Enforce linking with jemalloc

WIP: Disable internal malloc
WIP: Disable tuning large, enable tuning small
2021-12-09 18:15:17 +01:00 · 2021-12-09 18:15:17 +01:00 · 2021-12-09 18:15:17 +01:00 · 2021-12-09 13:33:56 +01:00 · 2021-12-09 10:07:19 +00:00 · 2021-12-09 10:47:56 +01:00
185 changed files with 2302 additions and 967 deletions
@@ -77,6 +77,9 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/rndc/include"))

+	       (expand-file-name "/usr/include/libxml2")
+	       (expand-file-name "/usr/include/json-c")
+	       
 	       (expand-file-name "/usr/local/opt/openssl@1.1/include")
 	       (expand-file-name "/usr/local/opt/libxml2/include/libxml2")
 	       (expand-file-name "/usr/local/opt/json-c/include/json-c/")
@@ -16,15 +16,15 @@ variables:
  TEST_PARALLEL_JOBS: 6

  CONFIGURE: ./configure
-  CLANG: clang-12
-  SCAN_BUILD: scan-build-12
-  ASAN_SYMBOLIZER_PATH: /usr/lib/llvm-12/bin/llvm-symbolizer
-  CLANG_FORMAT: clang-format-12
+  CLANG: clang-13
+  SCAN_BUILD: scan-build-13
+  ASAN_SYMBOLIZER_PATH: /usr/lib/llvm-13/bin/llvm-symbolizer
+  CLANG_FORMAT: clang-format-13

  CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls -O1 -g -Wall -Wextra 

  # Pass run-time flags to AddressSanitizer to get core dumps on error.
-  ASAN_OPTIONS_COMMON: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
+  ASAN_OPTIONS: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
  TSAN_OPTIONS_COMMON: "disable_coredump=0 second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=/usr/lib/llvm-12/bin/llvm-symbolizer"

  TARBALL_COMPRESSOR: xz
@@ -40,6 +40,13 @@ variables:
  BIND_STRESS_TEST_OS: linux
  BIND_STRESS_TEST_ARCH: amd64

+# Allow all running CI jobs to be automatically canceled when a new
+# version of a branch is pushed.
+#
+# See: https://docs.gitlab.com/ee/ci/pipelines/settings.html#auto-cancel-redundant-pipelines
+default:
+  interruptible: true
+
 stages:
  - precheck
  - build
@@ -121,6 +128,10 @@ stages:
  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64cross32"
  <<: *linux_amd64

+.debian-bullseye-amd64: &debian_bullseye_amd64_image
+  image: "$CI_REGISTRY_IMAGE:debian-bullseye-amd64"
+  <<: *linux_amd64
+
 .debian-sid-amd64: &debian_sid_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
  <<: *linux_amd64
@@ -178,7 +189,7 @@ stages:
  <<: *libvirt_amd64

 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-6.9-x86_64"
+  image: "openbsd-7.0-x86_64"
  <<: *libvirt_amd64

 ### Job Templates
@@ -466,7 +477,13 @@ clang-format:
  needs: []
  script:
    - if [ -r .clang-format ]; then "${CLANG_FORMAT}" -i -style=file $(git ls-files '*.c' '*.h'); fi
+    - git diff > clang-format.patch
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
+  artifacts:
+    paths:
+      - clang-format.patch
+    expire_in: "1 week"
+    when: on_failure

 coccinelle:
  <<: *precheck_job
@@ -495,7 +512,9 @@ flake8:
      artifacts: true
  script:
    - *configure
-    - flake8 --max-line-length=80 $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py)')
+    - flake8 --max-line-length=80 $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/)')
+      # Ignore Flake8 E402 error (module level import not at top of file) in system test to enable use of pytest.importorskip
+    - flake8 --max-line-length=80 --extend-ignore=E402 $(git ls-files 'bin/tests/system/*.py' | grep -vE 'ans\.py')

 pylint:
  <<: *default_triggering_rules
@@ -506,8 +525,10 @@ pylint:
      artifacts: true
  script:
    - *configure
-    - PYTHONPATH="$PYTHONPATH:$CI_PROJECT_DIR/bin/python"
-    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py)')
+    - export PYTHONPATH="$PYTHONPATH:$CI_PROJECT_DIR/bin/python"
+    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/)')
+      # Ignore Pylint wrong-import-position error in system test to enable use of pytest.importorskip
+    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc --disable=wrong-import-position $(git ls-files 'bin/tests/system/*.py' | grep -vE 'ans\.py')

 tarball-create:
  stage: precheck
@@ -647,10 +668,12 @@ gcc:stretch:amd64:
    EXTRA_CONFIGURE: "--without-gssapi"
  <<: *debian_stretch_amd64_image
  <<: *build_job
+  <<: *schedules_tags_web_triggering_rules

 system:gcc:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *system_test_job
+  <<: *schedules_tags_web_triggering_rules
  needs:
    - job: gcc:stretch:amd64
      artifacts: true
@@ -658,6 +681,7 @@ system:gcc:stretch:amd64:
 unit:gcc:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *unit_test_job
+  <<: *schedules_tags_web_triggering_rules
  needs:
    - job: gcc:stretch:amd64
      artifacts: true
@@ -687,6 +711,30 @@ unit:gcc:buster:amd64:
    - job: gcc:buster:amd64
      artifacts: true

+# Jobs for regular GCC builds on Debian 11 "bullseye" (amd64)
+
+gcc:bullseye:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -O2"
+    EXTRA_CONFIGURE: "--without-gssapi --with-libidn2"
+  <<: *debian_bullseye_amd64_image
+  <<: *build_job
+
+system:gcc:bullseye:amd64:
+  <<: *debian_bullseye_amd64_image
+  <<: *system_test_job
+  needs:
+    - job: gcc:bullseye:amd64
+      artifacts: true
+
+unit:gcc:bullseye:amd64:
+  <<: *debian_bullseye_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: gcc:bullseye:amd64
+      artifacts: true
+
 # Jobs for cross-compiled GCC builds on Debian 10 "buster" (amd64) with
 # 32-bit libraries

@@ -907,22 +955,18 @@ gcc:asan:
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *base_image
+  <<: *fedora_34_amd64_image
  <<: *build_job

 system:gcc:asan:
-  variables:
-    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
-  <<: *base_image
+  <<: *fedora_34_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:asan
      artifacts: true

 unit:gcc:asan:
-  variables:
-    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
-  <<: *base_image
+  <<: *fedora_34_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:asan
@@ -938,8 +982,6 @@ clang:asan:
  <<: *build_job

 system:clang:asan:
-  variables:
-    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
  <<: *base_image
  <<: *system_test_job
  needs:
@@ -947,8 +989,6 @@ system:clang:asan:
      artifacts: true

 unit:clang:asan:
-  variables:
-    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
  <<: *base_image
  <<: *unit_test_job
  needs:
@@ -958,18 +998,18 @@ unit:clang:asan:
 # Jobs for TSAN builds on Debian 10 "buster" (amd64)

 gcc:tsan:
-  <<: *base_image
-  <<: *build_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread -DISC_MEM_USE_INTERNAL_MALLOC=0"
    LDFLAGS: "-fsanitize=thread"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
+  <<: *fedora_34_amd64_image
+  <<: *build_job

 system:gcc:tsan:
  variables:
    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON}
-  <<: *base_image
+  <<: *fedora_34_amd64_image
  <<: *system_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -977,8 +1017,8 @@ system:gcc:tsan:

 unit:gcc:tsan:
  variables:
-    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON} suppressions=$CI_PROJECT_DIR/tsan-suppressions.txt
-  <<: *base_image
+    TSAN_OPTIONS: ${TSAN_OPTIONS_COMMON}
+  <<: *fedora_34_amd64_image
  <<: *unit_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -1,8 +1,9 @@
 [MASTER]
 disable=
+    C0103, # invalid-name
    C0114, # missing-module-docstring
    C0115, # missing-class-docstring
    C0116, # missing-function-docstring
+    C0209, # consider-using-f-string
+    C0415, # import-outside-toplevel
    R0801, # duplicate-code
-    C0103, # invalid-name
-    C0415,# import-outside-toplevel
@@ -1,22 +1,65 @@
-5727.	[bug]		Ignore the missing zones when doing a reload on a
-			catalog zone, and make sure to restore them later on.
-			[GL #2308]
+5776.	[bug]		Add a missing isc_condition_destroy() for nmsocket
+			condition variable and add missing isc_mutex_destroy()
+			for nmworker lock. [GL #3051]

-5724.	[bug]		Address potential dead lock when checking zone
-			content consistency. [GL #2908]
+5773.	[func]		Change the message when accepting TCP connection has
+			failed to say "Accepting TCP connection failed" and
+			change the log level for ISC_R_NOTCONNECTED, ISC_R_QUOTA
+			and ISC_R_SOFTQUOTA results codes from ERROR to INFO.
+			[GL #2700]

-5723.	[bug]		Backwards compatiblity for 'check-names master' and
-			'check-names slave' was accidentally broken. [GL #2911]
+5768.	[bug]		dnssec-dsfromkey failed to omit revoked keys. [GL #853]

-5720.	[contrib]	The DLZ drivers have been marked as deprecated and
-			will be removed in a future release. [GL #2814]
+5764.	[bug]		dns_sdlz_putrr failed to process some valid resource
+			records. [GL #3021]

-5719.	[func]		The "masterfile-format" format "map" has been marked
-			as deprecated.  The "map" format will be permanently
-			removed in a future release. [GL #2882]
+5762.	[bug]		Fix a "named" crash related to removing and restoring a
+			`catalog-zone` entry in the configuration file and
+			running `rndc reconfig`. [GL #1608]

-5717.	[func]		The "cache-file" option has been marked as
-			deprecated. [GL #2903]
+5758.	[bug]		mdig now honors the operating system's preferred
+			ephemeral port range. [GL #2374]
+
+5757.	[test]		Replace sed in nsupdate system test with awk to
+			construct the nsupdate command.  The sed expression
+			was not reliably changing the ttl. [GL #3003]
+
+	--- 9.16.23 released ---
+
+5752.	[bug]		Fix an assertion failure caused by missing member zones
+			during a reload of a catalog zone. [GL #2308]
+
+5750.	[bug]		Fix a bug when comparing two RSA keys. There was a typo
+			which caused the "p" prime factors to not being
+			compared. [GL #2972]
+
+5737.	[bug]		Address Coverity warning in lib/dns/dnssec.c.
+			[GL #2935]
+
+	--- 9.16.22 released ---
+
+5736.	[security]	The "lame-ttl" option is now forcibly set to 0. This
+			effectively disables the lame server cache, as it could
+			previously be abused by an attacker to significantly
+			degrade resolver performance. (CVE-2021-25219)
+			[GL #2899]
+
+5724.	[bug]		Address a potential deadlock when checking zone content
+			consistency. [GL #2908]
+
+5723.	[bug]		Change 5709 broke backward compatibility for the
+			"check-names master ..." and "check-names slave ..."
+			options. This has been fixed. [GL #2911]
+
+5720.	[contrib]	Old-style DLZ drivers that had to be enabled at
+			build-time have been marked as deprecated. [GL #2814]
+
+5719.	[func]		The "map" zone file format has been marked as
+			deprecated. [GL #2882]
+
+5717.	[func]		The "cache-file" option, which was documented as "for
+			testing purposes only" and not to be used, has been
+			removed. [GL #2903]

 5716.	[bug]		Multiple library names were mistakenly passed to the
 			krb5-config utility when ./configure was invoked with
@@ -24,20 +67,22 @@
 			has been fixed by invoking krb5-config separately for
 			each required library. [GL #2866]

-5715.	[func]		Add a check when the *-source(-v6) clashes with the
-			global listening port. Such a configuration was already
-			forbidden, but it failed silently. [GL #2888]
+5715.	[func]		Add a check for ports specified in "*-source(-v6)"
+			options clashing with a global listening port. Such a
+			configuration was already unsupported, but it failed
+			silently; it is now treated as an error. [GL #2888]

-5714.	[bug]		Remove the "adjust interface" mechanism that
-			set up a listener on interfaces where the *-source(-v6)
-			address and port were the same as the listening
-			address and port. Such a configuration is no longer
-			supported; in practice, this would disable
-			listening on TCP ports under certain timing conditions.
+5714.	[bug]		Remove the "adjust interface" mechanism which was
+			responsible for setting up listeners on interfaces when
+			the "*-source(-v6)" address and port were the same as
+			the "listen-on(-v6)" address and port. Such a
+			configuration is no longer supported; under certain
+			timing conditions, that mechanism could prevent named
+			from listening on some TCP ports. This has been fixed.
 			[GL #2852]

-5712.	[func]		Add deprecation notice about removing native PKCS#11
-			support in the next major BIND 9.18 release. [GL #2691]
+5712.	[doc]		Add deprecation notice about removing native PKCS#11
+			support in the next major BIND 9 release. [GL #2691]

 	--- 9.16.21 released ---

@@ -34,15 +34,15 @@ offer support on a "best effort" basis for some.

 Regularly tested platforms

-As of Nov 2020, BIND 9.16 is fully supported and regularly tested on the
+As of Oct 2021, BIND 9.16 is fully supported and regularly tested on the
 following systems:

-  * Debian 9, 10
+  * Debian 9, 10, 11
  * Ubuntu LTS 18.04, 20.04
  * Fedora 34
  * Red Hat Enterprise Linux / CentOS / Oracle Linux 7, 8
  * FreeBSD 11.4, 12.2, 13.0
-  * OpenBSD 6.9
+  * OpenBSD 7.0
  * Alpine Linux 3.14

 The amd64, i386, armhf and arm64 CPU architectures are all fully
@@ -42,15 +42,15 @@ offer support on a "best effort" basis for some.

 ### Regularly tested platforms

-As of Nov 2020, BIND 9.16 is fully supported and regularly tested on the
+As of Oct 2021, BIND 9.16 is fully supported and regularly tested on the
 following systems:

-* Debian 9, 10
+* Debian 9, 10, 11
 * Ubuntu LTS 18.04, 20.04
 * Fedora 34
 * Red Hat Enterprise Linux / CentOS / Oracle Linux 7, 8
 * FreeBSD 11.4, 12.2, 13.0
-* OpenBSD 6.9
+* OpenBSD 7.0
 * Alpine Linux 3.14

 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
@@ -127,18 +127,18 @@ struct dig_lookup {
 	isc_buffer_t	 namebuf;
 	isc_buffer_t	 onamebuf;
 	isc_buffer_t	 renderbuf;
-	char *		 sendspace;
-	dns_name_t *	 name;
+	char	     *sendspace;
+	dns_name_t	   *name;
 	isc_interval_t	 interval;
-	dns_message_t *	 sendmsg;
-	dns_name_t *	 oname;
+	dns_message_t   *sendmsg;
+	dns_name_t	   *oname;
 	ISC_LINK(dig_lookup_t) link;
 	ISC_LIST(dig_query_t) q;
 	ISC_LIST(dig_query_t) connecting;
-	dig_query_t *	  current_query;
+	dig_query_t	    *current_query;
 	dig_serverlist_t  my_server_list;
 	dig_searchlist_t *origin;
-	dig_query_t *	  xfr_q;
+	dig_query_t	    *xfr_q;
 	uint32_t	  retries;
 	int		  nsfound;
 	int16_t		  udpsize;
@@ -147,13 +147,13 @@ struct dig_lookup {
 	uint32_t	  ixfr_serial;
 	isc_buffer_t	  rdatabuf;
 	char		  rdatastore[MXNAME];
-	dst_context_t *	  tsigctx;
-	isc_buffer_t *	  querysig;
+	dst_context_t    *tsigctx;
+	isc_buffer_t     *querysig;
 	uint32_t	  msgcounter;
 	dns_fixedname_t	  fdomain;
-	isc_sockaddr_t *  ecs_addr;
-	char *		  cookie;
-	dns_ednsopt_t *	  ednsopts;
+	isc_sockaddr_t   *ecs_addr;
+	char	     *cookie;
+	dns_ednsopt_t    *ednsopts;
 	unsigned int	  ednsoptscnt;
 	isc_dscp_t	  dscp;
 	unsigned int	  ednsflags;
@@ -174,10 +174,10 @@ struct dig_query {
 	uint32_t      msg_count;
 	uint32_t      rr_count;
 	bool	      ixfr_axfr;
-	char *	      servname;
-	char *	      userarg;
+	char	     *servname;
+	char	     *userarg;
 	isc_buffer_t  recvbuf, lengthbuf, tmpsendbuf, sendbuf;
-	char *	      recvspace, *tmpsendspace, lengthspace[4];
+	char	     *recvspace, *tmpsendspace, lengthspace[4];
 	isc_socket_t *sock;
 	ISC_LINK(dig_query_t) link;
 	ISC_LINK(dig_query_t) clink;
@@ -185,7 +185,7 @@ struct dig_query {
 	isc_time_t     time_sent;
 	isc_time_t     time_recv;
 	uint64_t       byte_count;
-	isc_timer_t *  timer;
+	isc_timer_t   *timer;
 };

 struct dig_server {
@@ -215,7 +215,7 @@ extern bool check_ra, have_ipv4, have_ipv6, specified_source, usesearch,
 	showsearch, yaml;
 extern in_port_t	 port;
 extern unsigned int	 timeout;
-extern isc_mem_t *	 mctx;
+extern isc_mem_t	 *mctx;
 extern int		 sendcount;
 extern int		 ndots;
 extern int		 lookup_counter;
@@ -226,10 +226,10 @@ extern char		 keyfile[MXNAME];
 extern char		 keysecret[MXNAME];
 extern const dns_name_t *hmacname;
 extern unsigned int	 digestbits;
-extern dns_tsigkey_t *	 tsigkey;
+extern dns_tsigkey_t    *tsigkey;
 extern bool		 validated;
-extern isc_taskmgr_t *	 taskmgr;
-extern isc_task_t *	 global_task;
+extern isc_taskmgr_t    *taskmgr;
+extern isc_task_t	  *global_task;
 extern bool		 free_now;
 extern bool		 debugging, debugtiming, memdebugging;
 extern bool		 keep_open;
@@ -337,7 +337,7 @@ set_search_domain(char *domain);
 * Routines to be defined in dig.c, host.c, and nslookup.c. and
 * then assigned to the appropriate function pointer
 */
-extern isc_result_t (*dighost_printmessage)(dig_query_t *	query,
+extern isc_result_t (*dighost_printmessage)(dig_query_t	*query,
 					    const isc_buffer_t *msgbuf,
 					    dns_message_t *msg, bool headers);

@@ -262,6 +262,10 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
 		fatal("can't convert DNSKEY");
 	}

+	if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) {
+		return;
+	}
+
 	if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && !showall) {
 		return;
 	}
@@ -43,6 +43,10 @@ Description
 The ``dnssec-dsfromkey`` command outputs DS (Delegation Signer) resource records
 (RRs), or CDS (Child DS) RRs with the ``-C`` option.

+By default, only KSKs are converted (keys with flags = 257).  The
+``-A`` option includes ZSKs (flags = 256).  Revoked keys are never
+included.
+
 The input keys can be specified in a number of ways:

 By default, ``dnssec-dsfromkey`` reads a key file named in the format
@@ -48,33 +48,28 @@ options {\n\
 	answer-cookie true;\n\
 	automatic-interface-scan yes;\n\
 	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
-#	blackhole {none;};\n"
-			    "	cookie-algorithm siphash24;\n"
+#	blackhole {none;};\n\
+	cookie-algorithm siphash24;\n"
 #ifndef WIN32
 			    "	coresize default;\n\
 	datasize default;\n"
 #endif /* ifndef WIN32 */
 			    "\
-#	deallocate-on-exit <obsolete>;\n\
 #	directory <none>\n\
 	dnssec-policy \"none\";\n\
 	dump-file \"named_dump.db\";\n\
-	edns-udp-size 1232;\n\
-#	fake-iquery <obsolete>;\n"
+	edns-udp-size 1232;\n"
 #ifndef WIN32
 			    "	files unlimited;\n"
 #endif /* ifndef WIN32 */
 #if defined(HAVE_GEOIP2) && !defined(WIN32)
-			    "	geoip-directory \"" MAXMINDDB_PREFIX "/share/"
-			    "GeoIP\";"
-			    "\n"
+			    "	geoip-directory \"" MAXMINDDB_PREFIX
+			    "/share/GeoIP\";\n"
 #elif defined(HAVE_GEOIP2)
 			    "	geoip-directory \".\";\n"
 #endif /* if defined(HAVE_GEOIP2) && !defined(WIN32) */
 			    "\
-#	has-old-clients <obsolete>;\n\
 	heartbeat-interval 60;\n\
-#	host-statistics <obsolete>;\n\
 	interface-interval 60;\n\
 #	keep-response-order {none;};\n\
 	listen-on {any;};\n\
@@ -85,8 +80,6 @@ options {\n\
 	max-rsa-exponent-size 0; /* no limit */\n\
 	max-udp-size 1232;\n\
 	memstatistics-file \"named.memstats\";\n\
-#	multiple-cnames <obsolete>;\n\
-#	named-xfer <obsolete>;\n\
 	nocookie-udp-size 4096;\n\
 	notify-rate 20;\n\
 	nta-lifetime 3600;\n\
@@ -102,7 +95,6 @@ options {\n\
 	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
-#	serial-queries <obsolete>;\n\
 	serial-query-rate 20;\n\
 	server-id none;\n\
 	session-keyalg hmac-sha256;\n\
@@ -113,7 +105,6 @@ options {\n\
 #endif /* ifndef WIN32 */
 			    "	startup-notify-rate 20;\n\
 	statistics-file \"named.stats\";\n\
-#	statistics-interval <obsolete>;\n\
 	tcp-advertised-timeout 300;\n\
 	tcp-clients 150;\n\
 	tcp-idle-timeout 300;\n\
@@ -127,10 +118,7 @@ options {\n\
 	transfers-in 10;\n\
 	transfers-out 10;\n\
 	transfers-per-ns 2;\n\
-#	treat-cr-as-space <obsolete>;\n\
 	trust-anchor-telemetry yes;\n\
-#	use-id-pool <obsolete>;\n\
-#	use-ixfr <obsolete>;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
@@ -140,7 +128,6 @@ options {\n\
 	allow-recursion { localnets; localhost; };\n\
 	allow-recursion-on { any; };\n\
 	allow-update-forwarding {none;};\n\
-#	allow-v6-synthesis <obsolete>;\n\
 	auth-nxdomain false;\n\
 	check-dup-records warn;\n\
 	check-mx warn;\n\
@@ -155,12 +142,11 @@ options {\n\
 			    "	dnstap-identity hostname;\n"
 #endif /* ifdef HAVE_DNSTAP */
 			    "\
-#	fetch-glue <obsolete>;\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
 	fetches-per-zone 0;\n\
 	glue-cache yes;\n\
-	lame-ttl 600;\n"
+	lame-ttl 0;\n"
 #ifdef HAVE_LMDB
 			    "	lmdb-mapsize 32M;\n"
 #endif /* ifdef HAVE_LMDB */
@@ -174,7 +160,6 @@ options {\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
 	min-cache-ttl 0; /* 0 seconds */\n\
-#	min-roots <obsolete>;\n\
 	minimal-any false;\n\
 	minimal-responses no-auth-recursive;\n\
 	notify-source *;\n\
@@ -192,7 +177,6 @@ options {\n\
 	require-server-cookie no;\n\
 	resolver-nonbackoff-tries 3;\n\
 	resolver-retry-interval 800; /* in milliseconds */\n\
-#	rfc2308-type1 <obsolete>;\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
 #	sortlist <none>\n\
@@ -228,8 +212,6 @@ options {\n\
 #	forwarders <none>\n\
 #	inline-signing no;\n\
 	ixfr-from-differences false;\n\
-#	maintain-ixfr-base <obsolete>;\n\
-#	max-ixfr-log-size <obsolete>\n\
 	max-journal-size default;\n\
 	max-records 0;\n\
 	max-refresh-time 2419200; /* 4 weeks */\n\
@@ -299,14 +281,14 @@ view \"_bind\" chaos {\n\
 			    "#\n\
 #  Default trusted key(s), used if \n\
 # \"dnssec-validation auto;\" is set and\n\
-#  sysconfdir/bind.keys doesn't exist).\n\
+#  " NAMED_SYSCONFDIR "/bind.keys doesn't exist).\n\
 #\n\
-# BEGIN DNSSEC KEYS\n"
+# BEGIN TRUST ANCHORS\n"

 	/* Imported from bind.keys.h: */
 	TRUST_ANCHORS

-			    "# END MANAGED KEYS\n\
+			    "# END TRUST ANCHORS\n\
 \n\
 primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
 	2001:500:200::b;	# b.root-servers.net\n\
@@ -45,10 +45,10 @@
 #define NAMED_RUN_PID_DIR 1
 #endif /* ifndef NAMED_RUN_PID_DIR */

-EXTERN isc_mem_t *named_g_mctx	    INIT(NULL);
-EXTERN unsigned int named_g_cpus    INIT(0);
-EXTERN unsigned int named_g_udpdisp INIT(0);
-EXTERN isc_taskmgr_t *named_g_taskmgr INIT(NULL);
+EXTERN isc_mem_t *named_g_mctx		      INIT(NULL);
+EXTERN unsigned int named_g_cpus	      INIT(0);
+EXTERN unsigned int named_g_udpdisp	      INIT(0);
+EXTERN isc_taskmgr_t *named_g_taskmgr	      INIT(NULL);
 EXTERN dns_dispatchmgr_t *named_g_dispatchmgr INIT(NULL);
 EXTERN unsigned int named_g_cpus_detected     INIT(1);

@@ -60,42 +60,42 @@ EXTERN bool named_g_run_done INIT(false);
 *         for really short timers, another for client timers, and one
 *         for zone timers.
 */
-EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
+EXTERN isc_timermgr_t *named_g_timermgr	  INIT(NULL);
 EXTERN isc_socketmgr_t *named_g_socketmgr INIT(NULL);
-EXTERN isc_nm_t *named_g_nm INIT(NULL);
-EXTERN cfg_parser_t *named_g_parser INIT(NULL);
-EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
-EXTERN const char *named_g_version     INIT(VERSION);
-EXTERN const char *named_g_product     INIT(PRODUCT);
-EXTERN const char *named_g_description INIT(DESCRIPTION);
-EXTERN const char *named_g_srcid       INIT(SRCID);
-EXTERN const char *named_g_configargs  INIT(CONFIGARGS);
-EXTERN const char *named_g_builder     INIT(BUILDER);
-EXTERN in_port_t named_g_port	       INIT(0);
-EXTERN isc_dscp_t named_g_dscp	       INIT(-1);
+EXTERN isc_nm_t *named_g_nm		  INIT(NULL);
+EXTERN cfg_parser_t *named_g_parser	  INIT(NULL);
+EXTERN cfg_parser_t *named_g_addparser	  INIT(NULL);
+EXTERN const char *named_g_version	  INIT(VERSION);
+EXTERN const char *named_g_product	  INIT(PRODUCT);
+EXTERN const char *named_g_description	  INIT(DESCRIPTION);
+EXTERN const char *named_g_srcid	  INIT(SRCID);
+EXTERN const char *named_g_configargs	  INIT(CONFIGARGS);
+EXTERN const char *named_g_builder	  INIT(BUILDER);
+EXTERN in_port_t named_g_port		  INIT(0);
+EXTERN isc_dscp_t named_g_dscp		  INIT(-1);

 EXTERN named_server_t *named_g_server INIT(NULL);

 /*
 * Logging.
 */
-EXTERN isc_log_t *named_g_lctx INIT(NULL);
+EXTERN isc_log_t *named_g_lctx		     INIT(NULL);
 EXTERN isc_logcategory_t *named_g_categories INIT(NULL);
-EXTERN isc_logmodule_t *named_g_modules INIT(NULL);
-EXTERN unsigned int named_g_debuglevel	INIT(0);
+EXTERN isc_logmodule_t *named_g_modules	     INIT(NULL);
+EXTERN unsigned int named_g_debuglevel	     INIT(0);

 /*
 * Current configuration information.
 */
-EXTERN cfg_obj_t *named_g_config INIT(NULL);
+EXTERN cfg_obj_t *named_g_config	   INIT(NULL);
 EXTERN const cfg_obj_t *named_g_defaults   INIT(NULL);
 EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
 EXTERN const char *named_g_defaultbindkeys INIT(NAMED_SYSCONFDIR "/bind.keys");
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");

-EXTERN dns_tsigkey_t *named_g_sessionkey INIT(NULL);
-EXTERN dns_name_t			 named_g_sessionkeyname;
-EXTERN bool named_g_conffileset		 INIT(false);
+EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
+EXTERN dns_name_t			    named_g_sessionkeyname;
+EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);

 /*
@@ -46,7 +46,7 @@
 */
 struct named_server {
 	unsigned int magic;
-	isc_mem_t *  mctx;
+	isc_mem_t	  *mctx;

 	ns_server_t *sctx;

@@ -67,12 +67,12 @@ struct named_server {
 			     * */

 	/* Server data structures. */
-	dns_loadmgr_t *	   loadmgr;
-	dns_zonemgr_t *	   zonemgr;
+	dns_loadmgr_t     *loadmgr;
+	dns_zonemgr_t     *zonemgr;
 	dns_viewlist_t	   viewlist;
 	dns_kasplist_t	   kasplist;
 	ns_interfacemgr_t *interfacemgr;
-	dns_db_t *	   in_roothints;
+	dns_db_t		 *in_roothints;

 	isc_timer_t *interface_timer;
 	isc_timer_t *heartbeat_timer;
@@ -94,15 +94,15 @@ struct named_server {
 	isc_stats_t *resolverstats;  /*% Resolver stats */
 	isc_stats_t *sockstats;	     /*%< Socket stats */

-	named_controls_t *   controls; /*%< Control channels */
+	named_controls_t	 *controls; /*%< Control channels */
 	unsigned int	     dispatchgen;
 	named_dispatchlist_t dispatches;

 	named_statschannellist_t statschannels;

 	dns_tsigkey_t *sessionkey;
-	char *	       session_keyfile;
-	dns_name_t *   session_keyname;
+	char	     *session_keyfile;
+	dns_name_t	   *session_keyname;
 	unsigned int   session_keyalg;
 	uint16_t       session_keybits;
 	bool	       interface_auto;
@@ -4759,8 +4759,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	result = named_config_get(maps, "lame-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	lame_ttl = cfg_obj_asduration(obj);
-	if (lame_ttl > 1800) {
-		lame_ttl = 1800;
+	if (lame_ttl > 0) {
+		cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
+			    "disabling lame cache despite lame-ttl > 0 as it "
+			    "may cause performance issues");
+		lame_ttl = 0;
 	}
 	dns_resolver_setlamettl(view->resolver, lame_ttl);

@@ -6520,6 +6523,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,

 	if (zone_is_catz) {
 		dns_zone_catz_enable(zone, view->catzs);
+	} else if (dns_zone_catz_is_enabled(zone)) {
+		dns_zone_catz_disable(zone);
 	}

 	/*
@@ -370,11 +370,24 @@ Currently supported commands are:
   avoids the need to examine the modification times of the zone files.

 ``recursing``
-   This command dumps the list of queries ``named`` is currently recursing on, and the
-   list of domains to which iterative queries are currently being sent.
-   The second list includes the number of fetches currently active for
-   the given domain, and how many have been passed or dropped because of
-   the ``fetches-per-zone`` option.
+   This command dumps the list of queries ``named`` is currently
+   recursing on, and the list of domains to which iterative queries
+   are currently being sent.
+
+   The first list includes all unique clients that are waiting for
+   recursion to complete, including the query that is awaiting a
+   response and the timestamp (seconds since the Unix epoch) of
+   when named started processing this client query.
+
+   The second list comprises of domains for which there are active
+   (or recently active) fetches in progress.  It reports the number
+   of active fetches for each domain and the number of queries that
+   have been passed (allowed) or dropped (spilled) as a result of
+   the ``fetches-per-zone`` limit.  (Note: these counters are not
+   cumulative over time; whenever the number of active fetches for
+   a domain drops to zero, the counter for that domain is deleted,
+   and the next time a fetch is sent to that domain, it is recreated
+   with the counters set to zero).

 ``refresh`` *zone* [*class* [*view*]]
   This command schedules zone maintenance for the given zone.
@@ -1,4 +1,5 @@
 .cache
+.hypothesis
 __pycache__
 dig.out*
 rndc.out*
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { fd92:7065:b8e:ffff::2; };
+	notify no;
+	recursion no;
+	serial-query-rate 100;
+	# removed catalog-zone option, otherwise this is
+	# identical to named1.conf.in
+};
+
+zone "catalog1.example" {
+	type secondary;
+	file "catalog1.example.db";
+	primaries { 10.53.0.1; };
+};
+
+zone "catalog2.example" {
+	type secondary;
+	file "catalog2.example.db";
+	primaries { 10.53.0.3; };
+};
+
+zone "catalog3.example" {
+	type secondary;
+	file "catalog3.example.db";
+	primaries { 10.53.0.1; };
+};
+
+zone "catalog4.example" {
+	type secondary;
+	file "catalog4.example.db";
+	primaries { 10.53.0.1; };
+};
+
+key tsig_key. {
+	secret "LSAnCU+Z";
+	algorithm hmac-md5;
+};
@@ -15,7 +15,7 @@ SYSTEMTESTTOP=..
 $SHELL clean.sh

 copy_setports ns1/named.conf.in ns1/named.conf
-copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns2/named1.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf

 cp -f ns1/catalog.example.db.in ns1/catalog1.example.db
@@ -175,6 +175,56 @@ test -f ns2/zonedir/__catz___default_catalog1.example_dom1.example.db.jnl || ret
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

+n=$((n+1))
+echo_i "update catalog zone serial ($n)"
+ret=0
+# default minimum update rate is once / 5 seconds
+sleep 5
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add catalog1.example 3600 SOA . . 20 86400 3600 86400 3600
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "wait for catalog zone to transfer ($n)"
+ret=0
+wait_for_soa_equal_20() {
+	dig_with_opts @10.53.0.2 SOA catalog1.example. > dig.out.test$n || return 1
+	grep "ANSWER: 1," dig.out.test$n > /dev/null || return 1
+	grep "status: NOERROR" dig.out.test$n > /dev/null || return 1
+	grep 'IN.SOA.\. \. 20 ' dig.out.test$n > /dev/null || return 1
+}
+retry_quiet 10 wait_for_soa_equal_20 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "update dom1.example. again ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+   server 10.53.0.1 ${PORT}
+   update add foo.dom1.example 0 IN TXT added record
+   send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "wait for secondary to be updated again ($n)"
+ret=0
+wait_for_txt() {
+	dig_with_opts @10.53.0.2 TXT foo.dom1.example. > dig.out.test$n || return 1
+	grep "ANSWER: 2," dig.out.test$n > /dev/null || return 1
+	grep "status: NOERROR" dig.out.test$n > /dev/null || return 1
+	grep "IN.TXT." dig.out.test$n > /dev/null || return 1
+}
+retry_quiet 10 wait_for_txt || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 n=$((n+1))
 echo_i "removing domain dom1.example. from catalog1 zone ($n)"
 ret=0
@@ -1129,7 +1179,7 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "reconfiguring secondary - adding catalog4 catalog zone ($n)"
 ret=0
-sed -e "s/^#T1//g" <  ns2/named.conf.in > ns2/named.conf.tmp
+sed -e "s/^#T1//g" <  ns2/named1.conf.in > ns2/named.conf.tmp
 copy_setports ns2/named.conf.tmp ns2/named.conf
 rndccmd 10.53.0.2 reconfig || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -1160,7 +1210,7 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "reconfiguring secondary - removing catalog4 catalog zone, adding non-existent catalog5 catalog zone ($n)"
 ret=0
-sed -e "s/^#T2//" < ns2/named.conf.in > ns2/named.conf.tmp
+sed -e "s/^#T2//" < ns2/named1.conf.in > ns2/named.conf.tmp
 copy_setports ns2/named.conf.tmp ns2/named.conf
 $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig > /dev/null 2>&1 && ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -1169,7 +1219,7 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "reconfiguring secondary - removing non-existent catalog5 catalog zone ($n)"
 ret=0
-copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns2/named1.conf.in ns2/named.conf
 rndccmd 10.53.0.2 reconfig || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -1680,5 +1730,15 @@ wait_for_no_soa @10.53.0.2 dom16.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

+n=$((n+1))
+echo_i "checking that reconfig can delete and restore catalog zone configuration ($n)"
+ret=0
+copy_setports ns2/named2.conf.in ns2/named.conf
+rndccmd 10.53.0.2 reconfig || ret=1
+copy_setports ns2/named1.conf.in ns2/named.conf
+rndccmd 10.53.0.2 reconfig || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -22,4 +22,4 @@ while (<>) {
 die "missing notbefore time" unless $notbefore;
 die "missing inception time" unless $inception;
 my $delta = $inception - $notbefore;
-die "bad inception time $delta" unless abs($delta - $target) < 3;
+die "bad inception time $delta" unless abs($delta - $target) <= 3;
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	avoid-v4-udp-ports { 100; }
-	avoid-v6-udp-ports { 100; };
-	blackhole { 10.0.0.0/8; };
-	coresize 1G;
-	datasize 100M;
-	deallocate-on-exit yes;
-	directory ".";
-	dump-file "named_dumpdb";
-	fake-iquery yes;
-	files 1000;
-	has-old-clients no;
-	heartbeat-interval 30;
-	host-statistics yes;
-	host-statistics-max 100;
-	hostname none;
-	interface-interval 30;
-	keep-response-order { 10.0.0.10/24; };
-	listen-on port 90 { any; };
-	listen-on port 100 { 127.0.0.1; };
-	listen-on-v6 port 53 { none; };
-	match-mapped-addresses yes;
-	memstatistics-file "named.memstats";
-	multiple-cnames no;
-	named-xfer "this is no longer needed";
-	pid-file none;
-	port 5300;
-	querylog yes;
-	recursing-file "named.recursing";
-	recursive-clients 3000;
-	serial-queries 10;
-	serial-query-rate 100;
-	server-id none;
-};
@@ -21,5 +21,4 @@ rm -f ns*/keygen.out.* ns*/settime.out.* ns*/signer.out.*
 rm -f ns*/managed-keys.bind*
 rm -f ns*/*.mkeys
 rm -f ns*/zones
-rm -f tests-checkds.py.status
 rm -f *.checkds.out
@@ -1076,7 +1076,7 @@ if [ -x "$MDIG" ] ; then
    n=$((n+1))
    echo_i "check mdig +yaml output ($n)"
    ret=0
-    mdig_with_opts +yaml @10.53.0.3 -t any ns2.example > dig.out.test$n 2>&1 || ret=1
+    mdig_with_opts +yaml @10.53.0.3 -t any ns2.example > dig.out.test$n || ret=1
    value=$($PYTHON yamlget.py dig.out.test$n 0 message response_message_data status || ret=1)
    [ "$value" = "NOERROR" ] || ret=1
    value=$($PYTHON yamlget.py dig.out.test$n 0 message response_message_data QUESTION_SECTION 0 || ret=1)
@@ -1326,7 +1326,7 @@ if [ -x "$DELV" ] ; then
    n=$((n+1))
    echo_i "check delv +yaml output ($n)"
    ret=0
-    delv_with_opts +yaml @10.53.0.3 any ns2.example > delv.out.test$n 2>&1 || ret=1
+    delv_with_opts +yaml @10.53.0.3 any ns2.example > delv.out.test$n || ret=1
    value=$($PYTHON yamlget.py delv.out.test$n status || ret=1)
    [ "$value" = "success" ] || ret=1
    value=$($PYTHON yamlget.py delv.out.test$n query_name || ret=1)
@@ -238,10 +238,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 	struct dlz_example_data *state;
 	const char *helper_name;
 	va_list ap;
-	char soa_data[1024];
-	const char *extra;
+	char soa_data[sizeof("@ hostmaster.root 123 900 600 86400 3600")];
 	isc_result_t result;
-	int n;
+	size_t n;

 	UNUSED(dlzname);

@@ -275,19 +274,19 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[], void **dbdata,
 		sprintf(state->zone_name, "%s.", argv[1]);
 	}

+	/*
+	 * Use relative names to trigger ISC_R_NOSPACE in dns_sdlz_putrr.
+	 */
 	if (strcmp(state->zone_name, ".") == 0) {
-		extra = ".root";
+		n = strlcpy(soa_data,
+			    "@ hostmaster.root 123 900 600 86400 3600",
+			    sizeof(soa_data));
 	} else {
-		extra = ".";
+		n = strlcpy(soa_data, "@ hostmaster 123 900 600 86400 3600",
+			    sizeof(soa_data));
 	}

-	n = sprintf(soa_data, "%s hostmaster%s%s 123 900 600 86400 3600",
-		    state->zone_name, extra, state->zone_name);
-
-	if (n < 0) {
-		CHECK(ISC_R_FAILURE);
-	}
-	if ((unsigned)n >= sizeof(soa_data)) {
+	if (n >= sizeof(soa_data)) {
 		CHECK(ISC_R_NOSPACE);
 	}

@@ -21,6 +21,11 @@ dlz "example three" {
 	database "dlopen ../driver.@SO@ example.org";
 };

+dlz "example four" {
+        // Long zone name to trigger ISC_R_NOSPACE in dns_sdlz_putrr.
+        database "dlopen ../driver.@SO@ 123456789.123456789.123456789.123456789.123456789.example.foo";
+};
+
 dlz "unsearched1" {
 	database "dlopen ../driver.@SO@ other.nil";
 	search no;
@@ -2881,6 +2881,18 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

+echo_i "check dnssec-dsfromkey with revoked key ($n)"
+ret=0
+dig_with_opts revkey.example dnskey @10.53.0.4 > dig.out.ns4.test$n || ret=1
+grep "DNSKEY.256 3 13" dig.out.ns4.test$n > /dev/null || ret=1	# ZSK
+grep "DNSKEY.385 3 13" dig.out.ns4.test$n > /dev/null || ret=1	# revoked KSK
+grep "DNSKEY.257 3 13" dig.out.ns4.test$n > /dev/null || ret=1	# KSK
+test $(awk '$4 == "DNSKEY" { print }' dig.out.ns4.test$n | wc -l) -eq 3 || ret=1
+$DSFROMKEY -f dig.out.ns4.test$n revkey.example. > dsfromkey.out.test$n || ret=1
+test $(wc -l < dsfromkey.out.test$n) -eq 1 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+
 echo_i "testing soon-to-expire RRSIGs without a replacement private key ($n)"
 ret=0
 dig_with_answeropts +nottlid expiring.example ns @10.53.0.3 | grep RRSIG > dig.out.ns3.test$n 2>&1
@@ -63,4 +63,5 @@ rm -f perl.update_test.out
 rm -f nsupdate.out*
 rm -f typelist.out.*
 rm -f update.out.*
+rm -f update.in.*
 rm -f verylarge
@@ -751,9 +751,10 @@ ret=0
 echo_i "check that changes to the DNSKEY RRset TTL do not have side effects ($n)"
 $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd dnskey.test. \
        @10.53.0.3 dnskey | \
-	sed -n 's/\(.*\)10.IN/update add \1600 IN/p' |
-	(echo server 10.53.0.3 ${PORT}; cat - ; echo send ) |
-$NSUPDATE
+	awk -v port="${PORT}" 'BEGIN { print "server 10.53.0.3", port; }
+	$2 == 10 && $3 == "IN" && $4 == "DNSKEY" { $2 = 600; print "update add", $0 }
+	END { print "send" }' > update.in.$n
+$NSUPDATE update.in.$n

 $DIG $DIGOPTS +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd dnskey.test. \
 	@10.53.0.3 any > dig.out.ns3.$n
@@ -18,7 +18,7 @@ CLEANQL="rm -f ans*/query.log"
 status=0
 n=0

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .good is not minimized when qname-minimization is off ($n)"
 ret=0
 $CLEANQL
@@ -38,9 +38,9 @@ echo "ADDR icky.icky.icky.ptang.zoop.boing.good." | $DIFF ans3/query.log - > /de
 echo "ADDR icky.icky.icky.ptang.zoop.boing.good." | $DIFF ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .bad is not minimized when qname-minimization is off ($n)"
 ret=0
 $CLEANQL
@@ -60,9 +60,9 @@ echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | $DIFF ans3/query.log - > /dev
 echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | $DIFF ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .slow is not minimized when qname-minimization is off ($n)"
 ret=0
 $CLEANQL
@@ -83,9 +83,9 @@ echo "ADDR icky.icky.icky.ptang.zoop.boing.slow." | $DIFF ans3/query.log - > /de
 echo "ADDR icky.icky.icky.ptang.zoop.boing.slow." | $DIFF ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .ugly is not minimized when qname-minimization is off ($n)"
 ret=0
 $CLEANQL
@@ -106,9 +106,9 @@ echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans3/query.log - > /de
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .good is properly minimized when qname-minimization is in strict mode ($n)"
 ret=0
 $CLEANQL
@@ -140,9 +140,9 @@ ADDR icky.icky.icky.ptang.zoop.boing.good.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .good is properly minimized when qname-minimization is in relaxed mode ($n)"
 ret=0
 $CLEANQL
@@ -171,9 +171,9 @@ ADDR icky.icky.icky.ptang.zoop.boing.good.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .bad fails when qname-minimization is in strict mode ($n)"
 ret=0
 $CLEANQL
@@ -189,9 +189,9 @@ NS boing.bad.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .bad succeeds when qname-minimization is in relaxed mode ($n)"
 ret=0
 $CLEANQL
@@ -220,9 +220,9 @@ ADDR icky.icky.icky.ptang.zoop.boing.bad.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .ugly fails when qname-minimization is in strict mode ($n)"
 ret=0
 $CLEANQL
@@ -239,10 +239,10 @@ NS ugly.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 $RNDCCMD 10.53.0.6 flush

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .ugly succeeds when qname-minimization is in relaxed mode ($n)"
 ret=0
 $CLEANQL
@@ -253,7 +253,7 @@ grep "icky.icky.icky.ptang.zoop.boing.ugly. 1	IN A	192.0.2.1" dig.out.test$n > /
 sleep 1

 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || cat ans2/query.log.sorted
+cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
 ADDR _.boing.ugly.
 ADDR _.boing.ugly.
 ADDR a.bit.longer.ns.name.ugly.
@@ -267,17 +267,17 @@ echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans3/query.log - > /de
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans4/query.log - > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 $RNDCCMD 10.53.0.7 flush

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "information that minimization was unsuccessful for .ugly is logged ($n)"
 ret=0
 grep "success resolving 'icky.icky.icky.ptang.zoop.boing.ugly/A' after disabling qname minimization due to 'FORMERR'" ns7/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .slow is properly minimized when qname-minimization is on ($n)"
 ret=0
 $CLEANQL
@@ -309,9 +309,9 @@ ADDR icky.icky.icky.ptang.zoop.boing.slow.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .ip6.arpa succeeds and skips on proper boundaries when qname-minimization is on ($n)"
 ret=0
 $CLEANQL
@@ -331,9 +331,9 @@ PTR 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.f.4.0.1.0.0.2.ip6.arpa.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for multiple label name skips after 7th label ($n)"
 ret=0
 $CLEANQL
@@ -366,9 +366,9 @@ ADDR more.icky.icky.icky.ptang.zoop.boing.good.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "qname minimization is disabled when forwarding ($n)"
 ret=0
 $CLEANQL
@@ -382,9 +382,9 @@ ADDR a.bit.longer.ns.name.fwd.
 __EOF
 for ans in ans2; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "qname minimization resolves unusual ip6.arpa. names ($n)"
 ret=0
 $CLEANQL
@@ -396,7 +396,7 @@ grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep 'ip6\.arpa.*TXT.*long_ip6_name' dig.out.test$n > /dev/null || ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 # Below are test cases for GL #2665: The QNAME minimization (if enabled) should
 # also occur on the second query, after the RRsets have expired from cache.
@@ -405,7 +405,7 @@ status=`expr $status + $ret`
 # We query for the test domain a.b.stale. in all cases (QNAME minimization off,
 # strict mode, and relaxed mode) and expect it to behave the same the second
 # time when we have a stale delegation structure in cache.
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .stale is not minimized when qname-minimization is off ($n)"
 ret=0
 $CLEANQL
@@ -419,9 +419,9 @@ echo "TXT a.b.stale." | $DIFF ans3/query.log - > /dev/null || ret=1
 test -f  ans4/query.log && ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .stale is properly minimized when qname-minimization is in strict mode ($n)"
 ret=0
 $CLEANQL
@@ -446,9 +446,9 @@ TXT a.b.stale.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .stale is properly minimized when qname-minimization is in relaxed mode ($n)"
 ret=0
 $CLEANQL
@@ -471,12 +471,12 @@ TXT a.b.stale.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 echo_i "sleep 2, allow entries in cache to go stale"
 sleep 2

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .stale is not minimized when qname-minimization is off (stale cache) ($n)"
 ret=0
 $CLEANQL
@@ -489,9 +489,9 @@ echo "TXT a.b.stale." | $DIFF ans3/query.log - > /dev/null || ret=1
 test -f  ans4/query.log && ret=1
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .stale is properly minimized when qname-minimization is in strict mode (stale cache) ($n)"
 ret=0
 $CLEANQL
@@ -512,9 +512,9 @@ TXT a.b.stale.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "query for .stale is properly minimized when qname-minimization is in relaxed mode (stale cache) ($n)"
 ret=0
 $CLEANQL
@@ -533,7 +533,7 @@ TXT a.b.stale.
 __EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -228,6 +228,7 @@ if [ $status -eq 0 ]; then
    if [ -n "$PYTEST" ]; then
        run=$((run+1))
        for test in $(cd "${systest}" && find . -name "tests*.py"); do
+            rm -f "$systest/$test.status"
            if start_servers; then
                rm -f "$systest/$test.status"
                test_status=0
@@ -243,6 +244,7 @@ if [ $status -eq 0 ]; then
                break
            fi
        done
+        rm -f "$systest/$test.status"
    else
        echoinfo "I:$systest:pytest not installed, skipping python tests"
    fi
@@ -14,4 +14,3 @@ rm -f ns*/rpz*.txt
 rm -f */named.conf
 rm -f */named.run
 rm -rf __pycache__
-rm -f *.status
@@ -91,7 +91,11 @@ $DIGCMD +tries=2 +time=1 +recurse @10.53.0.3 foo.info. any > /dev/null 2>&1

 ret=0
 echo_i "dumping updated stats for ns3 ($n)"
-rndc_stats ns3 10.53.0.3 || ret=1
+getstats() {
+    rndc_stats ns3 10.53.0.3 || return 1
+    grep "2 recursing clients" $last_stats > /dev/null || return 1
+}
+retry_quiet 5 getstats || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`
@@ -137,6 +141,13 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`

+ret=0
+echo_i "checking priming queries are counted ($n)"
+grep "priming queries" $last_stats > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+n=`expr $n + 1`
+
 ret=0
 echo_i "checking that zones with slash are properly shown in XML output ($n)"
 if $FEATURETEST --have-libxml2 && [ -x ${CURL} ] ; then
@@ -239,13 +250,6 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`

-ret=0
-echo_i "checking priming queries are counted ($n)"
-grep "1 priming queries" $last_stats
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-n=`expr $n + 1`
-
 echo_i "Check that 'zone-statistics full;' is processed by 'rndc reconfig' ($n)"
 ret=0
 # off by default
@@ -12,6 +12,8 @@

 from datetime import datetime

+import os
+
 import pytest
 import requests

@@ -72,6 +74,8 @@ def load_zone_json(zone):

@pytest.mark.json
@pytest.mark.requests
+@pytest.mark.skipif(os.getenv("HAVEJSONSTATS", "unset") != "1",
+                    reason="JSON not configured")
 def test_zone_timers_primary_json(statsport):
    generic.test_zone_timers_primary(fetch_zones_json, load_timers_json,
                                     statsip="10.53.0.1", statsport=statsport,
@@ -80,6 +84,8 @@ def test_zone_timers_primary_json(statsport):

@pytest.mark.json
@pytest.mark.requests
+@pytest.mark.skipif(os.getenv("HAVEJSONSTATS", "unset") != "1",
+                    reason="JSON not configured")
 def test_zone_timers_secondary_json(statsport):
    generic.test_zone_timers_secondary(fetch_zones_json, load_timers_json,
                                       statsip="10.53.0.3", statsport=statsport,
@@ -88,6 +94,8 @@ def test_zone_timers_secondary_json(statsport):

@pytest.mark.json
@pytest.mark.requests
+@pytest.mark.skipif(os.getenv("HAVEJSONSTATS", "unset") != "1",
+                    reason="JSON not configured")
 def test_zone_with_many_keys_json(statsport):
    generic.test_zone_with_many_keys(fetch_zones_json, load_zone_json,
                                     statsip="10.53.0.2", statsport=statsport)
@@ -96,6 +104,8 @@ def test_zone_with_many_keys_json(statsport):
@pytest.mark.json
@pytest.mark.requests
@pytest.mark.dnspython
+@pytest.mark.skipif(os.getenv("HAVEJSONSTATS", "unset") != "1",
+                    reason="JSON not configured")
 def test_traffic_json(port, statsport):
    generic.test_traffic(fetch_traffic_json,
                         statsip="10.53.0.2", statsport=statsport,
@@ -13,6 +13,8 @@
 import xml.etree.ElementTree as ET
 from datetime import datetime

+import os
+
 import pytest
 import requests

@@ -102,6 +104,8 @@ def load_zone_xml(zone):

@pytest.mark.xml
@pytest.mark.requests
+@pytest.mark.skipif(os.getenv("HAVEXMLSTATS", "unset") != "1",
+                    reason="XML not configured")
 def test_zone_timers_primary_xml(statsport):
    generic.test_zone_timers_primary(fetch_zones_xml, load_timers_xml,
                                     statsip="10.53.0.1", statsport=statsport,
@@ -110,6 +114,8 @@ def test_zone_timers_primary_xml(statsport):

@pytest.mark.xml
@pytest.mark.requests
+@pytest.mark.skipif(os.getenv("HAVEXMLSTATS", "unset") != "1",
+                    reason="XML not configured")
 def test_zone_timers_secondary_xml(statsport):
    generic.test_zone_timers_secondary(fetch_zones_xml, load_timers_xml,
                                       statsip="10.53.0.3", statsport=statsport,
@@ -118,6 +124,8 @@ def test_zone_timers_secondary_xml(statsport):

@pytest.mark.xml
@pytest.mark.requests
+@pytest.mark.skipif(os.getenv("HAVEXMLSTATS", "unset") != "1",
+                    reason="XML not configured")
 def test_zone_with_many_keys_xml(statsport):
    generic.test_zone_with_many_keys(fetch_zones_xml, load_zone_xml,
                                     statsip="10.53.0.2", statsport=statsport)
@@ -126,6 +134,8 @@ def test_zone_with_many_keys_xml(statsport):
@pytest.mark.xml
@pytest.mark.requests
@pytest.mark.dnspython
+@pytest.mark.skipif(os.getenv("HAVEXMLSTATS", "unset") != "1",
+                    reason="XML not configured")
 def test_traffic_xml(port, statsport):
    generic.test_traffic(fetch_traffic_xml,
                         statsip="10.53.0.2", statsport=statsport,
@@ -0,0 +1,18 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+import os
+import pytest
+
+
+@pytest.fixture(scope='module')
+def named_port():
+    return int(os.environ.get("PORT", default=5300))
@@ -0,0 +1,4 @@
+$ORIGIN allwild.test.
+allwild.test.                 3600 IN  SOA   . . 0 0 0 0 0
+allwild.test.                 3600     NS    ns.example.test.
+*.allwild.test.           3600     A     192.0.2.1
@@ -27,6 +27,7 @@ zone "." { type primary; file "root.db.signed"; };
 /*
 * RFC 4592 example zone.
 */
+zone "allwild.test" { type primary; file "allwild.db"; };
 zone "example" { type primary; file "example.db"; };
 zone "nsec" { type primary; file "nsec.db.signed"; };
 zone "private.nsec" { type primary; file "private.nsec.db.signed"; };
@@ -17,6 +17,7 @@ SYSTESTDIR=wildcard
 dssets=

 # RFC 4592 example zone.
+cp allwild.db.in allwild.db
 cp example.db.in example.db

 zone=nsec
@@ -0,0 +1,103 @@
+#!/usr/bin/python3
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+"""
+Example property-based test for wildcard synthesis.
+Verifies that otherwise-empty zone with single wildcard record * A 192.0.2.1
+produces synthesized answers for <random_label>.test. A, and returns NODATA for
+<random_label>.test. when rdtype is not A.
+
+Limitations - untested properties:
+    - expansion works with multiple labels
+    - asterisk in qname does not cause expansion
+    - empty non-terminals prevent expansion
+    - or more generally any existing node prevents expansion
+    - DNSSEC record inclusion
+    - possibly others, see RFC 4592 and company
+    - content of authority & additional sections
+    - flags beyond RCODE
+    - special behavior of rdtypes like CNAME
+"""
+import pytest
+
+pytest.importorskip("dns")
+import dns.message
+import dns.name
+import dns.query
+import dns.rcode
+import dns.rdatatype
+
+pytest.importorskip("hypothesis")
+from hypothesis import given
+from hypothesis.strategies import binary, integers
+
+
+# labels of a zone with * A 192.0.2.1 wildcard
+WILDCARD_ZONE = ('allwild', 'test', '')
+WILDCARD_RDTYPE = dns.rdatatype.A
+WILDCARD_RDATA = '192.0.2.1'
+IPADDR = '10.53.0.1'
+TIMEOUT = 5  # seconds, just a sanity check
+
+
+# Helpers
+def is_nonexpanding_rdtype(rdtype):
+    """skip meta types to avoid weird rcodes caused by AXFR etc.; RFC 6895"""
+    return not(rdtype == WILDCARD_RDTYPE
+               or dns.rdatatype.is_metatype(rdtype)  # known metatypes: OPT ...
+               or 128 <= rdtype <= 255)  # unknown meta types
+
+
+def tcp_query(where, port, qname, qtype):
+    querymsg = dns.message.make_query(qname, qtype)
+    assert len(querymsg.question) == 1
+    return querymsg, dns.query.tcp(querymsg, where, port=port, timeout=TIMEOUT)
+
+
+def query(where, port, label, rdtype):
+    labels = (label, ) + WILDCARD_ZONE
+    qname = dns.name.Name(labels)
+    return tcp_query(where, port, qname, rdtype)
+
+
+# Tests
+@given(label=binary(min_size=1, max_size=63),
+       rdtype=integers(min_value=0, max_value=65535).filter(
+           is_nonexpanding_rdtype))
+def test_wildcard_rdtype_mismatch(label, rdtype, named_port):
+    """any label non-matching rdtype must result in to NODATA"""
+    check_answer_nodata(*query(IPADDR, named_port, label, rdtype))
+
+
+def check_answer_nodata(querymsg, answer):
+    assert querymsg.is_response(answer), str(answer)
+    assert answer.rcode() == dns.rcode.NOERROR, str(answer)
+    assert answer.answer == [], str(answer)
+
+
+@given(label=binary(min_size=1, max_size=63))
+def test_wildcard_match(label, named_port):
+    """any label with maching rdtype must result in wildcard data in answer"""
+    check_answer_noerror(*query(IPADDR, named_port, label, WILDCARD_RDTYPE))
+
+
+def check_answer_noerror(querymsg, answer):
+    assert querymsg.is_response(answer), str(answer)
+    assert answer.rcode() == dns.rcode.NOERROR, str(answer)
+    assert len(querymsg.question) == 1, str(answer)
+    expected_answer = [dns.rrset.from_text(
+                            querymsg.question[0].name,
+                            300,  # TTL, ignored by dnspython comparison
+                            dns.rdataclass.IN,
+                            WILDCARD_RDTYPE,
+                            WILDCARD_RDATA)]
+    assert answer.answer == expected_answer, str(answer)
@@ -25,6 +25,7 @@
 #include <isc/net.h>
 #include <isc/nonce.h>
 #include <isc/parseint.h>
+#include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/random.h>
 #include <isc/sockaddr.h>
@@ -2057,6 +2058,47 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 	}
 }

+/*
+ * Try honoring the operating system's preferred ephemeral port range.
+ */
+static void
+set_source_ports(dns_dispatchmgr_t *manager) {
+	isc_portset_t *v4portset = NULL, *v6portset = NULL;
+	in_port_t udpport_low, udpport_high;
+	isc_result_t result;
+
+	result = isc_portset_create(mctx, &v4portset);
+	if (result != ISC_R_SUCCESS) {
+		fatal("isc_portset_create (v4) failed");
+	}
+
+	result = isc_net_getudpportrange(AF_INET, &udpport_low, &udpport_high);
+	if (result != ISC_R_SUCCESS) {
+		fatal("isc_net_getudpportrange (v4) failed");
+	}
+
+	isc_portset_addrange(v4portset, udpport_low, udpport_high);
+
+	result = isc_portset_create(mctx, &v6portset);
+	if (result != ISC_R_SUCCESS) {
+		fatal("isc_portset_create (v6) failed");
+	}
+	result = isc_net_getudpportrange(AF_INET6, &udpport_low, &udpport_high);
+	if (result != ISC_R_SUCCESS) {
+		fatal("isc_net_getudpportrange (v6) failed");
+	}
+
+	isc_portset_addrange(v6portset, udpport_low, udpport_high);
+
+	result = dns_dispatchmgr_setavailports(manager, v4portset, v6portset);
+	if (result != ISC_R_SUCCESS) {
+		fatal("dns_dispatchmgr_setavailports failed");
+	}
+
+	isc_portset_destroy(mctx, &v4portset);
+	isc_portset_destroy(mctx, &v6portset);
+}
+
 /*% Main processing routine for mdig */
 int
 main(int argc, char *argv[]) {
@@ -2126,12 +2168,14 @@ main(int argc, char *argv[]) {

 	RUNCHECK(isc_managers_create(mctx, 1, 0, &netmgr, &taskmgr));
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
-
 	RUNCHECK(isc_timermgr_create(mctx, &timermgr));
 	RUNCHECK(isc_socketmgr_create(mctx, &socketmgr));
 	RUNCHECK(dns_dispatchmgr_create(mctx, &dispatchmgr));

+	set_source_ports(dispatchmgr);
+
 	attrs = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_MAKEQUERY;
+
 	if (have_ipv4) {
 		isc_sockaddr_any(&bind_any);
 		attrs |= DNS_DISPATCHATTR_IPV4;
@@ -288,6 +288,9 @@
 /* Define to 1 if you have the <net/route.h> header file. */
 #undef HAVE_NET_ROUTE_H

+/* Define to 1 if you have the `OPENSSL_cleanup' function. */
+#undef HAVE_OPENSSL_CLEANUP
+
 /* define if OpenSSL supports Ed25519 */
 #undef HAVE_OPENSSL_ED25519

@@ -676,6 +676,7 @@ CMOCKA_CFLAGS
 LIBIDN2_LDFLAGS
 LIBIDN2_LIBS
 LIBIDN2_CFLAGS
+XSLTPROC
 CURL
 DOXYGEN
 MANSRCS
@@ -779,6 +780,8 @@ PANDOC
 W3M
 LN
 ARFLAGS
+JEMALLOC_LIBS
+JEMALLOC_CFLAGS
 XTARGETS
 PKG_CONFIG_LIBDIR
 PKG_CONFIG_PATH
@@ -966,6 +969,8 @@ LT_SYS_LIBRARY_PATH
 PKG_CONFIG
 PKG_CONFIG_PATH
 PKG_CONFIG_LIBDIR
+JEMALLOC_CFLAGS
+JEMALLOC_LIBS
 PYTHON
 MAXMINDDB_CFLAGS
 MAXMINDDB_LIBS
@@ -1686,7 +1691,7 @@ Optional Packages:
  --with-libidn2=PATH     enable IDN support using GNU libidn2
                          [yes|no(default)|path]
  --with-cmocka=detect    enable CMocka based tests (default is detect)
-  --with-tuning=ARG       Specify server tuning (default or small)
+  --with-tuning=ARG       Specify server tuning (default or large)
  --with-dlopen=ARG       support dynamically loadable DLZ and DYNDB drivers
  --with-dnsrps-libname   DNSRPS provider library name (librpz.so)
  --with-dnsrps-dir       path to DNSRPS provider library
@@ -1724,6 +1729,10 @@ Some influential environment variables:
              directories to add to pkg-config's search path
  PKG_CONFIG_LIBDIR
              path overriding pkg-config's built-in search path
+  JEMALLOC_CFLAGS
+              C compiler flags for JEMALLOC, overriding pkg-config
+  JEMALLOC_LIBS
+              linker flags for JEMALLOC, overriding pkg-config
  PYTHON      path to python executable
  MAXMINDDB_CFLAGS
              C compiler flags for MAXMINDDB, overriding pkg-config
@@ -12320,6 +12329,104 @@ else
 fi


+# Enforce jemalloc
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for jemalloc" >&5
+$as_echo_n "checking for jemalloc... " >&6; }
+
+pkg_failed=no
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for jemalloc" >&5
+$as_echo_n "checking for jemalloc... " >&6; }
+
+if test -n "$JEMALLOC_CFLAGS"; then
+    pkg_cv_JEMALLOC_CFLAGS="$JEMALLOC_CFLAGS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"jemalloc\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "jemalloc") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_JEMALLOC_CFLAGS=`$PKG_CONFIG --cflags "jemalloc" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+if test -n "$JEMALLOC_LIBS"; then
+    pkg_cv_JEMALLOC_LIBS="$JEMALLOC_LIBS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"jemalloc\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "jemalloc") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_JEMALLOC_LIBS=`$PKG_CONFIG --libs "jemalloc" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+
+
+
+if test $pkg_failed = yes; then
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi
+        if test $_pkg_short_errors_supported = yes; then
+	        JEMALLOC_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "jemalloc" 2>&1`
+        else
+	        JEMALLOC_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "jemalloc" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$JEMALLOC_PKG_ERRORS" >&5
+
+	as_fn_error $? "Package requirements (jemalloc) were not met:
+
+$JEMALLOC_PKG_ERRORS
+
+Consider adjusting the PKG_CONFIG_PATH environment variable if you
+installed software in a non-standard prefix.
+
+Alternatively, you may set the environment variables JEMALLOC_CFLAGS
+and JEMALLOC_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details." "$LINENO" 5
+elif test $pkg_failed = untried; then
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "The pkg-config script could not be found or is too old.  Make sure it
+is in your PATH or set the PKG_CONFIG environment variable to the full
+path to pkg-config.
+
+Alternatively, you may set the environment variables JEMALLOC_CFLAGS
+and JEMALLOC_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details.
+
+To get pkg-config, see <http://pkg-config.freedesktop.org/>.
+See \`config.log' for more details" "$LINENO" 5; }
+else
+	JEMALLOC_CFLAGS=$pkg_cv_JEMALLOC_CFLAGS
+	JEMALLOC_LIBS=$pkg_cv_JEMALLOC_LIBS
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+fi
+CFLAGS="$JEMALLOC_CFLAGS $CFLAGS"
+LDFLAGS="$JEMALLOC_LDFLAGS $LDFLAGS"
+LIBS="$JEMALLOC_LIBS $LIBS"
+
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to enable fuzzing mode" >&5
 $as_echo_n "checking whether to enable fuzzing mode... " >&6; }
 case $enable_fuzzing in #(
@@ -16848,6 +16955,14 @@ fi



+#
+# This maintenance branch of BIND 9 does not support new OpenSSL APIs
+# introduced in version 3.0.0.  Suppress compiler warnings about using
+# functions deprecated in newer OpenSSL versions as they will not be
+# addressed in BIND 9.16.
+#
+OPENSSL_CFLAGS="$OPENSSL_CFLAGS -DOPENSSL_SUPPRESS_DEPRECATED"
+
 CFLAGS="$CFLAGS $OPENSSL_CFLAGS"
 LIBS="$LIBS $OPENSSL_LIBS"

@@ -21475,6 +21590,53 @@ fi



+#
+# Look for xsltproc
+#
+
+# Extract the first word of "xsltproc", so it can be a program name with args.
+set dummy xsltproc; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_path_XSLTPROC+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  case $XSLTPROC in
+  [\\/]* | ?:[\\/]*)
+  ac_cv_path_XSLTPROC="$XSLTPROC" # Let the user override the test with a path.
+  ;;
+  *)
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_path_XSLTPROC="$as_dir/$ac_word$ac_exec_ext"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+  test -z "$ac_cv_path_XSLTPROC" && ac_cv_path_XSLTPROC="xsltproc"
+  ;;
+esac
+fi
+XSLTPROC=$ac_cv_path_XSLTPROC
+if test -n "$XSLTPROC"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $XSLTPROC" >&5
+$as_echo "$XSLTPROC" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+
+
 #
 # IDN support using libidn2
 #
@@ -22254,19 +22416,19 @@ done
 if test "${with_tuning+set}" = set; then :
  withval=$with_tuning;
 else
-  with_tuning=no
+  with_tuning=small
 fi


 case $with_tuning in #(
-  small) :
-    { $as_echo "$as_me:${as_lineno-$LINENO}: using small system tuning" >&5
-$as_echo "$as_me: using small system tuning" >&6;} ;; #(
-  *) :
+  large) :

 $as_echo "#define TUNE_LARGE 1" >>confdefs.h

-	 { $as_echo "$as_me:${as_lineno-$LINENO}: using default system tuning" >&5
+		 { $as_echo "$as_me:${as_lineno-$LINENO}: using small system tuning" >&5
+$as_echo "$as_me: using small system tuning" >&6;} ;; #(
+  *) :
+    { $as_echo "$as_me:${as_lineno-$LINENO}: using default system tuning" >&5
 $as_echo "$as_me: using default system tuning" >&6;} ;;
 esac

@@ -26474,7 +26636,16 @@ fi
    echo "    localstatedir: $localstatedir"
    echo "-------------------------------------------------------------------------------"
    echo "Compiler: $CC"
-    $CC --version 2>&1 | sed 's/^/    /'
+    if test "$GCC" = "yes"; then :
+  $CC --version 2>&1 | sed 's/^/    /'
+else
+  case $host in #(
+  *-solaris*) :
+    $CC -V 2>&1 | sed 's/^/    /' ;; #(
+  *) :
+    $CC --version 2>&1 | sed 's/^/    /' ;;
+esac
+fi

    if test "X$ac_unrecognized_opts" != "X"; then
 	echo "Unrecognized options:"
@@ -117,6 +117,13 @@ AC_ARG_ENABLE([fuzzing],
 	      [],
 	      [enable_fuzzing=no])

+# Enforce jemalloc
+AC_MSG_CHECKING([for jemalloc])
+PKG_CHECK_MODULES([JEMALLOC], [jemalloc])
+CFLAGS="$JEMALLOC_CFLAGS $CFLAGS"
+LDFLAGS="$JEMALLOC_LDFLAGS $LDFLAGS"
+LIBS="$JEMALLOC_LIBS $LIBS"
+
 AC_MSG_CHECKING([whether to enable fuzzing mode])
 AS_CASE([$enable_fuzzing],
 	[no],[AC_MSG_RESULT([no])],
@@ -806,6 +813,14 @@ PKG_CHECK_MODULES([OPENSSL], [libssl libcrypto], [],

 AX_SAVE_FLAGS([openssl])

+#
+# This maintenance branch of BIND 9 does not support new OpenSSL APIs
+# introduced in version 3.0.0.  Suppress compiler warnings about using
+# functions deprecated in newer OpenSSL versions as they will not be
+# addressed in BIND 9.16.
+#
+OPENSSL_CFLAGS="$OPENSSL_CFLAGS -DOPENSSL_SUPPRESS_DEPRECATED"
+
 CFLAGS="$CFLAGS $OPENSSL_CFLAGS"
 LIBS="$LIBS $OPENSSL_LIBS"

@@ -824,7 +839,7 @@ AC_COMPILE_IFELSE(
 # Check for functions added in OpenSSL or LibreSSL
 #

-AC_CHECK_FUNCS([OPENSSL_init_ssl OPENSSL_init_crypto])
+AC_CHECK_FUNCS([OPENSSL_init_ssl OPENSSL_init_crypto OPENSSL_cleanup])
 AC_CHECK_FUNCS([CRYPTO_zalloc])
 AC_CHECK_FUNCS([EVP_CIPHER_CTX_new EVP_CIPHER_CTX_free])
 AC_CHECK_FUNCS([EVP_MD_CTX_new EVP_MD_CTX_free EVP_MD_CTX_reset])
@@ -2181,6 +2196,13 @@ AC_SUBST(DOXYGEN)
 AC_PATH_PROG(CURL, curl, curl)
 AC_SUBST(CURL)

+#
+# Look for xsltproc
+#
+
+AC_PATH_PROG(XSLTPROC, xsltproc, xsltproc)
+AC_SUBST(XSLTPROC)
+
 #
 # IDN support using libidn2
 #
@@ -2284,13 +2306,13 @@ AC_CHECK_FUNCS(setlocale)
 # [pairwise: --with-tuning=small, --without-tuning]
 AC_ARG_WITH([tuning],
 	    AS_HELP_STRING([--with-tuning=ARG],
-			   [Specify server tuning (default or small)]),
-	    [],[with_tuning=no])
+			   [Specify server tuning (default or large)]),
+	    [],[with_tuning=small])

 AS_CASE([$with_tuning],
-	[small],[AC_MSG_NOTICE(using small system tuning)],
-	[AC_DEFINE(TUNE_LARGE, 1, [Define to use default system tuning.])
-	 AC_MSG_NOTICE(using default system tuning)])
+	[large],[AC_DEFINE(TUNE_LARGE, 1, [Define to use default system tuning.])
+		 AC_MSG_NOTICE(using small system tuning)],
+	[AC_MSG_NOTICE(using default system tuning)])

 #
 # was --enable-querytrace specified?
@@ -3092,7 +3114,11 @@ report() {
    echo "    localstatedir: $localstatedir"
    echo "-------------------------------------------------------------------------------"
    echo "Compiler: $CC"
-    $CC --version 2>&1 | sed 's/^/    /'
+    AS_IF([test "$GCC" = "yes"],
+	  [$CC --version 2>&1 | sed 's/^/    /'],
+	  [AS_CASE([$host],
+		   [*-solaris*],[$CC -V 2>&1 | sed 's/^/    /'],
+		   [$CC --version 2>&1 | sed 's/^/    /'])])

    if test "X$ac_unrecognized_opts" != "X"; then
 	echo "Unrecognized options:"
@@ -57,7 +57,7 @@ typedef struct driverinstance driverinstance_t;
 * special tokens are %zone%, %record%, %client%
 */
 struct query_segment {
-	void *	     sql;
+	void	     *sql;
 	unsigned int strlen;
 	bool	     direct;
 	ISC_LINK(query_segment_t) link;
@@ -71,18 +71,18 @@ struct query_segment {
 * make sure no two threads try to use the same DBI at a time.
 */
 struct dbinstance {
-	void *	      dbconn;
+	void	     *dbconn;
 	query_list_t *allnodes_q;
 	query_list_t *allowxfr_q;
 	query_list_t *authority_q;
 	query_list_t *findzone_q;
 	query_list_t *lookup_q;
 	query_list_t *countzone_q;
-	char *	      query_buf;
-	char *	      zone;
-	char *	      record;
-	char *	      client;
-	isc_mem_t *   mctx;
+	char	     *query_buf;
+	char	     *zone;
+	char	     *record;
+	char	     *client;
+	isc_mem_t	  *mctx;
 	isc_mutex_t   instance_lock;
 	ISC_LINK(dbinstance_t) link;
 };
@@ -61,7 +61,7 @@ typedef struct driverinstance driverinstance_t;
 * special tokens are %zone%, %record%, %client%
 */
 struct query_segment {
-	void *	     cmd;
+	void	     *cmd;
 	unsigned int strlen;
 	bool	     direct;
 	DLZ_LINK(query_segment_t) link;
@@ -75,17 +75,17 @@ struct query_segment {
 * make sure no two threads try to use the same DBI at a time.
 */
 struct dbinstance {
-	void *	      dbconn;
+	void	     *dbconn;
 	query_list_t *allnodes_q;
 	query_list_t *allowxfr_q;
 	query_list_t *authority_q;
 	query_list_t *findzone_q;
 	query_list_t *lookup_q;
 	query_list_t *countzone_q;
-	char *	      query_buf;
-	char *	      zone;
-	char *	      record;
-	char *	      client;
+	char	     *query_buf;
+	char	     *zone;
+	char	     *record;
+	char	     *client;
 	dlz_mutex_t   lock;
 	DLZ_LINK(dbinstance_t) link;
 };
@@ -82,7 +82,7 @@ typedef uint32_t     dns_ttl_t;
 	do {                           \
 		union {                \
 			const void *k; \
-			void *	    v; \
+			void	     *v; \
 		} _u;                  \
 		_u.k = konst;          \
 		var = _u.v;            \
@@ -109,21 +109,21 @@ typedef struct isc_sockaddr {
 #endif /* ifdef ISC_PLATFORM_HAVESYSUNH */
 	} type;
 	unsigned int length;
-	void *	     link;
+	void	     *link;
 } isc_sockaddr_t;

 #define DNS_CLIENTINFO_VERSION 2
 typedef struct dns_clientinfo {
 	uint16_t version;
-	void *	 data;
-	void *	 dbversion;
+	void    *data;
+	void    *dbversion;
 } dns_clientinfo_t;

 typedef isc_result_t (*dns_clientinfo_sourceip_t)(dns_clientinfo_t *client,
-						  isc_sockaddr_t ** addrp);
+						  isc_sockaddr_t	 **addrp);

 typedef isc_result_t (*dns_clientinfo_version_t)(dns_clientinfo_t *client,
-						 void **	   addrp);
+						 void	      **addrp);

 #define DNS_CLIENTINFOMETHODS_VERSION 2
 #define DNS_CLIENTINFOMETHODS_AGE     1
@@ -18,7 +18,20 @@ from docutils.nodes import Node, system_message
 from docutils.parsers.rst import roles

 from sphinx import addnodes
-from sphinx.util.docutils import ReferenceRole
+
+try:
+    from sphinx.util.docutils import ReferenceRole
+except ImportError:
+    # pylint: disable=too-few-public-methods
+    class ReferenceRole(roles.GenericRole):
+        '''
+        The ReferenceRole class (used as a base class by GitLabRefRole
+        below) is only defined in Sphinx >= 2.0.0.  For older Sphinx
+        versions, this stub version of the ReferenceRole class is used
+        instead.
+        '''
+        def __init__(self):
+            super().__init__('', nodes.strong)


 GITLAB_BASE_URL = 'https://gitlab.isc.org/isc-projects/bind9/-/'
@@ -60,6 +60,8 @@ information about each release, source code, and pre-compiled versions
 for Microsoft Windows operating systems.

 .. include:: ../notes/notes-current.rst
+.. include:: ../notes/notes-9.16.23.rst
+.. include:: ../notes/notes-9.16.22.rst
 .. include:: ../notes/notes-9.16.21.rst
 .. include:: ../notes/notes-9.16.20.rst
 .. include:: ../notes/notes-9.16.19.rst
@@ -1623,10 +1623,6 @@ Boolean Options
   even if the server is not actually authoritative. The default is
   ``no``.

-``deallocate-on-exit``
-   This option was used in BIND 8 to enable checking for memory leaks on
-   exit. BIND 9 ignores the option and always performs the checks.
-
 ``memstatistics``
   This writes memory statistics to the file specified by
   ``memstatistics-file`` at exit. The default is ``no`` unless ``-m
@@ -1913,8 +1909,8 @@ Boolean Options

 ``cookie-algorithm``
   This sets the algorithm to be used when generating the server cookie; the options are
-   "aes", "sha1", or "sha256". The default is "aes" if supported by
-   the cryptographic library; otherwise, "sha256".
+   "aes" or "siphash24". The default is "siphash24". The "aes" option remains for legacy
+   purposes.

 ``cookie-secret``
   If set, this is a shared secret used for generating and verifying
@@ -2409,12 +2405,6 @@ for details on how to specify IP address lists.
   and inherited by zones, this can lead to some zones unintentionally
   forwarding updates.

-``allow-v6-synthesis``
-   This option was introduced for the smooth transition from AAAA to A6
-   and from "nibble labels" to binary labels. However, since both A6 and
-   binary labels were then deprecated, this option was also deprecated.
-   It is now ignored with some warning messages.
-
 .. _allow-transfer-access:

 ``allow-transfer``
@@ -2971,12 +2961,13 @@ system.

   The current list of active fetches can be dumped by running
   ``rndc recursing``. The list includes the number of active fetches
-   for each domain and the number of queries that have been passed or
-   dropped as a result of the ``fetches-per-zone`` limit. (Note: these
-   counters are not cumulative over time; whenever the number of active
-   fetches for a domain drops to zero, the counter for that domain is
-   deleted, and the next time a fetch is sent to that domain, it is
-   recreated with the counters set to zero.)
+   for each domain and the number of queries that have been passed
+   (allowed) or dropped (spilled) as a result of the ``fetches-per-zone``
+   limit. (Note: these counters are not cumulative over time;
+   whenever the number of active fetches for a domain drops to zero,
+   the counter for that domain is deleted, and the next time a fetch
+   is sent to that domain, it is recreated with the counters set
+   to zero.)

 ``fetches-per-server``
   This sets the maximum number of simultaneous iterative queries that the server
@@ -3350,9 +3341,9 @@ Tuning
 ^^^^^^

 ``lame-ttl``
-   This sets the number of seconds to cache a lame server indication. 0
-   disables caching. (This is **NOT** recommended.) The default is
-   ``600`` (10 minutes) and the maximum value is ``1800`` (30 minutes).
+   This is always set to 0. More information is available in the
+   `security advisory for CVE-2021-25219
+   <https://kb.isc.org/docs/cve-2021-25219>`_.

 ``servfail-ttl``
   This sets the number of seconds to cache a SERVFAIL response due to DNSSEC
@@ -44,6 +44,10 @@ dnssec-dsfromkey \- DNSSEC DS RR generation tool
 The \fBdnssec\-dsfromkey\fP command outputs DS (Delegation Signer) resource records
 (RRs), or CDS (Child DS) RRs with the \fB\-C\fP option.
 .sp
+By default, only KSKs are converted (keys with flags = 257).  The
+\fB\-A\fP option includes ZSKs (flags = 256).  Revoked keys are never
+included.
+.sp
 The input keys can be specified in a number of ways:
 .sp
 By default, \fBdnssec\-dsfromkey\fP reads a key file named in the format
@@ -372,11 +372,24 @@ full \fBreload\fP when there is a large number of zones, because it
 avoids the need to examine the modification times of the zone files.
 .TP
 .B \fBrecursing\fP
-This command dumps the list of queries \fBnamed\fP is currently recursing on, and the
-list of domains to which iterative queries are currently being sent.
-The second list includes the number of fetches currently active for
-the given domain, and how many have been passed or dropped because of
-the \fBfetches\-per\-zone\fP option.
+This command dumps the list of queries \fBnamed\fP is currently
+recursing on, and the list of domains to which iterative queries
+are currently being sent.
+.sp
+The first list includes all unique clients that are waiting for
+recursion to complete, including the query that is awaiting a
+response and the timestamp (seconds since the Unix epoch) of
+when named started processing this client query.
+.sp
+The second list comprises of domains for which there are active
+(or recently active) fetches in progress.  It reports the number
+of active fetches for each domain and the number of queries that
+have been passed (allowed) or dropped (spilled) as a result of
+the \fBfetches\-per\-zone\fP limit.  (Note: these counters are not
+cumulative over time; whenever the number of active fetches for
+a domain drops to zero, the counter for that domain is deleted,
+and the next time a fetch is sent to that domain, it is recreated
+with the counters set to zero).
 .TP
 .B \fBrefresh\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
 This command schedules zone maintenance for the given zone.
@@ -0,0 +1,78 @@
+.. 
+   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+   
+   This Source Code Form is subject to the terms of the Mozilla Public
+   License, v. 2.0. If a copy of the MPL was not distributed with this
+   file, you can obtain one at https://mozilla.org/MPL/2.0/.
+   
+   See the COPYRIGHT file distributed with this work for additional
+   information regarding copyright ownership.
+
+Notes for BIND 9.16.22
+----------------------
+
+Security Fixes
+~~~~~~~~~~~~~~
+
+- The ``lame-ttl`` option controls how long ``named`` caches certain
+  types of broken responses from authoritative servers (see the
+  `security advisory <https://kb.isc.org/docs/cve-2021-25219>`_ for
+  details). This caching mechanism could be abused by an attacker to
+  significantly degrade resolver performance. The vulnerability has been
+  mitigated by changing the default value of ``lame-ttl`` to ``0`` and
+  overriding any explicitly set value with ``0``, effectively disabling
+  this mechanism altogether. ISC's testing has determined that doing
+  that has a negligible impact on resolver performance while also
+  preventing abuse. Administrators may observe more traffic towards
+  servers issuing certain types of broken responses than in previous
+  BIND 9 releases, depending on client query patterns. (CVE-2021-25219)
+
+  ISC would like to thank Kishore Kumar Kothapalli of Infoblox for
+  bringing this vulnerability to our attention. :gl:`#2899`
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- The use of native PKCS#11 for Public-Key Cryptography in BIND 9 has
+  been deprecated in favor of the engine_pkcs11 OpenSSL engine from the
+  `OpenSC`_ project. The ``--with-native-pkcs11`` configuration option
+  will be removed in the next major BIND 9 release. The option to use
+  the engine_pkcs11 OpenSSL engine is already available in BIND 9;
+  please see the :ref:`ARM section on PKCS#11 <pkcs11>` for details.
+  :gl:`#2691`
+
+- Old-style Dynamically Loadable Zones (DLZ) drivers that had to be
+  enabled in ``named`` at build time have been marked as deprecated in
+  favor of new-style DLZ modules. Old-style DLZ drivers will be removed
+  in the next major BIND 9 release. :gl:`#2814`
+
+- The ``map`` zone file format has been marked as deprecated and will be
+  removed in the next major BIND 9 release. :gl:`#2882`
+
+- ``named`` and ``named-checkconf`` now exit with an error when a single
+  port configured for ``query-source``, ``transfer-source``,
+  ``notify-source``, ``parental-source``, and/or their respective IPv6
+  counterparts clashes with a global listening port. This configuration
+  has not been supported since BIND 9.16.0, but no error was reported
+  until now (even though sending UDP messages such as NOTIFY failed).
+  :gl:`#2888`
+
+- ``named`` and ``named-checkconf`` now issue a warning when there is a
+  single port configured for ``query-source``, ``transfer-source``,
+  ``notify-source``, ``parental-source``, and/or for their respective
+  IPv6 counterparts. :gl:`#2888`
+
+.. _OpenSC: https://github.com/OpenSC/libp11
+
+Bug Fixes
+~~~~~~~~~
+
+- A recent change introduced in BIND 9.16.21 inadvertently broke
+  backward compatibility for the ``check-names master ...`` and
+  ``check-names slave ...`` options, causing them to be silently
+  ignored. This has been fixed and these options now work properly
+  again. :gl:`#2911`
+
+- When new IP addresses were set up by the operating system during
+  ``named`` startup, it could fail to listen for TCP connections on the
+  newly added interfaces. :gl:`#2852`
@@ -0,0 +1,19 @@
+.. 
+   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+   
+   This Source Code Form is subject to the terms of the Mozilla Public
+   License, v. 2.0. If a copy of the MPL was not distributed with this
+   file, you can obtain one at https://mozilla.org/MPL/2.0/.
+   
+   See the COPYRIGHT file distributed with this work for additional
+   information regarding copyright ownership.
+
+Notes for BIND 9.16.23
+----------------------
+
+Bug Fixes
+~~~~~~~~~
+
+- Reloading a catalog zone which referenced a missing/deleted member
+  zone triggered a runtime check failure, causing ``named`` to exit
+  prematurely. This has been fixed. :gl:`#2308`
@@ -8,7 +8,7 @@
   See the COPYRIGHT file distributed with this work for additional
   information regarding copyright ownership.

-Notes for BIND 9.16.22
+Notes for BIND 9.16.24
 ----------------------

 Security Fixes
@@ -34,38 +34,24 @@ Removed Features
 Feature Changes
 ~~~~~~~~~~~~~~~

- The use of native PKCS#11 for Public-Key Cryptography in BIND 9 has been
-  deprecated in favor of OpenSSL engine_pkcs11 from the OpenSC project.
-  The ``--with-native-pkcs11`` configuration option will be removed from the
-  next major BIND 9 release.  The option to use the engine_pkcs11 OpenSSL
-  engine is already available in BIND 9; please see the ARM section on
-  PKCS#11 for details. :gl:`#2691`
+- None.

- ``named`` and ``named-checkconf`` now issue a warning when there is a single
-  configured port in the ``query-source``, ``transfer-source``,
-  ``notify-source``, and ``parental-source``, and/or in their respective IPv6 counterparts.
-  :gl:`#2888`
-
- ``named`` and ``named-checkconf`` now return an error when the single configured
-  port in the ``query-source``, ``transfer-source``, ``notify-source``,
-  ``parental-source``, and/or their respective IPv6 counterparts clashes with the
-  global listening port. This configuration is no longer supported as of BIND
-  9.16.0 but no error was reported, although sending UDP messages
-  (such as notifies) would fail. :gl:`#2888`
-
- The ``masterfile-format`` format ``map`` has been marked as deprecated and
-  will be removed in a future release. :gl:`#2882`
-
- The statically compiled DLZ drivers have been marked as deprecated in favor of
-  dynamically loaded DLZ modules and will be removed in a future major
-  release. :gl:`#2814`
+- Previously, when an incoming TCP connection could not be accepted because the client
+  closed the connection early, an error message of ``TCP connection
+  failed: socket is not connected`` was logged. This message has been changed
+  to ``Accepting TCP connection failed: socket is not connected``. The
+  severity level at which this type of message is logged has also
+  been changed from ``error`` to ``info`` for the following triggering
+  events: ``socket is not connected``, ``quota reached``, and ``soft
+  quota reached``. :gl:`#2700`

 Bug Fixes
 ~~~~~~~~~

- When new IP addresses were added to the system during ``named``
-  startup, ``named`` failed to listen on TCP for the newly added
-  interfaces. :gl:`#2852`
+- Removing a configured ``catalog-zone`` clause from the configuration, running
+  ``rndc reconfig``, then bringing back the removed ``catalog-zone`` clause and
+  running ``rndc reconfig`` again caused ``named`` to crash. This has been fixed.
+  :gl:`#1608`

- Reloading a catalog zone that referenced a missing/deleted zone
-  caused a crash. This has been fixed. :gl:`#2308`
+- On FreeBSD, a TCP connection would leak a small amount of heap memory leading
+  to out-of-memory problem in a long run. This has been fixed. :gl:`#3051`
@@ -959,7 +959,6 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
 		{ "max-transfer-idle-out", 60, 28 * 24 * 60 }, /* 28 days */
 		{ "max-transfer-time-in", 60, 28 * 24 * 60 },  /* 28 days */
 		{ "max-transfer-time-out", 60, 28 * 24 * 60 }, /* 28 days */
-		{ "statistics-interval", 60, 28 * 24 * 60 },   /* 28 days */

 		/* minimum and maximum cache and negative cache TTLs */
 		{ "min-cache-ttl", 1, MAX_MIN_CACHE_TTL },   /* 90 secs */
@@ -508,6 +508,14 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 					      zname, czname);
 			continue;
 		}
+
+		/*
+		 * Delete the old entry so that it won't accidentally be
+		 * removed as a non-existing entry below.
+		 */
+		dns_catz_entry_detach(target, &oentry);
+		result = isc_ht_delete(target->entries, key, (uint32_t)keysize);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	}
 	RUNTIME_CHECK(result == ISC_R_NOMORE);
 	isc_ht_iter_destroy(&iter1);
@@ -947,7 +947,6 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) {
 	dst_context_t *ctx = NULL;
 	isc_mem_t *mctx;
 	isc_result_t result;
-	bool signeedsfree = true;

 	REQUIRE(msg != NULL);
 	REQUIRE(key != NULL);
@@ -1036,7 +1035,6 @@ dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key) {
 				    dynbuf));

 	isc_mem_put(mctx, sig.signature, sig.siglen);
-	signeedsfree = false;

 	dns_message_takebuffer(msg, &dynbuf);

@@ -1057,7 +1055,7 @@ failure:
 	if (dynbuf != NULL) {
 		isc_buffer_free(&dynbuf);
 	}
-	if (signeedsfree) {
+	if (sig.signature != NULL) {
 		isc_mem_put(mctx, sig.signature, sig.siglen);
 	}
 	if (ctx != NULL) {
@@ -75,14 +75,14 @@ struct dns_aclelement {

 struct dns_acl {
 	unsigned int	  magic;
-	isc_mem_t *	  mctx;
+	isc_mem_t	  *mctx;
 	isc_refcount_t	  refcount;
-	dns_iptable_t *	  iptable;
+	dns_iptable_t    *iptable;
 	dns_aclelement_t *elements;
 	bool		  has_negatives;
 	unsigned int	  alloc;	 /*%< Elements allocated */
 	unsigned int	  length;	 /*%< Elements initialized */
-	char *		  name;		 /*%< Temporary use only */
+	char	     *name;		 /*%< Temporary use only */
 	ISC_LINK(dns_acl_t) nextincache; /*%< Ditto */
 };

@@ -118,7 +118,7 @@ struct dns_adbfind {
 	int	       name_bucket;
 	unsigned int   flags;
 	dns_adbname_t *adbname;
-	dns_adb_t *    adb;
+	dns_adb_t	  *adb;
 	isc_event_t    event;
 	ISC_LINK(dns_adbfind_t) plink;
 };
@@ -51,7 +51,7 @@ struct dns_rdatacallbacks {
 	 * to pass back information obtained from the file header
 	 */
 	dns_rawdatafunc_t rawdata;
-	dns_zone_t *	  zone;
+	dns_zone_t	   *zone;

 	/*%
 	 * dns_load_master / dns_rdata_fromtext call this to issue a error.
@@ -321,15 +321,15 @@ dns_catz_generate_zonecfg(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 /* Methods provided by named to dynamically modify the member zones */
 /* xxxwpk TODO config! */
 typedef isc_result_t (*dns_catz_zoneop_fn_t)(dns_catz_entry_t *entry,
-					     dns_catz_zone_t * origin,
-					     dns_view_t *      view,
-					     isc_taskmgr_t *   taskmgr,
-					     void *	       udata);
+					     dns_catz_zone_t  *origin,
+					     dns_view_t	*view,
+					     isc_taskmgr_t	   *taskmgr,
+					     void		  *udata);
 struct dns_catz_zonemodmethods {
 	dns_catz_zoneop_fn_t addzone;
 	dns_catz_zoneop_fn_t modzone;
 	dns_catz_zoneop_fn_t delzone;
-	void *		     udata;
+	void		     *udata;
 };

 isc_result_t
@@ -50,12 +50,12 @@ ISC_LANG_BEGINDECLS
 #define DNS_CLIENTINFO_VERSION 2
 typedef struct dns_clientinfo {
 	uint16_t version;
-	void *	 data;
-	void *	 dbversion;
+	void    *data;
+	void    *dbversion;
 } dns_clientinfo_t;

 typedef isc_result_t (*dns_clientinfo_sourceip_t)(dns_clientinfo_t *client,
-						  isc_sockaddr_t ** addrp);
+						  isc_sockaddr_t	 **addrp);

 #define DNS_CLIENTINFOMETHODS_VERSION 2
 #define DNS_CLIENTINFOMETHODS_AGE     1
@@ -70,7 +70,7 @@ typedef struct dns_clientinfomethods {
 ***** Methods
 *****/
 void
-dns_clientinfomethods_init(dns_clientinfomethods_t * methods,
+dns_clientinfomethods_init(dns_clientinfomethods_t  *methods,
 			   dns_clientinfo_sourceip_t sourceip);

 void
@@ -76,7 +76,7 @@ struct dns_compress {
 	/*% Preallocated nodes for the table. */
 	dns_compressnode_t initialnodes[DNS_COMPRESS_INITIALNODES];
 	uint16_t	   count; /*%< Number of nodes. */
-	isc_mem_t *	   mctx;  /*%< Memory context. */
+	isc_mem_t	  *mctx;  /*%< Memory context. */
 };

 typedef enum {
@@ -71,13 +71,13 @@ ISC_LANG_BEGINDECLS
 typedef struct dns_dbmethods {
 	void (*attach)(dns_db_t *source, dns_db_t **targetp);
 	void (*detach)(dns_db_t **dbp);
-	isc_result_t (*beginload)(dns_db_t *		db,
+	isc_result_t (*beginload)(dns_db_t		   *db,
 				  dns_rdatacallbacks_t *callbacks);
 	isc_result_t (*endload)(dns_db_t *db, dns_rdatacallbacks_t *callbacks);
 	isc_result_t (*serialize)(dns_db_t *db, dns_dbversion_t *version,
 				  FILE *file);
 	isc_result_t (*dump)(dns_db_t *db, dns_dbversion_t *version,
-			     const char *	filename,
+			     const char	*filename,
 			     dns_masterformat_t masterformat);
 	void (*currentversion)(dns_db_t *db, dns_dbversion_t **versionp);
 	isc_result_t (*newversion)(dns_db_t *db, dns_dbversion_t **versionp);
@@ -96,7 +96,7 @@ typedef struct dns_dbmethods {
 	isc_result_t (*findzonecut)(dns_db_t *db, const dns_name_t *name,
 				    unsigned int options, isc_stdtime_t now,
 				    dns_dbnode_t **nodep, dns_name_t *foundname,
-				    dns_name_t *    dcname,
+				    dns_name_t     *dcname,
 				    dns_rdataset_t *rdataset,
 				    dns_rdataset_t *sigrdataset);
 	void (*attachnode)(dns_db_t *db, dns_dbnode_t *source,
@@ -114,7 +114,7 @@ typedef struct dns_dbmethods {
 				     dns_rdataset_t *rdataset,
 				     dns_rdataset_t *sigrdataset);
 	isc_result_t (*allrdatasets)(dns_db_t *db, dns_dbnode_t *node,
-				     dns_dbversion_t *	  version,
+				     dns_dbversion_t     *version,
 				     isc_stdtime_t	  now,
 				     dns_rdatasetiter_t **iteratorp);
 	isc_result_t (*addrdataset)(dns_db_t *db, dns_dbnode_t *node,
@@ -124,9 +124,9 @@ typedef struct dns_dbmethods {
 				    dns_rdataset_t *addedrdataset);
 	isc_result_t (*subtractrdataset)(dns_db_t *db, dns_dbnode_t *node,
 					 dns_dbversion_t *version,
-					 dns_rdataset_t * rdataset,
+					 dns_rdataset_t	*rdataset,
 					 unsigned int	  options,
-					 dns_rdataset_t * newrdataset);
+					 dns_rdataset_t	*newrdataset);
 	isc_result_t (*deleterdataset)(dns_db_t *db, dns_dbnode_t *node,
 				       dns_dbversion_t *version,
 				       dns_rdatatype_t	type,
@@ -139,12 +139,12 @@ typedef struct dns_dbmethods {
 	isc_result_t (*getoriginnode)(dns_db_t *db, dns_dbnode_t **nodep);
 	void (*transfernode)(dns_db_t *db, dns_dbnode_t **sourcep,
 			     dns_dbnode_t **targetp);
-	isc_result_t (*getnsec3parameters)(dns_db_t *	    db,
+	isc_result_t (*getnsec3parameters)(dns_db_t	    *db,
 					   dns_dbversion_t *version,
 					   dns_hash_t *hash, uint8_t *flags,
-					   uint16_t *	  iterations,
+					   uint16_t	    *iterations,
 					   unsigned char *salt,
-					   size_t *	  salt_len);
+					   size_t	  *salt_len);
 	isc_result_t (*findnsec3node)(dns_db_t *db, const dns_name_t *name,
 				      bool create, dns_dbnode_t **nodep);
 	isc_result_t (*setsigningtime)(dns_db_t *db, dns_rdataset_t *rdataset,
@@ -160,16 +160,16 @@ typedef struct dns_dbmethods {
 	isc_result_t (*findnodeext)(dns_db_t *db, const dns_name_t *name,
 				    bool		     create,
 				    dns_clientinfomethods_t *methods,
-				    dns_clientinfo_t *	     clientinfo,
-				    dns_dbnode_t **	     nodep);
+				    dns_clientinfo_t	     *clientinfo,
+				    dns_dbnode_t		 **nodep);
 	isc_result_t (*findext)(dns_db_t *db, const dns_name_t *name,
 				dns_dbversion_t *version, dns_rdatatype_t type,
 				unsigned int options, isc_stdtime_t now,
 				dns_dbnode_t **nodep, dns_name_t *foundname,
 				dns_clientinfomethods_t *methods,
-				dns_clientinfo_t *	 clientinfo,
-				dns_rdataset_t *	 rdataset,
-				dns_rdataset_t *	 sigrdataset);
+				dns_clientinfo_t	 *clientinfo,
+				dns_rdataset_t	       *rdataset,
+				dns_rdataset_t	       *sigrdataset);
 	isc_result_t (*setcachestats)(dns_db_t *db, isc_stats_t *stats);
 	size_t (*hashsize)(dns_db_t *db);
 	isc_result_t (*nodefullname)(dns_db_t *db, dns_dbnode_t *node,
@@ -184,7 +184,7 @@ typedef struct dns_dbmethods {
 	isc_result_t (*adjusthashsize)(dns_db_t *db, size_t size);
 } dns_dbmethods_t;

-typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t *	     mctx,
+typedef isc_result_t (*dns_dbcreatefunc_t)(isc_mem_t	     *mctx,
 					   const dns_name_t *name,
 					   dns_dbtype_t	     type,
 					   dns_rdataclass_t  rdclass,
@@ -212,7 +212,7 @@ struct dns_db {
 	uint16_t	 attributes;
 	dns_rdataclass_t rdclass;
 	dns_name_t	 origin;
-	isc_mem_t *	 mctx;
+	isc_mem_t	  *mctx;
 	ISC_LIST(dns_dbonupdatelistener_t) update_listeners;
 };

@@ -221,7 +221,7 @@ struct dns_db {

 struct dns_dbonupdatelistener {
 	dns_dbupdate_callback_t onupdate;
-	void *			onupdate_arg;
+	void		     *onupdate_arg;
 	ISC_LINK(dns_dbonupdatelistener_t) link;
 };

@@ -96,7 +96,7 @@ struct dns_dbiterator {
 	/* Unlocked. */
 	unsigned int		 magic;
 	dns_dbiteratormethods_t *methods;
-	dns_db_t *		 db;
+	dns_db_t		 *db;
 	bool			 relative_names;
 	bool			 cleaning;
 };
@@ -73,7 +73,7 @@ typedef ISC_LIST(dns_difftuple_t) dns_difftuplelist_t;

 struct dns_difftuple {
 	unsigned int magic;
-	isc_mem_t *  mctx;
+	isc_mem_t	  *mctx;
 	dns_diffop_t op;
 	dns_name_t   name;
 	dns_ttl_t    ttl;
@@ -94,7 +94,7 @@ typedef struct dns_diff dns_diff_t;

 struct dns_diff {
 	unsigned int	    magic;
-	isc_mem_t *	    mctx;
+	isc_mem_t	  *mctx;
 	dns_difftuplelist_t tuples;
 };

@@ -89,7 +89,7 @@ struct dns_dispatchevent {
 * round-robin fashion.
 */
 struct dns_dispatchset {
-	isc_mem_t *	 mctx;
+	isc_mem_t	  *mctx;
 	dns_dispatch_t **dispatches;
 	int		 ndisp;
 	int		 cur;
@@ -198,7 +198,7 @@ dns_dispatchmgr_getblackhole(dns_dispatchmgr_t *mgr);

 void
 dns_dispatchmgr_setblackportlist(dns_dispatchmgr_t *mgr,
-				 dns_portlist_t *   portlist);
+				 dns_portlist_t	*portlist);
 /*%<
 * This function is deprecated.  Use dns_dispatchmgr_setavailports() instead.
 *
@@ -412,7 +412,7 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, unsigned int options,
 */

 void
-dns_dispatch_removeresponse(dns_dispentry_t **	  resp,
+dns_dispatch_removeresponse(dns_dispentry_t	    **resp,
 			    dns_dispatchevent_t **sockevent);
 /*%<
 * Stops the flow of responses for the provided id and destination.
@@ -97,11 +97,11 @@ ISC_LANG_BEGINDECLS
 #define DNS_DLZ_VALID(dlz) ISC_MAGIC_VALID(dlz, DNS_DLZ_MAGIC)

 typedef isc_result_t (*dns_dlzallowzonexfr_t)(void *driverarg, void *dbdata,
-					      isc_mem_t *	    mctx,
+					      isc_mem_t		*mctx,
 					      dns_rdataclass_t	    rdclass,
-					      const dns_name_t *    name,
+					      const dns_name_t     *name,
 					      const isc_sockaddr_t *clientaddr,
-					      dns_db_t **	    dbp);
+					      dns_db_t	       **dbp);

 /*%<
 * Method prototype.  Drivers implementing the DLZ interface MUST
@@ -135,12 +135,12 @@ typedef void (*dns_dlzdestroy_t)(void *driverarg, void **dbdata);
 */

 typedef isc_result_t (*dns_dlzfindzone_t)(void *driverarg, void *dbdata,
-					  isc_mem_t *		   mctx,
+					  isc_mem_t		    *mctx,
 					  dns_rdataclass_t	   rdclass,
-					  const dns_name_t *	   name,
+					  const dns_name_t	   *name,
 					  dns_clientinfomethods_t *methods,
-					  dns_clientinfo_t *	   clientinfo,
-					  dns_db_t **		   dbp);
+					  dns_clientinfo_t	   *clientinfo,
+					  dns_db_t		   **dbp);

 /*%<
 * Method prototype.  Drivers implementing the DLZ interface MUST
@@ -167,7 +167,7 @@ typedef isc_result_t (*dns_dlzfindzone_t)(void *driverarg, void *dbdata,
 */

 typedef isc_result_t (*dns_dlzconfigure_t)(void *driverarg, void *dbdata,
-					   dns_view_t * view,
+					   dns_view_t  *view,
 					   dns_dlzdb_t *dlzdb);
 /*%<
 * Method prototype.  Drivers implementing the DLZ interface may
@@ -176,8 +176,8 @@ typedef isc_result_t (*dns_dlzconfigure_t)(void *driverarg, void *dbdata,
 * may call configuration functions during the configure call
 */

-typedef bool (*dns_dlzssumatch_t)(const dns_name_t *   signer,
-				  const dns_name_t *   name,
+typedef bool (*dns_dlzssumatch_t)(const dns_name_t	   *signer,
+				  const dns_name_t	   *name,
 				  const isc_netaddr_t *tcpaddr,
 				  dns_rdatatype_t type, const dst_key_t *key,
 				  void *driverarg, void *dbdata);
@@ -199,10 +199,10 @@ typedef struct dns_dlzmethods {

 /*% information about a DLZ driver */
 struct dns_dlzimplementation {
-	const char *		name;
+	const char		   *name;
 	const dns_dlzmethods_t *methods;
-	isc_mem_t *		mctx;
-	void *			driverarg;
+	isc_mem_t		  *mctx;
+	void		     *driverarg;
 	ISC_LINK(dns_dlzimplementation_t) link;
 };

@@ -212,12 +212,12 @@ typedef isc_result_t (*dlzconfigure_callback_t)(dns_view_t *, dns_dlzdb_t *,
 /*% An instance of a DLZ driver */
 struct dns_dlzdb {
 	unsigned int		 magic;
-	isc_mem_t *		 mctx;
+	isc_mem_t		  *mctx;
 	dns_dlzimplementation_t *implementation;
-	void *			 dbdata;
+	void		     *dbdata;
 	dlzconfigure_callback_t	 configure_callback;
 	bool			 search;
-	char *			 dlzname;
+	char		     *dlzname;
 	ISC_LINK(dns_dlzdb_t) link;
 	dns_ssutable_t *ssutable;
 };
@@ -56,7 +56,7 @@ dlz_dlopen_destroy_t(void *dbdata);
 typedef isc_result_t
 dlz_dlopen_findzonedb_t(void *dbdata, const char *name,
 			dns_clientinfomethods_t *methods,
-			dns_clientinfo_t *	 clientinfo);
+			dns_clientinfo_t	 *clientinfo);

 /*
 * dlz_dlopen_lookup() is required for all DLZ external drivers
@@ -49,9 +49,9 @@ typedef struct rpsdb {
 	int		    ref_cnt;
 	librpz_result_id_t  hit_id;
 	librpz_result_t	    result;
-	librpz_rsp_t *	    rsp;
+	librpz_rsp_t	     *rsp;
 	librpz_domain_buf_t origin_buf;
-	const dns_name_t *  qname;
+	const dns_name_t	 *qname;
 	rpsnode_t	    origin_node;
 	rpsnode_t	    data_node;
 } rpsdb_t;
@@ -33,14 +33,14 @@ ISC_LANG_BEGINDECLS
 */
 struct dns_dyndbctx {
 	unsigned int	magic;
-	const void *	hashinit;
-	isc_mem_t *	mctx;
-	isc_log_t *	lctx;
-	dns_view_t *	view;
-	dns_zonemgr_t * zmgr;
-	isc_task_t *	task;
+	const void	   *hashinit;
+	isc_mem_t	  *mctx;
+	isc_log_t	  *lctx;
+	dns_view_t	   *view;
+	dns_zonemgr_t  *zmgr;
+	isc_task_t	   *task;
 	isc_timermgr_t *timermgr;
-	unsigned int *	memdebug;
+	unsigned int   *memdebug;
 };

 #define DNS_DYNDBCTX_MAGIC    ISC_MAGIC('D', 'd', 'b', 'c')
@@ -79,7 +79,7 @@ typedef enum {

 typedef struct dns_geoip_elem {
 	dns_geoip_subtype_t subtype;
-	void *		    db;
+	void		     *db;
 	union {
 		char as_string[256];
 		int  as_int;
@@ -101,9 +101,9 @@ struct dns_geoip_databases {
 ISC_LANG_BEGINDECLS

 bool
-dns_geoip_match(const isc_netaddr_t *	     reqaddr,
+dns_geoip_match(const isc_netaddr_t	    *reqaddr,
 		const dns_geoip_databases_t *geoip,
-		const dns_geoip_elem_t *     elt);
+		const dns_geoip_elem_t      *elt);

 ISC_LANG_ENDDECLS

@@ -24,9 +24,9 @@
 */
 struct dns_ipkeylist {
 	isc_sockaddr_t *addrs;
-	isc_dscp_t *	dscps;
-	dns_name_t **	keys;
-	dns_name_t **	labels;
+	isc_dscp_t	   *dscps;
+	dns_name_t	   **keys;
+	dns_name_t	   **labels;
 	uint32_t	count;
 	uint32_t	allocated;
 };
@@ -23,7 +23,7 @@

 struct dns_iptable {
 	unsigned int	  magic;
-	isc_mem_t *	  mctx;
+	isc_mem_t	  *mctx;
 	isc_refcount_t	  refcount;
 	isc_radix_tree_t *radix;
 	ISC_LINK(dns_iptable_t) nextincache;
@@ -60,8 +60,8 @@ struct dns_kasp_nsec3param {
 /* Stores a DNSSEC policy */
 struct dns_kasp {
 	unsigned int magic;
-	isc_mem_t *  mctx;
-	char *	     name;
+	isc_mem_t	  *mctx;
+	char	     *name;

 	/* Internals. */
 	isc_mutex_t lock;
@@ -373,7 +373,7 @@ typedef struct librpz_client librpz_client_t;
 * @param mutex: pointer to the lock for the client handle
 * @param log_ctx: NULL or resolver's context log messages
 */
-typedef librpz_clist_t *(librpz_clist_create_t)(librpz_emsg_t * emsg,
+typedef librpz_clist_t *(librpz_clist_create_t)(librpz_emsg_t  *emsg,
 						librpz_mutex_t *lock,
 						librpz_mutex_t *unlock,
 						librpz_mutex_t *mutex_destroy,
@@ -394,9 +394,9 @@ LIBDEF_F(clist_detach)
 * @param use_expired: true to not ignore expired zones
 * @return client handle or NULL if the handle could not be created
 */
-typedef librpz_client_t *(librpz_client_create_t)(librpz_emsg_t * emsg,
+typedef librpz_client_t *(librpz_client_create_t)(librpz_emsg_t	*emsg,
 						  librpz_clist_t *clist,
-						  const char *	  cstr,
+						  const char     *cstr,
 						  bool		  use_expired);
 LIBDEF_F(client_create)

@@ -493,9 +493,9 @@ LIBDEF_F(have_ns_trig)
 * @param[in,out] rsp state from librpz_itr_start()
 * @return false on error
 */
-typedef bool(librpz_rsp_clientip_prefix_t)(librpz_emsg_t *  emsg,
+typedef bool(librpz_rsp_clientip_prefix_t)(librpz_emsg_t	 *emsg,
 					   librpz_prefix_t *prefix,
-					   librpz_rsp_t *   rsp);
+					   librpz_rsp_t	*rsp);
 LIBDEF_F(rsp_clientip_prefix)

 /**
@@ -508,9 +508,9 @@ LIBDEF_F(rsp_clientip_prefix)
 * @param[in,out] rsp state from librpz_itr_start()
 * @return false on error
 */
-typedef bool(librpz_rsp_domain_t)(librpz_emsg_t *      emsg,
+typedef bool(librpz_rsp_domain_t)(librpz_emsg_t	*emsg,
 				  librpz_domain_buf_t *owner,
-				  librpz_rsp_t *       rsp);
+				  librpz_rsp_t	       *rsp);
 LIBDEF_F(rsp_domain)

 /**
@@ -766,7 +766,7 @@ typedef socku_t *(librpz_mk_inet_su_t)(socku_t *su, const struct in_addr *addrp,
 				       in_port_t port);
 LIBDEF_F(mk_inet_su)

-typedef socku_t *(librpz_mk_inet6_su_t)(socku_t *	       su,
+typedef socku_t *(librpz_mk_inet6_su_t)(socku_t		*su,
 					const struct in6_addr *addrp,
 					uint32_t scope_id, in_port_t port);
 LIBDEF_F(mk_inet6_su)
@@ -789,57 +789,57 @@ LIBDEF(const char *, librpz_dnsrpzd_path)
 * This is the dlopen() interface to librpz.
 */
 typedef const struct {
-	const char *			  dnsrpzd_path;
-	const char *			  version;
-	librpz_parse_log_opt_t *	  parse_log_opt;
-	librpz_log_level_val_t *	  log_level_val;
-	librpz_set_log_t *		  set_log;
-	librpz_vpemsg_t *		  vpemsg;
-	librpz_pemsg_t *		  pemsg;
-	librpz_vlog_t *			  vlog;
-	librpz_log_t *			  log;
+	const char			   *dnsrpzd_path;
+	const char			   *version;
+	librpz_parse_log_opt_t	       *parse_log_opt;
+	librpz_log_level_val_t	       *log_level_val;
+	librpz_set_log_t		 *set_log;
+	librpz_vpemsg_t			*vpemsg;
+	librpz_pemsg_t		       *pemsg;
+	librpz_vlog_t		      *vlog;
+	librpz_log_t		     *log;
 	librpz_fatal_t *fatal		  LIBRPZ_NORET;
 	librpz_rpz_assert_t *rpz_assert	  LIBRPZ_NORET;
 	librpz_rpz_vassert_t *rpz_vassert LIBRPZ_NORET;
-	librpz_clist_create_t *		  clist_create;
-	librpz_clist_detach_t *		  clist_detach;
-	librpz_client_create_t *	  client_create;
-	librpz_connect_t *		  connect;
-	librpz_client_detach_t *	  client_detach;
-	librpz_rsp_create_t *		  rsp_create;
-	librpz_rsp_detach_t *		  rsp_detach;
-	librpz_rsp_result_t *		  rsp_result;
-	librpz_have_trig_t *		  have_trig;
-	librpz_have_ns_trig_t *		  have_ns_trig;
-	librpz_rsp_clientip_prefix_t *	  rsp_clientip_prefix;
-	librpz_rsp_domain_t *		  rsp_domain;
-	librpz_rsp_rr_t *		  rsp_rr;
-	librpz_rsp_soa_t *		  rsp_soa;
-	librpz_soa_serial_t *		  soa_serial;
-	librpz_rsp_push_t *		  rsp_push;
-	librpz_rsp_pop_t *		  rsp_pop;
-	librpz_rsp_pop_discard_t *	  rsp_pop_discard;
-	librpz_rsp_forget_zone_t *	  rsp_forget_zone;
-	librpz_ck_ip_t *		  ck_ip;
-	librpz_ck_domain_t *		  ck_domain;
-	librpz_zone_refresh_t *		  zone_refresh;
-	librpz_db_info_t *		  db_info;
-	librpz_itr_start_t *		  itr_start;
-	librpz_mf_stats_t *		  mf_stats;
-	librpz_vers_stats_t *		  vers_stats;
-	librpz_itr_zone_t *		  itr_zone;
-	librpz_itr_node_t *		  itr_node;
-	librpz_policy2str_t *		  policy2str;
-	librpz_trig2str_t *		  trig2str;
-	librpz_secs2str_t *		  secs2str;
-	librpz_str2secs_t *		  str2secs;
-	librpz_rtype2str_t *		  rtype2str;
-	librpz_domain_ntop_t *		  domain_ntop;
-	librpz_domain_pton2_t *		  domain_pton2;
-	librpz_mk_inet_su_t *		  mk_inet_su;
-	librpz_mk_inet6_su_t *		  mk_inet6_su;
-	librpz_str2su_t *		  str2su;
-	librpz_su2str_t *		  su2str;
+	librpz_clist_create_t	      *clist_create;
+	librpz_clist_detach_t	      *clist_detach;
+	librpz_client_create_t	       *client_create;
+	librpz_connect_t		 *connect;
+	librpz_client_detach_t	       *client_detach;
+	librpz_rsp_create_t		    *rsp_create;
+	librpz_rsp_detach_t		    *rsp_detach;
+	librpz_rsp_result_t		    *rsp_result;
+	librpz_have_trig_t		   *have_trig;
+	librpz_have_ns_trig_t	      *have_ns_trig;
+	librpz_rsp_clientip_prefix_t     *rsp_clientip_prefix;
+	librpz_rsp_domain_t		    *rsp_domain;
+	librpz_rsp_rr_t			*rsp_rr;
+	librpz_rsp_soa_t		 *rsp_soa;
+	librpz_soa_serial_t		    *soa_serial;
+	librpz_rsp_push_t		  *rsp_push;
+	librpz_rsp_pop_t		 *rsp_pop;
+	librpz_rsp_pop_discard_t	 *rsp_pop_discard;
+	librpz_rsp_forget_zone_t	 *rsp_forget_zone;
+	librpz_ck_ip_t		       *ck_ip;
+	librpz_ck_domain_t		   *ck_domain;
+	librpz_zone_refresh_t	      *zone_refresh;
+	librpz_db_info_t		 *db_info;
+	librpz_itr_start_t		   *itr_start;
+	librpz_mf_stats_t		  *mf_stats;
+	librpz_vers_stats_t		    *vers_stats;
+	librpz_itr_zone_t		  *itr_zone;
+	librpz_itr_node_t		  *itr_node;
+	librpz_policy2str_t		    *policy2str;
+	librpz_trig2str_t		  *trig2str;
+	librpz_secs2str_t		  *secs2str;
+	librpz_str2secs_t		  *str2secs;
+	librpz_rtype2str_t		   *rtype2str;
+	librpz_domain_ntop_t	     *domain_ntop;
+	librpz_domain_pton2_t	      *domain_pton2;
+	librpz_mk_inet_su_t		    *mk_inet_su;
+	librpz_mk_inet6_su_t	     *mk_inet6_su;
+	librpz_str2su_t			*str2su;
+	librpz_su2str_t			*su2str;
 } librpz_0_t;
 extern librpz_0_t librpz_def_0;

@@ -851,7 +851,7 @@ extern librpz_0_t librpz_def_0;
 #define LIBRPZ_DEF_STR "librpz_def_0"

 typedef librpz_0_t librpz_t;
-extern librpz_t *  librpz;
+extern librpz_t	*librpz;

 #if LIBRPZ_LIB_OPEN == 2
 #include <dlfcn.h>
@@ -865,7 +865,7 @@ extern librpz_t *  librpz;
 */
 static inline librpz_t *
 librpz_lib_open(librpz_emsg_t *emsg, void **dl_handle, const char *path) {
-	void *	  handle;
+	void     *handle;
 	librpz_t *new_librpz;

 	emsg->c[0] = '\0';
@@ -18,7 +18,7 @@
 #include <isc/lang.h>
 #include <isc/log.h>

-LIBDNS_EXTERNAL_DATA extern isc_log_t *	      dns_lctx;
+LIBDNS_EXTERNAL_DATA extern isc_log_t	      *dns_lctx;
 LIBDNS_EXTERNAL_DATA extern isc_logcategory_t dns_categories[];
 LIBDNS_EXTERNAL_DATA extern isc_logmodule_t   dns_modules[];

@@ -57,11 +57,11 @@ ISC_LANG_BEGINDECLS
 typedef struct dns_lookupevent {
 	ISC_EVENT_COMMON(struct dns_lookupevent);
 	isc_result_t	result;
-	dns_name_t *	name;
+	dns_name_t	   *name;
 	dns_rdataset_t *rdataset;
 	dns_rdataset_t *sigrdataset;
-	dns_db_t *	db;
-	dns_dbnode_t *	node;
+	dns_db_t	 *db;
+	dns_dbnode_t   *node;
 } dns_lookupevent_t;

 isc_result_t
@@ -244,7 +244,7 @@ dns_dumpctx_db(dns_dumpctx_t *dctx);
 /*@{*/
 isc_result_t
 dns_master_dumptostreamasync(isc_mem_t *mctx, dns_db_t *db,
-			     dns_dbversion_t *	       version,
+			     dns_dbversion_t	     *version,
 			     const dns_master_style_t *style, FILE *f,
 			     isc_task_t *task, dns_dumpdonefunc_t done,
 			     void *done_arg, dns_dumpctx_t **dctxp);
@@ -310,8 +310,8 @@ dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 /*@}*/

 isc_result_t
-dns_master_rdatasettotext(const dns_name_t *	    owner_name,
-			  dns_rdataset_t *	    rdataset,
+dns_master_rdatasettotext(const dns_name_t	   *owner_name,
+			  dns_rdataset_t		 *rdataset,
 			  const dns_master_style_t *style, dns_indent_t *indent,
 			  isc_buffer_t *target);
 /*%<
@@ -327,15 +327,15 @@ dns_master_rdatasettotext(const dns_name_t *	    owner_name,
 */

 isc_result_t
-dns_master_questiontotext(const dns_name_t *	    owner_name,
-			  dns_rdataset_t *	    rdataset,
+dns_master_questiontotext(const dns_name_t	   *owner_name,
+			  dns_rdataset_t		 *rdataset,
 			  const dns_master_style_t *style,
-			  isc_buffer_t *	    target);
+			  isc_buffer_t	       *target);

 isc_result_t
 dns_master_dumpnodetostream(isc_mem_t *mctx, dns_db_t *db,
 			    dns_dbversion_t *version, dns_dbnode_t *node,
-			    const dns_name_t *	      name,
+			    const dns_name_t	     *name,
 			    const dns_master_style_t *style, FILE *f);

 isc_result_t
@@ -347,7 +347,7 @@ dns_masterstyle_flags_t
 dns_master_styleflags(const dns_master_style_t *style);

 isc_result_t
-dns_master_stylecreate(dns_master_style_t **   style,
+dns_master_stylecreate(dns_master_style_t	  **style,
 		       dns_masterstyle_flags_t flags, unsigned int ttl_column,
 		       unsigned int class_column, unsigned int type_column,
 		       unsigned int rdata_column, unsigned int line_length,
@@ -194,8 +194,8 @@ typedef int dns_messagetextflag_t;
 typedef struct dns_msgblock dns_msgblock_t;

 struct dns_sortlist_arg {
-	dns_aclenv_t *		env;
-	const dns_acl_t *	acl;
+	dns_aclenv_t	     *env;
+	const dns_acl_t	*acl;
 	const dns_aclelement_t *element;
 };

@@ -215,7 +215,7 @@ struct dns_message {

 	/* private from here down */
 	dns_namelist_t	sections[DNS_SECTION_MAX];
-	dns_name_t *	cursors[DNS_SECTION_MAX];
+	dns_name_t	   *cursors[DNS_SECTION_MAX];
 	dns_rdataset_t *opt;
 	dns_rdataset_t *sig0;
 	dns_rdataset_t *tsig;
@@ -241,10 +241,10 @@ struct dns_message {
 	uint16_t     padding;
 	unsigned int padding_off;

-	isc_buffer_t *	buffer;
+	isc_buffer_t   *buffer;
 	dns_compress_t *cctx;

-	isc_mem_t *    mctx;
+	isc_mem_t	  *mctx;
 	isc_mempool_t *namepool;
 	isc_mempool_t *rdspool;

@@ -263,14 +263,14 @@ struct dns_message {
 	dns_name_t *tsigname; /* Owner name of TSIG, if any
 			       * */
 	dns_rdataset_t *querytsig;
-	dns_tsigkey_t * tsigkey;
-	dst_context_t * tsigctx;
+	dns_tsigkey_t  *tsigkey;
+	dst_context_t  *tsigctx;
 	int		sigstart;
 	int		timeadjust;

 	dns_name_t *sig0name; /* Owner name of SIG0, if any
 			       * */
-	dst_key_t *  sig0key;
+	dst_key_t	  *sig0key;
 	dns_rcode_t  sig0status;
 	isc_region_t query;
 	isc_region_t saved;
@@ -368,7 +368,7 @@ isc_result_t
 dns_message_pseudosectiontotext(dns_message_t *msg, dns_pseudosection_t section,
 				const dns_master_style_t *style,
 				dns_messagetextflag_t	  flags,
-				isc_buffer_t *		  target);
+				isc_buffer_t	     *target);
 /*%<
 * Convert section 'section' or 'pseudosection' of message 'msg' to
 * a cleartext representation
@@ -107,7 +107,7 @@ struct dns_name {
 	unsigned int   labels;
 	unsigned int   attributes;
 	unsigned char *offsets;
-	isc_buffer_t * buffer;
+	isc_buffer_t  *buffer;
 	ISC_LINK(dns_name_t) link;
 	ISC_LIST(dns_rdataset_t) list;
 };
@@ -1382,9 +1382,9 @@ ISC_LANG_ENDDECLS

 #define DNS_NAME_SPLIT(n, l, p, s)                                             \
 	do {                                                                   \
-		dns_name_t * _n = (n);                                         \
-		dns_name_t * _p = (p);                                         \
-		dns_name_t * _s = (s);                                         \
+		dns_name_t  *_n = (n);                                         \
+		dns_name_t  *_p = (p);                                         \
+		dns_name_t  *_s = (s);                                         \
 		unsigned int _l = (l);                                         \
 		if (_p != NULL)                                                \
 			dns_name_getlabelsequence(_n, 0, _n->labels - _l, _p); \
@@ -107,7 +107,7 @@ dns_nsec3_supportedhash(dns_hash_t hash);

 isc_result_t
 dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version,
-		   const dns_name_t *		 name,
+		   const dns_name_t		    *name,
 		   const dns_rdata_nsec3param_t *nsec3param, dns_ttl_t nsecttl,
 		   bool unsecure, dns_diff_t *diff);

@@ -154,7 +154,7 @@ dns_nsec3_addnsec3sx(dns_db_t *db, dns_dbversion_t *version,

 isc_result_t
 dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version,
-		   const dns_name_t *		 name,
+		   const dns_name_t		    *name,
 		   const dns_rdata_nsec3param_t *nsec3param, dns_diff_t *diff);

 isc_result_t
@@ -164,7 +164,7 @@ dns_nsec3_delnsec3s(dns_db_t *db, dns_dbversion_t *version,
 isc_result_t
 dns_nsec3_delnsec3sx(dns_db_t *db, dns_dbversion_t *version,
 		     const dns_name_t *name, dns_rdatatype_t private,
-		     dns_diff_t *      diff);
+		     dns_diff_t	*diff);
 /*%<
 * Remove NSEC3 records for 'name', recording the change in 'diff'.
 * Adjust previous NSEC3 records, if any, to reflect the removal.
@@ -45,11 +45,11 @@ ISC_LANG_BEGINDECLS
 struct dns_ntatable {
 	/* Unlocked. */
 	unsigned int	magic;
-	dns_view_t *	view;
+	dns_view_t	   *view;
 	isc_rwlock_t	rwlock;
-	isc_taskmgr_t * taskmgr;
+	isc_taskmgr_t  *taskmgr;
 	isc_timermgr_t *timermgr;
-	isc_task_t *	task;
+	isc_task_t	   *task;
 	/* Protected by atomics */
 	isc_refcount_t references;
 	/* Locked by rwlock. */
@@ -74,12 +74,12 @@ struct dns_peer {
 	bool		      request_expire;
 	bool		      force_tcp;
 	bool		      tcp_keepalive;
-	dns_name_t *	      key;
-	isc_sockaddr_t *      transfer_source;
+	dns_name_t	   *key;
+	isc_sockaddr_t       *transfer_source;
 	isc_dscp_t	      transfer_dscp;
-	isc_sockaddr_t *      notify_source;
+	isc_sockaddr_t       *notify_source;
 	isc_dscp_t	      notify_dscp;
-	isc_sockaddr_t *      query_source;
+	isc_sockaddr_t       *query_source;
 	isc_dscp_t	      query_dscp;
 	uint16_t	      udpsize;	   /* receive size */
 	uint16_t	      maxudp;	   /* transmit size */
@@ -213,7 +213,7 @@ isc_result_t
 dns_peer_setkey(dns_peer_t *peer, dns_name_t **keyval);

 isc_result_t
-dns_peer_settransfersource(dns_peer_t *		 peer,
+dns_peer_settransfersource(dns_peer_t	      *peer,
 			   const isc_sockaddr_t *transfer_source);

 isc_result_t
@@ -167,8 +167,8 @@ struct dns_rbtnode {
 };

 typedef isc_result_t (*dns_rbtfindcallback_t)(dns_rbtnode_t *node,
-					      dns_name_t *   name,
-					      void *	     callback_arg);
+					      dns_name_t	 *name,
+					      void	   *callback_arg);

 typedef isc_result_t (*dns_rbtdatawriter_t)(FILE *file, unsigned char *data,
 					    void *arg, uint64_t *crc);
@@ -760,7 +760,7 @@ dns_rbt_deserialize_tree(void *base_address, size_t filesize,

 void
 dns_rbt_printtext(dns_rbt_t *rbt, void (*data_printer)(FILE *, void *),
-		  FILE *     f);
+		  FILE      *f);
 /*%<
 * Print an ASCII representation of the internal structure of the red-black
 * tree of trees to the passed stream.
@@ -108,7 +108,7 @@ ISC_LANG_BEGINDECLS
 * purpose the client desires.
 */
 struct dns_rdata {
-	unsigned char *	 data;
+	unsigned char   *data;
 	unsigned int	 length;
 	dns_rdataclass_t rdclass;
 	dns_rdatatype_t	 type;
@@ -96,7 +96,7 @@ dns_rdatalist_tordataset(dns_rdatalist_t *rdatalist, dns_rdataset_t *rdataset);
 */

 isc_result_t
-dns_rdatalist_fromrdataset(dns_rdataset_t *  rdataset,
+dns_rdatalist_fromrdataset(dns_rdataset_t	  *rdataset,
 			   dns_rdatalist_t **rdatalist);
 /*%<
 * Point 'rdatalist' to the rdatalist in 'rdataset'.
@@ -68,11 +68,11 @@ typedef struct dns_rdatasetmethods {
 	void (*current)(dns_rdataset_t *rdataset, dns_rdata_t *rdata);
 	void (*clone)(dns_rdataset_t *source, dns_rdataset_t *target);
 	unsigned int (*count)(dns_rdataset_t *rdataset);
-	isc_result_t (*addnoqname)(dns_rdataset_t *  rdataset,
+	isc_result_t (*addnoqname)(dns_rdataset_t	  *rdataset,
 				   const dns_name_t *name);
 	isc_result_t (*getnoqname)(dns_rdataset_t *rdataset, dns_name_t *name,
 				   dns_rdataset_t *neg, dns_rdataset_t *negsig);
-	isc_result_t (*addclosest)(dns_rdataset_t *  rdataset,
+	isc_result_t (*addclosest)(dns_rdataset_t	  *rdataset,
 				   const dns_name_t *name);
 	isc_result_t (*getclosest)(dns_rdataset_t *rdataset, dns_name_t *name,
 				   dns_rdataset_t *neg, dns_rdataset_t *negsig);
@@ -81,7 +81,7 @@ typedef struct dns_rdatasetmethods {
 	void (*clearprefetch)(dns_rdataset_t *rdataset);
 	void (*setownercase)(dns_rdataset_t *rdataset, const dns_name_t *name);
 	void (*getownercase)(const dns_rdataset_t *rdataset, dns_name_t *name);
-	isc_result_t (*addglue)(dns_rdataset_t * rdataset,
+	isc_result_t (*addglue)(dns_rdataset_t  *rdataset,
 				dns_dbversion_t *version, dns_message_t *msg);
 } dns_rdatasetmethods_t;

@@ -135,13 +135,13 @@ struct dns_rdataset {
 	 * These are for use by the rdataset implementation, and MUST NOT
 	 * be changed by clients.
 	 */
-	void *	     private1;
-	void *	     private2;
-	void *	     private3;
+	void	     *private1;
+	void	     *private2;
+	void	     *private3;
 	unsigned int privateuint4;
-	void *	     private5;
-	const void * private6;
-	const void * private7;
+	void	     *private5;
+	const void  *private6;
+	const void  *private7;
 	/*@}*/
 };

@@ -398,7 +398,7 @@ dns_rdataset_towire(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 */

 isc_result_t
-dns_rdataset_towiresorted(dns_rdataset_t *  rdataset,
+dns_rdataset_towiresorted(dns_rdataset_t	 *rdataset,
 			  const dns_name_t *owner_name, dns_compress_t *cctx,
 			  isc_buffer_t *target, dns_rdatasetorderfunc_t order,
 			  const void *order_arg, unsigned int options,
@@ -414,7 +414,7 @@ dns_rdataset_towiresorted(dns_rdataset_t *  rdataset,
 */

 isc_result_t
-dns_rdataset_towirepartial(dns_rdataset_t *  rdataset,
+dns_rdataset_towirepartial(dns_rdataset_t	  *rdataset,
 			   const dns_name_t *owner_name, dns_compress_t *cctx,
 			   isc_buffer_t *target, dns_rdatasetorderfunc_t order,
 			   const void *order_arg, unsigned int options,
@@ -438,7 +438,7 @@ dns_rdataset_towirepartial(dns_rdataset_t *  rdataset,
 */

 isc_result_t
-dns_rdataset_additionaldata(dns_rdataset_t *	     rdataset,
+dns_rdataset_additionaldata(dns_rdataset_t	   *rdataset,
 			    dns_additionaldatafunc_t add, void *arg);
 /*%<
 * For each rdata in rdataset, call 'add' for each name and type in the
@@ -88,9 +88,9 @@ struct dns_rdatasetiter {
 	/* Unlocked. */
 	unsigned int		   magic;
 	dns_rdatasetitermethods_t *methods;
-	dns_db_t *		   db;
-	dns_dbnode_t *		   node;
-	dns_dbversion_t *	   version;
+	dns_db_t			 *db;
+	dns_dbnode_t		     *node;
+	dns_dbversion_t		*version;
 	isc_stdtime_t		   now;
 };

@@ -143,7 +143,7 @@ dns_rdatasetiter_next(dns_rdatasetiter_t *iterator);

 void
 dns_rdatasetiter_current(dns_rdatasetiter_t *iterator,
-			 dns_rdataset_t *    rdataset);
+			 dns_rdataset_t	*rdataset);
 /*%<
 * Return the current rdataset.
 *
@@ -67,13 +67,13 @@ ISC_LANG_BEGINDECLS
 */
 typedef struct dns_fetchevent {
 	ISC_EVENT_COMMON(struct dns_fetchevent);
-	dns_fetch_t *	      fetch;
+	dns_fetch_t	    *fetch;
 	isc_result_t	      result;
 	dns_rdatatype_t	      qtype;
-	dns_db_t *	      db;
-	dns_dbnode_t *	      node;
-	dns_rdataset_t *      rdataset;
-	dns_rdataset_t *      sigrdataset;
+	dns_db_t		 *db;
+	dns_dbnode_t	     *node;
+	dns_rdataset_t       *rdataset;
+	dns_rdataset_t       *sigrdataset;
 	dns_fixedname_t	      foundname;
 	const isc_sockaddr_t *client;
 	dns_messageid_t	      id;
@@ -289,8 +289,8 @@ dns_resolver_detach(dns_resolver_t **resp);
 isc_result_t
 dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name,
 			 dns_rdatatype_t type, const dns_name_t *domain,
-			 dns_rdataset_t *      nameservers,
-			 dns_forwarders_t *    forwarders,
+			 dns_rdataset_t	*nameservers,
+			 dns_forwarders_t	  *forwarders,
 			 const isc_sockaddr_t *client, dns_messageid_t id,
 			 unsigned int options, unsigned int depth,
 			 isc_counter_t *qc, isc_task_t *task,
@@ -502,7 +502,7 @@ dns_resolver_disable_ds_digest(dns_resolver_t *resolver, const dns_name_t *name,
 */

 bool
-dns_resolver_algorithm_supported(dns_resolver_t *  resolver,
+dns_resolver_algorithm_supported(dns_resolver_t	*resolver,
 				 const dns_name_t *name, unsigned int alg);
 /*%<
 * Check if the given algorithm is supported by this resolver.
@@ -512,7 +512,7 @@ dns_resolver_algorithm_supported(dns_resolver_t *  resolver,
 */

 bool
-dns_resolver_ds_digest_supported(dns_resolver_t *  resolver,
+dns_resolver_ds_digest_supported(dns_resolver_t	*resolver,
 				 const dns_name_t *name,
 				 unsigned int	   digest_type);
 /*%<
@@ -145,20 +145,20 @@ struct dns_rpz_zone {

 	uint32_t min_update_interval;	 /* minimal interval between
 					  * updates */
-	isc_ht_t *	 nodes;		 /* entries in zone */
+	isc_ht_t	 *nodes;		 /* entries in zone */
 	dns_rpz_zones_t *rpzs;		 /* owner */
 	isc_time_t	 lastupdated;	 /* last time the zone was processed
 					  * */
 	bool updatepending;		 /* there is an update
 					  * pending/waiting */
 	bool		 updaterunning;	 /* there is an update running */
-	dns_db_t *	 db;		 /* zones database */
+	dns_db_t	 *db;		 /* zones database */
 	dns_dbversion_t *dbversion;	 /* version we will be updating to */
-	dns_db_t *	 updb;		 /* zones database we're working on */
+	dns_db_t	 *updb;		 /* zones database we're working on */
 	dns_dbversion_t *updbversion;	 /* version we're currently working
 					  * on */
 	dns_dbiterator_t *updbit;	 /* iterator to use when updating */
-	isc_ht_t *	  newnodes;	 /* entries in zone being updated */
+	isc_ht_t	 *newnodes;	 /* entries in zone being updated */
 	bool		  db_registered; /* is the notify event
 					  * registered? */
 	bool	     addsoa;		 /* add soa to the additional section */
@@ -213,7 +213,7 @@ struct dns_rpz_popt {
 */
 struct dns_rpz_zones {
 	dns_rpz_popt_t	   p;
-	dns_rpz_zone_t *   zones[DNS_RPZ_MAX_ZONES];
+	dns_rpz_zone_t    *zones[DNS_RPZ_MAX_ZONES];
 	dns_rpz_triggers_t triggers[DNS_RPZ_MAX_ZONES];

 	/*
@@ -249,10 +249,10 @@ struct dns_rpz_zones {
 	 */
 	dns_rpz_triggers_t total_triggers;

-	isc_mem_t *	mctx;
-	isc_taskmgr_t * taskmgr;
+	isc_mem_t	  *mctx;
+	isc_taskmgr_t  *taskmgr;
 	isc_timermgr_t *timermgr;
-	isc_task_t *	updater;
+	isc_task_t	   *updater;
 	isc_refcount_t	refs;
 	isc_refcount_t	irefs;
 	/*
@@ -265,12 +265,12 @@ struct dns_rpz_zones {
 	isc_mutex_t  maint_lock;

 	dns_rpz_cidr_node_t *cidr;
-	dns_rbt_t *	     rbt;
+	dns_rbt_t		  *rbt;

 	/*
 	 * DNSRPZ librpz configuration string and handle on librpz connection
 	 */
-	char *		      rps_cstr;
+	char		     *rps_cstr;
 	size_t		      rps_cstr_size;
 	struct librpz_client *rps_client;
 };
@@ -293,23 +293,23 @@ typedef struct {
 	 */
 	struct {
 		dns_rpz_type_t	 type;
-		dns_rpz_zone_t * rpz;
+		dns_rpz_zone_t  *rpz;
 		dns_rpz_prefix_t prefix;
 		dns_rpz_policy_t policy;
 		dns_ttl_t	 ttl;
 		isc_result_t	 result;
-		dns_zone_t *	 zone;
-		dns_db_t *	 db;
+		dns_zone_t	   *zone;
+		dns_db_t	 *db;
 		dns_dbversion_t *version;
-		dns_dbnode_t *	 node;
-		dns_rdataset_t * rdataset;
+		dns_dbnode_t    *node;
+		dns_rdataset_t  *rdataset;
 	} m;
 	/*
 	 * State for chasing IP addresses and NS names including recursion.
 	 */
 	struct {
 		unsigned int	label;
-		dns_db_t *	db;
+		dns_db_t	 *db;
 		dns_rdataset_t *ns_rdataset;
 		dns_rdatatype_t r_type;
 		isc_result_t	r_result;
@@ -323,9 +323,9 @@ typedef struct {
 		isc_result_t	result;
 		bool		is_zone;
 		bool		authoritative;
-		dns_zone_t *	zone;
-		dns_db_t *	db;
-		dns_dbnode_t *	node;
+		dns_zone_t	   *zone;
+		dns_db_t	 *db;
+		dns_dbnode_t   *node;
 		dns_rdataset_t *rdataset;
 		dns_rdataset_t *sigrdataset;
 		dns_rdatatype_t qtype;
@@ -351,9 +351,9 @@ typedef struct {
 	 * r_name: recursing for this name to possible policy triggers
 	 * f_name: saved found name from before recursion
 	 */
-	dns_name_t *	p_name;
-	dns_name_t *	r_name;
-	dns_name_t *	fname;
+	dns_name_t	   *p_name;
+	dns_name_t	   *r_name;
+	dns_name_t	   *fname;
 	dns_fixedname_t _p_namef;
 	dns_fixedname_t _r_namef;
 	dns_fixedname_t _fnamef;
@@ -54,11 +54,11 @@ ISC_LANG_BEGINDECLS
 typedef struct dns_rriterator {
 	unsigned int	    magic;
 	isc_result_t	    result;
-	dns_db_t *	    db;
-	dns_dbiterator_t *  dbit;
-	dns_dbversion_t *   ver;
+	dns_db_t		 *db;
+	dns_dbiterator_t	 *dbit;
+	dns_dbversion_t	*ver;
 	isc_stdtime_t	    now;
-	dns_dbnode_t *	    node;
+	dns_dbnode_t	     *node;
 	dns_fixedname_t	    fixedname;
 	dns_rdatasetiter_t *rdatasetit;
 	dns_rdataset_t	    rdataset;
@@ -197,7 +197,7 @@ struct dns_rrl_rate {
 typedef struct dns_rrl dns_rrl_t;
 struct dns_rrl {
 	isc_mutex_t lock;
-	isc_mem_t * mctx;
+	isc_mem_t  *mctx;

 	bool	       log_only;
 	dns_rrl_rate_t responses_per_second;
@@ -52,14 +52,14 @@ typedef struct dns_sdblookup dns_sdblookup_t;
 typedef struct dns_sdballnodes dns_sdballnodes_t;

 typedef isc_result_t (*dns_sdblookupfunc_t)(const char *zone, const char *name,
-					    void *		     dbdata,
-					    dns_sdblookup_t *	     lookup,
+					    void			 *dbdata,
+					    dns_sdblookup_t	    *lookup,
 					    dns_clientinfomethods_t *methods,
 					    dns_clientinfo_t *clientinfo);
-typedef isc_result_t (*dns_sdblookup2func_t)(const dns_name_t *	      zone,
-					     const dns_name_t *	      name,
-					     void *		      dbdata,
-					     dns_sdblookup_t *	      lookup,
+typedef isc_result_t (*dns_sdblookup2func_t)(const dns_name_t	      *zone,
+					     const dns_name_t	      *name,
+					     void			  *dbdata,
+					     dns_sdblookup_t	     *lookup,
 					     dns_clientinfomethods_t *methods,
 					     dns_clientinfo_t *clientinfo);

@@ -146,9 +146,9 @@ typedef void (*dns_sdlzdestroy_t)(void *driverarg, void *dbdata);
 */

 typedef isc_result_t (*dns_sdlzfindzone_t)(void *driverarg, void *dbdata,
-					   const char *		    name,
+					   const char	      *name,
 					   dns_clientinfomethods_t *methods,
-					   dns_clientinfo_t *	    clientinfo);
+					   dns_clientinfo_t	    *clientinfo);
 /*%<
 * Method prototype.  Drivers implementing the SDLZ interface MUST
 * supply a find zone method.  This method is called when the DNS
@@ -178,7 +178,7 @@ typedef isc_result_t (*dns_sdlzfindzone_t)(void *driverarg, void *dbdata,

 typedef isc_result_t (*dns_sdlzlookupfunc_t)(const char *zone, const char *name,
 					     void *driverarg, void *dbdata,
-					     dns_sdlzlookup_t *	      lookup,
+					     dns_sdlzlookup_t	      *lookup,
 					     dns_clientinfomethods_t *methods,
 					     dns_clientinfo_t *clientinfo);

@@ -221,7 +221,7 @@ typedef void (*dns_sdlzcloseversion_t)(const char *zone, bool commit,
 * If the call is successful then *versionp should be set to NULL
 */

-typedef isc_result_t (*dns_sdlzconfigure_t)(dns_view_t * view,
+typedef isc_result_t (*dns_sdlzconfigure_t)(dns_view_t  *view,
 					    dns_dlzdb_t *dlzdb, void *driverarg,
 					    void *dbdata);
 /*%<
@@ -26,11 +26,11 @@ typedef struct dns_tcpmsg {
 	uint16_t	 size;
 	isc_buffer_t	 buffer;
 	unsigned int	 maxsize;
-	isc_mem_t *	 mctx;
-	isc_socket_t *	 sock;
-	isc_task_t *	 task;
+	isc_mem_t	  *mctx;
+	isc_socket_t    *sock;
+	isc_task_t	   *task;
 	isc_taskaction_t action;
-	void *		 arg;
+	void	     *arg;
 	isc_event_t	 event;
 	/* public (read-only) */
 	isc_result_t   result;
@@ -34,11 +34,11 @@ ISC_LANG_BEGINDECLS
 #define DNS_TKEYMODE_DELETE	      5

 struct dns_tkeyctx {
-	dst_key_t *	  dhkey;
-	dns_name_t *	  domain;
+	dst_key_t	  *dhkey;
+	dns_name_t	   *domain;
 	dns_gss_cred_id_t gsscred;
-	isc_mem_t *	  mctx;
-	char *		  gssapi_keytab;
+	isc_mem_t	  *mctx;
+	char	     *gssapi_keytab;
 };

 isc_result_t
@@ -54,10 +54,10 @@ LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_tsig_hmacsha512_name;
 #define DNS_TSIG_FUDGE 300

 struct dns_tsig_keyring {
-	dns_rbt_t *  keys;
+	dns_rbt_t	  *keys;
 	unsigned int writecount;
 	isc_rwlock_t lock;
-	isc_mem_t *  mctx;
+	isc_mem_t	  *mctx;
 	/*
 	 * LRU list of generated key along with a count of the keys on the
 	 * list and a maximum size.
@@ -71,11 +71,11 @@ struct dns_tsig_keyring {
 struct dns_tsigkey {
 	/* Unlocked */
 	unsigned int	    magic; /*%< Magic number. */
-	isc_mem_t *	    mctx;
-	dst_key_t *	    key;       /*%< Key */
+	isc_mem_t	  *mctx;
+	dst_key_t	  *key;       /*%< Key */
 	dns_name_t	    name;      /*%< Key name */
-	const dns_name_t *  algorithm; /*%< Algorithm name */
-	dns_name_t *	    creator;   /*%< name that created secret */
+	const dns_name_t	 *algorithm; /*%< Algorithm name */
+	dns_name_t	   *creator;   /*%< name that created secret */
 	bool		    generated; /*%< was this generated? */
 	isc_stdtime_t	    inception; /*%< start of validity period */
 	isc_stdtime_t	    expire;    /*%< end of validity period */
@@ -162,7 +162,7 @@ typedef struct dns_ipkeylist dns_ipkeylist_t;
 */
 #ifndef GSSAPI
 typedef struct not_defined_gss_cred_id *gss_cred_id_t;
-typedef struct not_defined_gss_ctx *	gss_ctx_id_t;
+typedef struct not_defined_gss_ctx	   *gss_ctx_id_t;
 #endif /* ifndef GSSAPI */
 typedef struct dst_gssapi_signverifyctx dst_gssapi_signverifyctx_t;

@@ -76,7 +76,7 @@ typedef struct dns_validatorevent {
 	/*
 	 * Name and type of the response to be validated.
 	 */
-	dns_name_t *	name;
+	dns_name_t	   *name;
 	dns_rdatatype_t type;
 	/*
 	 * Rdata and RRSIG (if any) for positive responses.
@@ -118,24 +118,24 @@ struct dns_validator {
 	/* Unlocked. */
 	unsigned int magic;
 	isc_mutex_t  lock;
-	dns_view_t * view;
+	dns_view_t  *view;
 	/* Locked by lock. */
 	unsigned int	      options;
 	unsigned int	      attributes;
 	dns_validatorevent_t *event;
-	dns_fetch_t *	      fetch;
-	dns_validator_t *     subvalidator;
-	dns_validator_t *     parent;
-	dns_keytable_t *      keytable;
-	dst_key_t *	      key;
-	dns_rdata_rrsig_t *   siginfo;
-	isc_task_t *	      task;
+	dns_fetch_t	    *fetch;
+	dns_validator_t	*subvalidator;
+	dns_validator_t	*parent;
+	dns_keytable_t       *keytable;
+	dst_key_t		  *key;
+	dns_rdata_rrsig_t	  *siginfo;
+	isc_task_t	   *task;
 	isc_taskaction_t      action;
-	void *		      arg;
+	void		     *arg;
 	unsigned int	      labels;
-	dns_rdataset_t *      currentset;
-	dns_rdataset_t *      keyset;
-	dns_rdataset_t *      dsset;
+	dns_rdataset_t       *currentset;
+	dns_rdataset_t       *keyset;
+	dns_rdataset_t       *dsset;
 	dns_rdataset_t	      fdsset;
 	dns_rdataset_t	      frdataset;
 	dns_rdataset_t	      fsigrdataset;
--- a/Show More
+++ b/Show More