log when initializing mutex and rwlock

Merge branch 'ondrej/remove-debian-jessie-from-gitlab-ci' into 'master'
Remove Debian 8 ("jessie") from the GitLab CI See merge request isc-projects/bind9!3281
2020-03-24 15:27:20 -07:00 · 2020-03-24 13:50:41 +00:00 · 2020-03-24 14:24:47 +01:00 · 2020-03-24 08:56:20 +00:00 · 2020-03-24 07:36:24 +01:00 · 2020-03-24 04:22:43 +00:00
188 changed files with 5352 additions and 7967 deletions
@@ -7,4 +7,5 @@
 /doc/dev			 export-ignore
 /util/**			 export-ignore
 /util/bindkeys.pl		-export-ignore
+/util/check-make-install.in	-export-ignore
 /util/mksymtbl.pl		-export-ignore
@@ -15,7 +15,7 @@ variables:
  BUILD_PARALLEL_JOBS: 6
  TEST_PARALLEL_JOBS: 6

-  MAKE: make
+  MAKE_COMMAND: make
  CONFIGURE: ./configure
  CLANG: clang-9
  SCAN_BUILD: scan-build-9
@@ -47,7 +47,7 @@ stages:

 .freebsd-amd64: &freebsd_amd64
  tags:
-    - freebsd
+    - libvirt
    - amd64

 .linux-amd64: &linux_amd64
@@ -94,10 +94,6 @@ stages:

 # Debian

-.debian-jessie-amd64: &debian_jessie_amd64_image
-  image: "$CI_REGISTRY_IMAGE:debian-jessie-amd64"
-  <<: *linux_amd64
-
 .debian-stretch-amd64: &debian_stretch_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-stretch-amd64"
  <<: *linux_amd64
@@ -182,11 +178,7 @@ stages:
  script:
    - autoreconf -fi
  artifacts:
-    paths:
-      - aclocal.m4
-      - configure
-      - ltmain.sh
-      - m4/libtool.m4
+    untracked: true
    expire_in: "1 day"

 .configure: &configure |
@@ -211,13 +203,12 @@ stages:
    - test -n "${OOT_BUILD_WORKSPACE}" && mkdir "${OOT_BUILD_WORKSPACE}" && cd "${OOT_BUILD_WORKSPACE}"
  script:
    - *configure
-    - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - ${MAKE_COMMAND} -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
    - test -z "${RUN_MAKE_INSTALL}" || make install
    - test -z "${RUN_MAKE_INSTALL}" || sh util/check-make-install
-  dependencies:
-    - autoreconf:sid:amd64
  needs:
-    - autoreconf:sid:amd64
+    - job: autoreconf:sid:amd64
+      artifacts: true
  artifacts:
    untracked: true
    expire_in: "1 day"
@@ -245,9 +236,9 @@ stages:
         x64'
    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
-  dependencies: []
  needs:
-    - autoreconf:sid:amd64
+    - job: autoreconf:sid:amd64
+      artifacts: false
  artifacts:
    untracked: true
    expire_in: "1 day"
@@ -318,10 +309,7 @@ stages:
  after_script:
    - *kyua_report_html
  artifacts:
-    paths:
-      - kyua.log
-      - kyua.results
-      - kyua_html/
+    untracked: true
    expire_in: "1 day"
    when: on_failure

@@ -390,6 +378,7 @@ misc:sid:amd64:
    - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
    - xmllint --noout --nonet --html `git ls-files '*.html'`
    - sh util/check-win32util-configure
+  needs: []
  artifacts:
    paths:
      - util/newcopyrights
@@ -399,6 +388,7 @@ misc:sid:amd64:

 💾:sid:amd64:
  <<: *precheck_job
+  needs: []
  script:
    - if [ -r .clang-format ]; then "${CLANG_FORMAT}" -i -style=file $(git ls-files '*.c' '*.h'); fi
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
@@ -406,13 +396,14 @@ misc:sid:amd64:
 🐞:sid:amd64:
  <<: *precheck_job
  <<: *debian_buster_amd64_image
+  needs: []
  script:
    - util/check-cocci
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi

 tarball-create:sid:amd64:
-  <<: *debian_sid_amd64_image
  stage: precheck
+  <<: *debian_sid_amd64_image
  script:
    - source version
    - export BIND_DIRECTORY="bind-${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
@@ -437,10 +428,9 @@ docs:sid:amd64:
    - ./configure || cat config.log
    - make -C doc/misc docbook
    - make -C doc/arm Bv9ARM.html
-  dependencies:
-    - autoreconf:sid:amd64
  needs:
-    - autoreconf:sid:amd64
+    - job: autoreconf:sid:amd64
+      artifacts: true
  artifacts:
    paths:
      - doc/arm/
@@ -449,7 +439,9 @@ docs:sid:amd64:
 push:docs:sid:amd64:
  <<: *debian_sid_amd64_image
  stage: push
-  dependencies: []
+  needs:
+    - job: docs:sid:amd64
+      artifacts: false
  script:
    - curl -X POST -F token=$GITLAB_PAGES_DOCS_TRIGGER_TOKEN -F ref=master $GITLAB_PAGES_DOCS_TRIGGER_URL
  only:
@@ -469,16 +461,16 @@ gcc:alpine3.11:amd64:
 system:gcc:alpine3.11:amd64:
  <<: *alpine_3_11_amd64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:alpine3.11:amd64
-  needs: ["gcc:alpine3.11:amd64"]
+  needs:
+    - job: gcc:alpine3.11:amd64
+      artifacts: true

 unit:gcc:alpine3.11:amd64:
  <<: *alpine_3_11_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:alpine3.11:amd64
-  needs: ["gcc:alpine3.11:amd64"]
+  needs:
+    - job: gcc:alpine3.11:amd64
+      artifacts: true

 # Jobs for regular GCC builds on CentOS 6 (amd64)

@@ -493,16 +485,16 @@ gcc:centos6:amd64:
 system:gcc:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:centos6:amd64
-  needs: ["gcc:centos6:amd64"]
+  needs:
+    - job: gcc:centos6:amd64
+      artifacts: true

 unit:gcc:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:centos6:amd64
-  needs: ["gcc:centos6:amd64"]
+  needs:
+    - job: gcc:centos6:amd64
+      artifacts: true

 # Jobs for regular GCC builds on CentOS 7 (amd64)

@@ -517,16 +509,16 @@ gcc:centos7:amd64:
 system:gcc:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:centos7:amd64
-  needs: ["gcc:centos7:amd64"]
+  needs:
+    - job: gcc:centos7:amd64
+      artifacts: true

 unit:gcc:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:centos7:amd64
-  needs: ["gcc:centos7:amd64"]
+  needs:
+    - job: gcc:centos7:amd64
+      artifacts: true

 # Jobs for regular GCC builds on CentOS 8 (amd64)

@@ -541,40 +533,16 @@ gcc:centos8:amd64:
 system:gcc:centos8:amd64:
  <<: *centos_centos8_amd64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:centos8:amd64
-  needs: ["gcc:centos8:amd64"]
+  needs:
+    - job: gcc:centos8:amd64
+      artifacts: true

 unit:gcc:centos8:amd64:
  <<: *centos_centos8_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:centos8:amd64
-  needs: ["gcc:centos8:amd64"]
-
-# Jobs for regular GCC builds on Debian 8 Jessie (amd64)
-
-gcc:jessie:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O2"
-    EXTRA_CONFIGURE: "--without-cmocka --with-python --disable-geoip"
-  <<: *debian_jessie_amd64_image
-  <<: *build_job
-
-system:gcc:jessie:amd64:
-  <<: *debian_jessie_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - gcc:jessie:amd64
-  needs: ["gcc:jessie:amd64"]
-
-unit:gcc:jessie:amd64:
-  <<: *debian_jessie_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - gcc:jessie:amd64
-  needs: ["gcc:jessie:amd64"]
+  needs:
+    - job: gcc:centos8:amd64
+      artifacts: true

 # Jobs for regular GCC builds on Debian 9 Stretch (amd64)

@@ -588,16 +556,16 @@ gcc:stretch:amd64:
 system:gcc:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:stretch:amd64
-  needs: ["gcc:stretch:amd64"]
+  needs:
+    - job: gcc:stretch:amd64
+      artifacts: true

 unit:gcc:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:stretch:amd64
-  needs: ["gcc:stretch:amd64"]
+  needs:
+    - job: gcc:stretch:amd64
+      artifacts: true

 # Jobs for regular GCC builds on Debian 10 Buster (amd64)

@@ -611,16 +579,16 @@ gcc:buster:amd64:
 system:gcc:buster:amd64:
  <<: *debian_buster_amd64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:buster:amd64
-  needs: ["gcc:buster:amd64"]
+  needs:
+    - job: gcc:buster:amd64
+      artifacts: true

 unit:gcc:buster:amd64:
  <<: *debian_buster_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:buster:amd64
-  needs: ["gcc:buster:amd64"]
+  needs:
+    - job: gcc:buster:amd64
+      artifacts: true

 # Jobs for scan-build builds on Debian Buster (amd64)

@@ -644,10 +612,9 @@ scan-build:buster:amd64:
  script:
    - *configure
    - *scan_build
-  dependencies:
-    - autoreconf:sid:amd64
  needs:
-    - autoreconf:sid:amd64
+    - job: autoreconf:sid:amd64
+      artifacts: true
  artifacts:
    paths:
      - scan-build.reports/
@@ -662,30 +629,30 @@ gcc:sid:amd64:
    CFLAGS: "${CFLAGS_COMMON} -O3"
    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
    RUN_MAKE_INSTALL: 1
-    MAKE: bear make
+    MAKE_COMMAND: bear --use-cc=${CC} --verbose make
  <<: *debian_sid_amd64_image
  <<: *build_job

 system:gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:sid:amd64
-  needs: ["gcc:sid:amd64"]
+  needs:
+    - job: gcc:sid:amd64
+      artifacts: true

 unit:gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:sid:amd64
-  needs: ["gcc:sid:amd64"]
+  needs:
+    - job: gcc:sid:amd64
+      artifacts: true

 cppcheck:gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *cppcheck_job
-  dependencies:
-    - gcc:sid:amd64
-  needs: ["gcc:sid:amd64"]
+  needs:
+    - job: gcc:sid:amd64
+      artifacts: true

 # Job for out-of-tree GCC build on Debian Sid (amd64)

@@ -713,9 +680,9 @@ tarball:sid:amd64:
    - tar --extract --file bind-*.tar.${TARBALL_EXTENSION}
    - rm -f bind-*.tar.${TARBALL_EXTENSION}
    - cd bind-*
-  dependencies:
-    - tarball-create:sid:amd64
-  needs: ["tarball-create:sid:amd64"]
+  needs:
+    - job: tarball-create:sid:amd64
+      artifacts: true
  only:
    - tags

@@ -725,9 +692,9 @@ system:tarball:sid:amd64:
  before_script:
    - cd bind-*
    - *setup_interfaces
-  dependencies:
-    - tarball:sid:amd64
-  needs: ["tarball:sid:amd64"]
+  needs:
+    - job: tarball:sid:amd64
+      artifacts: true
  only:
    - tags

@@ -736,9 +703,9 @@ unit:tarball:sid:amd64:
  <<: *unit_test_job
  before_script:
    - cd bind-*
-  dependencies:
-    - tarball:sid:amd64
-  needs: ["tarball:sid:amd64"]
+  needs:
+    - job: tarball:sid:amd64
+      artifacts: true
  only:
    - tags

@@ -747,33 +714,24 @@ unit:tarball:sid:amd64:
 gcc:sid:arm64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O3"
+    CFLAGS: "${CFLAGS_COMMON} -O2"
    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
-    RUN_MAKE_INSTALL: 1
-    MAKE: bear make
  <<: *debian_sid_arm64_image
  <<: *build_job

 system:gcc:sid:arm64:
  <<: *debian_sid_arm64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:sid:arm64
-  needs: ["gcc:sid:arm64"]
+  needs:
+    - job: gcc:sid:arm64
+      artifacts: true

 unit:gcc:sid:arm64:
  <<: *debian_sid_arm64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:sid:arm64
-  needs: ["gcc:sid:arm64"]
-
-cppcheck:gcc:sid:arm64:
-  <<: *debian_sid_arm64_image
-  <<: *cppcheck_job
-  dependencies:
-    - gcc:sid:arm64
-  needs: ["gcc:sid:arm64"]
+  needs:
+    - job: gcc:sid:arm64
+      artifacts: true

 # Jobs for regular GCC builds on Debian Sid (i386)

@@ -788,16 +746,16 @@ gcc:sid:i386:
 system:gcc:sid:i386:
  <<: *debian_sid_i386_image
  <<: *system_test_job
-  dependencies:
-    - gcc:sid:i386
-  needs: ["gcc:sid:i386"]
+  needs:
+    - job: gcc:sid:i386
+      artifacts: true

 unit:gcc:sid:i386:
  <<: *debian_sid_i386_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:sid:i386
-  needs: ["gcc:sid:i386"]
+  needs:
+    - job: gcc:sid:i386
+      artifacts: true

 # Jobs for regular GCC builds on openSUSE Tumbleweed (amd64)

@@ -812,16 +770,16 @@ gcc:tumbleweed:amd64:
 system:gcc:tumbleweed:amd64:
  <<: *tumbleweed_latest_amd64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:tumbleweed:amd64
-  needs: ["gcc:tumbleweed:amd64"]
+  needs:
+    - job: gcc:tumbleweed:amd64
+      artifacts: true

 unit:gcc:tumbleweed:amd64:
  <<: *tumbleweed_latest_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:tumbleweed:amd64
-  needs: ["gcc:tumbleweed:amd64"]
+  needs:
+    - job: gcc:tumbleweed:amd64
+      artifacts: true

 # Jobs for regular GCC builds on Fedora 31 (amd64)

@@ -836,16 +794,16 @@ gcc:fedora31:amd64:
 system:gcc:fedora31:amd64:
  <<: *fedora_31_amd64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:fedora31:amd64
-  needs: ["gcc:fedora31:amd64"]
+  needs:
+    - job: gcc:fedora31:amd64
+      artifacts: true

 unit:gcc:fedora31:amd64:
  <<: *fedora_31_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:fedora31:amd64
-  needs: ["gcc:fedora31:amd64"]
+  needs:
+    - job: gcc:fedora31:amd64
+      artifacts: true

 # Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)

@@ -860,16 +818,16 @@ gcc:xenial:amd64:
 system:gcc:xenial:amd64:
  <<: *ubuntu_xenial_amd64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:xenial:amd64
-  needs: ["gcc:xenial:amd64"]
+  needs:
+    - job: gcc:xenial:amd64
+      artifacts: true

 unit:gcc:xenial:amd64:
  <<: *ubuntu_xenial_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:xenial:amd64
-  needs: ["gcc:xenial:amd64"]
+  needs:
+    - job: gcc:xenial:amd64
+      artifacts: true

 # Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)

@@ -884,16 +842,16 @@ gcc:bionic:amd64:
 system:gcc:bionic:amd64:
  <<: *ubuntu_bionic_amd64_image
  <<: *system_test_job
-  dependencies:
-    - gcc:bionic:amd64
-  needs: ["gcc:bionic:amd64"]
+  needs:
+    - job: gcc:bionic:amd64
+      artifacts: true

 unit:gcc:bionic:amd64:
  <<: *ubuntu_bionic_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - gcc:bionic:amd64
-  needs: ["gcc:bionic:amd64"]
+  needs:
+    - job: gcc:bionic:amd64
+      artifacts: true

 # Jobs for GCC builds with ASAN enabled on Debian Sid (amd64)

@@ -911,18 +869,18 @@ system:asan:sid:amd64:
    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
  <<: *debian_sid_amd64_image
  <<: *system_test_job
-  dependencies:
-    - asan:sid:amd64
-  needs: ["asan:sid:amd64"]
+  needs:
+    - job: asan:sid:amd64
+      artifacts: true

 unit:asan:sid:amd64:
  variables:
    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - asan:sid:amd64
-  needs: ["asan:sid:amd64"]
+  needs:
+    - job: asan:sid:amd64
+      artifacts: true

 # Jobs for GCC builds with TSAN enabled on Debian Sid (amd64)

@@ -943,9 +901,9 @@ system:tsan:buster:amd64:
    - echo $TSAN_OPTIONS
  <<: *debian_buster_amd64_image
  <<: *system_test_job
-  dependencies:
-    - tsan:buster:amd64
-  needs: ["tsan:buster:amd64"]
+  needs:
+    - job: tsan:buster:amd64
+      artifacts: true
  allow_failure: true
  after_script:
    - find bin -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
@@ -965,9 +923,9 @@ unit:tsan:buster:amd64:
    - lib/isc/tests/result_test
  <<: *debian_buster_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - tsan:buster:amd64
-  needs: ["tsan:buster:amd64"]
+  needs:
+    - job: tsan:buster:amd64
+      artifacts: true
  allow_failure: true
  after_script:
    - find lib -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
@@ -992,16 +950,16 @@ rwlock:sid:amd64:
 system:rwlock:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
-  dependencies:
-    - rwlock:sid:amd64
-  needs: ["rwlock:sid:amd64"]
+  needs:
+    - job: rwlock:sid:amd64
+      artifacts: true

 unit:rwlock:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - rwlock:sid:amd64
-  needs: ["rwlock:sid:amd64"]
+  needs:
+    - job: rwlock:sid:amd64
+      artifacts: true

 # Jobs for mutex-based atomics on Debian SID (amd64)
 mutexatomics:sid:amd64:
@@ -1015,16 +973,16 @@ mutexatomics:sid:amd64:
 system:mutexatomics:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
-  dependencies:
-    - mutexatomics:sid:amd64
-  needs: ["mutexatomics:sid:amd64"]
+  needs:
+    - job: mutexatomics:sid:amd64
+      artifacts: true

 unit:mutexatomics:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - mutexatomics:sid:amd64
-  needs: ["mutexatomics:sid:amd64"]
+  needs:
+    - job: mutexatomics:sid:amd64
+      artifacts: true

 # Jobs for Clang builds on Debian Stretch (amd64)

@@ -1039,9 +997,9 @@ clang:stretch:amd64:
 unit:clang:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - clang:stretch:amd64
-  needs: ["clang:stretch:amd64"]
+  needs:
+    - job: clang:stretch:amd64
+      artifacts: true

 # Jobs for Clang builds on Debian Stretch (i386)

@@ -1066,61 +1024,69 @@ pkcs11:sid:amd64:
 system:pkcs11:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
-  dependencies:
-    - pkcs11:sid:amd64
-  needs: ["pkcs11:sid:amd64"]
+  needs:
+    - job: pkcs11:sid:amd64
+      artifacts: true

 unit:pkcs11:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
-  dependencies:
-    - pkcs11:sid:amd64
-  needs: ["pkcs11:sid:amd64"]
+  needs:
+    - job: pkcs11:sid:amd64
+      artifacts: true

 # Jobs for Clang builds on FreeBSD 11.3 (amd64)

 clang:freebsd11.3:amd64:
  variables:
    CFLAGS: "${CFLAGS_COMMON}"
+    USER: gitlab-runner
  <<: *freebsd_amd64
  <<: *build_job

 system:clang:freebsd11.3:amd64:
  <<: *freebsd_amd64
  <<: *system_test_job
-  dependencies:
-    - clang:freebsd11.3:amd64
-  needs: ["clang:freebsd11.3:amd64"]
+  variables:
+    USER: gitlab-runner
+    TEST_PARALLEL_JOBS: 4
+  needs:
+    - job: clang:freebsd11.3:amd64
+      artifacts: true

 unit:clang:freebsd11.3:amd64:
  <<: *freebsd_amd64
  <<: *unit_test_job
-  dependencies:
-    - clang:freebsd11.3:amd64
-  needs: ["clang:freebsd11.3:amd64"]
+  needs:
+    - job: clang:freebsd11.3:amd64
+      artifacts: true

-# Jobs for Clang builds on FreeBSD 12.0 (amd64)
+# Jobs for Clang builds on FreeBSD 12.1 (amd64)

-clang:freebsd12.0:amd64:
+clang:freebsd12.1:amd64:
  variables:
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "--enable-dnstap"
+    USER: gitlab-runner
  <<: *freebsd_amd64
  <<: *build_job

-system:clang:freebsd12.0:amd64:
+system:clang:freebsd12.1:amd64:
  <<: *freebsd_amd64
  <<: *system_test_job
-  dependencies:
-    - clang:freebsd12.0:amd64
-  needs: ["clang:freebsd12.0:amd64"]
+  variables:
+    USER: gitlab-runner
+    TEST_PARALLEL_JOBS: 4
+  needs:
+    - job: clang:freebsd12.1:amd64
+      artifacts: true

-unit:clang:freebsd12.0:amd64:
+unit:clang:freebsd12.1:amd64:
  <<: *freebsd_amd64
  <<: *unit_test_job
-  dependencies:
-    - clang:freebsd12.0:amd64
-  needs: ["clang:freebsd12.0:amd64"]
+  needs:
+    - job: clang:freebsd12.1:amd64
+      artifacts: true

 # Jobs for Clang builds on OpenBSD 6.6 (amd64)

@@ -1136,9 +1102,9 @@ system:clang:openbsd6.6:amd64:
  <<: *system_test_job
  variables:
    USER: gitlab-runner
-  dependencies:
-    - clang:openbsd6.6:amd64
-  needs: ["clang:openbsd6.6:amd64"]
+  needs:
+    - job: clang:openbsd6.6:amd64
+      artifacts: true
  only:
    - schedules
    - web
@@ -1155,9 +1121,9 @@ system:msvc:windows:amd64:
  <<: *windows_system_test_job
  variables:
    VSCONF: Release
-  dependencies:
-    - msvc:windows:amd64
-  needs: ["msvc:windows:amd64"]
+  needs:
+    - job: msvc:windows:amd64
+      artifacts: true

 msvc-debug:windows:amd64:
  <<: *windows_build_job
@@ -1172,9 +1138,9 @@ system:msvc-debug:windows:amd64:
  <<: *windows_system_test_job
  variables:
    VSCONF: Debug
-  dependencies:
-    - msvc-debug:windows:amd64
-  needs: ["msvc-debug:windows:amd64"]
+  needs:
+    - job: msvc-debug:windows:amd64
+      artifacts: true

 # Job producing a release tarball

@@ -1207,10 +1173,13 @@ release:sid:amd64:
    - popd
    # Create release tarball
    - tar --create --file="${CI_COMMIT_TAG}.tar.gz" --gzip release/
-  dependencies:
-    - tarball-create:sid:amd64
-    - msvc:windows:amd64
-    - msvc-debug:windows:amd64
+  needs:
+    - job: tarball-create:sid:amd64
+      artifacts: true
+    - job: msvc:windows:amd64
+      artifacts: true
+    - job: msvc-debug:windows:amd64
+      artifacts: true
  only:
    - tags
  artifacts:
@@ -1257,10 +1226,9 @@ build:coverity:sid:amd64:
    - *coverity_cache_prep
    - *configure
    - *coverity_build
-  dependencies:
-    - autoreconf:sid:amd64
  needs:
-    - autoreconf:sid:amd64
+    - job: autoreconf:sid:amd64
+      artifacts: true
  artifacts:
    paths:
      - curl-response.txt
@@ -1288,18 +1256,18 @@ respdiff:sid:amd64:
    BIND_BASELINE_VERSION: v9_11_3
  script:
    - ./configure --without-make-clean
-    - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} V=1
+    - ${MAKE_COMMAND} -j${BUILD_PARALLEL_JOBS:-1} V=1
    - *setup_interfaces
    - git clone --depth 1 https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.isc.org/isc-private/bind-qa.git
    - git clone --branch "${BIND_BASELINE_VERSION}" --depth 1 https://gitlab.isc.org/isc-projects/bind9.git refbind
    - cd refbind/
    - ./configure --without-make-clean
-    - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} V=1
+    - ${MAKE_COMMAND} -j${BUILD_PARALLEL_JOBS:-1} V=1
    - cd ../bind-qa/bind9/respdiff
    - bash respdiff.sh -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}/refbind" "${CI_PROJECT_DIR}"
-  dependencies:
-    - tarball-create:sid:amd64
-  needs: ["tarball-create:sid:amd64"]
+  needs:
+    - job: tarball-create:sid:amd64
+      artifacts: true
  only:
    - tags
  artifacts:
@@ -1314,21 +1282,20 @@ respdiff:sid:amd64:
 abi-check:sid:amd64:
  <<: *debian_sid_amd64_image
  stage: build
-  dependencies:
-    - autoreconf:sid:amd64
  needs:
-    - autoreconf:sid:amd64
+    - job: autoreconf:sid:amd64
+      artifacts: true
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
-    BIND_BASELINE_VERSION: v9_16_0
+    BIND_BASELINE_VERSION: v9_17_0
  script:
    - *configure
-    - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} V=1
+    - ${MAKE_COMMAND} -j${BUILD_PARALLEL_JOBS:-1} V=1
    - git clone --branch "${BIND_BASELINE_VERSION}" --depth 1 https://gitlab.isc.org/isc-projects/bind9.git refbind
    - cd refbind/
    - *configure
-    - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} V=1
+    - ${MAKE_COMMAND} -j${BUILD_PARALLEL_JOBS:-1} V=1
    - cd ..
    - util/api-checker.sh . refbind
  artifacts:
@@ -59,6 +59,7 @@
 - [ ] ***(QA)*** Ensure all new tags are annotated and signed.
 - [ ] ***(SwEng)*** Push tags for the published releases to the public repository.
 - [ ] ***(SwEng)*** Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`).
+ - [ ] ***(QA)*** For each maintained branch, update the `BIND_BASELINE_VERSION` variable for the `abi-check:sid:amd64` job in `.gitlab-ci.yml` to the latest published BIND version tag for a given branch.

 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.

@@ -1,17 +1,28 @@
+5369.	[func]		Add the ability to specify whether or not to wait
+			for nameserver domain names to be looked up, with
+			a new RPZ modifying directive 'nsdname-wait-recurse'.
+			[GL #1138]
+
+5368.	[bug]		Named failed to restart if 'rndc addzone' names
+			contained special characters (e.g. '/'). [GL #1655]
+
+5367.	[placeholder]
+
+	--- 9.17.0 released ---
+
 5366.	[bug]		Fix a race condition with the keymgr when the same
 			zone plus dnssec-policy is configured in multiple
 			views. [GL #1653]

 5365.	[bug]		Algorithm rollover was stuck on submitting DS
 			because keymgr thought it would move to an invalid
-			state.  Fixed by when checking the current key,
-			check it against the desired state, not the existing
-			state. [GL #1626]
+			state.  Fixed by checking the current key against
+			the desired state, not the existing state. [GL #1626]

 5364.	[bug]		Algorithm rollover waited too long before introducing
 			zone signatures.  It waited to make sure all signatures
-			were resigned, but when introducing a new algorithm,
-			all signatures are resigned immediately.  Only
+			were regenerated, but when introducing a new algorithm,
+			all signatures are regenerated immediately.  Only
 			add the sign delay if there is a predecessor key.
 			[GL #1625]

@@ -43,7 +54,8 @@

 5357.	[bug]		Newly added RRSIG records with expiry times before
 			the previous earliest expiry times might not be
-			re-signed in time.  The was a side effect of 5315.
+			re-signed in time.  This was a side effect of 5315.
+			[GL !3137]

 5356.	[func]		Update dnssec-policy configuration statements:
 			- Rename "zone-max-ttl" dnssec-policy option to
@@ -41,7 +41,7 @@ following systems:
  * Ubuntu LTS 16.04, 18.04
  * Fedora 31
  * Red Hat Enterprise Linux / CentOS 7, 8
-  * FreeBSD 11.3, 12.0
+  * FreeBSD 11.3, 12.1
  * OpenBSD 6.6
  * Alpine Linux

@@ -49,7 +49,7 @@ following systems:
 * Ubuntu LTS 16.04, 18.04
 * Fedora 31
 * Red Hat Enterprise Linux / CentOS 7, 8
-* FreeBSD 11.3, 12.0
+* FreeBSD 11.3, 12.1
 * OpenBSD 6.6
 * Alpine Linux

@@ -112,7 +112,12 @@ format-patch.
 BIND 9.17 features

 BIND 9.17 is the newest development branch of BIND 9. It includes a number
-of changes from BIND 9.16 and earlier releases.
+of changes from BIND 9.16 and earlier releases. New features include:
+
+  * New option "max-ixfr-ratio" to limit the size of outgoing IXFR
+    responses before falling back to full zone transfers.
+  * "rndc nta -d" and "rndc secroots" now include "validate-except"
+    entries when listing negative trust anchors.

 Building BIND

@@ -227,7 +232,7 @@ github.com/farsightsec/fstrm and libprotobuf-c https://
 developers.google.com/protocol-buffers, and BIND must be configured with
 --enable-dnstap.

-Certain compiled-in constants and default settings can be increased to
+Certain compiled-in constants and default settings can be decreased to
 values better suited to small machines, e.g. OpenWRT boxes, by specifying
 --with-tuning=small on the configure command line. This will decrease
 memory usage by using smaller structures, but will degrade performance.
@@ -128,7 +128,12 @@ including your patch as an attachment, preferably generated by
 ### <a name="features"/> BIND 9.17 features

 BIND 9.17 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.16 and earlier releases.
+number of changes from BIND 9.16 and earlier releases. New features include:
+
+* New option "max-ixfr-ratio" to limit the size of outgoing IXFR responses
+  before falling back to full zone transfers.
+* "rndc nta -d" and "rndc secroots" now include "validate-except" entries
+  when listing negative trust anchors.

 ### <a name="build"/> Building BIND

@@ -244,7 +249,7 @@ and `libprotobuf-c`
 [https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
 and BIND must be configured with `--enable-dnstap`.

-Certain compiled-in constants and default settings can be increased to
+Certain compiled-in constants and default settings can be decreased to
 values better suited to small machines, e.g. OpenWRT boxes, by specifying
 `--with-tuning=small` on the `configure` command line. This will decrease
 memory usage by using smaller structures, but will degrade performance.
@@ -376,6 +376,7 @@ AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)])

 m4_include([m4/ax_check_compile_flag.m4])
 m4_include([m4/ax_check_openssl.m4])
+m4_include([m4/ax_lib_lmdb.m4])
 m4_include([m4/ax_posix_shell.m4])
 m4_include([m4/ax_pthread.m4])
 m4_include([m4/ax_restore_flags.m4])
@@ -553,7 +553,7 @@ setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
 	isc_logconfig_t *logconfig = NULL;
 	isc_log_t *log = NULL;

-	RUNTIME_CHECK(isc_log_create(mctx, &log, &logconfig) == ISC_R_SUCCESS);
+	isc_log_create(mctx, &log, &logconfig);
 	isc_log_registercategories(log, categories);
 	isc_log_setcontext(log);
 	dns_log_init(log);
@@ -565,9 +565,9 @@ setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
 	destination.file.name = NULL;
 	destination.file.versions = ISC_LOG_ROLLNEVER;
 	destination.file.maximum_size = 0;
-	RUNTIME_CHECK(isc_log_createchannel(logconfig, "stderr",
-					    ISC_LOG_TOFILEDESC, ISC_LOG_DYNAMIC,
-					    &destination, 0) == ISC_R_SUCCESS);
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, 0);
+
 	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
 		      ISC_R_SUCCESS);

@@ -271,11 +271,7 @@ setup_logging(FILE *errout) {
 	isc_logdestination_t destination;
 	isc_logconfig_t *logconfig = NULL;

-	result = isc_log_create(mctx, &lctx, &logconfig);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Couldn't set up logging");
-	}
-
+	isc_log_create(mctx, &lctx, &logconfig);
 	isc_log_registercategories(lctx, categories);
 	isc_log_registermodules(lctx, modules);
 	isc_log_setcontext(lctx);
@@ -287,20 +283,12 @@ setup_logging(FILE *errout) {
 	destination.file.name = NULL;
 	destination.file.versions = ISC_LOG_ROLLNEVER;
 	destination.file.maximum_size = 0;
-
-	result = isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-				       ISC_LOG_DYNAMIC, &destination,
-				       ISC_LOG_PRINTPREFIX);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Couldn't set up log channel 'stderr'");
-	}
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination,
+			      ISC_LOG_PRINTPREFIX);

 	isc_log_setdebuglevel(lctx, loglevel);
-
-	result = isc_log_settag(logconfig, ";; ");
-	if (result != ISC_R_SUCCESS) {
-		fatal("Couldn't set log tag");
-	}
+	isc_log_settag(logconfig, ";; ");

 	result = isc_log_usechannel(logconfig, "stderr",
 				    ISC_LOGCATEGORY_DEFAULT, NULL);
@@ -309,12 +297,9 @@ setup_logging(FILE *errout) {
 	}

 	if (resolve_trace && loglevel < 1) {
-		result = isc_log_createchannel(
-			logconfig, "resolver", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(1), &destination, ISC_LOG_PRINTPREFIX);
-		if (result != ISC_R_SUCCESS) {
-			fatal("Couldn't set up log channel 'resolver'");
-		}
+		isc_log_createchannel(logconfig, "resolver", ISC_LOG_TOFILEDESC,
+				      ISC_LOG_DEBUG(1), &destination,
+				      ISC_LOG_PRINTPREFIX);

 		result = isc_log_usechannel(logconfig, "resolver",
 					    DNS_LOGCATEGORY_RESOLVER,
@@ -325,12 +310,9 @@ setup_logging(FILE *errout) {
 	}

 	if (validator_trace && loglevel < 3) {
-		result = isc_log_createchannel(
-			logconfig, "validator", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(3), &destination, ISC_LOG_PRINTPREFIX);
-		if (result != ISC_R_SUCCESS) {
-			fatal("Couldn't set up log channel 'validator'");
-		}
+		isc_log_createchannel(logconfig, "validator",
+				      ISC_LOG_TOFILEDESC, ISC_LOG_DEBUG(3),
+				      &destination, ISC_LOG_PRINTPREFIX);

 		result = isc_log_usechannel(logconfig, "validator",
 					    DNS_LOGCATEGORY_DNSSEC,
@@ -341,12 +323,9 @@ setup_logging(FILE *errout) {
 	}

 	if (message_trace && loglevel < 10) {
-		result = isc_log_createchannel(
-			logconfig, "messages", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(10), &destination, ISC_LOG_PRINTPREFIX);
-		if (result != ISC_R_SUCCESS) {
-			fatal("Couldn't set up log channel 'messages'");
-		}
+		isc_log_createchannel(logconfig, "messages", ISC_LOG_TOFILEDESC,
+				      ISC_LOG_DEBUG(10), &destination,
+				      ISC_LOG_PRINTPREFIX);

 		result = isc_log_usechannel(logconfig, "messages",
 					    DNS_LOGCATEGORY_RESOLVER,
@@ -337,11 +337,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		}
 		printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
 		time(&tnow);
-#if !defined(WIN32)
 		(void)localtime_r(&tnow, &tmnow);
-#else  /* if !defined(WIN32) */
-		tmnow = *localtime(&tnow);
-#endif /* if !defined(WIN32) */

 #ifdef WIN32
 		/*
@@ -64,6 +64,7 @@
 #include <dns/log.h>
 #include <dns/message.h>
 #include <dns/name.h>
+#include <dns/opcode.h>
 #include <dns/rcode.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
@@ -1393,9 +1394,7 @@ setup_libs(void) {
 	isc_mem_create(&mctx);
 	isc_mem_setname(mctx, "dig", NULL);

-	result = isc_log_create(mctx, &lctx, &logconfig);
-	check_result(result, "isc_log_create");
-
+	isc_log_create(mctx, &lctx, &logconfig);
 	isc_log_setcontext(lctx);
 	dns_log_init(lctx);
 	dns_log_setcontext(lctx);
@@ -3815,6 +3814,32 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		UNLOCK_LOOKUP;
 		return;
 	}
+	if (msg->opcode != l->opcode) {
+		char expect[20] = { 0 }, got[20] = { 0 };
+
+		isc_buffer_init(&b, &expect, sizeof(expect));
+		result = dns_opcode_totext(l->opcode, &b);
+		check_result(result, "dns_opcode_totext");
+
+		isc_buffer_init(&b, &got, sizeof(got));
+		result = dns_opcode_totext(msg->opcode, &b);
+		check_result(result, "dns_opcode_totext");
+
+		dighost_warning("Warning: Opcode mismatch: expected %s, got %s",
+				expect, got);
+
+		dns_message_destroy(&msg);
+		if (l->tcp_mode) {
+			isc_event_free(&event);
+			clear_query(query);
+			cancel_lookup(l);
+			check_next_lookup(l);
+			UNLOCK_LOOKUP;
+			return;
+		} else {
+			goto udp_mismatch;
+		}
+	}
 	if (msg->counts[DNS_SECTION_QUESTION] != 0) {
 		match = true;
 		for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
@@ -4393,7 +4418,7 @@ idn_output_filter(isc_buffer_t *buffer, unsigned int used_org) {
 	 * Copy name from 'buffer' to 'src' and terminate it with NULL.
 	 */
 	srclen = isc_buffer_usedlength(buffer) - used_org;
-	if (srclen > sizeof(src)) {
+	if (srclen >= sizeof(src)) {
 		warn("Input name too long to perform IDN conversion");
 		return (ISC_R_SUCCESS);
 	}
@@ -108,7 +108,7 @@ static void
 show_usage(void) {
 	fputs("Usage: host [-aCdilrTvVw] [-c class] [-N ndots] [-t type] [-W "
 	      "time]\n"
-	      "            [-R number] [-m flag] hostname [server]\n"
+	      "            [-R number] [-m flag] [-p port] hostname [server]\n"
 	      "       -a is equivalent to -v -t ANY\n"
 	      "       -A is like -a but omits RRSIG, NSEC, NSEC3\n"
 	      "       -c specifies query class for non-IN data\n"
@@ -118,6 +118,7 @@ show_usage(void) {
 	      "       -m set memory debugging flag (trace|record|usage)\n"
 	      "       -N changes the number of dots allowed before root lookup "
 	      "is done\n"
+	      "       -p specifies the port on the server to query\n"
 	      "       -r disables recursive processing\n"
 	      "       -R specifies number of retries for UDP packets\n"
 	      "       -s a SERVFAIL response should stop query\n"
@@ -575,7 +576,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	return (result);
 }

-static const char *optstring = "46aAc:dilnm:rst:vVwCDN:R:TUW:";
+static const char *optstring = "46aAc:dilnm:p:rst:vVwCDN:R:TUW:";

 /*% version */
 static void
@@ -639,6 +640,8 @@ pre_parse_args(int argc, char **argv) {
 			break;
 		case 'N':
 			break;
+		case 'p':
+			break;
 		case 'r':
 			break;
 		case 'R':
@@ -686,6 +689,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 	lookup = make_empty_lookup();

 	lookup->servfail_stops = false;
+	lookup->besteffort = false;
 	lookup->comments = false;
 	short_form = !verbose;

@@ -841,6 +845,9 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 		case 's':
 			lookup->servfail_stops = true;
 			break;
+		case 'p':
+			port = atoi(isc_commandline_argument);
+			break;
 		}
 	}

@@ -59,6 +59,7 @@
      <arg choice="opt" rep="norepeat"><option>-aACdlnrsTUwv</option></arg>
      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-N <replaceable class="parameter">ndots</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-p <replaceable class="port">port</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">number</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-W <replaceable class="parameter">wait</replaceable></option></arg>
@@ -214,6 +215,15 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-p <replaceable class="parameter">port</replaceable></term>
+	<listitem>
+	  <para>
+	    Specify the port on the server to query.  The default is 53.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-r</term>
 	<listitem>
@@ -799,6 +799,7 @@ addlookup(char *opt) {
 	lookup->section_authority = section_authority;
 	lookup->section_additional = section_additional;
 	lookup->new_search = true;
+	lookup->besteffort = false;
 	if (nofail) {
 		lookup->servfail_stops = false;
 	}
@@ -25,6 +25,7 @@
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/string.h>
+#include <isc/time.h>
 #include <isc/util.h>

 #include <dns/keyvalues.h>
@@ -114,7 +115,6 @@ usage(void) {
 static void
 printtime(dst_key_t *key, int type, const char *tag, bool epoch, FILE *stream) {
 	isc_result_t result;
-	const char *output = NULL;
 	isc_stdtime_t when;

 	if (tag != NULL) {
@@ -127,9 +127,20 @@ printtime(dst_key_t *key, int type, const char *tag, bool epoch, FILE *stream) {
 	} else if (epoch) {
 		fprintf(stream, "%d\n", (int)when);
 	} else {
-		time_t timet = when;
-		output = ctime(&timet);
-		fprintf(stream, "%s", output);
+		time_t now = when;
+		struct tm t, *tm = localtime_r(&now, &t);
+		unsigned int flen;
+		char timebuf[80];
+
+		if (tm == NULL) {
+			fprintf(stream, "INVALID\n");
+			return;
+		}
+
+		flen = strftime(timebuf, sizeof(timebuf),
+				"%a %b %e %H:%M:%S %Y", tm);
+		INSIST(flen > 0U && flen < sizeof(timebuf));
+		fprintf(stream, "%s\n", timebuf);
 	}
 }

@@ -3105,14 +3105,18 @@ writeset(const char *prefix, dns_rdatatype_t type) {

 static void
 print_time(FILE *fp) {
-	time_t currenttime;
+	time_t currenttime = time(NULL);
+	struct tm t, *tm = localtime_r(&currenttime, &t);
+	unsigned int flen;
+	char timebuf[80];

-	if (outputformat != dns_masterformat_text) {
+	if (tm == NULL || outputformat != dns_masterformat_text) {
 		return;
 	}

-	currenttime = time(NULL);
-	fprintf(fp, "; File written on %s", ctime(&currenttime));
+	flen = strftime(timebuf, sizeof(timebuf), "%a %b %e %H:%M:%S %Y", tm);
+	INSIST(flen > 0U && flen < sizeof(timebuf));
+	fprintf(fp, "; File written on %s\n", timebuf);
 }

 static void
@@ -128,7 +128,6 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size) {

 void
 setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
-	isc_result_t result;
 	isc_logdestination_t destination;
 	isc_logconfig_t *logconfig = NULL;
 	isc_log_t *log = NULL;
@@ -153,12 +152,11 @@ setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
 		break;
 	}

-	RUNTIME_CHECK(isc_log_create(mctx, &log, &logconfig) == ISC_R_SUCCESS);
+	isc_log_create(mctx, &log, &logconfig);
 	isc_log_setcontext(log);
 	dns_log_init(log);
 	dns_log_setcontext(log);
-
-	RUNTIME_CHECK(isc_log_settag(logconfig, program) == ISC_R_SUCCESS);
+	isc_log_settag(logconfig, program);

 	/*
 	 * Set up a channel similar to default_stderr except:
@@ -170,10 +168,9 @@ setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
 	destination.file.name = NULL;
 	destination.file.versions = ISC_LOG_ROLLNEVER;
 	destination.file.maximum_size = 0;
-	result = isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-				       level, &destination,
-				       ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
-	check_result(result, "isc_log_createchannel()");
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC, level,
+			      &destination,
+			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);

 	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
 		      ISC_R_SUCCESS);
@@ -50,6 +50,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${OPENSSL_CFLAGS} \
 		${JSON_C_CFLAGS} \
 		${LIBXML2_CFLAGS} \
+		${LMDB_CFLAGS} \
 		${MAXMINDDB_CFLAGS} \
 		${ZLIB_CFLAGS}

@@ -77,6 +78,7 @@ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
 LIBS =		${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
 		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBCAP_LIBS@ \
+		${LMDB_LIBS} \
 		@LIBS@

 SUBDIRS =	unix
@@ -45,7 +45,7 @@ named_log_init(bool safe);
 * as root.
 */

-isc_result_t
+void
 named_log_setdefaultchannels(isc_logconfig_t *lcfg);
 /*%
 * Set up logging channels according to the named defaults, which
@@ -53,7 +53,7 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg);
 * this just means setting up default_debug.
 */

-isc_result_t
+void
 named_log_setsafechannels(isc_logconfig_t *lcfg);
 /*%
 * Like named_log_setdefaultchannels(), but omits any logging to files.
@@ -53,10 +53,7 @@ named_log_init(bool safe) {
 	/*
 	 * Setup a logging context.
 	 */
-	result = isc_log_create(named_g_mctx, &named_g_lctx, &lcfg);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	isc_log_create(named_g_mctx, &named_g_lctx, &lcfg);

 	/*
 	 * named-checktool.c:setup_logging() needs to be kept in sync.
@@ -71,12 +68,9 @@ named_log_init(bool safe) {
 	ns_log_setcontext(named_g_lctx);

 	if (safe) {
-		result = named_log_setsafechannels(lcfg);
+		named_log_setsafechannels(lcfg);
 	} else {
-		result = named_log_setdefaultchannels(lcfg);
-	}
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
+		named_log_setdefaultchannels(lcfg);
 	}

 	result = named_log_setdefaultcategory(lcfg);
@@ -94,9 +88,8 @@ cleanup:
 	return (result);
 }

-isc_result_t
+void
 named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
-	isc_result_t result;
 	isc_logdestination_t destination;

 	/*
@@ -109,12 +102,9 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 		destination.file.name = "named.run";
 		destination.file.versions = ISC_LOG_ROLLNEVER;
 		destination.file.maximum_size = 0;
-		result = isc_log_createchannel(
-			lcfg, "default_debug", ISC_LOG_TOFILE, ISC_LOG_DYNAMIC,
-			&destination, ISC_LOG_PRINTTIME | ISC_LOG_DEBUGONLY);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILE,
+				      ISC_LOG_DYNAMIC, &destination,
+				      ISC_LOG_PRINTTIME | ISC_LOG_DEBUGONLY);
 	}

 	if (named_g_logfile != NULL) {
@@ -122,48 +112,32 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 		destination.file.name = named_g_logfile;
 		destination.file.versions = ISC_LOG_ROLLNEVER;
 		destination.file.maximum_size = 0;
-		result = isc_log_createchannel(
-			lcfg, "default_logfile", ISC_LOG_TOFILE,
-			ISC_LOG_DYNAMIC, &destination,
-			ISC_LOG_PRINTTIME | ISC_LOG_PRINTCATEGORY |
-				ISC_LOG_PRINTLEVEL);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		isc_log_createchannel(lcfg, "default_logfile", ISC_LOG_TOFILE,
+				      ISC_LOG_DYNAMIC, &destination,
+				      ISC_LOG_PRINTTIME |
+					      ISC_LOG_PRINTCATEGORY |
+					      ISC_LOG_PRINTLEVEL);
 	}

 #if ISC_FACILITY != LOG_DAEMON
 	destination.facility = ISC_FACILITY;
-	result = isc_log_createchannel(lcfg, "default_syslog", ISC_LOG_TOSYSLOG,
-				       ISC_LOG_INFO, &destination, 0);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	isc_log_createchannel(lcfg, "default_syslog", ISC_LOG_TOSYSLOG,
+			      ISC_LOG_INFO, &destination, 0);
 #endif /* if ISC_FACILITY != LOG_DAEMON */

 	/*
 	 * Set the initial debug level.
 	 */
 	isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
-
-	result = ISC_R_SUCCESS;
-
-cleanup:
-	return (result);
 }

-isc_result_t
+void
 named_log_setsafechannels(isc_logconfig_t *lcfg) {
-	isc_result_t result;
 	isc_logdestination_t destination;

 	if (!named_g_logstderr) {
-		result = isc_log_createchannel(lcfg, "default_debug",
-					       ISC_LOG_TONULL, ISC_LOG_DYNAMIC,
-					       NULL, 0);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TONULL,
+				      ISC_LOG_DYNAMIC, NULL, 0);

 		/*
 		 * Setting the debug level to zero should get the output
@@ -179,29 +153,18 @@ named_log_setsafechannels(isc_logconfig_t *lcfg) {
 		destination.file.name = named_g_logfile;
 		destination.file.versions = ISC_LOG_ROLLNEVER;
 		destination.file.maximum_size = 0;
-		result = isc_log_createchannel(
-			lcfg, "default_logfile", ISC_LOG_TOFILE,
-			ISC_LOG_DYNAMIC, &destination,
-			ISC_LOG_PRINTTIME | ISC_LOG_PRINTCATEGORY |
-				ISC_LOG_PRINTLEVEL);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		isc_log_createchannel(lcfg, "default_logfile", ISC_LOG_TOFILE,
+				      ISC_LOG_DYNAMIC, &destination,
+				      ISC_LOG_PRINTTIME |
+					      ISC_LOG_PRINTCATEGORY |
+					      ISC_LOG_PRINTLEVEL);
 	}

 #if ISC_FACILITY != LOG_DAEMON
 	destination.facility = ISC_FACILITY;
-	result = isc_log_createchannel(lcfg, "default_syslog", ISC_LOG_TOSYSLOG,
-				       ISC_LOG_INFO, &destination, 0);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
+	isc_log_createchannel(lcfg, "default_syslog", ISC_LOG_TOSYSLOG,
+			      ISC_LOG_INFO, &destination, 0);
 #endif /* if ISC_FACILITY != LOG_DAEMON */
-
-	result = ISC_R_SUCCESS;
-
-cleanup:
-	return (result);
 }

 isc_result_t
@@ -92,7 +92,7 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 */
 static isc_result_t
 channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 	isc_logdestination_t dest;
 	unsigned int type;
 	unsigned int flags = 0;
@@ -271,14 +271,12 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 		}
 	}

-	if (logconfig == NULL) {
-		result = ISC_R_SUCCESS;
-	} else {
-		result = isc_log_createchannel(logconfig, channelname, type,
-					       level, &dest, flags);
+	if (logconfig != NULL) {
+		isc_log_createchannel(logconfig, channelname, type, level,
+				      &dest, flags);
 	}

-	if (result == ISC_R_SUCCESS && type == ISC_LOG_TOFILE) {
+	if (type == ISC_LOG_TOFILE) {
 		FILE *fp;

 		/*
@@ -333,7 +331,7 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 	const cfg_obj_t *catname;

 	if (logconfig != NULL) {
-		CHECK(named_log_setdefaultchannels(logconfig));
+		named_log_setdefaultchannels(logconfig);
 	}

 	(void)cfg_map_get(logstmt, "channel", &channels);
@@ -2557,6 +2557,13 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 		zones->p.qname_wait_recurse = false;
 	}

+	sub_obj = cfg_tuple_get(rpz_obj, "nsdname-wait-recurse");
+	if (cfg_obj_isvoid(sub_obj) || cfg_obj_asboolean(sub_obj)) {
+		zones->p.nsdname_wait_recurse = true;
+	} else {
+		zones->p.nsdname_wait_recurse = false;
+	}
+
 	sub_obj = cfg_tuple_get(rpz_obj, "nsip-wait-recurse");
 	if (cfg_obj_isvoid(sub_obj) || cfg_obj_asboolean(sub_obj)) {
 		zones->p.nsip_wait_recurse = true;
@@ -7779,6 +7786,7 @@ data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data, isc_buffer_t **text,
 	const char *zone_config;
 	size_t zone_config_len;
 	cfg_obj_t *zoneconf = NULL;
+	char bufname[DNS_NAME_FORMATSIZE];

 	REQUIRE(view != NULL);
 	REQUIRE(key != NULL);
@@ -7801,20 +7809,23 @@ data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data, isc_buffer_t **text,
 	INSIST(zone_config != NULL && zone_config_len > 0);

 	/* zone zonename { config; }; */
-	result = isc_buffer_reserve(text, 5 + zone_name_len + 1 +
+	result = isc_buffer_reserve(text, 6 + zone_name_len + 2 +
 						  zone_config_len + 2);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}

-	CHECK(putstr(text, "zone "));
+	CHECK(putstr(text, "zone \""));
 	CHECK(putmem(text, (const void *)zone_name, zone_name_len));
-	CHECK(putstr(text, " "));
+	CHECK(putstr(text, "\" "));
 	CHECK(putmem(text, (const void *)zone_config, zone_config_len));
 	CHECK(putstr(text, ";\n"));

+	snprintf(bufname, sizeof(bufname), "%.*s", (int)zone_name_len,
+		 zone_name);
+
 	cfg_parser_reset(named_g_addparser);
-	result = cfg_parse_buffer(named_g_addparser, *text, zone_name, 0,
+	result = cfg_parse_buffer(named_g_addparser, *text, bufname, 0,
 				  &cfg_type_addzoneconf, 0, &zoneconf);
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -9099,8 +9110,7 @@ load_configuration(const char *filename, named_server_t *server,
 	} else {
 		const cfg_obj_t *logobj = NULL;

-		CHECKM(isc_logconfig_create(named_g_lctx, &logc),
-		       "creating new logging configuration");
+		isc_logconfig_create(named_g_lctx, &logc);

 		logobj = NULL;
 		(void)cfg_map_get(config, "logging", &logobj);
@@ -9108,16 +9118,14 @@ load_configuration(const char *filename, named_server_t *server,
 			CHECKM(named_logconfig(logc, logobj), "configuring "
 							      "logging");
 		} else {
-			CHECKM(named_log_setdefaultchannels(logc),
-			       "setting up default logging channels");
+			named_log_setdefaultchannels(logc);
 			CHECKM(named_log_setunmatchedcategory(logc),
 			       "setting up default 'category unmatched'");
 			CHECKM(named_log_setdefaultcategory(logc),
 			       "setting up default 'category default'");
 		}

-		CHECKM(isc_logconfig_use(named_g_lctx, logc),
-		       "installing logging configuration");
+		isc_logconfig_use(named_g_lctx, logc);
 		logc = NULL;

 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -1647,6 +1647,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			} else if (strcasecmp(arg, "maintain") == 0) {
 				allow = maint = true;
 			} else if (strcasecmp(arg, "off") == 0) {
+				/* Default */
 			} else {
 				INSIST(0);
 				ISC_UNREACHABLE();
@@ -1801,6 +1802,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
 						   true);
 			} else if (strcasecmp(arg, "maintain") == 0) {
+				/* Default */
 			} else {
 				INSIST(0);
 				ISC_UNREACHABLE();
@@ -812,9 +812,7 @@ setup_system(void) {

 	dns_result_register();

-	result = isc_log_create(gmctx, &glctx, &logconfig);
-	check_result(result, "isc_log_create");
-
+	isc_log_create(gmctx, &glctx, &logconfig);
 	isc_log_setcontext(glctx);
 	dns_log_init(glctx);
 	dns_log_setcontext(glctx);
@@ -985,18 +985,16 @@ main(int argc, char **argv) {
 	   isc_taskmgr_create(rndc_mctx, 1, 0, NULL, &taskmgr));
 	DO("create task", isc_task_create(taskmgr, 0, &task));

-	DO("create logging context",
-	   isc_log_create(rndc_mctx, &log, &logconfig));
+	isc_log_create(rndc_mctx, &log, &logconfig);
 	isc_log_setcontext(log);
-	DO("setting log tag", isc_log_settag(logconfig, progname));
+	isc_log_settag(logconfig, progname);
 	logdest.file.stream = stderr;
 	logdest.file.name = NULL;
 	logdest.file.versions = ISC_LOG_ROLLNEVER;
 	logdest.file.maximum_size = 0;
-	DO("creating log channel",
-	   isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-				 ISC_LOG_INFO, &logdest,
-				 ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL));
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_INFO, &logdest,
+			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
 	DO("enabling log channel",
 	   isc_log_usechannel(logconfig, "stderr", NULL, NULL));

@@ -72,8 +72,7 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);

-	result = isc_log_create(mctx, &lctx, &lcfg);
-	check_result(result, "isc_log_create()");
+	isc_log_create(mctx, &lctx, &lcfg);
 	isc_log_setcontext(lctx);

 	/*
@@ -83,10 +82,9 @@ main(int argc, char **argv) {
 	destination.file.name = NULL;
 	destination.file.versions = ISC_LOG_ROLLNEVER;
 	destination.file.maximum_size = 0;
-	result = isc_log_createchannel(lcfg, "_default", ISC_LOG_TOFILEDESC,
-				       ISC_LOG_DYNAMIC, &destination,
-				       ISC_LOG_PRINTTIME);
-	check_result(result, "isc_log_createchannel()");
+	isc_log_createchannel(lcfg, "_default", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, ISC_LOG_PRINTTIME);
+
 	result = isc_log_usechannel(lcfg, "_default", NULL, NULL);
 	check_result(result, "isc_log_usechannel()");

@@ -100,7 +100,7 @@ main(int argc, char **argv) {
 	CHECK(dst_lib_init(mctx, NULL));
 	dst_active = true;

-	CHECK(isc_log_create(mctx, &lctx, &logconfig));
+	isc_log_create(mctx, &lctx, &logconfig);
 	isc_log_registercategories(lctx, categories);
 	isc_log_setcontext(lctx);
 	dns_log_init(lctx);
@@ -110,8 +110,9 @@ main(int argc, char **argv) {
 	destination.file.name = NULL;
 	destination.file.versions = ISC_LOG_ROLLNEVER;
 	destination.file.maximum_size = 0;
-	CHECK(isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-				    ISC_LOG_DYNAMIC, &destination, 0));
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, 0);
+
 	CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL));

 	dns_result_register();
@@ -297,8 +297,7 @@ main(int argc, char **argv) {
 	isc_mempool_create(mctx, sizeof(client_t), &cmp);
 	isc_mempool_setname(cmp, "adb test clients");

-	result = isc_log_create(mctx, &lctx, &lcfg);
-	check_result(result, "isc_log_create()");
+	isc_log_create(mctx, &lctx, &lcfg);
 	isc_log_setcontext(lctx);
 	dns_log_init(lctx);
 	dns_log_setcontext(lctx);
@@ -310,10 +309,9 @@ main(int argc, char **argv) {
 	destination.file.name = NULL;
 	destination.file.versions = ISC_LOG_ROLLNEVER;
 	destination.file.maximum_size = 0;
-	result = isc_log_createchannel(lcfg, "_default", ISC_LOG_TOFILEDESC,
-				       ISC_LOG_DYNAMIC, &destination,
-				       ISC_LOG_PRINTTIME);
-	check_result(result, "isc_log_createchannel()");
+	isc_log_createchannel(lcfg, "_default", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, ISC_LOG_PRINTTIME);
+
 	result = isc_log_usechannel(lcfg, "_default", NULL, NULL);
 	check_result(result, "isc_log_usechannel()");

@@ -56,7 +56,7 @@ log_init(void) {
 	/*
 	 * Setup a logging context.
 	 */
-	RUNTIME_CHECK(isc_log_create(mctx, &lctx, &lcfg) == ISC_R_SUCCESS);
+	isc_log_create(mctx, &lctx, &lcfg);
 	isc_log_setcontext(lctx);
 	dns_log_init(lctx);
 	dns_log_setcontext(lctx);
@@ -69,10 +69,9 @@ log_init(void) {
 	destination.file.versions = ISC_LOG_ROLLNEVER;
 	destination.file.maximum_size = 0;
 	flags = ISC_LOG_PRINTTIME;
-	RUNTIME_CHECK(isc_log_createchannel(lcfg, "_default",
-					    ISC_LOG_TOFILEDESC, ISC_LOG_DYNAMIC,
-					    &destination,
-					    flags) == ISC_R_SUCCESS);
+	isc_log_createchannel(lcfg, "_default", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, flags);
+
 	RUNTIME_CHECK(isc_log_usechannel(lcfg, "_default", NULL, NULL) ==
 		      ISC_R_SUCCESS);
 	isc_log_setdebuglevel(lctx, level);
@@ -402,8 +402,7 @@ main(int argc, char *argv[]) {
 				    DNS_DBFIND_VALIDATEGLUE);
 			break;
 		case 'l':
-			RUNTIME_CHECK(isc_log_create(mctx, &lctx, NULL) ==
-				      ISC_R_SUCCESS);
+			isc_log_create(mctx, &lctx, NULL);
 			isc_log_setcontext(lctx);
 			dns_log_init(lctx);
 			dns_log_setcontext(lctx);
@@ -458,7 +458,7 @@ main(int argc, char *argv[]) {
 	mctx = NULL;
 	isc_mem_create(&mctx);

-	RUNCHECK(isc_log_create(mctx, &lctx, &lcfg));
+	isc_log_create(mctx, &lctx, &lcfg);
 	isc_log_setcontext(lctx);
 	dns_log_init(lctx);
 	dns_log_setcontext(lctx);
@@ -470,9 +470,9 @@ main(int argc, char *argv[]) {
 	destination.file.name = NULL;
 	destination.file.versions = ISC_LOG_ROLLNEVER;
 	destination.file.maximum_size = 0;
-	RUNCHECK(isc_log_createchannel(lcfg, "_default", ISC_LOG_TOFILEDESC,
-				       ISC_LOG_DYNAMIC, &destination,
-				       ISC_LOG_PRINTTIME));
+	isc_log_createchannel(lcfg, "_default", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, ISC_LOG_PRINTTIME);
+
 	RUNCHECK(isc_log_usechannel(lcfg, "_default", NULL, NULL));

 	isc_log_setdebuglevel(lctx, 9);
@@ -112,9 +112,9 @@ main(int argc, char **argv) {
 	lcfg = NULL;

 	isc_mem_create(&mctx);
-	CHECK(isc_log_create(mctx, &lctx, &lcfg));
+	isc_log_create(mctx, &lctx, &lcfg);

-	CHECK(isc_log_settag(lcfg, progname));
+	isc_log_settag(lcfg, progname);

 	isc_log_setcontext(lctx);
 	dns_log_init(lctx);
@@ -147,20 +147,20 @@ main(int argc, char **argv) {
 	destination.file.maximum_size = 1;
 	destination.file.versions = file_versions;

-	CHECK(isc_log_createchannel(
+	isc_log_createchannel(
 		lcfg, "file_test", ISC_LOG_TOFILE, ISC_LOG_INFO, &destination,
 		ISC_LOG_PRINTTIME | ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL |
-			ISC_LOG_PRINTCATEGORY | ISC_LOG_PRINTMODULE));
+			ISC_LOG_PRINTCATEGORY | ISC_LOG_PRINTMODULE);

 	/*
 	 * Create a dynamic debugging channel to a file descriptor.
 	 */
 	destination.file.stream = stderr;

-	CHECK(isc_log_createchannel(lcfg, "debug_test", ISC_LOG_TOFILEDESC,
-				    ISC_LOG_DYNAMIC, &destination,
-				    ISC_LOG_PRINTTIME | ISC_LOG_PRINTLEVEL |
-					    ISC_LOG_DEBUGONLY));
+	isc_log_createchannel(lcfg, "debug_test", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination,
+			      ISC_LOG_PRINTTIME | ISC_LOG_PRINTLEVEL |
+				      ISC_LOG_DEBUGONLY);

 	/*
 	 * Test the usability of the four predefined logging channels.
@@ -236,7 +236,7 @@ main(int argc, char *argv[]) {
 	socketmgr = NULL;
 	RUNTIME_CHECK(isc_socketmgr_create(mctx, &socketmgr) == ISC_R_SUCCESS);

-	RUNTIME_CHECK(isc_log_create(mctx, &lctx, &logconfig) == ISC_R_SUCCESS);
+	isc_log_create(mctx, &lctx, &logconfig);

 	s = NULL;
 	RUNTIME_CHECK(isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp,
@@ -718,6 +718,8 @@ echo_i "check that named restarts with multiple added zones ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 addzone "test4.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 addzone "test5.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.3 addzone '"test/.baz"' '{ type master; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
+$RNDCCMD 10.53.0.3 addzone '"test\".baz"' '{ type master; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $PERL $SYSTEMTESTTOP/stop.pl addzone ns3
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} addzone ns3 || ret=1
 retry_quiet 10 _check_version_bind || ret=1
@@ -37,7 +37,7 @@ export LANG=C
 # SEQUENTIAL_UNIX in conf.sh.in; those that only run on windows should
 # be added to SEQUENTIAL_WINDOWS in conf.sh.win32.
 #
-SEQUENTIAL_COMMON="ecdsa eddsa tkey"
+SEQUENTIAL_COMMON=""

 #
 # These tests can use ports assigned by the caller (other than 5300
@@ -58,7 +58,7 @@ PARALLEL_COMMON="dnssec rpzrecurse serve-stale \
 	checkconf checknames checkzone \
 	cookie database digdelv dlz dlzexternal \
 	dns64 dscp dsdigest dyndb \
-	ednscompliance emptyzones \
+	ecdsa eddsa ednscompliance emptyzones \
 	fetchlimit filter-aaaa formerr forward \
 	geoip2 glue idna include-multiplecfg \
 	inline integrity ixfr \
@@ -70,7 +70,7 @@ PARALLEL_COMMON="dnssec rpzrecurse serve-stale \
 	rrchecker rrl rrsetorder rsabigexponent runtime \
 	sfcache smartsign sortlist \
 	spf staticstub statistics statschannel stub synthfromdnssec \
-	tcp tools tsig tsiggss ttl \
+	tcp tkey tools tsig tsiggss ttl \
 	unknown upforwd verify views wildcard \
 	xfer xferquota zero zonechecks"

@@ -39,6 +39,7 @@ DNSTAPREAD=$TOP/bin/tools/dnstap-read
 DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
 FEATURETEST=$TOP/bin/tests/system/feature-test
 FSTRM_CAPTURE=@FSTRM_CAPTURE@
+HOST=$TOP/bin/dig/host
 IMPORTKEY=$TOP/bin/dnssec/dnssec-importkey
 JOURNALPRINT=$TOP/bin/tools/named-journalprint
 KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
@@ -0,0 +1,66 @@
+#!/usr/bin/perl -w
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+use IO::File;
+use IO::Socket;
+use Net::DNS;
+use Net::DNS::Packet;
+
+my $localport = int($ENV{'PORT'});
+if (!$localport) { $localport = 5300; }
+
+my $sock = IO::Socket::INET->new(LocalAddr => "10.53.0.7",
+   LocalPort => $localport, Proto => "udp") or die "$!";
+
+my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
+print $pidf "$$\n" or die "cannot write pid file: $!";
+$pidf->close or die "cannot close pid file: $!";
+sub rmpid { unlink "ans.pid"; exit 1; };
+
+$SIG{INT} = \&rmpid;
+$SIG{TERM} = \&rmpid;
+
+STDOUT->autoflush(1);
+
+print "Net::DNS::VERSION => $Net::DNS::VERSION\n";
+
+for (;;) {
+	$sock->recv($buf, 512);
+
+	print "**** request from " , $sock->peerhost, " port ", $sock->peerport, "\n";
+
+	my $packet;
+
+	if ($Net::DNS::VERSION > 0.68) {
+		$packet = new Net::DNS::Packet(\$buf, 0);
+		$@ and die $@;
+	} else {
+		my $err;
+		($packet, $err) = new Net::DNS::Packet(\$buf, 0);
+		$err and die $err;
+	}
+
+	print "REQUEST:\n";
+	$packet->print;
+
+	$packet->header->qr(1);
+	$packet->header->opcode(5);
+
+	my @questions = $packet->question;
+	my $qname = $questions[0]->qname;
+	my $qtype = $questions[0]->qtype;
+	$packet->push("update", rr_del("$qname SOA"));
+
+	print "RESPONSE:\n";
+	$packet->print;
+
+	$sock->send($packet->data);
+}
@@ -20,6 +20,8 @@ rm -f ./dig.out.mm.*
 rm -f ./dig.out.mn.*
 rm -f ./dig.out.nm.*
 rm -f ./dig.out.nn.*
+rm -f ./host.out.test*
+rm -f ./nslookup.out.test*
 rm -f ./ns*/named.lock
 rm -f ./ns*/managed-keys.bind*
 rm -f ./ns2/example.db ./ns2/K* ./ns2/keyid ./ns2/keydata
@@ -67,8 +67,56 @@ if [ -n "$PYTHON" ] ; then
 	$PYTHON -c "import yaml" 2> /dev/null && HAS_PYYAML=1
 fi

+#
+# test whether ans7/ans.pl will be able to send a UPDATE response.
+# if it can't, we will log that below.
+#
+if "$PERL" -e 'use Net::DNS; use Net::DNS::Packet; my $p = new Net::DNS::Packet; $p->header->opcode(5);' > /dev/null 2>&1
+then
+	checkupdate=1
+else
+	checkupdate=0
+fi
+
+if [ -x "$NSLOOKUP" -a $checkupdate -eq 1 ] ; then
+
+  n=$((n+1))
+  echo_i "check nslookup handles UPDATE response ($n)"
+  ret=0
+  "$NSLOOKUP" -q=CNAME "-port=$PORT" foo.bar 10.53.0.7 > nslookup.out.test$n 2>&1 && ret=1
+  grep "Opcode mismatch" nslookup.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+fi
+
+if [ -x "$HOST" -a $checkupdate -eq 1 ] ; then
+
+  n=$((n+1))
+  echo_i "check host handles UPDATE response ($n)"
+  ret=0
+  "$HOST" -t CNAME -p $PORT foo.bar 10.53.0.7 > host.out.test$n 2>&1 && ret=1
+  grep "Opcode mismatch" host.out.test$n > /dev/null || ret=1
+  if [ $ret -ne 0 ]; then echo_i "failed"; fi
+  status=$((status+ret))
+
+fi
+
 if [ -x "$DIG" ] ; then

+  if [ $checkupdate -eq 1 ] ; then
+
+    n=$((n+1))
+    echo_i "check dig handles UPDATE response ($n)"
+    ret=0
+    dig_with_opts @10.53.0.7 cname foo.bar > dig.out.test$n 2>&1 && ret=1
+    grep "Opcode mismatch" dig.out.test$n > /dev/null || ret=1
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+  else
+    echo_i "Skipped UPDATE handling test"
+  fi
+
  n=$((n+1))
  echo_i "checking dig short form works ($n)"
  ret=0
@@ -0,0 +1,2 @@
+/ns1/named.conf
+/ns2/named.conf
@@ -9,11 +9,17 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-rm -f */K* */dsset-* */*.signed */trusted.conf
-rm -f ns1/root.db
-rm -f ns1/signer.err
-rm -f dig.out*
-rm -f */named.run
-rm -f */named.memstats
-rm -f ns*/named.lock
+set -e
+
+rm -f ./dig.out*
+rm -f ns*/*.signed
+rm -f ns*/K*
+rm -f ns*/dsset-*
 rm -f ns*/managed-keys.bind*
+rm -f ns*/named.conf
+rm -f ns*/named.lock
+rm -f ns*/named.memstats
+rm -f ns*/named.run
+rm -f ns*/root.db
+rm -f ns*/signer.err
+rm -f ns*/trusted.conf
@@ -17,7 +17,7 @@ options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
-	port 5300;
+	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
@@ -9,21 +9,22 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-SYSTEMTESTTOP=../..
-. $SYSTEMTESTTOP/conf.sh
+set -e
+
+. "$SYSTEMTESTTOP/conf.sh"

 zone=.
 infile=root.db.in
 zonefile=root.db

-key1=`$KEYGEN -q -a ECDSAP256SHA256 -n zone $zone`
-key2=`$KEYGEN -q -a ECDSAP384SHA384 -n zone -f KSK $zone`
-$DSFROMKEY -a sha-384 $key2.key > dsset-384
+key1=$($KEYGEN -q -a ECDSAP256SHA256 -n zone "$zone")
+key2=$($KEYGEN -q -a ECDSAP384SHA384 -n zone -f KSK "$zone")
+$DSFROMKEY -a sha-384 "$key2.key" > dsset-384

-cat $infile $key1.key $key2.key > $zonefile
+cat "$infile" "$key1.key" "$key2.key" > $zonefile

-$SIGNER -P -g -o $zone $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -P -g -o "$zone" "$zonefile" > /dev/null 2> signer.err || cat signer.err

 # Configure the resolving server with a static key.
-keyfile_to_static_ds $key1 > trusted.conf
+keyfile_to_static_ds "$key1" > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
@@ -17,7 +17,7 @@ options {
 	query-source address 10.53.0.2;
 	notify-source 10.53.0.2;
 	transfer-source 10.53.0.2;
-	port 5300;
+	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
@@ -9,7 +9,11 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
+set -e
+
+. "$SYSTEMTESTTOP/conf.sh"
+
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf

 cd ns1 && $SHELL sign.sh
@@ -9,26 +9,28 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
+set -e
+
+. "$SYSTEMTESTTOP/conf.sh"

 status=0
-n=0
+n=1

-rm -f dig.out.*
+dig_with_opts() {
+    "$DIG" +tcp +noau +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
+}

-DIGOPTS="+tcp +noau +noadd +nosea +nostat +nocmd +dnssec -p 5300"

 # Check the example. domain
 echo "I:checking that positive validation works ($n)"
 ret=0
-$DIG $DIGOPTS . @10.53.0.1 soa > dig.out.ns1.test$n || ret=1
-$DIG $DIGOPTS . @10.53.0.2 soa > dig.out.ns2.test$n || ret=1
+dig_with_opts . @10.53.0.1 soa > dig.out.ns1.test$n || ret=1
+dig_with_opts . @10.53.0.2 soa > dig.out.ns2.test$n || ret=1
 $PERL ../digcomp.pl dig.out.ns1.test$n dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -9,11 +9,17 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-rm -f */K* */dsset-* */*.signed */trusted.conf
-rm -f ns1/root.db
-rm -f ns*/signer.err
-rm -f dig.out*
-rm -f */named.run
-rm -f */named.memstats
-rm -f ns*/named.lock
+set -e
+
+rm -f ./dig.out*
+rm -f ns*/*.signed
+rm -f ns*/K*
+rm -f ns*/dsset-*
 rm -f ns*/managed-keys.bind*
+rm -f ns*/named.conf
+rm -f ns*/named.lock
+rm -f ns*/named.memstats
+rm -f ns*/named.run
+rm -f ns*/root.db
+rm -f ns*/signer.err
+rm -f ns*/trusted.conf
@@ -17,7 +17,7 @@ options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
-	port 5300;
+	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
@@ -9,24 +9,25 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-SYSTEMTESTTOP=../..
-. $SYSTEMTESTTOP/conf.sh
+set -e
+
+. "$SYSTEMTESTTOP/conf.sh"

 zone=.
 infile=root.db.in
 zonefile=root.db

-key1=`$KEYGEN -q -a ED25519 -n zone $zone`
-key2=`$KEYGEN -q -a ED25519 -n zone -f KSK $zone`
-#key2=`$KEYGEN -q -a ED448 -n zone -f KSK $zone`
-$DSFROMKEY -a sha-256 $key2.key > dsset-256
+key1=$($KEYGEN -q -a ED25519 -n zone "$zone")
+key2=$($KEYGEN -q -a ED25519 -n zone -f KSK "$zone")
+#key2=$($KEYGEN -q -a ED448 -n zone -f KSK "$zone")
+$DSFROMKEY -a sha-256 "$key2.key" > dsset-256

-cat $infile $key1.key $key2.key > $zonefile
+cat "$infile" "$key1.key" "$key2.key" > "$zonefile"

-$SIGNER -P -g -o $zone $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -P -g -o "$zone" "$zonefile" > /dev/null 2> signer.err || cat signer.err

 # Configure the resolving server with a static key.
-keyfile_to_static_ds $key1 > trusted.conf
+keyfile_to_static_ds "$key1" > trusted.conf
 cp trusted.conf ../ns2/trusted.conf

 cd ../ns2 && $SHELL sign.sh
@@ -17,7 +17,7 @@ options {
 	query-source address 10.53.0.2;
 	notify-source 10.53.0.2;
 	transfer-source 10.53.0.2;
-	port 5300;
+	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
@@ -9,8 +9,9 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-SYSTEMTESTTOP=../..
-. $SYSTEMTESTTOP/conf.sh
+set -e
+
+. "$SYSTEMTESTTOP/conf.sh"

 zone=example.com.
 zonefile=example.com.db
@@ -22,7 +23,7 @@ for i in Xexample.com.+015+03613.key Xexample.com.+015+03613.private \
 	 Xexample.com.+016+09713.key Xexample.com.+016+09713.private \
 	 Xexample.com.+016+38353.key Xexample.com.+016+38353.private
 do
-	cp $i `echo $i | sed s/X/K/`
+	cp "$i" "$(echo $i | sed s/X/K/)"
 done

-$SIGNER -P -z -s $starttime -e $endtime -o $zone $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -P -z -s "$starttime" -e "$endtime" -o "$zone" "$zonefile" > /dev/null 2> signer.err || cat signer.err
@@ -9,7 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
+set -e

-exec $SHELL ../testcrypto.sh eddsa
+. "$SYSTEMTESTTOP/conf.sh"
+
+if ! $SHELL ../testcrypto.sh eddsa; then
+	exit 1
+fi
@@ -9,7 +9,11 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
+set -e
+
+. "$SYSTEMTESTTOP/conf.sh"
+
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf

 cd ns1 && $SHELL sign.sh
@@ -9,27 +9,28 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
+set -e
+
+. "$SYSTEMTESTTOP/conf.sh"

 status=0
 n=1

-rm -f dig.out.*
-
-DIGOPTS="+tcp +noau +noadd +nosea +nostat +nocmd +dnssec -p 5300"
+dig_with_opts() {
+    "$DIG" +tcp +noau +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
+}

 # Check the example. domain

 echo "I:checking that positive validation works ($n)"
 ret=0
-$DIG $DIGOPTS . @10.53.0.1 soa > dig.out.ns1.test$n || ret=1
-$DIG $DIGOPTS . @10.53.0.2 soa > dig.out.ns2.test$n || ret=1
+dig_with_opts . @10.53.0.1 soa > dig.out.ns1.test$n || ret=1
+dig_with_opts . @10.53.0.2 soa > dig.out.ns2.test$n || ret=1
 $PERL ../digcomp.pl dig.out.ns1.test$n dig.out.ns2.test$n || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 # Check test vectors (RFC 8080 + errata)

@@ -39,9 +40,9 @@ grep 'oL9krJun7xfBOIWcGHi7mag5/hdZrKWw15jP' ns2/example.com.db.signed > /dev/nul
 grep 'VrbpMngwcrqNAg==' ns2/example.com.db.signed > /dev/null || ret=1
 grep 'zXQ0bkYgQTEFyfLyi9QoiY6D8ZdYo4wyUhVi' ns2/example.com.db.signed > /dev/null || ret=1
 grep 'R0O7KuI5k2pcBg==' ns2/example.com.db.signed > /dev/null || ret=1
-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 echo "I:checking that Ed448 test vectors match ($n)"
 ret=0
@@ -57,9 +58,9 @@ grep '4m0AsQ4f7qI1gVnML8vWWiyW2KXhT9kuAICU' ns2/example.com.db.signed > /dev/nul
 grep 'Sxv5OWbf81Rq7Yu60npabODB0QFPb/rkW3kU' ns2/example.com.db.signed > /dev/null || ret=1
 grep 'ZmQ0YQUA' ns2/example.com.db.signed > /dev/null || ret=1

-n=`expr $n + 1`
+n=$((n+1))
 if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -199,8 +199,9 @@ echo_i "checking that priming queries are not forwarded ($n)"
 ret=0
 nextpart ns7/named.run >/dev/null
 dig_with_opts +noadd +noauth txt.example1. txt @10.53.0.7 > dig.out.$n.f7 || ret=1
+received_pattern="received packet from 10\.53\.0\.1"
 start_pattern="sending packet to 10\.53\.0\.1"
-retry_quiet 5 wait_for_log ns7/named.run "$start_pattern" || ret=1
+retry_quiet 5 wait_for_log ns7/named.run "$received_pattern" || ret=1
 check_sent 1 ns7/named.run "$start_pattern" ";\.[[:space:]]*IN[[:space:]]*NS$" || ret=1
 sent=$(grep -c "10.53.0.7#.* (.): query '\./NS/IN' approved" ns4/named.run)
 [ "$sent" -eq 0 ] || ret=1
@@ -274,7 +274,7 @@ main(int argc, char *argv[]) {

 	lctx = NULL;
 	lcfg = NULL;
-	RUNCHECK(isc_log_create(mctx, &lctx, &lcfg));
+	isc_log_create(mctx, &lctx, &lcfg);

 	RUNCHECK(dst_lib_init(mctx, NULL));

@@ -22,7 +22,7 @@ rm -f ns2/*.queries
 rm -f ns2/named.[0-9]*.conf
 rm -f ns2/named.conf.header

-rm -f ns3/named2.conf
+rm -f ns3/named.conf

 rm -f dnsrps*.conf dnsrpzd*
 rm -f ns*/session.key
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation yes;
+	response-policy { zone "policy"; } nsdname-wait-recurse no
+		nsdname-enable yes;
+
+	include "../dnsrps.conf";
+};
+
+zone "policy" { type master; file "policy.db"; };
+
+zone "example.tld" { type master; file "example.db"; };
+
+zone "." { type master; file "root.db"; };
@@ -42,7 +42,6 @@ copy_setports ns2/named.conf.header.in ns2/named.conf.header
 copy_setports ns2/named.default.conf ns2/named.conf

 copy_setports ns3/named1.conf.in ns3/named.conf
-copy_setports ns3/named2.conf.in ns3/named2.conf

 copy_setports ns4/named.conf.in ns4/named.conf

@@ -474,15 +474,17 @@ for mode in native dnsrps; do
    status=1
  }

-  # Check for invalid prefix length error
-  t=`expr $t + 1`
-  echo_i "testing for invalid prefix length error (${t})"
-  add_test_marker 10.53.0.2
-  run_server invalidprefixlength
-  grep "invalid rpz IP address \"1000.4.0.53.10.rpz-client-ip.invalidprefixlength\"; invalid prefix length of 1000$" ns2/named.run > /dev/null || {
-    echo_ic "failed: expected that invalid prefix length error would be logged"
-    status=1
-  }
+  if [ "$mode" = "native" ]; then
+    # Check for invalid prefix length error
+    t=`expr $t + 1`
+    echo_i "testing for invalid prefix length error (${t})"
+    add_test_marker 10.53.0.2
+    run_server invalidprefixlength
+    grep "invalid rpz IP address \"1000.4.0.53.10.rpz-client-ip.invalidprefixlength\"; invalid prefix length of 1000$" ns2/named.run > /dev/null || {
+      echo_ic "failed: expected that invalid prefix length error would be logged"
+      status=1
+    }
+  fi

  t=`expr $t + 1`
  echo_i "checking 'nsip-wait-recurse no' is faster than 'nsip-wait-recurse yes' ($t)"
@@ -493,10 +495,10 @@ for mode in native dnsrps; do
  $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
  t2=`$PERL -e 'print time()."\n";'`
  p1=`expr $t2 - $t1`
-  echo_i "elasped time $p1 seconds"
+  echo_i "elapsed time $p1 seconds"

  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
-  cp -f ns3/named2.conf ns3/named.conf
+  copy_setports ns3/named2.conf.in ns3/named.conf
  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null

  echo_i "timing 'nsip-wait-recurse no'"
@@ -504,12 +506,44 @@ for mode in native dnsrps; do
  $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
  t4=`$PERL -e 'print time()."\n";'`
  p2=`expr $t4 - $t3`
-  echo_i "elasped time $p2 seconds"
+  echo_i "elapsed time $p2 seconds"

  if test $p1 -le $p2; then ret=1; fi
  if test $ret != 0; then echo_i "failed"; fi
  status=`expr $status + $ret`

+  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
+  # restore original named.conf
+  copy_setports ns3/named1.conf.in ns3/named.conf
+  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
+
+  t=`expr $t + 1`
+  echo_i "checking 'nsdname-wait-recurse no' is faster than 'nsdname-wait-recurse yes' ($t)"
+  add_test_marker 10.53.0.2
+  echo_i "timing 'nsdname-wait-recurse yes' (default)"
+  ret=0
+  t1=`$PERL -e 'print time()."\n";'`
+  $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
+  t2=`$PERL -e 'print time()."\n";'`
+  p1=`expr $t2 - $t1`
+  echo_i "elapsed time $p1 seconds"
+
+  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
+  copy_setports ns3/named3.conf.in ns3/named.conf
+  $RNDC  -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
+
+  echo_i "timing 'nsdname-wait-recurse no'"
+  t3=`$PERL -e 'print time()."\n";'`
+  $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
+  t4=`$PERL -e 'print time()."\n";'`
+  p2=`expr $t4 - $t3`
+  echo_i "elapsed time $p2 seconds"
+
+  if test $p1 -le $p2; then ret=1; fi
+  if test $ret != 0; then echo_i "failed"; fi
+  status=`expr $status + $ret`
+
+
  [ $status -ne 0 ] && pf=fail || pf=pass
  case $mode in
  native)
@@ -107,19 +107,20 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);
 	CHECK(dst_lib_init(mctx, NULL), "dst_lib_init()");
-	CHECK(isc_log_create(mctx, &log_, &logconfig), "isc_log_create()");
+	isc_log_create(mctx, &log_, &logconfig);
 	isc_log_setcontext(log_);
 	dns_log_init(log_);
 	dns_log_setcontext(log_);
-	CHECK(isc_log_settag(logconfig, "bigkey"), "isc_log_settag()");
+	isc_log_settag(logconfig, "bigkey");
+
 	destination.file.stream = stderr;
 	destination.file.name = NULL;
 	destination.file.versions = ISC_LOG_ROLLNEVER;
 	destination.file.maximum_size = 0;
-	CHECK(isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
-				    level, &destination,
-				    ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL),
-	      "isc_log_createchannel()");
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC, level,
+			      &destination,
+			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
+
 	CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL), "isc_log_"
 								   "usechannel("
 								   ")");
@@ -9,10 +9,15 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-rm -f dig.out.* rndc.out.* ns1/named.conf
-rm -f K* ns1/K*
-rm -f */named.memstats
-rm -f */named.run
-rm -f ns1/_default.tsigkeys
-rm -f ns*/named.lock
+set -e
+
+rm -f ./K*
+rm -f ./dig.out.*
+rm -f ./rndc.out.*
+rm -f ns*/K*
+rm -f ns*/_default.tsigkeys
 rm -f ns*/managed-keys.bind*
+rm -f ns*/named.conf
+rm -f ns*/named.lock
+rm -f ns*/named.memstats
+rm -f ns*/named.run
@@ -52,9 +52,11 @@

 #define RUNCHECK(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)

-#define PORT	5300
 #define TIMEOUT 30

+static char *ip_address = NULL;
+static int port = 0;
+
 static dst_key_t *ourkey;
 static isc_mem_t *mctx;
 static dns_tsigkey_t *tsigkey, *initialkey;
@@ -141,10 +143,10 @@ sendquery(isc_task_t *task, isc_event_t *event) {
 	isc_event_free(&event);

 	result = ISC_R_FAILURE;
-	if (inet_pton(AF_INET, "10.53.0.1", &inaddr) != 1) {
+	if (inet_pton(AF_INET, ip_address, &inaddr) != 1) {
 		CHECK("inet_pton", result);
 	}
-	isc_sockaddr_fromin(&address, &inaddr, PORT);
+	isc_sockaddr_fromin(&address, &inaddr, port);

 	dns_fixedname_init(&keyname);
 	isc_buffer_constinit(&namestr, "tkeytest.", 9);
@@ -210,18 +212,16 @@ main(int argc, char *argv[]) {

 	RUNCHECK(isc_app_start());

-	if (argc < 2) {
+	if (argc < 4) {
 		fprintf(stderr, "I:no DH key provided\n");
 		exit(-1);
 	}
-	if (strcmp(argv[1], "-r") == 0) {
-		fprintf(stderr, "I:the -r option has been deprecated\n");
-		exit(-1);
-	}
-	ourkeyname = argv[1];
+	ip_address = argv[1];
+	port = atoi(argv[2]);
+	ourkeyname = argv[3];

-	if (argc >= 3) {
-		ownername_str = argv[2];
+	if (argc >= 5) {
+		ownername_str = argv[4];
 	}

 	dns_result_register();
@@ -232,7 +232,7 @@ main(int argc, char *argv[]) {

 	log = NULL;
 	logconfig = NULL;
-	RUNCHECK(isc_log_create(mctx, &log, &logconfig));
+	isc_log_create(mctx, &log, &logconfig);

 	RUNCHECK(dst_lib_init(mctx, NULL));

@@ -51,9 +51,10 @@

 #define RUNCHECK(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)

-#define PORT	5300
 #define TIMEOUT 30

+static char *ip_address;
+static int port;
 static isc_mem_t *mctx;
 static dns_tsigkey_t *tsigkey;
 static dns_tsig_keyring_t *ring;
@@ -114,10 +115,10 @@ sendquery(isc_task_t *task, isc_event_t *event) {
 	isc_event_free(&event);

 	result = ISC_R_FAILURE;
-	if (inet_pton(AF_INET, "10.53.0.1", &inaddr) != 1) {
+	if (inet_pton(AF_INET, ip_address, &inaddr) != 1) {
 		CHECK("inet_pton", result);
 	}
-	isc_sockaddr_fromin(&address, &inaddr, PORT);
+	isc_sockaddr_fromin(&address, &inaddr, port);

 	query = NULL;
 	result = dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &query);
@@ -155,7 +156,7 @@ main(int argc, char **argv) {

 	RUNCHECK(isc_app_start());

-	if (argc < 2) {
+	if (argc < 4) {
 		fprintf(stderr, "I:no key to delete\n");
 		exit(-1);
 	}
@@ -163,7 +164,9 @@ main(int argc, char **argv) {
 		fprintf(stderr, "I:The -r options has been deprecated\n");
 		exit(-1);
 	}
-	keyname = argv[1];
+	ip_address = argv[1];
+	port = atoi(argv[2]);
+	keyname = argv[3];

 	dns_result_register();

@@ -172,7 +175,7 @@ main(int argc, char **argv) {

 	log = NULL;
 	logconfig = NULL;
-	RUNCHECK(isc_log_create(mctx, &log, &logconfig));
+	isc_log_create(mctx, &log, &logconfig);

 	RUNCHECK(dst_lib_init(mctx, NULL));

@@ -15,7 +15,7 @@ options {
 	query-source address 10.53.0.1;
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
-	port 5300;
+	port @PORT@;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
@@ -32,7 +32,7 @@ key rndc_key {
 };

 controls {
-	inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };

 key "tkeytest." {
@@ -9,10 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-SYSTEMTESTTOP=../..
-. $SYSTEMTESTTOP/conf.sh
+set -e

-keyname=`$KEYGEN -T KEY -a DH -b 768 -n host server`
-keyid=$(keyfile_to_key_id $keyname)
-rm -f named.conf
-sed -e "s;KEYID;$keyid;" < named.conf.in > named.conf
+. "$SYSTEMTESTTOP/conf.sh"
+
+keyname=$($KEYGEN -T KEY -a DH -b 768 -n host server)
+keyid=$(keyfile_to_key_id "$keyname")
+sed -i -e "s;KEYID;$keyid;" named.conf
@@ -9,7 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
+set -e
+
+. "$SYSTEMTESTTOP/conf.sh"
+
+copy_setports ns1/named.conf.in ns1/named.conf

 cd ns1 && $SHELL setup.sh
@@ -9,137 +9,153 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
+set -e

-DIGOPTS="@10.53.0.1 -p 5300"
+. "$SYSTEMTESTTOP/conf.sh"
+
+dig_with_opts() {
+	"$DIG" @10.53.0.1 -p "$PORT" "$@"
+}

 status=0
+n=1

-echo "I:generating new DH key"
+echo "I:generating new DH key ($n)"
 ret=0
-dhkeyname=`$KEYGEN -T KEY -a DH -b 768 -n host client` || ret=1
+dhkeyname=$($KEYGEN -T KEY -a DH -b 768 -n host client) || ret=1
 if [ $ret != 0 ]; then
 	echo "I:failed"
-	status=`expr $status + $ret`
+	status=$((status+ret))
 	echo "I:exit status: $status"
 	exit $status
 fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))

 for owner in . foo.example.
 do
-	echo "I:creating new key using owner name \"$owner\""
+	echo "I:creating new key using owner name \"$owner\" ($n)"
 	ret=0
-	keyname=`$KEYCREATE $dhkeyname $owner` || ret=1
+	keyname=$($KEYCREATE 10.53.0.1 "$PORT" "$dhkeyname" $owner) || ret=1
 	if [ $ret != 0 ]; then
 		echo "I:failed"
-		status=`expr $status + $ret`
+		status=$((status+ret))
 		echo "I:exit status: $status"
 		exit $status
 	fi
-	status=`expr $status + $ret`
+	status=$((status+ret))
+	n=$((n+1))

-	echo "I:checking the new key"
+	echo "I:checking the new key ($n)"
 	ret=0
-	$DIG $DIGOPTS txt txt.example -k $keyname > dig.out.1 || ret=1
-	grep "status: NOERROR" dig.out.1 > /dev/null || ret=1
-	grep "TSIG.*hmac-md5.*NOERROR" dig.out.1 > /dev/null || ret=1
-	grep "Some TSIG could not be validated" dig.out.1 > /dev/null && ret=1
+	dig_with_opts txt txt.example -k "$keyname" > dig.out.test$n || ret=1
+	grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+	grep "TSIG.*hmac-md5.*NOERROR" dig.out.test$n > /dev/null || ret=1
+	grep "Some TSIG could not be validated" dig.out.test$n > /dev/null && ret=1
 	if [ $ret != 0 ]; then
 		echo "I:failed"
 	fi
-	status=`expr $status + $ret`
+	status=$((status+ret))
+	n=$((n+1))

-	echo "I:deleting new key"
+	echo "I:deleting new key ($n)"
 	ret=0
-	$KEYDELETE $keyname || ret=1
+	$KEYDELETE 10.53.0.1 "$PORT" "$keyname" || ret=1
 	if [ $ret != 0 ]; then
 		echo "I:failed"
 	fi
-	status=`expr $status + $ret`
+	status=$((status+ret))
+	n=$((n+1))

-	echo "I:checking that new key has been deleted"
+	echo "I:checking that new key has been deleted ($n)"
 	ret=0
-	$DIG $DIGOPTS txt txt.example -k $keyname > dig.out.2 || ret=1
-	grep "status: NOERROR" dig.out.2 > /dev/null && ret=1
-	grep "TSIG.*hmac-md5.*NOERROR" dig.out.2 > /dev/null && ret=1
-	grep "Some TSIG could not be validated" dig.out.2 > /dev/null || ret=1
+	dig_with_opts txt txt.example -k "$keyname" > dig.out.test$n || ret=1
+	grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
+	grep "TSIG.*hmac-md5.*NOERROR" dig.out.test$n > /dev/null && ret=1
+	grep "Some TSIG could not be validated" dig.out.test$n > /dev/null || ret=1
 	if [ $ret != 0 ]; then
 		echo "I:failed"
 	fi
-	status=`expr $status + $ret`
+	status=$((status+ret))
+	n=$((n+1))
 done

-echo "I:creating new key using owner name bar.example."
+echo "I:creating new key using owner name bar.example. ($n)"
 ret=0
-keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
+keyname=$($KEYCREATE 10.53.0.1 "$PORT" "$dhkeyname" bar.example.) || ret=1
 if [ $ret != 0 ]; then
        echo "I:failed"
-	status=`expr $status + $ret`
+	status=$((status+ret))
        echo "I:exit status: $status"
        exit $status
 fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))

-echo "I:checking the key with 'rndc tsig-list'"
+echo "I:checking the key with 'rndc tsig-list' ($n)"
 ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 tsig-list > rndc.out.1
-grep "key \"bar.example.server" rndc.out.1 > /dev/null || ret=1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p "$CONTROLPORT" tsig-list > rndc.out.test$n
+grep "key \"bar.example.server" rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then
        echo "I:failed"
 fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))

-echo "I:using key in a request"
+echo "I:using key in a request ($n)"
 ret=0
-$DIG $DIGOPTS -k $keyname txt.example txt > dig.out.3 || ret=1
-grep "status: NOERROR" dig.out.3 > /dev/null || ret=1
+dig_with_opts -k "$keyname" txt.example txt > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then
        echo "I:failed"
 fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))

-echo "I:deleting the key with 'rndc tsig-delete'"
+echo "I:deleting the key with 'rndc tsig-delete' ($n)"
 ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 tsig-delete bar.example.server > /dev/null || ret=1
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 tsig-list > rndc.out.2
-grep "key \"bar.example.server" rndc.out.2 > /dev/null && ret=1
-$DIG $DIGOPTS -k $keyname txt.example txt > dig.out.4 || ret=1
-grep "TSIG could not be validated" dig.out.4 > /dev/null || ret=1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p "$CONTROLPORT" tsig-delete bar.example.server > /dev/null || ret=1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p "$CONTROLPORT" tsig-list > rndc.out.test$n
+grep "key \"bar.example.server" rndc.out.test$n > /dev/null && ret=1
+dig_with_opts -k "$keyname" txt.example txt > dig.out.test$n || ret=1
+grep "TSIG could not be validated" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then
        echo "I:failed"
 fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))

-echo "I:recreating the bar.example. key"
+echo "I:recreating the bar.example. key ($n)"
 ret=0
-keyname=`$KEYCREATE $dhkeyname bar.example.` || ret=1
+keyname=$($KEYCREATE 10.53.0.1 "$PORT" "$dhkeyname" bar.example.) || ret=1
 if [ $ret != 0 ]; then
        echo "I:failed"
-	status=`expr $status + $ret`
+	status=$((status+ret))
        echo "I:exit status: $status"
        exit $status
 fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))

-echo "I:checking the new key with 'rndc tsig-list'"
+echo "I:checking the new key with 'rndc tsig-list' ($n)"
 ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 tsig-list > rndc.out.3
-grep "key \"bar.example.server" rndc.out.3 > /dev/null || ret=1
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p "$CONTROLPORT" tsig-list > rndc.out.test$n
+grep "key \"bar.example.server" rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then
        echo "I:failed"
 fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))

-echo "I:using the new key in a request"
+echo "I:using the new key in a request ($n)"
 ret=0
-$DIG $DIGOPTS -k $keyname txt.example txt > dig.out.5 || ret=1
-grep "status: NOERROR" dig.out.5 > /dev/null || ret=1
+dig_with_opts -k "$keyname" txt.example txt > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then
        echo "I:failed"
 fi
-status=`expr $status + $ret`
+status=$((status+ret))
+n=$((n+1))

 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -18,7 +18,8 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
 		${BIND9_INCLUDES} \
 		${OPENSSL_CFLAGS} \
-		${MAXMINDDB_CFLAGS}
+		${MAXMINDDB_CFLAGS} \
+		${LMDB_CFLAGS}

 CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =
@@ -33,7 +34,7 @@ BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 ISCCFGDEPLIBS = ../../lib/isccfg/libisccfg.@A@

-LIBS =		${ISCLIBS} @LIBS@
+LIBS =		${ISCLIBS} ${LMDB_LIBS} @LIBS@

 SUBDIRS =

@@ -2086,7 +2086,7 @@ main(int argc, char *argv[]) {

 	lctx = NULL;
 	lcfg = NULL;
-	RUNCHECK(isc_log_create(mctx, &lctx, &lcfg));
+	isc_log_create(mctx, &lctx, &lcfg);

 	RUNCHECK(dst_lib_init(mctx, NULL));
 	isc_nonce_buf(cookie_secret, sizeof(cookie_secret));
@@ -32,7 +32,7 @@ setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
 	isc_logconfig_t *logconfig = NULL;
 	isc_log_t *log = NULL;

-	RUNTIME_CHECK(isc_log_create(mctx, &log, &logconfig) == ISC_R_SUCCESS);
+	isc_log_create(mctx, &log, &logconfig);
 	isc_log_setcontext(log);
 	dns_log_init(log);
 	dns_log_setcontext(log);
@@ -41,9 +41,9 @@ setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
 	destination.file.name = NULL;
 	destination.file.versions = ISC_LOG_ROLLNEVER;
 	destination.file.maximum_size = 0;
-	RUNTIME_CHECK(isc_log_createchannel(logconfig, "stderr",
-					    ISC_LOG_TOFILEDESC, ISC_LOG_DYNAMIC,
-					    &destination, 0) == ISC_R_SUCCESS);
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, 0);
+
 	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
 		      ISC_R_SUCCESS);

@@ -261,7 +261,7 @@
 /* Define to 1 if you have the <linux/rtnetlink.h> header file. */
 #undef HAVE_LINUX_RTNETLINK_H

-/* Define if lmdb was found */
+/* Use lmdb library */
 #undef HAVE_LMDB

 /* Define to 1 if you have the <locale.h> header file. */
@@ -733,6 +733,9 @@ LIBXML2_CFLAGS
 NZDTARGETS
 NZDSRCS
 NZD_TOOLS
+LMDB_LDFLAGS
+LMDB_LIBS
+LMDB_CFLAGS
 DNS_CRYPTO_LIBS
 DNS_GSSAPI_LIBS
 DST_GSSAPI_INC
@@ -970,6 +973,8 @@ LIBUV_CFLAGS
 LIBUV_LIBS
 OPENSSL_CFLAGS
 OPENSSL_LIBS
+LMDB_CFLAGS
+LMDB_LIBS
 LIBXML2_CFLAGS
 LIBXML2_LIBS
 JSON_C_CFLAGS
@@ -1663,7 +1668,8 @@ Optional Packages:
  --with-gssapi=PATH|/path/krb5-config
                          Specify path for system-supplied GSSAPI
                          [default=auto]
-  --with-lmdb=PATH        build with LMDB library [yes|no|path]
+  --with-lmdb=[PATH]      use LMDB library [default=auto], optionally specify
+                          the prefix for lmdb library
  --with-libxml2          build with libxml2 library [yes|no|auto] (default is
                          auto)
  --with-libjson          deprecated, use --with-json-c
@@ -1732,6 +1738,8 @@ Some influential environment variables:
              C compiler flags for OPENSSL, overriding pkg-config
  OPENSSL_LIBS
              linker flags for OPENSSL, overriding pkg-config
+  LMDB_CFLAGS C compiler flags for LMDB, overriding pkg-config
+  LMDB_LIBS   linker flags for LMDB, overriding pkg-config
  LIBXML2_CFLAGS
              C compiler flags for LIBXML2, overriding pkg-config
  LIBXML2_LIBS
@@ -17514,53 +17522,96 @@ DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS"
 #
 # was --with-lmdb specified?
 #
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for lmdb library" >&5
-$as_echo_n "checking for lmdb library... " >&6; }
+

 # Check whether --with-lmdb was given.
 if test "${with_lmdb+set}" = set; then :
-  withval=$with_lmdb; use_lmdb="$withval"
+  withval=$with_lmdb; :
 else
-  use_lmdb="auto"
+  with_lmdb="auto"
 fi


-have_lmdb=""
-case "$use_lmdb" in
-	no)
-		lmdb_libs=""
-		;;
-	auto|yes)
-		for d in /usr /usr/local /opt/local
-		do
-			if test -f "${d}/include/lmdb.h"
-			then
-				if test ${d} != /usr
-				then
-					lmdb_cflags="-I ${d}/include"
-					LIBS="$LIBS -L${d}/lib"
-				fi
-				have_lmdb="yes"
-			fi
-		done
-		;;
-	*)
-		if test -f "${use_lmdb}/include/lmdb.h"
-		then
-			lmdb_cflags="-I${use_lmdb}/include"
-			LIBS="$LIBS -L${use_lmdb}/lib"
-			have_lmdb="yes"
-		else
-			as_fn_error $? "$use_lmdb/include/lmdb.h not found." "$LINENO" 5
-		fi
-		;;
-esac
+ac_lib_lmdb_found=no
+case $with_lmdb in #(
+  no) :
+     ;; #(
+  auto|yes) :

-if test "X${have_lmdb}" != "X"
-then
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+pkg_failed=no
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for lmdb" >&5
+$as_echo_n "checking for lmdb... " >&6; }
+
+if test -n "$LMDB_CFLAGS"; then
+    pkg_cv_LMDB_CFLAGS="$LMDB_CFLAGS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lmdb\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "lmdb") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_LMDB_CFLAGS=`$PKG_CONFIG --cflags "lmdb" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+if test -n "$LMDB_LIBS"; then
+    pkg_cv_LMDB_LIBS="$LMDB_LIBS"
+ elif test -n "$PKG_CONFIG"; then
+    if test -n "$PKG_CONFIG" && \
+    { { $as_echo "$as_me:${as_lineno-$LINENO}: \$PKG_CONFIG --exists --print-errors \"lmdb\""; } >&5
+  ($PKG_CONFIG --exists --print-errors "lmdb") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+  test $ac_status = 0; }; then
+  pkg_cv_LMDB_LIBS=`$PKG_CONFIG --libs "lmdb" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes
+else
+  pkg_failed=yes
+fi
+ else
+    pkg_failed=untried
+fi
+
+
+
+if test $pkg_failed = yes; then
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi
+        if test $_pkg_short_errors_supported = yes; then
+	        LMDB_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "lmdb" 2>&1`
+        else
+	        LMDB_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "lmdb" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$LMDB_PKG_ERRORS" >&5
+
+	for ac_lib_lmdb_path in /usr /usr/local /opt /opt/local; do
+						if test -z "$ac_lib_lmdb_path"; then :
+  as_fn_error $? "Path cannot be empty" "$LINENO" 5
+fi
+	  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for lmdb header in $ac_lib_lmdb_path" >&5
+$as_echo_n "checking for lmdb header in $ac_lib_lmdb_path... " >&6; }
+	  if test -r "$ac_lib_lmdb_path/include/lmdb.h"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing mdb_env_create" >&5
+		 LMDB_CFLAGS="-I$ac_lib_lmdb_path/include"
+		 LMDB_LIBS="-L$ac_lib_lmdb_path/lib"
+		 saved_CFLAGS="$CFLAGS"
+		 saved_LIBS="$LIBS"
+		 CFLAGS="$CFLAGS $LMDB_CFLAGS"
+		 LIBS="$LIBS $LMDB_LIBS"
+		 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing mdb_env_create" >&5
 $as_echo_n "checking for library containing mdb_env_create... " >&6; }
 if ${ac_cv_search_mdb_env_create+:} false; then :
  $as_echo_n "(cached) " >&6
@@ -17613,32 +17664,250 @@ $as_echo "$ac_cv_search_mdb_env_create" >&6; }
 ac_res=$ac_cv_search_mdb_env_create
 if test "$ac_res" != no; then :
  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+  LMDB_LIBS="$LMDB_LIBS $ac_cv_search_mdb_env_create"
+
+
+				 ac_lib_lmdb_found=yes
+							     break

 else
-  as_fn_error $? "found lmdb include but not library." "$LINENO" 5
-			have_lmdb=""
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+				 LMDB_CFLAGS=""
+				 LMDB_LIBS=""
+
+
 fi

-elif test "X$use_lmdb" = Xyes
-then
-	as_fn_error $? "include/lmdb.h not found." "$LINENO" 5
+		 CFLAGS="$saved_CFLAGS"
+		 LIBS="$saved_LIBS"
+
 else
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 fi
+					done

-NZD_TOOLS=""
-NZDSRCS=
-NZDTARGETS=
-if test "X${have_lmdb}" != "X"
-then
-	CFLAGS="$CFLAGS $lmdb_cflags"
+elif test $pkg_failed = untried; then
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+	for ac_lib_lmdb_path in /usr /usr/local /opt /opt/local; do
+						if test -z "$ac_lib_lmdb_path"; then :
+  as_fn_error $? "Path cannot be empty" "$LINENO" 5
+fi
+	  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for lmdb header in $ac_lib_lmdb_path" >&5
+$as_echo_n "checking for lmdb header in $ac_lib_lmdb_path... " >&6; }
+	  if test -r "$ac_lib_lmdb_path/include/lmdb.h"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+		 LMDB_CFLAGS="-I$ac_lib_lmdb_path/include"
+		 LMDB_LIBS="-L$ac_lib_lmdb_path/lib"
+		 saved_CFLAGS="$CFLAGS"
+		 saved_LIBS="$LIBS"
+		 CFLAGS="$CFLAGS $LMDB_CFLAGS"
+		 LIBS="$LIBS $LMDB_LIBS"
+		 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing mdb_env_create" >&5
+$as_echo_n "checking for library containing mdb_env_create... " >&6; }
+if ${ac_cv_search_mdb_env_create+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char mdb_env_create ();
+int
+main ()
+{
+return mdb_env_create ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' lmdb; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_search_mdb_env_create=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_mdb_env_create+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_mdb_env_create+:} false; then :
+
+else
+  ac_cv_search_mdb_env_create=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_mdb_env_create" >&5
+$as_echo "$ac_cv_search_mdb_env_create" >&6; }
+ac_res=$ac_cv_search_mdb_env_create
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+  LMDB_LIBS="$LMDB_LIBS $ac_cv_search_mdb_env_create"
+
+
+				 ac_lib_lmdb_found=yes
+							     break
+
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+				 LMDB_CFLAGS=""
+				 LMDB_LIBS=""
+
+
+fi
+
+		 CFLAGS="$saved_CFLAGS"
+		 LIBS="$saved_LIBS"
+
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+					done
+
+else
+	LMDB_CFLAGS=$pkg_cv_LMDB_CFLAGS
+	LMDB_LIBS=$pkg_cv_LMDB_LIBS
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+	ac_lib_lmdb_found=yes
+fi ;; #(
+  *) :
+    if test -z "$with_lmdb"; then :
+  as_fn_error $? "Path cannot be empty" "$LINENO" 5
+fi
+	  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for lmdb header in $with_lmdb" >&5
+$as_echo_n "checking for lmdb header in $with_lmdb... " >&6; }
+	  if test -r "$with_lmdb/include/lmdb.h"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+		 LMDB_CFLAGS="-I$with_lmdb/include"
+		 LMDB_LIBS="-L$with_lmdb/lib"
+		 saved_CFLAGS="$CFLAGS"
+		 saved_LIBS="$LIBS"
+		 CFLAGS="$CFLAGS $LMDB_CFLAGS"
+		 LIBS="$LIBS $LMDB_LIBS"
+		 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing mdb_env_create" >&5
+$as_echo_n "checking for library containing mdb_env_create... " >&6; }
+if ${ac_cv_search_mdb_env_create+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char mdb_env_create ();
+int
+main ()
+{
+return mdb_env_create ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' lmdb; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_search_mdb_env_create=$ac_res
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext
+  if ${ac_cv_search_mdb_env_create+:} false; then :
+  break
+fi
+done
+if ${ac_cv_search_mdb_env_create+:} false; then :
+
+else
+  ac_cv_search_mdb_env_create=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_mdb_env_create" >&5
+$as_echo "$ac_cv_search_mdb_env_create" >&6; }
+ac_res=$ac_cv_search_mdb_env_create
+if test "$ac_res" != no; then :
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+  LMDB_LIBS="$LMDB_LIBS $ac_cv_search_mdb_env_create"
+
+
+				 ac_lib_lmdb_found=yes
+
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+				 LMDB_CFLAGS=""
+				 LMDB_LIBS=""
+
+
+fi
+
+		 CFLAGS="$saved_CFLAGS"
+		 LIBS="$saved_LIBS"
+
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi ;;
+esac
+
+# don't fail when in automatic mode
+if test "$with_lmdb" = "auto" && test "$ac_lib_lmdb_found" = "no"; then :
+  with_lmdb=no
+fi
+
+# hard fail when LMDB requested, but not found
+if test "$with_lmdb" != "no" && test "$ac_lib_lmdb_found" != "yes"; then :
+  as_fn_error $? "LMDB requested, but not found" "$LINENO" 5
+fi
+
+if test "$ac_lib_lmdb_found" = "yes"; then :

 $as_echo "#define HAVE_LMDB 1" >>confdefs.h

-	NZD_TOOLS="nzd"
-	NZDSRCS='${NZDSRCS}'
-	NZDTARGETS='${NZDTARGETS}'
+fi
+
+
+
+#AM_CONDITIONAL([HAVE_LMDB], [test "$ac_lib_lmdb_found" = "yes"])
+
+NZD_TOOLS=
+NZDSRCS=
+NZDTARGETS=
+if test -n "$LMDB_LIBS"; then :
+  NZD_TOOLS="nzd"
+       NZDSRCS='${NZDSRCS}'
+       NZDTARGETS='${NZDTARGETS}'
 fi


@@ -1168,70 +1168,51 @@ AC_SUBST(DNS_CRYPTO_LIBS)
 #
 # was --with-lmdb specified?
 #
-AC_MSG_CHECKING(for lmdb library)
-AC_ARG_WITH(lmdb,
-	    AS_HELP_STRING([--with-lmdb[=PATH]],
-			   [build with LMDB library [yes|no|path]]),
-    use_lmdb="$withval", use_lmdb="auto")

-have_lmdb=""
-case "$use_lmdb" in
-	no)
-		lmdb_libs=""
-		;;
-	auto|yes)
-		for d in /usr /usr/local /opt/local
-		do
-			if test -f "${d}/include/lmdb.h"
-			then
-				if test ${d} != /usr
-				then
-					lmdb_cflags="-I ${d}/include"
-					LIBS="$LIBS -L${d}/lib"
-				fi
-				have_lmdb="yes"
-			fi
-		done
-		;;
-	*)
-		if test -f "${use_lmdb}/include/lmdb.h"
-		then
-			lmdb_cflags="-I${use_lmdb}/include"
-			LIBS="$LIBS -L${use_lmdb}/lib"
-			have_lmdb="yes"
-		else
-			AC_MSG_ERROR([$use_lmdb/include/lmdb.h not found.])
-		fi
-		;;
-esac
+AC_ARG_WITH([lmdb],
+	    [AS_HELP_STRING([--with-lmdb=@<:@PATH@:>@],
+			    [use LMDB library @<:@default=auto@:>@, optionally specify the prefix for lmdb library])],
+	    [:],
+	    [with_lmdb="auto"])

-if test "X${have_lmdb}" != "X"
-then
-	AC_MSG_RESULT(yes)
-	AC_SEARCH_LIBS([mdb_env_create], [lmdb], [],
-		       [AC_MSG_ERROR([found lmdb include but not library.])
-			have_lmdb=""])
-elif test "X$use_lmdb" = Xyes
-then
-	AC_MSG_ERROR([include/lmdb.h not found.])
-else
-	AC_MSG_RESULT(no)
-fi
+ac_lib_lmdb_found=no
+AS_CASE([$with_lmdb],
+	[no],[],
+	[auto|yes], [PKG_CHECK_MODULES([LMDB], [lmdb],
+				       [ac_lib_lmdb_found=yes],
+				       [for ac_lib_lmdb_path in /usr /usr/local /opt /opt/local; do
+						AX_LIB_LMDB([$ac_lib_lmdb_path],
+							    [ac_lib_lmdb_found=yes
+							     break])
+					done
+				       ])],
+	[AX_LIB_LMDB([$with_lmdb],[ac_lib_lmdb_found=yes])])

-NZD_TOOLS=""
+# don't fail when in automatic mode
+AS_IF([test "$with_lmdb" = "auto" && test "$ac_lib_lmdb_found" = "no"],
+      [with_lmdb=no])
+
+# hard fail when LMDB requested, but not found
+AS_IF([test "$with_lmdb" != "no" && test "$ac_lib_lmdb_found" != "yes"],
+      [AC_MSG_ERROR([LMDB requested, but not found])])
+
+AS_IF([test "$ac_lib_lmdb_found" = "yes"],
+      [AC_DEFINE([HAVE_LMDB], [1], [Use lmdb library])])
+
+AC_SUBST([LMDB_CFLAGS])
+AC_SUBST([LMDB_LIBS])
+#AM_CONDITIONAL([HAVE_LMDB], [test "$ac_lib_lmdb_found" = "yes"])
+
+NZD_TOOLS=
 NZDSRCS=
 NZDTARGETS=
-if test "X${have_lmdb}" != "X"
-then
-	CFLAGS="$CFLAGS $lmdb_cflags"
-	AC_DEFINE(HAVE_LMDB, 1, [Define if lmdb was found])
-	NZD_TOOLS="nzd"
-	NZDSRCS='${NZDSRCS}'
-	NZDTARGETS='${NZDTARGETS}'
-fi
-AC_SUBST(NZD_TOOLS)
-AC_SUBST(NZDSRCS)
-AC_SUBST(NZDTARGETS)
+AS_IF([test -n "$LMDB_LIBS"],
+      [NZD_TOOLS="nzd"
+       NZDSRCS='${NZDSRCS}'
+       NZDTARGETS='${NZDTARGETS}'])
+AC_SUBST([NZD_TOOLS])
+AC_SUBST([NZDSRCS])
+AC_SUBST([NZDTARGETS])

 #
 # was --with-libxml2 specified?
@@ -62,8 +62,7 @@ int ctx_init(void) {

 	isc_mem_create(&ctx.mem);

-	if (isc_log_create(ctx.mem, &ctx.log, &ctx.logcfg) != ISC_R_SUCCESS)
-		goto done;
+	isc_log_create(ctx.mem, &ctx.log, &ctx.logcfg);

 	isc_log_setcontext(ctx.log);
 	dns_log_init(ctx.log);
@@ -75,7 +75,7 @@
        <acronym class="acronym">BIND</acronym> version 9 software package for
        system administrators.
      </p>
-      <p>This version of the manual corresponds to BIND version 9.15.</p>
+      <p>This version of the manual corresponds to BIND version 9.17.</p>
    </div>

    <div class="section">
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Chapter 2. BIND Resource Requirements</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch01.html" title="Chapter 1. Introduction">
@@ -43,17 +43,16 @@
 <dt><span class="section"><a href="Bv9ARM.ch02.html#supported_os">Supported Operating Systems</a></span></dt>
 </dl>
 </div>
-
-    <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="hw_req"></a>Hardware requirements</h2></div></div></div>
-      <p>
+<p>
        <acronym class="acronym">DNS</acronym> hardware requirements have
        traditionally been quite modest.
        For many installations, servers that have been pensioned off from
        active duty have performed admirably as <acronym class="acronym">DNS</acronym> servers.
      </p>
-      <p>
+<p>
        The DNSSEC features of <acronym class="acronym">BIND</acronym> 9
        may prove to be quite
        CPU intensive however, so organizations that make heavy use of these
@@ -62,22 +61,22 @@
        full utilization of
        multiprocessor systems for installations that need it.
      </p>
-    </div>
-    <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="cpu_req"></a>CPU Requirements</h2></div></div></div>
-      <p>
+<p>
        CPU requirements for <acronym class="acronym">BIND</acronym> 9 range from
        i386-class machines
        for serving of static zones without caching, to enterprise-class
        machines if you intend to process many dynamic updates and DNSSEC
        signed zones, serving many thousands of queries per second.
      </p>
-    </div>
-    <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="mem_req"></a>Memory Requirements</h2></div></div></div>
-      <p>
+<p>
        The memory of the server has to be large enough to fit the
        cache and zones loaded off disk.  The <span class="command"><strong>max-cache-size</strong></span>
        option can be used to limit the amount of memory used by the cache,
@@ -91,14 +90,11 @@
        a relatively stable size where entries are expiring from the cache as
        fast as they are being inserted.
      </p>
-      
-    </div>
-
-    <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="intensive_env"></a>Name Server Intensive Environment Issues</h2></div></div></div>
-
-      <p>
+<p>
        For name server intensive environments, there are two alternative
        configurations that may be used. The first is where clients and
        any second-level internal name servers query a main name server, which
@@ -111,13 +107,11 @@
        this has the disadvantage of making many more external queries,
        as none of the name servers share their cached data.
      </p>
-    </div>
-
-    <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="supported_os"></a>Supported Operating Systems</h2></div></div></div>
-
-      <p>
+<p>
        ISC <acronym class="acronym">BIND</acronym> 9 compiles and runs on a large
        number
        of Unix-like operating systems and on
@@ -127,8 +121,8 @@
        directory
        of the BIND 9 source distribution.
      </p>
-    </div>
-  </div>
+</div>
+</div>
 <div class="navfooter">
 <hr>
 <table width="100%" summary="Navigation footer">
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Chapter 3. Name Server Configuration</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch02.html" title="Chapter 2. BIND Resource Requirements">
@@ -54,22 +54,18 @@
 </dl></dd>
 </dl>
 </div>
-
-    <p>
+<p>
      In this chapter we provide some suggested configurations along
      with guidelines for their use.  We suggest reasonable values for
      certain option settings.
    </p>
-
-    <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="sample_configuration"></a>Sample Configurations</h2></div></div></div>
-
-      <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="cache_only_sample"></a>A Caching-only Name Server</h3></div></div></div>
-
-        <p>
+<p>
          The following sample configuration is appropriate for a caching-only
          name server for use by clients internal to a corporation.  All
          queries
@@ -78,7 +74,6 @@
          suitable
          firewall rules.
        </p>
-
 <pre class="programlisting">
 // Two corporate subnets we wish to allow queries from.
 acl corpnets { 192.168.4.0/24; 192.168.7.0/24; };
@@ -96,19 +91,15 @@ zone "0.0.127.in-addr.arpa" {
     notify no;
 };
 </pre>
-
-      </div>
-
-      <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="auth_only_sample"></a>An Authoritative-only Name Server</h3></div></div></div>
-
-        <p>
+<p>
          This sample configuration is for an authoritative-only server
          that is the master server for "<code class="filename">example.com</code>"
          and a slave for the subdomain "<code class="filename">eng.example.com</code>".
        </p>
-
 <pre class="programlisting">
 options {
     // Working directory
@@ -147,31 +138,23 @@ zone "eng.example.com" {
     masters { 192.168.4.12; };
 };
 </pre>
-
-      </div>
-    </div>
-
-    <div class="section">
+</div>
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="load_balancing"></a>Load Balancing</h2></div></div></div>
-
-      
-
-      <p>
+<p>
        A primitive form of load balancing can be achieved in
        the <acronym class="acronym">DNS</acronym> by using multiple records
        (such as multiple A records) for one name.
      </p>
-
-      <p>
+<p>
        For example, if you have three HTTP servers with network addresses
        of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
        following means that clients will connect to each machine one third
        of the time:
      </p>
-
-      <div class="informaltable">
-        <table border="1">
+<div class="informaltable"><table class="informaltable" border="1">
 <colgroup>
 <col width="0.875in" class="1">
 <col width="0.500in" class="2">
@@ -285,52 +268,47 @@ zone "eng.example.com" {
              </td>
 </tr>
 </tbody>
-</table>
-      </div>
-      <p>
+</table></div>
+<p>
        When a resolver queries for these records, <acronym class="acronym">BIND</acronym> will rotate
        them and respond to the query with the records in a different
        order.  In the example above, clients will randomly receive
        records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients
        will use the first record returned and discard the rest.
      </p>
-      <p>
+<p>
        For more detail on ordering responses, check the
        <span class="command"><strong>rrset-order</strong></span> sub-statement in the
        <span class="command"><strong>options</strong></span> statement, see
        <a class="xref" href="Bv9ARM.ch05.html#rrset_ordering" title="RRset Ordering">RRset Ordering</a>.
      </p>
-
-    </div>
-
-    <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="ns_operations"></a>Name Server Operations</h2></div></div></div>
-
-      <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="tools"></a>Tools for Use With the Name Server Daemon</h3></div></div></div>
-        <p>
+<p>
          This section describes several indispensable diagnostic,
          administrative and monitoring tools available to the system
          administrator for controlling and debugging the name server
          daemon.
        </p>
-        <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h4 class="title">
 <a name="diagnostic_tools"></a>Diagnostic Tools</h4></div></div></div>
-          <p>
+<p>
            The <span class="command"><strong>dig</strong></span>, <span class="command"><strong>host</strong></span>, and
            <span class="command"><strong>nslookup</strong></span> programs are all command
            line tools
            for manually querying name servers.  They differ in style and
            output format.
          </p>
-
-          <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><a name="dig"></a><span class="command"><strong>dig</strong></span></span></dt>
 <dd>
-                <p>
+<p>
                  <span class="command"><strong>dig</strong></span>
                  is the most versatile and complete of these lookup tools.
                  It has two modes: simple interactive
@@ -340,31 +318,22 @@ zone "eng.example.com" {
                  accessible
                  from the command line.
                </p>
-                <div class="cmdsynopsis"><p>
-                  <code class="command">dig</code> 
-                   [@<em class="replaceable"><code>server</code></em>]
-                    <em class="replaceable"><code>domain</code></em> 
-                   [<em class="replaceable"><code>query-type</code></em>]
-                   [<em class="replaceable"><code>query-class</code></em>]
-                   [+<em class="replaceable"><code>query-option</code></em>]
-                   [-<em class="replaceable"><code>dig-option</code></em>]
-                   [%<em class="replaceable"><code>comment</code></em>]
-                </p></div>
-                <p>
+<div class="cmdsynopsis"><p><code class="command">dig</code>  [@<em class="replaceable"><code>server</code></em>]  <em class="replaceable"><code>domain</code></em>  [<em class="replaceable"><code>query-type</code></em>] [<em class="replaceable"><code>query-class</code></em>] [+<em class="replaceable"><code>query-option</code></em>] [-<em class="replaceable"><code>dig-option</code></em>] [%<em class="replaceable"><code>comment</code></em>]</p></div>
+<p>
                  The usual simple use of <span class="command"><strong>dig</strong></span> will take the form
                </p>
-                <p class="simpara">
+<p class="simpara">
                  <span class="command"><strong>dig @server domain query-type query-class</strong></span>
                </p>
-                <p>
+<p>
                  For more information and a list of available commands and
                  options, see the <span class="command"><strong>dig</strong></span> man
                  page.
                </p>
-              </dd>
+</dd>
 <dt><span class="term"><span class="command"><strong>host</strong></span></span></dt>
 <dd>
-                <p>
+<p>
                  The <span class="command"><strong>host</strong></span> utility emphasizes
                  simplicity
                  and ease of use.  By default, it converts
@@ -372,29 +341,16 @@ zone "eng.example.com" {
                  functionality
                  can be extended with the use of options.
                </p>
-                <div class="cmdsynopsis"><p>
-                  <code class="command">host</code> 
-                   [-aCdlnrsTwv]
-                   [-c <em class="replaceable"><code>class</code></em>]
-                   [-N <em class="replaceable"><code>ndots</code></em>]
-                   [-t <em class="replaceable"><code>type</code></em>]
-                   [-W <em class="replaceable"><code>timeout</code></em>]
-                   [-R <em class="replaceable"><code>retries</code></em>]
-                   [-m <em class="replaceable"><code>flag</code></em>]
-                   [-4]
-                   [-6]
-                    <em class="replaceable"><code>hostname</code></em> 
-                   [<em class="replaceable"><code>server</code></em>]
-                </p></div>
-                <p>
+<div class="cmdsynopsis"><p><code class="command">host</code>  [-aCdlnrsTwv] [-c <em class="replaceable"><code>class</code></em>] [-N <em class="replaceable"><code>ndots</code></em>] [-t <em class="replaceable"><code>type</code></em>] [-W <em class="replaceable"><code>timeout</code></em>] [-R <em class="replaceable"><code>retries</code></em>] [-m <em class="replaceable"><code>flag</code></em>] [-4] [-6]  <em class="replaceable"><code>hostname</code></em>  [<em class="replaceable"><code>server</code></em>]</p></div>
+<p>
                  For more information and a list of available commands and
                  options, see the <span class="command"><strong>host</strong></span> man
                  page.
                </p>
-              </dd>
+</dd>
 <dt><span class="term"><span class="command"><strong>nslookup</strong></span></span></dt>
 <dd>
-                <p><span class="command"><strong>nslookup</strong></span>
+<p><span class="command"><strong>nslookup</strong></span>
                  has two modes: interactive and
                  non-interactive. Interactive mode allows the user to
                  query name servers for information about various
@@ -403,15 +359,8 @@ zone "eng.example.com" {
                  the name and requested information for a host or
                  domain.
                </p>
-                <div class="cmdsynopsis"><p>
-                  <code class="command">nslookup</code> 
-                   [-option...]
-                   [
-                    [<em class="replaceable"><code>host-to-find</code></em>]
-                     |  [- [server]]
-                  ]
-                </p></div>
-                <p>
+<div class="cmdsynopsis"><p><code class="command">nslookup</code>  [-option...] [[<em class="replaceable"><code>host-to-find</code></em>] |  [- [server]]]</p></div>
+<p>
                  Interactive mode is entered when no arguments are given (the
                  default name server will be used) or when the first argument
                  is a
@@ -419,7 +368,7 @@ zone "eng.example.com" {
                  Internet address
                  of a name server.
                </p>
-                <p>
+<p>
                  Non-interactive mode is used when the name or Internet
                  address
                  of the host to be looked up is given as the first argument.
@@ -427,76 +376,56 @@ zone "eng.example.com" {
                  optional second argument specifies the host name or address
                  of a name server.
                </p>
-                <p>
+<p>
                  Due to its arcane user interface and frequently inconsistent
                  behavior, we do not recommend the use of <span class="command"><strong>nslookup</strong></span>.
                  Use <span class="command"><strong>dig</strong></span> instead.
                </p>
-              </dd>
+</dd>
 </dl></div>
-        </div>
-
-        <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h4 class="title">
 <a name="admin_tools"></a>Administrative Tools</h4></div></div></div>
-          <p>
+<p>
            Administrative tools play an integral part in the management
            of a server.
          </p>
-          <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt>
 <a name="named-checkconf"></a><span class="term"><span class="command"><strong>named-checkconf</strong></span></span>
 </dt>
 <dd>
-                <p>
+<p>
                  The <span class="command"><strong>named-checkconf</strong></span> program
                  checks the syntax of a <code class="filename">named.conf</code> file.
                </p>
-                <div class="cmdsynopsis"><p>
-                  <code class="command">named-checkconf</code> 
-                   [-jvz]
-                   [-t <em class="replaceable"><code>directory</code></em>]
-                   [<em class="replaceable"><code>filename</code></em>]
-                </p></div>
-              </dd>
+<div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [-jvz] [-t <em class="replaceable"><code>directory</code></em>] [<em class="replaceable"><code>filename</code></em>]</p></div>
+</dd>
 <dt>
 <a name="named-checkzone"></a><span class="term"><span class="command"><strong>named-checkzone</strong></span></span>
 </dt>
 <dd>
-                <p>
+<p>
                  The <span class="command"><strong>named-checkzone</strong></span> program
                  checks a master file for
                  syntax and consistency.
                </p>
-                <div class="cmdsynopsis"><p>
-                  <code class="command">named-checkzone</code> 
-                   [-djqvD]
-                   [-c <em class="replaceable"><code>class</code></em>]
-                   [-o <em class="replaceable"><code>output</code></em>]
-                   [-t <em class="replaceable"><code>directory</code></em>]
-                   [-w <em class="replaceable"><code>directory</code></em>]
-                   [-k <em class="replaceable"><code>(ignore|warn|fail)</code></em>]
-                   [-n <em class="replaceable"><code>(ignore|warn|fail)</code></em>]
-                   [-W <em class="replaceable"><code>(ignore|warn)</code></em>]
-                    <em class="replaceable"><code>zone</code></em> 
-                   [<em class="replaceable"><code>filename</code></em>]
-                </p></div>
-              </dd>
+<div class="cmdsynopsis"><p><code class="command">named-checkzone</code>  [-djqvD] [-c <em class="replaceable"><code>class</code></em>] [-o <em class="replaceable"><code>output</code></em>] [-t <em class="replaceable"><code>directory</code></em>] [-w <em class="replaceable"><code>directory</code></em>] [-k <em class="replaceable"><code>(ignore|warn|fail)</code></em>] [-n <em class="replaceable"><code>(ignore|warn|fail)</code></em>] [-W <em class="replaceable"><code>(ignore|warn)</code></em>]  <em class="replaceable"><code>zone</code></em>  [<em class="replaceable"><code>filename</code></em>]</p></div>
+</dd>
 <dt>
 <a name="named-compilezone"></a><span class="term"><span class="command"><strong>named-compilezone</strong></span></span>
 </dt>
-<dd>
-                <p>
+<dd><p>
                  Similar to <span class="command"><strong>named-checkzone,</strong></span> but
                  it always dumps the zone content to a specified file
                  (typically in a different format).
-                </p>
-              </dd>
+                </p></dd>
 <dt>
 <a name="rndc"></a><span class="term"><span class="command"><strong>rndc</strong></span></span>
 </dt>
 <dd>
-                <p>
+<p>
                  The remote name daemon control
                  (<span class="command"><strong>rndc</strong></span>) program allows the
                  system
@@ -504,21 +433,11 @@ zone "eng.example.com" {
                  If you run <span class="command"><strong>rndc</strong></span> without any
                  options, it will display a usage message as follows:
                </p>
-                <div class="cmdsynopsis"><p>
-                  <code class="command">rndc</code> 
-                   [-c <em class="replaceable"><code>config</code></em>]
-                   [-s <em class="replaceable"><code>server</code></em>]
-                   [-p <em class="replaceable"><code>port</code></em>]
-                   [-y <em class="replaceable"><code>key</code></em>]
-                    <em class="replaceable"><code>command</code></em> 
-                   [<em class="replaceable"><code>command</code></em>...]
-                </p></div>
-
-                <p>See <a class="xref" href="man.rndc.html" title="rndc"><span class="refentrytitle"><span class="application">rndc</span></span>(8)</a> for details of
+<div class="cmdsynopsis"><p><code class="command">rndc</code>  [-c <em class="replaceable"><code>config</code></em>] [-s <em class="replaceable"><code>server</code></em>] [-p <em class="replaceable"><code>port</code></em>] [-y <em class="replaceable"><code>key</code></em>]  <em class="replaceable"><code>command</code></em>  [<em class="replaceable"><code>command</code></em>...]</p></div>
+<p>See <a class="xref" href="man.rndc.html" title="rndc"><span class="refentrytitle"><span class="application">rndc</span></span>(8)</a> for details of
                  the available <span class="command"><strong>rndc</strong></span> commands.
                </p>
-
-                <p>
+<p>
                  <span class="command"><strong>rndc</strong></span> requires a configuration file,
                  since all
                  communication with the server is authenticated with
@@ -542,8 +461,7 @@ zone "eng.example.com" {
                  <a class="xref" href="Bv9ARM.ch05.html#controls_statement_definition_and_usage" title="controls Statement Definition and Usage">the section called &#8220;<span class="command"><strong>controls</strong></span> Statement Definition and
          Usage&#8221;</a>.
                </p>
-
-                <p>
+<p>
                  The format of the configuration file is similar to
                  that of <code class="filename">named.conf</code>, but
                  limited to
@@ -555,8 +473,7 @@ zone "eng.example.com" {
                  be shared.  The order of statements is not
                  significant.
                </p>
-
-                <p>
+<p>
                  The <span class="command"><strong>options</strong></span> statement has
                  three clauses:
                  <span class="command"><strong>default-server</strong></span>, <span class="command"><strong>default-key</strong></span>,
@@ -574,8 +491,7 @@ zone "eng.example.com" {
                  port is given on the command line or in a
                  <span class="command"><strong>server</strong></span> statement.
                </p>
-
-                <p>
+<p>
                  The <span class="command"><strong>key</strong></span> statement defines a
                  key to be used
                  by <span class="command"><strong>rndc</strong></span> when authenticating
@@ -604,8 +520,7 @@ zone "eng.example.com" {
                  have any meaning.  The secret is a Base64 encoded string
                  as specified in RFC 3548.
                </p>
-
-                <p>
+<p>
                  The <span class="command"><strong>server</strong></span> statement
                  associates a key
                  defined using the <span class="command"><strong>key</strong></span>
@@ -621,11 +536,9 @@ zone "eng.example.com" {
                  connect
                  to on the server.
                </p>
-
-                <p>
+<p>
                  A sample minimal configuration file is as follows:
                </p>
-
 <pre class="programlisting">
 key rndc_key {
     algorithm "hmac-sha256";
@@ -637,36 +550,30 @@ options {
     default-key    rndc_key;
 };
 </pre>
-
-                <p>
+<p>
                  This file, if installed as <code class="filename">/etc/rndc.conf</code>,
                  would allow the command:
                </p>
-
-                <p>
+<p>
                  <code class="prompt">$ </code><strong class="userinput"><code>rndc reload</code></strong>
                </p>
-
-                <p>
+<p>
                  to connect to 127.0.0.1 port 953 and cause the name server
                  to reload, if a name server on the local machine were
                  running with
                  following controls statements:
                </p>
-
 <pre class="programlisting">
 controls {
        inet 127.0.0.1
            allow { localhost; } keys { rndc_key; };
 };
 </pre>
-
-                <p>
+<p>
                  and it had an identical key statement for
                  <code class="literal">rndc_key</code>.
                </p>
-
-                <p>
+<p>
                  Running the <span class="command"><strong>rndc-confgen</strong></span>
                  program will
                  conveniently create a <code class="filename">rndc.conf</code>
@@ -681,23 +588,19 @@ controls {
                  modify
                  <code class="filename">named.conf</code> at all.
                </p>
-
-              </dd>
+</dd>
 </dl></div>
-
-        </div>
-      </div>
-
-      <div class="section">
+</div>
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="signals"></a>Signals</h3></div></div></div>
-        <p>
+<p>
          Certain UNIX signals cause the name server to take specific
          actions, as described in the following table.  These signals can
          be sent using the <span class="command"><strong>kill</strong></span> command.
        </p>
-        <div class="informaltable">
-          <table border="1">
+<div class="informaltable"><table class="informaltable" border="1">
 <colgroup>
 <col width="1.125in" class="1">
 <col width="4.000in" class="2">
@@ -735,29 +638,26 @@ controls {
                </td>
 </tr>
 </tbody>
-</table>
-        </div>
-      </div>
-    </div>
-
-    <div class="section">
+</table></div>
+</div>
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="module-info"></a>Plugins</h2></div></div></div>
-
-  <p>
+<p>
    Plugins are a mechanism to extend the functionality of
    <span class="command"><strong>named</strong></span> using dynamically loadable libraries.
    By using plugins, core server functionality can be kept simple
    for the majority of users; more complex code implementing optional
    features need only be installed by users that need those features.
  </p>
-  <p>
+<p>
    The plugin interface is a work in progress, and is expected to evolve
    as more plugins are added. Currently, only "query plugins" are supported;
    these modify the name server query logic. Other plugin types may be added
    in the future.
  </p>
-  <p>
+<p>
    The only plugin currently included in BIND is
    <code class="filename">filter-aaaa.so</code>, which replaces the
    <span class="command"><strong>filter-aaaa</strong></span> feature that previously existed natively
@@ -768,20 +668,19 @@ controls {
    <code class="filename">filter-aaaa.so</code> plugin provides identical
    functionality.
  </p>
-
-  <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="id-1.4.6.5"></a>Configuring Plugins</h3></div></div></div>
-    <p>
+<p>
      A plugin is configured with the <span class="command"><strong>plugin</strong></span>
      statement in <code class="filename">named.conf</code>:
    </p>
-    <pre class="screen">
+<pre class="screen">
    plugin query "library.so" {
        <em class="replaceable"><code>parameters</code></em>
    };
    </pre>
-    <p>
+<p>
      In this example, file <code class="filename">library.so</code> is the plugin
      library.  <code class="literal">query</code> indicates that this is a query
      plugin.
@@ -792,17 +691,16 @@ controls {
      Multiple <span class="command"><strong>plugin</strong></span> statements can be specified, to load
      different plugins or multiple instances of the same plugin.
    </p>
-    <p>
+<p>
      <em class="replaceable"><code>parameters</code></em> are passed as an opaque
      string to the plugin's initialization routine. Configuration
      syntax will differ depending on the module.
    </p>
-  </div>
-
-  <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="id-1.4.6.6"></a>Developing Plugins</h3></div></div></div>
-    <p>
+<p>
      Each plugin implements four functions:
      </p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
@@ -822,7 +720,7 @@ controls {
 </ul></div>
 <p>
    </p>
-    <p>
+<p>
      At various locations within the <span class="command"><strong>named</strong></span> source code,
      there are "hook points" at which a plugin may register itself.
      When a hook point is reached while <span class="command"><strong>named</strong></span> is
@@ -834,11 +732,9 @@ controls {
      aborted. More details can be found in the file
      <code class="filename">lib/ns/include/ns/hooks.h</code>.
    </p>
-  </div>
-
 </div>
-
-  </div>
+</div>
+</div>
 <div class="navfooter">
 <hr>
 <table width="100%" summary="Navigation footer">
@@ -271,30 +271,43 @@

      <p>
        The incremental zone transfer (IXFR) protocol is a way for
-        slave servers to transfer only changed data, instead of having to
+        secondary servers to transfer only changed data, instead of having to
        transfer the entire zone. The IXFR protocol is specified in RFC
        1995. See <a class="xref" href="Bv9ARM.ch10.html#proposed_standards" title="Proposed Standards">Proposed Standards</a>.
      </p>

      <p>
-        When acting as a master, <acronym class="acronym">BIND</acronym> 9
+        When acting as a primary server, <acronym class="acronym">BIND</acronym> 9
        supports IXFR for those zones
        where the necessary change history information is available. These
-        include master zones maintained by dynamic update and slave zones
+        include primary zones maintained by dynamic update and secondary zones
        whose data was obtained by IXFR.  For manually maintained master
-        zones, and for slave zones obtained by performing a full zone
+        zones, and for secondary zones obtained by performing a full zone
        transfer (AXFR), IXFR is supported only if the option
        <span class="command"><strong>ixfr-from-differences</strong></span> is set
        to <strong class="userinput"><code>yes</code></strong>.
      </p>

      <p>
-        When acting as a slave, <acronym class="acronym">BIND</acronym> 9 will
+        When acting as a secondary server, <acronym class="acronym">BIND</acronym> 9 will
        attempt to use IXFR unless
        it is explicitly disabled. For more information about disabling
        IXFR, see the description of the <span class="command"><strong>request-ixfr</strong></span> clause
        of the <span class="command"><strong>server</strong></span> statement.
      </p>
+
+      <p>
+        When a secondary server receives a zone via AXFR, it creates a
+        new copy of the zone database and then swaps it into place; during
+        the loading process, queries continue to be served from the old
+        database with no interference. When receiving a zone via IXFR,
+        however, changes are applied to the running zone, which may
+        degrade query performance during the transfer.  If a server
+        receiving an IXFR request determines that the response size would
+        be similar in size to an AXFR response, it may wish to send AXFR
+        instead. The threshold at which this determination is made can
+        be configured using the <span class="command"><strong>max-ixfr-ratio</strong></span> option.
+      </p>
    </div>

    <div class="section">
@@ -1220,7 +1220,8 @@

        <p>
          The <span class="command"><strong>include</strong></span> statement inserts the
-          specified file at the point where the <span class="command"><strong>include</strong></span>
+          specified file (or files if a valid glob expression is detected)
+          at the point where the <span class="command"><strong>include</strong></span>
          statement is encountered. The <span class="command"><strong>include</strong></span>
                statement facilitates the administration of configuration
          files
@@ -3115,6 +3116,22 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                of the new format.)
              </p>
            </dd>
+<dt><span class="term"><span class="command"><strong>max-ixfr-ratio</strong></span></span></dt>
+<dd>
+              <p>
+                Sets the size threshold (expressed as a percentage
+                of the size of the full zone) beyond which
+                <span class="command"><strong>named</strong></span> will choose to use an AXFR
+                response rather than IXFR when answering zone transfer
+                requests.  See <a class="xref" href="Bv9ARM.ch04.html#incremental_zone_transfers" title="Incremental Zone Transfers (IXFR)">the section called &#8220;Incremental Zone Transfers (IXFR)&#8221;</a>.
+              </p>
+              <p>
+                The minimum value is <code class="literal">1%</code>. The keyword
+                <code class="literal">unlimited</code> disables ratio checking and
+                allows IXFRs of any size.  The default is
+                <code class="literal">100%</code>.
+              </p>
+            </dd>
 <dt><span class="term"><span class="command"><strong>new-zones-directory</strong></span></span></dt>
 <dd>
              <p>
@@ -9125,6 +9142,13 @@ example.com                 CNAME   rpz-tcp-only.
            roll, which cryptographic algorithms to use, and how often RRSIG
            records need to be refreshed.
          </p>
+          <p>
+            Keys are not shared among zones, which means that one set of keys
+            per zone will be generated even if they have the same policy.
+            If multiple views are configured with different versions of the
+            same zone, each separate version will use the same set of signing
+            keys.
+          </p>
          <p>
            Multiple key and signing policies can be configured.  To
            attach a policy to a zone, add a <span class="command"><strong>dnssec-policy</strong></span>
@@ -10607,6 +10631,15 @@ view "external" {
                    This is applicable to <span class="command"><strong>master</strong></span> and <span class="command"><strong>slave</strong></span> zones.
                  </p>
                </dd>
+<dt><span class="term"><span class="command"><strong>max-ixfr-ratio</strong></span></span></dt>
+<dd>
+                  <p>
+                    See the description of
+                    <span class="command"><strong>max-ixfr-ratio</strong></span> in
+                    <a class="xref" href="Bv9ARM.ch05.html#options" title="options Statement Definition and Usage">the section called &#8220;<span class="command"><strong>options</strong></span> Statement Definition and
+          Usage&#8221;</a>.
+                  </p>
+                </dd>
 <dt><span class="term"><span class="command"><strong>max-journal-size</strong></span></span></dt>
 <dd>
                  <p>
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Chapter 6. BIND 9 Security Considerations</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch05.html" title="Chapter 5. BIND 9 Configuration Reference">
@@ -45,12 +45,10 @@
 <dt><span class="section"><a href="Bv9ARM.ch06.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
 </dl>
 </div>
-
-      <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="Access_Control_Lists"></a>Access Control Lists</h2></div></div></div>
-
-        <p>
+<p>
          Access Control Lists (ACLs) are address match lists that
          you can set up and nickname for future use in
          <span class="command"><strong>allow-notify</strong></span>, <span class="command"><strong>allow-query</strong></span>,
@@ -58,27 +56,26 @@
          <span class="command"><strong>blackhole</strong></span>, <span class="command"><strong>allow-transfer</strong></span>,
          <span class="command"><strong>match-clients</strong></span>, etc.
        </p>
-        <p>
+<p>
          Using ACLs allows you to have finer control over who can access
          your name server, without cluttering up your config files with huge
          lists of IP addresses.
        </p>
-        <p>
+<p>
          It is a <span class="emphasis"><em>good idea</em></span> to use ACLs, and to
          control access to your server. Limiting access to your server by
          outside parties can help prevent spoofing and denial of service
          (DoS) attacks against your server.
        </p>
-        <p>
+<p>
          ACLs match clients on the basis of up to three characteristics:
          1) The client's IP address; 2) the TSIG or SIG(0) key that was
          used to sign the request, if any; and 3) an address prefix
          encoded in an EDNS Client Subnet option, if any.
        </p>
-        <p>
+<p>
          Here is an example of ACLs based on client addresses:
        </p>
-
 <pre class="programlisting">
 // Set up an ACL named "bogusnets" that will block
 // RFC1918 space and some reserved space, which is
@@ -107,33 +104,32 @@ zone "example.com" {
  allow-query { any; };
 };
 </pre>
-
-        <p>
+<p>
          This allows authoritative queries for "example.com" from any
          address, but recursive queries only from the networks specified
          in "our-nets", and no queries at all from the networks
          specified in "bogusnets".
        </p>
-        <p>
+<p>
          In addition to network addresses and prefixes, which are
          matched against the source address of the DNS request, ACLs
          may include <code class="option">key</code> elements, which specify the
          name of a TSIG or SIG(0) key.
        </p>
-        <p>
+<p>
          When <acronym class="acronym">BIND</acronym> 9 is built with GeoIP support,
          ACLs can also be used for geographic access restrictions.
          This is done by specifying an ACL element of the form:
          <span class="command"><strong>geoip [<span class="optional">db <em class="replaceable"><code>database</code></em></span>] <em class="replaceable"><code>field</code></em> <em class="replaceable"><code>value</code></em></strong></span>
        </p>
-        <p>
+<p>
          The <em class="replaceable"><code>field</code></em> indicates which field
          to search for a match.  Available fields are "country",
          "region", "city", "continent", "postal" (postal code),
          "metro" (metro code), "area" (area code), "tz" (timezone),
          "isp", "asnum", and "domain".
        </p>
-        <p>
+<p>
          <em class="replaceable"><code>value</code></em> is the value to search
          for within the database.  A string may be quoted if it
          contains spaces or other special characters.  An "asnum"
@@ -148,7 +144,7 @@ zone "example.com" {
          abbreviation; otherwise it treated as the full name of the
          state or province.
        </p>
-        <p>
+<p>
          The <em class="replaceable"><code>database</code></em> field indicates which
          GeoIP database to search for a match.  In most cases this is
          unnecessary, because most search fields can only be found in
@@ -163,10 +159,10 @@ zone "example.com" {
          is installed, in that order. Valid database names are
          "country", "city", "asnum", "isp", and "domain".
        </p>
-        <p>
+<p>
          Some example GeoIP ACLs:
        </p>
-        <pre class="programlisting">geoip country US;
+<pre class="programlisting">geoip country US;
 geoip country JP;
 geoip db country country Canada;
 geoip region WA;
@@ -176,8 +172,7 @@ geoip postal 95062;
 geoip tz "America/Los_Angeles";
 geoip org "Internet Systems Consortium";
 </pre>
-
-        <p>
+<p>
          ACLs use a "first-match" logic rather than "best-match":
          if an address prefix matches an ACL element, then that ACL
          is considered to have matched even if a later element would
@@ -187,7 +182,7 @@ geoip org "Internet Systems Consortium";
          indicated that the query should be accepted, and the second
          element is ignored.
        </p>
-        <p>
+<p>
          When using "nested" ACLs (that is, ACLs included or referenced
          within other ACLs), a negative match of a nested ACL will
          the containing ACL to continue looking for matches.  This
@@ -197,10 +192,10 @@ geoip org "Internet Systems Consortium";
          it originates from a particular network <span class="emphasis"><em>and</em></span>
          only when it is signed with a particular key, use:
        </p>
-        <pre class="programlisting">
+<pre class="programlisting">
 allow-query { !{ !10/8; any; }; key example; };
 </pre>
-        <p>
+<p>
          Within the nested ACL, any address that is
          <span class="emphasis"><em>not</em></span> in the 10/8 network prefix will
          be rejected, and this will terminate processing of the
@@ -212,14 +207,12 @@ allow-query { !{ !10/8; any; }; key example; };
          will only matches when <span class="emphasis"><em>both</em></span> conditions
          are true.
        </p>
-      </div>
-
-      <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="chroot_and_setuid"></a><span class="command"><strong>Chroot</strong></span> and <span class="command"><strong>Setuid</strong></span>
 </h2></div></div></div>
-
-        <p>
+<p>
          On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym>
          in a <span class="emphasis"><em>chrooted</em></span> environment (using
          the <span class="command"><strong>chroot()</strong></span> function) by specifying
@@ -228,25 +221,23 @@ allow-query { !{ !10/8; any; }; key example; };
          <acronym class="acronym">BIND</acronym> in a "sandbox", which will limit
          the damage done if a server is compromised.
        </p>
-        <p>
+<p>
          Another useful feature in the UNIX version of <acronym class="acronym">BIND</acronym> is the
          ability to run the daemon as an unprivileged user ( <code class="option">-u</code> <em class="replaceable"><code>user</code></em> ).
          We suggest running as an unprivileged user when using the <span class="command"><strong>chroot</strong></span> feature.
        </p>
-        <p>
+<p>
          Here is an example command line to load <acronym class="acronym">BIND</acronym> in a <span class="command"><strong>chroot</strong></span> sandbox,
          <span class="command"><strong>/var/named</strong></span>, and to run <span class="command"><strong>named</strong></span> <span class="command"><strong>setuid</strong></span> to
          user 202:
        </p>
-        <p>
+<p>
          <strong class="userinput"><code>/usr/local/sbin/named -u 202 -t /var/named</code></strong>
        </p>
-
-        <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="chroot"></a>The <span class="command"><strong>chroot</strong></span> Environment</h3></div></div></div>
-
-          <p>
+<p>
            In order for a <span class="command"><strong>chroot</strong></span> environment
            to work properly in a particular directory (for example,
            <code class="filename">/var/named</code>), you will need to set
@@ -258,7 +249,7 @@ allow-query { !{ !10/8; any; }; key example; };
            options like <span class="command"><strong>directory</strong></span> and
            <span class="command"><strong>pid-file</strong></span> to account for this.
          </p>
-          <p>
+<p>
            Unlike with earlier versions of BIND, you typically will
            <span class="emphasis"><em>not</em></span> need to compile <span class="command"><strong>named</strong></span>
            statically nor install shared libraries under the new root.
@@ -269,13 +260,11 @@ allow-query { !{ !10/8; any; }; key example; };
            <code class="filename">/dev/log</code>, and
            <code class="filename">/etc/localtime</code>.
          </p>
-        </div>
-
-        <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="setuid"></a>Using the <span class="command"><strong>setuid</strong></span> Function</h3></div></div></div>
-
-          <p>
+<p>
            Prior to running the <span class="command"><strong>named</strong></span> daemon,
            use
            the <span class="command"><strong>touch</strong></span> utility (to change file
@@ -286,7 +275,7 @@ allow-query { !{ !10/8; any; }; key example; };
            to which you want <acronym class="acronym">BIND</acronym>
            to write.
          </p>
-          <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
+<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Note</h3>
 <p>
            If the <span class="command"><strong>named</strong></span> daemon is running as an
@@ -294,14 +283,12 @@ allow-query { !{ !10/8; any; }; key example; };
            ports if the server is reloaded.
          </p>
 </div>
-        </div>
-      </div>
-
-      <div class="section">
+</div>
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="dynamic_update_security"></a>Dynamic Update Security</h2></div></div></div>
-
-        <p>
+<p>
          Access to the dynamic
          update facility should be strictly limited.  In earlier versions of
          <acronym class="acronym">BIND</acronym>, the only way to do this was
@@ -321,8 +308,7 @@ allow-query { !{ !10/8; any; }; key example; };
          forward it to the master with its own source IP address causing the
          master to approve it without question.
        </p>
-
-        <p>
+<p>
          For these reasons, we strongly recommend that updates be
          cryptographically authenticated by means of transaction signatures
          (TSIG).  That is, the <span class="command"><strong>allow-update</strong></span>
@@ -331,8 +317,7 @@ allow-query { !{ !10/8; any; }; key example; };
          prefixes. Alternatively, the new <span class="command"><strong>update-policy</strong></span>
          option can be used.
        </p>
-
-        <p>
+<p>
          Some sites choose to keep all dynamically-updated DNS data
          in a subdomain and delegate that subdomain to a separate zone. This
          way, the top-level zone containing critical data such as the IP
@@ -340,9 +325,8 @@ allow-query { !{ !10/8; any; }; key example; };
          of public web and mail servers need not allow dynamic update at
          all.
        </p>
-
-      </div>
-    </div>
+</div>
+</div>
 <div class="navfooter">
 <hr>
 <table width="100%" summary="Navigation footer">
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Chapter 7. Troubleshooting</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch06.html" title="Chapter 6. BIND 9 Security Considerations">
@@ -45,28 +45,24 @@
 <dt><span class="section"><a href="Bv9ARM.ch07.html#more_help">Where Can I Get Help?</a></span></dt>
 </dl>
 </div>
-
-      <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="common_problems"></a>Common Problems</h2></div></div></div>
-
-        <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="id-1.8.2.2"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div>
-
-          <p>
+<p>
            The best solution to solving installation and
            configuration issues is to take preventative measures by setting
            up logging files beforehand. The log files provide a
            source of hints and information that can be used to figure out
            what went wrong and how to fix the problem.
          </p>
-        </div>
-
-        <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="id-1.8.2.3"></a>EDNS compliance issues</h3></div></div></div>
-          <p>
+<p>
            EDNS (Extended DNS) is a standard that was first specified
            in 1999. It is required for DNSSEC validation, DNS COOKIE
            options, and other features. There are broken and outdated
@@ -77,7 +73,7 @@
            situation, retrying queries in different ways and eventually
            falling back to plain DNS queries without EDNS.
          </p>
-          <p>
+<p>
            Such workarounds cause unnecessary resolution delays,
            increase code complexity, and prevent deployment of new DNS
            features. As of February 2019, all major DNS software vendors
@@ -86,7 +82,7 @@
            for further details. This change was implemented in BIND
            as of release 9.14.0.
          </p>
-          <p>
+<p>
            As a result, some domains may be non-resolvable without manual
            intervention.  In these cases, resolution can be restored by
            adding <span class="command"><strong>server</strong></span> clauses for the offending
@@ -94,33 +90,32 @@
            <span class="command"><strong>send-cookie no</strong></span>, depending on the specific
            noncompliance.
          </p>
-          <p>
+<p>
            To determine which <span class="command"><strong>server</strong></span> clause to use,
            run the following commands to send queries to the authoritative
            servers for the broken domain:
          </p>
-  <div class="literallayout"><p><br>
+<div class="literallayout"><p><br>
             dig soa &lt;zone&gt; @&lt;server&gt; +dnssec<br>
             dig soa &lt;zone&gt; @&lt;server&gt; +dnssec +nocookie<br>
             dig soa &lt;zone&gt; @&lt;server&gt; +noedns<br>
   </p></div>
-          <p>
+<p>
            If the first command fails but the second succeeds, the
            server most likely needs <span class="command"><strong>send-cookie no</strong></span>.
            If the first two fail but the third succeeds, then the server
            needs EDNS to be fully disabled with <span class="command"><strong>edns no</strong></span>.
          </p>
-          <p>
+<p>
            Please contact the administrators of noncompliant domains
            and encourage them to upgrade their broken DNS servers.
          </p>
-        </div>
-      </div>
-      <div class="section">
+</div>
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="id-1.8.3"></a>Incrementing and Changing the Serial Number</h2></div></div></div>
-
-        <p>
+<p>
          Zone serial numbers are just numbers &#8212; they aren't
          date related.  A lot of people set them to a number that
          represents a date, usually of the form YYYYMMDDRR.
@@ -132,26 +127,22 @@
          lower than the serial number on the master, the slave
          server will attempt to update its copy of the zone.
        </p>
-
-        <p>
+<p>
          Setting the serial number to a lower number on the master
          server than the slave server means that the slave will not perform
          updates to its copy of the zone.
        </p>
-
-        <p>
+<p>
          The solution to this is to add 2147483647 (2^31-1) to the
          number, reload the zone and make sure all slaves have updated to
          the new zone serial number, then reset the number to what you want
          it to be, and reload the zone again.
        </p>
-
-      </div>
-      <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="more_help"></a>Where Can I Get Help?</h2></div></div></div>
-
-        <p>
+<p>
          The Internet Systems Consortium
          (<acronym class="acronym">ISC</acronym>) offers a wide range
          of support and service agreements for <acronym class="acronym">BIND</acronym> and <acronym class="acronym">DHCP</acronym> servers. Four
@@ -164,16 +155,15 @@
          fix announcements to remote support. It also includes training in
          <acronym class="acronym">BIND</acronym> and <acronym class="acronym">DHCP</acronym>.
        </p>
-
-        <p>
+<p>
          To discuss arrangements for support, contact
          <a class="link" href="mailto:info@isc.org" target="_top">info@isc.org</a> or visit the
          <acronym class="acronym">ISC</acronym> web page at
          <a class="link" href="http://www.isc.org/services/support/" target="_top">http://www.isc.org/services/support/</a>
          to read more.
        </p>
-      </div>
-    </div>
+</div>
+</div>
 <div class="navfooter">
 <hr>
 <table width="100%" summary="Navigation footer">
@@ -109,6 +109,89 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes-9.17.0"></a>Notes for BIND 9.17.0</h3></div></div></div>

+  <div class="section">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.17.0-known"></a>Known Issues</h4></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+        <p>
+          UDP network ports used for listening can no longer simultaneously be
+          used for sending traffic.  An example configuration which triggers
+          this issue would be one which uses the same
+          <em class="replaceable"><code>address:port</code></em> pair for
+          <span class="command"><strong>listen-on(-v6)</strong></span> statements as for
+          <span class="command"><strong>notify-source(-v6)</strong></span> or
+          <span class="command"><strong>transfer-source(-v6)</strong></span>.  While this issue affects all
+          operating systems, it only triggers log messages (e.g. "unable to
+          create dispatch for reserved port") on some of them.  There are
+          currently no plans to make such a combination of settings work again.
+        </p>
+      </li></ul></div>
+  </div>
+
+  <div class="section">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.17.0-new"></a>New Features</h4></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+        <p>
+          When a secondary server receives a large incremental zone
+          transfer (IXFR), it can have a negative impact on query
+          performance while the incremental changes are applied to
+          the zone. To address this, <span class="command"><strong>named</strong></span> can now
+          limit the size of IXFR responses it sends in response to zone
+          transfer requests. If an IXFR response would be larger than an
+          AXFR of the entire zone, it will send an AXFR response instead.
+        </p>
+        <p>
+          This behavior is controlled by the <span class="command"><strong>max-ixfr-ratio</strong></span>
+          option - a percentage value representing the ratio of IXFR size
+          to the size of a full zone transfer. The default is
+          <code class="literal">100%</code>. [GL #1515]
+        </p>
+      </li></ul></div>
+  </div>
+
+  <div class="section">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.17.0-changes"></a>Feature Changes</h4></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+        <p>
+          The system-provided POSIX Threads read-write lock implementation is
+          now used by default instead of the native BIND 9 implementation.
+          Please be aware that glibc versions 2.26 through 2.29 had a
+          <a class="link" href="https://sourceware.org/bugzilla/show_bug.cgi?id=23844" target="_top">bug</a>
+          that could cause BIND 9 to deadlock. A fix was released in glibc 2.30,
+          and most current Linux distributions have patched or updated glibc,
+          with the notable exception of Ubuntu 18.04 (Bionic) which is a work in
+          progress. If you are running on an affected operating system, compile
+          BIND 9 with <span class="command"><strong>--disable-pthread-rwlock</strong></span> until a fixed
+          version of glibc is available. [GL !3125]
+        </p>
+      </li>
+<li class="listitem">
+        <p>
+          The <span class="command"><strong>rndc nta -dump</strong></span> and
+          <span class="command"><strong>rndc secroots</strong></span> commands now both include
+          <span class="command"><strong>validate-except</strong></span> entries when listing negative
+          trust anchors. These are indicated by the keyword
+          <code class="literal">permanent</code> in place of the expiry
+          date. [GL #1532]
+        </p>
+      </li>
+</ul></div>
+  </div>
+
+  <div class="section">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.17.0-bugs"></a>Bug Fixes</h4></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+        <p>
+          Fixed re-signing issues with inline zones which resulted in
+          records being re-signed late or not at all.
+        </p>
+      </li></ul></div>
+  </div>
+
 </div>

  <div class="section">
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Appendix B. A Brief History of the DNS and BIND</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch08.html" title="Appendix A. Release Notes">
@@ -35,7 +35,7 @@
 <div class="titlepage"><div><div><h1 class="title">
 <a name="Bv9ARM.ch09"></a>A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym>
 </h1></div></div></div>
-      <p><a name="historical_dns_information"></a>
+<p><a name="historical_dns_information"></a>
        Although the "official" beginning of the Domain Name
        System occurred in 1984 with the publication of RFC 920, the
        core of the new system was described in 1983 in RFCs 882 and
@@ -50,8 +50,7 @@
        became the standards upon which all <acronym class="acronym">DNS</acronym> implementations are
        built.
      </p>
-
-      <p>
+<p>
        The first working domain name server, called "Jeeves", was
        written in 1983-84 by Paul Mockapetris for operation on DEC
        Tops-20
@@ -69,7 +68,7 @@
        Administration
        (DARPA).
      </p>
-      <p>
+<p>
        Versions of <acronym class="acronym">BIND</acronym> through
        4.8.3 were maintained by the Computer
        Systems Research Group (CSRG) at UC Berkeley. Douglas Terry, Mark
@@ -84,7 +83,7 @@
        Mike Muuss, Jim Bloom and Mike Schwartz. <acronym class="acronym">BIND</acronym> maintenance was subsequently
        handled by Mike Karels and Øivind Kure.
      </p>
-      <p>
+<p>
        <acronym class="acronym">BIND</acronym> versions 4.9 and 4.9.1 were
        released by Digital Equipment
        Corporation (now Compaq Computer Corporation). Paul Vixie, then
@@ -96,41 +95,41 @@
        Baran, Anant Kumar, Art Harkin, Win Treese, Don Lewis, Christophe
        Wolfhugel, and others.
      </p>
-      <p>
+<p>
        In 1994, <acronym class="acronym">BIND</acronym> version 4.9.2 was sponsored by
        Vixie Enterprises. Paul
        Vixie became <acronym class="acronym">BIND</acronym>'s principal
        architect/programmer.
      </p>
-      <p>
+<p>
        <acronym class="acronym">BIND</acronym> versions from 4.9.3 onward
        have been developed and maintained
        by the Internet Systems Consortium and its predecessor,
        the Internet Software Consortium,  with support being provided
        by ISC's sponsors.
      </p>
-      <p>
+<p>
        As co-architects/programmers, Bob Halley and
        Paul Vixie released the first production-ready version of
        <acronym class="acronym">BIND</acronym> version 8 in May 1997.
      </p>
-      <p>
+<p>
        BIND version 9 was released in September 2000 and is a
        major rewrite of nearly all aspects of the underlying
        BIND architecture.
      </p>
-      <p>
+<p>
        BIND versions 4 and 8 are officially deprecated.
        No additional development is done
        on BIND version 4 or BIND version 8.
      </p>
-      <p>
+<p>
        <acronym class="acronym">BIND</acronym> development work is made
        possible today by the sponsorship
        of several corporations, and by the tireless work efforts of
        numerous individuals.
      </p>
-    </div>
+</div>
 <div class="navfooter">
 <hr>
 <table width="100%" summary="Navigation footer">
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Appendix D. BIND 9 DNS Library Support</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch10.html" title="Appendix C. General DNS Reference Information">
@@ -46,11 +46,10 @@
 </dl></dd>
 </dl>
 </div>
-      <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="bind9.library"></a>BIND 9 DNS Library Support</h2></div></div></div>
-  
-  <p>
+<p>
    This version of BIND 9 "exports" its internal libraries so
    that they can be used by third-party applications more easily (we
    call them "export" libraries in this document). Certain library
@@ -59,32 +58,27 @@
    the calling program initializes the libraries by calling
    <span class="command"><strong>isc_lib_register()</strong></span>.
  </p>
-  <p>
+<p>
    In addition to DNS-related APIs that are used within BIND 9, the
    libraries provide the following features:
  </p>
-  <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem">
-      <p>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>
 	The "DNS client" module. This is a higher level API that
 	provides an interface to name resolution, single DNS transaction
 	with a particular server, and dynamic update. Regarding name
 	resolution, it supports advanced features such as DNSSEC validation
 	and caching. This module supports both synchronous and asynchronous
 	mode.
-      </p>
-    </li>
-<li class="listitem">
-      <p>
+      </p></li>
+<li class="listitem"><p>
 	The "IRS" (Information Retrieval System) library.  It provides an
 	interface to parse the traditional <code class="filename">resolv.conf</code>
 	file and more advanced, DNS-specific configuration file for the
 	rest of this package (see the description for the
 	<code class="filename">dns.conf</code> file below).
-      </p>
-    </li>
-<li class="listitem">
-      <p>
+      </p></li>
+<li class="listitem"><p>
 	As part of the IRS library, the standard address-name
 	mapping functions, <span class="command"><strong>getaddrinfo()</strong></span> and
 	<span class="command"><strong>getnameinfo()</strong></span>, are provided. They use the
@@ -93,38 +87,33 @@
 	<span class="command"><strong>getaddrinfo()</strong></span> function resolves both A
 	and AAAA RRs concurrently when the address family is
 	unspecified.
-      </p>
-    </li>
-<li class="listitem">
-      <p>
+      </p></li>
+<li class="listitem"><p>
 	An experimental framework to support other event
 	libraries than BIND 9's internal event task system.
-      </p>
-    </li>
+      </p></li>
 </ul></div>
-  <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="id-1.12.2.5"></a>Installation</h3></div></div></div>
-    
-    <pre class="screen">
+<pre class="screen">
 $ <strong class="userinput"><code>make install</code></strong>
    </pre>
-    <p>
+<p>
      Normal installation of BIND will also install library object
      and header files.  Root privilege is normally required.
    </p>
-    <p>
+<p>
      To see how to build your own application after the installation, see
      <code class="filename">lib/samples/Makefile-postinstall.in</code>.
    </p>
-  </div>
-  <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="id-1.12.2.6"></a>Known Defects/Restrictions</h3></div></div></div>
-    
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem">
-        <p>
+<p>
 	The "fixed" RRset order is not (currently) supported in the export
 	library. If you want to use "fixed" RRset order for, e.g.
 	<span class="command"><strong>named</strong></span> while still building the export library
@@ -139,30 +128,25 @@ $ <strong class="userinput"><code>make</code></strong>
 </pre>
 <p>
      </p>
-      </li>
-<li class="listitem">
-        <p>
+</li>
+<li class="listitem"><p>
 	RFC 5011 is not supported in the validating stub resolver of the
 	export library. In fact, it is not clear whether it should: trust
 	anchors would be a system-wide configuration which would be managed
 	by an administrator, while the stub resolver will be used by
 	ordinary applications run by a normal user.
-      </p>
-      </li>
-<li class="listitem">
-        <p>
+      </p></li>
+<li class="listitem"><p>
 	Not all common <code class="filename">/etc/resolv.conf</code> options are
 	supported in the IRS library. The only available options in this
 	version are <span class="command"><strong>debug</strong></span> and <span class="command"><strong>ndots</strong></span>.
-      </p>
-      </li>
+      </p></li>
 </ul></div>
-  </div>
-  <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="id-1.12.2.7"></a>The dns.conf File</h3></div></div></div>
-    
-    <p>
+<p>
      The IRS library supports an "advanced" configuration file related to
      the DNS library for configuration parameters that would be beyond the
      capability of the <code class="filename">resolv.conf</code> file.
@@ -180,42 +164,38 @@ $ <strong class="userinput"><code>make</code></strong>
      with <span class="command"><strong>initial-key</strong></span> or <span class="command"><strong>iniital-ds</strong></span>.
      (See <a class="xref" href="Bv9ARM.ch05.html#managed-keys" title="managed-keys Statement Grammar">the section called &#8220;<span class="command"><strong>managed-keys</strong></span> Statement Grammar&#8221;</a> for syntax details.)
    </p>
-  </div>
-  <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="id-1.12.2.8"></a>Sample Applications</h3></div></div></div>
-    
-    <p>
+<p>
      Some sample application programs using this API are provided for
      reference. The following is a brief description of these
      applications.
    </p>
-    <div class="section">
+<div class="section">
 <div class="titlepage"><div><div><h4 class="title">
 <a name="id-1.12.2.8.3"></a>sample: a simple stub resolver utility</h4></div></div></div>
-      
-      <p>
+<p>
 	Sends a query of a given name (of a given optional RR type) to a
 	specified recursive server and prints the result as a list of RRs.
 	It can also act as a validating stub resolver if a trust anchor is
 	given via a set of command line options.
      </p>
-      <p>
+<p>
 	Usage: sample [options] server_address hostname
      </p>
-      <p>
+<p>
 	Options and Arguments:
      </p>
-      <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-t RRtype</span></dt>
-<dd>
-            <p>
+<dd><p>
 	      specify the RR type of the query.  The default is the A RR.
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">[-a algorithm] [-e] -k keyname -K keystring</span></dt>
 <dd>
-            <p>
+<p>
 	      specify a command-line DNS key to validate the answer.  For
 	      example, to specify the following DNSKEY of example.com:
 	      </p>
@@ -233,43 +213,36 @@ $ <strong class="userinput"><code>make</code></strong>
 	      as "secure entry point").
 	      When -a is omitted rsasha1 will be used by default.
 	    </p>
-          </dd>
+</dd>
 <dt><span class="term">-s domain:alt_server_address</span></dt>
-<dd>
-            <p>
+<dd><p>
 	       specify a separate recursive server address for the specific
 	       "domain".  Example: -s example.com:2001:db8::1234
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">server_address</span></dt>
-<dd>
-            <p>
+<dd><p>
 	      an IP(v4/v6) address of the recursive server to which queries
 	      are sent.
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">hostname</span></dt>
-<dd>
-            <p>
+<dd><p>
 	      the domain name for the query
-	</p>
-          </dd>
+	</p></dd>
 </dl></div>
-    </div>
-    <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h4 class="title">
 <a name="id-1.12.2.8.4"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
-      
-      <p>
+<p>
      Similar to "sample", but accepts a list
      of (query) domain names as a separate file and resolves the names
      asynchronously.</p>
-      <p>
+<p>
 	Usage: sample-async [-s server_address] [-t RR_type] input_file</p>
-      <p>
+<p>
     Options and Arguments:
      </p>
-      <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-s server_address</span></dt>
 <dd>
       an IPv4 address of the recursive server to which queries are sent.
@@ -289,14 +262,13 @@ $ <strong class="userinput"><code>make</code></strong>
       mx.example.net<br>
       ns.xxx.example<br>
       </p></div>
-	  </dd>
+</dd>
 </dl></div>
-    </div>
-    <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h4 class="title">
 <a name="id-1.12.2.8.5"></a>sample-request: a simple DNS transaction client</h4></div></div></div>
-      
-      <p>
+<p>
 	Sends a query to a specified server, and prints the response with
 	minimal processing. It doesn't act as a "stub resolver": it stops
 	the processing once it gets any response from the server, whether
@@ -304,39 +276,32 @@ $ <strong class="userinput"><code>make</code></strong>
 	further queries to get the ultimate answer. In other words, this
 	utility acts as a very simplified <span class="command"><strong>dig</strong></span>.
      </p>
-      <p>
+<p>
 	Usage: sample-request [-t RRtype] server_address hostname
      </p>
-      <p>
+<p>
 	Options and Arguments:
      </p>
-      <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-t RRtype</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      specify the RR type of the queries. The default is the A RR.
-            </p>
-          </dd>
+            </p></dd>
 <dt><span class="term">server_address</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      an IP(v4/v6) address of the recursive server to which
 	      the query is sent.
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">hostname</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      the domain name for the query
-	    </p>
-          </dd>
+	    </p></dd>
 </dl></div>
-    </div>
-    <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h4 class="title">
 <a name="id-1.12.2.8.6"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
-      
-      <p>
+<p>
 	This is a test program to check <span class="command"><strong>getaddrinfo()</strong></span> and
 	<span class="command"><strong>getnameinfo()</strong></span> behavior. It takes a host name as an
 	argument, calls <span class="command"><strong>getaddrinfo()</strong></span> with the given host
@@ -348,153 +313,130 @@ $ <strong class="userinput"><code>make</code></strong>
 	will fail with an EAI_INSECUREDATA error when DNSSEC validation
 	fails.
      </p>
-      <p>
+<p>
 	Usage: sample-gai hostname
      </p>
-    </div>
-    <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h4 class="title">
 <a name="id-1.12.2.8.7"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
-      
-      <p>
+<p>
 	Accepts a single update command as a command-line argument, sends
 	an update request message to the authoritative server, and shows
 	the response from the server. In other words, this is a simplified
 	<span class="command"><strong>nsupdate</strong></span>.
      </p>
-      <p>
+<p>
 	Usage: sample-update [options] (add|delete) "update data"
      </p>
-      <p>
+<p>
 	Options and Arguments:
      </p>
-      <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a auth_server</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      An IP address of the authoritative server that has authority
 	      for the zone containing the update name.  This should
 	      normally be the primary authoritative server that accepts
 	      dynamic updates.  It can also be a secondary server that is
 	      configured to forward update requests to the primary server.
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">-k keyfile</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      A TSIG key file to secure the update transaction.  The
 	      keyfile format is the same as that for the nsupdate utility.
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">-p prerequisite</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      A prerequisite for the update (only one prerequisite can be
 	      specified).  The prerequisite format is the same as that is
 	      accepted by the nsupdate utility.
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">-r recursive_server</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      An IP address of a recursive server that this utility will
 	      use.  A recursive server may be necessary to identify the
 	      authoritative server address to which the update request is
 	      sent.
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">-z zonename</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      The domain name of the zone that contains
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">(add|delete)</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Specify the type of update operation.  Either "add" or
 	      "delete" must be specified.
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">"update data"</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Specify the data to be updated.  A typical example of the
 	      data would look like "name TTL RRtype RDATA".
-	    </p>
-          </dd>
+	    </p></dd>
 </dl></div>
-      <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
+<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Note</h3>
-	<p>
+<p>
 	  In practice, either -a or -r must be specified.  Others can be
 	  optional; the underlying library routine tries to identify the
 	  appropriate server and the zone name for the update.
 	</p>
-      </div>
-      <p>
+</div>
+<p>
 	Examples: assuming the primary authoritative server of the
 	dynamic.example.com zone has an IPv6 address 2001:db8::1234,
      </p>
-      <pre class="screen">
+<pre class="screen">
 $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mmmm.key add "foo.dynamic.example.com 30 IN A 192.168.2.1"</code></strong></pre>
-      <p>
+<p>
 	adds an A RR for foo.dynamic.example.com using the given key.
      </p>
-      <pre class="screen">
+<pre class="screen">
 $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com 30 IN A"</code></strong></pre>
-      <p>
+<p>
 	removes all A RRs for foo.dynamic.example.com using the given key.
      </p>
-      <pre class="screen">
+<pre class="screen">
 $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com"</code></strong></pre>
-      <p>
+<p>
 	removes all RRs for foo.dynamic.example.com using the given key.
      </p>
-    </div>
-    <div class="section">
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h4 class="title">
 <a name="id-1.12.2.8.8"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
-      
-      <p>
+<p>
 	Checks a set of domains to see the name servers of the domains
 	behave correctly in terms of RFC 4074. This is included in the set
 	of sample programs to show how the export library can be used in a
 	DNS-related application.
      </p>
-      <p>
+<p>
 	Usage: nsprobe [-d] [-v [-v...]] [-c cache_address] [input_file]
      </p>
-      <p>
+<p>
 	Options
      </p>
-      <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-d</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Run in "debug" mode.  With this option nsprobe will dump
 	      every RRs it receives.
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">-v</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Increase verbosity of other normal log messages.  This can be
 	      specified multiple times.
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">-c cache_address</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Specify an IP address of a recursive (caching) name server.
 	      nsprobe uses this server to get the NS RRset of each domain
 	      and the A and/or AAAA RRsets for the name servers.  The
 	      default value is 127.0.0.1.
-	    </p>
-          </dd>
+	    </p></dd>
 <dt><span class="term">input_file</span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      A file name containing a list of domain (zone) names to be
 	      probed.  when omitted the standard input will be used.  Each
 	      line of the input file specifies a single domain name such as
@@ -504,23 +446,21 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 	      for the given domain name, and sends A and AAAA queries to
 	      these servers for some "widely used" names under the zone;
 	      specifically, adding "www" and "ftp" to the zone name.
-	    </p>
-          </dd>
+	    </p></dd>
 </dl></div>
-    </div>
-  </div>
-  <div class="section">
+</div>
+</div>
+<div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="id-1.12.2.9"></a>Library References</h3></div></div></div>
-    
-    <p>
+<p>
      As of this writing, there is no formal "manual" for the libraries,
      except this document, header files (some of which provide pretty
      detailed explanations), and sample application programs.
    </p>
-  </div>
 </div>
-    </div>
+</div>
+</div>
 <div class="navfooter">
 <hr>
 <table width="100%" summary="Navigation footer">
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Manual pages</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch11.html" title="Appendix D. BIND 9 DNS Library Support">
@@ -154,44 +154,7 @@
 </dt>
 </dl>
 </div>
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-      
-    </div>
+</div>
 <div class="navfooter">
 <hr>
 <table width="100%" summary="Navigation footer">
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>BIND 9 Administrator Reference Manual</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="next" href="Bv9ARM.ch01.html" title="Chapter 1. Introduction">
 </head>
@@ -398,32 +398,7 @@
 </dl></dd>
 </dl>
 </div>
-  
-
-  
-
-  
-
-  
-
-  
-
-  
-    
-
-    
-
-    
-
-    
-
-    
-
-    
-
-    
-
-  </div>
+</div>
 <div class="navfooter">
 <hr>
 <table width="100%" summary="Navigation footer">
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>arpaname</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.ch12.html" title="Manual pages">
 <link rel="prev" href="Bv9ARM.ch12.html" title="Manual pages">
@@ -32,45 +32,27 @@
 </div>
 <div class="refentry">
 <a name="man.arpaname"></a><div class="titlepage"></div>
-  
-  
-  
-
-  <div class="refnamediv">
+<div class="refnamediv">
 <h2>Name</h2>
-<p>
-    <span class="application">arpaname</span>
-     &#8212; translate IP addresses to the corresponding ARPA names
-  </p>
+<p><span class="application">arpaname</span> &#8212; translate IP addresses to the corresponding ARPA names</p>
 </div>
-
-  
-
-  <div class="refsynopsisdiv">
+<div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">arpaname</code> 
-       {<em class="replaceable"><code>ipaddress </code></em>...}
-    </p></div>
-  </div>
-
-  <div class="refsection">
+<div class="cmdsynopsis"><p><code class="command">arpaname</code>  {<em class="replaceable"><code>ipaddress </code></em>...}</p></div>
+</div>
+<div class="refsection">
 <a name="id-1.13.2.7"></a><h2>DESCRIPTION</h2>
-
-    <p>
+<p>
      <span class="command"><strong>arpaname</strong></span> translates IP addresses (IPv4 and
      IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.
    </p>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.2.8"></a><h2>SEE ALSO</h2>
-
-    <p>
+<p>
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
-  </div>
-
+</div>
 </div>
 <div class="navfooter">
 <hr>
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>ddns-confgen</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.ch12.html" title="Manual pages">
 <link rel="prev" href="man.arpaname.html" title="arpaname">
@@ -32,62 +32,31 @@
 </div>
 <div class="refentry">
 <a name="man.ddns-confgen"></a><div class="titlepage"></div>
-  
-  
-
-  
-
-  <div class="refnamediv">
+<div class="refnamediv">
 <h2>Name</h2>
-<p>
-    <span class="application">ddns-confgen</span>
-     &#8212; ddns key generation tool
-  </p>
+<p><span class="application">ddns-confgen</span> &#8212; ddns key generation tool</p>
 </div>
-
-  
-
-  <div class="refsynopsisdiv">
+<div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">tsig-keygen</code> 
-       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
-       [<code class="option">-h</code>]
-       [name]
-    </p></div>
-    <div class="cmdsynopsis"><p>
-      <code class="command">ddns-confgen</code> 
-       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
-       [<code class="option">-h</code>]
-       [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>]
-       [<code class="option">-q</code>]
-       [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>]
-       [
-         -s <em class="replaceable"><code>name</code></em> 
-         |   -z <em class="replaceable"><code>zone</code></em> 
-      ]
-    </p></div>
-  </div>
-
-  <div class="refsection">
+<div class="cmdsynopsis"><p><code class="command">tsig-keygen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-h</code>] [name]</p></div>
+<div class="cmdsynopsis"><p><code class="command">ddns-confgen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-q</code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [ -s <em class="replaceable"><code>name</code></em>  |   -z <em class="replaceable"><code>zone</code></em> ]</p></div>
+</div>
+<div class="refsection">
 <a name="id-1.13.3.7"></a><h2>DESCRIPTION</h2>
-
-    <p>
+<p>
      <span class="command"><strong>tsig-keygen</strong></span> and <span class="command"><strong>ddns-confgen</strong></span>
      are invocation methods for a utility that generates keys for use
      in TSIG signing.  The resulting keys can be used, for example,
      to secure dynamic DNS updates to a zone or for the
      <span class="command"><strong>rndc</strong></span> command channel.
    </p>
-
-    <p>
+<p>
      When run as <span class="command"><strong>tsig-keygen</strong></span>, a domain name
      can be specified on the command line which will be used as
      the name of the generated key.  If no name is specified,
      the default is <code class="constant">tsig-key</code>.
    </p>
-
-    <p>
+<p>
      When run as <span class="command"><strong>ddns-confgen</strong></span>, the generated
      key is accompanied by configuration text and instructions
      that can be used with <span class="command"><strong>nsupdate</strong></span> and
@@ -97,8 +66,7 @@
      <span class="command"><strong>rndc-confgen</strong></span> command for setting
      up command channel security.)
    </p>
-
-    <p>
+<p>
      Note that <span class="command"><strong>named</strong></span> itself can configure a
      local DDNS key for use with <span class="command"><strong>nsupdate -l</strong></span>:
      it does this when a zone is configured with
@@ -108,32 +76,24 @@
      if <span class="command"><strong>nsupdate</strong></span> is to be used from a remote
      system.
    </p>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.3.8"></a><h2>OPTIONS</h2>
-
-
-    <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
            Options are case-insensitive, and the "hmac-" prefix
            may be omitted.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-h</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Prints a short summary of options and arguments.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-k <em class="replaceable"><code>keyname</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Specifies the key name of the DDNS authentication key.
 	    The default is <code class="constant">ddns-key</code> when neither
 	    the <code class="option">-s</code> nor <code class="option">-z</code> option is
@@ -143,19 +103,15 @@
 	    <code class="constant">ddns-key.example.com.</code>
 	    The key name must have the format of a valid domain name,
 	    consisting of letters, digits, hyphens and periods.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-q</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    (<span class="command"><strong>ddns-confgen</strong></span> only.) Quiet mode:  Print
            only the key, with no explanatory text or usage examples;
            This is essentially identical to <span class="command"><strong>tsig-keygen</strong></span>.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-s <em class="replaceable"><code>name</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
            (<span class="command"><strong>ddns-confgen</strong></span> only.)
 	    Generate configuration example to allow dynamic updates
            of a single hostname.  The example <span class="command"><strong>named.conf</strong></span>
@@ -166,11 +122,9 @@
 	    Note that the "self" nametype cannot be used, since
 	    the name to be updated may differ from the key name.
 	    This option cannot be used with the <code class="option">-z</code> option.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-z <em class="replaceable"><code>zone</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
            (<span class="command"><strong>ddns-confgen</strong></span> only.)
 	    Generate configuration example to allow dynamic updates
            of a zone:  The example <span class="command"><strong>named.conf</strong></span> text
@@ -180,27 +134,17 @@
            all subdomain names within that
            <em class="replaceable"><code>zone</code></em>.
 	    This option cannot be used with the <code class="option">-s</code> option.
-	  </p>
-	</dd>
+	  </p></dd>
 </dl></div>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.3.9"></a><h2>SEE ALSO</h2>
-
-    <p><span class="citerefentry">
-	<span class="refentrytitle">nsupdate</span>(1)
-      </span>,
-      <span class="citerefentry">
-	<span class="refentrytitle">named.conf</span>(5)
-      </span>,
-      <span class="citerefentry">
-	<span class="refentrytitle">named</span>(8)
-      </span>,
+<p><span class="citerefentry"><span class="refentrytitle">nsupdate</span>(1)</span>,
+      <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
+      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
-  </div>
-
+</div>
 </div>
 <div class="navfooter">
 <hr>
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>delv</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.ch12.html" title="Manual pages">
 <link rel="prev" href="man.ddns-confgen.html" title="ddns-confgen">
@@ -32,72 +32,25 @@
 </div>
 <div class="refentry">
 <a name="man.delv"></a><div class="titlepage"></div>
-  
-  
-
-  
-
-  <div class="refnamediv">
+<div class="refnamediv">
 <h2>Name</h2>
-<p>
-    delv
-     &#8212; DNS lookup and validation utility
-  </p>
+<p>delv &#8212; DNS lookup and validation utility</p>
 </div>
-
-  
-
-  <div class="refsynopsisdiv">
+<div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">delv</code> 
-       [@server]
-       [
-	[<code class="option">-4</code>]
-	 |  [<code class="option">-6</code>]
-      ]
-       [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>]
-       [<code class="option">-b <em class="replaceable"><code>address</code></em></code>]
-       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
-       [<code class="option">-d <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-i</code>]
-       [<code class="option">-m</code>]
-       [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>]
-       [<code class="option">-q <em class="replaceable"><code>name</code></em></code>]
-       [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
-       [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>]
-       [name]
-       [type]
-       [class]
-       [queryopt...]
-    </p></div>
-
-    <div class="cmdsynopsis"><p>
-      <code class="command">delv</code> 
-       [<code class="option">-h</code>]
-    </p></div>
-
-    <div class="cmdsynopsis"><p>
-      <code class="command">delv</code> 
-       [<code class="option">-v</code>]
-    </p></div>
-
-    <div class="cmdsynopsis"><p>
-      <code class="command">delv</code> 
-       [queryopt...]
-       [query...]
-    </p></div>
-  </div>
-
-  <div class="refsection">
+<div class="cmdsynopsis"><p><code class="command">delv</code>  [@server] [[<code class="option">-4</code>] |  [<code class="option">-6</code>]] [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>level</code></em></code>] [<code class="option">-i</code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [name] [type] [class] [queryopt...]</p></div>
+<div class="cmdsynopsis"><p><code class="command">delv</code>  [<code class="option">-h</code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">delv</code>  [<code class="option">-v</code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">delv</code>  [queryopt...] [query...]</p></div>
+</div>
+<div class="refsection">
 <a name="id-1.13.4.7"></a><h2>DESCRIPTION</h2>
-
-    <p><span class="command"><strong>delv</strong></span>
+<p><span class="command"><strong>delv</strong></span>
      is a tool for sending
      DNS queries and validating the results, using the same internal
      resolver and validator logic as <span class="command"><strong>named</strong></span>.
    </p>
-    <p>
+<p>
      <span class="command"><strong>delv</strong></span> will send to a specified name server all
      queries needed to fetch and validate the requested data; this
      includes the original requested query, subsequent queries to follow
@@ -107,7 +60,7 @@
      behavior of a name server configured for DNSSEC validating and
      forwarding.
    </p>
-    <p>
+<p>
      By default, responses are validated using built-in DNSSEC trust
      anchor for the root zone (".").  Records returned by
      <span class="command"><strong>delv</strong></span> are either fully validated or
@@ -118,7 +71,7 @@
      be used to check the validity of DNS responses in environments
      where local name servers may not be trustworthy.
    </p>
-    <p>
+<p>
      Unless it is told to query a specific name server,
      <span class="command"><strong>delv</strong></span> will try each of the servers listed in
      <code class="filename">/etc/resolv.conf</code>. If no usable server
@@ -126,18 +79,15 @@
      queries to the localhost addresses (127.0.0.1 for IPv4, ::1
      for IPv6).
    </p>
-    <p>
+<p>
      When no command line arguments or options are given,
      <span class="command"><strong>delv</strong></span> will perform an NS query for "."
      (the root zone).
    </p>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.4.8"></a><h2>SIMPLE USAGE</h2>
-
-
-    <p>
+<p>
      A typical invocation of <span class="command"><strong>delv</strong></span> looks like:
      </p>
 <pre class="programlisting"> delv @server name type </pre>
@@ -148,7 +98,7 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="constant">server</code></span></dt>
 <dd>
-	    <p>
+<p>
 	      is the name or IP address of the name server to query.  This
 	      can be an IPv4 address in dotted-decimal notation or an IPv6
 	      address in colon-delimited notation.  When the supplied
@@ -158,7 +108,7 @@
 	      initial lookup is <span class="emphasis"><em>not</em></span> validated
 	      by DNSSEC).
 	    </p>
-	    <p>
+<p>
 	      If no <em class="parameter"><code>server</code></em> argument is
 	      provided, <span class="command"><strong>delv</strong></span> consults
 	      <code class="filename">/etc/resolv.conf</code>; if an
@@ -171,16 +121,13 @@
 	      the localhost addresses (127.0.0.1 for IPv4,
 	      ::1 for IPv6).
 	    </p>
-	  </dd>
+</dd>
 <dt><span class="term"><code class="constant">name</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      is the domain name to be looked up.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="constant">type</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      indicates what type of query is required &#8212;
 	      ANY, A, MX, etc.
 	      <em class="parameter"><code>type</code></em> can be any valid query
@@ -188,32 +135,28 @@
 	      <em class="parameter"><code>type</code></em> argument is supplied,
 	      <span class="command"><strong>delv</strong></span> will perform a lookup for an
 	      A record.
-	    </p>
-	  </dd>
+	    </p></dd>
 </dl></div>
 <p>
    </p>
-
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.4.9"></a><h2>OPTIONS</h2>
-
-    <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
 <dd>
-	  <p>
+<p>
 	    Specifies a file from which to read DNSSEC trust anchors.
 	    The default is <code class="filename">/etc/bind.keys</code>, which
 	    is included with <acronym class="acronym">BIND</acronym> 9 and contains
 	    one or more trust anchors for the root zone (".").
 	  </p>
-	  <p>
+<p>
 	    Keys that do not match the root zone name are ignored.
            An alternate key name can be specified using the
 	    <code class="option">+root=NAME</code> options.
 	  </p>
-	  <p>
+<p>
 	    Note: When reading the trust anchor file,
 	    <span class="command"><strong>delv</strong></span> treats <code class="option">trust-anchors</code>
 	    <code class="option">initial-key</code> and <code class="option">static-key</code>
@@ -230,28 +173,23 @@
 	    <code class="filename">/etc/bind.keys</code> to use DNSSEC
 	    validation in <span class="command"><strong>delv</strong></span>.
 	  </p>
-	</dd>
+</dd>
 <dt><span class="term">-b  <em class="replaceable"><code>address</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Sets the source IP address of the query to
 	    <em class="parameter"><code>address</code></em>.  This must be a valid address
 	    on one of the host's network interfaces or "0.0.0.0" or "::".
 	    An optional source port may be specified by appending
 	    "#&lt;port&gt;"
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Sets the query class for the requested data. Currently,
 	    only class "IN" is supported in <span class="command"><strong>delv</strong></span>
 	    and any other value is ignored.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-d <em class="replaceable"><code>level</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Set the systemwide debug level to <code class="option">level</code>.
 	    The allowed range is from 0 to 99.
 	    The default is 0 (no debugging).
@@ -260,17 +198,13 @@
 	    See the <code class="option">+mtrace</code>, <code class="option">+rtrace</code>,
 	    and <code class="option">+vtrace</code> options below for additional
 	    debugging details.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-h</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Display the <span class="command"><strong>delv</strong></span> help usage output and exit.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-i</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Insecure mode. This disables internal DNSSEC validation.
 	    (Note, however, this does not set the CD bit on upstream
 	    queries. If the server being queried is performing DNSSEC
@@ -278,37 +212,30 @@
 	    can cause <span class="command"><strong>delv</strong></span> to time out. When it
 	    is necessary to examine invalid data to debug a DNSSEC
 	    problem, use <span class="command"><strong>dig +cd</strong></span>.)
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-m</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Enables memory usage debugging.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-p <em class="replaceable"><code>port#</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Specifies a destination port to use for queries instead of
 	    the standard DNS port number 53.  This option would be used
 	    with a name server that has been configured to listen
 	    for queries on a non-standard port number.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-q <em class="replaceable"><code>name</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Sets the query name to <em class="parameter"><code>name</code></em>.
 	    While the query name can be specified without using the
 	    <code class="option">-q</code>, it is sometimes necessary to disambiguate
 	    names from types or classes (for example, when looking up the
 	    name "ns", which could be misinterpreted as the type NS,
 	    or "ch", which could be misinterpreted as class CH).
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
-	  <p>
+<p>
 	    Sets the query type to <em class="parameter"><code>type</code></em>, which
 	    can be any valid query type supported in BIND 9 except
 	    for zone transfer types AXFR and IXFR. As with
@@ -316,21 +243,18 @@
 	    query name type or class when they are ambiguous.
 	    it is sometimes necessary to disambiguate names from types.
 	  </p>
-	  <p>
+<p>
 	    The default query type is "A", unless the <code class="option">-x</code>
 	    option is supplied to indicate a reverse lookup, in which case
 	    it is "PTR".
 	  </p>
-	</dd>
+</dd>
 <dt><span class="term">-v</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Print the <span class="command"><strong>delv</strong></span> version and exit.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-x <em class="replaceable"><code>addr</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Performs a reverse lookup, mapping an addresses to
 	    a name.  <em class="parameter"><code>addr</code></em> is an IPv4 address in
 	    dotted-decimal notation, or a colon-delimited IPv6 address.
@@ -340,33 +264,24 @@
 	    lookup for a name like <code class="literal">11.12.13.10.in-addr.arpa</code>
 	    and sets the query type to PTR.  IPv6 addresses are looked up
 	    using nibble format under the IP6.ARPA domain.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-4</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Forces <span class="command"><strong>delv</strong></span> to only use IPv4.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-6</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Forces <span class="command"><strong>delv</strong></span> to only use IPv6.
-	  </p>
-	</dd>
+	  </p></dd>
 </dl></div>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.4.10"></a><h2>QUERY OPTIONS</h2>
-
-
-    <p><span class="command"><strong>delv</strong></span>
+<p><span class="command"><strong>delv</strong></span>
      provides a number of query options which affect the way results are
      displayed, and in some cases the way lookups are performed.
    </p>
-
-    <p>
+<p>
      Each query option is identified by a keyword preceded by a plus sign
      (<code class="literal">+</code>).  Some keywords set or reset an
      option.  These may be preceded by the string
@@ -378,8 +293,7 @@
      </p>
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="option">+[no]cdflag</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Controls whether to set the CD (checking disabled) bit in
 	      queries sent by <span class="command"><strong>delv</strong></span>. This may be useful
 	      when troubleshooting DNSSEC problems from behind a validating
@@ -388,25 +302,20 @@
 	      the CD flag on queries will cause the resolver to return
 	      invalid responses, which <span class="command"><strong>delv</strong></span> can then
 	      validate internally and report the errors in detail.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]class</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Controls whether to display the CLASS when printing
 	      a record. The default is to display the CLASS.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]ttl</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Controls whether to display the TTL when printing
 	      a record. The default is to display the TTL.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]rtrace</code></span></dt>
 <dd>
-	    <p>
+<p>
 	      Toggle resolver fetch logging. This reports the
 	      name and type of each query sent by <span class="command"><strong>delv</strong></span>
 	      in the process of carrying out the resolution and validation
@@ -414,69 +323,62 @@
 	      all subsequent queries to follow CNAMEs and to establish a
 	      chain of trust for DNSSEC validation.
 	    </p>
-	    <p>
+<p>
 	      This is equivalent to setting the debug level to 1 in
 	      the "resolver" logging category. Setting the systemwide
 	      debug level to 1 using the <code class="option">-d</code> option will
 	      product the same output (but will affect other logging
 	      categories as well).
 	    </p>
-	  </dd>
+</dd>
 <dt><span class="term"><code class="option">+[no]mtrace</code></span></dt>
 <dd>
-	    <p>
+<p>
 	      Toggle message logging. This produces a detailed dump of
 	      the responses received by <span class="command"><strong>delv</strong></span> in the
 	      process of carrying out the resolution and validation process.
 	    </p>
-	    <p>
+<p>
 	      This is equivalent to setting the debug level to 10
 	      for the "packets" module of the "resolver" logging
 	      category. Setting the systemwide debug level to 10 using
 	      the <code class="option">-d</code> option will produce the same output
 	      (but will affect other logging categories as well).
 	    </p>
-	  </dd>
+</dd>
 <dt><span class="term"><code class="option">+[no]vtrace</code></span></dt>
 <dd>
-	    <p>
+<p>
 	      Toggle validation logging. This shows the internal
 	      process of the validator as it determines whether an
 	      answer is validly signed, unsigned, or invalid.
 	    </p>
-	    <p>
+<p>
 	      This is equivalent to setting the debug level to 3
 	      for the "validator" module of the "dnssec" logging
 	      category. Setting the systemwide debug level to 3 using
 	      the <code class="option">-d</code> option will produce the same output
 	      (but will affect other logging categories as well).
 	    </p>
-	  </dd>
+</dd>
 <dt><span class="term"><code class="option">+[no]short</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Provide a terse answer.  The default is to print the answer in a
 	      verbose form.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]comments</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Toggle the display of comment lines in the output.  The default
 	      is to print comments.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]rrcomments</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Toggle the display of per-record comments in the output (for
 	      example, human-readable key information about DNSKEY records).
 	      The default is to print per-record comments.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]crypto</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Toggle the display of cryptographic fields in DNSSEC records.
 	      The contents of these field are unnecessary to debug most DNSSEC
 	      validation failures and removing them makes it easier to see
@@ -484,18 +386,14 @@
 	      When omitted they are replaced by the string "[omitted]" or
 	      in the DNSKEY case the key id is displayed as the replacement,
 	      e.g. "[ key id = value ]".
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]trust</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Controls whether to display the trust level when printing
 	      a record. The default is to display the trust level.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]split[=W]</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Split long hex- or base64-formatted fields in resource
 	      records into chunks of <em class="parameter"><code>W</code></em> characters
 	      (where <em class="parameter"><code>W</code></em> is rounded up to the nearest
@@ -504,30 +402,24 @@
 	      <em class="parameter"><code>+split=0</code></em> causes fields not to be
 	      split at all.  The default is 56 characters, or 44 characters
 	      when multiline mode is active.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]all</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Set or clear the display options
 	      <code class="option">+[no]comments</code>,
 	      <code class="option">+[no]rrcomments</code>, and
 	      <code class="option">+[no]trust</code> as a group.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]multiline</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Print long records (such as RRSIG, DNSKEY, and SOA records)
 	      in a verbose multi-line format with human-readable comments.
 	      The default is to print each record on a single line, to
 	      facilitate machine parsing of the <span class="command"><strong>delv</strong></span>
 	      output.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]dnssec</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Indicates whether to display RRSIG records in the
 	      <span class="command"><strong>delv</strong></span> output.  The default is to
 	      do so.  Note that (unlike in <span class="command"><strong>dig</strong></span>)
@@ -536,11 +428,9 @@
 	      DNSSEC records are always requested, and validation
 	      will always occur unless suppressed by the use of
 	      <code class="option">-i</code> or <code class="option">+noroot</code>.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]root[=ROOT]</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Indicates whether to perform conventional
 	      DNSSEC validation, and if so, specifies the
 	      name of a trust anchor.  The default is to validate using
@@ -548,60 +438,44 @@
 	      a built-in key.  If specifying a different trust anchor,
 	      then <code class="option">-a</code> must be used to specify a file
 	      containing the key.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Controls whether to use TCP when sending queries.
 	      The default is to use UDP unless a truncated
 	      response has been received.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]unknownformat</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Print all RDATA in unknown RR type presentation format
 	      (RFC 3597). The default is to print RDATA for known types
 	      in the type's presentation format.
-	    </p>
-	  </dd>
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]yaml</code></span></dt>
-<dd>
-	    <p>
+<dd><p>
 	      Print response data in YAML format.
-	    </p>
-	  </dd>
+	    </p></dd>
 </dl></div>
 <p>

    </p>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.4.11"></a><h2>FILES</h2>
-
-    <p><code class="filename">/etc/bind.keys</code></p>
-    <p><code class="filename">/etc/resolv.conf</code></p>
-  </div>
-
-  <div class="refsection">
+<p><code class="filename">/etc/bind.keys</code></p>
+<p><code class="filename">/etc/resolv.conf</code></p>
+</div>
+<div class="refsection">
 <a name="id-1.13.4.12"></a><h2>SEE ALSO</h2>
-
-    <p><span class="citerefentry">
-	<span class="refentrytitle">dig</span>(1)
-      </span>,
-      <span class="citerefentry">
-	<span class="refentrytitle">named</span>(8)
-      </span>,
+<p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
+      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <em class="citetitle">RFC4034</em>,
      <em class="citetitle">RFC4035</em>,
      <em class="citetitle">RFC4431</em>,
      <em class="citetitle">RFC5074</em>,
      <em class="citetitle">RFC5155</em>.
    </p>
-  </div>
-
+</div>
 </div>
 <div class="navfooter">
 <hr>
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-cds</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.ch12.html" title="Manual pages">
 <link rel="prev" href="man.dig.html" title="dig">
@@ -32,44 +32,17 @@
 </div>
 <div class="refentry">
 <a name="man.dnssec-cds"></a><div class="titlepage"></div>
-  
-  
-
-  
-
-  <div class="refnamediv">
+<div class="refnamediv">
 <h2>Name</h2>
-<p>
-    <span class="application">dnssec-cds</span>
-     &#8212; change DS records for a child zone based on CDS/CDNSKEY
-  </p>
+<p><span class="application">dnssec-cds</span> &#8212; change DS records for a child zone based on CDS/CDNSKEY</p>
 </div>
-
-  
-
-  <div class="refsynopsisdiv">
+<div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-cds</code> 
-       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>...]
-       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
-       [<code class="option">-D</code>]
-       {<code class="option">-d <em class="replaceable"><code>dsset-file</code></em></code>}
-       {<code class="option">-f <em class="replaceable"><code>child-file</code></em></code>}
-       [<code class="option">-i</code> [<em class="replaceable"><code>extension</code></em>]]
-       [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>]
-       [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>]
-       [<code class="option">-u</code>]
-       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-V</code>]
-       {domain}
-    </p></div>
-  </div>
-
-  <div class="refsection">
+<div class="cmdsynopsis"><p><code class="command">dnssec-cds</code>  [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>...] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D</code>] {<code class="option">-d <em class="replaceable"><code>dsset-file</code></em></code>} {<code class="option">-f <em class="replaceable"><code>child-file</code></em></code>} [<code class="option">-i</code> [<em class="replaceable"><code>extension</code></em>]] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] {domain}</p></div>
+</div>
+<div class="refsection">
 <a name="id-1.13.6.7"></a><h2>DESCRIPTION</h2>
-
-    <p>
+<p>
      The <span class="command"><strong>dnssec-cds</strong></span> command changes DS records at
      a delegation point based on CDS or CDNSKEY records published in
      the child zone. If both CDS and CDNSKEY records are present in
@@ -79,7 +52,7 @@
      parent can keep the DS records up to date and enable automatic
      rolling of KSKs.
    </p>
-    <p>
+<p>
      Two input files are required.  The
      <code class="option">-f <em class="replaceable"><code>child-file</code></em></code>
      option specifies a file containing the child's CDS and/or CDNSKEY
@@ -92,27 +65,27 @@
      <span class="command"><strong>dnssec-dsfromkey</strong></span>, or the output of a previous
      run of <span class="command"><strong>dnssec-cds</strong></span>.
    </p>
-    <p>
+<p>
      The <span class="command"><strong>dnssec-cds</strong></span> command uses special DNSSEC
      validation logic specified by RFC 7344. It requires that the CDS
      and/or CDNSKEY records are validly signed by a key represented in the
      existing DS records. This will typically be the pre-existing
      key-signing key (KSK).
    </p>
-    <p>
+<p>
      For protection against replay attacks, the signatures on the
      child records must not be older than they were on a previous run
      of <span class="command"><strong>dnssec-cds</strong></span>. This time is obtained from the
      modification time of the <code class="filename">dsset-</code> file, or
      from the <code class="option">-s</code> option.
    </p>
-    <p>
+<p>
      To protect against breaking the delegation,
      <span class="command"><strong>dnssec-cds</strong></span> ensures that the DNSKEY RRset can be
      verified by every key algorithm in the new DS RRset, and that the
      same set of keys are covered by every DS digest type.
    </p>
-    <p>
+<p>
      By default, replacement DS records are written to the standard
      output; with the <code class="option">-i</code> option the input file is
      overwritten in place. The replacement DS records will be the
@@ -120,56 +93,49 @@
      output can be empty if the CDS / CDNSKEY records specify that
      the child zone wants to go insecure.
    </p>
-    <p>
+<p>
      Warning: Be careful not to delete the DS records
      when <span class="command"><strong>dnssec-cds</strong></span> fails!
    </p>
-    <p>
+<p>
      Alternatively, <span class="command"><strong>dnssec-cds -u</strong></span> writes
      an <span class="command"><strong>nsupdate</strong></span> script to the standard output.
      You can use the <code class="option">-u</code> and <code class="option">-i</code>
      options together to maintain a <code class="filename">dsset-</code> file
      as well as emit an <span class="command"><strong>nsupdate</strong></span> script.
    </p>
-
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.6.8"></a><h2>OPTIONS</h2>
-
-    <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
-          <p>
+<p>
 	    Specify a digest algorithm to use when converting CDNSKEY
 	    records to DS records. This option can be repeated, so
 	    that multiple DS records are created for each CDNSKEY
 	    record. This option has no effect when using CDS records.
          </p>
-          <p>
+<p>
 	    The <em class="replaceable"><code>algorithm</code></em> must be one of
 	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
 	    and the hyphen may be omitted.  If no algorithm is specified,
 	    the default is SHA-256.
          </p>
-        </dd>
+</dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd>
-          <p>
+<dd><p>
            Specifies the DNS class of the zones.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term">-D</span></dt>
-<dd>
-          <p>
+<dd><p>
 	    Generate DS records from CDNSKEY records if both CDS and
 	    CDNSKEY records are present in the child zone. By default
 	    CDS records are preferred.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term">-d <em class="replaceable"><code>path</code></em></span></dt>
 <dd>
-          <p>
+<p>
            Location of the parent DS records.
 	    The <em class="replaceable"><code>path</code></em> can be the name of a file
 	    containing the DS records, or if it is a
@@ -177,31 +143,31 @@
 	    a <code class="filename">dsset-</code> file for
 	    the <em class="replaceable"><code>domain</code></em> inside the directory.
          </p>
-          <p>
+<p>
            To protect against replay attacks, child records are
            rejected if they were signed earlier than the modification
            time of the <code class="filename">dsset-</code> file. This can be
            adjusted with the <code class="option">-s</code> option.
          </p>
-        </dd>
+</dd>
 <dt><span class="term">-f <em class="replaceable"><code>child-file</code></em></span></dt>
 <dd>
-          <p>
+<p>
 	    File containing the child's CDS and/or CDNSKEY records,
 	    plus its DNSKEY records and the covering RRSIG records so
 	    that they can be authenticated.
          </p>
-	  <p>
+<p>
 	    The EXAMPLES below describe how to generate this file.
 	  </p>
-        </dd>
+</dd>
 <dt><span class="term">-i[<em class="replaceable"><code>extension</code></em>]</span></dt>
 <dd>
-          <p>
+<p>
            Update the <code class="filename">dsset-</code> file in place,
            instead of writing DS records to the standard output.
          </p>
-	  <p>
+<p>
 	    There must be no space between the <code class="option">-i</code> and
 	    the <em class="replaceable"><code>extension</code></em>. If you provide
 	    no <em class="replaceable"><code>extension</code></em> then the
@@ -211,17 +177,17 @@
 	    with the <em class="replaceable"><code>extension</code></em> appended to
 	    its filename.
 	  </p>
-          <p>
+<p>
            To protect against replay attacks, the modification time
            of the <code class="filename">dsset-</code> file is set to match
            the signature inception time of the child records,
            provided that is later than the file's current
            modification time.
          </p>
-        </dd>
+</dd>
 <dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
 <dd>
-          <p>
+<p>
            Specify the date and time after which RRSIG records become
            acceptable. This can be either an absolute or relative
            time. An absolute start time is indicated by a number in
@@ -231,82 +197,69 @@
            which is N seconds before the file modification time. A
            time relative to the current time is indicated with now+N.
 	  </p>
-	  <p>
+<p>
            If no <em class="replaceable"><code>start-time</code></em> is specified, the
            modification time of the <code class="filename">dsset-</code> file
            is used.
          </p>
-        </dd>
+</dd>
 <dt><span class="term">-T <em class="replaceable"><code>ttl</code></em></span></dt>
-<dd>
-          <p>
+<dd><p>
            Specifies a TTL to be used for new DS records. If not
            specified, the default is the TTL of the old DS records.
            If they had no explicit TTL then the new DS records also
            have no explicit TTL.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term">-u</span></dt>
 <dd>
-          <p>
+<p>
 	    Write an <span class="command"><strong>nsupdate</strong></span> script to the
 	    standard output, instead of printing the new DS reords.
 	    The output will be empty if no change is needed.
          </p>
-	  <p>
+<p>
 	    Note: The TTL of new records needs to be specified, either
 	    in the original <code class="filename">dsset-</code> file, or with
 	    the <code class="option">-T</code> option, or using
 	    the <span class="command"><strong>nsupdate</strong></span> <span class="command"><strong>ttl</strong></span>
 	    command.
 	  </p>
-        </dd>
+</dd>
 <dt><span class="term">-V</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Print version information.
-	  </p>
-        </dd>
+	  </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd>
-          <p>
+<dd><p>
            Sets the debugging level. Level 1 is intended to be
            usefully verbose for general users; higher levels are
            intended for developers.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term"><em class="replaceable"><code>domain</code></em></span></dt>
-<dd>
-          <p>
+<dd><p>
            The name of the delegation point / child zone apex.
-          </p>
-        </dd>
+          </p></dd>
 </dl></div>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.6.9"></a><h2>EXIT STATUS</h2>
-
-    <p>
+<p>
      The <span class="command"><strong>dnssec-cds</strong></span> command exits 0 on success, or
      non-zero if an error occurred.
    </p>
-    <p>
+<p>
      In the success case, the DS records might or might not need
      to be changed.
    </p>
-
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.6.10"></a><h2>EXAMPLES</h2>
-
-    <p>
+<p>
      Before running <span class="command"><strong>dnssec-signzone</strong></span>, you can ensure
      that the delegations are up-to-date by running
      <span class="command"><strong>dnssec-cds</strong></span> on every <code class="filename">dsset-</code> file.
    </p>
-    <p>
+<p>
      To fetch the child records required by <span class="command"><strong>dnssec-cds</strong></span>
      you can invoke <span class="command"><strong>dig</strong></span> as in the script below.  It's
      okay if the <span class="command"><strong>dig</strong></span> fails since
@@ -319,8 +272,7 @@ do
 	dnssec-cds -i -f /dev/stdin -d $f $d
 done
 </pre>
-
-    <p>
+<p>
      When the parent zone is automatically signed by
      <span class="command"><strong>named</strong></span>, you can use <span class="command"><strong>dnssec-cds</strong></span>
      with <span class="command"><strong>nsupdate</strong></span> to maintain a delegation as follows.
@@ -333,30 +285,18 @@ dig +dnssec +noall +answer $d DNSKEY $d CDNSKEY $d CDS |
 dnssec-cds -u -i -f /dev/stdin -d $f $d |
 nsupdate -l
 </pre>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.6.11"></a><h2>SEE ALSO</h2>
-
-    <p>
-      <span class="citerefentry">
-        <span class="refentrytitle">dig</span>(1)
-      </span>,
-      <span class="citerefentry">
-        <span class="refentrytitle">dnssec-settime</span>(8)
-      </span>,
-      <span class="citerefentry">
-        <span class="refentrytitle">dnssec-signzone</span>(8)
-      </span>,
-      <span class="citerefentry">
-        <span class="refentrytitle">nsupdate</span>(1)
-      </span>,
+<p>
+      <span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
+      <span class="citerefentry"><span class="refentrytitle">dnssec-settime</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">nsupdate</span>(1)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 7344</em>.
    </p>
-
-  </div>
-
+</div>
 </div>
 <div class="navfooter">
 <hr>
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-checkds</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.ch12.html" title="Manual pages">
 <link rel="prev" href="man.dnssec-cds.html" title="dnssec-cds">
@@ -32,110 +32,70 @@
 </div>
 <div class="refentry">
 <a name="man.dnssec-checkds"></a><div class="titlepage"></div>
-  
-  
-
-  
-
-  <div class="refnamediv">
+<div class="refnamediv">
 <h2>Name</h2>
-<p>
-    <span class="application">dnssec-checkds</span>
-     &#8212; DNSSEC delegation consistency checking tool
-  </p>
+<p><span class="application">dnssec-checkds</span> &#8212; DNSSEC delegation consistency checking tool</p>
 </div>
-
-  
-
-  <div class="refsynopsisdiv">
+<div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-checkds</code> 
-       [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>]
-       [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
-       [<code class="option">-s <em class="replaceable"><code>file</code></em></code>]
-       {zone}
-    </p></div>
-  </div>
-
-  <div class="refsection">
+<div class="cmdsynopsis"><p><code class="command">dnssec-checkds</code>  [<code class="option">-d <em class="replaceable"><code>dig path</code></em></code>] [<code class="option">-D <em class="replaceable"><code>dsfromkey path</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s <em class="replaceable"><code>file</code></em></code>] {zone}</p></div>
+</div>
+<div class="refsection">
 <a name="id-1.13.7.7"></a><h2>DESCRIPTION</h2>
-
-    <p><span class="command"><strong>dnssec-checkds</strong></span>
+<p><span class="command"><strong>dnssec-checkds</strong></span>
      verifies the correctness of Delegation Signer (DS)
      resource records for keys in a specified zone.
    </p>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.7.8"></a><h2>OPTIONS</h2>
-
-    <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
-	  <p>
+<p>
 	    Specify a digest algorithm to use when converting the
 	    zone's DNSKEY records to expected DS records. This
 	    option can be repeated, so that multiple records are
 	    checked for each DNSKEY record.
          </p>
-          <p>
+<p>
            The <em class="replaceable"><code>algorithm</code></em> must be one of
            SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
            and the hyphen may be omitted.  If no algorithm is specified,
            the default is SHA-256.
 	  </p>
-	</dd>
+</dd>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
-<dd>
-          <p>
+<dd><p>
            If a <code class="option">file</code> is specified, then the zone is
            read from that file to find the DNSKEY records.  If not,
            then the DNSKEY records for the zone are looked up in the DNS.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term">-s <em class="replaceable"><code>file</code></em></span></dt>
-<dd>
-          <p>
+<dd><p>
            Specifies a prepared dsset file, such as would be generated
            by <span class="command"><strong>dnssec-signzone</strong></span>, to use as a source for
            the DS RRset instead of querying the parent.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term">-d <em class="replaceable"><code>dig path</code></em></span></dt>
-<dd>
-          <p>
+<dd><p>
            Specifies a path to a <span class="command"><strong>dig</strong></span> binary.  Used
            for testing.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term">-D <em class="replaceable"><code>dsfromkey path</code></em></span></dt>
-<dd>
-          <p>
+<dd><p>
            Specifies a path to a <span class="command"><strong>dnssec-dsfromkey</strong></span> binary.
            Used for testing.
-          </p>
-        </dd>
+          </p></dd>
 </dl></div>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.7.9"></a><h2>SEE ALSO</h2>
-
-    <p><span class="citerefentry">
-        <span class="refentrytitle">dnssec-dsfromkey</span>(8)
-      </span>,
-      <span class="citerefentry">
-        <span class="refentrytitle">dnssec-keygen</span>(8)
-      </span>,
-      <span class="citerefentry">
-        <span class="refentrytitle">dnssec-signzone</span>(8)
-      </span>,
+<p><span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
    </p>
-  </div>
-
+</div>
 </div>
 <div class="navfooter">
 <hr>
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-coverage</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.ch12.html" title="Manual pages">
 <link rel="prev" href="man.dnssec-checkds.html" title="dnssec-checkds">
@@ -32,47 +32,22 @@
 </div>
 <div class="refentry">
 <a name="man.dnssec-coverage"></a><div class="titlepage"></div>
-  
-  
-
-  
-
-  <div class="refnamediv">
+<div class="refnamediv">
 <h2>Name</h2>
-<p>
-    <span class="application">dnssec-coverage</span>
-     &#8212; checks future DNSKEY coverage for a zone
-  </p>
+<p><span class="application">dnssec-coverage</span> &#8212; checks future DNSKEY coverage for a zone</p>
 </div>
-
-  
-
-  <div class="refsynopsisdiv">
+<div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-coverage</code> 
-       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
-       [<code class="option">-l <em class="replaceable"><code>length</code></em></code>]
-       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
-       [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>]
-       [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>]
-       [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>]
-       [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>]
-       [<code class="option">-k</code>]
-       [<code class="option">-z</code>]
-       [zone...]
-    </p></div>
-  </div>
-
-  <div class="refsection">
+<div class="cmdsynopsis"><p><code class="command">dnssec-coverage</code>  [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>length</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>DNSKEY TTL</code></em></code>] [<code class="option">-m <em class="replaceable"><code>max TTL</code></em></code>] [<code class="option">-r <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-c <em class="replaceable"><code>compilezone path</code></em></code>] [<code class="option">-k</code>] [<code class="option">-z</code>] [zone...]</p></div>
+</div>
+<div class="refsection">
 <a name="id-1.13.8.7"></a><h2>DESCRIPTION</h2>
-
-    <p><span class="command"><strong>dnssec-coverage</strong></span>
+<p><span class="command"><strong>dnssec-coverage</strong></span>
      verifies that the DNSSEC keys for a given zone or a set of zones
      have timing metadata set properly to ensure no future lapses in DNSSEC
      coverage.
    </p>
-    <p>
+<p>
      If <code class="option">zone</code> is specified, then keys found in
      the key repository matching that zone are scanned, and an ordered
      list is generated of the events scheduled for that key (i.e.,
@@ -85,54 +60,47 @@
      key is rolled, and cached data signed by the prior key has not had
      time to expire from resolver caches.
    </p>
-    <p>
+<p>
      If <code class="option">zone</code> is not specified, then all keys in the
      key repository will be scanned, and all zones for which there are
      keys will be analyzed.  (Note: This method of reporting is only
      accurate if all the zones that have keys in a given repository
      share the same TTL parameters.)
    </p>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.8.8"></a><h2>OPTIONS</h2>
-
-
-    <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd>
-          <p>
+<dd><p>
            Sets the directory in which keys can be found.  Defaults to the
            current working directory.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
-<dd>
-          <p>
+<dd><p>
            If a <code class="option">file</code> is specified, then the zone is
            read from that file; the largest TTL and the DNSKEY TTL are
            determined directly from the zone data, and the
            <code class="option">-m</code> and <code class="option">-d</code> options do
            not need to be specified on the command line.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term">-l <em class="replaceable"><code>duration</code></em></span></dt>
 <dd>
-          <p>
+<p>
            The length of time to check for DNSSEC coverage.  Key events
            scheduled further into the future than <code class="option">duration</code>
            will be ignored, and assumed to be correct.
          </p>
-          <p>
+<p>
            The value of <code class="option">duration</code> can be set in seconds,
            or in larger units of time by adding a suffix: 'mi' for minutes,
            'h' for hours, 'd' for days, 'w' for weeks, 'mo' for months,
            'y' for years.
          </p>
-        </dd>
+</dd>
 <dt><span class="term">-m <em class="replaceable"><code>maximum TTL</code></em></span></dt>
 <dd>
-          <p>
+<p>
            Sets the value to be used as the maximum TTL for the zone or
            zones being analyzed when determining whether there is a
            possibility of validation failure.  When a zone-signing key is
@@ -141,26 +109,26 @@
            before that key can be purged from the DNSKEY RRset.  If that
            condition does not apply, a warning will be generated.
          </p>
-          <p>
+<p>
            The length of the TTL can be set in seconds, or in larger units
            of time by adding a suffix: 'mi' for minutes, 'h' for hours,
            'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
          </p>
-          <p>
+<p>
            This option is not necessary if the <code class="option">-f</code> has
            been used to specify a zone file.  If <code class="option">-f</code> has
            been specified, this option may still be used; it will override
            the value found in the file.
          </p>
-          <p>
+<p>
            If this option is not used and the maximum TTL cannot be retrieved
            from a zone file, a warning is generated and a default value of
            1 week is used.
          </p>
-        </dd>
+</dd>
 <dt><span class="term">-d <em class="replaceable"><code>DNSKEY TTL</code></em></span></dt>
 <dd>
-          <p>
+<p>
            Sets the value to be used as the DNSKEY TTL for the zone or
            zones being analyzed when determining whether there is a
            possibility of validation failure.  When a key is rolled (that
@@ -169,12 +137,12 @@
            the new key is activated and begins generating signatures.  If
            that condition does not apply, a warning will be generated.
          </p>
-          <p>
+<p>
            The length of the TTL can be set in seconds, or in larger units
            of time by adding a suffix: 'mi' for minutes, 'h' for hours,
            'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
          </p>
-          <p>
+<p>
            This option is not necessary if <code class="option">-f</code> has
            been used to specify a zone file from which the TTL
            of the DNSKEY RRset can be read, or if a default key TTL was
@@ -183,15 +151,15 @@
            this option may still be used; it will override the values
            found in the zone file or the key file.
          </p>
-          <p>
+<p>
            If this option is not used and the key TTL cannot be retrieved
            from the zone file or the key file, then a warning is generated
            and a default value of 1 day is used.
          </p>
-        </dd>
+</dd>
 <dt><span class="term">-r <em class="replaceable"><code>resign interval</code></em></span></dt>
 <dd>
-          <p>
+<p>
            Sets the value to be used as the resign interval for the zone
            or zones being analyzed when determining whether there is a
            possibility of validation failure.  This value defaults to
@@ -201,55 +169,38 @@
            <code class="filename">named.conf</code>, then it should also be
            changed here.
          </p>
-          <p>
+<p>
            The length of the interval can be set in seconds, or in larger
            units of time by adding a suffix: 'mi' for minutes, 'h' for hours,
            'd' for days, 'w' for weeks, 'mo' for months, 'y' for years.
          </p>
-        </dd>
+</dd>
 <dt><span class="term">-k</span></dt>
-<dd>
-          <p>
+<dd><p>
 	    Only check KSK coverage; ignore ZSK events. Cannot be
            used with <code class="option">-z</code>.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term">-z</span></dt>
-<dd>
-          <p>
+<dd><p>
 	    Only check ZSK coverage; ignore KSK events. Cannot be
            used with <code class="option">-k</code>.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term">-c <em class="replaceable"><code>compilezone path</code></em></span></dt>
-<dd>
-          <p>
+<dd><p>
            Specifies a path to a <span class="command"><strong>named-compilezone</strong></span> binary.
            Used for testing.
-          </p>
-        </dd>
+          </p></dd>
 </dl></div>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.8.9"></a><h2>SEE ALSO</h2>
-
-    <p>
-      <span class="citerefentry">
-        <span class="refentrytitle">dnssec-checkds</span>(8)
-      </span>,
-      <span class="citerefentry">
-        <span class="refentrytitle">dnssec-dsfromkey</span>(8)
-      </span>,
-      <span class="citerefentry">
-        <span class="refentrytitle">dnssec-keygen</span>(8)
-      </span>,
-      <span class="citerefentry">
-        <span class="refentrytitle">dnssec-signzone</span>(8)
-      </span>
+<p>
+      <span class="citerefentry"><span class="refentrytitle">dnssec-checkds</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">dnssec-dsfromkey</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>
    </p>
-  </div>
-
+</div>
 </div>
 <div class="navfooter">
 <hr>
@@ -10,7 +10,7 @@
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-dsfromkey</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.79.1">
 <link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.ch12.html" title="Manual pages">
 <link rel="prev" href="man.dnssec-coverage.html" title="dnssec-coverage">
@@ -32,145 +32,66 @@
 </div>
 <div class="refentry">
 <a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
-  
-  
-
-  
-
-  <div class="refnamediv">
+<div class="refnamediv">
 <h2>Name</h2>
-<p>
-    <span class="application">dnssec-dsfromkey</span>
-     &#8212; DNSSEC DS RR generation tool
-  </p>
+<p><span class="application">dnssec-dsfromkey</span> &#8212; DNSSEC DS RR generation tool</p>
 </div>
-
-  
-
-  <div class="refsynopsisdiv">
+<div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-dsfromkey</code> 
-       [
-	 <code class="option">-1</code> 
-	 |   <code class="option">-2</code> 
-	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
-      ]
-       [
-	 <code class="option">-C</code> 
-	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
-      ]
-       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
-       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
-       {keyfile}
-    </p></div>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-dsfromkey</code> 
-       [
-	 <code class="option">-1</code> 
-	 |   <code class="option">-2</code> 
-	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
-      ]
-       [
-	 <code class="option">-C</code> 
-	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
-      ]
-       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
-       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
-       [<code class="option">-A</code>]
-       {<code class="option">-f <em class="replaceable"><code>file</code></em></code>}
-       [dnsname]
-    </p></div>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-dsfromkey</code> 
-       [
-	 <code class="option">-1</code> 
-	 |   <code class="option">-2</code> 
-	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
-      ]
-       [
-	 <code class="option">-C</code> 
-	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
-      ]
-       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
-       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
-       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
-       {-s}
-       {dnsname}
-    </p></div>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-dsfromkey</code> 
-       [
-	 <code class="option">-h</code> 
-	 |   <code class="option">-V</code> 
-      ]
-    </p></div>
-  </div>
-
-  <div class="refsection">
+<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [ <code class="option">-1</code>  |   <code class="option">-2</code>  |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> ] [ <code class="option">-C</code>  |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> ] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] {keyfile}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [ <code class="option">-1</code>  |   <code class="option">-2</code>  |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> ] [ <code class="option">-C</code>  |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> ] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-A</code>] {<code class="option">-f <em class="replaceable"><code>file</code></em></code>} [dnsname]</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [ <code class="option">-1</code>  |   <code class="option">-2</code>  |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> ] [ <code class="option">-C</code>  |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> ] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] {-s} {dnsname}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [ <code class="option">-h</code>  |   <code class="option">-V</code> ]</p></div>
+</div>
+<div class="refsection">
 <a name="id-1.13.9.7"></a><h2>DESCRIPTION</h2>
-
-    <p>
+<p>
      The <span class="command"><strong>dnssec-dsfromkey</strong></span> command outputs DS (Delegation
      Signer) resource records (RRs), or CDS (Child DS) RRs with the
      <code class="option">-C</code> option.
    </p>
-
-    <p>
+<p>
      The input keys can be specified in a number of ways:
    </p>
-
-    <p>
+<p>
      By default, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads a key file
      named like <code class="filename">Knnnn.+aaa+iiiii.key</code>, as generated
      by <span class="command"><strong>dnssec-keygen</strong></span>.
    </p>
-
-    <p>
+<p>
      With the <code class="option">-f <em class="replaceable"><code>file</code></em></code>
      option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads keys from a zone file
      or partial zone file (which can contain just the DNSKEY records).
    </p>
-
-    <p>
+<p>
      With the <code class="option">-s</code>
      option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads
      a <code class="filename">keyset-</code> file, as generated
      by <span class="command"><strong>dnssec-keygen</strong></span> <code class="option">-C</code>.
    </p>
-
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.9.8"></a><h2>OPTIONS</h2>
-
-    <div class="variablelist"><dl class="variablelist">
+<div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-1</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    An abbreviation for <code class="option">-a SHA-1</code>.
 	    (Note: The SHA-1 algorithm is no longer recommended for use
 	    when generating new DS and CDS records.)
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-2</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    An abbreviation for <code class="option">-a SHA-256</code>.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
-	  <p>
+<p>
 	    Specify a digest algorithm to use when converting DNSKEY
 	    records to DS records. This option can be repeated, so
 	    that multiple DS records are created for each DNSKEY
 	    record.
          </p>
-          <p>
+<p>
 	    The <em class="replaceable"><code>algorithm</code></em> must be one of
 	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
 	    and the hyphen may be omitted.  If no algorithm is specified,
@@ -178,149 +99,117 @@
 	    (Note: The SHA-1 algorithm is no longer recommended for use
 	    when generating new DS and CDS records.)
 	  </p>
-	</dd>
+</dd>
 <dt><span class="term">-A</span></dt>
-<dd>
-          <p>
+<dd><p>
            Include ZSKs when generating DS records. Without this option, only
            keys which have the KSK flag set will be converted to DS records
            and printed. Useful only in <code class="option">-f</code> zone file mode.
-          </p>
-        </dd>
+          </p></dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Specifies the DNS class (default is IN). Useful only
 	    in <code class="option">-s</code> keyset or <code class="option">-f</code>
 	    zone file mode.
-	  </p>
-	  </dd>
+	  </p></dd>
 <dt><span class="term">-C</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Generate CDS records rather than DS records.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
 <dd>
-	  <p>
+<p>
 	    Zone file mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
 	    final <em class="replaceable"><code>dnsname</code></em> argument is
 	    the DNS domain name of a zone whose master file can be read
 	    from <code class="option">file</code>.  If the zone name is the same as
 	    <code class="option">file</code>, then it may be omitted.
 	  </p>
-	  <p>
+<p>
 	    If <em class="replaceable"><code>file</code></em> is <code class="literal">"-"</code>, then
 	    the zone data is read from the standard input.  This makes it
 	    possible to use the output of the <span class="command"><strong>dig</strong></span>
 	    command as input, as in:
 	  </p>
-	  <p>
+<p>
 	    <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
 	  </p>
-	</dd>
+</dd>
 <dt><span class="term">-h</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Prints usage information.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Look for key files or <code class="filename">keyset-</code> files in
 	    <code class="option">directory</code>.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-s</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Keyset mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
 	    final <em class="replaceable"><code>dnsname</code></em> argument is the DNS
 	    domain name used to locate a <code class="filename">keyset-</code> file.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Specifies the TTL of the DS records. By default the TTL is omitted.
-	  </p>
-	  </dd>
+	  </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Sets the debugging level.
-	  </p>
-	</dd>
+	  </p></dd>
 <dt><span class="term">-V</span></dt>
-<dd>
-	  <p>
+<dd><p>
 	    Prints version information.
-	  </p>
-	</dd>
+	  </p></dd>
 </dl></div>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.9.9"></a><h2>EXAMPLE</h2>
-
-    <p>
+<p>
      To build the SHA-256 DS RR from the
      <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
      keyfile name, you can issue the following command:
    </p>
-    <p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
+<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
    </p>
-    <p>
+<p>
      The command would print something like:
    </p>
-    <p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</code></strong>
+<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</code></strong>
    </p>
-
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.9.10"></a><h2>FILES</h2>
-
-    <p>
+<p>
      The keyfile can be designated by the key identification
      <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
      <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
      <span class="refentrytitle">dnssec-keygen</span>(8).
    </p>
-    <p>
+<p>
      The keyset file name is built from the <code class="option">directory</code>,
      the string <code class="filename">keyset-</code> and the
      <code class="option">dnsname</code>.
    </p>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.9.11"></a><h2>CAVEAT</h2>
-
-    <p>
+<p>
      A keyfile error can give a "file not found" even if the file exists.
    </p>
-  </div>
-
-  <div class="refsection">
+</div>
+<div class="refsection">
 <a name="id-1.13.9.12"></a><h2>SEE ALSO</h2>
-
-    <p><span class="citerefentry">
-	<span class="refentrytitle">dnssec-keygen</span>(8)
-      </span>,
-      <span class="citerefentry">
-	<span class="refentrytitle">dnssec-signzone</span>(8)
-      </span>,
+<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 3658</em> (DS RRs),
      <em class="citetitle">RFC 4509</em> (SHA-256 for DS RRs),
      <em class="citetitle">RFC 6605</em> (SHA-384 for DS RRs),
      <em class="citetitle">RFC 7344</em> (CDS and CDNSKEY RRs).
    </p>
-  </div>
-
+</div>
 </div>
 <div class="navfooter">
 <hr>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Evan Hunt	3ba34c4c49	log when initializing mutex and rwlock	2020-03-24 15:27:20 -07:00
Ondřej Surý	aed3927592	Merge branch 'ondrej/remove-debian-jessie-from-gitlab-ci' into 'master' Remove Debian 8 ("jessie") from the GitLab CI See merge request isc-projects/bind9!3281	2020-03-24 13:50:41 +00:00
Ondřej Surý	75f46cc3d1	Remove Debian 8 ("Jessie") from the GitLab CI There are several reason why remove Debian 8 from the CI: * Debian 8 ("jessie") has been superseded by Debian 9 ("stretch"). * Regular security support updates have been discontinued as of June 17th, 2018. * Jessie LTS is supported from 17th June 2018 to June 30, 2020. In other words, it's no longer officially supported by Debian security team, but by the volunteer/paid contributor composed LTS team. And the release will be discontinued in three months from now. We can use the freed CI resources to bring new platforms or just to make the jobs run a bit faster.	2020-03-24 14:24:47 +01:00
Michał Kępień	84a2ed67a1	Merge branch 'michal/update-release-checklist' into 'master' Update release checklist (BIND_BASELINE_VERSION) See merge request isc-projects/bind9!3278	2020-03-24 08:56:20 +00:00
Michał Kępień	b145071260	Update release checklist (BIND_BASELINE_VERSION) The reference BIND version used in the ABI check CI job is not determined automatically - it needs to be updated after each BIND release. Reflect that fact in the release checklist to make sure the ABI check CI job is always comparing current code with the latest BIND release on a given branch.	2020-03-24 07:36:24 +01:00
Mark Andrews	7da215f38b	Merge branch '1698-converting-isc_log-to-rwlock-broke-windows' into 'master' Resolve "Converting isc_log to RWLOCK broke Windows" Closes #1698 See merge request isc-projects/bind9!3276	2020-03-24 04:22:43 +00:00
Mark Andrews	b7dbfd14d8	Used to the correct unlock type (read)	2020-03-24 14:50:31 +11:00
Michal Nowak	2d74d88b47	Merge branch 'mnowak/abi-tracker-helper-v9.17.0' into 'master' Bump BIND baseline version for abi-check See merge request isc-projects/bind9!3202	2020-03-20 12:08:23 +00:00
Michal Nowak	3730d59bf9	Bump BIND baseline version for abi-check	2020-03-20 13:06:57 +01:00
Matthijs Mekking	5efc35f517	Merge branch 'v9_17_0-release' into 'master' Apply 9.17.0 release branch See merge request isc-projects/bind9!3262	2020-03-20 10:22:12 +00:00
Tinderbox UserandMatthijs Mekking	4b3b2e5dc7	Fix README related to --with-tuning	2020-03-20 10:51:32 +01:00
Tinderbox UserandMatthijs Mekking	a972cf4360	regen master	2020-03-20 10:51:32 +01:00
Tinderbox UserandMatthijs Mekking	50cf0e6ef8	Fix resonse typo in release notes	2020-03-20 10:51:32 +01:00
Tinderbox UserandMatthijs Mekking	e73565ae0a	regen master	2020-03-20 10:51:32 +01:00
Tinderbox UserandMatthijs Mekking	678b8d27d6	prep 9.17.0 The files configure.ac and version are already up to date. Updated CHANGES with 9.17.0 release line. Fixed CHANGES by adding GitLab reference to entry 5357 and fix grammar mistakes. Add missing /util/check-make-install.in to .gitattributes. The lib/*/api are already updated to match the new ranges. I listed two new features under BIND 9.17 features that to me seemed noteworthy. The release notes look good to me.	2020-03-20 10:51:32 +01:00
Michal Nowak	2fafcc2c2d	Merge branch 'mnowak/unit-test-debugging-enhancements' into 'master' Enhance unit test debugging See merge request isc-projects/bind9!2990	2020-03-20 09:40:16 +00:00
Michal Nowak	8fad74e0e5	Enhance unit test debugging When unit test fails, core file is created. Kyua's 'debug' command can run GDB on it and provide backtrace. Unfortunately Kyua is picky about location of these core files we opt to use custom Kyua fork and copy core files from Kyua working directory to source tree and make it available in GitLab.	2020-03-20 10:37:59 +01:00
Ondřej Surý	eb26fdf701	Merge branch '4-fix-the-last-three-system-tests-parallel-run' into 'master' Convert the last three system tests (ecdsa, eddsa and tkey) to use dynamic ports See merge request isc-projects/bind9!3257	2020-03-19 17:23:53 +00:00
Ondřej Surý	cfbb46201f	Fix the tkey system test to allow parallel run The tkey test was not adapted to dynamic ports, so we had to run it in sequence. This commit adds support for dynamic ports, and also makes all the scripts shellcheck clean.	2020-03-19 17:31:31 +01:00
Ondřej Surý	4124a89972	Fix the eddsa system test to allow parallel run The eddsa test was not adapted to dynamic ports, so we had to run it in sequence. This commit adds support for dynamic ports, and also makes all the scripts shellcheck clean.	2020-03-19 17:31:31 +01:00
Ondřej Surý	1f1ecdecc9	Fix the ecdsa system test to allow parallel run The ecdsa test was not adapted to dynamic ports, so we had to run it in sequence. This commit adds support for dynamic ports, and also makes all the scripts shellcheck clean.	2020-03-19 17:31:31 +01:00
Ondřej Surý	bde35220cd	Merge branch '1679-remove-workaround-for-systems-with-broken-gettimeofday-system-calls' into 'master' Remove Solaris 2.8 broken gettimeofday() workaround Closes #1679 See merge request isc-projects/bind9!3238	2020-03-19 08:34:49 +00:00
Ondřej Surý	e691b89a9a	Use clock_gettime() instead of gettimeofday() for isc_stdtime function This also removes Solaris 2.8 broken gettimeofday() workaround	2020-03-18 16:02:24 +01:00
Ondřej Surý	af26de6370	Merge branch '4-gitlab-ci.yml-improvement' into 'master' Improve GitLab CI configuration See merge request isc-projects/bind9!3254	2020-03-18 11:51:59 +00:00
Ondřej SurýandOndřej Surý	de1a637a69	Rename MAKE environment variable to MAKE_COMMAND The environment variable MAKE has been replaced with MAKE_COMMAND, because overriding MAKE variable also changed the definition of the MAKE inside the Makefiles, and we want only a single wrapper around the whole build process. Previously, setting `MAKE` to `bear make` meant that `bear make` would be run at every nested make invocation, which messed up the upcoming automake transition as compile_commands.json would be generated in every subdirectory instead of just having one central file at the top of the build tree.	2020-03-18 12:51:08 +01:00
Ondřej SurýandOndřej Surý	99f9e2c53e	Remove cppcheck arm64 job All :sid:amd64 jobs were errorneously copied to :sid:arm64 including the extra cppcheck run. Remove the extra definitions from arm64 jobs.	2020-03-18 12:51:08 +01:00
Ondřej SurýandOndřej Surý	66ba808c1b	Replace dependencies+needs with needs+artifacts in GitLabCI config All jobs now use solely the newer needs configuration to declare dependencies between jobs: needs: - job: <foo> artifacts: true instead of combination of dependencies and needs which is deprecated. This change completely unbundles the stages (alas the stages still needs to stay because the job graph has to stay acyclic between the stages).	2020-03-18 12:51:08 +01:00
Ondřej Surý	d7348a2b96	Merge branch '1675-logfileconfig-system-test-crashes-occasionally-rwlock' into 'master' Use isc_rwlock to lock .logconfig member of isc_log_t Closes #1675 See merge request isc-projects/bind9!3229	2020-03-18 11:50:39 +00:00
Ondřej Surý	4d58856ff7	Use isc_rwlock to lock .logconfig member of isc_log_t In isc_log_woudlog() the .logconfig member of isc_log_t structure was accessed unlocked on the merit that there could be just a race when .logconfig would be NULL, so the message would not be logged. This turned not to be true, as there's also data race deeper. The accessed isc_logconfig_t object could be in the middle of destruction, so the pointer would be still non-NULL, but the structure members could point to a chunk of memory no longer belonging to the object. Since we are only accessing integer types (the log level), this would never lead to a crash, it leads to memory access to memory area no longer belonging to the object and this a) wrong, b) raises a red flag in thread-safety tools.	2020-03-18 11:52:14 +01:00
Ondřej Surý	ed2ee2dffa	Merge branch 'marka-memget-cannot-fail-logging' into 'master' Cleanup logging API now that isc_mem_get cannot fail. See merge request isc-projects/bind9!3252	2020-03-18 10:34:28 +00:00
Mark AndrewsandOndřej Surý	0b793166d0	Refactor the isc_log API so it cannot fail on memory failures The isc_mem API now crashes on memory allocation failure, and this is the next commit in series to cleanup the code that could fail before, but cannot fail now, e.g. isc_result_t return type has been changed to void for the isc_log API functions that could only return ISC_R_SUCCESS.	2020-03-18 09:05:59 +01:00
Evan Hunt	e6deefd03f	Merge branch 'each-lgtm-fixes' into 'master' fix LGTM warnings See merge request isc-projects/bind9!3200	2020-03-17 22:18:10 +00:00
Ondřej SurýandEvan Hunt	08f4c7d6c0	Add C11 localtime_r and gmtime_r shims for Windows On Windows, C11 localtime_r() and gmtime_r() functions are not available. While localtime() and gmtime() functions are already thread safe because they use Thread Local Storage, it's quite ugly to #ifdef around every localtime_r() and gmtime_r() usage to make the usage also thread-safe on POSIX platforms. The commit adds wrappers around Windows localtime_s() and gmtime_s() functions. NOTE: The implementation of localtime_s and gmtime_s in Microsoft CRT are incompatible with the C standard since it has reversed parameter order and errno_t return type.	2020-03-17 13:28:15 -07:00
Evan Hunt	ec95b84e8d	silence a warning about unsafe snprintf() call	2020-03-17 13:28:15 -07:00
Evan Hunt	fc5ae3192b	clean up dead code removed an if statement that always evaluated to false	2020-03-17 13:28:15 -07:00
Evan Hunt	5703f70427	replace unsafe ctime() and gmtime() function calls This silences LGTM warnings that these functions are not thread-safe.	2020-03-17 13:28:15 -07:00
Evan Hunt	735be3b816	remove or comment empty conditional branches some empty conditional branches which contained a semicolon were "fixed" by clang-format to contain nothing. add comments to prevent this.	2020-03-17 13:28:15 -07:00
Evan Hunt	8915e4722d	Merge branch '1684-timer-test-build' into 'master' fix a pointer-to-int cast error Closes #1684 See merge request isc-projects/bind9!3246	2020-03-17 20:10:02 +00:00
Evan Hunt	6b76646037	fix a pointer-to-int cast error	2020-03-17 13:00:29 -07:00
Ondřej Surý	58cc273b19	Merge branch '1672-stop-leaking-external-headers-and-symbols-to-the-public-api-isc/md.h' into 'master' Make isc_md API to not leak OpenSSL symbols Closes #1672 See merge request isc-projects/bind9!3218	2020-03-17 15:00:56 +00:00
Ondřej Surý	4e114f8ed6	Stop leaking OpenSSL types and defines in the isc/md.h The <isc/md.h> header directly included <openssl/evp.h> header which enforced all users of the libisc library to explicitly list the include path to OpenSSL and link with -lcrypto. By hiding the specific implementation into the private namespace, we no longer enforce this. In the long run, this might also allow us to switch cryptographic library implementation without affecting the downstream users. While making the isc_md_type_t type opaque, the API using the data type was changed to use the pointer to isc_md_type_t instead of using the type directly.	2020-03-17 09:11:13 +01:00
Mark Andrews	6052e254b9	Merge branch '1682-dighost-c-idn_output_filter-has-off-by-one-error' into 'master' Resolve "dighost.c: idn_output_filter has off by one error" Closes #1682 See merge request isc-projects/bind9!3243	2020-03-17 04:43:46 +00:00
Mark Andrews	af67acc0d0	address off by one error in idn_output_filter	2020-03-17 13:56:30 +11:00
Diego dos Santos Fronza	da64d42cd6	Merge branch '1138-from-bugs-43718-extend-nsip-wait-recurse-or-add-nsdname-wait-recurse' into 'master' Resolve "From Bugs (#43718) : extend nsip-wait-recurse or add nsdname-wait-recurse" Closes #1138 See merge request isc-projects/bind9!3134	2020-03-16 18:50:53 +00:00
Diego Fronza	267e2c4772	Add CHANGES and release note	2020-03-16 15:20:12 -03:00
Diego Fronza	4e8f8da661	Added nsdname-wait-recurse documentation to ARM	2020-03-16 15:18:46 -03:00
Evan HuntandDiego Fronza	2822b01636	incidental fix: dnsrps test was failing the test for logging of invalid prefixes doesn't work when running with dnsrps; disable it in that case.	2020-03-16 15:18:46 -03:00
Diego Fronza	fe10111521	Added test for nsdname-wait-recurse option	2020-03-16 15:18:46 -03:00
Diego Fronza	c786c578d7	Added RPZ configuration option "nsdname-wait-recurse" This new option was added to fill a gap in RPZ configuration options. It was possible to instruct BIND wheter NSIP rewritting rules would apply or not, as long as the required data was already in cache or not, respectively, by means of the option nsip-wait-recurse. A value of yes (default) could incur a little processing cost, since BIND would need to recurse to find NS addresses in case they were not in the cache. This behavior could be changed by setting nsip-wait-recurse value to no, in which case BIND would promptly return some error code if the NS IP addresses data were not in cache, then BIND would start a recursive query in background, so future similar requests would have the required data (NS IPs) in cache, allowing BIND to apply NSIP rules accordingly. A similar feature wasn't available for NSDNAME triggers, so this commit adds the option nsdname-wait-recurse to fill this gap, as it was expected by couple BIND users.	2020-03-16 15:18:46 -03:00
Michał Kępień	be0dc3db3f	Merge branch 'michal/update-gitlab-ci-to-freebsd-12.1' into 'master' Update GitLab CI to FreeBSD 12.1 See merge request isc-projects/bind9!3180	2020-03-16 10:33:31 +00:00
Michał Kępień	80618b5378	Move FreeBSD CI jobs to libvirt-based executors To get rid of the currently used FreeBSD-specific executor, move FreeBSD CI jobs to libvirt-based executors. Make the necessary tag and variable adjustments.	2020-03-16 11:32:46 +01:00
Michał Kępień	4c68b56246	Update GitLab CI to FreeBSD 12.1 Since FreeBSD 12.1 is the current FreeBSD 12.x release, replace FreeBSD 12.0 GitLab CI jobs with their up-to-date counterparts.	2020-03-16 11:32:46 +01:00
Ondřej Surý	a3b89e7547	Merge branch '4-convert-lmdb-check-to-macro' into 'master' Add AX_LIB_LMDB macro See merge request isc-projects/bind9!3205	2020-03-16 09:44:49 +00:00
Ondřej SurýandOndřej Surý	6a475340cf	Link with LMDB only where needed	2020-03-16 09:38:15 +01:00
Ondřej SurýandOndřej Surý	fe85568604	Convert lmdb check to m4 macro	2020-03-16 09:38:15 +01:00
Mark Andrews	020b9f7a73	Merge branch '1681-compile-error-geoip_test-c-maxminddb-h-file-not-found' into 'master' Resolve "compile error: geoip_test.c - maxminddb.h file not found" Closes #1681 See merge request isc-projects/bind9!3233	2020-03-16 07:50:16 +00:00
Mark Andrews	81a80274bd	Add MAXMINDDB_CFLAGS to CINCLUDES	2020-03-16 16:15:03 +11:00
Mark Andrews	402c0b26f7	Merge branch '1676-address-timing-issue-in-forward-system-test' into 'master' Resolve "Address timing issue in forward system test." Closes #1676 See merge request isc-projects/bind9!3221	2020-03-15 23:30:46 +00:00
Mark Andrews	a38a324442	wait for the reply message before checking to avoid false negative. Waiting for the reply message will ensure that all messages being looked for exist in the logs at the time of checking. When the test was only waiting for the send message there was a race between grep and the ns1 instance of named logging that it had seen the request.	2020-03-16 09:50:45 +11:00
Mark Andrews	9660ec80df	Merge branch '1655-bind-9-11-5-writes-syntax-errors-to-its-zone-cache' into 'master' Resolve "BIND 9.11.5 writes syntax errors to its zone cache" Closes #1655 See merge request isc-projects/bind9!3150	2020-03-13 04:00:26 +00:00
Mark Andrews	c9c59db5b3	Add CHANGES note	2020-03-13 13:40:15 +11:00
Mark Andrews	59498ce17f	Quote zone name so that specials are handled	2020-03-13 13:38:56 +11:00
Mark Andrews	91efc587b2	Pass NUL terminated buffer name to cfg_parse_buffer	2020-03-13 13:38:56 +11:00
Mark Andrews	ad030332bd	Test reloading of zones with special	2020-03-13 13:38:56 +11:00
Mark Andrews	fed5992b31	Merge branch 'marka-maybe-silence-missing-unlock' into 'master' Silence missing unlock from Coverity. See merge request isc-projects/bind9!3185	2020-03-13 02:14:14 +00:00
Mark Andrews	8dd8d48c9f	Silence missing unlock from Coverity. Save 'i' to 'locknum' and use that rather than using 'header->node->locknum' when performing the deferred unlock as 'header->node->locknum' can theoretically be different to 'i'.	2020-03-13 12:42:52 +11:00
Mark Andrews	462a46cf50	Merge branch '1652-nslookup-assertion-at-soa_6-c-302-require-rdata-length-0-failed-back-trace' into 'master' Resolve "nslookup: assertion at soa_6.c:302: REQUIRE(rdata->length != 0) failed, back trace" Closes #1652 See merge request isc-projects/bind9!3136	2020-03-13 00:44:24 +00:00
Mark Andrews	6593cf0b5a	Check that dig/host/nslookup handle a UPDATE response. Additionally check that "delete $qname SOA" in the update reponse doesn't trigger a insertion in nslookup.	2020-03-13 10:29:43 +11:00
Mark Andrews	bb7576cc9b	Report opcode mismatch	2020-03-13 10:28:18 +11:00
Mark Andrews	4a7b9dba61	turn off best effort processing in host and add the ability to specify the port	2020-03-13 10:28:18 +11:00
Mark Andrews	d1cb30e747	turn off best effort processing in nslookup	2020-03-13 10:28:18 +11:00
Ondřej Surý	386ceaac7b	Merge branch '1672-stop-leaking-external-headers-and-symbols-to-the-public-api-isc/hmac.h' into 'master' Make isc_hmac API to not leak OpenSSL symbols See merge request isc-projects/bind9!3216	2020-03-12 21:22:46 +00:00
Ondřej Surý	70100c664a	Stop leaking OpenSSL types and defines in the isc/hmac.h The <isc/md.h> header directly included <openssl/hmac.h> header which enforced all users of the libisc library to explicitly list the include path to OpenSSL and link with -lcrypto. By hiding the specific implementation into the private namespace, we no longer enforce this. In the long run, this might also allow us to switch cryptographic library implementation without affecting the downstream users.	2020-03-12 22:22:03 +01:00
Ondřej Surý	b04eda7212	Merge branch '1672-stop-leaking-external-headers-and-symbols-to-the-public-api-isc/safe.h' into 'master' Make isc_safe API to not leak OpenSSL symbols See merge request isc-projects/bind9!3215	2020-03-12 19:07:51 +00:00
Ondřej Surý	ab827ab5bf	Stop leaking OpenSSL types and defines in the isc/safe.h The two "functions" that isc/safe.h declared before were actually simple defines to matching OpenSSL functions. The downside of the approach was enforcing all users of the libisc library to explicitly list the include path to OpenSSL and link with -lcrypto. By hiding the specific implementation into the private namespace changing the defines into simple functions, we no longer enforce this. In the long run, this might also allow us to switch cryptographic library implementation without affecting the downstream users.	2020-03-12 20:07:16 +01:00
Ondřej Surý	c34b9364c0	Merge branch '1673-lib-isc-pk11-c-depend-on-libdns-headers' into 'master' Use ISC_R_CRYPTOFAILURE instead DST_R_CRYPTOFAILURE in libisc Closes #1673 See merge request isc-projects/bind9!3220	2020-03-12 19:05:29 +00:00
Ondřej Surý	e67ce7e966	Use ISC_R_CRYPTOFAILURE instead DST_R_CRYPTOFAILURE in libisc There was a circular libisc dependency on libdns headers for DST_R_CRYPTOFAILURE return code. Replace it with ISC_R_CRYPTOFAILURE to break the loop.	2020-03-12 17:50:29 +01:00
Evan Hunt	bc10d88c25	Merge branch '864-zone-type-table-in-arm-needs-improvement' into 'master' Resolve "zone type table in ARM needs improvement" Closes #864 See merge request isc-projects/bind9!1544	2020-03-12 08:48:23 +00:00
Evan Hunt	b10bdb57ac	build doc	2020-03-12 01:14:07 -07:00
Evan Hunt	6fb568caae	improve readability of bibliogrpahy Change <biblioentry> and <citetitle> sections to improve the readability of the bibliography sections. Thanks to Sun Guonian.	2020-03-12 01:14:07 -07:00
Evan Hunt	d9a6fef020	shorten text for mirror zones to prevent overspill	2020-03-12 01:14:07 -07:00
Mark AndrewsandEvan Hunt	9e4a153f3b	use relative widths for zone table	2020-03-12 01:14:07 -07:00
Evan Hunt	bf38b4af11	Merge branch 'placeholder' into 'master' placeholder See merge request isc-projects/bind9!3214	2020-03-12 07:37:05 +00:00
Evan Hunt	9a8865d674	placeholder	2020-03-12 00:36:23 -07:00