WIP: non-blocking zone lookup

- add a DNS_DBFIND_NONBLOCK option, which causes dns_db_find/findext() to return ISC_R_LOCKBUSY if unable to acquire a read lock on the database. - use the asynchronous hook mechanism to postpone query_lookup() if this occurs.
Merge branch '2751-serve-stale-tests-false-negative' into 'main'
2021-06-03 22:59:57 -07:00 · 2021-06-03 08:40:38 +00:00 · 2021-06-03 18:20:14 +10:00 · 2021-06-03 07:31:26 +00:00 · 2021-06-03 11:55:31 +10:00 · 2021-06-02 22:37:10 +00:00
159 changed files with 4093 additions and 2760 deletions
@@ -34,7 +34,7 @@ variables:
  WITH_READLINE_LIBEDIT: "--with-readline=libedit"
  WITH_READLINE_READLINE: "--with-readline=readline"

-  BIND_INSTALL_PATH: "${CI_PROJECT_DIR}/.local"
+  INSTALL_PATH: "${CI_PROJECT_DIR}/.local"

  # In multithreaded unit tests, abort on the first failure
  CMOCKA_TEST_ABORT: 1
@@ -137,16 +137,20 @@ stages:

 # Fedora

-.fedora-33-amd64: &fedora_33_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-33-amd64"
+.fedora-34-amd64: &fedora_34_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-34-amd64"
  <<: *linux_amd64

-.fedora-33-arm64: &fedora_33_arm64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-33-arm64"
+.fedora-34-arm64: &fedora_34_arm64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-34-arm64"
  <<: *linux_stress_arm64

 # Ubuntu

+.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
+  <<: *linux_amd64
+
 .ubuntu-focal-amd64: &ubuntu_focal_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-focal-amd64"
  <<: *linux_amd64
@@ -173,8 +177,12 @@ stages:
  image: "freebsd-12.2-x86_64"
  <<: *libvirt_amd64

+.freebsd-13-amd64: &freebsd_13_amd64_image
+  image: "freebsd-13.0-x86_64"
+  <<: *libvirt_amd64
+
 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-6.8-x86_64"
+  image: "openbsd-6.9-x86_64"
  <<: *libvirt_amd64

 ### Job Templates
@@ -195,6 +203,12 @@ stages:
    - main@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9

+.schedules-tags-web-triggering-rules: &schedules_tags_web_triggering_rules
+  only:
+    - schedules
+    - tags
+    - web
+
 .precheck: &precheck_job
  <<: *default_triggering_rules
  <<: *base_image
@@ -219,7 +233,6 @@ stages:
    --with-cmocka \
    --with-libxml2 \
    --with-json-c \
-    --prefix="${BIND_INSTALL_PATH}" \
    $EXTRA_CONFIGURE \
    || (test -s config.log && cat config.log; exit 1)

@@ -238,6 +251,18 @@ stages:
      grep "^#define HAVE_READLINE_READLINE" config.h; \
    fi

+# Move the out-of-tree workspace to CI project dir to save it for use in
+# dependent jobs.
+.save_out_of_tree_workspace: &save_out_of_tree_workspace
+  - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "${OUT_OF_TREE_WORKSPACE}" "${CI_PROJECT_DIR}"
+
+# Move the artifacts from the out-of-tree build job to their original
+# location (the out-of-tree workspace) and then continue work in the
+# out-of-tree workspace.
+.retrieve_out_of_tree_workspace: &retrieve_out_of_tree_workspace
+  - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "$(basename "${OUT_OF_TREE_WORKSPACE}")" "${OUT_OF_TREE_WORKSPACE}"
+  - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
+
 .build: &build_job
  <<: *default_triggering_rules
  stage: build
@@ -248,12 +273,12 @@ stages:
    - *configure
    - *check_readline_setup
    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
-    - test -z "${RUN_MAKE_INSTALL}" || make install
-    - test -z "${RUN_MAKE_INSTALL}" || sh util/check-make-install
+    - test -z "${RUN_MAKE_INSTALL}" || make DESTDIR="${INSTALL_PATH}" install
+    - test -z "${RUN_MAKE_INSTALL}" || DESTDIR="${INSTALL_PATH}" sh util/check-make-install
    - if [[ "${CFLAGS}" == *"-fsanitize=address"* ]]; then ( ! grep -F AddressSanitizer config.log ); fi
    - if test -z "${OUT_OF_TREE_WORKSPACE}" && test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
  after_script:
-    - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "${OUT_OF_TREE_WORKSPACE}" "${CI_PROJECT_DIR}"
+    - *save_out_of_tree_workspace
  needs:
    - job: autoreconf
      artifacts: true
@@ -304,10 +329,7 @@ stages:
  stage: system
  before_script:
    - *setup_softhsm
-    # Move the artifacts from the out-of-tree build job to their original location (the out-of-tree workspace).
-    - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "$(basename "${OUT_OF_TREE_WORKSPACE}")" "${OUT_OF_TREE_WORKSPACE}"
-    # Continue work in the out-of-tree workspace.
-    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
+    - *retrieve_out_of_tree_workspace
    - *setup_interfaces
  script:
    - cd bin/tests/system
@@ -317,7 +339,7 @@ stages:
    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
    - test -d bind-* && cd bind-*
    - cat bin/tests/system/test-suite.log
-    - test -n "${OUT_OF_TREE_WORKSPACE}" && mv "${OUT_OF_TREE_WORKSPACE}" "${CI_PROJECT_DIR}"
+    - *save_out_of_tree_workspace

 .system_test: &system_test_job
  <<: *system_test_common
@@ -344,6 +366,7 @@ stages:
    when: on_failure

 .windows_system_test: &windows_system_test_job
+  <<: *schedules_tags_web_triggering_rules
  stage: system
  script:
    - 'Push-Location bin/tests/system'
@@ -359,19 +382,17 @@ stages:
    untracked: true
    expire_in: "1 day"
    when: on_failure
-  only:
-    - schedules
-    - tags
-    - web

 .unit_test_common: &unit_test_common
  <<: *default_triggering_rules
  stage: unit
  before_script:
-    - if [ -n "$TCP_CONNECTIONTIMEOUT" ]; then sudo sysctl 'net.inet.tcp.keepinittime=1'; fi
    - *setup_softhsm
+    - *retrieve_out_of_tree_workspace
  script:
    - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1
+  after_script:
+    - *save_out_of_tree_workspace

 .unit_test: &unit_test_job
  <<: *unit_test_common
@@ -770,10 +791,17 @@ system:gcc:out-of-tree:
      artifacts: true
  <<: *base_image
  <<: *system_test_job
-  only:
-    - schedules
-    - tags
-    - web
+  <<: *schedules_tags_web_triggering_rules
+
+unit:gcc:out-of-tree:
+  variables:
+    OUT_OF_TREE_WORKSPACE: /tmp/out_of_tree_workspace
+  needs:
+    - job: gcc:out-of-tree
+      artifacts: true
+  <<: *base_image
+  <<: *unit_test_job
+  <<: *schedules_tags_web_triggering_rules

 # Jobs for tarball GCC builds on Debian 10 "buster" (amd64)

@@ -791,37 +819,27 @@ gcc:tarball:
  needs:
    - job: tarball-create
      artifacts: true
-  only:
-    - schedules
-    - tags
-    - web

 system:gcc:tarball:
  <<: *base_image
  <<: *system_test_job
+  <<: *schedules_tags_web_triggering_rules
  before_script:
    - cd bind-*
    - *setup_interfaces
  needs:
    - job: gcc:tarball
      artifacts: true
-  only:
-    - schedules
-    - tags
-    - web

 unit:gcc:tarball:
  <<: *base_image
  <<: *unit_test_job
+  <<: *schedules_tags_web_triggering_rules
  before_script:
    - cd bind-*
  needs:
    - job: gcc:tarball
      artifacts: true
-  only:
-    - schedules
-    - tags
-    - web

 # Jobs for debug GCC builds on openSUSE Tumbleweed (amd64)

@@ -847,6 +865,30 @@ unit:gcc:tumbleweed:amd64:
    - job: gcc:tumbleweed:amd64
      artifacts: true

+# Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
+
+gcc:bionic:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -O2"
+    EXTRA_CONFIGURE: "--disable-dnstap --disable-geoip"
+  <<: *ubuntu_bionic_amd64_image
+  <<: *build_job
+
+system:gcc:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *system_test_job
+  needs:
+    - job: gcc:bionic:amd64
+      artifacts: true
+
+unit:gcc:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: gcc:bionic:amd64
+      artifacts: true
+
 # Jobs for regular GCC builds on Ubuntu 20.04 Focal Fossa (amd64)

 gcc:focal:amd64:
@@ -1054,25 +1096,25 @@ unit:gcc:softhsm2.4:
    - job: gcc:softhsm2.4
      artifacts: true

-# Jobs for PKCS#11-enabled GCC builds on Fedora 33 (amd64)
+# Jobs for PKCS#11-enabled GCC builds on Fedora 34 (amd64)

 gcc:softhsm2.6:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O1"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-native-pkcs11 --with-pkcs11=/usr/lib64/pkcs11/libsofthsm2.so"
-  <<: *fedora_33_amd64_image
+  <<: *fedora_34_amd64_image
  <<: *build_job

 system:gcc:softhsm2.6:
-  <<: *fedora_33_amd64_image
+  <<: *fedora_34_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:softhsm2.6
      artifacts: true

 unit:gcc:softhsm2.6:
-  <<: *fedora_33_amd64_image
+  <<: *fedora_34_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:softhsm2.6
@@ -1087,10 +1129,12 @@ clang:freebsd11:amd64:
    USER: gitlab-runner
  <<: *freebsd_11_amd64_image
  <<: *build_job
+  <<: *schedules_tags_web_triggering_rules

 system:clang:freebsd11:amd64:
  <<: *freebsd_11_amd64_image
  <<: *system_test_job
+  <<: *schedules_tags_web_triggering_rules
  variables:
    USER: gitlab-runner
    TEST_PARALLEL_JOBS: 4
@@ -1101,6 +1145,7 @@ system:clang:freebsd11:amd64:
 unit:clang:freebsd11:amd64:
  <<: *freebsd_11_amd64_image
  <<: *unit_test_job
+  <<: *schedules_tags_web_triggering_rules
  needs:
    - job: clang:freebsd11:amd64
      artifacts: true
@@ -1132,6 +1177,33 @@ unit:clang:freebsd12:amd64:
    - job: clang:freebsd12:amd64
      artifacts: true

+# Jobs for Clang builds on FreeBSD 13 (amd64)
+
+clang:freebsd13:amd64:
+  variables:
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "${WITH_READLINE_LIBEDIT}"
+    USER: gitlab-runner
+  <<: *freebsd_13_amd64_image
+  <<: *build_job
+
+system:clang:freebsd13:amd64:
+  <<: *freebsd_13_amd64_image
+  <<: *system_test_job
+  variables:
+    USER: gitlab-runner
+    TEST_PARALLEL_JOBS: 4
+  needs:
+    - job: clang:freebsd13:amd64
+      artifacts: true
+
+unit:clang:freebsd13:amd64:
+  <<: *freebsd_13_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: clang:freebsd13:amd64
+      artifacts: true
+
 # Jobs for Clang builds on OpenBSD (amd64)

 clang:openbsd:amd64:
@@ -1159,8 +1231,6 @@ unit:clang:openbsd:amd64:
  <<: *unit_test_job
  variables:
    USER: gitlab-runner
-    # There's no socket option on OpenBSD, so we need to set this globally
-    TCP_CONNECTIONTIMEOUT: 1
  needs:
    - job: clang:openbsd:amd64
      artifacts: true
@@ -1186,12 +1256,9 @@ system:msvc:windows:amd64:
 msvc-debug:windows:amd64:
  <<: *windows_server_2016_amd64_image
  <<: *windows_build_job
+  <<: *schedules_tags_web_triggering_rules
  variables:
    VSCONF: Debug
-  only:
-    - schedules
-    - tags
-    - web

 system:msvc-debug:windows:amd64:
  <<: *windows_server_2016_amd64_image
@@ -1349,10 +1416,10 @@ respdiff:
    - *setup_interfaces
    - *setup_softhsm
    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
-    - make install
+    - make DESTDIR="${INSTALL_PATH}" install
    - git clone --depth 1 https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.isc.org/isc-private/bind-qa.git
    - cd bind-qa/bind9/stress
-    - DIG="${BIND_INSTALL_PATH}/bin/dig" WORKSPACE="${CI_PROJECT_DIR}" bash stress.sh
+    - LD_LIBRARY_PATH="${INSTALL_PATH}/usr/local/lib" BIND_INSTALL_PATH="${INSTALL_PATH}/usr/local" WORKSPACE="${CI_PROJECT_DIR}" bash stress.sh
  needs:
    - job: autoreconf
      artifacts: true
@@ -1362,8 +1429,8 @@ respdiff:
    when: always
  timeout: 2h

-stress:authoritative:fedora:33:amd64:
-  <<: *fedora_33_amd64_image
+stress:authoritative:fedora:34:amd64:
+  <<: *fedora_34_amd64_image
  <<: *linux_stress_amd64
  <<: *stress_job
  variables:
@@ -1376,8 +1443,8 @@ stress:authoritative:fedora:33:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:recursive:fedora:33:amd64:
-  <<: *fedora_33_amd64_image
+stress:recursive:fedora:34:amd64:
+  <<: *fedora_34_amd64_image
  <<: *linux_stress_amd64
  <<: *stress_job
  variables:
@@ -1390,8 +1457,8 @@ stress:recursive:fedora:33:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:authoritative:fedora:33:arm64:
-  <<: *fedora_33_arm64_image
+stress:authoritative:fedora:34:arm64:
+  <<: *fedora_34_arm64_image
  <<: *linux_stress_arm64
  <<: *stress_job
  variables:
@@ -1404,8 +1471,8 @@ stress:authoritative:fedora:33:arm64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:recursive:fedora:33:arm64:
-  <<: *fedora_33_arm64_image
+stress:recursive:fedora:34:arm64:
+  <<: *fedora_34_arm64_image
  <<: *linux_stress_arm64
  <<: *stress_job
  variables:
@@ -13,6 +13,7 @@ email to [security-officer@isc.org](security-officer@isc.org).
  - [ ] Determine CVSS score
  - [ ] Determine the range of BIND versions affected (including the Subscription Edition)
  - [ ] Determine whether workarounds for the problem exists
+  - [ ] Create a draft of the security advisory and put the information above in there
  - [ ] Prepare a detailed description of the problem which should include the following by default:
      - instructions for reproducing the problem (a system test is good enough)
      - explanation of code flow which triggers the problem (a system test is *not* good enough)
@@ -85,7 +85,9 @@
 - [ ] ***(QA)*** Merge the automatically prepared `prep 9.x.y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_x`).
 - [ ] ***(QA)*** For each maintained branch, update the `BIND_BASELINE_VERSION` variable for the `abi-check` job in `.gitlab-ci.yml` to the latest published BIND version tag for a given branch.
 - [ ] ***(QA)*** Prepare empty release notes for the next set of releases.
- - [ ] ***(QA)*** Sanitize all confidential issues assigned to the release milestone and make them public.
+ - [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
+ - [ ] ***(QA)*** Sanitize confidential issues which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
 - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.

 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
+[^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.
@@ -13,6 +13,7 @@ extraction:
      - "libidn2-dev"
      - "libmaxminddb-dev"
      - "libuv1-dev"
+      - "libnghttp2-dev"
    configure:
      command:
      - "autoreconf -fi"
@@ -1,85 +1,153 @@
+5652.	[bug]		Copy and paste error caused the socket option to
+			be enabled instead of disabled. [GL #2746]
+
+5651.	[func]		Refactor zone dumping to be processed asynchronously
+			via the uv_work_t thread pool API. [GL #2732]
+
+5650.	[bug]		Prevent a crash that could occur if serve-stale
+			was enabled and a prefetch was triggered during a
+			query restart. [GL #2733]
+
+5649.	[bug]		If a query was answered with stale data on a server
+			with DNS64 enabled, an assertion could occur if a
+			non-stale answer arrived afterward. [GL #2731]
+
+5648.	[bug]		The calculation of the estimated IXFR transaction
+			size by dns_journal_iter_init() was invalid. [GL #2685]
+
+5647.	[func]		The interfacemgr has been refactored to use fewer
+			clientmgr objects, which in turn use fewer memory
+			contexts and tasks.  This should result in less
+			fragmented memory and better startup performance.
+			[GL #2433]
+
+5646.	[bug]		The default TCP timeout for rndc has been increased
+			to 60 seconds. This was its original value, but it
+			had been inadvertently lowered to 10. [GL #2643]
+
+5645.	[cleanup]	Remove the rarely-used dns_name_copy() function
+			and rename dns_name_copynf() to dns_name_copy().
+			[GL !5081]
+
+5644.	[bug]		Fix a race condition in reading and writing key files
+			for KASP zones in multiple views. [GL #1875]
+
+5643.	[placeholder]
+
+5642.	[bug]		Check "key-directory" conflicts in "named.conf" for
+			zones in multiple views with different "dnssec-policy".
+			[GL #2463].
+
+5641.	[bug]		Address potential memory leak in dst_key_fromnamedfile.
+			[GL #2689]
+
+5640.	[func]		Add new configuration option to set the operating system
+			receive and send buffers. [GL #2313]
+
+5639.	[bug]		Check that the first and last SOA record of an AXFR
+			are consistent. [GL #2528]
+
+	--- 9.17.13 released ---
+
 5638.	[bug]		Improvements related to network manager/task manager
 			integration:
-			- added isc_managers_create() and _destroy() functions
-			  to handle setup and teardown of netmgr, taskmgr,
-			  timermgr and socketmgr since these require a
-			  precise order of operations now.
-			- event queue processing is now quantized to prevent
+			- isc_managers_create() and isc_managers_destroy()
+			  functions were added to handle setup and teardown of
+			  netmgr, taskmgr, timermgr, and socketmgr, since these
+			  require a precise order of operations now.
+			- Event queue processing is now quantized to prevent
 			  infinite looping.
-			- the netmgr can now be paused from within a netmgr
+			- The netmgr can now be paused from within a netmgr
 			  thread.
-			- fixed deadlocks due to conflict between netmgr
-			  pause/resume and listen/stoplistening operations.
+			- Deadlocks due to a conflict between netmgr's
+			  pause/resume and listen/stoplistening operations were
+			  fixed.
 			[GL #2654]

 5637.	[placeholder]

-5636.	[bug]		Check that zone files for 'dnssec-policy' zones are
-			only referenced once in 'named.conf'. [GL #2603]
+5636.	[bug]		named and named-checkconf did not report an error when
+			multiple zones with the "dnssec-policy" option set were
+			using the same zone file. This has been fixed.
+			[GL #2603]

 5635.	[bug]		Journal compaction could fail when a journal with
-			invalid transaction headers was not detected at
-			startup.  [GL #2670]
+			invalid transaction headers was not detected at startup.
+			This has been fixed. [GL #2670]

-5634.	[bug]		Don't roll keys when the private key file is offline.
-			[GL #2596]
+5634.	[bug]		If "dnssec-policy" was active and a private key file was
+			temporarily offline during a rekey event, named could
+			incorrectly introduce replacement keys and break a
+			signed zone. This has been fixed. [GL #2596]

-5633.	[doc]		Inline-signing was incorrectly described as being
-			inherited from the options / view levels and was
+5633.	[doc]		The "inline-signing" option was incorrectly described as
+			being inherited from the "options"/"view" levels and was
 			incorrectly accepted at those levels without effect.
-			This has been corrected. [GL #2536]
+			This has been fixed. [GL #2536]

-5632.	[func]		Add built-in dnssec-policy "insecure". This is used to
-			transition a zone from a signed state to a unsigned
-			state. [GL #2645]
+5632.	[func]		Add a new built-in KASP, "insecure", which is used to
+			transition a zone from a signed to an unsigned state.
+			The existing built-in KASP "none" should no longer be
+			used to unsign a zone. [GL #2645]

-5631.	[bug]		Update ZONEMD to match RFC 8976. [GL #2658]
+5631.	[protocol]	Update the implementation of the ZONEMD RR type to match
+			RFC 8976. [GL #2658]

-5630.	[func]		Treat DNSSEC responses with NSEC3 iterations greater
-			than 150 as insecure. [GL #2445]
+5630.	[func]		Treat DNSSEC responses containing NSEC3 records with
+			iteration counts greater than 150 as insecure.
+			[GL #2445]

-5629.	[func]		Reduce the supported maximum number of iterations
-			that can be configured in an NSEC3 zone to 150.
-			[GL #2642]
+5629.	[func]		Reduce the maximum supported number of NSEC3 iterations
+			that can be configured for a zone to 150. [GL #2642]

-5628.	[bug]		Host and nslookup could die on SERVFAIL response.
-			[GL #2564]
+5628.	[bug]		Host and nslookup could crash upon receiving a SERVFAIL
+			response. This has been fixed. [GL #2564]

-5627.	[bug]		RRSIG(SOA) RRsets placed anywhere else than at zone apex
-			were triggering infinite resigning loops. This has been
-			fixed. [GL #2650]
+5627.	[bug]		RRSIG(SOA) RRsets placed anywhere other than at the zone
+			apex were triggering infinite resigning loops. This has
+			been fixed. [GL #2650]

-5626.	[bug]		When generating new keys, check for keyid conflicts
-			between new keys too. [GL #2628]
+5626.	[bug]		When generating zone signing keys, KASP now also checks
+			for key ID conflicts among newly created keys, rather
+			than just between new and existing ones. [GL #2628]

-5625.	[bug]		Address deadlock between rndc addzone/delzone.
-			[GL #2626]
+5625.	[bug]		A deadlock could occur when multiple "rndc addzone",
+			"rndc delzone", and/or "rndc modzone" commands were
+			invoked simultaneously for different zones. This has
+			been fixed. [GL #2626]

-5624.	[func]		Remove the taskmgr dispatch threads and run the tasks
-			on top of netmgr loops. [GL #2638]
+5624.	[func]		Task manager events are now processed inside network
+			manager loops. The task manager no longer needs its own
+			set of worker threads, which improves resolver
+			performance. [GL #2638]

-5623.	[bug]		Prevent double xfrin_fail() call when shutting down
-			the server during ongoing transfer. [GL #2630]
+5623.	[bug]		When named was shut down during an ongoing zone
+			transfer, xfrin_fail() could incorrectly be called
+			twice. This has been fixed. [GL #2630]

-5622.	[cleanup]	Remove lib/samples, since export versions of libraries
-			are no longer maintained. [GL !4835]
+5622.	[cleanup]	The lib/samples/ directory has been removed, as export
+			versions of libraries are no longer maintained.
+			[GL !4835]

 5621.	[placeholder]

-5620.	[bug]		Named would overwrite a zone file unconditionally when
-			it recovered from a corrupted journal. [GL #2623]
+5620.	[bug]		If zone journal files written by BIND 9.16.11 or earlier
+			were present when BIND was upgraded, the zone file for
+			that zone could have been inadvertently rewritten with
+			the current zone contents. This caused the original zone
+			file structure (e.g. comments, $INCLUDE directives) to
+			be lost, although the zone data itself was preserved.
+			This has been fixed. [GL #2623]

 5619.	[protocol]	Implement draft-vandijk-dnsop-nsec-ttl, updating the
 			protocol such that NSEC(3) TTL values are set to the
-			minimum of the SOA MINIMUM value and the SOA TTL.
+			minimum of the SOA MINIMUM value or the SOA TTL.
 			[GL #2347]

-5618.	[bug]		When introducing change 5149, "rndc dumpdb" started
-			to print a line above a stale RRset, indicating how
-			long the data will be retained. Also, TTLs were
-			increased with 'max-stale-ttl'. This could lead to
-			nonsensical values and both issues have been fixed.
-			[GL #389] [GL #2289]
+5618.	[bug]		Change 5149 introduced some inconsistencies in the way
+			record TTLs were presented in cache dumps. These
+			inconsistencies have been eliminated. [GL #389]
+			[GL #2289]

 	--- 9.17.12 released ---

@@ -46,11 +46,11 @@ As of Nov 2020, BIND 9.17 is fully supported and regularly tested on the
 following systems:

 * Debian 9, 10
-* Ubuntu LTS 16.04, 20.04
-* Fedora 33
+* Ubuntu LTS 18.04, 20.04
+* Fedora 34
 * Red Hat Enterprise Linux / CentOS 7, 8
-* FreeBSD 11.4, 12.2
-* OpenBSD 6.8
+* FreeBSD 11.4, 12.2, 13.0
+* OpenBSD 6.9
 * Alpine Linux 3.13

 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
@@ -69,7 +69,7 @@ Server 2016, none of these are tested regularly by ISC.
 * Solaris 11
 * NetBSD
 * Other Linux distributions still supported by their vendors, such as:
-    * Ubuntu 19.04+
+    * Ubuntu 20.10+
    * Gentoo
    * Arch Linux
 * OpenWRT/LEDE 17.01+
@@ -86,7 +86,7 @@ assessed against the risk of adverse effect on officially supported
 platforms.

 * Platforms past or close to their respective EOL dates, such as:
-    * Ubuntu 14.04, 18.10
+    * Ubuntu 14.04, 16.04 (Ubuntu ESM releases are not supported)
    * CentOS 6
    * Debian Jessie
    * FreeBSD 10.x
@@ -797,8 +797,8 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 		memmove(looknew->ecs_addr, lookold->ecs_addr, len);
 	}

-	dns_name_copynf(dns_fixedname_name(&lookold->fdomain),
-			dns_fixedname_name(&looknew->fdomain));
+	dns_name_copy(dns_fixedname_name(&lookold->fdomain),
+		      dns_fixedname_name(&looknew->fdomain));

 	if (servers) {
 		clone_server_list(lookold->my_server_list,
@@ -1890,7 +1890,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 					lookup->recurse = false;
 				}
 				domain = dns_fixedname_name(&lookup->fdomain);
-				dns_name_copynf(name, domain);
+				dns_name_copy(name, domain);
 			}
 			debug("adding server %s", namestr);
 			num = getaddresses(lookup, namestr, &lresult);
@@ -2065,7 +2065,6 @@ insert_soa(dig_lookup_t *lookup) {

 	result = dns_message_gettempname(lookup->sendmsg, &soaname);
 	check_result(result, "dns_message_gettempname");
-	dns_name_init(soaname, NULL);
 	dns_name_clone(lookup->name, soaname);
 	ISC_LIST_INIT(soaname->list);
 	ISC_LIST_APPEND(soaname->list, rdataset, link);
@@ -2163,7 +2162,6 @@ setup_lookup(dig_lookup_t *lookup) {
 	}
 	result = dns_message_gettempname(lookup->sendmsg, &lookup->name);
 	check_result(result, "dns_message_gettempname");
-	dns_name_init(lookup->name, NULL);

 	isc_buffer_init(&lookup->namebuf, lookup->name_space,
 			sizeof(lookup->name_space));
@@ -2207,7 +2205,6 @@ setup_lookup(dig_lookup_t *lookup) {
 		result = dns_message_gettempname(lookup->sendmsg,
 						 &lookup->oname);
 		check_result(result, "dns_message_gettempname");
-		dns_name_init(lookup->oname, NULL);
 		/* XXX Helper funct to conv char* to name? */
 		origin = lookup->origin->origin;
 #ifdef HAVE_LIBIDN2
@@ -2247,9 +2244,7 @@ setup_lookup(dig_lookup_t *lookup) {
 						name, lookup->oname,
 						lookup->name, &lookup->namebuf);
 				} else {
-					result = dns_name_copy(
-						name, lookup->name,
-						&lookup->namebuf);
+					dns_name_copy(name, lookup->name);
 				}
 			}
 			if (result != ISC_R_SUCCESS) {
@@ -2802,11 +2797,10 @@ start_tcp(dig_query_t *query) {
 		if (query->lookup->tls_mode) {
 			result = isc_tlsctx_createclient(&query->tlsctx);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
-			isc_nm_tlsdnsconnect(netmgr,
-					     (isc_nmiface_t *)&localaddr,
-					     (isc_nmiface_t *)&query->sockaddr,
-					     tcp_connected, query,
-					     local_timeout, 0, query->tlsctx);
+			isc_nm_tlsdnsconnect(netmgr, &localaddr,
+					     &query->sockaddr, tcp_connected,
+					     query, local_timeout, 0,
+					     query->tlsctx);
 		} else if (query->lookup->https_mode) {
 			char uri[4096] = { 0 };
 			snprintf(uri, sizeof(uri), "https://%s:%u%s",
@@ -2821,16 +2815,14 @@ start_tcp(dig_query_t *query) {
 					query->tlsctx);
 			}

-			isc_nm_httpconnect(netmgr, (isc_nmiface_t *)&localaddr,
-					   (isc_nmiface_t *)&query->sockaddr,
+			isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr,
 					   uri, !query->lookup->https_get,
 					   tcp_connected, query, query->tlsctx,
 					   local_timeout, 0);
 		} else {
-			isc_nm_tcpdnsconnect(
-				netmgr, (isc_nmiface_t *)&localaddr,
-				(isc_nmiface_t *)&query->sockaddr,
-				tcp_connected, query, local_timeout, 0);
+			isc_nm_tcpdnsconnect(netmgr, &localaddr,
+					     &query->sockaddr, tcp_connected,
+					     query, local_timeout, 0);
 		}

 		/* XXX: set DSCP */
@@ -3003,8 +2995,7 @@ start_udp(dig_query_t *query) {
 	}

 	query_attach(query, &connectquery);
-	isc_nm_udpconnect(netmgr, (isc_nmiface_t *)&localaddr,
-			  (isc_nmiface_t *)&query->sockaddr, udp_ready,
+	isc_nm_udpconnect(netmgr, &localaddr, &query->sockaddr, udp_ready,
 			  connectquery,
 			  (timeout ? timeout : UDP_TIMEOUT) * 1000, 0);
 }
@@ -379,7 +379,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copynf(&cname.cname, qname);
+		dns_name_copy(&cname.cname, qname);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -442,7 +442,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* Add AAAA and MX lookups. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copynf(query->lookup->name, name);
+		dns_name_copy(query->lookup->name, name);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -391,7 +391,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copynf(&cname.cname, qname);
+		dns_name_copy(&cname.cname, qname);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -448,7 +448,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* Add AAAA lookup. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copynf(query->lookup->name, name);
+		dns_name_copy(query->lookup->name, name);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -215,7 +215,7 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);

 	name = dns_fixedname_initname(&fixed);
-	dns_name_copynf(dst_key_name(key), name);
+	dns_name_copy(dst_key_name(key), name);

 	dst_key_free(&key);
 }
@@ -185,7 +185,7 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);

 	name = dns_fixedname_initname(&fixed);
-	dns_name_copynf(dst_key_name(key), name);
+	dns_name_copy(dst_key_name(key), name);

 	dst_key_free(&key);
 }
@@ -201,7 +201,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	dns_name_t *result;

 	result = dns_fixedname_initname(fzonecut);
-	dns_name_copynf(name, result);
+	dns_name_copy(name, result);

 	return (result);
 }
@@ -2397,7 +2397,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copynf(gorigin, nextname);
+			dns_name_copy(gorigin, nextname);
 			done = true;
 		} else if (result != ISC_R_SUCCESS) {
 			fatal("iterating through the database failed: %s",
@@ -2534,7 +2534,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copynf(gorigin, nextname);
+			dns_name_copy(gorigin, nextname);
 			done = true;
 		} else if (result != ISC_R_SUCCESS) {
 			fatal("iterating through the database failed: %s",
@@ -123,6 +123,8 @@ options {\n\
 	tcp-initial-timeout 300;\n\
 	tcp-keepalive-timeout 300;\n\
 	tcp-listen-queue 10;\n\
+	tcp-receive-buffer 0;\n\
+	tcp-send-buffer 0;\n\
 #	tkey-dhkey <none>\n\
 #	tkey-domain <none>\n\
 #	tkey-gssapi-credential <none>\n\
@@ -133,6 +135,8 @@ options {\n\
 #	treat-cr-as-space <obsolete>;\n\
 	trust-anchor-telemetry yes;\n\
 #	use-id-pool <obsolete>;\n\
+	udp-receive-buffer 0;\n\
+	udp-send-buffer 0;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
@@ -1165,9 +1165,8 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 #endif

 	CHECK(isc_nm_listentcp(
-		named_g_netmgr, (isc_nmiface_t *)&listener->address,
-		control_newconn, listener, sizeof(controlconnection_t), 5, NULL,
-		&listener->sock));
+		named_g_netmgr, &listener->address, control_newconn, listener,
+		sizeof(controlconnection_t), 5, NULL, &listener->sock));
 #if 0
 	/* XXX: no unix socket support yet */
 	if (type == isc_socktype_unix) {
@@ -1467,6 +1466,7 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {

 	ISC_LIST_INIT(controls->listeners);

+	atomic_init(&controls->shuttingdown, false);
 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
 	result = isccc_cc_createsymtab(&controls->symtab);
@@ -432,6 +432,8 @@ OPTIONS
  	tcp-initial-timeout integer;
  	tcp-keepalive-timeout integer;
  	tcp-listen-queue integer;
+  	tcp-receive-buffer integer;
+  	tcp-send-buffer integer;
  	tkey-dhkey quoted_string integer;
  	tkey-domain quoted_string;
  	tkey-gssapi-credential quoted_string;
@@ -448,6 +450,8 @@ OPTIONS
  	transfers-per-ns integer;
  	trust-anchor-telemetry boolean; // experimental
  	try-tcp-refresh boolean;
+  	udp-receive-buffer integer;
+  	udp-send-buffer integer;
  	update-check-ksk boolean;
  	use-alt-transfer-source boolean;
  	use-v4-udp-ports { portrange; ... };
@@ -5081,8 +5081,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	/*
 	 * Copy the aclenv object.
 	 */
-	dns_aclenv_copy(&view->aclenv, ns_interfacemgr_getaclenv(
-					       named_g_server->interfacemgr));
+	dns_aclenv_copy(view->aclenv, ns_interfacemgr_getaclenv(
+					      named_g_server->interfacemgr));

 	/*
 	 * Configure the "match-clients" and "match-destinations" ACL.
@@ -7330,7 +7330,7 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, dns_name_t *keyname,
 	tat->view = NULL;
 	dns_rdataset_init(&tat->rdataset);
 	dns_rdataset_init(&tat->sigrdataset);
-	dns_name_copynf(keyname, dns_fixedname_initname(&tat->keyname));
+	dns_name_copy(keyname, dns_fixedname_initname(&tat->keyname));
 	result = get_tat_qname(dns_fixedname_initname(&tat->tatname), keyname,
 			       keynode);
 	if (result != ISC_R_SUCCESS) {
@@ -8503,6 +8503,10 @@ load_configuration(const char *filename, named_server_t *server,
 	uint32_t reserved;
 	uint32_t udpsize;
 	uint32_t transfer_message_size;
+	uint32_t recv_tcp_buffer_size;
+	uint32_t send_tcp_buffer_size;
+	uint32_t recv_udp_buffer_size;
+	uint32_t send_udp_buffer_size;
 	named_cache_t *nsc;
 	named_cachelist_t cachelist, tmpcachelist;
 	ns_altsecret_t *altsecret;
@@ -8774,6 +8778,9 @@ load_configuration(const char *filename, named_server_t *server,
 					     named_g_aclconfctx),
 	       "configuring statistics server(s)");

+	/*
+	 * Configure the network manager
+	 */
 	obj = NULL;
 	result = named_config_get(maps, "tcp-initial-timeout", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -8843,6 +8850,44 @@ load_configuration(const char *filename, named_server_t *server,
 	isc_nm_settimeouts(named_g_netmgr, initial, idle, keepalive,
 			   advertised);

+#define CAP_IF_NOT_ZERO(v, min, max)        \
+	if (v > 0 && v < min) {             \
+		recv_tcp_buffer_size = min; \
+	} else if (v > max) {               \
+		recv_tcp_buffer_size = max; \
+	}
+
+	/* Set the kernel send and receive buffer sizes */
+	obj = NULL;
+	result = named_config_get(maps, "tcp-receive-buffer", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	recv_tcp_buffer_size = cfg_obj_asuint32(obj);
+	CAP_IF_NOT_ZERO(recv_tcp_buffer_size, 4096, INT32_MAX);
+
+	obj = NULL;
+	result = named_config_get(maps, "tcp-send-buffer", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	send_tcp_buffer_size = cfg_obj_asuint32(obj);
+	CAP_IF_NOT_ZERO(send_tcp_buffer_size, 4096, INT32_MAX);
+
+	obj = NULL;
+	result = named_config_get(maps, "udp-receive-buffer", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	recv_udp_buffer_size = cfg_obj_asuint32(obj);
+	CAP_IF_NOT_ZERO(recv_udp_buffer_size, 4096, INT32_MAX);
+
+	obj = NULL;
+	result = named_config_get(maps, "udp-send-buffer", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	send_udp_buffer_size = cfg_obj_asuint32(obj);
+	CAP_IF_NOT_ZERO(send_udp_buffer_size, 4096, INT32_MAX);
+
+	isc_nm_setnetbuffers(named_g_netmgr, recv_tcp_buffer_size,
+			     send_tcp_buffer_size, recv_udp_buffer_size,
+			     send_udp_buffer_size);
+
+#undef CAP_IF_NOT_ZERO
+
 	/*
 	 * Configure sets of UDP query source ports.
 	 */
@@ -11442,7 +11487,7 @@ resume:
 				";\n; Cache dump of view '%s' (cache %s)\n;\n",
 				dctx->view->view->name,
 				dns_cache_getname(dctx->view->view->cache));
-			result = dns_master_dumptostreaminc(
+			result = dns_master_dumptostreamasync(
 				dctx->mctx, dctx->cache, NULL, style, dctx->fp,
 				dctx->task, dumpdone, dctx, &dctx->mdctx);
 			if (result == DNS_R_CONTINUE) {
@@ -11502,7 +11547,7 @@ resume:
 				goto nextzone;
 			}
 			dns_db_currentversion(dctx->db, &dctx->version);
-			result = dns_master_dumptostreaminc(
+			result = dns_master_dumptostreamasync(
 				dctx->mctx, dctx->db, dctx->version, style,
 				dctx->fp, dctx->task, dumpdone, dctx,
 				&dctx->mdctx);
@@ -15117,10 +15162,10 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	CHECK(dns_db_findnode(db, origin, false, &node));
 	dns_db_currentversion(db, &version);
 	/* Get keys from private key files. */
-	LOCK(&kasp->lock);
-	result = dns_dnssec_findmatchingkeys(origin, dir, now,
+	dns_zone_lock_keyfiles(zone);
+	result = dns_dnssec_findmatchingkeys(dns_zone_getorigin(zone), dir, now,
 					     dns_zone_getmctx(zone), &keys);
-	UNLOCK(&kasp->lock);
+	dns_zone_unlock_keyfiles(zone);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		goto cleanup;
 	}
@@ -272,8 +272,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		dns_fixedname_init(&fname);
 		if (usezone) {
-			dns_name_copynf(dns_zone_getorigin(zone),
-					dns_fixedname_name(&fname));
+			dns_name_copy(dns_zone_getorigin(zone),
+				      dns_fixedname_name(&fname));
 		} else {
 			str = cfg_obj_asstring(dname);
 			isc_buffer_constinit(&b, str, strlen(str));
@@ -1264,7 +1264,6 @@ static uint16_t
 parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	isc_result_t result;
 	char *word;
-	isc_buffer_t *namebuf = NULL;
 	isc_buffer_t source;

 	word = nsu_strsep(cmdlinep, " \t\r\n");
@@ -1275,10 +1274,6 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {

 	result = dns_message_gettempname(msg, namep);
 	check_result(result, "dns_message_gettempname");
-	isc_buffer_allocate(gmctx, &namebuf, DNS_NAME_MAXWIRE);
-	dns_name_init(*namep, NULL);
-	dns_name_setbuffer(*namep, namebuf);
-	dns_message_takebuffer(msg, &namebuf);
 	isc_buffer_init(&source, word, strlen(word));
 	isc_buffer_add(&source, strlen(word));
 	result = dns_name_fromtext(*namep, &source, dns_rootname, 0, NULL);
@@ -2073,7 +2068,6 @@ setzone(dns_name_t *zonename) {
 	if (zonename != NULL) {
 		result = dns_message_gettempname(updatemsg, &name);
 		check_result(result, "dns_message_gettempname");
-		dns_name_init(name, NULL);
 		dns_name_clone(zonename, name);
 		result = dns_message_gettemprdataset(updatemsg, &rdataset);
 		check_result(result, "dns_message_gettemprdataset");
@@ -2736,7 +2730,7 @@ lookforsoa:
 		 * address.
 		 */
 		zname = dns_fixedname_initname(&fzname);
-		dns_name_copynf(name, zname);
+		dns_name_copy(name, zname);
 	}

 	if (debugging) {
@@ -3248,7 +3242,6 @@ start_update(void) {
 	dns_rdataset_makequestion(rdataset, getzoneclass(), dns_rdatatype_soa);

 	if (userzone != NULL) {
-		dns_name_init(name, NULL);
 		dns_name_clone(userzone, name);
 	} else {
 		dns_rdataset_t *tmprdataset;
@@ -3267,7 +3260,6 @@ start_update(void) {
 		}
 		firstname = NULL;
 		dns_message_currentname(updatemsg, section, &firstname);
-		dns_name_init(name, NULL);
 		dns_name_clone(firstname, name);
 		/*
 		 * Looks to see if the first name references a DS record
@@ -600,8 +600,8 @@ rndc_startconnect(isc_sockaddr_t *addr) {
 	}

 	atomic_fetch_add_relaxed(&connects, 1);
-	isc_nm_tcpconnect(netmgr, (isc_nmiface_t *)local, (isc_nmiface_t *)addr,
-			  rndc_connected, &rndc_ccmsg, 10000, 0);
+	isc_nm_tcpconnect(netmgr, local, addr, rndc_connected, &rndc_ccmsg,
+			  60000, 0);
 }

 static void
@@ -68,23 +68,22 @@ def test_rndc_deadlock():
    test_state = {'finished': False}

    # Create 4 worker threads running "rndc" commands in a loop.
-    executor = concurrent.futures.ThreadPoolExecutor()
-    for i in range(1, 5):
-        domain = 'example%d' % i
-        executor.submit(rndc_loop, test_state, domain)
+    with concurrent.futures.ThreadPoolExecutor() as executor:
+        for i in range(1, 5):
+            domain = 'example%d' % i
+            executor.submit(rndc_loop, test_state, domain)

-    # Run "rndc status" in 1-second intervals for a maximum of 10 seconds.  If
-    # any "rndc status" command fails, the loop will be interrupted.
-    server_is_responsive = True
-    attempts = 10
-    while server_is_responsive and attempts > 0:
-        server_is_responsive = check_if_server_is_responsive()
-        attempts -= 1
-        time.sleep(1)
+        # Run "rndc status" in 1-second intervals for a maximum of 10 seconds.
+        # If any "rndc status" command fails, the loop will be interrupted.
+        server_is_responsive = True
+        attempts = 10
+        while server_is_responsive and attempts > 0:
+            server_is_responsive = check_if_server_is_responsive()
+            attempts -= 1
+            time.sleep(1)

-    # Signal worker threads that the test is finished.
-    test_state['finished'] = True
-    executor.shutdown()
+        # Signal worker threads that the test is finished.
+        test_state['finished'] = True

    # Check whether all "rndc status" commands succeeded.
    assert server_is_responsive
@@ -80,6 +80,34 @@ sub reply_handler {
 	$rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
 	push @ans, $rr;
 	$rcode = "NOERROR";
+    # The following three code branches referring to the "example.dname"
+    # zone are necessary for the resolver variant of the CVE-2021-25215
+    # regression test to work.  A named instance cannot be used for
+    # serving the DNAME records below as a version of BIND vulnerable to
+    # CVE-2021-25215 would crash while answering the queries asked by
+    # the tested resolver.
+    } elsif ($qname eq "ns3.example.dname") {
+	if ($qtype eq "A") {
+		my $rr = new Net::DNS::RR("$qname $ttl $qclass A 10.53.0.3");
+		push @ans, $rr;
+	}
+	if ($qtype eq "AAAA") {
+		my $rr = new Net::DNS::RR("example.dname. $ttl $qclass SOA . . 0 0 0 0 $ttl");
+		push @auth, $rr;
+	}
+	$rcode = "NOERROR";
+    } elsif ($qname eq "self.example.self.example.dname") {
+	my $rr = new Net::DNS::RR("self.example.dname. $ttl $qclass DNAME dname.");
+	push @ans, $rr;
+	$rr = new Net::DNS::RR("$qname $ttl $qclass CNAME self.example.dname.");
+	push @ans, $rr;
+	$rcode = "NOERROR";
+    } elsif ($qname eq "self.example.dname") {
+	if ($qtype eq "DNAME") {
+		my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME dname.");
+		push @ans, $rr;
+	}
+	$rcode = "NOERROR";
    } else {
 	$rcode = "REFUSED";
    }
@@ -24,6 +24,10 @@ ns2.example.		A	10.53.0.2
 example.broken.		NS	ns3.example.broken.
 ns3.example.broken.	A	10.53.0.3

+; for the resolver variant of the CVE-2021-25215 regression test
+example.dname.		NS	ns3.example.dname.
+ns3.example.dname.	A	10.53.0.3
+
 domain0.nil.		NS	ns2.domain0.nil
 domain1.nil.		NS	ns2.domain0.nil
 domain2.nil.		NS	ns2.domain0.nil
@@ -16,3 +16,5 @@ ns2	86400	AAAA    fd92:7065:b8e:ffff::2
@       86400	AAAA 	1:2:3::4
 *       86400	A 	1.2.3.4
 *       86400	AAAA 	1:2:3::4
+; CVE-2021-25215 regression test data
+self	86400	DNAME	nil.
@@ -295,5 +295,23 @@ grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+# Regression test for CVE-2021-25215 (authoritative server).
+n=`expr $n + 1`
+echo_i "checking DNAME resolution via itself (authoritative) ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 DNAME self.domain0.self.domain0.nil. > dig.out.2.$n 2>&1
+grep 'status: NOERROR' dig.out.2.$n > /dev/null 2>&1 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Regression test for CVE-2021-25215 (recursive resolver).
+n=`expr $n + 1`
+echo_i "checking DNAME resolution via itself (recursive) ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.7 DNAME self.example.self.example.dname. > dig.out.7.$n 2>&1
+grep 'status: NOERROR' dig.out.7.$n > /dev/null 2>&1 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key "keyforview1" {
+	algorithm "hmac-sha1";
+	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+	algorithm "hmac-sha1";
+	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+view "example1" {
+	match-clients { key "keyforview1"; };
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "default";
+		key-directory ".";
+		file "example1.db";
+	};
+};
+
+view "example2" {
+	match-clients { key "keyforview2"; };
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "insecure";
+		key-directory ".";
+		file "example2.db";
+	};
+};
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key "keyforview1" {
+	algorithm "hmac-sha1";
+	secret "YPfMoAk6h+3iN8MDRQC004iSNHY=";
+};
+
+key "keyforview2" {
+	algorithm "hmac-sha1";
+	secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
+};
+
+view "example1" {
+	match-clients { key "keyforview1"; };
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "default";
+		file "example1.db";
+	};
+};
+
+view "example2" {
+	match-clients { key "keyforview2"; };
+
+	zone "example.net" {
+		type primary;
+		dnssec-policy "insecure";
+		file "example2.db";
+	};
+};
@@ -192,7 +192,53 @@ view "fourth" {
 		file "dnssec-none.db";
 		dnssec-policy "none";
 	};
+	zone "dnssec-view1" {
+		type master;
+		file "dnssec-view41.db";
+		dnssec-policy "test";
+	};
+	zone "dnssec-view2" {
+		type master;
+		file "dnssec-view42.db";
+	};
+	zone "dnssec-view3" {
+		type master;
+		file "dnssec-view43.db";
+		dnssec-policy "none";
+		key-directory "keys";
+	};
+	zone "dnssec-view4" {
+		type master;
+		file "dnssec-view44.db";
+		dnssec-policy "none";
+	};
 	dnssec-policy "default";
+	key-directory ".";
+};
+view "fifth" {
+	zone "dnssec-view1" {
+		type master;
+		file "dnssec-view51.db";
+		dnssec-policy "test";
+	};
+	zone "dnssec-view2" {
+		type master;
+		file "dnssec-view52.db";
+		dnssec-policy "test";
+		key-directory "keys";
+	};
+	zone "dnssec-view3" {
+		type master;
+		file "dnssec-view53.db";
+		dnssec-policy "default";
+		key-directory "keys";
+	};
+	zone "dnssec-view4" {
+		type master;
+		file "dnssec-view54.db";
+		dnssec-policy "none";
+	};
+	key-directory ".";
 };
 view "chaos" chaos {
 	zone "hostname.bind" chaos {
@@ -13,4 +13,12 @@ dnssec-test IN fourth master
 dnssec-default IN fourth master
 dnssec-inherit IN fourth master
 dnssec-none IN fourth master
+dnssec-view1 IN fourth master
+dnssec-view2 IN fourth master
+dnssec-view3 IN fourth master
+dnssec-view4 IN fourth master
+dnssec-view1 IN fifth master
+dnssec-view2 IN fifth master
+dnssec-view3 IN fifth master
+dnssec-view4 IN fifth master
 hostname.bind chaos chaos master
@@ -12,6 +12,8 @@
 status=0
 n=0

+mkdir keys
+
 n=`expr $n + 1`
 echo_i "checking that named-checkconf handles a known good config ($n)"
 ret=0
@@ -549,5 +551,7 @@ grep "exceeds 100%" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

+rmdir keys
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -229,7 +229,7 @@ syncptr(sample_instance_t *inst, dns_name_t *name, dns_rdata_t *addr_rdata,
 	/* Reverse zone is managed by this driver, prepare PTR record */
 	pevent->zone = NULL;
 	dns_zone_attach(ptr_zone, &pevent->zone);
-	dns_name_copynf(name, dns_fixedname_name(&pevent->ptr_target_name));
+	dns_name_copy(name, dns_fixedname_name(&pevent->ptr_target_name));
 	dns_name_clone(dns_fixedname_name(&pevent->ptr_target_name),
 		       &ptr_struct.ptr);
 	dns_diff_init(inst->mctx, &pevent->diff);
@@ -108,7 +108,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

 n=$((n+1))
-echo_i "testing AXFR fallback after IXFR failure ($n)"
+echo_i "testing AXFR fallback after IXFR failure (not exact error) ($n)"
 ret=0

 # Provide a broken IXFR response and a working fallback AXFR response
@@ -142,6 +142,66 @@ $DIG $DIGOPTS @10.53.0.1 nil. TXT | grep 'fallback AXFR' >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

+n=$((n+1))
+echo_i "testing AXFR fallback after IXFR failure (bad SOA owner) ($n)"
+ret=0
+
+# Prepare for checking the logs later on.
+nextpart ns1/named.run >/dev/null
+
+# Provide a broken IXFR response and a working fallback AXFR response.
+sendcmd <<EOF
+/SOA/
+nil.      	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
+/IXFR/
+nil.      	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
+nil.      	300	SOA	ns.nil. root.nil. 3 300 300 604800 300
+bad-owner.    	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
+test.nil.	300	TXT	"serial 4, malformed IXFR"
+nil.      	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
+/AXFR/
+nil.      	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
+/AXFR/
+nil.      	300	NS	ns.nil.
+test.nil.      	300	TXT	"serial 4, fallback AXFR"
+/AXFR/
+nil.      	300	SOA	ns.nil. root.nil. 4 300 300 604800 300
+EOF
+$RNDCCMD 10.53.0.1 refresh nil | sed 's/^/ns1 /' | cat_i
+
+# A broken server would accept the malformed IXFR and apply its contents to the
+# zone.  A fixed one would reject the IXFR and fall back to AXFR.  Both IXFR and
+# AXFR above bring the nil. zone up to serial 4, but we cannot reliably query
+# for the SOA record to check whether the transfer was finished because a broken
+# server would send back SERVFAIL responses to SOA queries after accepting the
+# malformed IXFR.  Instead, check transfer progress by querying for a TXT record
+# at test.nil. which is present in both IXFR and AXFR (with different contents).
+_wait_until_transfer_is_finished() {
+	$DIG $DIGOPTS +tries=1 +time=1 @10.53.0.1 test.nil. TXT > dig.out.test$n.1 &&
+	grep -q -F "serial 4" dig.out.test$n.1
+}
+if ! retry_quiet 10 _wait_until_transfer_is_finished; then
+	echo_i "timed out waiting for version 4 of zone nil. to be transferred"
+	ret=1
+fi
+
+# At this point a broken server would be serving a zone with no SOA records.
+# Try crashing it by triggering a SOA refresh query.
+$RNDCCMD 10.53.0.1 refresh nil | sed 's/^/ns1 /' | cat_i
+
+# Do not wait until the zone refresh completes - even if a crash has not
+# happened by now, a broken server would never serve the record which is only
+# present in the fallback AXFR, so checking for that is enough to verify if a
+# server is broken or not; if it is, it is bound to crash shortly anyway.
+$DIG $DIGOPTS test.nil. TXT @10.53.0.1 > dig.out.test$n.2 || ret=1
+grep -q -F "serial 4, fallback AXFR" dig.out.test$n.2 || ret=1
+
+# Ensure the expected error is logged.
+nextpart ns1/named.run | grep -q -F "SOA name mismatch" || ret=1
+
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 n=$((n+1))
 echo_i "testing ixfr-from-differences option ($n)"
 # ns3 is primary; ns4 is secondary
@@ -251,12 +311,25 @@ $DIG $DIGOPTS ixfr=1 +notcp test @10.53.0.4 > dig.out2.test$n || ret=1
 digcomp dig.out1.test$n dig.out2.test$n || ret=1
 awk '$4 == "SOA" { soacnt++} END {if (soacnt == 1) exit(0); else exit(1);}' dig.out1.test$n || ret=1
 awk '$4 == "SOA" { if ($7 == 3) exit(0); else exit(1);}' dig.out1.test$n || ret=1
+#
+nextpart ns4/named.run > /dev/null
 # Should be incremental transfer.
 $DIG $DIGOPTS ixfr=1 test @10.53.0.4 > dig.out3.test$n || ret=1
 awk '$4 == "SOA" { soacnt++} END { if (soacnt == 6) exit(0); else exit(1);}' dig.out3.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

+n=$((n+1))
+echo_i "check estimated IXFR size ($n)"
+ret=0
+# note IXFR delta size will be slightly bigger with version 1 transaction
+# headers as there is no correction for the overall record length storage.
+# Ver1 = 4 * (6 + 10 + 10 + 17 + 5 * 4) + 2 * (13 + 10 + 4) + (6 * 4) = 330
+# Ver2 = 4 * (6 + 10 + 10 + 17 + 5 * 4) + 2 * (13 + 10 + 4) = 306
+nextpart ns4/named.run | grep "IXFR delta size (306 bytes)" > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 # make sure ns5 has transfered the zone
 # wait for secondary to reload
 tret=0
@@ -167,7 +167,6 @@ sendquery(isc_task_t *task) {
 	result = dns_message_gettemprdataset(message, &qrdataset);
 	CHECK("dns_message_gettemprdataset", result);

-	dns_name_init(qname, NULL);
 	dns_name_clone(dns_fixedname_name(&queryname), qname);
 	dns_rdataset_makequestion(qrdataset, dns_rdataclass_in,
 				  dns_rdatatype_a);
@@ -93,6 +93,11 @@ ctxs_init(void) {
 	isc_managers_create(ctxs_mctx, 1, 0, 0, &ctxs_netmgr, &ctxs_taskmgr,
 			    &ctxs_timermgr, &ctxs_socketmgr);

+	result = isc_app_ctxstart(ctxs_actx);
+	if (result != ISC_R_SUCCESS) {
+		goto fail;
+	}
+
 	return (ISC_R_SUCCESS);

 fail:
@@ -16,7 +16,14 @@ $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 >ns2/other.db
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 >ns2/static.db

 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 >ns6/huge.zone.db
-awk 'END { for (i = 1; i <= 1000000; i++)
+
+# we make the huge zone less huge if we're running under
+# TSAN, to give the test a fighting chance not to time out.
+size=1000000
+if $FEATURETEST --tsan; then
+    size=250000
+fi
+awk 'END { for (i = 1; i <= '${size}'; i++)
     printf "host%d IN A 10.53.0.6\n", i; }' < /dev/null >> ns6/huge.zone.db

 copy_setports ns2/named.conf.in ns2/named.conf
@@ -18,7 +18,7 @@ RNDCCMD="$RNDC -p ${CONTROLPORT} -c ../common/rndc.conf -s"
 status=0
 n=0

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "preparing ($n)"
 ret=0
 $NSUPDATE -p ${PORT} -k ns2/session.key > /dev/null 2>&1 <<END || ret=1
@@ -37,12 +37,12 @@ END
 	echo_i "'test -s ns2/other.db.jnl' failed when it shouldn't have"; ret=1;
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 echo_i "rndc freeze"
 $RNDCCMD 10.53.0.2 freeze | sed 's/^/ns2 /' | cat_i | cat_i

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking zone was dumped ($n)"
 ret=0
 for i in 1 2 3 4 5 6 7 8 9 10
@@ -52,18 +52,18 @@ do
 done
 grep "addition 1" ns2/nil.db > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking journal file is still present ($n)"
 ret=0
 [ -s ns2/nil.db.jnl ] || {
 	echo_i "'test -s ns2/nil.db.jnl' failed when it shouldn't have"; ret=1;
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking zone not writable ($n)"
 ret=0
 $NSUPDATE -p ${PORT} -k ns2/session.key > /dev/null 2>&1 <<END && ret=1
@@ -76,12 +76,12 @@ END
 $DIGCMD text2.nil. TXT > dig.out.1.test$n
 grep 'addition 2' dig.out.1.test$n >/dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 echo_i "rndc thaw"
 $RNDCCMD 10.53.0.2 thaw | sed 's/^/ns2 /' | cat_i

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking zone now writable ($n)"
 ret=0
 $NSUPDATE -p ${PORT} -k ns2/session.key > nsupdate.out.1.test$n 2>&1 <<END || ret=1
@@ -93,13 +93,13 @@ END
 $DIGCMD text3.nil. TXT > dig.out.1.test$n
 grep 'addition 3' dig.out.1.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 echo_i "rndc sync"
 ret=0
 $RNDCCMD 10.53.0.2 sync nil | sed 's/^/ns2 /' | cat_i

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking zone was dumped ($n)"
 ret=0
 for i in 1 2 3 4 5 6 7 8 9 10
@@ -109,18 +109,18 @@ do
 done
 grep "addition 3" ns2/nil.db > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking journal file is still present ($n)"
 ret=0
 [ -s ns2/nil.db.jnl ] || {
 	echo_i "'test -s ns2/nil.db.jnl' failed when it shouldn't have"; ret=1;
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking zone is still writable ($n)"
 ret=0
 $NSUPDATE -p ${PORT} -k ns2/session.key > nsupdate.out.1.test$n 2>&1 <<END || ret=1
@@ -133,13 +133,13 @@ END
 $DIGCMD text4.nil. TXT > dig.out.1.test$n
 grep 'addition 4' dig.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 echo_i "rndc sync -clean"
 ret=0
 $RNDCCMD 10.53.0.2 sync -clean nil | sed 's/^/ns2 /' | cat_i

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking zone was dumped ($n)"
 ret=0
 for i in 1 2 3 4 5 6 7 8 9 10
@@ -149,18 +149,18 @@ do
 done
 grep "addition 4" ns2/nil.db > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking journal file is deleted ($n)"
 ret=0
 [ -s ns2/nil.db.jnl ] && {
 	echo_i "'test -s ns2/nil.db.jnl' failed when it shouldn't have"; ret=1;
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking zone is still writable ($n)"
 ret=0
 $NSUPDATE -p ${PORT} -k ns2/session.key > /dev/null 2>&1 <<END || ret=1
@@ -173,21 +173,21 @@ END
 $DIGCMD text4.nil. TXT > dig.out.1.test$n
 grep 'addition 4' dig.out.1.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking other journal files not removed ($n)"
 ret=0
 [ -s ns2/other.db.jnl ] || {
 	echo_i "'test -s ns2/other.db.jnl' failed when it shouldn't have"; ret=1;
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 echo_i "cleaning all zones ($n)"
 $RNDCCMD 10.53.0.2 sync -clean | sed 's/^/ns2 /' | cat_i

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking all journals removed ($n)"
 ret=0
 [ -s ns2/nil.db.jnl ] && {
@@ -197,17 +197,17 @@ ret=0
 	echo_i "'test -s ns2/other.db.jnl' succeeded when it shouldn't have"; ret=1;
 }
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking that freezing static zones is not allowed ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 freeze static > rndc.out.1.test$n 2>&1
 grep 'not dynamic' rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking that journal is removed when serial is changed before thaw ($n)"
 ret=0
 sleep 1
@@ -227,7 +227,7 @@ do
 	sleep 1
 done
 serial=`awk '$3 ~ /serial/ {print $1}' ns2/other.db`
-newserial=`expr $serial + 1`
+newserial=$((serial + 1))
 sed s/$serial/$newserial/ ns2/other.db > ns2/other.db.new
 echo 'frozen TXT "frozen addition"' >> ns2/other.db.new
 mv -f ns2/other.db.new ns2/other.db
@@ -249,9 +249,9 @@ grep 'addition 7' dig.out.2.test$n >/dev/null || ret=1
 $DIGCMD frozen.other. TXT > dig.out.3.test$n
 grep 'frozen addition' dig.out.3.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "checking that journal is kept when ixfr-from-differences is in use ($n)"
 ret=0
 $NSUPDATE -p ${PORT} -k ns2/session.key > nsupdate.out.1.test$n 2>&1 <<END || ret=1
@@ -270,7 +270,7 @@ do
 	sleep 1
 done
 serial=`awk '$3 ~ /serial/ {print $1}' ns2/nil.db`
-newserial=`expr $serial + 1`
+newserial=$((serial + 1))
 sed s/$serial/$newserial/ ns2/nil.db > ns2/nil.db.new
 echo 'frozen TXT "frozen addition"' >> ns2/nil.db.new
 mv -f ns2/nil.db.new ns2/nil.db
@@ -292,32 +292,32 @@ grep 'addition 7' dig.out.2.test$n > /dev/null || ret=1
 $DIGCMD frozen.nil. TXT > dig.out.3.test$n
 grep 'frozen addition' dig.out.3.test$n >/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 # temp test
 echo_i "dumping stats ($n)"
 $RNDCCMD 10.53.0.2 stats
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "verifying adb records in named.stats ($n)"
 grep "ADB stats" ns2/named.stats > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "test using second key ($n)"
 ret=0
 $RNDC -s 10.53.0.2 -p ${CONTROLPORT} -c ns2/secondkey.conf status > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "test 'rndc dumpdb' on a empty cache ($n)"
 ret=0
 rndc_dumpdb ns3 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "test 'rndc reload' on a zone with include files ($n)"
 ret=0
 grep "incl/IN: skipping load" ns2/named.run > /dev/null && ret=1
@@ -344,9 +344,9 @@ do
 done
 [ $tmp -eq 1 ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc with hmac-md5 ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
@@ -355,9 +355,9 @@ do
        $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc with hmac-sha1 ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT2} -c ns4/key2.conf status > /dev/null 2>&1 || ret=1
@@ -366,9 +366,9 @@ do
        $RNDC -s 10.53.0.4 -p ${EXTRAPORT2} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc with hmac-sha224 ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT3} -c ns4/key3.conf status > /dev/null 2>&1 || ret=1
@@ -377,9 +377,9 @@ do
        $RNDC -s 10.53.0.4 -p ${EXTRAPORT3} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc with hmac-sha256 ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT4} -c ns4/key4.conf status > /dev/null 2>&1 || ret=1
@@ -388,9 +388,9 @@ do
        $RNDC -s 10.53.0.4 -p ${EXTRAPORT4} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc with hmac-sha384 ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT5} -c ns4/key5.conf status > /dev/null 2>&1 || ret=1
@@ -399,9 +399,9 @@ do
        $RNDC -s 10.53.0.4 -p ${EXTRAPORT5} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc with hmac-sha512 ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf status > /dev/null 2>&1 || ret=1
@@ -410,32 +410,32 @@ do
        $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key${i}.conf status > /dev/null 2>&1 2>&1 && ret=1
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing automatic zones are reported ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf status > rndc.out.1.test$n || ret=1
 grep "number of zones: 200 (198 automatic)" rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc with null command ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc with unknown control channel command ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf obviouslynotacommand >/dev/null 2>&1 && ret=1
 # rndc: 'obviouslynotacommand' failed: unknown command
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc with querylog command ($n)"
 ret=0
 # first enable it with querylog on option
@@ -460,10 +460,10 @@ grep "query logging is now off" ns4/named.run > /dev/null || ret=1
 $DIG @10.53.0.4 -p ${PORT} -c ch -t txt foo9876.bind > /dev/null || ret=1
 grep "query: foo9876.bind CH TXT.*(.*)$" ns4/named.run > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 RNDCCMD4="$RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf"
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc nta time limits ($n)"
 ret=0
 $RNDCCMD4 nta -l 2h nta1.example > rndc.out.1.test$n 2>&1
@@ -475,9 +475,9 @@ grep "Negative trust anchor added" rndc.out.3.test$n > /dev/null || ret=1
 $RNDCCMD4 nta -l 8d nta4.example > rndc.out.4.test$n 2>&1
 grep "NTA lifetime cannot exceed one week" rndc.out.4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc nta -class option ($n)"
 ret=0
 nextpart ns4/named.run > /dev/null
@@ -491,43 +491,43 @@ $RNDCCMD4 nta -c fake nta1.example > rndc.out.4.test$n 2>&1
 nextpart ns4/named.run | grep "added NTA 'nta1.example'" > /dev/null && ret=1
 grep 'unknown class' rndc.out.4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 for i in 512 1024 2048 4096 8192 16384 32768 65536 131072 262144 524288
 do
-	n=`expr $n + 1`
+        n=$((n+1))
 	echo_i "testing rndc buffer size limits (size=${i}) ($n)"
 	ret=0
 	$RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf testgen ${i} 2>&1 > rndc.out.$i.test$n || ret=1
 	actual_size=`$GENCHECK rndc.out.$i.test$n`
 	if [ "$?" = "0" ]; then
-	    expected_size=`expr $i + 1`
+            expected_size=$((i+1))
 	    if [ $actual_size != $expected_size ]; then ret=1; fi
 	else
 	    ret=1
 	fi

 	if [ $ret != 0 ]; then echo_i "failed"; fi
-	status=`expr $status + $ret`
+        status=$((status+ret))
 done

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc -r (show result) ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf -r testgen 0 2>&1 > rndc.out.1.test$n || ret=1
 grep "ISC_R_SUCCESS 0" rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "testing rndc with a token containing a space ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf -r flush '"view with a space"' 2>&1 > rndc.out.1.test$n || ret=1
 grep "not found" rndc.out.1.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "test 'rndc reconfig' with a broken config ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf reconfig > /dev/null || ret=1
@@ -537,17 +537,17 @@ echo "error error error" >> ns4/named.conf
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf reconfig > rndc.out.1.test$n 2>&1 && ret=1
 grep "rndc: 'reconfig' failed: unexpected token" rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check rndc status reports failure ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf status > rndc.out.1.test$n 2>&1 || ret=1
 grep "reload/reconfig failed" rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "restore working config ($n)"
 ret=0
 mv ns4/named.conf.save ns4/named.conf
@@ -555,129 +555,120 @@ sleep 1
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf reconfig > /dev/null || ret=1
 sleep 1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check 'rndc status' 'reload/reconfig failure' is cleared after successful reload/reconfig ($n)"
 ret=0
 $RNDC -s 10.53.0.4 -p ${EXTRAPORT6} -c ns4/key6.conf status > rndc.out.1.test$n 2>&1 || ret=1
 grep "reload/reconfig failed" rndc.out.1.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "test read-only control channel access ($n)"
 ret=0
 $RNDCCMD 10.53.0.5 status > rndc.out.1.test$n 2>&1 || ret=1
 $RNDCCMD 10.53.0.5 nta -dump > rndc.out.2.test$n 2>&1 || ret=1
 $RNDCCMD 10.53.0.5 reconfig > rndc.out.3.test$n 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "test rndc status shows running on ($n)"
 ret=0
 $RNDCCMD 10.53.0.5 status > rndc.out.1.test$n 2>&1 || ret=1
 grep "^running on " rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "test 'rndc reconfig' with loading of a large zone ($n)"
 ret=0
-cur=`awk 'BEGIN {l=0} /^/ {l++} END { print l }' ns6/named.run`
+nextpart ns6/named.run > /dev/null
 cp ns6/named.conf ns6/named.conf.save
 echo "zone \"huge.zone\" { type primary; file \"huge.zone.db\"; };" >> ns6/named.conf
 echo_i "reloading config"
 $RNDCCMD 10.53.0.6 reconfig > rndc.out.1.test$n 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))
 sleep 1
-n=`expr $n + 1`
-echo_i "check if zone load was scheduled ($n)"
-grep "scheduled loading new zones" ns6/named.run > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`

-n=`expr $n + 1`
+n=$((n+1))
+echo_i "check if zone load was scheduled ($n)"
+wait_for_log_peek 20 "scheduled loading new zones" ns6/named.run || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
 echo_i "check if query for the zone returns SERVFAIL ($n)"
 $DIG @10.53.0.6 -p ${PORT} -t soa huge.zone > dig.out.1.test$n
 grep "SERVFAIL" dig.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed (ignored)"; ret=0; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "wait for the zones to be loaded ($n)"
-ret=1
-try=0
-while test $try -lt 180
-do
-    sleep 1
-    sed -n "$cur,"'$p' < ns6/named.run | grep "any newly configured zones are now loaded" > /dev/null && {
-        ret=0
-        break
-    }
-    try=`expr $try + 1`
-done
+wait_for_log_peek 60 "huge.zone/IN: loaded serial" ns6/named.run || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check if query for the zone returns NOERROR ($n)"
 $DIG @10.53.0.6 -p ${PORT} -t soa huge.zone > dig.out.1.test$n
 grep "NOERROR" dig.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "verify that the full command is logged ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 null with extra arguments > /dev/null 2>&1
 grep "received control channel command 'null with extra arguments'" ns2/named.run > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 mv ns6/named.conf.save ns6/named.conf
 sleep 1
 $RNDCCMD 10.53.0.6 reconfig > /dev/null || ret=1
 sleep 1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check 'rndc \"\"' is handled ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 "" > rndc.out.1.test$n 2>&1 && ret=1
 grep "rndc: '' failed: failure" rndc.out.1.test$n > /dev/null
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check rndc -4 -6 ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 -4 -6 status > rndc.out.1.test$n 2>&1 && ret=1
 grep "only one of -4 and -6 allowed" rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check rndc -4 with an IPv6 server address ($n)"
 ret=0
 $RNDCCMD fd92:7065:b8e:ffff::2 -4 status > rndc.out.1.test$n 2>&1 && ret=1
 grep "address family not supported" rndc.out.1.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check rndc nta reports adding to multiple views ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 nta test.com > rndc.out.test$n 2>&1 || ret=1
 lines=`cat rndc.out.test$n | wc -l`
 [ ${lines:-0} -eq 2 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check 'rndc retransfer' of primary error message ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 retransfer nil > rndc.out.test$n 2>&1 && ret=1
@@ -686,7 +677,7 @@ grep "retransfer: inappropriate zone type: primary" rndc.out.test$n > /dev/null
 lines=`cat rndc.out.test$n | wc -l`
 [ ${lines:-0} -eq 2 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status+ret))

 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -70,7 +70,7 @@ if ! $do_run; then
    if [ "$baseport" -eq 0 ]; then
        log_flags="$log_flags -p 5300"
    fi
-    env - SLOT="$SLOT" SOFTHSM2_CONF="$SOFTHSM2_CONF" PATH="$PATH" ${LD_LIBRARY_PATH:+"LD_LIBRARY_PATH=${LD_LIBRARY_PATH}"} TESTS="$*" TEST_SUITE_LOG=run.log LOG_DRIVER_FLAGS="--verbose yes --color-tests yes" LOG_FLAGS="$log_flags" make -e check
+    env - CYGWIN="$CYGWIN" SYSTEMTEST_FORCE_COLOR="$SYSTEMTEST_FORCE_COLOR" SYSTEMTEST_NO_CLEAN="$SYSTEMTEST_NO_CLEAN" SLOT="$SLOT" SOFTHSM2_CONF="$SOFTHSM2_CONF" PATH="$PATH" ${LD_LIBRARY_PATH:+"LD_LIBRARY_PATH=${LD_LIBRARY_PATH}"} TESTS="$*" TEST_SUITE_LOG=run.log LOG_DRIVER_FLAGS="--verbose yes --color-tests yes" LOG_FLAGS="$log_flags" make -e check
    exit $?
 fi

@@ -26,7 +26,12 @@ sub rmpid { unlink "ans.pid"; exit 1; };
 $SIG{INT} = \&rmpid;
 $SIG{TERM} = \&rmpid;

+# If send_response is set, the server will respond, otherwise the query will
+# be dropped.
 my $send_response = 1;
+# If slow_response is set, a lookup for the CNAME target (target.example) is
+# delayed. Other lookups will not be delayed.
+my $slow_response = 0;

 my $localaddr = "10.53.0.2";

@@ -49,6 +54,8 @@ my $TXT = "data.example 2 IN TXT \"A text record with a 2 second ttl\"";
 my $LONGTXT = "longttl.example 600 IN TXT \"A text record with a 600 second ttl\"";
 my $CAA = "othertype.example 2 IN CAA 0 issue \"ca1.example.net\"";
 my $negSOA = "example 2 IN SOA . . 0 0 0 0 300";
+my $CNAME = "cname.example 7 IN CNAME target.example";
+my $TARGET = "target.example 9 IN A $localaddr";

 sub reply_handler {
    my ($qname, $qclass, $qtype) = @_;
@@ -75,6 +82,15 @@ sub reply_handler {
 	}
 	$rcode = "NOERROR";
        return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
+    } elsif ($qname eq "slowdown" ) {
+	if ($qtype eq "TXT") {
+	    $send_response = 1;
+	    $slow_response = 1;
+            my $rr = new Net::DNS::RR("$qname 0 $qclass TXT \"$send_response\"");
+            push @ans, $rr;
+	}
+	$rcode = "NOERROR";
+        return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
    }

    # If we are not responding to queries we are done.
@@ -117,6 +133,37 @@ sub reply_handler {
 	    push @auth, $rr;
 	}
 	$rcode = "NOERROR";
+    } elsif ($qname eq "a-only.example") {
+	if ($qtype eq "A") {
+	    my $rr = new Net::DNS::RR("a-only.example 2 IN A $localaddr");
+	    push @ans, $rr;
+	} else {
+	    my $rr = new Net::DNS::RR($negSOA);
+	    push @auth, $rr;
+	}
+	$rcode = "NOERROR";
+    } elsif ($qname eq "cname.example") {
+	if ($qtype eq "A") {
+	    my $rr = new Net::DNS::RR($CNAME);
+	    push @ans, $rr;
+	} else {
+	    my $rr = new Net::DNS::RR($negSOA);
+	    push @auth, $rr;
+	}
+	$rcode = "NOERROR";
+    } elsif ($qname eq "target.example") {
+	if ($slow_response) {
+                print "  Sleeping 3 seconds\n";
+		sleep(3);
+	}
+	if ($qtype eq "A") {
+	    my $rr = new Net::DNS::RR($TARGET);
+	    push @ans, $rr;
+	} else {
+	    my $rr = new Net::DNS::RR($negSOA);
+	    push @auth, $rr;
+	}
+	$rcode = "NOERROR";
    } elsif ($qname eq "longttl.example") {
 	if ($qtype eq "TXT") {
 	    my $rr = new Net::DNS::RR($LONGTXT);
@@ -7,7 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-rm -f dig.out.test*
+rm -f dig.out*
 rm -f ns*/named.conf
 rm -f ns*/root.bk
 rm -f rndc.out.test*
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+	stale-answer-enable yes;
+	stale-cache-enable yes;
+	stale-answer-client-timeout 1800;
+	prefetch 2 8;
+	dns64 2001:aaaa::/96 {
+		clients { any; };
+		mapped { any; };
+	};
+};
+
+zone "." {
+	type secondary;
+	primaries { 10.53.0.1; };
+	file "root.bk";
+};
@@ -14,6 +14,6 @@
 $SHELL clean.sh

 copy_setports ns1/named1.conf.in ns1/named.conf
-copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns3/named1.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
@@ -19,6 +19,7 @@ stale_answer_ttl=$(sed -ne 's,^[[:space:]]*stale-answer-ttl \([[:digit:]]*\).*,\

 status=0
 n=0
+
 #
 # First test server with serve-stale options set.
 #
@@ -1617,7 +1618,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

 n=$((n+1))
-echo_i "prime cache data.example (stale-answer-client-timeout)"
+echo_i "prime cache data.example (stale-answer-client-timeout) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1626,7 +1627,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

 n=$((n+1))
-echo_i "prime cache nodata.example (stale-answer-client-timeout)"
+echo_i "prime cache nodata.example (stale-answer-client-timeout) ($n)"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
@@ -1646,6 +1647,8 @@ status=$((status+ret))
 # Allow RRset to become stale.
 sleep 2

+nextpart ns3/named.run > /dev/null
+
 echo_i "sending queries for tests $((n+1))-$((n+2))..."
 t1=`$PERL -e 'print time()'`
 $DIG -p ${PORT} +tries=1 +timeout=10  @10.53.0.3 data.example TXT > dig.out.test$((n+1)) &
@@ -1657,27 +1660,73 @@ t2=`$PERL -e 'print time()'`
 # That should give us enough time to receive an stale answer from cache
 # after stale-answer-client-timeout timer of 1.8 sec triggers.
 n=$((n+1))
-echo_i "check stale data.example comes from cache (default stale-answer-client-timeout) ($n)"
-nextpart ns3/named.run > /dev/null
-wait_for_log 5 "data.example client timeout, stale answer used" ns3/named.run || ret=1
+echo_i "check stale data.example comes from cache (stale-answer-client-timeout 1.8) ($n)"
 ret=0
+wait_for_log 5 "data.example client timeout, stale answer used" ns3/named.run || ret=1
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
 grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
-# Default stale-answer-client-timeout is 1.8s, we allow some extra time
+# Configured stale-answer-client-timeout is 1.8s, we allow some extra time
 # just in case other tests are taking too much cpu.
 [ $((t2 - t1)) -le 10 ] || { echo_i "query took $((t2 - t1))s to resolve.";  ret=1; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

 n=$((n+1))
-echo_i "check stale nodata.example comes from cache (default stale-answer-client-timeout) ($n)"
+echo_i "check stale nodata.example comes from cache (stale-answer-client-timeout 1.8) ($n)"
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 grep "example\..*3.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

+# Now query for RRset not in cache. The first query should time out, but once
+# we enable the authoritative server, the second query should be able to get a
+# response.
+
+nextpart ns3/named.run > /dev/null
+
+echo_i "sending queries for tests $((n+2))-$((n+3))..."
+$DIG -p ${PORT} +tries=1 +timeout=3   @10.53.0.3 longttl.example TXT > dig.out.test$((n+2)) &
+$DIG -p ${PORT} +tries=1 +timeout=10  @10.53.0.3 longttl.example TXT > dig.out.test$((n+3)) &
+
+# Enable the authoritative name server after stale-answer-client-timeout.
+n=$((n+1))
+echo_i "enable responses from authoritative server ($n)"
+ret=0
+sleep 3
+$DIG -p ${PORT} @10.53.0.2 txt enable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check not in cache longttl.example times out (stale-answer-client-timeout 1.8) ($n)"
+ret=0
+wait_for_log 3 "longttl.example client timeout, stale answer unavailable" ns3/named.run || ret=1
+check_results() {
+    [ -s "$1" ] || return 1
+    grep "connection timed out" "$1" > /dev/null || return 1
+    return 0
+}
+retry_quiet 3 check_results dig.out.test$n || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check not in cache longttl.example comes from authoritative (stale-answer-client-timeout 1.8) ($n)"
+ret=0
+check_results() {
+    [ -s "$1" ] || return 1
+    grep "status: NOERROR" "$1" > /dev/null || return 1
+    grep "ANSWER: 1," "$1" > /dev/null || return 1
+    return 0
+}
+retry_quiet 7 check_results dig.out.test$n || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 #############################################
 # Test for stale-answer-client-timeout off. #
 #############################################
@@ -2198,5 +2247,106 @@ grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

+n=$((n+1))
+echo_i "check DNS64 processing of a stale negative answer ($n)"
+ret=0
+# configure ns3 with dns64
+copy_setports ns3/named8.conf.in ns3/named.conf
+rndc_reload ns3 10.53.0.3
+# flush cache, enable ans2 responses, make sure serve-stale is on
+$RNDCCMD 10.53.0.3 flush > rndc.out.test$n.1 2>&1 || ret=1
+$DIG -p ${PORT} @10.53.0.2 txt enable > /dev/null
+$RNDCCMD 10.53.0.3 serve-stale on > rndc.out.test$n.2 2>&1 || ret=1
+# prime the cache with an AAAA NXRRSET response
+$DIG -p ${PORT} @10.53.0.3 a-only.example AAAA > dig.out.1.test$n
+grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
+grep "2001:aaaa" dig.out.1.test$n > /dev/null || ret=1
+# disable responses from the auth server
+$DIG -p ${PORT} @10.53.0.2 txt disable > /dev/null
+# wait two seconds for the previous answer to become stale
+sleep 2
+# resend the query and wait in the background; we should get a stale answer
+$DIG -p ${PORT} @10.53.0.3 a-only.example AAAA > dig.out.2.test$n &
+# re-enable queries after a pause, so the server gets a real answer too
+sleep 2
+$DIG -p ${PORT} @10.53.0.2 txt enable > /dev/null
+wait
+grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
+grep "2001:aaaa" dig.out.2.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+###########################################################
+# Test serve-stale's interaction with prefetch processing #
+###########################################################
+echo_i "test serve-stale's interaction with prefetch processing"
+
+# Test case for #2733, ensuring that prefetch queries do not trigger
+# a lookup due to stale-answer-client-timeout.
+#
+# 1. Cache the following records:
+#    cname.example 7 IN CNAME target.example.
+#    target.example 9 IN A <addr>.
+# 2. Let the CNAME RRset expire.
+# 3. Query for 'cname.example/A'.
+#
+# This starts recursion because cname.example/CNAME is expired.
+# The authoritative server is up so likely it will respond before
+#  stale-answer-client-timeout is triggered.
+# The 'target.example/A' RRset is found in cache with a positive value
+#  and is eligble for prefetching.
+# A prefetch is done for 'target.example/A', our ans2 server will
+#  delay the request.
+# The 'prefetch_done()' callback should have the right event type
+#  (DNS_EVENT_FETCHDONE).
+
+# flush cache
+n=$((n+1))
+echo_i "flush cache ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 flushtree example > rndc.out.test$n.1 2>&1 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# prime the cache with CNAME and A; CNAME expires sooner
+n=$((n+1))
+echo_i "prime cache cname.example (stale-answer-client-timeout 1.8) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 cname.example A > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "cname\.example\..*7.*IN.*CNAME.*target\.example\." dig.out.test$n > /dev/null || ret=1
+grep "target\.example\..*9.*IN.*A" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# wait for the CNAME to be stale; A will still be valid and in prefetch window.
+# (the longer TTL is needed, otherwise data won't be prefetch-eligible.)
+sleep 7
+
+# re-enable auth responses, but with a delay answering the A
+n=$((n+1))
+echo_i "delay responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt slowdown  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# resend the query and wait in the background; we should get a stale answer
+n=$((n+1))
+echo_i "check prefetch processing of a stale CNAME target ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 cname.example A > dig.out.test$n &
+sleep 2
+wait
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
+grep "cname\.example\..*7.*IN.*CNAME.*target\.example\." dig.out.test$n > /dev/null || ret=1
+grep "target\.example\..*[1-2].*IN.*A" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -65,65 +65,64 @@ def do_work(named_proc, resolver, rndc_cmd, kill_method, n_workers, n_queries):

    # We're going to execute queries in parallel by means of a thread pool.
    # dnspython functions block, so we need to circunvent that.
-    executor = ThreadPoolExecutor(n_workers + 1)
+    with ThreadPoolExecutor(n_workers + 1) as executor:

-    # Helper dict, where keys=Future objects and values are tags used
-    # to process results later.
-    futures = {}
+        # Helper dict, where keys=Future objects and values are tags used
+        # to process results later.
+        futures = {}

-    # 50% of work will be A queries.
-    # 1 work will be rndc stop.
-    # Remaining work will be rndc status (so we test parallel control
-    #  connections that were crashing named).
-    shutdown = True
-    for i in range(n_queries):
-        if i < (n_queries // 2):
-            # Half work will be standard A queries.
-            # Among those we split 50% queries relname='www',
-            # 50% queries relname=random characters
-            if random.randrange(2) == 1:
-                tag = "good"
-                relname = "www"
+        # 50% of work will be A queries.
+        # 1 work will be rndc stop.
+        # Remaining work will be rndc status (so we test parallel control
+        #  connections that were crashing named).
+        shutdown = True
+        for i in range(n_queries):
+            if i < (n_queries // 2):
+                # Half work will be standard A queries.
+                # Among those we split 50% queries relname='www',
+                # 50% queries relname=random characters
+                if random.randrange(2) == 1:
+                    tag = "good"
+                    relname = "www"
+                else:
+                    tag = "bad"
+                    length = random.randint(4, 10)
+                    relname = "".join(letters[
+                        random.randrange(len(letters))] for i in range(length))
+
+                qname = relname + ".test"
+                futures[executor.submit(resolver.query, qname, 'A')] = tag
+            elif shutdown:  # We attempt to stop named in the middle
+                shutdown = False
+                if kill_method == "rndc":
+                    futures[executor.submit(launch_rndc, ['stop'])] = 'stop'
+                else:
+                    futures[executor.submit(named_proc.terminate)] = 'kill'
            else:
-                tag = "bad"
-                length = random.randint(4, 10)
-                relname = "".join(letters[
-                    random.randrange(len(letters))] for i in range(length))
+                # We attempt to send couple rndc commands while named is
+                # being shutdown
+                futures[executor.submit(launch_rndc, ['status'])] = 'status'

-            qname = relname + ".test"
-            futures[executor.submit(resolver.query, qname, 'A')] = tag
-        elif shutdown:  # We attempt to stop named in the middle
-            shutdown = False
-            if kill_method == "rndc":
-                futures[executor.submit(launch_rndc, ['stop'])] = 'stop'
-            else:
-                futures[executor.submit(named_proc.terminate)] = 'kill'
+        ret_code = -1
+        for future in as_completed(futures):
+            try:
+                result = future.result()
+                # If tag is "stop", result is an instance of
+                # subprocess.CompletedProcess, then we check returncode
+                # attribute to know if rncd stop command finished successfully.
+                #
+                # if tag is "kill" then the main function will check if
+                # named process exited gracefully after SIGTERM signal.
+                if futures[future] == "stop":
+                    ret_code = result

-        else:
-            # We attempt to send couple rndc commands while named is
-            # being shutdown
-            futures[executor.submit(launch_rndc, ['status'])] = 'status'
+            except (dns.resolver.NXDOMAIN,
+                    dns.resolver.NoNameservers,
+                    dns.exception.Timeout):
+                pass

-    ret_code = -1
-    for future in as_completed(futures):
-        try:
-            result = future.result()
-            # If tag is "stop", result is an instance of
-            # subprocess.CompletedProcess, then we check returncode
-            # attribute to know if rncd stop command finished successfully.
-            #
-            # if tag is "kill" then the main function will check if
-            # named process exited gracefully after SIGTERM signal.
-            if futures[future] == "stop":
-                ret_code = result
-
-        except (dns.resolver.NXDOMAIN, dns.exception.Timeout):
-            pass
-
-    if kill_method == "rndc":
-        assert ret_code == 0
-
-    executor.shutdown()
+        if kill_method == "rndc":
+            assert ret_code == 0


@pytest.mark.dnspython
@@ -149,14 +148,6 @@ def test_named_shutdown(named_port, control_port):
    rndc_cmd = [rndc, "-c", rndc_cfg, "-p", str(control_port),
                "-s", "10.53.0.3"]

-    # Helper function, launch named without blocking.
-    def launch_named():
-        proc = subprocess.Popen([named, "-c", cfg_file, "-f"], cwd=cfg_dir)
-        # Ensure named is running
-        assert proc.poll() is None
-
-        return proc
-
    # We create a resolver instance that will be used to send queries.
    resolver = dns.resolver.Resolver()
    resolver.nameservers = ['10.53.0.3']
@@ -167,38 +158,41 @@ def test_named_shutdown(named_port, control_port):
    # Method 2: killing with SIGTERM
    # In both methods named should exit gracefully.
    for kill_method in ("rndc", "sigterm"):
-        named_proc = launch_named()
-        # wait for named to finish loading
-        for _ in range(10):
-            try:
-                resolver.query('version.bind', 'TXT', 'CH')
-                break
-            except (dns.resolver.NoNameservers, dns.exception.Timeout):
-                time.sleep(1)
+        named_cmdline = [named, "-c", cfg_file, "-f"]
+        with subprocess.Popen(named_cmdline, cwd=cfg_dir) as named_proc:
+            # Ensure named is running
+            assert named_proc.poll() is None
+            # wait for named to finish loading
+            for _ in range(10):
+                try:
+                    resolver.query('version.bind', 'TXT', 'CH')
+                    break
+                except (dns.resolver.NoNameservers, dns.exception.Timeout):
+                    time.sleep(1)

-        do_work(named_proc, resolver, rndc_cmd,
-                kill_method, n_workers=12, n_queries=16)
+            do_work(named_proc, resolver, rndc_cmd,
+                    kill_method, n_workers=12, n_queries=16)

-        # Wait named to exit for a maximum of MAX_TIMEOUT seconds.
-        MAX_TIMEOUT = 10
-        is_dead = False
-        for _ in range(MAX_TIMEOUT):
-            if named_proc.poll() is not None:
-                is_dead = True
-                break
-            time.sleep(1)
-
-        if not is_dead:
-            named_proc.send_signal(signal.SIGABRT)
+            # Wait named to exit for a maximum of MAX_TIMEOUT seconds.
+            MAX_TIMEOUT = 10
+            is_dead = False
            for _ in range(MAX_TIMEOUT):
                if named_proc.poll() is not None:
                    is_dead = True
                    break
                time.sleep(1)
-            if not is_dead:
-                named_proc.kill()

-        assert is_dead
-        # Ensures that named exited gracefully.
-        # If it crashed (abort()) exitcode will be non zero.
-        assert named_proc.returncode == 0
+            if not is_dead:
+                named_proc.send_signal(signal.SIGABRT)
+                for _ in range(MAX_TIMEOUT):
+                    if named_proc.poll() is not None:
+                        is_dead = True
+                        break
+                    time.sleep(1)
+                if not is_dead:
+                    named_proc.kill()
+
+            assert is_dead
+            # Ensures that named exited gracefully.
+            # If it crashed (abort()) exitcode will be non zero.
+            assert named_proc.returncode == 0
@@ -22,7 +22,8 @@ from helper import fmt
 # JSON helper functions
 def fetch_zones_json(statsip, statsport):

-    r = requests.get("http://{}:{}/json/v1/zones".format(statsip, statsport))
+    r = requests.get("http://{}:{}/json/v1/zones".format(statsip, statsport),
+                     timeout=600)
    assert r.status_code == 200

    data = r.json()
@@ -31,7 +32,8 @@ def fetch_zones_json(statsip, statsport):

 def fetch_traffic_json(statsip, statsport):

-    r = requests.get("http://{}:{}/json/v1/traffic".format(statsip, statsport))
+    r = requests.get("http://{}:{}/json/v1/traffic".format(statsip, statsport),
+                     timeout=600)
    assert r.status_code == 200

    data = r.json()
@@ -23,7 +23,8 @@ from helper import fmt
 # XML helper functions
 def fetch_zones_xml(statsip, statsport):

-    r = requests.get("http://{}:{}/xml/v3/zones".format(statsip, statsport))
+    r = requests.get("http://{}:{}/xml/v3/zones".format(statsip, statsport),
+                     timeout=600)
    assert r.status_code == 200

    root = ET.fromstring(r.text)
@@ -47,7 +48,8 @@ def fetch_traffic_xml(statsip, statsport):

        return out

-    r = requests.get("http://{}:{}/xml/v3/traffic".format(statsip, statsport))
+    r = requests.get("http://{}:{}/xml/v3/traffic".format(statsip, statsport),
+                     timeout=600)
    assert r.status_code == 200

    root = ET.fromstring(r.text)
@@ -9,6 +9,8 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+set -e
+
 #
 # Clean up after zone transfer tests.
 #
@@ -16,9 +18,9 @@
 rm -f ns*/named.conf
 rm -f ns3/example.bk dig.out.ns?.?
 rm -f ns2/example.db ns3/internal.bk
-rm -f */*.jnl
-rm -f */named.memstats
-rm -f */named.run */named.run.prev
+rm -f -- */*.jnl
+rm -f -- */named.memstats
+rm -f -- */named.run */named.run.prev
 rm -f ns2/external/K*
 rm -f ns2/external/inline.db.jbk
 rm -f ns2/external/inline.db.signed
@@ -9,6 +9,9 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+set -e
+
+# shellcheck source=conf.sh
 . ../conf.sh

 cp -f ns2/example1.db ns2/example.db
@@ -25,9 +28,9 @@ copy_setports ns5/named.conf.in ns5/named.conf
 #
 $KEYGEN -K ns2/internal -a rsasha256 -q inline > /dev/null 2>&1
 $KEYGEN -K ns2/internal -a rsasha256 -qfk inline > /dev/null 2>&1
-k1=`$KEYGEN -K ns2/external -a rsasha256 -q inline 2> /dev/null`
-k2=`$KEYGEN -K ns2/external -a rsasha256 -qfk inline 2> /dev/null`
+k1=$($KEYGEN -K ns2/external -a rsasha256 -q inline 2> /dev/null)
+k2=$($KEYGEN -K ns2/external -a rsasha256 -qfk inline 2> /dev/null)
 $KEYGEN -K ns2/external -a rsasha256 -q inline > /dev/null 2>&1
 $KEYGEN -K ns2/external -a rsasha256 -qfk inline > /dev/null 2>&1
-test -n "$k1" && rm -f ns2/external/$k1.*
-test -n "$k2" && rm -f ns2/external/$k2.*
+test -n "$k1" && rm -f ns2/external/"$k1".*
+test -n "$k2" && rm -f ns2/external/"$k2".*
@@ -9,19 +9,28 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+set -e
+
+# shellcheck source=conf.sh
 . ../conf.sh

-DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd +noauth -p ${PORT}"
-SHORTOPTS="+tcp +short -p ${PORT}"
+dig_with_opts() {
+	"$DIG" +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd +noauth -p "${PORT}" "$@"
+}
+
+dig_with_shortopts() {
+	"$DIG" +tcp +short -p "${PORT}" "$@"
+}
+
 RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"

 status=0

 echo_i "fetching a.example from ns2's initial configuration"
-$DIG $DIGOPTS a.example. @10.53.0.2 any > dig.out.ns2.1 || status=1
+dig_with_opts a.example. @10.53.0.2 any > dig.out.ns2.1 || status=1

 echo_i "fetching a.example from ns3's initial configuration"
-$DIG $DIGOPTS a.example. @10.53.0.3 any > dig.out.ns3.1 || status=1
+dig_with_opts a.example. @10.53.0.3 any > dig.out.ns3.1 || status=1

 echo_i "copying in new configurations for ns2 and ns3"
 rm -f ns2/named.conf ns3/named.conf ns2/example.db
@@ -44,16 +53,16 @@ _check_reload() (
 )
 retry_quiet 10 _check_reload || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))

 echo_i "fetching a.example from ns2's 10.53.0.4, source address 10.53.0.4"
-$DIG $DIGOPTS -b 10.53.0.4 a.example. @10.53.0.4 any > dig.out.ns4.2 || status=1
+dig_with_opts -b 10.53.0.4 a.example. @10.53.0.4 any > dig.out.ns4.2 || status=1

 echo_i "fetching a.example from ns2's 10.53.0.2, source address 10.53.0.2"
-$DIG $DIGOPTS -b 10.53.0.2 a.example. @10.53.0.2 any > dig.out.ns2.2 || status=1
+dig_with_opts -b 10.53.0.2 a.example. @10.53.0.2 any > dig.out.ns2.2 || status=1

 echo_i "fetching a.example from ns3's 10.53.0.3, source address defaulted"
-$DIG $DIGOPTS @10.53.0.3 a.example. any > dig.out.ns3.2 || status=1
+dig_with_opts @10.53.0.3 a.example. any > dig.out.ns3.2 || status=1

 echo_i "comparing ns3's initial a.example to one from reconfigured 10.53.0.2"
 digcomp dig.out.ns3.1 dig.out.ns2.2 || status=1
@@ -84,21 +93,21 @@ sleep 5

 echo_i "verifying update affected both views"
 ret=0
-one=`$DIG $SHORTOPTS -b 10.53.0.2 @10.53.0.2 b.clone a`
-two=`$DIG $SHORTOPTS -b 10.53.0.4 @10.53.0.2 b.clone a`
+one=$(dig_with_shortopts -b 10.53.0.2 @10.53.0.2 b.clone a)
+two=$(dig_with_shortopts -b 10.53.0.4 @10.53.0.2 b.clone a)
 if [ "$one" != "$two" ]; then
        echo_i "'$one' does not match '$two'"
        ret=1
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))

 echo_i "verifying forwarder in cloned zone works"
 ret=0
-one=`$DIG $SHORTOPTS -b 10.53.0.2 @10.53.0.2 child.clone txt`
-two=`$DIG $SHORTOPTS -b 10.53.0.4 @10.53.0.2 child.clone txt`
-three=`$DIG $SHORTOPTS @10.53.0.3 child.clone txt`
-four=`$DIG $SHORTOPTS @10.53.0.5 child.clone txt`
+one=$(dig_with_shortopts -b 10.53.0.2 @10.53.0.2 child.clone txt)
+two=$(dig_with_shortopts -b 10.53.0.4 @10.53.0.2 child.clone txt)
+three=$(dig_with_shortopts @10.53.0.3 child.clone txt)
+four=$(dig_with_shortopts @10.53.0.5 child.clone txt)
 echo "$three" | grep NS3 > /dev/null || { ret=1; echo_i "expected response from NS3 got '$three'"; }
 echo "$four" | grep NS5 > /dev/null || { ret=1; echo_i "expected response from NS5 got '$four'"; }
 if [ "$one" = "$two" ]; then
@@ -114,64 +123,65 @@ if [ "$two" != "$four" ]; then
        ret=1
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))

 echo_i "verifying inline zones work with views"
 ret=0
 wait_for_signed() {
-    $DIG -p ${PORT} @10.53.0.2 -b 10.53.0.2 +dnssec DNSKEY inline > dig.out.internal
-    $DIG -p ${PORT} @10.53.0.2 -b 10.53.0.5 +dnssec DNSKEY inline > dig.out.external
+    "$DIG" -p "${PORT}" @10.53.0.2 -b 10.53.0.2 +dnssec DNSKEY inline > dig.out.internal
+    "$DIG" -p "${PORT}" @10.53.0.2 -b 10.53.0.5 +dnssec DNSKEY inline > dig.out.external
    grep "ANSWER: 4," dig.out.internal > /dev/null || return 1
    grep "ANSWER: 4," dig.out.external > /dev/null || return 1
    return 0
 }
 retry_quiet 10 wait_for_signed || ret=1
-int=`awk '$4 == "DNSKEY" { print $8 }' dig.out.internal | sort`
-ext=`awk '$4 == "DNSKEY" { print $8 }' dig.out.external | sort`
+int=$(awk '$4 == "DNSKEY" { print $8 }' dig.out.internal | sort)
+ext=$(awk '$4 == "DNSKEY" { print $8 }' dig.out.external | sort)
 test "$int" != "$ext" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
+status=$((status + ret))

 echo_i "verifying adding of multiple inline zones followed by reconfiguration works"

 [ ! -f ns2/zones.conf ] && touch ns2/zones.conf
 copy_setports ns2/named3.conf.in ns2/named.conf

-for i in `seq 1 50`; do
+i=1
+while [ $i -lt 50 ]; do
 	ret=0
-	zone_name=`printf "example%03d.com" $i`
+	zone_name=$(printf "example%03d.com" $i)

-# Add a new zone to the configuration.
-	cat >> ns2/zones.conf << EOF
-zone "${zone_name}" {
-    type master;
-    file "db.${zone_name}";
-    dnssec-dnskey-kskonly yes;
-    auto-dnssec maintain;
-    inline-signing yes;
-};
-EOF
+	# Add a new zone to the configuration.
+	cat >> ns2/zones.conf <<-EOF
+	zone "${zone_name}" {
+	    type master;
+	    file "db.${zone_name}";
+	    dnssec-dnskey-kskonly yes;
+	    auto-dnssec maintain;
+	    inline-signing yes;
+	};
+	EOF

-# Create a master file for the zone.
-	cat > "ns2/db.${zone_name}" <<EOF
-\$TTL   86400
-@      IN  SOA localhost. hostmaster.localhost (
-                1612542642  ; serial
-                12H ; refresh
-                1H  ; retry
-                2w  ; expiry
-                1h  ; minimum
-        )
+	# Create a master file for the zone.
+	cat > "ns2/db.${zone_name}" <<-EOF
+	\$TTL 86400
+	@		IN	SOA	localhost. hostmaster.localhost (
+						1612542642 ; serial
+						12H ; refresh
+						1H  ; retry
+						2w  ; expiry
+						1h  ; minimum
+					)
+	@		IN      NS      localhost
+	localhost       IN      A       127.0.0.1
+	EOF

-        IN      NS      localhost
-localhost       IN      A       127.0.0.1
-EOF
-
-    $KEYGEN -q -Kns2 -fk -aecdsa256 ${zone_name} > /dev/null
-    $RNDCCMD 10.53.0.2 reconfig || ret=1
-    if [ $ret != 0 ]; then echo_i "failed"; break; fi
-done # end for #
-status=`expr $status + $ret`
+	$KEYGEN -q -Kns2 -fk -aecdsa256 "${zone_name}" > /dev/null
+	$RNDCCMD 10.53.0.2 reconfig || ret=1
+	if [ $ret != 0 ]; then echo_i "failed"; break; fi
+	i=$((i + 1))
+done
+status=$((status + ret))

 echo_i "exit status: $status"
-[ $status -eq 0 ] || exit 1
+[ "$status" -eq 0 ] || exit 1
@@ -0,0 +1,10 @@
+/SOA tsig_key LSAnCU+Z/
+nil.      	300	SOA	ns.nil. root.nil. 1 300 300 604800 300
+/AXFR tsig_key LSAnCU+Z/
+nil.      	300	SOA	ns.nil. root.nil. 1 300 300 604800 300
+/AXFR tsig_key LSAnCU+Z/
+nil.      	300	NS	ns.nil.
+nil.		300	TXT	"SOA mismatch AXFR"
+a.nil.		60	A	10.0.0.61
+/AXFR tsig_key LSAnCU+Z/
+nil.      	300	SOA	whatever. other. 1 300 300 604800 300
@@ -428,6 +428,25 @@ $DIGCMD nil. TXT | grep 'bad message id' >/dev/null && {
    status=$((status+1))
 }

+n=$((n+1))
+echo_i "mismatched SOA ($n)"
+
+sendcmd < ans5/soamismatch
+
+$RNDCCMD 10.53.0.4 retransfer nil | sed 's/^/ns4 /' | cat_i
+
+sleep 2
+
+nextpart ns4/named.run | grep "Transfer status: FORMERR" > /dev/null || {
+    echo_i "failed: expected status was not logged"
+    status=$((status+1))
+}
+
+$DIGCMD nil. TXT | grep 'SOA mismatch AXFR' >/dev/null && {
+    echo_i "failed"
+    status=$((status+1))
+}
+
 n=$((n+1))
 echo_i "check that we ask for and get a EDNS EXPIRE response ($n)"
 # force a refresh query
@@ -423,20 +423,17 @@ static void
 run(void) {
 	switch (protocol) {
 	case UDP:
-		isc_nm_udpconnect(netmgr, (isc_nmiface_t *)&sockaddr_local,
-				  (isc_nmiface_t *)&sockaddr_remote, connect_cb,
-				  NULL, timeout, 0);
+		isc_nm_udpconnect(netmgr, &sockaddr_local, &sockaddr_remote,
+				  connect_cb, NULL, timeout, 0);
 		break;
 	case TCP:
-		isc_nm_tcpdnsconnect(netmgr, (isc_nmiface_t *)&sockaddr_local,
-				     (isc_nmiface_t *)&sockaddr_remote,
+		isc_nm_tcpdnsconnect(netmgr, &sockaddr_local, &sockaddr_remote,
 				     connect_cb, NULL, timeout, 0);
 		break;
 	case DOT: {
 		isc_tlsctx_createclient(&tls_ctx);

-		isc_nm_tlsdnsconnect(netmgr, (isc_nmiface_t *)&sockaddr_local,
-				     (isc_nmiface_t *)&sockaddr_remote,
+		isc_nm_tlsdnsconnect(netmgr, &sockaddr_local, &sockaddr_remote,
 				     connect_cb, NULL, timeout, 0, tls_ctx);
 		break;
 	}
@@ -454,10 +451,9 @@ run(void) {
 		if (is_https) {
 			isc_tlsctx_createclient(&tls_ctx);
 		}
-		isc_nm_httpconnect(netmgr, (isc_nmiface_t *)&sockaddr_local,
-				   (isc_nmiface_t *)&sockaddr_remote, req_url,
-				   is_post, connect_cb, NULL, tls_ctx, timeout,
-				   0);
+		isc_nm_httpconnect(netmgr, &sockaddr_local, &sockaddr_remote,
+				   req_url, is_post, connect_cb, NULL, tls_ctx,
+				   timeout, 0);
 	} break;
 	default:
 		INSIST(0);
@@ -266,20 +266,20 @@ run(void) {

 	switch (protocol) {
 	case UDP:
-		result = isc_nm_listenudp(netmgr, (isc_nmiface_t *)&sockaddr,
-					  read_cb, NULL, 0, &sock);
+		result = isc_nm_listenudp(netmgr, &sockaddr, read_cb, NULL, 0,
+					  &sock);
 		break;
 	case TCP:
-		result = isc_nm_listentcpdns(netmgr, (isc_nmiface_t *)&sockaddr,
-					     read_cb, NULL, accept_cb, NULL, 0,
-					     0, NULL, &sock);
+		result = isc_nm_listentcpdns(netmgr, &sockaddr, read_cb, NULL,
+					     accept_cb, NULL, 0, 0, NULL,
+					     &sock);
 		break;
 	case DOT: {
 		isc_tlsctx_createserver(NULL, NULL, &tls_ctx);

-		result = isc_nm_listentlsdns(netmgr, (isc_nmiface_t *)&sockaddr,
-					     read_cb, NULL, accept_cb, NULL, 0,
-					     0, NULL, tls_ctx, &sock);
+		result = isc_nm_listentlsdns(netmgr, &sockaddr, read_cb, NULL,
+					     accept_cb, NULL, 0, 0, NULL,
+					     tls_ctx, &sock);
 		break;
 	}
 	case HTTPS:
@@ -288,8 +288,8 @@ run(void) {
 		if (is_https) {
 			isc_tlsctx_createserver(NULL, NULL, &tls_ctx);
 		}
-		result = isc_nm_listenhttp(netmgr, (isc_nmiface_t *)&sockaddr,
-					   0, NULL, tls_ctx, &sock);
+		result = isc_nm_listenhttp(netmgr, &sockaddr, 0, NULL, tls_ctx,
+					   &sock);
 		if (result == ISC_R_SUCCESS) {
 			result = isc_nm_http_endpoint(sock, DEFAULT_DOH_PATH,
 						      read_cb, NULL, 0);
@@ -88,10 +88,10 @@
 #define US_PER_SEC 1000000 /*%< Microseconds per second. */
 #define US_PER_MS  1000	   /*%< Microseconds per millisecond. */

-static isc_mem_t *mctx;
-static dns_requestmgr_t *requestmgr;
-static const char *batchname;
-static FILE *batchfp;
+static isc_mem_t *mctx = NULL;
+static dns_requestmgr_t *requestmgr = NULL;
+static const char *batchname = NULL;
+static FILE *batchfp = NULL;
 static bool burst = false;
 static bool have_ipv4 = false;
 static bool have_ipv6 = false;
@@ -116,7 +116,7 @@ static bool yaml = false;
 static bool continue_on_error = false;
 static uint32_t display_splitwidth = 0xffffffff;
 static isc_sockaddr_t srcaddr;
-static char *server;
+static char *server = NULL;
 static isc_sockaddr_t dstaddr;
 static in_port_t port = 53;
 static isc_dscp_t dscp = -1;
@@ -580,10 +580,10 @@ compute_cookie(unsigned char *cookie, size_t len) {

 static isc_result_t
 sendquery(struct query *query, isc_task_t *task) {
-	dns_request_t *request;
-	dns_message_t *message;
-	dns_name_t *qname;
-	dns_rdataset_t *qrdataset;
+	dns_request_t *request = NULL;
+	dns_message_t *message = NULL;
+	dns_name_t *qname = NULL;
+	dns_rdataset_t *qrdataset = NULL;
 	isc_result_t result;
 	dns_fixedname_t queryname;
 	isc_buffer_t buf;
@@ -598,7 +598,6 @@ sendquery(struct query *query, isc_task_t *task) {
 				   dns_rootname, 0, NULL);
 	CHECK("dns_name_fromtext", result);

-	message = NULL;
 	dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &message);

 	message->opcode = dns_opcode_query;
@@ -620,15 +619,12 @@ sendquery(struct query *query, isc_task_t *task) {
 	message->rdclass = query->rdclass;
 	message->id = (unsigned short)(random() & 0xFFFF);

-	qname = NULL;
 	result = dns_message_gettempname(message, &qname);
 	CHECK("dns_message_gettempname", result);

-	qrdataset = NULL;
 	result = dns_message_gettemprdataset(message, &qrdataset);
 	CHECK("dns_message_gettemprdataset", result);

-	dns_name_init(qname, NULL);
 	dns_name_clone(dns_fixedname_name(&queryname), qname);
 	dns_rdataset_makequestion(qrdataset, query->rdclass, query->rdtype);
 	ISC_LIST_APPEND(qname->list, qrdataset, link);
@@ -2064,11 +2060,11 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 /*% Main processing routine for mdig */
 int
 main(int argc, char *argv[]) {
-	struct query *query;
+	struct query *query = NULL;
 	isc_result_t result;
 	isc_sockaddr_t bind_any;
-	isc_log_t *lctx;
-	isc_logconfig_t *lcfg;
+	isc_log_t *lctx = NULL;
+	isc_logconfig_t *lcfg = NULL;
 	isc_nm_t *netmgr = NULL;
 	isc_taskmgr_t *taskmgr = NULL;
 	isc_task_t *task = NULL;
@@ -2076,8 +2072,8 @@ main(int argc, char *argv[]) {
 	isc_socketmgr_t *socketmgr = NULL;
 	dns_dispatchmgr_t *dispatchmgr = NULL;
 	unsigned int attrs, attrmask;
-	dns_dispatch_t *dispatchvx;
-	dns_view_t *view;
+	dns_dispatch_t *dispatchvx = NULL;
+	dns_view_t *view = NULL;
 	int ns;
 	unsigned int i;

@@ -2097,11 +2093,8 @@ main(int argc, char *argv[]) {

 	preparse_args(argc, argv);

-	mctx = NULL;
 	isc_mem_create(&mctx);

-	lctx = NULL;
-	lcfg = NULL;
 	isc_log_create(mctx, &lctx, &lcfg);

 	RUNCHECK(dst_lib_init(mctx, NULL));
@@ -2153,13 +2146,12 @@ main(int argc, char *argv[]) {
 				     have_src ? &srcaddr : &bind_any, 4096, 100,
 				     100, 17, 19, attrs, attrmask,
 				     &dispatchvx));
-	requestmgr = NULL;
+
 	RUNCHECK(dns_requestmgr_create(
 		mctx, timermgr, socketmgr, taskmgr, dispatchmgr,
 		have_ipv4 ? dispatchvx : NULL, have_ipv6 ? dispatchvx : NULL,
 		&requestmgr));

-	view = NULL;
 	RUNCHECK(dns_view_create(mctx, 0, "_test", &view));

 	query = ISC_LIST_HEAD(queries);
@@ -5,7 +5,7 @@ statement S;

 - V = dns_name_copy(E1, E2, NULL);
 - if (V != ISC_R_SUCCESS) S
-+ RUNTIME_CHECK(dns_name_copy(E1, E2, NULL) == ISC_R_SUCCESS);
+ dns_name_copy(E1, E2);

@@
 expression V, E1, E2;
@@ -14,7 +14,7 @@ statement S1, S2;

 - V = dns_name_copy(E1, E2, NULL);
 - if (V == ISC_R_SUCCESS) S1 else S2;
-+ RUNTIME_CHECK(dns_name_copy(E1, E2, NULL) == ISC_R_SUCCESS);
+ dns_name_copy(E1, E2);
 + S2

@@
@@ -25,6 +25,6 @@ statement S1, S2;
 - V = dns_name_copy(E1, E2, NULL);
 - S1
 - if (V == ISC_R_SUCCESS) S2
-+ RUNTIME_CHECK(dns_name_copy(E1, E2, NULL) == ISC_R_SUCCESS);
+ dns_name_copy(E1, E2):
 + S1
 + S2
@@ -3,21 +3,21 @@ expression E1, E2;
@@

 - dns_name_copy(E1, E2, NULL);
-+ RUNTIME_CHECK(dns_name_copy(E1, E2, NULL) == ISC_R_SUCCESS);
+ dns_name_copy(E1, E2);

@@
 expression E1, E2;
@@

 - (void)dns_name_copy(E1, E2, NULL);
-+ RUNTIME_CHECK(dns_name_copy(E1, E2, NULL) == ISC_R_SUCCESS);
+ dns_name_copy(E1, E2);

@@
 expression E1, E2;
@@

 - return (dns_name_copy(E1, E2, NULL));
-+ RUNTIME_CHECK(dns_name_copy(E1, E2, NULL) == ISC_R_SUCCESS);
+ dns_name_copy(E1, E2);
 + return (ISC_R_SUCCESS);

 // ./bin/named/query.c processing broken with this rule, fix manually
@@ -27,4 +27,4 @@ expression E1, E2;
 //
 // - V = dns_name_copy(E1, E2, NULL);
 // - RUNTIME_CHECK(V == ISC_R_SUCCESS);
-// + RUNTIME_CHECK(dns_name_copy(E1, E2, NULL) == ISC_R_SUCCESS);
+// + dns_name_copy(E1, E2);
@@ -3,4 +3,4 @@ expression E1, E2;
@@

 - RUNTIME_CHECK(dns_name_copy(E1, E2, NULL) == ISC_R_SUCCESS);
-+ dns_name_copynf(E1, E2);
+ dns_name_copy(E1, E2);
@@ -378,15 +378,6 @@ typedef __int64 off_t;
 /* Define to 1 if you have the `SSL_CTX_up_ref' function. */
 #define SSL_CTX_UP_REF 1

-/* Define to 1 if you have the `uv_handle_get_data' function. */
-@HAVE_UV_HANDLE_GET_DATA@
-
-/* Define to 1 if you have the `uv_handle_set_data' function. */
-@HAVE_UV_HANDLE_SET_DATA@
-
-/* Define to 1 if you have the `uv_import' function. */
-@HAVE_UV_IMPORT@
-
 /* GSSAPI Related defines */
@HAVE_GSSAPI@
@HAVE_GSSAPI_H@
@@ -14,7 +14,7 @@
 #
 m4_define([bind_VERSION_MAJOR], 9)dnl
 m4_define([bind_VERSION_MINOR], 17)dnl
-m4_define([bind_VERSION_PATCH], 12)dnl
+m4_define([bind_VERSION_PATCH], 13)dnl
 m4_define([bind_VERSION_EXTRA], )dnl
 m4_define([bind_DESCRIPTION], [(Development Release)])dnl
 m4_define([bind_SRCID], [m4_esyscmd_s([git rev-parse --short HEAD | cut -b1-7])])dnl
@@ -303,7 +303,7 @@ AM_CONDITIONAL([HAVE_PERLMOD_TIME_HIRES],
 AM_PATH_PYTHON([3.4], [], [:])
 AM_CONDITIONAL([HAVE_PYTHON], [test "$PYTHON" != ":"])

-AC_PATH_PROGS([PYTEST], [pytest-3 py.test-3 pytest pytest-pypy], [])
+AC_PATH_PROGS([PYTEST], [pytest-3 py.test-3 pytest py.test pytest-pypy], [])
 AS_IF([test -z "$PYTEST"],
      [AC_MSG_WARN([pytest not found, some system tests will be skipped])])
 AC_SUBST([PYTEST])
@@ -593,15 +593,6 @@ AC_CHECK_HEADERS([pthread_np.h], [], [], [#include <pthread.h>])
 AC_MSG_CHECKING([for libuv])
 PKG_CHECK_MODULES([LIBUV], [libuv >= 1.0.0], [],
 		  [AC_MSG_ERROR([libuv not found])])
-AX_SAVE_FLAGS([libuv])
-
-CFLAGS="$CFLAGS $LIBUV_CFLAGS"
-LIBS="$LIBS $LIBUV_LIBS"
-
-# Those functions are only provided in newer versions of libuv, we'll be emulating them
-# for now
-AC_CHECK_FUNCS([uv_handle_get_data uv_handle_set_data uv_import uv_udp_connect uv_translate_sys_error uv_sleep])
-AX_RESTORE_FLAGS([libuv])

 # libnghttp2
 AC_MSG_CHECKING([for libnghttp2])
@@ -4,6 +4,10 @@ if HAVE_PERL
 SUBDIRS += misc
 endif

+# Do not change this line to "SUBDIRS = man" at the top of this file: in
+# maintainer mode, the "man" subdirectory depends on the "misc" subdirectory.
+SUBDIRS += man
+
 if HAVE_SPHINX_BUILD
-SUBDIRS += man arm
+SUBDIRS += arm
 endif HAVE_SPHINX_BUILD
@@ -53,6 +53,7 @@ information about each release, source code, and pre-compiled versions
 for Microsoft Windows operating systems.

 .. include:: ../notes/notes-current.rst
+.. include:: ../notes/notes-9.17.13.rst
 .. include:: ../notes/notes-9.17.12.rst
 .. include:: ../notes/notes-9.17.11.rst
 .. include:: ../notes/notes-9.17.10.rst
@@ -3585,6 +3585,28 @@ Tuning
   milliseconds to prefer IPv6 name servers. The default is ``50``
   milliseconds.

+``tcp-recv-buffer``;  ``udp-recv-buffer``
+   These options control the operating system's receive buffer sizes
+   (``SO_RCVBUF``) for TCP and UDP sockets respectively.  Buffering at
+   the operating system level can prevent packet drops during brief load
+   spikes, but if the value is set too high, it could clog a running server
+   with outstanding queries that have already timed out. The default is
+   ``0``, which means the operating system's default value should be used.
+   The minimum configurable value is ``4096``; any nonzero value lower than
+   that will be silently raised. The maximum value is determined by the
+   kernel, and values exceeding the maximum will be silently reduced.
+
+``tcp-send-buffer``; ``udp-send-buffer``
+   These options control the operating system's send buffer sizes
+   (``SO_SNDBUF``) for TCP and UDP sockets respectively.  Buffering at the
+   operating system level can prevent packet drops during brief load
+   spikes, but if the value is set too high, it could clog a running server
+   with outstanding queries that have already timed out. The default is
+   ``0``, which means the operating system's default value should be used.
+   The minimum configurable value is ``4096``; any nonzero value lower than
+   that will be silently raised. The maximum value is determined by the
+   kernel, and values exceeding the maximum will be silently reduced.
+
 .. _builtin:

 Built-in Server Information Zones
@@ -1 +1,2 @@
 Sphinx>=2
+docutils<0.17
@@ -679,12 +679,35 @@ once.

 ##### Copying

-There are two methods for copying name objects: `dns_name_clone()`
-makes a target refer to the same data as the source without copying
-the data, so the source must not be changed while the target is still in
-use.  `dns_name_dup()` and `dns_name_dupwithoffsets()` create a true
-copy of the name, dynamically allocating memory as needed; targets
-created by these must be freed by calling `dns_name_free()`.
+There are three methods for copying name objects:
+
+- `dns_name_clone()` makes a target refer to the same data as the
+  source, but does not copy the data. The source must not be changed
+  or freed while the target is still in use.
+
+- `dns_name_copy()` copies the source data from one name object into
+  another, which must already have a dedicated buffer associated with
+  it to receive the data.  The target name can have a buffer assigned
+  to it using `dns_name_setbuffer()`:
+
+        dns_name_t target;
+        unsigned char namedata[DNS_NAME_MAXWIRE];
+        isc_buffer_t buffer;
+
+        isc_buffer_init(&buffer, namedata, sizeof(namedata));
+        dns_name_init(&target, NULL);
+        dns_name_setbuffer(target, &buffer);
+        dns_name_copy(source, &target);
+
+  Using a [fixed name](#fixedname) (see below) for the target
+  ensures that it has sufficient buffer space without needing to set
+  a buffer.
+
+- `dns_name_dup()` copies a name into a new name object, dynamically
+  allocating buffer space as needed. `dns_name_dupwithoffsets()` does
+  the same, but also dynamically allocates space for the copied offset
+  table.  Targets created by these functions must be freed by calling
+  `dns_name_free()`.

 ##### Wire format

@@ -799,7 +822,7 @@ not all of this information is required:
 * `dns_name_caseequal()`: same as `dns_name_equal()`, but case-sensitive
 * `dns_name_issubdomain()`: returns `true` if one name contains another

-##### Fixed names
+##### <a name="fixedname"></a>Fixed names

 `dns_fixedname_t` is a convenience type containing a name, an offsets
 table, and a dedicated buffer big enough for the longest possible DNS
@@ -1098,7 +1098,7 @@ Then use ``rndc reload`` to reload the zone.

 The "insecure" policy is a built-in policy (like "default"). It will make sure
 the zone is still DNSSEC maintained, to allow for a graceful transition to
-unsigned,
+unsigned.

 When the DS records have been removed from the parent zone, use
 ``rndc dnssec -checkds -key <id> withdrawn example.com`` to tell ``named`` that
@@ -31,12 +31,19 @@
 # -- Project information -----------------------------------------------------

 project = u'BIND 9'
+# pylint: disable=wrong-import-position
+import datetime
+year = datetime.datetime.now().year
 # pylint: disable=redefined-builtin
-copyright = u'2021, Internet Systems Consortium'
+copyright = u"%d, Internet Systems Consortium" % year
 author = u'Internet Systems Consortium'

 # -- General configuration ---------------------------------------------------

+# Build man pages directly in _build/man/, not in _build/man/<section>/.
+# This is what the shell code in Makefile.am expects.
+man_make_section_directory = False
+
 # Add any Sphinx extension module names here, as strings. They can be
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
 # ones.
@@ -499,6 +499,8 @@ options {
      tcp\-initial\-timeout integer;
      tcp\-keepalive\-timeout integer;
      tcp\-listen\-queue integer;
+      tcp\-receive\-buffer integer;
+      tcp\-send\-buffer integer;
      tkey\-dhkey quoted_string integer;
      tkey\-domain quoted_string;
      tkey\-gssapi\-credential quoted_string;
@@ -515,6 +517,8 @@ options {
      transfers\-per\-ns integer;
      trust\-anchor\-telemetry boolean; // experimental
      try\-tcp\-refresh boolean;
+      udp\-receive\-buffer integer;
+      udp\-send\-buffer integer;
      update\-check\-ksk boolean;
      use\-alt\-transfer\-source boolean;
      use\-v4\-udp\-ports { portrange; ... };
@@ -358,6 +358,8 @@ options {
        tcp-initial-timeout <integer>;
        tcp-keepalive-timeout <integer>;
        tcp-listen-queue <integer>;
+        tcp-receive-buffer <integer>;
+        tcp-send-buffer <integer>;
        tkey-dhkey <quoted_string> <integer>;
        tkey-domain <quoted_string>;
        tkey-gssapi-credential <quoted_string>;
@@ -374,6 +376,8 @@ options {
        transfers-per-ns <integer>;
        trust-anchor-telemetry <boolean>; // experimental
        try-tcp-refresh <boolean>;
+        udp-receive-buffer <integer>;
+        udp-send-buffer <integer>;
        update-check-ksk <boolean>;
        use-alt-transfer-source <boolean>;
        use-v4-udp-ports { <portrange>; ... };
@@ -355,6 +355,8 @@ options {
        tcp-initial-timeout <integer>;
        tcp-keepalive-timeout <integer>;
        tcp-listen-queue <integer>;
+        tcp-receive-buffer <integer>;
+        tcp-send-buffer <integer>;
        tkey-dhkey <quoted_string> <integer>;
        tkey-domain <quoted_string>;
        tkey-gssapi-credential <quoted_string>;
@@ -371,6 +373,8 @@ options {
        transfers-per-ns <integer>;
        trust-anchor-telemetry <boolean>; // experimental
        try-tcp-refresh <boolean>;
+        udp-receive-buffer <integer>;
+        udp-send-buffer <integer>;
        update-check-ksk <boolean>;
        use-alt-transfer-source <boolean>;
        use-v4-udp-ports { <portrange>; ... };
@@ -277,6 +277,8 @@
  	tcp-initial-timeout <integer>;
  	tcp-keepalive-timeout <integer>;
  	tcp-listen-queue <integer>;
+  	tcp-receive-buffer <integer>;
+  	tcp-send-buffer <integer>;
  	tkey-dhkey <quoted_string> <integer>;
  	tkey-domain <quoted_string>;
  	tkey-gssapi-credential <quoted_string>;
@@ -293,6 +295,8 @@
  	transfers-per-ns <integer>;
  	trust-anchor-telemetry <boolean>; // experimental
  	try-tcp-refresh <boolean>;
+  	udp-receive-buffer <integer>;
+  	udp-send-buffer <integer>;
  	update-check-ksk <boolean>;
  	use-alt-transfer-source <boolean>;
  	use-v4-udp-ports { <portrange>; ... };
@@ -0,0 +1,83 @@
+.. 
+   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+   
+   This Source Code Form is subject to the terms of the Mozilla Public
+   License, v. 2.0. If a copy of the MPL was not distributed with this
+   file, you can obtain one at https://mozilla.org/MPL/2.0/.
+   
+   See the COPYRIGHT file distributed with this work for additional
+   information regarding copyright ownership.
+
+Notes for BIND 9.17.13
+----------------------
+
+Feature Changes
+~~~~~~~~~~~~~~~
+
+- DNSSEC responses containing NSEC3 records with iteration counts
+  greater than 150 are now treated as insecure. :gl:`#2445`
+
+- The maximum supported number of NSEC3 iterations that can be
+  configured for a zone has been reduced to 150. :gl:`#2642`
+
+- After the network manager was introduced to ``named`` to handle
+  incoming traffic, it was discovered that recursive performance had
+  degraded compared to previous BIND 9 versions. This has now been
+  fixed by processing internal tasks inside network manager worker
+  threads, preventing resource contention among two sets of threads.
+  :gl:`#2638`
+
+- Zones that want to transition from secure to insecure mode without
+  becoming bogus in the process must now have their ``dnssec-policy``
+  changed first to ``insecure``, rather than ``none``. After the DNSSEC
+  records have been removed from the zone, the ``dnssec-policy`` can be
+  set to ``none`` or removed from the configuration. Setting the
+  ``dnssec-policy`` to ``insecure`` causes CDS and CDNSKEY DELETE
+  records to be published. :gl:`#2645`
+
+- The implementation of the ZONEMD RR type has been updated to match
+  :rfc:`8976`. :gl:`#2658`
+
+- The ``draft-vandijk-dnsop-nsec-ttl`` IETF draft was implemented:
+  NSEC(3) TTL values are now set to the minimum of the SOA MINIMUM value
+  or the SOA TTL. :gl:`#2347`
+
+Bug Fixes
+~~~~~~~~~
+
+- If zone journal files written by BIND 9.16.11 or earlier were present
+  when BIND was upgraded to BIND 9.17.11 or BIND 9.17.12, the zone file
+  for that zone could have been inadvertently rewritten with the current
+  zone contents. This caused the original zone file structure (e.g.
+  comments, ``$INCLUDE`` directives) to be lost, although the zone data
+  itself was preserved. :gl:`#2623`
+
+- It was possible for corrupt journal files generated by an earlier
+  version of ``named`` to cause problems after an upgrade. This has been
+  fixed. :gl:`#2670`
+
+- TTL values in cache dumps were reported incorrectly when
+  ``stale-cache-enable`` was set to ``yes``. This has been fixed.
+  :gl:`#389` :gl:`#2289`
+
+- A deadlock could occur when multiple ``rndc addzone``, ``rndc
+  delzone``, and/or ``rndc modzone`` commands were invoked
+  simultaneously for different zones. This has been fixed. :gl:`#2626`
+
+- ``inline-signing`` was incorrectly described as being inherited from
+  the ``options``/``view`` levels and was incorrectly accepted at those
+  levels without effect. This has been fixed; ``named.conf`` files with
+  ``inline-signing`` at those levels no longer load. :gl:`#2536`
+
+- ``named`` and ``named-checkconf`` did not report an error when
+  multiple zones with the ``dnssec-policy`` option set were using the
+  same zone file. This has been fixed. :gl:`#2603`
+
+- If ``dnssec-policy`` was active and a private key file was temporarily
+  offline during a rekey event, ``named`` could incorrectly introduce
+  replacement keys and break a signed zone. This has been fixed.
+  :gl:`#2596`
+
+- When generating zone signing keys, KASP now also checks for key ID
+  conflicts among newly created keys, rather than just between new and
+  existing ones. :gl:`#2628`
@@ -8,7 +8,7 @@
   See the COPYRIGHT file distributed with this work for additional
   information regarding copyright ownership.

-Notes for BIND 9.17.13
+Notes for BIND 9.17.14
 ----------------------

 Security Fixes
@@ -24,7 +24,17 @@ Known Issues
 New Features
 ~~~~~~~~~~~~

- None.
+- New configuration options, ``tcp-receive-buffer``, ``tcp-send-buffer``,
+  ``udp-receive-buffer``, and ``udp-send-buffer``, have been added.  These
+  options allows the operator to fine tune the receiving and sending
+  buffers in the operating system.  On busy servers, increasing the value
+  of the receive buffers can prevent the server from dropping the packets
+  during short spikes, and decreasing the value would prevent the server to
+  became clogged up with queries that are too old and have already timeouted
+  on the receiving side. :gl:`#2313`
+
+- Run zone dumping tasks on separate asynchronous thread pools.  This change
+  makes zone dumping no longer block networking I/O. :gl:`#2732`

 Removed Features
 ~~~~~~~~~~~~~~~~
@@ -34,60 +44,35 @@ Removed Features
 Feature Changes
 ~~~~~~~~~~~~~~~

- Implement ``draft-vandijk-dnsop-nsec-ttl``, NSEC(3) TTL values are now set to
-  the minimum of the SOA MINIMUM value and the SOA TTL. :gl:`#2347`
-
- Reduce the supported maximum number of iterations that can be
-  configured in an NSEC3 zones to 150. :gl:`#2642`
-
- Treat DNSSEC responses with NSEC3 iterations greater than 150 as insecure.
-  :gl:`#2445`
-
- Implement ``draft-vandijk-dnsop-nsec-ttl``, NSEC(3) TTL values are now set to
-  the minimum of the SOA MINIMUM value and the SOA TTL. :gl:`#2347`
-
- Zones that want to transition from secure to insecure mode without making it
-  bogus in the process should now first change their ``dnssec-policy`` to
-  ``insecure`` (as opposed to ``none``). Only after the DNSSEC records have
-  been removed from the zone (in a timely manner), the ``dnssec-policy`` can
-  be set to ``none`` (or be removed from the configuration). Setting the
-  ``dnssec-policy`` to ``insecure`` will cause CDS and CDNSKEY DELETE records
-  to be published. :gl:`#2645`
-
- ``inline-signing`` was incorrectly described as being inherited from the
-  ``options`` or ``view`` levels and was incorrectly accepted at those levels
-  without effect.  This has been corrected, ``named.conf`` files with
-  ``inline-signing`` at those levels will no longer load with this fix applied.
-  :gl:`#2536`
+- The interface handling code has been refactored to use fewer resources,
+  which should lead to less memory fragmentation and better startup
+  performance.  :gl:`#2433`

 Bug Fixes
 ~~~~~~~~~

- When dumping the cache to file, TTLs were being increased with
-  ``max-stale-ttl``. Also the comment above stale RRsets could have nonsensical
-  values if the RRset was still marked a stale but the ``max-stale-ttl`` has
-  passed (and is actually an RRset awaiting cleanup). Both issues have now
-  been fixed. :gl:`#389` :gl:`#2289`
+- Fix a race condition in reading and writing key files for KASP zones in
+  multiple views. :gl:`#1875`

- ``named`` would overwrite a zone file unconditionally when it recovered from
-  a corrupted journal. :gl:`#2623`
-
- After the networking manager was introduced to ``named`` to handle
-  incoming traffic, it was discovered that the recursive performance had been
-  degraded compared to the previous version (9.11).  This has been now fixed by
-  running internal tasks inside the networking manager worker threads, so
-  they do not compete for resources. :gl:`#2638`
-
- With ``dnssec-policy``, when creating new keys also check for keyid conflicts
-  between the new keys too. :gl:`#2628`
-
- Update ZONEMD to match RFC 8976. :gl:`#2658`
-
- With ``dnssec-policy```, don't roll keys if the private key file is offline.
-  :gl:`#2596`
-
- Journal compaction could fail when a journal with invalid transaction 
-  headers was not detected at startup. :gl:`#2670`
+- Check ``key-directory`` conflicts in ``named.conf`` for zones in multiple
+  views with different ``dnssec-policy``. Using the same ``key-directory`` for
+  such zones is not allowed. :gl:`#2463`

 - ``named-checkconf`` now complains if zones with ``dnssec-policy`` reference
  the same zone file more than once. :gl:`#2603`
+
+- The calculation of the estimated IXFR transaction size by
+  `dns_journal_iter_init()` was invalid.  This resulted in excessive
+  AXFR-style-IXFR responses. :gl:`#2685`
+
+- If a query was answered with stale data on a server with DNS64 enabled,
+  an assertion could occur if a non-stale answer arrived afterward. This
+  has been fixed. :gl:`#2731`
+
+- Fixed an assertion failure that could occur if stale data was used
+  to answer a query, and then a prefetch was triggered after the query
+  was restarted (for example, to follow a CNAME). :gl:`#2733`
+
+- Fix an error that would enable don't fragment socket option instead
+  of disabling it leading to errors when sending the oversized UDP
+  packets. [GL #2746]
@@ -72,6 +72,9 @@ static isc_result_t
 fileexist(const cfg_obj_t *obj, isc_symtab_t *symtab, bool writeable,
 	  isc_log_t *logctxlogc);

+static isc_result_t
+keydirexist(const cfg_obj_t *zcgf, const char *dir, const char *kaspnamestr,
+	    isc_symtab_t *symtab, isc_log_t *logctx, isc_mem_t *mctx);
 static void
 freekey(char *key, unsigned int type, isc_symvalue_t value, void *userarg) {
 	UNUSED(type);
@@ -2377,9 +2380,9 @@ cleanup:
 static isc_result_t
 check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	       const cfg_obj_t *config, isc_symtab_t *symtab,
-	       isc_symtab_t *files, isc_symtab_t *inview, const char *viewname,
-	       dns_rdataclass_t defclass, cfg_aclconfctx_t *actx,
-	       isc_log_t *logctx, isc_mem_t *mctx) {
+	       isc_symtab_t *files, isc_symtab_t *keydirs, isc_symtab_t *inview,
+	       const char *viewname, dns_rdataclass_t defclass,
+	       cfg_aclconfctx_t *actx, isc_log_t *logctx, isc_mem_t *mctx) {
 	const char *znamestr;
 	const char *typestr = NULL;
 	const char *target = NULL;
@@ -2404,6 +2407,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	bool has_dnssecpolicy = false;
 	const void *clauses = NULL;
 	const char *option = NULL;
+	const char *kaspname = NULL;
+	const char *dir = NULL;
 	static const char *acls[] = {
 		"allow-notify",
 		"allow-transfer",
@@ -2633,8 +2638,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	(void)cfg_map_get(zoptions, "dnssec-policy", &obj);
 	if (obj != NULL) {
 		const cfg_obj_t *kasps = NULL;
-		const char *kaspname = cfg_obj_asstring(obj);

+		kaspname = cfg_obj_asstring(obj);
 		if (strcmp(kaspname, "default") == 0) {
 			has_dnssecpolicy = true;
 		} else if (strcmp(kaspname, "insecure") == 0) {
@@ -3188,7 +3193,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	obj = NULL;
 	tresult = cfg_map_get(zoptions, "key-directory", &obj);
 	if (tresult == ISC_R_SUCCESS) {
-		const char *dir = cfg_obj_asstring(obj);
+		dir = cfg_obj_asstring(obj);
+
 		tresult = isc_file_isdirectory(dir);
 		switch (tresult) {
 		case ISC_R_SUCCESS:
@@ -3210,6 +3216,25 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		}
 	}

+	/*
+	 * Make sure there is no other zone with the same
+	 * key-directory and a different dnssec-policy.
+	 */
+	if (zname != NULL) {
+		char keydirbuf[DNS_NAME_FORMATSIZE + 128];
+		char *tmp = keydirbuf;
+		size_t len = sizeof(keydirbuf);
+		dns_name_format(zname, keydirbuf, sizeof(keydirbuf));
+		tmp += strlen(tmp);
+		len -= strlen(tmp);
+		(void)snprintf(tmp, len, "/%s", (dir == NULL) ? "(null)" : dir);
+		tresult = keydirexist(zconfig, (const char *)keydirbuf,
+				      kaspname, keydirs, logctx, mctx);
+		if (tresult != ISC_R_SUCCESS) {
+			result = tresult;
+		}
+	}
+
 	/*
 	 * Check various options.
 	 */
@@ -3420,6 +3445,56 @@ fileexist(const cfg_obj_t *obj, isc_symtab_t *symtab, bool writeable,
 	return (result);
 }

+static isc_result_t
+keydirexist(const cfg_obj_t *zcfg, const char *keydir, const char *kaspnamestr,
+	    isc_symtab_t *symtab, isc_log_t *logctx, isc_mem_t *mctx) {
+	isc_result_t result;
+	isc_symvalue_t symvalue;
+	char *symkey;
+
+	if (kaspnamestr == NULL || strcmp(kaspnamestr, "none") == 0) {
+		return (ISC_R_SUCCESS);
+	}
+
+	result = isc_symtab_lookup(symtab, keydir, 0, &symvalue);
+	if (result == ISC_R_SUCCESS) {
+		const cfg_obj_t *kasp = NULL;
+		const cfg_obj_t *exist = symvalue.as_cpointer;
+		const char *file = cfg_obj_file(exist);
+		unsigned int line = cfg_obj_line(exist);
+
+		/*
+		 * Having the same key-directory for the same zone is fine
+		 * iff the zone is using the same policy, or has no policy.
+		 */
+		(void)cfg_map_get(cfg_tuple_get(exist, "options"),
+				  "dnssec-policy", &kasp);
+		if (kasp == NULL ||
+		    strcmp(cfg_obj_asstring(kasp), "none") == 0 ||
+		    strcmp(cfg_obj_asstring(kasp), kaspnamestr) == 0)
+		{
+			return (ISC_R_SUCCESS);
+		}
+
+		cfg_obj_log(zcfg, logctx, ISC_LOG_ERROR,
+			    "key-directory '%s' already in use by zone %s with "
+			    "policy %s: %s:%u",
+			    keydir,
+			    cfg_obj_asstring(cfg_tuple_get(exist, "name")),
+			    cfg_obj_asstring(kasp), file, line);
+		return (ISC_R_EXISTS);
+	}
+
+	/*
+	 * Add the new zone plus key-directory.
+	 */
+	symkey = isc_mem_strdup(mctx, keydir);
+	symvalue.as_cpointer = zcfg;
+	result = isc_symtab_define(symtab, symkey, 2, symvalue,
+				   isc_symexists_reject);
+	return (result);
+}
+
 /*
 * Check key list for duplicates key names and that the key names
 * are valid domain names as these keys are used for TSIG.
@@ -4379,8 +4454,8 @@ check_dnstap(const cfg_obj_t *voptions, const cfg_obj_t *config,
 static isc_result_t
 check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	       const char *viewname, dns_rdataclass_t vclass,
-	       isc_symtab_t *files, bool check_plugins, isc_symtab_t *inview,
-	       isc_log_t *logctx, isc_mem_t *mctx) {
+	       isc_symtab_t *files, isc_symtab_t *keydirs, bool check_plugins,
+	       isc_symtab_t *inview, isc_log_t *logctx, isc_mem_t *mctx) {
 	const cfg_obj_t *zones = NULL;
 	const cfg_obj_t *view_tkeys = NULL, *global_tkeys = NULL;
 	const cfg_obj_t *view_mkeys = NULL, *global_mkeys = NULL;
@@ -4437,8 +4512,8 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 		const cfg_obj_t *zone = cfg_listelt_value(element);

 		tresult = check_zoneconf(zone, voptions, config, symtab, files,
-					 inview, viewname, vclass, actx, logctx,
-					 mctx);
+					 keydirs, inview, viewname, vclass,
+					 actx, logctx, mctx);
 		if (tresult != ISC_R_SUCCESS) {
 			result = ISC_R_FAILURE;
 		}
@@ -5035,6 +5110,7 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 	isc_result_t tresult;
 	isc_symtab_t *symtab = NULL;
 	isc_symtab_t *files = NULL;
+	isc_symtab_t *keydirs = NULL;
 	isc_symtab_t *inview = NULL;

 	static const char *builtin[] = { "localhost", "localnets", "any",
@@ -5086,6 +5162,12 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 		goto cleanup;
 	}

+	tresult = isc_symtab_create(mctx, 100, freekey, mctx, false, &keydirs);
+	if (tresult != ISC_R_SUCCESS) {
+		result = tresult;
+		goto cleanup;
+	}
+
 	tresult = isc_symtab_create(mctx, 100, freekey, mctx, true, &inview);
 	if (tresult != ISC_R_SUCCESS) {
 		result = tresult;
@@ -5094,8 +5176,8 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,

 	if (views == NULL) {
 		tresult = check_viewconf(config, NULL, NULL, dns_rdataclass_in,
-					 files, check_plugins, inview, logctx,
-					 mctx);
+					 files, keydirs, check_plugins, inview,
+					 logctx, mctx);
 		if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS) {
 			result = ISC_R_FAILURE;
 		}
@@ -5186,8 +5268,8 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 		}
 		if (tresult == ISC_R_SUCCESS) {
 			tresult = check_viewconf(config, voptions, key, vclass,
-						 files, check_plugins, inview,
-						 logctx, mctx);
+						 files, keydirs, check_plugins,
+						 inview, logctx, mctx);
 		}
 		if (tresult != ISC_R_SUCCESS) {
 			result = ISC_R_FAILURE;
@@ -5306,6 +5388,9 @@ cleanup:
 	if (files != NULL) {
 		isc_symtab_destroy(&files);
 	}
+	if (keydirs != NULL) {
+		isc_symtab_destroy(&keydirs);
+	}

 	return (result);
 }
@@ -22,6 +22,9 @@
 #include <dns/acl.h>
 #include <dns/iptable.h>

+#define DNS_ACLENV_MAGIC ISC_MAGIC('a', 'c', 'n', 'v')
+#define VALID_ACLENV(a)	 ISC_MAGIC_VALID(a, DNS_ACLENV_MAGIC)
+
 /*
 * Create a new ACL, including an IP table and an array with room
 * for 'n' ACL elements.  The elements are uninitialized and the
@@ -617,11 +620,14 @@ dns_acl_allowed(isc_netaddr_t *addr, const dns_name_t *signer, dns_acl_t *acl,
 * Initialize ACL environment, setting up localhost and localnets ACLs
 */
 isc_result_t
-dns_aclenv_init(isc_mem_t *mctx, dns_aclenv_t *env) {
+dns_aclenv_create(isc_mem_t *mctx, dns_aclenv_t **envp) {
 	isc_result_t result;
+	dns_aclenv_t *env = isc_mem_get(mctx, sizeof(*env));
+	*env = (dns_aclenv_t){ 0 };
+
+	isc_mem_attach(mctx, &env->mctx);
+	isc_refcount_init(&env->references, 1);

-	env->localhost = NULL;
-	env->localnets = NULL;
 	result = dns_acl_create(mctx, 0, &env->localhost);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup_nothing;
@@ -634,6 +640,11 @@ dns_aclenv_init(isc_mem_t *mctx, dns_aclenv_t *env) {
 #if defined(HAVE_GEOIP2)
 	env->geoip = NULL;
 #endif /* if defined(HAVE_GEOIP2) */
+
+	env->magic = DNS_ACLENV_MAGIC;
+
+	*envp = env;
+
 	return (ISC_R_SUCCESS);

 cleanup_localhost:
@@ -644,22 +655,55 @@ cleanup_nothing:

 void
 dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s) {
+	REQUIRE(VALID_ACLENV(s));
+	REQUIRE(VALID_ACLENV(t));
+
 	dns_acl_detach(&t->localhost);
 	dns_acl_attach(s->localhost, &t->localhost);
 	dns_acl_detach(&t->localnets);
 	dns_acl_attach(s->localnets, &t->localnets);
+
 	t->match_mapped = s->match_mapped;
 #if defined(HAVE_GEOIP2)
 	t->geoip = s->geoip;
 #endif /* if defined(HAVE_GEOIP2) */
 }

-void
-dns_aclenv_destroy(dns_aclenv_t *env) {
-	if (env->localhost != NULL) {
-		dns_acl_detach(&env->localhost);
+static void
+dns__aclenv_destroy(dns_aclenv_t *aclenv) {
+	REQUIRE(VALID_ACLENV(aclenv));
+
+	aclenv->magic = 0;
+
+	if (aclenv->localhost != NULL) {
+		dns_acl_detach(&aclenv->localhost);
 	}
-	if (env->localnets != NULL) {
-		dns_acl_detach(&env->localnets);
+	if (aclenv->localnets != NULL) {
+		dns_acl_detach(&aclenv->localnets);
+	}
+
+	isc_mem_putanddetach(&aclenv->mctx, aclenv, sizeof(*aclenv));
+}
+
+void
+dns_aclenv_attach(dns_aclenv_t *source, dns_aclenv_t **targetp) {
+	REQUIRE(VALID_ACLENV(source));
+	REQUIRE(targetp != NULL && *targetp == NULL);
+
+	isc_refcount_increment(&source->references);
+	*targetp = source;
+}
+
+void
+dns_aclenv_detach(dns_aclenv_t **aclenvp) {
+	dns_aclenv_t *aclenv = NULL;
+
+	REQUIRE(aclenvp != NULL && VALID_ACLENV(*aclenvp));
+
+	aclenv = *aclenvp;
+	*aclenvp = NULL;
+
+	if (isc_refcount_decrement(&aclenv->references) == 1) {
+		dns__aclenv_destroy(aclenv);
 	}
 }
@@ -3325,7 +3325,7 @@ post_copy:
 	find->partial_result |= (adbname->partial_result & wanted_addresses);
 	if (alias) {
 		if (target != NULL) {
-			dns_name_copynf(&adbname->target, target);
+			dns_name_copy(&adbname->target, target);
 		}
 		result = DNS_R_ALIAS;
 	} else {
@@ -27,6 +27,7 @@
 #include <isc/util.h>

 #include <dns/badcache.h>
+#include <dns/fixedname.h>
 #include <dns/name.h>
 #include <dns/rdatatype.h>
 #include <dns/types.h>
@@ -57,7 +58,8 @@ struct dns_bcentry {
 	isc_time_t expire;
 	uint32_t flags;
 	unsigned int hashval;
-	dns_name_t name;
+	dns_fixedname_t fname;
+	dns_name_t *name;
 };

 static void
@@ -183,8 +185,7 @@ badcache_resize(dns_badcache_t *bc, isc_time_t *now) {
 		for (bad = bc->table[i]; bad != NULL; bad = next) {
 			next = bad->next;
 			if (isc_time_compare(&bad->expire, now) < 0) {
-				isc_mem_put(bc->mctx, bad,
-					    sizeof(*bad) + bad->name.length);
+				isc_mem_put(bc->mctx, bad, sizeof(*bad));
 				atomic_fetch_sub_relaxed(&bc->count, 1);
 			} else {
 				bad->next = newtable[bad->hashval % newsize];
@@ -231,7 +232,7 @@ dns_badcache_add(dns_badcache_t *bc, const dns_name_t *name,
 	prev = NULL;
 	for (bad = bc->table[hash]; bad != NULL; bad = next) {
 		next = bad->next;
-		if (bad->type == type && dns_name_equal(name, &bad->name)) {
+		if (bad->type == type && dns_name_equal(name, bad->name)) {
 			if (update) {
 				bad->expire = *expire;
 				bad->flags = flags;
@@ -244,8 +245,7 @@ dns_badcache_add(dns_badcache_t *bc, const dns_name_t *name,
 			} else {
 				prev->next = bad->next;
 			}
-			isc_mem_put(bc->mctx, bad,
-				    sizeof(*bad) + bad->name.length);
+			isc_mem_put(bc->mctx, bad, sizeof(*bad));
 			atomic_fetch_sub_relaxed(&bc->count, 1);
 		} else {
 			prev = bad;
@@ -253,18 +253,22 @@ dns_badcache_add(dns_badcache_t *bc, const dns_name_t *name,
 	}

 	if (bad == NULL) {
+		unsigned count;
 		isc_buffer_t buffer;
-		bad = isc_mem_get(bc->mctx, sizeof(*bad) + name->length);
-		bad->type = type;
-		bad->hashval = hashval;
-		bad->expire = *expire;
-		bad->flags = flags;
+
+		bad = isc_mem_get(bc->mctx, sizeof(*bad));
+		*bad = (dns_bcentry_t){ .type = type,
+					.hashval = hashval,
+					.expire = *expire,
+					.flags = flags,
+					.next = bc->table[hash] };
+
 		isc_buffer_init(&buffer, bad + 1, name->length);
-		dns_name_init(&bad->name, NULL);
-		dns_name_copy(name, &bad->name, &buffer);
-		bad->next = bc->table[hash];
+		bad->name = dns_fixedname_initname(&bad->fname);
+		dns_name_copy(name, bad->name);
 		bc->table[hash] = bad;
-		unsigned count = atomic_fetch_add_relaxed(&bc->count, 1);
+
+		count = atomic_fetch_add_relaxed(&bc->count, 1);
 		if ((count > bc->size * 8) ||
 		    (count < bc->size * 2 && bc->size > bc->minsize)) {
 			resize = true;
@@ -325,12 +329,11 @@ dns_badcache_find(dns_badcache_t *bc, const dns_name_t *name,
 				bc->table[hash] = bad->next;
 			}

-			isc_mem_put(bc->mctx, bad,
-				    sizeof(*bad) + bad->name.length);
+			isc_mem_put(bc->mctx, bad, sizeof(*bad));
 			atomic_fetch_sub(&bc->count, 1);
 			continue;
 		}
-		if (bad->type == type && dns_name_equal(name, &bad->name)) {
+		if (bad->type == type && dns_name_equal(name, bad->name)) {
 			if (flagp != NULL) {
 				*flagp = bad->flags;
 			}
@@ -350,8 +353,7 @@ skip:
 		bad = bc->table[i];
 		if (bad != NULL && isc_time_compare(&bad->expire, now) < 0) {
 			bc->table[i] = bad->next;
-			isc_mem_put(bc->mctx, bad,
-				    sizeof(*bad) + bad->name.length);
+			isc_mem_put(bc->mctx, bad, sizeof(*bad));
 			atomic_fetch_sub_relaxed(&bc->count, 1);
 		}
 		UNLOCK(&bc->tlocks[i]);
@@ -372,8 +374,7 @@ dns_badcache_flush(dns_badcache_t *bc) {
 	for (i = 0; atomic_load_relaxed(&bc->count) > 0 && i < bc->size; i++) {
 		for (entry = bc->table[i]; entry != NULL; entry = next) {
 			next = entry->next;
-			isc_mem_put(bc->mctx, entry,
-				    sizeof(*entry) + entry->name.length);
+			isc_mem_put(bc->mctx, entry, sizeof(*entry));
 			atomic_fetch_sub_relaxed(&bc->count, 1);
 		}
 		bc->table[i] = NULL;
@@ -404,15 +405,14 @@ dns_badcache_flushname(dns_badcache_t *bc, const dns_name_t *name) {
 		int n;
 		next = bad->next;
 		n = isc_time_compare(&bad->expire, &now);
-		if (n < 0 || dns_name_equal(name, &bad->name)) {
+		if (n < 0 || dns_name_equal(name, bad->name)) {
 			if (prev == NULL) {
 				bc->table[hash] = bad->next;
 			} else {
 				prev->next = bad->next;
 			}

-			isc_mem_put(bc->mctx, bad,
-				    sizeof(*bad) + bad->name.length);
+			isc_mem_put(bc->mctx, bad, sizeof(*bad));
 			atomic_fetch_sub_relaxed(&bc->count, 1);
 		} else {
 			prev = bad;
@@ -450,15 +450,14 @@ dns_badcache_flushtree(dns_badcache_t *bc, const dns_name_t *name) {
 		for (bad = bc->table[i]; bad != NULL; bad = next) {
 			next = bad->next;
 			n = isc_time_compare(&bad->expire, &now);
-			if (n < 0 || dns_name_issubdomain(&bad->name, name)) {
+			if (n < 0 || dns_name_issubdomain(bad->name, name)) {
 				if (prev == NULL) {
 					bc->table[i] = bad->next;
 				} else {
 					prev->next = bad->next;
 				}

-				isc_mem_put(bc->mctx, bad,
-					    sizeof(*bad) + bad->name.length);
+				isc_mem_put(bc->mctx, bad, sizeof(*bad));
 				atomic_fetch_sub_relaxed(&bc->count, 1);
 			} else {
 				prev = bad;
@@ -501,13 +500,12 @@ dns_badcache_print(dns_badcache_t *bc, const char *cachename, FILE *fp) {
 					bc->table[i] = bad->next;
 				}

-				isc_mem_put(bc->mctx, bad,
-					    sizeof(*bad) + bad->name.length);
+				isc_mem_put(bc->mctx, bad, sizeof(*bad));
 				atomic_fetch_sub_relaxed(&bc->count, 1);
 				continue;
 			}
 			prev = bad;
-			dns_name_format(&bad->name, namebuf, sizeof(namebuf));
+			dns_name_format(bad->name, namebuf, sizeof(namebuf));
 			dns_rdatatype_format(bad->type, typebuf,
 					     sizeof(typebuf));
 			t = isc_time_microdiff(&bad->expire, &now);
@@ -735,7 +735,7 @@ client_resfind(resctx_t *rctx, dns_fetchevent_t *event) {
 			if (tresult != ISC_R_SUCCESS) {
 				goto done;
 			}
-			dns_name_copynf(&cname.cname, name);
+			dns_name_copy(&cname.cname, name);
 			dns_rdata_freestruct(&cname);
 			want_restart = true;
 			goto done;
@@ -1155,7 +1155,7 @@ dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
 	rctx->sigrdataset = sigrdataset;

 	dns_fixedname_init(&rctx->name);
-	dns_name_copynf(name, dns_fixedname_name(&rctx->name));
+	dns_name_copy(name, dns_fixedname_name(&rctx->name));

 	rctx->client = client;
 	ISC_LINK_INIT(rctx, link);
@@ -612,7 +612,7 @@ rpsdb_finddb(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		nodep = &node;
 	}
 	rpsdb_findnode(db, name, false, nodep);
-	dns_name_copynf(name, foundname);
+	dns_name_copy(name, foundname);
 	return (rpsdb_findrdataset(db, *nodep, NULL, type, 0, 0, rdataset,
 				   sigrdataset));
 }
@@ -599,10 +599,8 @@ dst_key_fromnamedfile(const char *filename, const char *dirname, int type,
 			   ".key");
 	INSIST(result == ISC_R_SUCCESS);

-	result = dst_key_read_public(newfilename, type, mctx, &pubkey);
+	RETERR(dst_key_read_public(newfilename, type, mctx, &pubkey));
 	isc_mem_put(mctx, newfilename, newfilenamelen);
-	newfilename = NULL;
-	RETERR(result);

 	/*
 	 * Read the state file, if requested by type.
@@ -633,33 +631,20 @@ dst_key_fromnamedfile(const char *filename, const char *dirname, int type,
 	if ((type & (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC)) == DST_TYPE_PUBLIC ||
 	    (pubkey->key_flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY)
 	{
-		if (statefilename != NULL) {
-			isc_mem_put(mctx, statefilename, statefilenamelen);
-		}
-
-		result = computeid(pubkey);
-		if (result != ISC_R_SUCCESS) {
-			dst_key_free(&pubkey);
-			return (result);
-		}
-
+		RETERR(computeid(pubkey));
 		*keyp = pubkey;
-		return (ISC_R_SUCCESS);
+		pubkey = NULL;
+		goto out;
 	}

-	result = algorithm_status(pubkey->key_alg);
-	if (result != ISC_R_SUCCESS) {
-		dst_key_free(&pubkey);
-		return (result);
-	}
+	RETERR(algorithm_status(pubkey->key_alg));

 	key = get_key_struct(pubkey->key_name, pubkey->key_alg,
 			     pubkey->key_flags, pubkey->key_proto,
 			     pubkey->key_size, pubkey->key_class,
 			     pubkey->key_ttl, mctx);
 	if (key == NULL) {
-		dst_key_free(&pubkey);
-		return (ISC_R_NOMEMORY);
+		RETERR(ISC_R_NOMEMORY);
 	}

 	if (key->func->parse == NULL) {
@@ -691,20 +676,17 @@ dst_key_fromnamedfile(const char *filename, const char *dirname, int type,
 			/* Having no state is valid. */
 			result = ISC_R_SUCCESS;
 		}
-		isc_mem_put(mctx, statefilename, statefilenamelen);
-		statefilename = NULL;
+		RETERR(result);
 	}
-	RETERR(result);

 	RETERR(computeid(key));

 	if (pubkey->key_id != key->key_id) {
 		RETERR(DST_R_INVALIDPRIVATEKEY);
 	}
-	dst_key_free(&pubkey);

 	*keyp = key;
-	return (ISC_R_SUCCESS);
+	key = NULL;

 out:
 	if (pubkey != NULL) {
@@ -87,9 +87,12 @@ struct dns_acl {
 };

 struct dns_aclenv {
-	dns_acl_t *localhost;
-	dns_acl_t *localnets;
-	bool	   match_mapped;
+	unsigned int   magic;
+	isc_mem_t *    mctx;
+	isc_refcount_t references;
+	dns_acl_t *    localhost;
+	dns_acl_t *    localnets;
+	bool	       match_mapped;
 #if defined(HAVE_GEOIP2)
 	dns_geoip_databases_t *geoip;
 #endif /* HAVE_GEOIP2 */
@@ -191,16 +194,38 @@ dns_acl_allowed(isc_netaddr_t *addr, const dns_name_t *signer, dns_acl_t *acl,
 */

 isc_result_t
-dns_aclenv_init(isc_mem_t *mctx, dns_aclenv_t *env);
+dns_aclenv_create(isc_mem_t *mctx, dns_aclenv_t **envp);
 /*%<
- * Initialize ACL environment, setting up localhost and localnets ACLs
+ * Create ACL environment, setting up localhost and localnets ACLs
 */

 void
 dns_aclenv_copy(dns_aclenv_t *t, dns_aclenv_t *s);
+/*%<
+ * Copy the ACLs from one ACL environment object to another.
+ *
+ * Requires:
+ *\li	both 's' and 't' are valid ACL environments.
+ */

 void
-dns_aclenv_destroy(dns_aclenv_t *env);
+dns_aclenv_attach(dns_aclenv_t *source, dns_aclenv_t **targetp);
+/*%<
+ * Attach '*targetp' to ACL environment 'source'.
+ *
+ * Requires:
+ *\li	'source' is a valid ACL environment.
+ *\li	'targetp' is not NULL and '*targetp' is NULL.
+ */
+
+void
+dns_aclenv_detach(dns_aclenv_t **aclenvp);
+/*%<
+ * Detach an ACL environment; on final detach, destroy it.
+ *
+ * Requires:
+ *\li	'*aclenvp' to be a valid ACL environment
+ */

 isc_result_t
 dns_acl_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
@@ -271,6 +271,13 @@ struct dns_dbonupdatelistener {
 * window.
 */
 #define DNS_DBFIND_STALESTART 0x2000
+
+/*
+ * DNS_DBFIND_NONBLOCK: If set, then if a call to dns_db_find() would block
+ * while waiting for a read lock, the implementation may return ISC_R_LOCKBUSY
+ * so the lookup can be rescheduled for later.
+ */
+#define DNS_DBFIND_NONBLOCK 0x4000
 /*@}*/

 /*@{*/
@@ -243,11 +243,11 @@ dns_dumpctx_db(dns_dumpctx_t *dctx);

 /*@{*/
 isc_result_t
-dns_master_dumptostreaminc(isc_mem_t *mctx, dns_db_t *db,
-			   dns_dbversion_t *	     version,
-			   const dns_master_style_t *style, FILE *f,
-			   isc_task_t *task, dns_dumpdonefunc_t done,
-			   void *done_arg, dns_dumpctx_t **dctxp);
+dns_master_dumptostreamasync(isc_mem_t *mctx, dns_db_t *db,
+			     dns_dbversion_t *	       version,
+			     const dns_master_style_t *style, FILE *f,
+			     isc_task_t *task, dns_dumpdonefunc_t done,
+			     void *done_arg, dns_dumpctx_t **dctxp);

 isc_result_t
 dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
@@ -259,11 +259,6 @@ dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 * 'format'.  If the format is dns_masterformat_text (the RFC1035 format),
 * 'style' specifies the file style (e.g., &dns_master_style_default).
 *
- * dns_master_dumptostream() is an old form of dns_master_dumptostream3(),
- * which always specifies the dns_masterformat_text format.
- * dns_master_dumptostream2() is an old form which always specifies
- * a NULL header.
- *
 * If 'format' is dns_masterformat_raw, then 'header' can contain
 * information to be written to the file header.
 *
@@ -276,7 +271,6 @@ dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 *
 * Returns:
 *\li	ISC_R_SUCCESS
- *\li	ISC_R_CONTINUE	dns_master_dumptostreaminc() only.
 *\li	ISC_R_NOMEMORY
 *\li	Any database or rrset iterator error.
 *\li	Any dns_rdata_totext() error code.
@@ -286,11 +280,11 @@ dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 /*@{*/

 isc_result_t
-dns_master_dumpinc(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
-		   const dns_master_style_t *style, const char *filename,
-		   isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg,
-		   dns_dumpctx_t **dctxp, dns_masterformat_t format,
-		   dns_masterrawheader_t *header);
+dns_master_dumpasync(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
+		     const dns_master_style_t *style, const char *filename,
+		     isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg,
+		     dns_dumpctx_t **dctxp, dns_masterformat_t format,
+		     dns_masterrawheader_t *header);

 isc_result_t
 dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
@@ -302,11 +296,6 @@ dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 * 'format'.  If the format is dns_masterformat_text (the RFC1035 format),
 * 'style' specifies the file style (e.g., &dns_master_style_default).
 *
- * dns_master_dumpinc() and dns_master_dump() are old forms of _dumpinc3()
- * and _dump3(), respectively, which always specify the dns_masterformat_text
- * format.  dns_master_dumpinc2() and dns_master_dump2() are old forms which
- * always specify a NULL header.
- *
 * If 'format' is dns_masterformat_raw, then 'header' can contain
 * information to be written to the file header.
 *
@@ -314,7 +303,6 @@ dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 *
 * Returns:
 *\li	ISC_R_SUCCESS
- *\li	ISC_R_CONTINUE	dns_master_dumpinc() only.
 *\li	ISC_R_NOMEMORY
 *\li	Any database or rrset iterator error.
 *\li	Any dns_rdata_totext() error code.
@@ -74,8 +74,7 @@
 * \code
 *	buffer = isc_buffer_allocate(mctx, 512);
 *	name = NULL;
- *	name = dns_message_gettempname(message, &name);
- *	dns_name_init(name, NULL);
+ *	result = dns_message_gettempname(message, &name);
 *	result = dns_name_fromtext(name, &source, dns_rootname, 0, buffer);
 *	dns_message_takebuffer(message, &buffer);
 * \endcode
@@ -890,24 +889,8 @@ dns_message_gettempname(dns_message_t *msg, dns_name_t **item);
 * to the message code using dns_message_puttempname() or inserted into
 * one of the message's sections before the message is destroyed.
 *
- * It is the caller's responsibility to initialize this name.
- *
- * Requires:
- *\li	msg be a valid message
- *
- *\li	item != NULL && *item == NULL
- *
- * Returns:
- *\li	#ISC_R_SUCCESS		-- All is well.
- *\li	#ISC_R_NOMEMORY		-- No item can be allocated.
- */
-
-isc_result_t
-dns_message_gettempoffsets(dns_message_t *msg, dns_offsets_t **item);
-/*%<
- * Return an offsets array that can be used for any temporary purpose,
- * such as attaching to a temporary name.  The offsets will be freed
- * when the message is destroyed or reset.
+ * The name will be associated with a dns_fixedname object, and will
+ * be initialized.
 *
 * Requires:
 *\li	msg be a valid message
@@ -638,7 +638,7 @@ dns_name_clone(const dns_name_t *source, dns_name_t *target);
 * Notes:
 *
 * \li	'target' refers to the same memory as 'source', so 'source'
- *	must not be changed while 'target' is still in use.
+ *	must not be changed or freed while 'target' is still in use.
 *
 * \li	This call is functionally equivalent to:
 *
@@ -1240,31 +1240,17 @@ dns_name_settotextfilter(dns_name_totextfilter_t *proc);
 * Includes space for the terminating NULL.
 */

-isc_result_t
-dns_name_copy(const dns_name_t *source, dns_name_t *dest, isc_buffer_t *target);
 void
-dns_name_copynf(const dns_name_t *source, dns_name_t *dest);
+dns_name_copy(const dns_name_t *source, dns_name_t *dest);
 /*%<
- * Makes 'dest' refer to a copy of the name in 'source'.  The data are either
- * copied to 'target' or in case of dns_name_copynf the dedicated buffer in
- * 'dest'.
+ * Copies the name in 'source' into 'dest'.  The name data is copied to
+ * the dedicated buffer for 'dest'. (If copying to a name that doesn't
+ * have a dedicated buffer, use dns_name_setbuffer() first.)
 *
 * Requires:
 * \li	'source' is a valid name.
 *
 * \li	'dest' is an initialized name with a dedicated buffer.
- *
- * \li	'target' is an initialized buffer.
- *
- * \li	Either dest has a dedicated buffer or target != NULL.
- *
- * Ensures:
- *
- *\li	On success, the used space in target is updated.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS
- *\li	#ISC_R_NOSPACE
 */

 bool
@@ -95,7 +95,7 @@ typedef struct dns_rdatasetmethods {
 * rdataset implementations may change any of the fields.
 */
 struct dns_rdataset {
-	unsigned int	       magic; /* XXX ? */
+	unsigned int	       magic;
 	dns_rdatasetmethods_t *methods;
 	ISC_LINK(dns_rdataset_t) link;

@@ -107,11 +107,7 @@ struct dns_rdataset {
 	dns_rdataclass_t rdclass;
 	dns_rdatatype_t	 type;
 	dns_ttl_t	 ttl;
-	/*
-	 * Stale ttl is used to see how long this RRset can still be used
-	 * to serve to clients, after the TTL has expired.
-	 */
-	dns_ttl_t	stale_ttl;
+
 	dns_trust_t	trust;
 	dns_rdatatype_t covers;

@@ -163,7 +163,7 @@ struct dns_view {
 	dns_ttl_t	      prefetch_trigger;
 	dns_ttl_t	      prefetch_eligible;
 	in_port_t	      dstport;
-	dns_aclenv_t	      aclenv;
+	dns_aclenv_t *	      aclenv;
 	dns_rdatatype_t	      preferred_glue;
 	bool		      flush;
 	dns_namelist_t *      delonly;
@@ -363,6 +363,24 @@ dns_zone_getmaxttl(dns_zone_t *zone);
 *\li	dns_ttl_t maxttl.
 */

+void
+dns_zone_lock_keyfiles(dns_zone_t *zone);
+/*%<
+ *	Lock associated keyfiles for this zone.
+ *
+ * Require:
+ *\li	'zone' to be a valid zone.
+ */
+
+void
+dns_zone_unlock_keyfiles(dns_zone_t *zone);
+/*%<
+ *	Unlock associated keyfiles for this zone.
+ *
+ * Require:
+ *\li	'zone' to be a valid zone.
+ */
+
 isc_result_t
 dns_zone_load(dns_zone_t *zone, bool newonly);

@@ -468,16 +486,6 @@ dns_zone_idetach(dns_zone_t **zonep);
 *\li	'zonep' to point to a valid zone.
 */

-void
-dns_zone_setflag(dns_zone_t *zone, unsigned int flags, bool value);
-/*%<
- *	Sets ('value' == 'true') / clears ('value' == 'IS_FALSE')
- *	zone flags.  Valid flag bits are DNS_ZONE_F_*.
- *
- * Requires
- *\li	'zone' to be a valid zone.
- */
-
 isc_result_t
 dns_zone_getdb(dns_zone_t *zone, dns_db_t **dbp);
 /*%<
@@ -131,7 +131,7 @@ dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx,
 	dns_name_t *zonename;

 	zonename = dns_fixedname_initname(&fixed);
-	dns_name_copynf(dns_db_origin(db), zonename);
+	dns_name_copy(dns_db_origin(db), zonename);

 	node = NULL;
 	result = dns_db_findnode(db, zonename, false, &node);
@@ -854,6 +854,73 @@ ixfr_order(const void *av, const void *bv) {
 	return (r);
 }

+static isc_result_t
+maybe_fixup_xhdr(dns_journal_t *j, journal_xhdr_t *xhdr, uint32_t serial,
+		 isc_offset_t offset) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	/*
+	 * Handle mixture of version 1 and version 2
+	 * transaction headers in a version 1 journal.
+	 */
+	if ((xhdr->serial0 != serial ||
+	     isc_serial_le(xhdr->serial1, xhdr->serial0))) {
+		if (j->xhdr_version == XHDR_VERSION1 && xhdr->serial1 == serial)
+		{
+			isc_log_write(
+				JOURNAL_COMMON_LOGARGS, ISC_LOG_DEBUG(3),
+				"%s: XHDR_VERSION1 -> XHDR_VERSION2 at %u",
+				j->filename, serial);
+			j->xhdr_version = XHDR_VERSION2;
+			CHECK(journal_seek(j, offset));
+			CHECK(journal_read_xhdr(j, xhdr));
+			j->recovered = true;
+		} else if (j->xhdr_version == XHDR_VERSION2 &&
+			   xhdr->count == serial) {
+			isc_log_write(
+				JOURNAL_COMMON_LOGARGS, ISC_LOG_DEBUG(3),
+				"%s: XHDR_VERSION2 -> XHDR_VERSION1 at %u",
+				j->filename, serial);
+			j->xhdr_version = XHDR_VERSION1;
+			CHECK(journal_seek(j, offset));
+			CHECK(journal_read_xhdr(j, xhdr));
+			j->recovered = true;
+		}
+	}
+
+	/*
+	 * Handle <size, serial0, serial1, 0> transaction header.
+	 */
+	if (j->xhdr_version == XHDR_VERSION1) {
+		uint32_t value;
+
+		CHECK(journal_read(j, &value, sizeof(value)));
+		if (value != 0L) {
+			CHECK(journal_seek(j, offset + 12));
+		} else {
+			isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_DEBUG(3),
+				      "%s: XHDR_VERSION1 count zero at %u",
+				      j->filename, serial);
+			j->xhdr_version = XHDR_VERSION2;
+			j->recovered = true;
+		}
+	} else if (j->xhdr_version == XHDR_VERSION2 && xhdr->count == serial &&
+		   xhdr->serial1 == 0U &&
+		   isc_serial_gt(xhdr->serial0, xhdr->count))
+	{
+		isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_DEBUG(3),
+			      "%s: XHDR_VERSION2 count zero at %u", j->filename,
+			      serial);
+		xhdr->serial1 = xhdr->serial0;
+		xhdr->serial0 = xhdr->count;
+		xhdr->count = 0;
+		j->recovered = true;
+	}
+
+failure:
+	return (result);
+}
+
 /*
 * Advance '*pos' to the next journal transaction.
 *
@@ -871,7 +938,7 @@ ixfr_order(const void *av, const void *bv) {
 *    Other results due to file errors are possible.
 */
 static isc_result_t
-journal_next(dns_journal_t *j, journal_pos_t *pos, bool retry) {
+journal_next(dns_journal_t *j, journal_pos_t *pos) {
 	isc_result_t result;
 	journal_xhdr_t xhdr;
 	size_t hdrsize;
@@ -896,46 +963,20 @@ journal_next(dns_journal_t *j, journal_pos_t *pos, bool retry) {
 		return (result);
 	}

+	if (j->header_ver1) {
+		CHECK(maybe_fixup_xhdr(j, &xhdr, pos->serial, pos->offset));
+	}
+
 	/*
 	 * Check serial number consistency.
 	 */
 	if (xhdr.serial0 != pos->serial ||
 	    isc_serial_le(xhdr.serial1, xhdr.serial0)) {
-		if (j->header_ver1 && j->xhdr_version == XHDR_VERSION1 &&
-		    xhdr.serial1 == pos->serial && !retry)
-		{
-			/* XHDR_VERSION1 -> XHDR_VERSION2 */
-			isc_log_write(
-				JOURNAL_COMMON_LOGARGS, ISC_LOG_DEBUG(3),
-				"%s: XHDR_VERSION1 -> XHDR_VERSION2 at %u",
-				j->filename, pos->serial);
-			j->xhdr_version = XHDR_VERSION2;
-			result = journal_next(j, pos, true);
-			if (result == ISC_R_SUCCESS) {
-				j->recovered = true;
-			}
-			return (result);
-		} else if (j->header_ver1 && j->xhdr_version == XHDR_VERSION2 &&
-			   xhdr.count == pos->serial && !retry)
-		{
-			/* XHDR_VERSION2 -> XHDR_VERSION1 */
-			isc_log_write(
-				JOURNAL_COMMON_LOGARGS, ISC_LOG_DEBUG(3),
-				"%s: XHDR_VERSION2 -> XHDR_VERSION1 at %u",
-				j->filename, pos->serial);
-			j->xhdr_version = XHDR_VERSION1;
-			result = journal_next(j, pos, true);
-			if (result == ISC_R_SUCCESS) {
-				j->recovered = true;
-			}
-			return (result);
-		} else {
-			isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
-				      "%s: journal file corrupt: "
-				      "expected serial %u, got %u",
-				      j->filename, pos->serial, xhdr.serial0);
-			return (ISC_R_UNEXPECTED);
-		}
+		isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
+			      "%s: journal file corrupt: "
+			      "expected serial %u, got %u",
+			      j->filename, pos->serial, xhdr.serial0);
+		return (ISC_R_UNEXPECTED);
 	}

 	/*
@@ -945,29 +986,6 @@ journal_next(dns_journal_t *j, journal_pos_t *pos, bool retry) {
 			  ? sizeof(journal_rawxhdr_t)
 			  : sizeof(journal_rawxhdr_ver1_t);

-	/*
-	 * Handle <size, serial0, serial1, 0> transaction header.
-	 */
-	if (j->header_ver1 && j->xhdr_version == XHDR_VERSION1) {
-		uint32_t value;
-
-		CHECK(journal_read(j, &value, sizeof(value)));
-		if (value != 0L) {
-			CHECK(journal_seek(j, pos->offset + 12));
-		} else {
-			j->recovered = true;
-			hdrsize += 4;
-		}
-	} else if (j->header_ver1 && j->xhdr_version == XHDR_VERSION2 &&
-		   xhdr.count == pos->serial && xhdr.serial1 == 0U &&
-		   isc_serial_ge(xhdr.serial0, xhdr.count))
-	{
-		xhdr.serial1 = xhdr.serial0;
-		xhdr.serial0 = xhdr.count;
-		xhdr.count = 0;
-		j->recovered = true;
-	}
-
 	if ((isc_offset_t)(pos->offset + hdrsize + xhdr.size) < pos->offset) {
 		isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
 			      "%s: offset too large", j->filename);
@@ -1114,7 +1132,7 @@ journal_find(dns_journal_t *j, uint32_t serial, journal_pos_t *pos) {
 		if (DNS_SERIAL_GT(current_pos.serial, serial)) {
 			return (ISC_R_NOTFOUND);
 		}
-		result = journal_next(j, &current_pos, false);
+		result = journal_next(j, &current_pos);
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
@@ -1326,7 +1344,7 @@ dns_journal_commit(dns_journal_t *j) {
 	if (!JOURNAL_EMPTY(&j->header)) {
 		while (!DNS_SERIAL_GT(j->x.pos[1].serial,
 				      j->header.begin.serial)) {
-			CHECK(journal_next(j, &j->header.begin, false));
+			CHECK(journal_next(j, &j->header.begin));
 		}
 		index_invalidate(j, j->x.pos[1].serial);
 	}
@@ -1806,7 +1824,7 @@ dns_journal_get_sourceserial(dns_journal_t *j, uint32_t *sourceserial) {
 */

 static isc_result_t
-read_one_rr(dns_journal_t *j, bool retry);
+read_one_rr(dns_journal_t *j);

 /*
 * Make sure the buffer 'b' is has at least 'size' bytes
@@ -1857,14 +1875,27 @@ dns_journal_iter_init(dns_journal_t *j, uint32_t begin_serial,
 		 * adding up sizes and RR counts so we can calculate
 		 * the IXFR size.
 		 */
-		CHECK(journal_seek(j, pos.offset));
 		do {
+			CHECK(journal_seek(j, pos.offset));
 			CHECK(journal_read_xhdr(j, &xhdr));

+			if (j->header_ver1) {
+				CHECK(maybe_fixup_xhdr(j, &xhdr, pos.serial,
+						       pos.offset));
+			}
+
+			/*
+			 * Check that xhdr is consistent.
+			 */
+			if (xhdr.serial0 != pos.serial ||
+			    isc_serial_le(xhdr.serial1, xhdr.serial0)) {
+				CHECK(ISC_R_UNEXPECTED);
+			}
+
 			size += xhdr.size;
 			count += xhdr.count;

-			result = journal_next(j, &pos, false);
+			result = journal_next(j, &pos);
 			if (result == ISC_R_NOMORE) {
 				result = ISC_R_SUCCESS;
 			}
@@ -1900,14 +1931,14 @@ dns_journal_first_rr(dns_journal_t *j) {
 	j->it.xsize = 0; /* We have no transaction data yet... */
 	j->it.xpos = 0;	 /* ...and haven't used any of it. */

-	return (read_one_rr(j, false));
+	return (read_one_rr(j));

 failure:
 	return (result);
 }

 static isc_result_t
-read_one_rr(dns_journal_t *j, bool retry) {
+read_one_rr(dns_journal_t *j) {
 	isc_result_t result;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
@@ -1938,34 +1969,15 @@ read_one_rr(dns_journal_t *j, bool retry) {
 				      j->filename);
 			FAIL(ISC_R_UNEXPECTED);
 		}
+
+		if (j->header_ver1) {
+			CHECK(maybe_fixup_xhdr(j, &xhdr, j->it.current_serial,
+					       save.offset));
+		}
+
 		if (xhdr.serial0 != j->it.current_serial ||
 		    isc_serial_le(xhdr.serial1, xhdr.serial0))
 		{
-			if (!retry && j->header_ver1 &&
-			    j->xhdr_version == XHDR_VERSION2 &&
-			    xhdr.count == j->it.current_serial)
-			{
-				/* XHDR_VERSION2 -> XHDR_VERSION1 */
-				j->xhdr_version = XHDR_VERSION1;
-				CHECK(journal_seek(j, save.offset));
-				result = read_one_rr(j, true);
-				if (result == ISC_R_SUCCESS) {
-					j->recovered = true;
-				}
-				return (result);
-			} else if (!retry && j->header_ver1 &&
-				   j->xhdr_version == XHDR_VERSION1 &&
-				   xhdr.serial1 == j->it.current_serial)
-			{
-				/* XHDR_VERSION1 -> XHDR_VERSION2 */
-				j->xhdr_version = XHDR_VERSION2;
-				CHECK(journal_seek(j, save.offset));
-				result = read_one_rr(j, true);
-				if (result == ISC_R_SUCCESS) {
-					j->recovered = true;
-				}
-				return (result);
-			}
 			isc_log_write(JOURNAL_COMMON_LOGARGS, ISC_LOG_ERROR,
 				      "%s: journal file corrupt: "
 				      "expected serial %u, got %u",
@@ -1974,29 +1986,6 @@ read_one_rr(dns_journal_t *j, bool retry) {
 			FAIL(ISC_R_UNEXPECTED);
 		}

-		/*
-		 * Handle <size, serial0, serial1, 0> transaction header.
-		 */
-		if (j->header_ver1 && j->xhdr_version == XHDR_VERSION1) {
-			uint32_t value;
-
-			CHECK(journal_read(j, &value, sizeof(value)));
-			if (value != 0L) {
-				CHECK(journal_seek(j, save.offset + 12));
-			} else {
-				j->recovered = true;
-			}
-		} else if (j->header_ver1 && j->xhdr_version == XHDR_VERSION2 &&
-			   xhdr.count == j->it.current_serial &&
-			   xhdr.serial1 == 0U &&
-			   isc_serial_ge(xhdr.serial0, xhdr.count))
-		{
-			xhdr.serial1 = xhdr.serial0;
-			xhdr.serial0 = xhdr.count;
-			xhdr.count = 0;
-			j->recovered = true;
-		}
-
 		j->it.xsize = xhdr.size;
 		j->it.xpos = 0;
 	}
@@ -2080,7 +2069,7 @@ failure:

 isc_result_t
 dns_journal_next_rr(dns_journal_t *j) {
-	j->it.result = read_one_rr(j, false);
+	j->it.result = read_one_rr(j);
 	return (j->it.result);
 }

@@ -2567,7 +2556,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, uint32_t serial,

 	current_pos = best_guess;
 	while (current_pos.serial != serial) {
-		CHECK(journal_next(j1, &current_pos, false));
+		CHECK(journal_next(j1, &current_pos));
 		if (current_pos.serial == j1->header.end.serial) {
 			break;
 		}
@@ -2585,7 +2574,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, uint32_t serial,

 	INSIST(best_guess.serial != j1->header.end.serial);
 	if (best_guess.serial != serial) {
-		CHECK(journal_next(j1, &best_guess, false));
+		CHECK(journal_next(j1, &best_guess));
 		serial = best_guess.serial;
 	}

@@ -2665,7 +2654,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, uint32_t serial,
 			 */
 			if (j1->xhdr_version == XHDR_VERSION2 &&
 			    xhdr.count == serial && xhdr.serial1 == 0U &&
-			    isc_serial_ge(xhdr.serial0, xhdr.count))
+			    isc_serial_gt(xhdr.serial0, xhdr.count))
 			{
 				xhdr.serial1 = xhdr.serial0;
 				xhdr.serial0 = xhdr.count;
@@ -2731,7 +2720,7 @@ dns_journal_compact(isc_mem_t *mctx, char *filename, uint32_t serial,
 		current_pos = j2->header.begin;
 		while (current_pos.serial != j2->header.end.serial) {
 			index_add(j2, &current_pos);
-			CHECK(journal_next(j2, &current_pos, false));
+			CHECK(journal_next(j2, &current_pos));
 		}

 		/*
@@ -1713,6 +1713,20 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 				      keystr, keymgr_keyrole(active_key->key),
 				      dns_kasp_getname(kasp));
 		}
+
+		/*
+		 * If rollover is not allowed, warn.
+		 */
+		if (!rollover) {
+			dst_key_format(active_key->key, keystr, sizeof(keystr));
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSSEC,
+				      DNS_LOGMODULE_DNSSEC, ISC_LOG_WARNING,
+				      "keymgr: DNSKEY %s (%s) is offline in "
+				      "policy %s, cannot start rollover",
+				      keystr, keymgr_keyrole(active_key->key),
+				      dns_kasp_getname(kasp));
+			return (ISC_R_SUCCESS);
+		}
 	} else if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(1))) {
 		char namestr[DNS_NAME_FORMATSIZE];
 		dns_name_format(origin, namestr, sizeof(namestr));
@@ -1724,20 +1738,6 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,

 	/* It is time to do key rollover, we need a new key. */

-	/*
-	 * If rollover is not allowed, warn.
-	 */
-	if (!rollover) {
-		dst_key_format(active_key->key, keystr, sizeof(keystr));
-		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DNSSEC,
-			      DNS_LOGMODULE_DNSSEC, ISC_LOG_WARNING,
-			      "keymgr: DNSKEY %s (%s) is offline in policy %s, "
-			      "cannot start rollover",
-			      keystr, keymgr_keyrole(active_key->key),
-			      dns_kasp_getname(kasp));
-		return (ISC_R_SUCCESS);
-	}
-
 	/*
 	 * Check if there is a key available in pool because keys
 	 * may have been pregenerated with dnssec-keygen.
@@ -247,7 +247,7 @@ lookup_find(dns_lookup_t *lookup, dns_fetchevent_t *event) {
 			if (result != ISC_R_SUCCESS) {
 				break;
 			}
-			dns_name_copynf(&cname.cname, name);
+			dns_name_copy(&cname.cname, name);
 			dns_rdata_freestruct(&cname);
 			want_restart = true;
 			send_event = false;
@@ -388,7 +388,7 @@ dns_lookup_create(isc_mem_t *mctx, const dns_name_t *name, dns_rdatatype_t type,

 	dns_fixedname_init(&lookup->name);

-	dns_name_copynf(name, dns_fixedname_name(&lookup->name));
+	dns_name_copy(name, dns_fixedname_name(&lookup->name));

 	lookup->type = type;
 	lookup->view = NULL;
@@ -265,8 +265,8 @@ struct dns_dumpctx {
 	isc_task_t *task;
 	dns_dumpdonefunc_t done;
 	void *done_arg;
-	unsigned int nodes;
-	/* dns_master_dumpinc() */
+	/* dns_master_dumpasync() */
+	isc_result_t result;
 	char *file;
 	char *tmpfile;
 	dns_masterformat_t format;
@@ -572,7 +572,7 @@ rdataset_totext(dns_rdataset_t *rdataset, const dns_name_t *owner_name,

 	if (owner_name != NULL) {
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copynf(owner_name, name);
+		dns_name_copy(owner_name, name);
 		dns_rdataset_getownercase(rdataset, name);
 	}

@@ -1114,7 +1114,7 @@ again:
 				char buf[sizeof("YYYYMMDDHHMMSS")];
 				memset(buf, 0, sizeof(buf));
 				isc_buffer_init(&b, buf, sizeof(buf) - 1);
-				dns_time64_totext((uint64_t)rds->stale_ttl, &b);
+				dns_time64_totext((uint64_t)rds->ttl, &b);
 				fprintf(f,
 					"; expired since %s "
 					"(awaiting cleanup)\n",
@@ -1286,7 +1286,7 @@ dump_rdatasets_raw(isc_mem_t *mctx, const dns_name_t *owner_name,
 	dns_name_t *name;

 	name = dns_fixedname_initname(&fixed);
-	dns_name_copynf(owner_name, name);
+	dns_name_copy(owner_name, name);
 	for (result = dns_rdatasetiter_first(rdsiter); result == ISC_R_SUCCESS;
 	     result = dns_rdatasetiter_next(rdsiter))
 	{
@@ -1343,7 +1343,7 @@ dump_rdatasets_map(isc_mem_t *mctx, const dns_name_t *name,
 static const int initial_buffer_length = 1200;

 static isc_result_t
-dumptostreaminc(dns_dumpctx_t *dctx);
+dumptostream(dns_dumpctx_t *dctx);

 static void
 dumpctx_destroy(dns_dumpctx_t *dctx) {
@@ -1486,27 +1486,23 @@ closeandrename(FILE *f, isc_result_t result, const char *temp,
 	return (result);
 }

+/*
+ * This will run in a libuv threadpool thread.
+ */
 static void
-dump_quantum(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result;
-	isc_result_t tresult;
-	dns_dumpctx_t *dctx;
-
-	REQUIRE(event != NULL);
-	dctx = event->ev_arg;
+master_dump_cb(void *data) {
+	isc_result_t result = ISC_R_UNSET;
+	dns_dumpctx_t *dctx = data;
 	REQUIRE(DNS_DCTX_VALID(dctx));
+
 	if (atomic_load_acquire(&dctx->canceled)) {
 		result = ISC_R_CANCELED;
 	} else {
-		result = dumptostreaminc(dctx);
-	}
-	if (result == DNS_R_CONTINUE) {
-		event->ev_arg = dctx;
-		isc_task_send(task, &event);
-		return;
+		result = dumptostream(dctx);
 	}

 	if (dctx->file != NULL) {
+		isc_result_t tresult = ISC_R_UNSET;
 		tresult = closeandrename(dctx->f, result, dctx->tmpfile,
 					 dctx->file);
 		if (tresult != ISC_R_SUCCESS && result == ISC_R_SUCCESS) {
@@ -1515,17 +1511,51 @@ dump_quantum(isc_task_t *task, isc_event_t *event) {
 	} else {
 		result = flushandsync(dctx->f, result, NULL);
 	}
+
+	dctx->result = result;
+}
+
+/*
+ * This will run in a network/task manager thread when the dump is complete.
+ */
+static void
+master_dump_done_cb(void *data, isc_result_t result) {
+	dns_dumpctx_t *dctx = data;
+
+	if (result == ISC_R_SUCCESS && dctx->result != ISC_R_SUCCESS) {
+		result = dctx->result;
+	}
+
 	(dctx->done)(dctx->done_arg, result);
-	isc_event_free(&event);
 	dns_dumpctx_detach(&dctx);
 }

+/*
+ * This must be run from a network/task manager thread.
+ */
+static void
+setup_dump(isc_task_t *task, isc_event_t *event) {
+	dns_dumpctx_t *dctx = NULL;
+
+	REQUIRE(isc_nm_tid() >= 0);
+	REQUIRE(event != NULL);
+
+	dctx = event->ev_arg;
+
+	REQUIRE(DNS_DCTX_VALID(dctx));
+
+	isc_nm_work_offload(isc_task_getnetmgr(task), master_dump_cb,
+			    master_dump_done_cb, dctx);
+
+	isc_event_free(&event);
+}
+
 static isc_result_t
 task_send(dns_dumpctx_t *dctx) {
 	isc_event_t *event;

 	event = isc_event_allocate(dctx->mctx, NULL, DNS_EVENT_DUMPQUANTUM,
-				   dump_quantum, dctx, sizeof(*event));
+				   setup_dump, dctx, sizeof(*event));
 	isc_task_send(dctx->task, &event);
 	return (ISC_R_SUCCESS);
 }
@@ -1548,7 +1578,6 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 	dctx->done = NULL;
 	dctx->done_arg = NULL;
 	dctx->task = NULL;
-	dctx->nodes = 0;
 	dctx->first = true;
 	atomic_init(&dctx->canceled, false);
 	dctx->file = NULL;
@@ -1702,13 +1731,12 @@ writeheader(dns_dumpctx_t *dctx) {
 }

 static isc_result_t
-dumptostreaminc(dns_dumpctx_t *dctx) {
+dumptostream(dns_dumpctx_t *dctx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_buffer_t buffer;
 	char *bufmem;
 	dns_name_t *name;
 	dns_fixedname_t fixname;
-	unsigned int nodes;
 	isc_time_t start;

 	bufmem = isc_mem_get(dctx->mctx, initial_buffer_length);
@@ -1742,9 +1770,8 @@ dumptostreaminc(dns_dumpctx_t *dctx) {
 		result = ISC_R_SUCCESS;
 	}

-	nodes = dctx->nodes;
 	isc_time_now(&start);
-	while (result == ISC_R_SUCCESS && (dctx->nodes == 0 || nodes--)) {
+	while (result == ISC_R_SUCCESS) {
 		dns_rdatasetiter_t *rdsiter = NULL;
 		dns_dbnode_t *node = NULL;

@@ -1780,52 +1807,7 @@ dumptostreaminc(dns_dumpctx_t *dctx) {
 		result = dns_dbiterator_next(dctx->dbiter);
 	}

-	/*
-	 * Work out how many nodes can be written in the time between
-	 * two requests to the nameserver.  Smooth the resulting number and
-	 * use it as a estimate for the number of nodes to be written in the
-	 * next iteration.
-	 */
-	if (dctx->nodes != 0 && result == ISC_R_SUCCESS) {
-		unsigned int pps = dns_pps; /* packets per second */
-		unsigned int interval;
-		uint64_t usecs;
-		isc_time_t end;
-
-		isc_time_now(&end);
-		if (pps < 100) {
-			pps = 100;
-		}
-		interval = 1000000 / pps; /* interval in usecs */
-		if (interval == 0) {
-			interval = 1;
-		}
-		usecs = isc_time_microdiff(&end, &start);
-		if (usecs == 0) {
-			dctx->nodes = dctx->nodes * 2;
-			if (dctx->nodes > 1000) {
-				dctx->nodes = 1000;
-			}
-		} else {
-			nodes = dctx->nodes * interval;
-			nodes /= (unsigned int)usecs;
-			if (nodes == 0) {
-				nodes = 1;
-			} else if (nodes > 1000) {
-				nodes = 1000;
-			}
-
-			/* Smooth and assign. */
-			dctx->nodes = (nodes + dctx->nodes * 7) / 8;
-
-			isc_log_write(dns_lctx, ISC_LOGCATEGORY_GENERAL,
-				      DNS_LOGMODULE_MASTERDUMP,
-				      ISC_LOG_DEBUG(1),
-				      "dumptostreaminc(%p) new nodes -> %d",
-				      dctx, dctx->nodes);
-		}
-		result = DNS_R_CONTINUE;
-	} else if (result == ISC_R_NOMORE) {
+	if (result == ISC_R_NOMORE) {
 		result = ISC_R_SUCCESS;
 	}
 cleanup:
@@ -1835,11 +1817,11 @@ cleanup:
 }

 isc_result_t
-dns_master_dumptostreaminc(isc_mem_t *mctx, dns_db_t *db,
-			   dns_dbversion_t *version,
-			   const dns_master_style_t *style, FILE *f,
-			   isc_task_t *task, dns_dumpdonefunc_t done,
-			   void *done_arg, dns_dumpctx_t **dctxp) {
+dns_master_dumptostreamasync(isc_mem_t *mctx, dns_db_t *db,
+			     dns_dbversion_t *version,
+			     const dns_master_style_t *style, FILE *f,
+			     isc_task_t *task, dns_dumpdonefunc_t done,
+			     void *done_arg, dns_dumpctx_t **dctxp) {
 	dns_dumpctx_t *dctx = NULL;
 	isc_result_t result;

@@ -1855,7 +1837,6 @@ dns_master_dumptostreaminc(isc_mem_t *mctx, dns_db_t *db,
 	isc_task_attach(task, &dctx->task);
 	dctx->done = done;
 	dctx->done_arg = done_arg;
-	dctx->nodes = 100;

 	result = task_send(dctx);
 	if (result == ISC_R_SUCCESS) {
@@ -1881,7 +1862,7 @@ dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 		return (result);
 	}

-	result = dumptostreaminc(dctx);
+	result = dumptostream(dctx);
 	INSIST(result != DNS_R_CONTINUE);
 	dns_dumpctx_detach(&dctx);

@@ -1917,6 +1898,11 @@ opentmp(isc_mem_t *mctx, dns_masterformat_t format, const char *file,
 			      isc_result_totext(result));
 		goto cleanup;
 	}
+
+#if defined(POSIX_FADV_DONTNEED)
+	posix_fadvise(fileno(f), 0, 0, POSIX_FADV_DONTNEED);
+#endif
+
 	*tempp = tempname;
 	*fp = f;
 	return (ISC_R_SUCCESS);
@@ -1927,11 +1913,11 @@ cleanup:
 }

 isc_result_t
-dns_master_dumpinc(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
-		   const dns_master_style_t *style, const char *filename,
-		   isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg,
-		   dns_dumpctx_t **dctxp, dns_masterformat_t format,
-		   dns_masterrawheader_t *header) {
+dns_master_dumpasync(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
+		     const dns_master_style_t *style, const char *filename,
+		     isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg,
+		     dns_dumpctx_t **dctxp, dns_masterformat_t format,
+		     dns_masterrawheader_t *header) {
 	FILE *f = NULL;
 	isc_result_t result;
 	char *tempname = NULL;
@@ -1956,7 +1942,6 @@ dns_master_dumpinc(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 	isc_task_attach(task, &dctx->task);
 	dctx->done = done;
 	dctx->done_arg = done_arg;
-	dctx->nodes = 100;
 	dctx->file = file;
 	file = NULL;
 	dctx->tmpfile = tempname;
@@ -2001,7 +1986,7 @@ dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 		goto cleanup;
 	}

-	result = dumptostreaminc(dctx);
+	result = dumptostream(dctx);
 	INSIST(result != DNS_R_CONTINUE);
 	dns_dumpctx_detach(&dctx);

@@ -104,12 +104,14 @@ hexdump(const char *msg, const char *msg2, void *base, size_t len) {
 * of various block allocations used within the server.
 * XXXMLG These should come from a config setting.
 */
-#define SCRATCHPAD_SIZE 512
-#define NAME_COUNT	64
-#define OFFSET_COUNT	4
-#define RDATA_COUNT	8
-#define RDATALIST_COUNT 8
-#define RDATASET_COUNT	64
+#define SCRATCHPAD_SIZE	   1232
+#define NAME_FILLCOUNT	   4
+#define NAME_FREEMAX	   8 * NAME_FILLCOUNT
+#define OFFSET_COUNT	   4
+#define RDATA_COUNT	   8
+#define RDATALIST_COUNT	   8
+#define RDATASET_FILLCOUNT 4
+#define RDATASET_FREEMAX   8 * RDATASET_FILLCOUNT

 /*%
 * Text representation of the different items, for message_totext
@@ -466,10 +468,7 @@ msgresetnames(dns_message_t *msg, unsigned int first_section) {
 				isc_mempool_put(msg->rdspool, rds);
 				rds = next_rds;
 			}
-			if (dns_name_dynamic(name)) {
-				dns_name_free(name, msg->mctx);
-			}
-			isc_mempool_put(msg->namepool, name);
+			dns_message_puttempname(msg, &name);
 			name = next_name;
 		}
 	}
@@ -511,12 +510,8 @@ msgresetsigs(dns_message_t *msg, bool replying) {
 				isc_mempool_put(msg->rdspool, msg->querytsig);
 			}
 		}
-		if (dns_name_dynamic(msg->tsigname)) {
-			dns_name_free(msg->tsigname, msg->mctx);
-		}
-		isc_mempool_put(msg->namepool, msg->tsigname);
+		dns_message_puttempname(msg, &msg->tsigname);
 		msg->tsig = NULL;
-		msg->tsigname = NULL;
 	} else if (msg->querytsig != NULL && !replying) {
 		dns_rdataset_disassociate(msg->querytsig);
 		isc_mempool_put(msg->rdspool, msg->querytsig);
@@ -529,11 +524,7 @@ msgresetsigs(dns_message_t *msg, bool replying) {
 		msg->sig0 = NULL;
 	}
 	if (msg->sig0name != NULL) {
-		if (dns_name_dynamic(msg->sig0name)) {
-			dns_name_free(msg->sig0name, msg->mctx);
-		}
-		isc_mempool_put(msg->namepool, msg->sig0name);
-		msg->sig0name = NULL;
+		dns_message_puttempname(msg, &msg->sig0name);
 	}
 }

@@ -716,8 +707,8 @@ spacefortsig(dns_tsigkey_t *key, int otherlen) {

 void
 dns_message_create(isc_mem_t *mctx, unsigned int intent, dns_message_t **msgp) {
-	dns_message_t *m;
-	isc_buffer_t *dynbuf;
+	dns_message_t *m = NULL;
+	isc_buffer_t *dynbuf = NULL;
 	unsigned int i;

 	REQUIRE(mctx != NULL);
@@ -727,45 +718,37 @@ dns_message_create(isc_mem_t *mctx, unsigned int intent, dns_message_t **msgp) {
 		intent == DNS_MESSAGE_INTENTRENDER);

 	m = isc_mem_get(mctx, sizeof(dns_message_t));
-
-	m->magic = DNS_MESSAGE_MAGIC;
-	m->from_to_wire = intent;
+	*m = (dns_message_t){ .from_to_wire = intent };
+	isc_mem_attach(mctx, &m->mctx);
 	msginit(m);

 	for (i = 0; i < DNS_SECTION_MAX; i++) {
 		ISC_LIST_INIT(m->sections[i]);
 	}

-	m->mctx = NULL;
-	isc_mem_attach(mctx, &m->mctx);
-
 	ISC_LIST_INIT(m->scratchpad);
 	ISC_LIST_INIT(m->cleanup);
-	m->namepool = NULL;
-	m->rdspool = NULL;
 	ISC_LIST_INIT(m->rdatas);
 	ISC_LIST_INIT(m->rdatalists);
 	ISC_LIST_INIT(m->offsets);
 	ISC_LIST_INIT(m->freerdata);
 	ISC_LIST_INIT(m->freerdatalist);

-	isc_mempool_create(m->mctx, sizeof(dns_name_t), &m->namepool);
-	isc_mempool_setfillcount(m->namepool, NAME_COUNT);
-	isc_mempool_setfreemax(m->namepool, NAME_COUNT);
+	isc_mempool_create(m->mctx, sizeof(dns_fixedname_t), &m->namepool);
+	isc_mempool_setfillcount(m->namepool, NAME_FILLCOUNT);
+	isc_mempool_setfreemax(m->namepool, 32 * NAME_FREEMAX);
 	isc_mempool_setname(m->namepool, "msg:names");

 	isc_mempool_create(m->mctx, sizeof(dns_rdataset_t), &m->rdspool);
-	isc_mempool_setfillcount(m->rdspool, RDATASET_COUNT);
-	isc_mempool_setfreemax(m->rdspool, RDATASET_COUNT);
+	isc_mempool_setfillcount(m->rdspool, RDATASET_FILLCOUNT);
+	isc_mempool_setfreemax(m->rdspool, 32 * RDATASET_FREEMAX);
 	isc_mempool_setname(m->rdspool, "msg:rdataset");

-	dynbuf = NULL;
 	isc_buffer_allocate(mctx, &dynbuf, SCRATCHPAD_SIZE);
 	ISC_LIST_APPEND(m->scratchpad, dynbuf, link);

-	m->cctx = NULL;
-
 	isc_refcount_init(&m->refcount, 1);
+	m->magic = DNS_MESSAGE_MAGIC;

 	*msgp = m;
 }
@@ -985,41 +968,26 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	     unsigned int options) {
 	isc_region_t r;
 	unsigned int count;
-	dns_name_t *name;
-	dns_name_t *name2;
-	dns_offsets_t *offsets;
-	dns_rdataset_t *rdataset;
-	dns_rdatalist_t *rdatalist;
+	dns_name_t *name = NULL;
+	dns_name_t *name2 = NULL;
+	dns_rdataset_t *rdataset = NULL;
+	dns_rdatalist_t *rdatalist = NULL;
 	isc_result_t result;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
-	dns_namelist_t *section;
-	bool free_name;
-	bool best_effort;
-	bool seen_problem;
-
-	section = &msg->sections[DNS_SECTION_QUESTION];
-
-	best_effort = ((options & DNS_MESSAGEPARSE_BESTEFFORT) != 0);
-	seen_problem = false;
-
-	name = NULL;
-	rdataset = NULL;
-	rdatalist = NULL;
+	dns_namelist_t *section = &msg->sections[DNS_SECTION_QUESTION];
+	bool best_effort = ((options & DNS_MESSAGEPARSE_BESTEFFORT) != 0);
+	bool seen_problem = false;
+	bool free_name = false;

 	for (count = 0; count < msg->counts[DNS_SECTION_QUESTION]; count++) {
-		name = isc_mempool_get(msg->namepool);
-		if (name == NULL) {
-			return (ISC_R_NOMEMORY);
-		}
-		free_name = true;
-
-		offsets = newoffsets(msg);
-		if (offsets == NULL) {
-			result = ISC_R_NOMEMORY;
+		name = NULL;
+		result = dns_message_gettempname(msg, &name);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
-		dns_name_init(name, *offsets);
+		name->offsets = (unsigned char *)newoffsets(msg);
+		free_name = true;

 		/*
 		 * Parse the name out of this packet.
@@ -1056,7 +1024,7 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			ISC_LIST_APPEND(*section, name, link);
 			free_name = false;
 		} else {
-			isc_mempool_put(msg->namepool, name);
+			dns_message_puttempname(msg, &name);
 			name = name2;
 			name2 = NULL;
 			free_name = false;
@@ -1142,13 +1110,8 @@ cleanup:
 		INSIST(!dns_rdataset_isassociated(rdataset));
 		isc_mempool_put(msg->rdspool, rdataset);
 	}
-#if 0
-	if (rdatalist != NULL) {
-		isc_mempool_put(msg->rdlpool, rdatalist);
-	}
-#endif /* if 0 */
 	if (free_name) {
-		isc_mempool_put(msg->namepool, name);
+		dns_message_puttempname(msg, &name);
 	}

 	return (result);
@@ -1229,25 +1192,19 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	unsigned int count, rdatalen;
 	dns_name_t *name = NULL;
 	dns_name_t *name2 = NULL;
-	dns_offsets_t *offsets;
-	dns_rdataset_t *rdataset;
-	dns_rdatalist_t *rdatalist;
+	dns_rdataset_t *rdataset = NULL;
+	dns_rdatalist_t *rdatalist = NULL;
 	isc_result_t result;
 	dns_rdatatype_t rdtype, covers;
 	dns_rdataclass_t rdclass;
-	dns_rdata_t *rdata;
+	dns_rdata_t *rdata = NULL;
 	dns_ttl_t ttl;
-	dns_namelist_t *section;
-	bool free_name = false, free_rdataset = false;
-	bool preserve_order, best_effort, seen_problem;
+	dns_namelist_t *section = &msg->sections[sectionid];
+	bool free_name = false, free_rdataset = false, seen_problem = false;
+	bool preserve_order = ((options & DNS_MESSAGEPARSE_PRESERVEORDER) != 0);
+	bool best_effort = ((options & DNS_MESSAGEPARSE_BESTEFFORT) != 0);
 	bool isedns, issigzero, istsig;

-	preserve_order = ((options & DNS_MESSAGEPARSE_PRESERVEORDER) != 0);
-	best_effort = ((options & DNS_MESSAGEPARSE_BESTEFFORT) != 0);
-	seen_problem = false;
-
-	section = &msg->sections[sectionid];
-
 	for (count = 0; count < msg->counts[sectionid]; count++) {
 		int recstart = source->current;
 		bool skip_name_search, skip_type_search;
@@ -1259,18 +1216,13 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		issigzero = false;
 		istsig = false;

-		name = isc_mempool_get(msg->namepool);
-		if (name == NULL) {
-			return (ISC_R_NOMEMORY);
-		}
-		free_name = true;
-
-		offsets = newoffsets(msg);
-		if (offsets == NULL) {
-			result = ISC_R_NOMEMORY;
+		name = NULL;
+		result = dns_message_gettempname(msg, &name);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
-		dns_name_init(name, *offsets);
+		name->offsets = (unsigned char *)newoffsets(msg);
+		free_name = true;

 		/*
 		 * Parse the name out of this packet.
@@ -1509,7 +1461,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			 * If it is a new name, append to the section.
 			 */
 			if (result == ISC_R_SUCCESS) {
-				isc_mempool_put(msg->namepool, name);
+				dns_message_puttempname(msg, &name);
 				name = name2;
 			} else {
 				ISC_LIST_APPEND(*section, name, link);
@@ -1630,7 +1582,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 				(msg->opt->ttl & DNS_MESSAGE_EDNSRCODE_MASK) >>
 				20);
 			msg->rcode |= ercode;
-			isc_mempool_put(msg->namepool, name);
+			dns_message_puttempname(msg, &name);
 			free_name = false;
 		} else if (issigzero) {
 			msg->sig0 = rdataset;
@@ -1654,7 +1606,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,

 		if (seen_problem) {
 			if (free_name) {
-				isc_mempool_put(msg->namepool, name);
+				dns_message_puttempname(msg, &name);
 			}
 			if (free_rdataset) {
 				isc_mempool_put(msg->rdspool, rdataset);
@@ -1686,7 +1638,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,

 cleanup:
 	if (free_name) {
-		isc_mempool_put(msg->namepool, name);
+		dns_message_puttempname(msg, &name);
 	}
 	if (free_rdataset) {
 		isc_mempool_put(msg->rdspool, rdataset);
@@ -2573,27 +2525,16 @@ dns_message_removename(dns_message_t *msg, dns_name_t *name,

 isc_result_t
 dns_message_gettempname(dns_message_t *msg, dns_name_t **item) {
+	dns_fixedname_t *fn = NULL;
+
 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(item != NULL && *item == NULL);

-	*item = isc_mempool_get(msg->namepool);
-	if (*item == NULL) {
-		return (ISC_R_NOMEMORY);
-	}
-	dns_name_init(*item, NULL);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_message_gettempoffsets(dns_message_t *msg, dns_offsets_t **item) {
-	REQUIRE(DNS_MESSAGE_VALID(msg));
-	REQUIRE(item != NULL && *item == NULL);
-
-	*item = newoffsets(msg);
-	if (*item == NULL) {
+	fn = isc_mempool_get(msg->namepool);
+	if (fn == NULL) {
 		return (ISC_R_NOMEMORY);
 	}
+	*item = dns_fixedname_initname(fn);

 	return (ISC_R_SUCCESS);
 }
@@ -2622,7 +2563,6 @@ dns_message_gettemprdataset(dns_message_t *msg, dns_rdataset_t **item) {
 	}

 	dns_rdataset_init(*item);
-
 	return (ISC_R_SUCCESS);
 }

@@ -2641,18 +2581,29 @@ dns_message_gettemprdatalist(dns_message_t *msg, dns_rdatalist_t **item) {

 void
 dns_message_puttempname(dns_message_t *msg, dns_name_t **itemp) {
-	dns_name_t *item;
+	dns_name_t *item = NULL;

 	REQUIRE(DNS_MESSAGE_VALID(msg));
 	REQUIRE(itemp != NULL && *itemp != NULL);
+
 	item = *itemp;
 	*itemp = NULL;
+
 	REQUIRE(!ISC_LINK_LINKED(item, link));
 	REQUIRE(ISC_LIST_HEAD(item->list) == NULL);

+	/*
+	 * we need to check this in case dns_name_dup() was used.
+	 */
 	if (dns_name_dynamic(item)) {
 		dns_name_free(item, msg->mctx);
 	}
+
+	/*
+	 * 'name' is the first field in dns_fixedname_t, so putting
+	 * back the address of name is the same as putting back
+	 * the fixedname.
+	 */
 	isc_mempool_put(msg->namepool, item);
 }

@@ -1264,6 +1264,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 		}
 		if (state == ft_ordinary) {
 			INSIST(count != 0);
+			INSIST(label != NULL);
 			*label = count;
 			labels++;
 			INSIST(labels <= 127);
@@ -2461,24 +2462,23 @@ dns_name_fromstring2(dns_name_t *target, const char *src,
 	return (result);
 }

-static isc_result_t
-name_copy(const dns_name_t *source, dns_name_t *dest, isc_buffer_t *target) {
-	unsigned char *ndata;
-
-	/*
-	 * Make dest a copy of source.
-	 */
+void
+dns_name_copy(const dns_name_t *source, dns_name_t *dest) {
+	isc_buffer_t *target = NULL;
+	unsigned char *ndata = NULL;

+	REQUIRE(VALID_NAME(source));
+	REQUIRE(VALID_NAME(dest));
 	REQUIRE(BINDABLE(dest));

-	/*
-	 * Set up.
-	 */
-	if (target->length - target->used < source->length) {
-		return (ISC_R_NOSPACE);
-	}
+	target = dest->buffer;

-	ndata = (unsigned char *)target->base + target->used;
+	REQUIRE(target != NULL);
+	REQUIRE(target->length >= source->length);
+
+	isc_buffer_clear(target);
+
+	ndata = (unsigned char *)target->base;
 	dest->ndata = target->base;

 	if (source->length != 0) {
@@ -2495,7 +2495,7 @@ name_copy(const dns_name_t *source, dns_name_t *dest, isc_buffer_t *target) {
 	}

 	if (dest->labels > 0 && dest->offsets != NULL) {
-		if (source->offsets != NULL) {
+		if (source->offsets != NULL && source->labels != 0) {
 			memmove(dest->offsets, source->offsets, source->labels);
 		} else {
 			set_offsets(dest, dest->offsets, NULL);
@@ -2503,28 +2503,6 @@ name_copy(const dns_name_t *source, dns_name_t *dest, isc_buffer_t *target) {
 	}

 	isc_buffer_add(target, dest->length);
-
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_name_copy(const dns_name_t *source, dns_name_t *dest,
-	      isc_buffer_t *target) {
-	REQUIRE(VALID_NAME(source));
-	REQUIRE(VALID_NAME(dest));
-	REQUIRE(target != NULL);
-
-	return (name_copy(source, dest, target));
-}
-
-void
-dns_name_copynf(const dns_name_t *source, dns_name_t *dest) {
-	REQUIRE(VALID_NAME(source));
-	REQUIRE(VALID_NAME(dest));
-	REQUIRE(dest->buffer != NULL);
-
-	isc_buffer_clear(dest->buffer);
-	RUNTIME_CHECK(name_copy(source, dest, dest->buffer) == ISC_R_SUCCESS);
 }

 /*
@@ -1964,7 +1964,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 	 */
 	if (dns_name_countlabels(zonename) == 0 ||
 	    dns_name_issubdomain(zone, zonename)) {
-		dns_name_copynf(zone, zonename);
+		dns_name_copy(zone, zonename);
 	}

 	if (!dns_name_equal(zone, zonename)) {
@@ -2123,7 +2123,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 					 "NSEC3 indicates potential closest "
 					 "encloser: '%s'",
 					 namebuf);
-				dns_name_copynf(qname, closest);
+				dns_name_copy(qname, closest);
 				*setclosest = true;
 			}
 			dns_name_format(qname, namebuf, sizeof(namebuf));
@@ -2157,7 +2157,7 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 			    (dns_name_countlabels(nearest) == 0 ||
 			     dns_name_issubdomain(nearest, qname)))
 			{
-				dns_name_copynf(qname, nearest);
+				dns_name_copy(qname, nearest);
 				*setnearest = true;
 			}

@@ -317,7 +317,7 @@ nta_create(dns_ntatable_t *ntatable, const dns_name_t *name,
 	isc_refcount_init(&nta->refcount, 1);

 	nta->name = dns_fixedname_initname(&nta->fn);
-	dns_name_copynf(name, nta->name);
+	dns_name_copy(name, nta->name);

 	nta->magic = NTA_MAGIC;

@@ -79,7 +79,7 @@ dns_order_add(dns_order_t *order, const dns_name_t *name,
 	ent = isc_mem_get(order->mctx, sizeof(*ent));

 	dns_fixedname_init(&ent->name);
-	dns_name_copynf(name, dns_fixedname_name(&ent->name));
+	dns_name_copy(name, dns_fixedname_name(&ent->name));
 	ent->rdtype = rdtype;
 	ent->rdclass = rdclass;
 	ent->mode = mode;
@@ -1100,7 +1100,7 @@ chain_name(dns_rbtnodechain_t *chain, dns_name_t *name,

 	if (include_chain_end && chain->end != NULL) {
 		NODENAME(chain->end, &nodename);
-		dns_name_copynf(&nodename, name);
+		dns_name_copy(&nodename, name);
 	} else {
 		dns_name_reset(name);
 	}
@@ -3296,7 +3296,7 @@ dns_rbtnodechain_current(dns_rbtnodechain_t *chain, dns_name_t *name,
 		if (chain->level_count > 0) {
 			result = chain_name(chain, origin, false);
 		} else {
-			dns_name_copynf(dns_rootname, origin);
+			dns_name_copy(dns_rootname, origin);
 		}
 	}

@@ -766,7 +766,7 @@ static char FILE_VERSION[32] = "\0";
 *      that indicates that the database does not implement cyclic
 *      processing.
 */
-static atomic_uint_fast32_t init_count;
+static atomic_uint_fast32_t init_count = ATOMIC_VAR_INIT(0);

 /*
 * Locking
@@ -3059,7 +3059,7 @@ zone_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
 			 * is, we need to remember the node name.
 			 */
 			zcname = dns_fixedname_name(&search->zonecut_name);
-			dns_name_copynf(name, zcname);
+			dns_name_copy(name, zcname);
 			search->copy_name = true;
 		}
 	} else {
@@ -3136,6 +3136,7 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
 	rdataset->covers = RBTDB_RDATATYPE_EXT(header->type);
 	rdataset->ttl = header->rdh_ttl - now;
 	rdataset->trust = header->trust;
+
 	if (NEGATIVE(header)) {
 		rdataset->attributes |= DNS_RDATASETATTR_NEGATIVE;
 	}
@@ -3148,23 +3149,21 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header,
 	if (PREFETCH(header)) {
 		rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
 	}
+
 	if (stale && !ancient) {
 		dns_ttl_t stale_ttl = header->rdh_ttl + rbtdb->serve_stale_ttl;
 		if (stale_ttl > now) {
-			stale_ttl = stale_ttl - now;
+			rdataset->ttl = stale_ttl - now;
 		} else {
-			stale_ttl = 0;
+			rdataset->ttl = 0;
 		}
 		if (STALE_WINDOW(header)) {
 			rdataset->attributes |= DNS_RDATASETATTR_STALE_WINDOW;
 		}
 		rdataset->attributes |= DNS_RDATASETATTR_STALE;
-		rdataset->stale_ttl = stale_ttl;
-		rdataset->ttl = stale_ttl;
 	} else if (IS_CACHE(rbtdb) && !ACTIVE(header, now)) {
 		rdataset->attributes |= DNS_RDATASETATTR_ANCIENT;
-		rdataset->stale_ttl = header->rdh_ttl;
-		rdataset->ttl = 0;
+		rdataset->ttl = header->rdh_ttl;
 	}

 	rdataset->private1 = rbtdb;
@@ -3229,7 +3228,7 @@ setup_delegation(rbtdb_search_t *search, dns_dbnode_t **nodep,
 	 */
 	if (foundname != NULL && search->copy_name) {
 		zcname = dns_fixedname_name(&search->zonecut_name);
-		dns_name_copynf(zcname, foundname);
+		dns_name_copy(zcname, foundname);
 	}
 	if (nodep != NULL) {
 		/*
@@ -3697,6 +3696,7 @@ previous_closest_nsec(dns_rdatatype_t type, rbtdb_search_t *search,
 	isc_result_t result;

 	REQUIRE(nodep != NULL && *nodep == NULL);
+	REQUIRE(type == dns_rdatatype_nsec3 || firstp != NULL);

 	if (type == dns_rdatatype_nsec3) {
 		result = dns_rbtnodechain_prev(&search->chain, NULL, NULL);
@@ -3996,33 +3996,43 @@ zone_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	  dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
 	  dns_dbnode_t **nodep, dns_name_t *foundname, dns_rdataset_t *rdataset,
 	  dns_rdataset_t *sigrdataset) {
-	dns_rbtnode_t *node = NULL;
 	isc_result_t result;
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	rbtdb_version_t *rbtversion = NULL;
+	dns_rbtnode_t *node = NULL;
 	rbtdb_search_t search;
 	bool cname_ok = true;
 	bool close_version = false;
 	bool maybe_zonecut = false;
 	bool at_zonecut = false;
-	bool wild;
-	bool empty_node;
-	rdatasetheader_t *header, *header_next, *found, *nsecheader;
-	rdatasetheader_t *foundsig, *cnamesig, *nsecsig;
+	bool wild = false;
+	bool empty_node = true;
+	bool active = false;
+	rdatasetheader_t *header = NULL,  *header_next = NULL;
+	rdatasetheader_t *found = NULL, *nsecheader = NULL;
+	rdatasetheader_t *foundsig = NULL, *cnamesig = NULL, *nsecsig = NULL;
 	rbtdb_rdatatype_t sigtype;
-	bool active;
-	nodelock_t *lock;
-	dns_rbt_t *tree;
+	nodelock_t *lock = NULL;
+	dns_rbt_t *tree = NULL;

-	search.rbtdb = (dns_rbtdb_t *)db;
-
-	REQUIRE(VALID_RBTDB(search.rbtdb));
-	INSIST(version == NULL ||
-	       ((rbtdb_version_t *)version)->rbtdb == (dns_rbtdb_t *)db);
+	REQUIRE(VALID_RBTDB(rbtdb));
+	INSIST(version == NULL || ((rbtdb_version_t *)version)->rbtdb == rbtdb);

 	/*
 	 * We don't care about 'now'.
 	 */
 	UNUSED(now);

+	if ((options & DNS_DBFIND_NONBLOCK) != 0) {
+		result = isc_rwlock_trylock(&rbtdb->tree_lock,
+					    isc_rwlocktype_read);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	} else {
+		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+	}
+
 	/*
 	 * If the caller didn't supply a version, attach to the current
 	 * version.
@@ -4032,31 +4042,21 @@ zone_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		close_version = true;
 	}

-	search.rbtversion = version;
-	search.serial = search.rbtversion->serial;
-	search.options = options;
-	search.copy_name = false;
-	search.need_cleanup = false;
-	search.wild = false;
-	search.zonecut = NULL;
-	dns_fixedname_init(&search.zonecut_name);
+	rbtversion = (rbtdb_version_t *)version;
+	search = (rbtdb_search_t){ .rbtdb = rbtdb,
+				   .options = options,
+				   .rbtversion = rbtversion,
+				   .serial = rbtversion->serial };
 	dns_rbtnodechain_init(&search.chain);
-	search.now = 0;
-
-	/*
-	 * 'wild' will be true iff. we've matched a wildcard.
-	 */
-	wild = false;
-
-	RWLOCK(&search.rbtdb->tree_lock, isc_rwlocktype_read);
+	dns_fixedname_init(&search.zonecut_name);

 	/*
 	 * Search down from the root of the tree.  If, while going down, we
 	 * encounter a callback node, zone_zonecut_callback() will search the
 	 * rdatasets at the zone cut for active DNAME or NS rdatasets.
 	 */
-	tree = (options & DNS_DBFIND_FORCENSEC3) != 0 ? search.rbtdb->nsec3
-						      : search.rbtdb->tree;
+	tree = (options & DNS_DBFIND_FORCENSEC3) != 0 ? rbtdb->nsec3
+						      : rbtdb->tree;
 	result = dns_rbt_findnode(tree, name, foundname, &node, &search.chain,
 				  DNS_RBTFIND_EMPTYDATA, zone_zonecut_callback,
 				  &search);
@@ -4078,7 +4078,7 @@ zone_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 			 */
 			result = find_wildcard(&search, &node, name);
 			if (result == ISC_R_SUCCESS) {
-				dns_name_copynf(name, foundname);
+				dns_name_copy(name, foundname);
 				wild = true;
 				goto found;
 			} else if (result != ISC_R_NOTFOUND) {
@@ -4086,7 +4086,6 @@ zone_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 			}
 		}

-		active = false;
 		if ((options & DNS_DBFIND_FORCENSEC3) == 0) {
 			/*
 			 * The NSEC3 tree won't have empty nodes,
@@ -4100,14 +4099,14 @@ zone_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 * If we're here, then the name does not exist, is not
 		 * beneath a zonecut, and there's no matching wildcard.
 		 */
-		if ((search.rbtversion->secure == dns_db_secure &&
-		     !search.rbtversion->havensec3) ||
+		if ((rbtversion->secure == dns_db_secure &&
+		     !rbtversion->havensec3) ||
 		    (search.options & DNS_DBFIND_FORCENSEC) != 0 ||
 		    (search.options & DNS_DBFIND_FORCENSEC3) != 0)
 		{
 			result = find_closest_nsec(&search, nodep, foundname,
 						   rdataset, sigrdataset, tree,
-						   search.rbtversion->secure);
+						   rbtversion->secure);
 			if (result == ISC_R_SUCCESS) {
 				result = active ? DNS_R_EMPTYNAME
 						: DNS_R_NXDOMAIN;
@@ -4144,9 +4143,8 @@ found:
 		 * we always return a referral.
 		 */
 		if (node->find_callback &&
-		    ((node != search.rbtdb->origin_node &&
-		      !dns_rdatatype_atparent(type)) ||
-		     IS_STUB(search.rbtdb)))
+		    ((node != rbtdb->origin_node &&
+		      !dns_rdatatype_atparent(type)) || IS_STUB(rbtdb)))
 		{
 			maybe_zonecut = true;
 		}
@@ -4167,16 +4165,10 @@ found:
 	 * We now go looking for rdata...
 	 */

-	lock = &search.rbtdb->node_locks[node->locknum].lock;
+	lock = &rbtdb->node_locks[node->locknum].lock;
 	NODE_LOCK(lock, isc_rwlocktype_read);

-	found = NULL;
-	foundsig = NULL;
 	sigtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig, type);
-	nsecheader = NULL;
-	nsecsig = NULL;
-	cnamesig = NULL;
-	empty_node = true;
 	for (header = node->data; header != NULL; header = header_next) {
 		header_next = header->next;
 		/*
@@ -4213,8 +4205,7 @@ found:
 				 * ensure that search->zonecut_rdataset will
 				 * still be valid later.
 				 */
-				new_reference(search.rbtdb, node,
-					      isc_rwlocktype_read);
+				new_reference(rbtdb, node, isc_rwlocktype_read);
 				search.zonecut = node;
 				search.zonecut_rdataset = header;
 				search.zonecut_sigrdataset = NULL;
@@ -4300,7 +4291,7 @@ found:
 					break;
 				}
 			} else if (header->type == dns_rdatatype_nsec &&
-				   !search.rbtversion->havensec3) {
+				   !rbtversion->havensec3) {
 				/*
 				 * Remember a NSEC rdataset even if we're
 				 * not specifically looking for it, because
@@ -4308,7 +4299,7 @@ found:
 				 */
 				nsecheader = header;
 			} else if (header->type == RBTDB_RDATATYPE_SIGNSEC &&
-				   !search.rbtversion->havensec3)
+				   !rbtversion->havensec3)
 			{
 				/*
 				 * If we need the NSEC rdataset, we'll also
@@ -4359,8 +4350,8 @@ found:
 		 * The desired type doesn't exist.
 		 */
 		result = DNS_R_NXRRSET;
-		if (search.rbtversion->secure == dns_db_secure &&
-		    !search.rbtversion->havensec3 &&
+		if (rbtversion->secure == dns_db_secure &&
+		    !rbtversion->havensec3 &&
 		    (nsecheader == NULL || nsecsig == NULL))
 		{
 			/*
@@ -4375,8 +4366,8 @@ found:
 			NODE_UNLOCK(lock, isc_rwlocktype_read);
 			result = find_closest_nsec(&search, nodep, foundname,
 						   rdataset, sigrdataset,
-						   search.rbtdb->tree,
-						   search.rbtversion->secure);
+						   rbtdb->tree,
+						   rbtversion->secure);
 			if (result == ISC_R_SUCCESS) {
 				result = DNS_R_EMPTYWILD;
 			}
@@ -4392,17 +4383,17 @@ found:
 			goto node_exit;
 		}
 		if (nodep != NULL) {
-			new_reference(search.rbtdb, node, isc_rwlocktype_read);
+			new_reference(rbtdb, node, isc_rwlocktype_read);
 			*nodep = node;
 		}
-		if ((search.rbtversion->secure == dns_db_secure &&
-		     !search.rbtversion->havensec3) ||
+		if ((rbtversion->secure == dns_db_secure &&
+		     !rbtversion->havensec3) ||
 		    (search.options & DNS_DBFIND_FORCENSEC) != 0)
 		{
-			bind_rdataset(search.rbtdb, node, nsecheader, 0,
+			bind_rdataset(rbtdb, node, nsecheader, 0,
 				      isc_rwlocktype_read, rdataset);
 			if (nsecsig != NULL) {
-				bind_rdataset(search.rbtdb, node, nsecsig, 0,
+				bind_rdataset(rbtdb, node, nsecsig, 0,
 					      isc_rwlocktype_read, sigrdataset);
 			}
 		}
@@ -4476,7 +4467,7 @@ found:

 	if (nodep != NULL) {
 		if (!at_zonecut) {
-			new_reference(search.rbtdb, node, isc_rwlocktype_read);
+			new_reference(rbtdb, node, isc_rwlocktype_read);
 		} else {
 			search.need_cleanup = false;
 		}
@@ -4484,10 +4475,10 @@ found:
 	}

 	if (type != dns_rdatatype_any) {
-		bind_rdataset(search.rbtdb, node, found, 0, isc_rwlocktype_read,
+		bind_rdataset(rbtdb, node, found, 0, isc_rwlocktype_read,
 			      rdataset);
 		if (foundsig != NULL) {
-			bind_rdataset(search.rbtdb, node, foundsig, 0,
+			bind_rdataset(rbtdb, node, foundsig, 0,
 				      isc_rwlocktype_read, sigrdataset);
 		}
 	}
@@ -4500,7 +4491,7 @@ node_exit:
 	NODE_UNLOCK(lock, isc_rwlocktype_read);

 tree_exit:
-	RWUNLOCK(&search.rbtdb->tree_lock, isc_rwlocktype_read);
+	RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);

 	/*
 	 * If we found a zonecut but aren't going to use it, we have to
@@ -4509,10 +4500,10 @@ tree_exit:
 	if (search.need_cleanup) {
 		node = search.zonecut;
 		INSIST(node != NULL);
-		lock = &(search.rbtdb->node_locks[node->locknum].lock);
+		lock = &(rbtdb->node_locks[node->locknum].lock);

 		NODE_LOCK(lock, isc_rwlocktype_read);
-		decrement_reference(search.rbtdb, node, 0, isc_rwlocktype_read,
+		decrement_reference(rbtdb, node, 0, isc_rwlocktype_read,
 				    isc_rwlocktype_none, false);
 		NODE_UNLOCK(lock, isc_rwlocktype_read);
 	}
@@ -4798,7 +4789,7 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node,
 			if (foundname != NULL) {
 				dns_name_init(&name, NULL);
 				dns_rbt_namefromnode(node, &name);
-				dns_name_copynf(&name, foundname);
+				dns_name_copy(&name, foundname);
 				while (i > 0) {
 					i--;
 					level_node = search->chain.levels[i];
@@ -5367,7 +5358,7 @@ cache_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
 	} else if (result != ISC_R_SUCCESS) {
 		goto tree_exit;
 	} else if (!dcnull) {
-		dns_name_copynf(dcname, foundname);
+		dns_name_copy(dcname, foundname);
 	}
 	/*
 	 * We now go looking for an NS rdataset at the node.
@@ -5588,7 +5579,8 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
 		  isc_rwlocktype_write);

 	for (header = rbtnode->data; header != NULL; header = header->next) {
-		if (header->rdh_ttl <= now - RBTDB_VIRTUAL) {
+		if (header->rdh_ttl + rbtdb->serve_stale_ttl <=
+		    now - RBTDB_VIRTUAL) {
 			/*
 			 * We don't check if refcurrent(rbtnode) == 0 and try
 			 * to free like we do in cache_find(), because
@@ -5859,7 +5851,8 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	for (header = rbtnode->data; header != NULL; header = header_next) {
 		header_next = header->next;
 		if (!ACTIVE(header, now)) {
-			if ((header->rdh_ttl < now - RBTDB_VIRTUAL) &&
+			if ((header->rdh_ttl + rbtdb->serve_stale_ttl <
+			     now - RBTDB_VIRTUAL) &&
 			    (locktype == isc_rwlocktype_write ||
 			     NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS))
 			{
@@ -6956,7 +6949,9 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		}

 		header = isc_heap_element(rbtdb->heaps[rbtnode->locknum], 1);
-		if (header && header->rdh_ttl < now - RBTDB_VIRTUAL) {
+		if (header != NULL && header->rdh_ttl + rbtdb->serve_stale_ttl <
+					      now - RBTDB_VIRTUAL)
+		{
 			expire_header(rbtdb, header, tree_locked, expire_ttl);
 		}

@@ -9831,7 +9826,7 @@ dbiterator_origin(dns_dbiterator_t *iterator, dns_name_t *name) {
 		return (rbtdbiter->result);
 	}

-	dns_name_copynf(origin, name);
+	dns_name_copy(origin, name);
 	return (ISC_R_SUCCESS);
 }

@@ -9847,7 +9842,7 @@ setownercase(rdatasetheader_t *header, const dns_name_t *name) {
 	memset(header->upper, 0, sizeof(header->upper));
 	fully_lower = true;
 	for (i = 0; i < name->length; i++) {
-		if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a) {
+		if (name->ndata[i] >= 'A' && name->ndata[i] <= 'Z') {
 			{
 				header->upper[i / 8] |= 1 << (i % 8);
 				fully_lower = false;
@@ -9876,54 +9871,20 @@ rdataset_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name) {
 		    isc_rwlocktype_write);
 }

-static const unsigned char charmask[] = {
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
-	0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
-	0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
-	0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
-	0x20, 0x20, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-	0x00, 0x00, 0x00, 0x00
+static const unsigned char maptolower[256] = {
+	['A'] = 'a', ['B'] = 'b', ['C'] = 'c', ['D'] = 'd', ['E'] = 'e',
+	['F'] = 'f', ['G'] = 'g', ['H'] = 'h', ['I'] = 'i', ['J'] = 'j',
+	['K'] = 'k', ['L'] = 'l', ['M'] = 'm', ['N'] = 'n', ['O'] = 'o',
+	['P'] = 'p', ['Q'] = 'q', ['R'] = 'r', ['S'] = 's', ['T'] = 't',
+	['U'] = 'u', ['V'] = 'v', ['X'] = 'x', ['Y'] = 'y', ['Z'] = 'z',
 };

-static const unsigned char maptolower[] = {
-	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
-	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
-	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
-	0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
-	0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
-	0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
-	0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73,
-	0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
-	0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
-	0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
-	0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83,
-	0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
-	0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
-	0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
-	0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf, 0xb0, 0xb1, 0xb2, 0xb3,
-	0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
-	0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xcb,
-	0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
-	0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3,
-	0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
-	0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa, 0xfb,
-	0xfc, 0xfd, 0xfe, 0xff
+static const unsigned char maptoupper[256] = {
+	['a'] = 'A', ['b'] = 'B', ['c'] = 'C', ['d'] = 'D', ['e'] = 'E',
+	['f'] = 'F', ['g'] = 'G', ['h'] = 'H', ['i'] = 'I', ['j'] = 'J',
+	['k'] = 'K', ['l'] = 'L', ['m'] = 'M', ['n'] = 'N', ['o'] = 'O',
+	['p'] = 'P', ['q'] = 'Q', ['r'] = 'R', ['s'] = 'S', ['t'] = 'T',
+	['u'] = 'U', ['v'] = 'V', ['x'] = 'X', ['y'] = 'Y', ['z'] = 'Z',
 };

 static void
@@ -9931,10 +9892,9 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
 	dns_rbtdb_t *rbtdb = rdataset->private1;
 	dns_rbtnode_t *rbtnode = rdataset->private2;
 	unsigned char *raw = rdataset->private3; /* RDATASLAB */
-	rdatasetheader_t *header;
-	unsigned int i, j;
-	unsigned char bits;
-	unsigned char c, flip;
+	rdatasetheader_t *header = NULL;
+	uint8_t mask = (1 << 7);
+	uint8_t bits = 0;

 	header = (struct rdatasetheader *)(raw - sizeof(*header));

@@ -9945,85 +9905,36 @@ rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
 		goto unlock;
 	}

-#if 0
-	/*
-	 * This was the original code, and is implemented differently in
-	 * the #else block that follows.
-	 */
-	for (i = 0; i < name->length; i++) {
-		/*
-		 * Set the case bit if it does not match the recorded bit.
-		 */
-		if (name->ndata[i] >= 0x61 && name->ndata[i] <= 0x7a &&
-		    (header->upper[i / 8] & (1 << (i % 8))) != 0)
-		{
-			name->ndata[i] &= ~0x20; /* clear the lower case bit */
-		} else if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a &&
-			   (header->upper[i / 8] & (1 << (i % 8))) == 0)
-		{
-			name->ndata[i] |= 0x20; /* set the lower case bit */
-		}
-	}
-#else  /* if 0 */
-
 	if (ISC_LIKELY(CASEFULLYLOWER(header))) {
-		unsigned char *bp, *be;
-		bp = name->ndata;
-		be = bp + name->length;
-
-		while (bp <= be - 4) {
-			c = bp[0];
-			bp[0] = maptolower[c];
-			c = bp[1];
-			bp[1] = maptolower[c];
-			c = bp[2];
-			bp[2] = maptolower[c];
-			c = bp[3];
-			bp[3] = maptolower[c];
-			bp += 4;
+		for (size_t i = 0; i < name->length; i++) {
+			uint8_t c = name->ndata[i];
+			if (c >= 'A' && c <= 'Z') {
+				name->ndata[i] = maptolower[c];
+			}
 		}
-		while (bp < be) {
-			c = *bp;
-			*bp++ = maptolower[c];
-		}
-		goto unlock;
-	}
+	} else {
+		for (size_t i = 0; i < name->length; i++) {
+			uint8_t c = name->ndata[i];

-	i = 0;
-	for (j = 0; j < (name->length >> 3); j++) {
-		unsigned int k;
+			if (mask == (1 << 7)) {
+				bits = header->upper[i / 8];
+				mask = 1;
+			} else {
+				mask <<= 1;
+			}

-		bits = ~(header->upper[j]);
-
-		for (k = 0; k < 8; k++) {
-			c = name->ndata[i];
-			flip = (bits & 1) << 5;
-			flip ^= c;
-			flip &= charmask[c];
-			name->ndata[i] ^= flip;
-
-			i++;
-			bits >>= 1;
+			if (c >= 'a' && c <= 'z') {
+				if ((bits & mask) != 0) {
+					name->ndata[i] = maptoupper[c];
+				}
+			} else if (c >= 'A' && c <= 'Z') {
+				if ((bits & mask) == 0) {
+					name->ndata[i] = maptolower[c];
+				}
+			}
 		}
 	}

-	if (ISC_UNLIKELY(i == name->length)) {
-		goto unlock;
-	}
-
-	bits = ~(header->upper[j]);
-
-	for (; i < name->length; i++) {
-		c = name->ndata[i];
-		flip = (bits & 1) << 5;
-		flip ^= c;
-		flip &= charmask[c];
-		name->ndata[i] ^= flip;
-
-		bits >>= 1;
-	}
-#endif /* if 0 */
-
 unlock:
 	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
 		    isc_rwlocktype_read);
@@ -10219,7 +10130,7 @@ glue_nsdname_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 		glue = isc_mem_get(ctx->rbtdb->common.mctx, sizeof(*glue));

 		gluename = dns_fixedname_initname(&glue->fixedname);
-		dns_name_copynf(name_a, gluename);
+		dns_name_copy(name_a, gluename);

 		dns_rdataset_init(&glue->rdataset_a);
 		dns_rdataset_init(&glue->sigrdataset_a);
@@ -10243,7 +10154,7 @@ glue_nsdname_cb(void *arg, const dns_name_t *name, dns_rdatatype_t qtype) {
 					   sizeof(*glue));

 			gluename = dns_fixedname_initname(&glue->fixedname);
-			dns_name_copynf(name_aaaa, gluename);
+			dns_name_copy(name_aaaa, gluename);

 			dns_rdataset_init(&glue->rdataset_a);
 			dns_rdataset_init(&glue->sigrdataset_a);
@@ -10370,7 +10281,6 @@ restart:
 	}

 	for (; ge != NULL; ge = ge->next) {
-		isc_buffer_t *buffer = NULL;
 		dns_name_t *name = NULL;
 		dns_rdataset_t *rdataset_a = NULL;
 		dns_rdataset_t *sigrdataset_a = NULL;
@@ -10378,16 +10288,12 @@ restart:
 		dns_rdataset_t *sigrdataset_aaaa = NULL;
 		dns_name_t *gluename = dns_fixedname_name(&ge->fixedname);

-		isc_buffer_allocate(msg->mctx, &buffer, 512);
-
 		result = dns_message_gettempname(msg, &name);
 		if (ISC_UNLIKELY(result != ISC_R_SUCCESS)) {
-			isc_buffer_free(&buffer);
 			goto no_glue;
 		}

-		dns_name_copy(gluename, name, buffer);
-		dns_message_takebuffer(msg, &buffer);
+		dns_name_copy(gluename, name);

 		if (dns_rdataset_isassociated(&ge->rdataset_a)) {
 			result = dns_message_gettemprdataset(msg, &rdataset_a);
@@ -440,7 +440,7 @@ towiresorted(dns_rdataset_t *rdataset, const dns_name_t *owner_name,
 	added = 0;

 	name = dns_fixedname_initname(&fixed);
-	dns_name_copynf(owner_name, name);
+	dns_name_copy(owner_name, name);
 	dns_rdataset_getownercase(rdataset, name);
 	offset = 0xffff;

@@ -1636,7 +1636,7 @@ fcount_incr(fetchctx_t *fctx, bool force) {
 			counter->dropped = 0;
 			counter->domain =
 				dns_fixedname_initname(&counter->fdname);
-			dns_name_copynf(&fctx->domain, counter->domain);
+			dns_name_copy(&fctx->domain, counter->domain);
 			ISC_LIST_APPEND(dbucket->list, counter, link);
 		}
 	} else {
@@ -2520,7 +2520,6 @@ resquery_send(resquery_t *query) {
 	/*
 	 * Set up question.
 	 */
-	dns_name_init(qname, NULL);
 	dns_name_clone(&fctx->name, qname);
 	dns_rdataset_makequestion(qrdataset, res->rdclass, fctx->type);
 	ISC_LIST_APPEND(qname->list, qrdataset, link);
@@ -3934,7 +3933,7 @@ possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) {
 	if (blackhole != NULL) {
 		int match;

-		if ((dns_acl_match(&ipaddr, NULL, blackhole, &res->view->aclenv,
+		if ((dns_acl_match(&ipaddr, NULL, blackhole, res->view->aclenv,
 				   &match, NULL) == ISC_R_SUCCESS) &&
 		    match > 0)
 		{
@@ -5552,7 +5551,7 @@ clone_results(fetchctx_t *fctx) {
 			continue;
 		}
 		name = dns_fixedname_name(&event->foundname);
-		dns_name_copynf(hname, name);
+		dns_name_copy(hname, name);
 		event->result = hevent->result;
 		dns_db_attach(hevent->db, &event->db);
 		dns_db_attachnode(hevent->db, hevent->node, &event->node);
@@ -5694,8 +5693,8 @@ validated(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) {
 		wild = dns_fixedname_initname(&fwild);
-		dns_name_copynf(dns_fixedname_name(&vevent->validator->wild),
-				wild);
+		dns_name_copy(dns_fixedname_name(&vevent->validator->wild),
+			      wild);
 	}
 	dns_validator_destroy(&vevent->validator);
 	dns_message_detach(&valarg->message);
@@ -6093,8 +6092,8 @@ answer_response:
 			       eresult == DNS_R_NCACHENXRRSET);
 		}
 		hevent->result = eresult;
-		dns_name_copynf(vevent->name,
-				dns_fixedname_name(&hevent->foundname));
+		dns_name_copy(vevent->name,
+			      dns_fixedname_name(&hevent->foundname));
 		dns_db_attach(fctx->cache, &hevent->db);
 		dns_db_transfernode(fctx->cache, &node, &hevent->node);
 		clone_results(fctx);
@@ -6324,7 +6323,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 		if (event != NULL) {
 			adbp = &event->db;
 			aname = dns_fixedname_name(&event->foundname);
-			dns_name_copynf(name, aname);
+			dns_name_copy(name, aname);
 			anodep = &event->node;
 			/*
 			 * If this is an ANY, SIG or RRSIG query, we're not
@@ -6943,7 +6942,7 @@ ncache_message(fetchctx_t *fctx, dns_message_t *message,
 		if (event != NULL) {
 			adbp = &event->db;
 			aname = dns_fixedname_name(&event->foundname);
-			dns_name_copynf(name, aname);
+			dns_name_copy(name, aname);
 			anodep = &event->node;
 			ardataset = event->rdataset;
 		}
@@ -7166,7 +7165,7 @@ is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
 		}

 		result = dns_acl_match(&netaddr, NULL, view->denyansweracl,
-				       &view->aclenv, &match, NULL);
+				       view->aclenv, &match, NULL);
 		if (result == ISC_R_SUCCESS && match > 0) {
 			isc_netaddr_format(&netaddr, addrbuf, sizeof(addrbuf));
 			dns_name_format(name, namebuf, sizeof(namebuf));
@@ -7474,7 +7473,7 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) {
 		 * Retrieve state from fctx->nsfetch before we destroy it.
 		 */
 		domain = dns_fixedname_initname(&fixed);
-		dns_name_copynf(&fctx->nsfetch->private->domain, domain);
+		dns_name_copy(&fctx->nsfetch->private->domain, domain);
 		if (dns_name_equal(&fctx->nsname, domain)) {
 			if (dns_rdataset_isassociated(fevent->rdataset)) {
 				dns_rdataset_disassociate(fevent->rdataset);
@@ -10403,13 +10402,7 @@ dns_resolver_create(dns_view_t *view, isc_taskmgr_t *taskmgr,
 		}
 		res->buckets[i].mctx = NULL;
 		snprintf(name, sizeof(name), "res%u", i);
-		/*
-		 * Use a separate memory context for each bucket to reduce
-		 * contention among multiple threads.  Do this only when
-		 * enabling threads because it will be require more memory.
-		 */
-		isc_mem_create(&res->buckets[i].mctx);
-		isc_mem_setname(res->buckets[i].mctx, name);
+		isc_mem_attach(view->mctx, &res->buckets[i].mctx);
 		isc_task_setname(res->buckets[i].task, name, res);
 		ISC_LIST_INIT(res->buckets[i].fctxs);
 		atomic_init(&res->buckets[i].exiting, false);
@@ -933,8 +933,8 @@ make_log_buf(dns_rrl_t *rrl, dns_rrl_entry_t *e, const char *str1,
 				e->log_qname = qbuf->index;
 				qbuf->e = e;
 				dns_fixedname_init(&qbuf->qname);
-				dns_name_copynf(qname, dns_fixedname_name(
-							       &qbuf->qname));
+				dns_name_copy(qname,
+					      dns_fixedname_name(&qbuf->qname));
 			}
 		}
 		if (qbuf != NULL) {
@@ -1048,7 +1048,7 @@ dns_rrl(dns_view_t *view, const isc_sockaddr_t *client_addr, bool is_tcp,
 	if (rrl->exempt != NULL) {
 		isc_netaddr_fromsockaddr(&netclient, client_addr);
 		result = dns_acl_match(&netclient, NULL, rrl->exempt,
-				       &view->aclenv, &exempt_match, NULL);
+				       view->aclenv, &exempt_match, NULL);
 		if (result == ISC_R_SUCCESS && exempt_match > 0) {
 			return (DNS_RRL_RESULT_OK);
 		}
--- a/Show More
+++ b/Show More