Minor tone edits during review with Vicky

Fixup the manpages after ddns-confgen.rst -> tsig-keygen.rst rename

See merge request isc-projects/bind9!3817

.gitlab-ci.yml

@@ -201,6 +201,7 @@ stages:
     - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
     - test -z "${RUN_MAKE_INSTALL}" || make install
     - test -z "${RUN_MAKE_INSTALL}" || sh util/check-make-install
+    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
   needs:
     - job: autoreconf
       artifacts: true

CHANGES

@@ -1,3 +1,16 @@
+5461.	[bug]		The header STALE attribute was not being updated with
+			the write lock being held leading to incorrect
+			statistics.  Convert the header attributes to use atomic
+			operations. [GL #1475]
+
+5460.	[cleanup]	tsig-keygen was previously an alias for
+			ddns-confgen and was documented in the ddns-confgen
+			man page. This has been reversed; tsig-keygen is
+			now the primary name. [GL #1998]
+
+5459.	[bug]		Bad isc_mem_put() size when an invalid type was
+			specified in a update-policy rule. [GL #1990]
+
 5458.	[bug]		Prevent a theoretically possible NULL dereference caused
 			by a data race between zone_maintenance() and
 			dns_zone_setview_helper(). [GL #1627]

CODE_OF_CONDUCT.md

@@ -6,8 +6,8 @@ on every aspect of the mission - including mentorship, teaching, and connecting
 people.
 
 Diversity is one of our huge strengths, but it can also lead to communication
-issues and unhappiness. To that end, we have a few ground rules that we ask
+issues and unhappiness. To that end, we have a few ground rules to which we expect
-people to adhere to. This code applies equally to the core development team, open source contributors and those
+people to adhere. This code applies equally to the core development team, open source contributors and those
 seeking help and guidance.
 
 This isn't an exhaustive list of things that you can't do. Rather, take it in

bin/confgen/Makefile.am

@@ -20,11 +20,11 @@ libconfgen_la_SOURCES =		\
 	util.c			\
 	unix/os.c
 
-sbin_PROGRAMS = ddns-confgen rndc-confgen
+sbin_PROGRAMS = tsig-keygen rndc-confgen
 
 install-exec-hook:
-	ln -f $(DESTDIR)$(sbindir)/ddns-confgen \
+	ln -f $(DESTDIR)$(sbindir)/tsig-keygen \
-	      $(DESTDIR)$(sbindir)/tsig-confgen
+	      $(DESTDIR)$(sbindir)/ddns-confgen
 
 uninstall-hook:
-	-rm -f $(DESTDIR)$(sbindir)/tsig-confgen
+	-rm -f $(DESTDIR)$(sbindir)/ddns-confgen

bin/confgen/tsig-keygen.c

@@ -12,9 +12,8 @@
 /*! \file */
 
 /**
- * ddns-confgen generates configuration files for dynamic DNS. It can
+ * tsig-keygen generates TSIG keys that can be used in named configuration
- * be used as a convenient alternative to writing the ddns.key file
+ * files for dynamic DNS.
- * and the corresponding key and update-policy statements in named.conf.
  */
 
 #include <stdarg.h>

bin/confgen/tsig-keygen.rst

@@ -21,10 +21,10 @@
 
 .. highlight: console
 
-.. _man_ddns-confgen:
+.. _man_tsig-keygen:
 
-ddns-confgen - ddns key generation tool
+tsig-keygen, ddns-confgen - TSIG key generation tool
----------------------------------------
+----------------------------------------------------
 
 Synopsis
 ~~~~~~~~
@@ -37,15 +37,16 @@ Description
 
 ``tsig-keygen`` and ``ddns-confgen`` are invocation methods for a
 utility that generates keys for use in TSIG signing. The resulting keys
-can be used, for example, to secure dynamic DNS updates to a zone or for
+can be used, for example, to secure dynamic DNS updates to a zone, or for
 the ``rndc`` command channel.
 
 When run as ``tsig-keygen``, a domain name can be specified on the
 command line to be used as the name of the generated key. If no
 name is specified, the default is ``tsig-key``.
 
-When run as ``ddns-confgen``, the generated key is accompanied by
+When run as ``ddns-confgen``, the key name can specified using ``-k``
-configuration text and instructions that can be used with ``nsupdate``
+parameter and defaults to ``ddns-key``. The generated key is accompanied
+by configuration text and instructions that can be used with ``nsupdate``
 and ``named`` when setting up dynamic DNS, including an example
 ``update-policy`` statement. (This usage is similar to the ``rndc-confgen``
 command for setting up command-channel security.)
@@ -60,20 +61,20 @@ Options
 ~~~~~~~
 
 ``-a algorithm``
-   This option specifies the algorithm to use for the TSIG key. Available choices
+   This option specifies the algorithm to use for the TSIG key. Available
-   are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and
+   choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384,
-   hmac-sha512. The default is hmac-sha256. Options are
+   and hmac-sha512. The default is hmac-sha256. Options are
    case-insensitive, and the "hmac-" prefix may be omitted.
 
 ``-h``
    This option prints a short summary of options and arguments.
 
 ``-k keyname``
-   This option specifies the key name of the DDNS authentication key. The default is
+   This option specifies the key name of the DDNS authentication key. The
-   ``ddns-key`` when neither the ``-s`` nor ``-z`` option is specified;
+   default is ``ddns-key`` when neither the ``-s`` nor ``-z`` option is
-   otherwise, the default is ``ddns-key`` as a separate label followed
+   specified; otherwise, the default is ``ddns-key`` as a separate label
-   by the argument of the option, e.g., ``ddns-key.example.com.`` The
+   followed by the argument of the option, e.g., ``ddns-key.example.com.``
-   key name must have the format of a valid domain name, consisting of
+   The key name must have the format of a valid domain name, consisting of
    letters, digits, hyphens, and periods.
 
 ``-q`` (``ddns-confgen`` only)
@@ -82,13 +83,12 @@ Options
    ``tsig-keygen``.
 
 ``-s name`` (``ddns-confgen`` only)
-   This option generates a configuration example to allow
+   This option generates a configuration example to allow dynamic updates
-   dynamic updates of a single hostname. The example ``named.conf`` text
+   of a single hostname. The example ``named.conf`` text shows how to set
-   shows how to set an update policy for the specified name using the
+   an update policy for the specified name using the "name" nametype. The
-   "name" nametype. The default key name is ``ddns-key.name``. Note that the
+   default key name is ``ddns-key.name``. Note that the "self" nametype
-   "self" nametype cannot be used, since the name to be updated may
+   cannot be used, since the name to be updated may differ from the key
-   differ from the key name. This option cannot be used with the ``-z``
+   name. This option cannot be used with the ``-z`` option.
-   option.
 
 ``-z zone`` (``ddns-confgen`` only)
    This option generates a configuration example to allow

bin/confgen/win32/tsigkeygen.vcxproj.filters.in

@@ -11,7 +11,7 @@
     </Filter>
   </ItemGroup>
   <ItemGroup>
-    <ClCompile Include="..\ddns-confgen.c">
+    <ClCompile Include="..\tsig-keygen.c">
       <Filter>Source Files</Filter>
     </ClCompile>
   </ItemGroup>

bin/confgen/win32/tsigkeygen.vcxproj.in

@@ -13,7 +13,7 @@
   <PropertyGroup Label="Globals">
     <ProjectGuid>{1EA4FC64-F33B-4A50-970A-EA052BBE9CF1}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
-    <RootNamespace>ddnsconfgen</RootNamespace>
+    <RootNamespace>tsigkeygen</RootNamespace>
     @WINDOWS_TARGET_PLATFORM_VERSION@
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
@@ -45,14 +45,14 @@
     <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
     <IntDir>.\$(Configuration)\</IntDir>
     <IntDirSharingDetected>None</IntDirSharingDetected>
-    <TargetName>ddns-confgen</TargetName>
+    <TargetName>tsig-keygen</TargetName>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
     <LinkIncremental>false</LinkIncremental>
     <OutDir>..\..\..\Build\$(Configuration)\</OutDir>
     <IntDir>.\$(Configuration)\</IntDir>
     <IntDirSharingDetected>None</IntDirSharingDetected>
-    <TargetName>ddns-confgen</TargetName>
+    <TargetName>tsig-keygen</TargetName>
   </PropertyGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
     <ClCompile>
@@ -81,8 +81,8 @@
     </Link>
     <PostBuildEvent>
       <Command>cd ..\..\..\Build\$(Configuration)
-copy /Y ddns-confgen.exe tsig-keygen.exe
+copy /Y tsig-keygen.exe ddns-confgen.exe
-copy /Y ddns-confgen.ilk tsig-keygen.ilk
+copy /Y tsig-keygen.ilk ddns-confgen.ilk
 </Command>
     </PostBuildEvent>
   </ItemDefinitionGroup>
@@ -119,12 +119,12 @@ copy /Y ddns-confgen.ilk tsig-keygen.ilk
     </Link>
     <PostBuildEvent>
       <Command>cd ..\..\..\Build\$(Configuration)
-copy /Y ddns-confgen.exe tsig-keygen.exe
+copy /Y tsig-keygen.exe ddns-confgen.exe
 </Command>
     </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemGroup>
-    <ClCompile Include="..\ddns-confgen.c" />
+    <ClCompile Include="..\tsig-keygen.c" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\..\..\lib\isc\win32\libisc.vcxproj">

bin/named/named.conf.rst

@@ -1025,5 +1025,5 @@ Files
 See Also
 ~~~~~~~~
 
-:manpage:`ddns-confgen(8)`, :manpage:`named(8)`, :manpage:`named-checkconf(8)`, :manpage:`rndc(8)`, :manpage:`rndc-confgen(8)`, BIND 9 Administrator Reference Manual.
+:manpage:`named(8)`, :manpage:`named-checkconf(8)`, :manpage:`rndc(8)`, :manpage:`rndc-confgen(8)`, :manpage:`tsig-keygen(8)`, BIND 9 Administrator Reference Manual.
 

bin/named/server.c

@@ -14475,7 +14475,7 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	dns_dnsseckey_t *key;
 	const char *ptr;
 	/* variables for -status */
-	char output[BUFSIZ];
+	char output[4096];
 	isc_stdtime_t now;
 	isc_time_t timenow;
 	const char *dir;

bin/named/zoneconf.c

@@ -334,7 +334,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 					    ISC_LOG_ERROR,
 					    "'%.*s' is not a valid type",
 					    (int)r.length, str);
-				isc_mem_put(mctx, types, n * sizeof(types));
+				isc_mem_put(mctx, types, n * sizeof(*types));
 				goto cleanup;
 			}
 		}

bin/nsupdate/nsupdate.rst

@@ -355,7 +355,7 @@ See Also
 ~~~~~~~~
 
 :rfc:`2136`, :rfc:`3007`, :rfc:`2104`, :rfc:`2845`, :rfc:`1034`, :rfc:`2535`, :rfc:`2931`,
-:manpage:`named(8)`, :manpage:`ddns-confgen(8)`, :manpage:`dnssec-keygen(8)`.
+:manpage:`named(8)`, :manpage:`dnssec-keygen(8)`, :manpage:`tsig-keygen(8)`.
 
 Bugs
 ~~~~

bin/tests/system/conf.sh.in

@@ -31,7 +31,6 @@ ARPANAME=$TOP_BUILDDIR/bin/tools/arpaname
 CDS=$TOP_BUILDDIR/bin/dnssec/dnssec-cds
 CHECKCONF=$TOP_BUILDDIR/bin/check/named-checkconf
 CHECKZONE=$TOP_BUILDDIR/bin/check/named-checkzone
-DDNSCONFGEN=$TOP_BUILDDIR/bin/confgen/ddns-confgen
 DELV=$TOP_BUILDDIR/bin/delv/delv
 DIG=$TOP_BUILDDIR/bin/dig/dig
 DNSTAPREAD=$TOP_BUILDDIR/bin/tools/dnstap-read

bin/tests/system/conf.sh.win32

@@ -32,7 +32,6 @@ ARPANAME=$TOP_BUILDDIR/Build/$VSCONF/arpaname@EXEEXT@
 CDS=$TOP_BUILDDIR/Build/$VSCONF/dnssec-cds@EXEEXT@
 CHECKCONF=$TOP_BUILDDIR/Build/$VSCONF/named-checkconf@EXEEXT@
 CHECKZONE=$TOP_BUILDDIR/Build/$VSCONF/named-checkzone@EXEEXT@
-DDNSCONFGEN=$TOP_BUILDDIR/Build/$VSCONF/ddns-confgen@EXEEXT@
 DELV=$TOP_BUILDDIR/Build/$VSCONF/delv@EXEEXT@
 DIG=$TOP_BUILDDIR/Build/$VSCONF/dig@EXEEXT@
 DNSTAPREAD=$TOP_BUILDDIR/Build/$VSCONF/dnstap-read@EXEEXT@

bin/tests/system/dlzexternal/setup.sh

@@ -11,6 +11,6 @@
 
 . $SYSTEMTESTTOP/conf.sh
 
-$DDNSCONFGEN -q -z example.nil > ns1/ddns.key
+$TSIGKEYGEN ddns-key.example.nil > ns1/ddns.key
 
 copy_setports ns1/named.conf.in ns1/named.conf

bin/tests/system/nsupdate/setup.sh

@@ -53,14 +53,14 @@ ns1.update.nil.         A       10.53.0.2
 ns2.update.nil.		AAAA	::1
 EOF
 
-$DDNSCONFGEN -q -z example.nil > ns1/ddns.key
+$TSIGKEYGEN ddns-key.example.nil > ns1/ddns.key
 
-$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
+$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key
-$DDNSCONFGEN -q -a hmac-sha1 -k sha1-key -z keytests.nil > ns1/sha1.key
+$TSIGKEYGEN -a hmac-sha1 sha1-key > ns1/sha1.key
-$DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
+$TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key
-$DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
+$TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key
-$DDNSCONFGEN -q -a hmac-sha384 -k sha384-key -z keytests.nil > ns1/sha384.key
+$TSIGKEYGEN -a hmac-sha384 sha384-key > ns1/sha384.key
-$DDNSCONFGEN -q -a hmac-sha512 -k sha512-key -z keytests.nil > ns1/sha512.key
+$TSIGKEYGEN -a hmac-sha512 sha512-key > ns1/sha512.key
 
 (cd ns3; $SHELL -e sign.sh)
 

bin/win32/BINDInstall/BINDInstall.vcxproj.in

@@ -162,7 +162,7 @@
     <ProjectReference Include="..\..\..\bin\confgen\win32\confgentool.vcxproj">
       <Project>{64964B03-4815-41F0-9057-E766A94AF197}</Project>
     </ProjectReference>
-    <ProjectReference Include="..\..\..\bin\confgen\win32\ddnsconfgen.vcxproj">
+    <ProjectReference Include="..\..\..\bin\confgen\win32\tsigkeygen.vcxproj">
       <Project>{1EA4FC64-F33B-4A50-970A-EA052BBE9CF1}</Project>
     </ProjectReference>
     <ProjectReference Include="..\..\..\bin\confgen\win32\rndcconfgen.vcxproj">

doc/arm/advanced.rst

@@ -416,7 +416,7 @@ email, etc.)
 
 ``tsig-keygen`` can also be run as ``ddns-confgen``, in which case its
 output includes additional configuration text for setting up dynamic DNS
-in ``named``. See :ref:`man_ddns-confgen` for details.
+in ``named``. See :ref:`man_tsig-keygen` for details.
 
 Loading a New Key
 ~~~~~~~~~~~~~~~~~

doc/arm/manpages.rst

@@ -14,7 +14,6 @@ Manual Pages
 ============
 
 .. include:: ../../bin/tools/arpaname.rst
-.. include:: ../../bin/confgen/ddns-confgen.rst
 .. include:: ../../bin/delv/delv.rst
 .. include:: ../../bin/dig/dig.rst
 .. include:: ../../bin/dnssec/dnssec-cds.rst
@@ -47,3 +46,4 @@ Manual Pages
 .. include:: ../../bin/confgen/rndc-confgen.rst
 .. include:: ../../bin/rndc/rndc.conf.rst
 .. include:: ../../bin/rndc/rndc.rst
+.. include:: ../../bin/confgen/tsig-keygen.rst

doc/man/Makefile.am

@@ -3,9 +3,9 @@ include $(top_srcdir)/Makefile.docs
 
 MANPAGES_RST =				\
 	arpaname.rst			\
-	ddns-confgen.rst		\
 	delv.rst			\
 	dig.rst				\
+	ddns-confgen.rst		\
 	dnssec-cds.rst			\
 	dnssec-dsfromkey.rst		\
 	dnssec-importkey.rst		\
@@ -37,10 +37,11 @@ MANPAGES_RST =				\
 	rndc-confgen.rst		\
 	rndc.conf.rst			\
 	rndc.rst			\
+	tsig-keygen.rst			\
 	../../bin/check/named-checkconf.rst \
 	../../bin/check/named-checkzone.rst \
-	../../bin/confgen/ddns-confgen.rst \
 	../../bin/confgen/rndc-confgen.rst \
+	../../bin/confgen/tsig-keygen.rst \
 	../../bin/delv/delv.rst \
 	../../bin/dig/dig.rst \
 	../../bin/dig/host.rst \
@@ -84,7 +85,6 @@ man_MANS =				\
 	nsupdate.1			\
 	named.conf.5			\
 	rndc.conf.5			\
-	ddns-confgen.8			\
 	dnssec-cds.1			\
 	dnssec-dsfromkey.1		\
 	dnssec-importkey.1		\
@@ -102,7 +102,8 @@ man_MANS =				\
 	named.8				\
 	nsec3hash.1			\
 	rndc-confgen.8			\
-	rndc.8
+	rndc.8				\
+	tsig-keygen.8
 
 if HAVE_PKCS11
 man_MANS +=				\

doc/man/conf.py

@@ -60,7 +60,6 @@ master_doc = 'index'
 # pylint: disable=line-too-long
 man_pages = [
     ('arpaname', 'arpaname', 'translate IP addresses to the corresponding ARPA names', author, 1),
-    ('ddns-confgen', 'ddns-confgen', 'ddns key generation tool', author, 8),
     ('delv', 'delv', 'DNS lookup and validation utility', author, 1),
     ('dig', 'dig', 'DNS lookup utility', author, 1),
     ('dnssec-cds', 'dnssec-cds', 'change DS records for a child zone based on CDS/CDNSKEY', author, 1),
@@ -93,4 +92,5 @@ man_pages = [
     ('rndc-confgen', 'rndc-confgen', 'rndc key generation tool', author, 8),
     ('rndc.conf', 'rndc.conf', 'rndc configuration file', author, 5),
     ('rndc', 'rndc', 'name server control utility', author, 8),
+    ('tsig-keygen', 'tsig-keygen', 'TSIG key generation tool', author, 8),
     ]

doc/man/ddns-confgen.rst

@@ -10,4 +10,4 @@
 
 :orphan:
 
-.. include:: ../../bin/confgen/ddns-confgen.rst
+.. include:: ../../bin/confgen/tsig-keygen.rst

doc/man/dnssec-importkey.1in

@@ -39,7 +39,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .sp
 \fBdnssec\-importkey\fP reads a public DNSKEY record and generates a pair
 of .key/.private files. The DNSKEY record may be read from an existing
-\&.key file, in which case a corresponding .private file is
+.key file, in which case a corresponding .private file is
 generated, or it may be read from any other file or from the standard
 input, in which case both .key and .private files are generated.
 .sp

doc/man/named.conf.5in

@@ -1120,7 +1120,7 @@ zone string [ class ] {
 \fB/etc/named.conf\fP
 .SH SEE ALSO
 .sp
-\fBddns\-confgen(8)\fP, \fBnamed(8)\fP, \fBnamed\-checkconf(8)\fP, \fBrndc(8)\fP, \fBrndc\-confgen(8)\fP, BIND 9 Administrator Reference Manual.
+\fBnamed(8)\fP, \fBnamed\-checkconf(8)\fP, \fBrndc(8)\fP, \fBrndc\-confgen(8)\fP, \fBtsig\-keygen(8)\fP, BIND 9 Administrator Reference Manual.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT

doc/man/nsupdate.1in

@@ -364,7 +364,7 @@ Base\-64 encoding of the HMAC\-MD5 key created by \fBdnssec\-keygen\fP\&.
 .SH SEE ALSO
 .sp
 \fI\%RFC 2136\fP, \fI\%RFC 3007\fP, \fI\%RFC 2104\fP, \fI\%RFC 2845\fP, \fI\%RFC 1034\fP, \fI\%RFC 2535\fP, \fI\%RFC 2931\fP,
-\fBnamed(8)\fP, \fBddns\-confgen(8)\fP, \fBdnssec\-keygen(8)\fP\&.
+\fBnamed(8)\fP, \fBdnssec\-keygen(8)\fP, \fBtsig\-keygen(8)\fP\&.
 .SH BUGS
 .sp
 The TSIG key is redundantly stored in two separate files. This is a

doc/man/tsig-keygen.8in

@@ -0,0 +1,109 @@
+.\" Man page generated from reStructuredText.
+.
+.TH "TSIG-KEYGEN" "8" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
+.SH NAME
+tsig-keygen \- TSIG key generation tool
+.
+.nr rst2man-indent-level 0
+.
+.de1 rstReportMargin
+\\$1 \\n[an-margin]
+level \\n[rst2man-indent-level]
+level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
+-
+\\n[rst2man-indent0]
+\\n[rst2man-indent1]
+\\n[rst2man-indent2]
+..
+.de1 INDENT
+.\" .rstReportMargin pre:
+. RS \\$1
+. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
+. nr rst2man-indent-level +1
+.\" .rstReportMargin post:
+..
+.de UNINDENT
+. RE
+.\" indent \\n[an-margin]
+.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
+.nr rst2man-indent-level -1
+.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
+.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
+..
+.SH SYNOPSIS
+.sp
+\fBtsig\-keygen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-r\fP randomfile] [\fB\-s\fP name]
+.sp
+\fBddns\-confgen\fP [\fB\-a\fP algorithm] [\fB\-h\fP] [\fB\-k\fP keyname] [\fB\-q\fP] [\fB\-r\fP randomfile] [\fB\-s\fP name] [\fB\-z\fP zone]
+.SH DESCRIPTION
+.sp
+\fBtsig\-keygen\fP and \fBddns\-confgen\fP are invocation methods for a
+utility that generates keys for use in TSIG signing. The resulting keys
+can be used, for example, to secure dynamic DNS updates to a zone, or for
+the \fBrndc\fP command channel.
+.sp
+When run as \fBtsig\-keygen\fP, a domain name can be specified on the
+command line to be used as the name of the generated key. If no
+name is specified, the default is \fBtsig\-key\fP\&.
+.sp
+When run as \fBddns\-confgen\fP, the key name can specified using \fB\-k\fP
+parameter and defaults to \fBddns\-key\fP\&. The generated key is accompanied
+by configuration text and instructions that can be used with \fBnsupdate\fP
+and \fBnamed\fP when setting up dynamic DNS, including an example
+\fBupdate\-policy\fP statement. (This usage is similar to the \fBrndc\-confgen\fP
+command for setting up command\-channel security.)
+.sp
+Note that \fBnamed\fP itself can configure a local DDNS key for use with
+\fBnsupdate \-l\fP; it does this when a zone is configured with
+\fBupdate\-policy local;\fP\&. \fBddns\-confgen\fP is only needed when a more
+elaborate configuration is required: for instance, if \fBnsupdate\fP is to
+be used from a remote system.
+.SH OPTIONS
+.INDENT 0.0
+.TP
+.B \fB\-a algorithm\fP
+This option specifies the algorithm to use for the TSIG key. Available
+choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384,
+and hmac\-sha512. The default is hmac\-sha256. Options are
+case\-insensitive, and the "hmac\-" prefix may be omitted.
+.TP
+.B \fB\-h\fP
+This option prints a short summary of options and arguments.
+.TP
+.B \fB\-k keyname\fP
+This option specifies the key name of the DDNS authentication key. The
+default is \fBddns\-key\fP when neither the \fB\-s\fP nor \fB\-z\fP option is
+specified; otherwise, the default is \fBddns\-key\fP as a separate label
+followed by the argument of the option, e.g., \fBddns\-key.example.com.\fP
+The key name must have the format of a valid domain name, consisting of
+letters, digits, hyphens, and periods.
+.TP
+.B \fB\-q\fP (\fBddns\-confgen\fP only)
+This option enables quiet mode, which prints only the key, with no
+explanatory text or usage examples. This is essentially identical to
+\fBtsig\-keygen\fP\&.
+.TP
+.B \fB\-s name\fP (\fBddns\-confgen\fP only)
+This option generates a configuration example to allow dynamic updates
+of a single hostname. The example \fBnamed.conf\fP text shows how to set
+an update policy for the specified name using the "name" nametype. The
+default key name is \fBddns\-key.name\fP\&. Note that the "self" nametype
+cannot be used, since the name to be updated may differ from the key
+name. This option cannot be used with the \fB\-z\fP option.
+.TP
+.B \fB\-z zone\fP (\fBddns\-confgen\fP only)
+This option generates a configuration example to allow
+dynamic updates of a zone. The example \fBnamed.conf\fP text shows how
+to set an update policy for the specified zone using the "zonesub"
+nametype, allowing updates to all subdomain names within that zone.
+This option cannot be used with the \fB\-s\fP option.
+.UNINDENT
+.SH SEE ALSO
+.sp
+\fBnsupdate(1)\fP, \fBnamed.conf(5)\fP, \fBnamed(8)\fP, BIND 9 Administrator Reference Manual.
+.SH AUTHOR
+Internet Systems Consortium
+.SH COPYRIGHT
+2020, Internet Systems Consortium
+.\" Generated by docutils manpage writer.
+.

doc/man/tsig-keygen.rst

@@ -0,0 +1,13 @@
+.. 
+   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+   
+   This Source Code Form is subject to the terms of the Mozilla Public
+   License, v. 2.0. If a copy of the MPL was not distributed with this
+   file, You can obtain one at http://mozilla.org/MPL/2.0/.
+   
+   See the COPYRIGHT file distributed with this work for additional
+   information regarding copyright ownership.
+
+:orphan:
+
+.. include:: ../../bin/confgen/tsig-keygen.rst

doc/misc/named.conf.rst

@@ -1021,5 +1021,5 @@ Files
 See Also
 ~~~~~~~~
 
-:manpage:`ddns-confgen(8)`, :manpage:`named(8)`, :manpage:`named-checkconf(8)`, :manpage:`rndc(8)`, :manpage:`rndc-confgen(8)`, BIND 9 Administrator Reference Manual.
+:manpage:`tsig-keygen(8)`, :manpage:`named(8)`, :manpage:`named-checkconf(8)`, :manpage:`rndc(8)`, :manpage:`rndc-confgen(8)`, BIND 9 Administrator Reference Manual.
 

doc/misc/rst-options.pl

@@ -114,6 +114,6 @@ Files
 See Also
 ~~~~~~~~
 
-:manpage:`ddns-confgen(8)`, :manpage:`named(8)`, :manpage:`named-checkconf(8)`, :manpage:`rndc(8)`, :manpage:`rndc-confgen(8)`, BIND 9 Administrator Reference Manual.
+:manpage:`named(8)`, :manpage:`named-checkconf(8)`, :manpage:`rndc(8)`, :manpage:`rndc-confgen(8)`, :manpage:`tsig-keygen(8)`, BIND 9 Administrator Reference Manual.
 
 END

lib/dns/client.c

@@ -1407,10 +1407,8 @@ cleanup:
 	if (sigrdataset != NULL) {
 		putrdataset(client->mctx, &sigrdataset);
 	}
-	if (rctx != NULL) {
+	isc_mutex_destroy(&rctx->lock);
-		isc_mutex_destroy(&rctx->lock);
+	isc_mem_put(mctx, rctx, sizeof(*rctx));
-		isc_mem_put(mctx, rctx, sizeof(*rctx));
-	}
 	isc_event_free(ISC_EVENT_PTR(&event));
 	isc_task_detach(&tclone);
 	dns_view_detach(&view);

lib/dns/rbtdb.c

@@ -203,7 +203,7 @@ typedef struct rdatasetheader {
 	rbtdb_serial_t serial;
 	dns_ttl_t rdh_ttl;
 	rbtdb_rdatatype_t type;
-	uint16_t attributes;
+	atomic_uint_least16_t attributes;
 	dns_trust_t trust;
 	struct noqname *noqname;
 	struct noqname *closest;
@@ -284,22 +284,58 @@ typedef ISC_LIST(dns_rbtnode_t) rbtnodelist_t;
 
 #undef IGNORE /* WIN32 winbase.h defines this. */
 
-#define EXISTS(header) (((header)->attributes & RDATASET_ATTR_NONEXISTENT) == 0)
+#define EXISTS(header)                                 \
-#define NONEXISTENT(header) \
+	((atomic_load_acquire(&(header)->attributes) & \
-	(((header)->attributes & RDATASET_ATTR_NONEXISTENT) != 0)
+	  RDATASET_ATTR_NONEXISTENT) == 0)
-#define IGNORE(header)	 (((header)->attributes & RDATASET_ATTR_IGNORE) != 0)
+#define NONEXISTENT(header)                            \
-#define RETAIN(header)	 (((header)->attributes & RDATASET_ATTR_RETAIN) != 0)
+	((atomic_load_acquire(&(header)->attributes) & \
-#define NXDOMAIN(header) (((header)->attributes & RDATASET_ATTR_NXDOMAIN) != 0)
+	  RDATASET_ATTR_NONEXISTENT) != 0)
-#define STALE(header)	 (((header)->attributes & RDATASET_ATTR_STALE) != 0)
+#define IGNORE(header)                                 \
-#define RESIGN(header)	 (((header)->attributes & RDATASET_ATTR_RESIGN) != 0)
+	((atomic_load_acquire(&(header)->attributes) & \
-#define OPTOUT(header)	 (((header)->attributes & RDATASET_ATTR_OPTOUT) != 0)
+	  RDATASET_ATTR_IGNORE) != 0)
-#define NEGATIVE(header) (((header)->attributes & RDATASET_ATTR_NEGATIVE) != 0)
+#define RETAIN(header)                                 \
-#define PREFETCH(header) (((header)->attributes & RDATASET_ATTR_PREFETCH) != 0)
+	((atomic_load_acquire(&(header)->attributes) & \
-#define CASESET(header)	 (((header)->attributes & RDATASET_ATTR_CASESET) != 0)
+	  RDATASET_ATTR_RETAIN) != 0)
-#define ZEROTTL(header)	 (((header)->attributes & RDATASET_ATTR_ZEROTTL) != 0)
+#define NXDOMAIN(header)                               \
-#define CASEFULLYLOWER(header) \
+	((atomic_load_acquire(&(header)->attributes) & \
-	(((header)->attributes & RDATASET_ATTR_CASEFULLYLOWER) != 0)
+	  RDATASET_ATTR_NXDOMAIN) != 0)
-#define ANCIENT(header) (((header)->attributes & RDATASET_ATTR_ANCIENT) != 0)
+#define STALE(header)                                                          \
+	((atomic_load_acquire(&(header)->attributes) & RDATASET_ATTR_STALE) != \
+	 0)
+#define RESIGN(header)                                 \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  RDATASET_ATTR_RESIGN) != 0)
+#define OPTOUT(header)                                 \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  RDATASET_ATTR_OPTOUT) != 0)
+#define NEGATIVE(header)                               \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  RDATASET_ATTR_NEGATIVE) != 0)
+#define PREFETCH(header)                               \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  RDATASET_ATTR_PREFETCH) != 0)
+#define CASESET(header)                                \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  RDATASET_ATTR_CASESET) != 0)
+#define ZEROTTL(header)                                \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  RDATASET_ATTR_ZEROTTL) != 0)
+#define CASEFULLYLOWER(header)                         \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  RDATASET_ATTR_CASEFULLYLOWER) != 0)
+#define ANCIENT(header)                                \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  RDATASET_ATTR_ANCIENT) != 0)
+#define STATCOUNT(header)                              \
+	((atomic_load_acquire(&(header)->attributes) & \
+	  RDATASET_ATTR_STATCOUNT) != 0)
+
+#define RDATASET_ATTR_GET(header, attribute) \
+	(atomic_load_acquire(&(header)->attributes) & attribute)
+#define RDATASET_ATTR_SET(header, attribute) \
+	atomic_fetch_or_release(&(header)->attributes, attribute)
+#define RDATASET_ATTR_CLR(header, attribute) \
+	atomic_fetch_and_release(&(header)->attributes, ~(attribute))
 
 #define ACTIVE(header, now)             \
 	(((header)->rdh_ttl > (now)) || \
@@ -820,16 +856,18 @@ update_cachestats(dns_rbtdb_t *rbtdb, isc_result_t result) {
 
 static bool
 do_stats(rdatasetheader_t *header) {
-	return (EXISTS(header) &&
+	return (EXISTS(header) && STATCOUNT(header));
-		(header->attributes & RDATASET_ATTR_STATCOUNT) != 0);
 }
 
 static void
-update_rrsetstats(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
+update_rrsetstats(dns_rbtdb_t *rbtdb, const rbtdb_rdatatype_t htype,
-		  bool increment) {
+		  const uint_least16_t hattributes, const bool increment) {
 	dns_rdatastatstype_t statattributes = 0;
 	dns_rdatastatstype_t base = 0;
 	dns_rdatastatstype_t type;
+	rdatasetheader_t *header = &(rdatasetheader_t){
+		.type = htype, .attributes = ATOMIC_VAR_INIT(hattributes)
+	};
 
 	if (!do_stats(header)) {
 		return;
@@ -1427,6 +1465,13 @@ init_rdataset(dns_rbtdb_t *rbtdb, rdatasetheader_t *h) {
 	h->is_mmapped = 0;
 	h->next_is_relative = 0;
 	h->node_is_relative = 0;
+	atomic_init(&h->attributes, 0);
+
+#ifndef ISC_MUTEX_ATOMICS
+	STATIC_ASSERT((sizeof(h->attributes) == 2),
+		      "The .attributes field of rdatasetheader_t needs to be "
+		      "16-bit int type exactly.");
+#endif /* !ISC_MUTEX_ATOMICS */
 
 #if TRACE_HEADER
 	if (IS_CACHE(rbtdb) && rbtdb->common.rdclass == dns_rdataclass_in) {
@@ -1455,12 +1500,11 @@ update_newheader(rdatasetheader_t *newh, rdatasetheader_t *old) {
 		newh->node = (dns_rbtnode_t *)p;
 	}
 	if (CASESET(old)) {
-		uint16_t attr;
+		uint_least16_t attr = RDATASET_ATTR_GET(
-
+			old,
+			(RDATASET_ATTR_CASESET | RDATASET_ATTR_CASEFULLYLOWER));
+		RDATASET_ATTR_SET(newh, attr);
 		memmove(newh->upper, old->upper, sizeof(old->upper));
-		attr = old->attributes &
-		       (RDATASET_ATTR_CASESET | RDATASET_ATTR_CASEFULLYLOWER);
-		newh->attributes |= attr;
 	}
 }
 
@@ -1486,7 +1530,8 @@ free_rdataset(dns_rbtdb_t *rbtdb, isc_mem_t *mctx, rdatasetheader_t *rdataset) {
 	unsigned int size;
 	int idx;
 
-	update_rrsetstats(rbtdb, rdataset, false);
+	update_rrsetstats(rbtdb, rdataset->type,
+			  atomic_load_acquire(&rdataset->attributes), false);
 
 	idx = rdataset->node->locknum;
 	if (ISC_LINK_LINKED(rdataset, link)) {
@@ -1536,13 +1581,14 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
 	 */
 	for (header = node->data; header != NULL; header = header->next) {
 		if (header->serial == serial) {
-			header->attributes |= RDATASET_ATTR_IGNORE;
+			RDATASET_ATTR_SET(header, RDATASET_ATTR_IGNORE);
 			make_dirty = true;
 		}
 		for (dcurrent = header->down; dcurrent != NULL;
 		     dcurrent = dcurrent->down) {
 			if (dcurrent->serial == serial) {
-				dcurrent->attributes |= RDATASET_ATTR_IGNORE;
+				RDATASET_ATTR_SET(dcurrent,
+						  RDATASET_ATTR_IGNORE);
 				make_dirty = true;
 			}
 		}
@@ -1554,12 +1600,19 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
 
 static inline void
 mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
+	uint_least16_t attributes = atomic_load_acquire(&header->attributes);
+	uint_least16_t newattributes = 0;
+
 	/*
 	 * If we are already ancient there is nothing to do.
 	 */
-	if (ANCIENT(header)) {
+	do {
-		return;
+		if ((attributes & RDATASET_ATTR_ANCIENT) != 0) {
-	}
+			return;
+		}
+		newattributes = attributes | RDATASET_ATTR_ANCIENT;
+	} while (!atomic_compare_exchange_weak_acq_rel(
+		&header->attributes, &attributes, newattributes));
 
 	/*
 	 * Decrement the stats counter for the appropriate RRtype.
@@ -1567,23 +1620,28 @@ mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
 	 * stale type counter, otherwise it decrements the active
 	 * stats type counter.
 	 */
-	update_rrsetstats(rbtdb, header, false);
+	update_rrsetstats(rbtdb, header->type, attributes, false);
-
-	header->attributes |= RDATASET_ATTR_ANCIENT;
 	header->node->dirty = 1;
 
 	/* Increment the stats counter for the ancient RRtype. */
-	update_rrsetstats(rbtdb, header, true);
+	update_rrsetstats(rbtdb, header->type, newattributes, true);
 }
 
 static inline void
 mark_header_stale(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
+	uint_least16_t attributes = atomic_load_acquire(&header->attributes);
+	uint_least16_t newattributes = 0;
+
 	/*
 	 * If we are already stale there is nothing to do.
 	 */
-	if (STALE(header)) {
+	do {
-		return;
+		if ((attributes & RDATASET_ATTR_STALE) != 0) {
-	}
+			return;
+		}
+		newattributes = attributes | RDATASET_ATTR_STALE;
+	} while (!atomic_compare_exchange_weak_acq_rel(
+		&header->attributes, &attributes, newattributes));
 
 	/* Decrement the stats counter for the appropriate RRtype.
 	 * If the ANCIENT attribute is set (although it is very
@@ -1591,11 +1649,9 @@ mark_header_stale(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) {
 	 * will decrement the ancient stale type counter, otherwise it
 	 * decrements the active stats type counter.
 	 */
-	update_rrsetstats(rbtdb, header, false);
 
-	header->attributes |= RDATASET_ATTR_STALE;
+	update_rrsetstats(rbtdb, header->type, attributes, false);
-
+	update_rrsetstats(rbtdb, header->type, newattributes, true);
-	update_rrsetstats(rbtdb, header, true);
 }
 
 static inline void
@@ -5530,17 +5586,20 @@ printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out) {
 			first = true;
 			fprintf(out, "\ttype %u", current->type);
 			do {
+				uint_least16_t attributes = atomic_load_acquire(
+					&current->attributes);
 				if (!first) {
 					fprintf(out, "\t");
 				}
 				first = false;
 				fprintf(out,
 					"\tserial = %lu, ttl = %u, "
-					"trust = %u, attributes = %u, "
+					"trust = %u, attributes = %" PRIuLEAST16
+					", "
 					"resign = %u\n",
 					(unsigned long)current->serial,
 					current->rdh_ttl, current->trust,
-					current->attributes,
+					attributes,
 					(current->resign << 1) |
 						current->resign_lsb);
 				current = current->down;
@@ -6702,9 +6761,9 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	set_ttl(rbtdb, newheader, rdataset->ttl + now);
 	newheader->type = RBTDB_RDATATYPE_VALUE(rdataset->type,
 						rdataset->covers);
-	newheader->attributes = 0;
+	atomic_init(&newheader->attributes, 0);
 	if (rdataset->ttl == 0U) {
-		newheader->attributes |= RDATASET_ATTR_ZEROTTL;
+		RDATASET_ATTR_SET(newheader, RDATASET_ATTR_ZEROTTL);
 	}
 	newheader->noqname = NULL;
 	newheader->closest = NULL;
@@ -6718,7 +6777,7 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		now = 0;
 
 		if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
-			newheader->attributes |= RDATASET_ATTR_RESIGN;
+			RDATASET_ATTR_SET(newheader, RDATASET_ATTR_RESIGN);
 			newheader->resign = (isc_stdtime_t)(
 				dns_time64_from32(rdataset->resign) >> 1);
 			newheader->resign_lsb = rdataset->resign & 0x1;
@@ -6731,16 +6790,16 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		newheader->resign = 0;
 		newheader->resign_lsb = 0;
 		if ((rdataset->attributes & DNS_RDATASETATTR_PREFETCH) != 0) {
-			newheader->attributes |= RDATASET_ATTR_PREFETCH;
+			RDATASET_ATTR_SET(newheader, RDATASET_ATTR_PREFETCH);
 		}
 		if ((rdataset->attributes & DNS_RDATASETATTR_NEGATIVE) != 0) {
-			newheader->attributes |= RDATASET_ATTR_NEGATIVE;
+			RDATASET_ATTR_SET(newheader, RDATASET_ATTR_NEGATIVE);
 		}
 		if ((rdataset->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) {
-			newheader->attributes |= RDATASET_ATTR_NXDOMAIN;
+			RDATASET_ATTR_SET(newheader, RDATASET_ATTR_NXDOMAIN);
 		}
 		if ((rdataset->attributes & DNS_RDATASETATTR_OPTOUT) != 0) {
-			newheader->attributes |= RDATASET_ATTR_OPTOUT;
+			RDATASET_ATTR_SET(newheader, RDATASET_ATTR_OPTOUT);
 		}
 		if ((rdataset->attributes & DNS_RDATASETATTR_NOQNAME) != 0) {
 			result = addnoqname(rbtdb, newheader, rdataset);
@@ -6807,8 +6866,10 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		  isc_rwlocktype_write);
 
 	if (rbtdb->rrsetstats != NULL) {
-		newheader->attributes |= RDATASET_ATTR_STATCOUNT;
+		RDATASET_ATTR_SET(newheader, RDATASET_ATTR_STATCOUNT);
-		update_rrsetstats(rbtdb, newheader, true);
+		update_rrsetstats(rbtdb, newheader->type,
+				  atomic_load_acquire(&newheader->attributes),
+				  true);
 	}
 
 	if (IS_CACHE(rbtdb)) {
@@ -6914,7 +6975,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	set_ttl(rbtdb, newheader, rdataset->ttl);
 	newheader->type = RBTDB_RDATATYPE_VALUE(rdataset->type,
 						rdataset->covers);
-	newheader->attributes = 0;
+	atomic_init(&newheader->attributes, 0);
 	newheader->serial = rbtversion->serial;
 	newheader->trust = 0;
 	newheader->noqname = NULL;
@@ -6924,7 +6985,7 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	newheader->last_used = 0;
 	newheader->node = rbtnode;
 	if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
-		newheader->attributes |= RDATASET_ATTR_RESIGN;
+		RDATASET_ATTR_SET(newheader, RDATASET_ATTR_RESIGN);
 		newheader->resign = (isc_stdtime_t)(
 			dns_time64_from32(rdataset->resign) >> 1);
 		newheader->resign_lsb = rdataset->resign & 0x1;
@@ -6986,7 +7047,8 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 			init_rdataset(rbtdb, newheader);
 			update_newheader(newheader, header);
 			if (RESIGN(header)) {
-				newheader->attributes |= RDATASET_ATTR_RESIGN;
+				RDATASET_ATTR_SET(newheader,
+						  RDATASET_ATTR_RESIGN);
 				newheader->resign = header->resign;
 				newheader->resign_lsb = header->resign_lsb;
 				result = resign_insert(rbtdb, rbtnode->locknum,
@@ -7024,7 +7086,8 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 			init_rdataset(rbtdb, newheader);
 			set_ttl(rbtdb, newheader, 0);
 			newheader->type = topheader->type;
-			newheader->attributes = RDATASET_ATTR_NONEXISTENT;
+			atomic_init(&newheader->attributes,
+				    RDATASET_ATTR_NONEXISTENT);
 			newheader->trust = 0;
 			newheader->serial = rbtversion->serial;
 			newheader->noqname = NULL;
@@ -7128,7 +7191,7 @@ deleterdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	init_rdataset(rbtdb, newheader);
 	set_ttl(rbtdb, newheader, 0);
 	newheader->type = RBTDB_RDATATYPE_VALUE(type, covers);
-	newheader->attributes = RDATASET_ATTR_NONEXISTENT;
+	atomic_init(&newheader->attributes, RDATASET_ATTR_NONEXISTENT);
 	newheader->trust = 0;
 	newheader->noqname = NULL;
 	newheader->closest = NULL;
@@ -7320,7 +7383,7 @@ loading_addrdataset(void *arg, const dns_name_t *name,
 								  * check */
 	newheader->type = RBTDB_RDATATYPE_VALUE(rdataset->type,
 						rdataset->covers);
-	newheader->attributes = 0;
+	atomic_init(&newheader->attributes, 0);
 	newheader->trust = rdataset->trust;
 	newheader->serial = 1;
 	newheader->noqname = NULL;
@@ -7332,7 +7395,7 @@ loading_addrdataset(void *arg, const dns_name_t *name,
 	setownercase(newheader, name);
 
 	if ((rdataset->attributes & DNS_RDATASETATTR_RESIGN) != 0) {
-		newheader->attributes |= RDATASET_ATTR_RESIGN;
+		RDATASET_ATTR_SET(newheader, RDATASET_ATTR_RESIGN);
 		newheader->resign = (isc_stdtime_t)(
 			dns_time64_from32(rdataset->resign) >> 1);
 		newheader->resign_lsb = rdataset->resign & 0x1;
@@ -7381,6 +7444,9 @@ rbt_datafixer(dns_rbtnode_t *rbtnode, void *base, size_t filesize, void *arg,
 		header->is_mmapped = 1;
 		header->node = rbtnode;
 		header->node_is_relative = 0;
+#ifdef ISC_MUTEX_ATOMICS
+		atomic_init(&header->attributes, header->attributes.v);
+#endif
 
 		if (RESIGN(header) &&
 		    (header->resign != 0 || header->resign_lsb != 0)) {
@@ -8082,7 +8148,7 @@ setsigningtime(dns_db_t *db, dns_rdataset_t *rdataset, isc_stdtime_t resign) {
 					   header->heap_index);
 		}
 	} else if (resign != 0) {
-		header->attributes |= RDATASET_ATTR_RESIGN;
+		RDATASET_ATTR_SET(header, RDATASET_ATTR_RESIGN);
 		result = resign_insert(rbtdb, header->node->locknum, header);
 	}
 	NODE_UNLOCK(&rbtdb->node_locks[header->node->locknum].lock,
@@ -8971,7 +9037,7 @@ rdataset_clearprefetch(dns_rdataset_t *rdataset) {
 	header--;
 	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
 		  isc_rwlocktype_write);
-	header->attributes &= ~RDATASET_ATTR_PREFETCH;
+	RDATASET_ATTR_CLR(header, RDATASET_ATTR_PREFETCH);
 	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
 		    isc_rwlocktype_write);
 }
@@ -9705,9 +9771,9 @@ setownercase(rdatasetheader_t *header, const dns_name_t *name) {
 			}
 		}
 	}
-	header->attributes |= RDATASET_ATTR_CASESET;
+	RDATASET_ATTR_SET(header, RDATASET_ATTR_CASESET);
 	if (ISC_LIKELY(fully_lower)) {
-		header->attributes |= RDATASET_ATTR_CASEFULLYLOWER;
+		RDATASET_ATTR_SET(header, RDATASET_ATTR_CASEFULLYLOWER);
 	}
 }
 
@@ -9781,13 +9847,13 @@ static void
 rdataset_getownercase(const dns_rdataset_t *rdataset, dns_name_t *name) {
 	dns_rbtdb_t *rbtdb = rdataset->private1;
 	dns_rbtnode_t *rbtnode = rdataset->private2;
-	const unsigned char *raw = rdataset->private3; /* RDATASLAB */
+	unsigned char *raw = rdataset->private3; /* RDATASLAB */
-	const rdatasetheader_t *header;
+	rdatasetheader_t *header;
 	unsigned int i, j;
 	unsigned char bits;
 	unsigned char c, flip;
 
-	header = (const struct rdatasetheader *)(raw - sizeof(*header));
+	header = (struct rdatasetheader *)(raw - sizeof(*header));
 
 	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
 		  isc_rwlocktype_read);
@@ -10406,9 +10472,9 @@ no_glue:
  */
 static inline bool
 need_headerupdate(rdatasetheader_t *header, isc_stdtime_t now) {
-	if ((header->attributes &
+	if (RDATASET_ATTR_GET(header, (RDATASET_ATTR_NONEXISTENT |
-	     (RDATASET_ATTR_NONEXISTENT | RDATASET_ATTR_ANCIENT |
+				       RDATASET_ATTR_ANCIENT |
-	      RDATASET_ATTR_ZEROTTL)) != 0)
+				       RDATASET_ATTR_ZEROTTL)) != 0)
 	{
 		return (false);
 	}

lib/dns/rdata.c

@@ -1286,7 +1286,7 @@ dns_rdata_checknames(dns_rdata_t *rdata, const dns_name_t *owner,
 unsigned int
 dns_rdatatype_attributes(dns_rdatatype_t type) {
 	RDATATYPE_ATTRIBUTE_SW
-	if (type >= (dns_rdatatype_t)128 && type < (dns_rdatatype_t)255) {
+	if (type >= (dns_rdatatype_t)128 && type <= (dns_rdatatype_t)255) {
 		return (DNS_RDATATYPEATTR_UNKNOWN | DNS_RDATATYPEATTR_META);
 	}
 	return (DNS_RDATATYPEATTR_UNKNOWN);

lib/isc/include/isc/mutexatomic.h

@@ -13,6 +13,9 @@
 
 #include <inttypes.h>
 #include <stdbool.h>
+#if HAVE_UCHAR_H
+#include <uchar.h>
+#endif /* HAVE_UCHAR_H */
 
 #include <isc/mutex.h>
 
@@ -73,35 +76,65 @@ enum memory_order {
 
 typedef enum memory_order memory_order;
 
-typedef struct atomic_int_fast32 {
+#define ___TYPEDEF(type, name, orig) \
-	isc_mutex_t  m;
+	typedef struct name {        \
-	int_fast32_t v;
+		isc_mutex_t m;       \
-} atomic_int_fast32_t;
+		orig	    v;       \
+	} type;
 
-typedef struct atomic_int_fast64 {
+#define _TYPEDEF_S(type) ___TYPEDEF(atomic_##type, atomic_##type##_s, type)
-	isc_mutex_t  m;
+#define _TYPEDEF_O(type, orig) \
-	int_fast64_t v;
+	___TYPEDEF(atomic_##type, atomic_##type##_s, orig)
-} atomic_int_fast64_t;
+#define _TYPEDEF_T(type) \
+	___TYPEDEF(atomic_##type##_t, atomic_##type##_s, type##_t)
 
-typedef struct atomic_uint_fast32 {
+#ifndef HAVE_UCHAR_H
-	isc_mutex_t   m;
+typedef uint_least16_t char16_t;
-	uint_fast32_t v;
+typedef uint_least32_t char32_t;
-} atomic_uint_fast32_t;
+#endif /* HAVE_UCHAR_H */
 
-typedef struct atomic_uint_fast64 {
+_TYPEDEF_S(bool);
-	isc_mutex_t   m;
+_TYPEDEF_S(char);
-	uint_fast64_t v;
+_TYPEDEF_O(schar, signed char);
-} atomic_uint_fast64_t;
+_TYPEDEF_O(uchar, unsigned char);
+_TYPEDEF_S(short);
+_TYPEDEF_O(ushort, unsigned short);
+_TYPEDEF_S(int);
+_TYPEDEF_O(uint, unsigned int);
+_TYPEDEF_S(long);
+_TYPEDEF_O(ulong, unsigned long);
+_TYPEDEF_O(llong, long long);
+_TYPEDEF_O(ullong, unsigned long long);
+_TYPEDEF_T(char16);
+_TYPEDEF_T(char32);
+_TYPEDEF_T(wchar);
+_TYPEDEF_T(int_least8);
+_TYPEDEF_T(uint_least8);
+_TYPEDEF_T(int_least16);
+_TYPEDEF_T(uint_least16);
+_TYPEDEF_T(int_least32);
+_TYPEDEF_T(uint_least32);
+_TYPEDEF_T(int_least64);
+_TYPEDEF_T(uint_least64);
+_TYPEDEF_T(int_fast8);
+_TYPEDEF_T(uint_fast8);
+_TYPEDEF_T(int_fast16);
+_TYPEDEF_T(uint_fast16);
+_TYPEDEF_T(int_fast32);
+_TYPEDEF_T(uint_fast32);
+_TYPEDEF_T(int_fast64);
+_TYPEDEF_T(uint_fast64);
+_TYPEDEF_T(intptr);
+_TYPEDEF_T(uintptr);
+_TYPEDEF_T(size);
+_TYPEDEF_T(ptrdiff);
+_TYPEDEF_T(intmax);
+_TYPEDEF_T(uintmax);
 
-typedef struct atomic_uintptr {
+#undef ___TYPEDEF
-	isc_mutex_t m;
+#undef _TYPEDEF_S
-	uintptr_t   v;
+#undef _TYPEDEF_T
-} atomic_uintptr_t;
+#undef _TYPEDEF_O
-
-typedef struct atomic_bool_s {
-	isc_mutex_t m;
-	bool	    v;
-} atomic_bool;
 
 #define ATOMIC_VAR_INIT(arg)                             \
 	{                                                \

lib/isc/unix/include/isc/stdatomic.h

@@ -13,6 +13,10 @@
 
 #include <inttypes.h>
 #include <stdbool.h>
+#include <stddef.h>
+#if HAVE_UCHAR_H
+#include <uchar.h>
+#endif /* HAVE_UCHAR_H */
 
 #if !defined(__has_feature)
 #define __has_feature(x) 0
@@ -73,13 +77,48 @@ enum memory_order {
 
 typedef enum memory_order memory_order;
 
-typedef int_fast32_t  atomic_int_fast32_t;
+#ifndef HAVE_UCHAR_H
-typedef uint_fast32_t atomic_uint_fast32_t;
+typedef uint_least16_t char16_t;
-typedef int_fast64_t  atomic_int_fast64_t;
+typedef uint_least32_t char32_t;
-typedef uint_fast64_t atomic_uint_fast64_t;
+#endif /* HAVE_UCHAR_H */
-typedef bool	      atomic_bool;
 
-typedef uint_fast64_t atomic_uintptr_t;
+typedef bool		   atomic_bool;
+typedef char		   atomic_char;
+typedef signed char	   atomic_schar;
+typedef unsigned char	   atomic_uchar;
+typedef short		   atomic_short;
+typedef unsigned short	   atomic_ushort;
+typedef int		   atomic_int;
+typedef unsigned int	   atomic_uint;
+typedef long		   atomic_long;
+typedef unsigned long	   atomic_ulong;
+typedef long long	   atomic_llong;
+typedef unsigned long long atomic_ullong;
+typedef char16_t	   atomic_char16_t;
+typedef char32_t	   atomic_char32_t;
+typedef wchar_t		   atomic_wchar_t;
+typedef int_least8_t	   atomic_int_least8_t;
+typedef uint_least8_t	   atomic_uint_least8_t;
+typedef int_least16_t	   atomic_int_least16_t;
+typedef uint_least16_t	   atomic_uint_least16_t;
+typedef int_least32_t	   atomic_int_least32_t;
+typedef uint_least32_t	   atomic_uint_least32_t;
+typedef int_least64_t	   atomic_int_least64_t;
+typedef uint_least64_t	   atomic_uint_least64_t;
+typedef int_fast8_t	   atomic_int_fast8_t;
+typedef uint_fast8_t	   atomic_uint_fast8_t;
+typedef int_fast16_t	   atomic_int_fast16_t;
+typedef uint_fast16_t	   atomic_uint_fast16_t;
+typedef int_fast32_t	   atomic_int_fast32_t;
+typedef uint_fast32_t	   atomic_uint_fast32_t;
+typedef int_fast64_t	   atomic_int_fast64_t;
+typedef uint_fast64_t	   atomic_uint_fast64_t;
+typedef intptr_t	   atomic_intptr_t;
+typedef uintptr_t	   atomic_uintptr_t;
+typedef size_t		   atomic_size_t;
+typedef ptrdiff_t	   atomic_ptrdiff_t;
+typedef intmax_t	   atomic_intmax_t;
+typedef uintmax_t	   atomic_uintmax_t;
 
 #if defined(__CLANG_ATOMICS) /* __c11_atomic builtins */
 #define atomic_init(obj, desired)	 __c11_atomic_init(obj, desired)

lib/isc/win32/include/isc/stdatomic.h

@@ -15,6 +15,7 @@
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
+#include <uchar.h>
 #include <windows.h>
 
 #pragma warning(disable : 4133)
@@ -65,19 +66,58 @@ typedef enum memory_order memory_order;
  */
 
 typedef bool volatile atomic_bool;
+typedef char volatile atomic_char;
+typedef signed char volatile atomic_schar;
+typedef unsigned char volatile atomic_uchar;
+typedef short volatile atomic_short;
+typedef unsigned short volatile atomic_ushort;
+typedef int volatile atomic_int;
+typedef unsigned int volatile atomic_uint;
+typedef long volatile atomic_long;
+typedef unsigned long volatile atomic_ulong;
+typedef long long volatile atomic_llong;
+typedef unsigned long long volatile atomic_ullong;
+typedef char16_t volatile atomic_char16_t;
+typedef char32_t volatile atomic_char32_t;
+typedef wchar_t volatile atomic_wchar_t;
+typedef int_least8_t volatile atomic_int_least8_t;
+typedef uint_least8_t volatile atomic_uint_least8_t;
+typedef int_least16_t volatile atomic_int_least16_t;
+typedef uint_least16_t volatile atomic_uint_least16_t;
+typedef int_least32_t volatile atomic_int_least32_t;
+typedef uint_least32_t volatile atomic_uint_least32_t;
+typedef int_least64_t volatile atomic_int_least64_t;
+typedef uint_least64_t volatile atomic_uint_least64_t;
 typedef int_fast8_t volatile atomic_int_fast8_t;
 typedef uint_fast8_t volatile atomic_uint_fast8_t;
+typedef int_fast16_t volatile atomic_int_fast16_t;
+typedef uint_fast16_t volatile atomic_uint_fast16_t;
 typedef int_fast32_t volatile atomic_int_fast32_t;
 typedef uint_fast32_t volatile atomic_uint_fast32_t;
 typedef int_fast64_t volatile atomic_int_fast64_t;
 typedef uint_fast64_t volatile atomic_uint_fast64_t;
+typedef intptr_t volatile atomic_intptr_t;
 typedef uintptr_t volatile atomic_uintptr_t;
+typedef size_t volatile atomic_size_t;
+typedef ptrdiff_t volatile atomic_ptrdiff_t;
+typedef intmax_t volatile atomic_intmax_t;
+typedef uintmax_t volatile atomic_uintmax_t;
 
 #define atomic_init(obj, desired) (*(obj) = (desired))
 
 #define atomic_store_explicit8(obj, desired, order) \
 	(void)InterlockedExchange8((atomic_int_fast8_t *)obj, desired)
 
+#define atomic_store_explicit16(obj, desired, order)                           \
+	(order == memory_order_relaxed                                         \
+		 ? (void)InterlockedExchangeNoFence16((atomic_short *)obj,     \
+						      desired)                 \
+		 : (order == memory_order_acquire                              \
+			    ? (void)InterlockedExchangeAcquire16(              \
+				      (atomic_short *)obj, desired)            \
+			    : (void)InterlockedExchange16((atomic_short *)obj, \
+							  desired)))
+
 #define atomic_store_explicit32(obj, desired, order)                       \
 	(order == memory_order_relaxed                                     \
 		 ? (void)InterlockedExchangeNoFence(                       \
@@ -109,15 +149,19 @@ atomic_store_abort(void) {
 	ISC_UNREACHABLE();
 }
 
-#define atomic_store_explicit(obj, desired, order)                            \
+#define atomic_store_explicit(obj, desired, order)                             \
-	(sizeof(*(obj)) == 8                                                  \
+	(sizeof(*(obj)) == 8                                                   \
-		 ? atomic_store_explicit64(obj, desired, order)               \
+		 ? atomic_store_explicit64(obj, desired, order)                \
-		 : (sizeof(*(obj)) == 4                                       \
+		 : (sizeof(*(obj)) == 4                                        \
-			    ? atomic_store_explicit32(obj, desired, order)    \
+			    ? atomic_store_explicit32(obj, desired, order)     \
-			    : (sizeof(*(obj)) == 1                            \
+			    : (sizeof(*(obj)) == 2                             \
-				       ? atomic_store_explicit8(obj, desired, \
+				       ? atomic_store_explicit16(obj, desired, \
-								order)        \
+								 order)        \
-				       : atomic_store_abort())))
+				       : (sizeof(*(obj)) == 1                  \
+						  ? atomic_store_explicit8(    \
+							    obj, desired,      \
+							    order)             \
+						  : atomic_store_abort()))))
 
 #define atomic_store(obj, desired) \
 	atomic_store_explicit(obj, desired, memory_order_seq_cst)
@@ -125,6 +169,9 @@ atomic_store_abort(void) {
 #define atomic_load_explicit8(obj, order) \
 	(int8_t) InterlockedOr8((atomic_int_fast8_t *)obj, 0)
 
+#define atomic_load_explicit16(obj, order) \
+	(short)InterlockedOr16((atomic_short *)obj, 0)
+
 #define atomic_load_explicit32(obj, order)                                      \
 	(order == memory_order_relaxed                                          \
 		 ? (int32_t)InterlockedOrNoFence((atomic_int_fast32_t *)obj,    \
@@ -163,26 +210,35 @@ atomic_load_abort(void) {
 	ISC_UNREACHABLE();
 }
 
-#define atomic_load_explicit(obj, order)                                    \
+#define atomic_load_explicit(obj, order)                                       \
-	((sizeof(*(obj)) == 8                                               \
+	((sizeof(*(obj)) == 8                                                  \
-		  ? atomic_load_explicit64(obj, order)                      \
+		  ? atomic_load_explicit64(obj, order)                         \
-		  : (sizeof(*(obj) == 4)                                    \
+		  : (sizeof(*(obj) == 4)                                       \
-			     ? atomic_load_explicit32(obj, order)           \
+			     ? atomic_load_explicit32(obj, order)              \
-			     : (sizeof(*(obj) == 1)                         \
+			     : (sizeof(*(obj) == 2)                            \
-					? atomic_load_explicit8(obj, order) \
+					? atomic_load_explicit16(obj, order)   \
-					: atomic_load_abort()))) &          \
+					: (sizeof(*(obj) == 1)                 \
-	 (sizeof(*(obj)) == 8                                               \
+						   ? atomic_load_explicit8(    \
-		  ? 0xffffffffffffffffULL                                   \
+							     obj, order)       \
-		  : (sizeof(*(obj)) == 4                                    \
+						   : atomic_load_abort())))) & \
-			     ? 0xffffffffULL                                \
+	 (sizeof(*(obj)) == 8                                                  \
-			     : (sizeof(*(obj)) == 1 ? 0xffULL               \
+		  ? 0xffffffffffffffffULL                                      \
-						    : atomic_load_abort()))))
+		  : (sizeof(*(obj)) == 4                                       \
+			     ? 0xffffffffULL                                   \
+			     : (sizeof(*(obj)) == 2                            \
+					? 0xffffULL                            \
+					: (sizeof(*(obj)) == 1                 \
+						   ? 0xffULL                   \
+						   : atomic_load_abort())))))
 
 #define atomic_load(obj) atomic_load_explicit(obj, memory_order_seq_cst)
 
 #define atomic_fetch_add_explicit8(obj, arg, order) \
 	InterlockedExchangeAdd8((atomic_int_fast8_t *)obj, arg)
 
+#define atomic_fetch_add_explicit16(obj, arg, order) \
+	InterlockedExchangeAdd16((atomic_short *)obj, arg)
+
 #define atomic_fetch_add_explicit32(obj, arg, order)                         \
 	(order == memory_order_relaxed                                       \
 		 ? InterlockedExchangeAddNoFence((atomic_int_fast32_t *)obj, \
@@ -224,15 +280,18 @@ atomic_add_abort(void) {
 	ISC_UNREACHABLE();
 }
 
-#define atomic_fetch_add_explicit(obj, arg, order)                            \
+#define atomic_fetch_add_explicit(obj, arg, order)                              \
-	(sizeof(*(obj)) == 8                                                  \
+	(sizeof(*(obj)) == 8                                                    \
-		 ? atomic_fetch_add_explicit64(obj, arg, order)               \
+		 ? atomic_fetch_add_explicit64(obj, arg, order)                 \
-		 : (sizeof(*(obj)) == 4                                       \
+		 : (sizeof(*(obj)) == 4                                         \
-			    ? atomic_fetch_add_explicit32(obj, arg, order)    \
+			    ? atomic_fetch_add_explicit32(obj, arg, order)      \
-			    : (sizeof(*(obj)) == 1                            \
+			    : (sizeof(*(obj)) == 2                              \
-				       ? atomic_fetch_add_explicit8(obj, arg, \
+				       ? atomic_fetch_add_explicit16(obj, arg,  \
-								    order)    \
+								     order)     \
-				       : atomic_add_abort())))
+				       : (sizeof(*(obj)) == 1                   \
+						  ? atomic_fetch_add_explicit8( \
+							    obj, arg, order)    \
+						  : atomic_add_abort()))))
 
 #define atomic_fetch_add(obj, arg) \
 	atomic_fetch_add_explicit(obj, arg, memory_order_seq_cst)
@@ -246,6 +305,9 @@ atomic_add_abort(void) {
 #define atomic_fetch_and_explicit8(obj, arg, order) \
 	InterlockedAnd8((atomic_int_fast8_t *)obj, arg)
 
+#define atomic_fetch_and_explicit16(obj, arg, order) \
+	InterlockedAnd16((atomic_short *)obj, arg)
+
 #define atomic_fetch_and_explicit32(obj, arg, order)                         \
 	(order == memory_order_relaxed                                       \
 		 ? InterlockedAndNoFence((atomic_int_fast32_t *)obj, arg)    \
@@ -285,15 +347,18 @@ atomic_and_abort(void) {
 	ISC_UNREACHABLE();
 }
 
-#define atomic_fetch_and_explicit(obj, arg, order)                            \
+#define atomic_fetch_and_explicit(obj, arg, order)                              \
-	(sizeof(*(obj)) == 8                                                  \
+	(sizeof(*(obj)) == 8                                                    \
-		 ? atomic_fetch_and_explicit64(obj, arg, order)               \
+		 ? atomic_fetch_and_explicit64(obj, arg, order)                 \
-		 : (sizeof(*(obj)) == 4                                       \
+		 : (sizeof(*(obj)) == 4                                         \
-			    ? atomic_fetch_and_explicit32(obj, arg, order)    \
+			    ? atomic_fetch_and_explicit32(obj, arg, order)      \
-			    : (sizeof(*(obj)) == 1                            \
+			    : (sizeof(*(obj)) == 2                              \
-				       ? atomic_fetch_and_explicit8(obj, arg, \
+				       ? atomic_fetch_and_explicit16(obj, arg,  \
-								    order)    \
+								     order)     \
-				       : atomic_and_abort())))
+				       : (sizeof(*(obj)) == 1                   \
+						  ? atomic_fetch_and_explicit8( \
+							    obj, arg, order)    \
+						  : atomic_and_abort()))))
 
 #define atomic_fetch_and(obj, arg) \
 	atomic_fetch_and_explicit(obj, arg, memory_order_seq_cst)
@@ -301,6 +366,9 @@ atomic_and_abort(void) {
 #define atomic_fetch_or_explicit8(obj, arg, order) \
 	InterlockedOr8((atomic_int_fast8_t *)obj, arg)
 
+#define atomic_fetch_or_explicit16(obj, arg, order) \
+	InterlockedOr16((atomic_short *)obj, arg)
+
 #define atomic_fetch_or_explicit32(obj, arg, order)                            \
 	(order == memory_order_relaxed                                         \
 		 ? InterlockedOrNoFence((atomic_int_fast32_t *)obj, arg)       \
@@ -340,15 +408,18 @@ atomic_or_abort(void) {
 	ISC_UNREACHABLE();
 }
 
-#define atomic_fetch_or_explicit(obj, arg, order)                            \
+#define atomic_fetch_or_explicit(obj, arg, order)                              \
-	(sizeof(*(obj)) == 8                                                 \
+	(sizeof(*(obj)) == 8                                                   \
-		 ? atomic_fetch_or_explicit64(obj, arg, order)               \
+		 ? atomic_fetch_or_explicit64(obj, arg, order)                 \
-		 : (sizeof(*(obj)) == 4                                      \
+		 : (sizeof(*(obj)) == 4                                        \
-			    ? atomic_fetch_or_explicit32(obj, arg, order)    \
+			    ? atomic_fetch_or_explicit32(obj, arg, order)      \
-			    : (sizeof(*(obj)) == 1                           \
+			    : (sizeof(*(obj)) == 2                             \
-				       ? atomic_fetch_or_explicit8(obj, arg, \
+				       ? atomic_fetch_or_explicit16(obj, arg,  \
-								   order)    \
+								    order)     \
-				       : atomic_or_abort())))
+				       : (sizeof(*(obj)) == 1                  \
+						  ? atomic_fetch_or_explicit8( \
+							    obj, arg, order)   \
+						  : atomic_or_abort()))))
 
 #define atomic_fetch_or(obj, arg) \
 	atomic_fetch_or_explicit(obj, arg, memory_order_seq_cst)
@@ -372,6 +443,25 @@ atomic_compare_exchange_strong_explicit8(atomic_int_fast8_t *obj,
 	return (__r);
 }
 
+static inline bool
+atomic_compare_exchange_strong_explicit16(atomic_short *obj, short *expected,
+					  short desired, memory_order succ,
+					  memory_order fail) {
+	bool  __r;
+	short __v;
+
+	UNUSED(succ);
+	UNUSED(fail);
+
+	__v = InterlockedCompareExchange16((atomic_short *)obj, desired,
+					   *expected);
+	__r = (*(expected) == __v);
+	if (!__r) {
+		*(expected) = __v;
+	}
+	return (__r);
+}
+
 static inline bool
 atomic_compare_exchange_strong_explicit32(atomic_int_fast32_t *obj,
 					  int32_t *expected, int32_t desired,
@@ -455,19 +545,24 @@ atomic_compare_exchange_abort(void) {
 	ISC_UNREACHABLE();
 }
 
-#define atomic_compare_exchange_strong_explicit(obj, expected, desired, succ,      \
+#define atomic_compare_exchange_strong_explicit(obj, expected, desired, succ,                 \
-						fail)                              \
+						fail)                                         \
-	(sizeof(*(obj)) == 8                                                       \
+	(sizeof(*(obj)) == 8                                                                  \
-		 ? atomic_compare_exchange_strong_explicit64(                      \
+		 ? atomic_compare_exchange_strong_explicit64(                                 \
-			   obj, expected, desired, succ, fail)                     \
+			   obj, expected, desired, succ, fail)                                \
-		 : (sizeof(*(obj)) == 4                                            \
+		 : (sizeof(*(obj)) == 4                                                       \
-			    ? atomic_compare_exchange_strong_explicit32(           \
+			    ? atomic_compare_exchange_strong_explicit32(                      \
-				      obj, expected, desired, succ, fail)          \
+				      obj, expected, desired, succ, fail)                     \
-			    : (sizeof(*(obj)) == 1                                 \
+			    : (sizeof(*(obj)) == 2                                            \
-				       ? atomic_compare_exchange_strong_explicit8( \
+				       ? atomic_compare_exchange_strong_explicit16(           \
-						 obj, expected, desired, succ,     \
+						 obj, expected, desired, succ,                \
-						 fail)                             \
+						 fail)                                        \
-				       : atomic_compare_exchange_abort())))
+				       : (sizeof(*(obj)) == 1                                 \
+						  ? atomic_compare_exchange_strong_explicit8( \
+							    obj, expected,                    \
+							    desired, succ,                    \
+							    fail)                             \
+						  : atomic_compare_exchange_abort()))))
 
 #define atomic_compare_exchange_strong(obj, expected, desired)          \
 	atomic_compare_exchange_strong_explicit(obj, expected, desired, \
@@ -490,14 +585,17 @@ atomic_exchange_abort(void) {
 	ISC_UNREACHABLE();
 }
 
-#define atomic_exchange_explicit(obj, desired, order)                       \
+#define atomic_exchange_explicit(obj, desired, order)                        \
-	(sizeof(*(obj)) == 8                                                \
+	(sizeof(*(obj)) == 8                                                 \
-		 ? InterlockedExchange64(obj, desired)                      \
+		 ? InterlockedExchange64(obj, desired)                       \
-		 : (sizeof(*(obj)) == 4                                     \
+		 : (sizeof(*(obj)) == 4                                      \
-			    ? InterlockedExchange(obj, desired)             \
+			    ? InterlockedExchange(obj, desired)              \
-			    : (sizeof(*(obj)) == 1                          \
+			    : (sizeof(*(obj)) == 2                           \
-				       ? InterlockedExchange8(obj, desired) \
+				       ? InterlockedExchange16(obj, desired) \
-				       : atomic_exchange_abort())))
+				       : (sizeof(*(obj)) == 1                \
+						  ? InterlockedExchange8(    \
+							    obj, desired)    \
+						  : atomic_exchange_abort()))))
 
 #define atomic_exchange(obj, desired) \
 	atomic_exchange_explicit(obj, desired, memory_order_seq_cst)

util/copyrights

@@ -22,26 +22,26 @@
 ./bin/check/win32/checkzone.vcxproj.filters.in	X	2013,2015,2018,2019,2020
 ./bin/check/win32/checkzone.vcxproj.in		X	2013,2014,2015,2016,2017,2018,2019,2020
 ./bin/check/win32/checkzone.vcxproj.user	X	2013,2018,2019,2020
-./bin/confgen/ddns-confgen.c			C	2009,2011,2014,2016,2018,2019,2020
-./bin/confgen/ddns-confgen.rst			RST	2020
 ./bin/confgen/include/confgen/os.h		C	2009,2016,2018,2019,2020
 ./bin/confgen/keygen.c				C	2009,2012,2013,2014,2015,2016,2017,2018,2019,2020
 ./bin/confgen/keygen.h				C	2009,2016,2018,2019,2020
 ./bin/confgen/rndc-confgen.c			C	2001,2003,2004,2005,2007,2008,2009,2011,2013,2014,2016,2017,2018,2019,2020
 ./bin/confgen/rndc-confgen.rst			RST	2020
+./bin/confgen/tsig-keygen.c			C	2009,2011,2014,2016,2018,2019,2020
+./bin/confgen/tsig-keygen.rst			RST	2020
 ./bin/confgen/unix/os.c				C	2009,2016,2018,2019,2020
 ./bin/confgen/util.c				C	2009,2015,2016,2018,2019,2020
 ./bin/confgen/util.h				C	2009,2016,2018,2019,2020
 ./bin/confgen/win32/confgentool.vcxproj.filters.in	X	2013,2015,2018,2019,2020
 ./bin/confgen/win32/confgentool.vcxproj.in	X	2013,2015,2016,2017,2018,2019,2020
 ./bin/confgen/win32/confgentool.vcxproj.user	X	2013,2018,2019,2020
-./bin/confgen/win32/ddnsconfgen.vcxproj.filters.in	X	2013,2015,2018,2019,2020
-./bin/confgen/win32/ddnsconfgen.vcxproj.in	X	2013,2014,2015,2016,2017,2018,2019,2020
-./bin/confgen/win32/ddnsconfgen.vcxproj.user	X	2013,2018,2019,2020
 ./bin/confgen/win32/os.c			C	2009,2016,2018,2019,2020
 ./bin/confgen/win32/rndcconfgen.vcxproj.filters.in	X	2013,2015,2018,2019,2020
 ./bin/confgen/win32/rndcconfgen.vcxproj.in	X	2013,2015,2016,2017,2018,2019,2020
 ./bin/confgen/win32/rndcconfgen.vcxproj.user	X	2013,2018,2019,2020
+./bin/confgen/win32/tsigkeygen.vcxproj.filters.in	X	2013,2015,2018,2019,2020
+./bin/confgen/win32/tsigkeygen.vcxproj.in	X	2013,2014,2015,2016,2017,2018,2019,2020
+./bin/confgen/win32/tsigkeygen.vcxproj.user	X	2013,2018,2019,2020
 ./bin/delv/delv.c				C	2014,2015,2016,2017,2018,2019,2020
 ./bin/delv/delv.rst				RST	2020
 ./bin/delv/win32/delv.vcxproj.filters.in	X	2014,2015,2018,2019,2020
@@ -1208,6 +1208,7 @@
 ./doc/man/rndc-confgen.rst			RST	2020
 ./doc/man/rndc.conf.rst				RST	2020
 ./doc/man/rndc.rst				RST	2020
+./doc/man/tsig-keygen.rst			RST	2020
 ./doc/misc/cfg_test.c				C	2020
 ./doc/misc/delegation-only.zoneopt		X	2018,2019,2020
 ./doc/misc/format-options.pl			PERL	2001,2004,2007,2012,2016,2018,2019,2020

win32utils/Configure

@@ -40,8 +40,8 @@ my @projectlist = ("../bin/check/win32/checkconf.vcxproj",
                    "../bin/check/win32/checkzone.vcxproj.filters",
                    "../bin/confgen/win32/confgentool.vcxproj",
                    "../bin/confgen/win32/confgentool.vcxproj.filters",
-                   "../bin/confgen/win32/ddnsconfgen.vcxproj",
+                   "../bin/confgen/win32/tsigkeygen.vcxproj",
-                   "../bin/confgen/win32/ddnsconfgen.vcxproj.filters",
+                   "../bin/confgen/win32/tsigkeygen.vcxproj.filters",
                    "../bin/confgen/win32/rndcconfgen.vcxproj",
                    "../bin/confgen/win32/rndcconfgen.vcxproj.filters",
                    "../bin/delv/win32/delv.vcxproj",

win32utils/bind9.sln.in

@@ -92,7 +92,7 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "confgentool", "..\bin\confg
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "rndcconfgen", "..\bin\confgen\win32\rndcconfgen.vcxproj", "{1E2C1635-3093-4D59-80E7-4743AC10F22F}"
 EndProject
-Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ddnsconfgen", "..\bin\confgen\win32\ddnsconfgen.vcxproj", "{1EA4FC64-F33B-4A50-970A-EA052BBE9CF1}"
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "tsigkeygen", "..\bin\confgen\win32\tsigkeygen.vcxproj", "{1EA4FC64-F33B-4A50-970A-EA052BBE9CF1}"
 EndProject
 @IF PKCS11
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "pk11keygen", "..\bin\pkcs11\win32\pk11keygen.vcxproj", "{5042D371-0402-4FA3-A52A-769708694422}"