add missing decrements; set *versionp to NULL at start of closeversion

Merge branch '2077-negative-hook-point-value-in-filter-aaaa-c' into 'main'
Resolve "negative hook point value in filter-aaaa.c" Closes #2077 See merge request isc-projects/bind9!3985
2020-08-19 12:31:38 +10:00 · 2020-08-19 00:17:05 +00:00 · 2020-08-19 09:21:59 +10:00 · 2020-08-18 15:44:11 +00:00 · 2020-08-18 16:39:23 +02:00 · 2020-08-18 09:07:47 +00:00
122 changed files with 1620 additions and 934 deletions
@@ -1,6 +1,8 @@
 *.sln.in eol=crlf
 *.vcxproj.* eol=crlf

+/fuzz/dns_rdata_fromwire_text.in/input-* -text
+
 .gitignore			 export-ignore
 /conftools			 export-ignore
 /doc/design			 export-ignore
@@ -248,7 +248,7 @@ stages:
    - *setup_softhsm
  script:
    - cd bin/tests/system
-    - make -j${TEST_PARALLEL_JOBS:-1} -k check V=1 || make -j${TEST_PARALLEL_JOBS:-1} -k recheck V=1
+    - make -j${TEST_PARALLEL_JOBS:-1} -k check V=1
  after_script:
    - cat bin/tests/system/test-suite.log

@@ -709,6 +709,7 @@ gcc:tarball:
    - job: tarball-create
      artifacts: true
  only:
+    - schedules
    - tags

 system:gcc:tarball:
@@ -721,6 +722,7 @@ system:gcc:tarball:
    - job: gcc:tarball
      artifacts: true
  only:
+    - schedules
    - tags

 unit:gcc:tarball:
@@ -732,6 +734,7 @@ unit:gcc:tarball:
    - job: gcc:tarball
      artifacts: true
  only:
+    - schedules
    - tags

 # Jobs for regular GCC builds on Debian "sid" (i386)
@@ -1291,6 +1294,7 @@ abi-check:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
    BIND_BASELINE_VERSION: v9_17_3
  script:
    - *configure
@@ -1311,3 +1315,37 @@ abi-check:
  only:
    - main@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9
+
+gcov:
+  <<: *base_image
+  stage: build
+  needs:
+    - job: autoreconf
+      artifacts: true
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
+  script:
+    - *configure
+    - *setup_interfaces
+    - *setup_softhsm
+    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1 || true
+    - make -C bin/tests/system -j${TEST_PARALLEL_JOBS:-1} -k check V=1 || cat bin/tests/system/test-suite.log
+    # *.gcno and *.gcda files generated for shared library objects are created
+    # in directories in which gcovr is unable to process them properly
+    # (.../.libs/...).  Move such *.gcno and *.gcda files one level higher.
+    - find . -regex ".*/\.libs/.*\.\(gcda\|gcno\)" -execdir mv "{}" .. \;
+    # Help gcovr process the nasty tricks in lib/dns/code.h, where we include C
+    # source files from lib/dns/rdata/*/, using an even nastier trick.
+    - find lib/dns/rdata/* -name "*.c" -execdir cp -f "{}" ../../ \;
+    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc --exclude-directories libltdl --exclude-directories lib/samples --exclude 'lib/.*/tests/.*' --html-details -o coverage.html
+    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc --exclude-directories libltdl --exclude-directories lib/samples --exclude 'lib/.*/tests/.*' -o coverage.txt
+    - tail -n 3 coverage.txt
+  artifacts:
+    paths:
+      - coverage*.html
+  only:
+    - main@isc-projects/bind9
+    - /^v9_[1-9][0-9]$/@isc-projects/bind9
@@ -1,3 +1,25 @@
+5490.	[func]		Refactor the readline support to use pkg-config and
+			add support for editline library. [GL !3942]
+
+5489.	[bug]		Named failed to reject some invalid records resulting
+			in records that, after being printed, could not be
+			loaded or would result in DNSSEC validation failures
+			when re-read from zone files as the wire format
+			differed.  The covered records records are: CERT,
+			IPSECKEY, NSEC3, NSEC3PARAM, NXT, SIG, TLSA, WKS, and
+			X25. [GL !3953]
+
+5488.	[bug]		nta needed to have a weak reference on view to prevent
+			the view being deleted while nta tests are being
+			performed. [GL #2067]
+
+5487.	[cleanup]	Update managed keys log messages to be less confusing.
+			[GL #2027]
+
+5486.	[func]		Add 'rndc dnssec -checkds' command to tell named
+			that the DS record has been published in the parent.
+			[GL #1613]
+
 5485.	[placeholder]

 5484.	[func]		Expire the 0 TTL RRSet quickly rather using them for
@@ -33,6 +33,11 @@ LIBISC_CFLAGS +=					\
 	$(LIBXML2_CFLAGS)
 endif HAVE_LIBXML2

+if HAVE_READLINE
+LIBISC_CFLAGS +=					\
+	$(READLINE_CFLAGS)
+endif HAVE_READLINE
+
 LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la

 LIBDNS_CFLAGS = \
@@ -28,7 +28,7 @@ tsig-keygen, ddns-confgen - TSIG key generation tool

 Synopsis
 ~~~~~~~~
-:program:`tsig-keygen` [**-a** algorithm] [**-h**] [**-r** randomfile] [**-s** name]
+:program:`tsig-keygen` [**-a** algorithm] [**-h**] [**-r** randomfile] [name]

 :program:`ddns-confgen` [**-a** algorithm] [**-h**] [**-k** keyname] [**-q**] [**-r** randomfile] [**-s** name] [**-z** zone]

@@ -25,6 +25,10 @@ libdighost_la_SOURCES = \

 bin_PROGRAMS = dig host nslookup

-nslookup_LDADD =	\
-	$(LDADD)	\
-	$(READLINE_LIB)
+nslookup_LDADD =		\
+	$(LDADD)
+
+if HAVE_READLINE
+nslookup_LDADD +=		\
+	$(READLINE_LIBS)
+endif HAVE_READLINE
@@ -22,6 +22,7 @@
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
+#include <isc/readline.h>
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/util.h>
@@ -38,22 +39,6 @@

 #include "dighost.h"

-#if defined(HAVE_READLINE)
-#if defined(HAVE_EDIT_READLINE_READLINE_H)
-#include <edit/readline/readline.h>
-#if defined(HAVE_EDIT_READLINE_HISTORY_H)
-#include <edit/readline/history.h>
-#endif /* if defined(HAVE_EDIT_READLINE_HISTORY_H) */
-#elif defined(HAVE_EDITLINE_READLINE_H)
-#include <editline/readline.h>
-#elif defined(HAVE_READLINE_READLINE_H)
-#include <readline/readline.h>
-#if defined(HAVE_READLINE_HISTORY_H)
-#include <readline/history.h>
-#endif /* if defined(HAVE_READLINE_HISTORY_H) */
-#endif /* if defined(HAVE_EDIT_READLINE_READLINE_H) */
-#endif /* if defined(HAVE_READLINE) */
-
 static bool short_form = true, tcpmode = false, tcpmode_set = false,
 	    identify = false, stats = true, comments = true,
 	    section_question = true, section_answer = true,
@@ -848,38 +833,27 @@ do_next_command(char *input) {

 static void
 get_next_command(void) {
-	char *buf;
-	char *ptr;
+	char cmdlinebuf[COMMSIZE];
+	char *cmdline, *ptr = NULL;

-	fflush(stdout);
-	buf = isc_mem_allocate(mctx, COMMSIZE);
 	isc_app_block();
 	if (interactive) {
-#ifdef HAVE_READLINE
-		ptr = readline("> ");
-		if (ptr != NULL) {
+		cmdline = ptr = readline("> ");
+		if (ptr != NULL && *ptr != 0) {
 			add_history(ptr);
 		}
-#else  /* ifdef HAVE_READLINE */
-		fprintf(stderr, "> ");
-		fflush(stderr);
-		ptr = fgets(buf, COMMSIZE, stdin);
-#endif /* ifdef HAVE_READLINE */
 	} else {
-		ptr = fgets(buf, COMMSIZE, stdin);
+		cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
 	}
 	isc_app_unblock();
-	if (ptr == NULL) {
+	if (cmdline == NULL) {
 		in_use = false;
 	} else {
-		do_next_command(ptr);
+		do_next_command(cmdline);
 	}
-#ifdef HAVE_READLINE
-	if (interactive) {
+	if (ptr != NULL) {
 		free(ptr);
 	}
-#endif /* ifdef HAVE_READLINE */
-	isc_mem_free(mctx, buf);
 }

 ISC_NORETURN static void
@@ -68,7 +68,6 @@ DNSSEC-POLICY
  	max-zone-ttl duration;
  	parent-ds-ttl duration;
  	parent-propagation-delay duration;
-  	parent-registration-delay duration;
  	publish-safety duration;
  	retire-safety duration;
  	signatures-refresh duration;
@@ -89,6 +89,7 @@
 #include <dns/secalg.h>
 #include <dns/soa.h>
 #include <dns/stats.h>
+#include <dns/time.h>
 #include <dns/tkey.h>
 #include <dns/tsig.h>
 #include <dns/ttl.h>
@@ -14497,6 +14498,23 @@ cleanup:
 	return (result);
 }

+static inline bool
+argcheck(char *cmd, const char *full) {
+	size_t l;
+
+	if (cmd == NULL || cmd[0] != '-') {
+		return (false);
+	}
+
+	cmd++;
+	l = strlen(cmd);
+	if (l > strlen(full) || strncasecmp(cmd, full, l) != 0) {
+		return (false);
+	}
+
+	return (true);
+}
+
 isc_result_t
 named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 		    isc_buffer_t **text) {
@@ -14505,11 +14523,17 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	dns_kasp_t *kasp = NULL;
 	dns_dnsseckeylist_t keys;
 	dns_dnsseckey_t *key;
-	const char *ptr;
+	char *ptr;
+	const char *msg = NULL;
+	/* variables for -checkds */
+	bool checkds = false, dspublish = false, use_keyid = false;
+	dns_keytag_t keyid = 0;
+	uint8_t algorithm = 0;
 	/* variables for -status */
+	bool status = false;
 	char output[4096];
-	isc_stdtime_t now;
-	isc_time_t timenow;
+	isc_stdtime_t now, when;
+	isc_time_t timenow, timewhen;
 	const char *dir;

 	/* Skip the command name. */
@@ -14524,43 +14548,184 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 		return (ISC_R_UNEXPECTEDEND);
 	}

-	if (strcasecmp(ptr, "-status") != 0) {
-		return (DNS_R_SYNTAX);
-	}
+	/* Initialize current time and key list. */
+	TIME_NOW(&timenow);
+	now = isc_time_seconds(&timenow);
+	when = now;

 	ISC_LIST_INIT(keys);

+	if (strcasecmp(ptr, "-status") == 0) {
+		status = true;
+	} else if (strcasecmp(ptr, "-checkds") == 0) {
+		checkds = true;
+
+		/* Check for options */
+		for (;;) {
+			ptr = next_token(lex, text);
+			if (ptr == NULL) {
+				msg = "Bad format";
+				CHECK(ISC_R_UNEXPECTEDEND);
+			} else if (argcheck(ptr, "alg")) {
+				isc_consttextregion_t alg;
+				ptr = next_token(lex, text);
+				if (ptr == NULL) {
+					msg = "No key algorithm specified";
+					CHECK(ISC_R_UNEXPECTEDEND);
+				}
+				alg.base = ptr;
+				alg.length = strlen(alg.base);
+				result = dns_secalg_fromtext(
+					&algorithm, (isc_textregion_t *)&alg);
+				if (result != ISC_R_SUCCESS) {
+					msg = "Bad algorithm";
+					CHECK(DNS_R_SYNTAX);
+				}
+				continue;
+			} else if (argcheck(ptr, "key")) {
+				uint16_t id;
+				ptr = next_token(lex, text);
+				if (ptr == NULL) {
+					msg = "No key identifier specified";
+					CHECK(ISC_R_UNEXPECTEDEND);
+				}
+				CHECK(isc_parse_uint16(&id, ptr, 10));
+				keyid = (dns_keytag_t)id;
+				use_keyid = true;
+				continue;
+			} else if (argcheck(ptr, "when")) {
+				uint32_t tw;
+				ptr = next_token(lex, text);
+				if (ptr == NULL) {
+					msg = "No time specified";
+					CHECK(ISC_R_UNEXPECTEDEND);
+				}
+				CHECK(dns_time32_fromtext(ptr, &tw));
+				when = (isc_stdtime_t)tw;
+				continue;
+			} else if (ptr[0] == '-') {
+				msg = "Unknown option";
+				CHECK(DNS_R_SYNTAX);
+			} else {
+				/*
+				 * No arguments provided, so we must be
+				 * parsing "published|withdrawn".
+				 */
+				if (strcasecmp(ptr, "published") == 0) {
+					dspublish = true;
+				} else if (strcasecmp(ptr, "withdrawn") != 0) {
+					CHECK(DNS_R_SYNTAX);
+				}
+			}
+			break;
+		}
+
+		if (algorithm > 0 && !use_keyid) {
+			msg = "Key id is required when setting algorithm";
+			CHECK(DNS_R_SYNTAX);
+		}
+	} else {
+		CHECK(DNS_R_SYNTAX);
+	}
+
+	/* Get zone. */
 	CHECK(zone_from_args(server, lex, NULL, &zone, NULL, text, false));
 	if (zone == NULL) {
+		msg = "Zone not found";
 		CHECK(ISC_R_UNEXPECTEDEND);
 	}

+	/* Trailing garbage? */
+	ptr = next_token(lex, text);
+	if (ptr != NULL) {
+		msg = "Too many arguments";
+		CHECK(DNS_R_SYNTAX);
+	}
+
+	/* Get dnssec-policy. */
 	kasp = dns_zone_getkasp(zone);
 	if (kasp == NULL) {
-		CHECK(putstr(text, "zone does not have dnssec-policy"));
-		CHECK(putnull(text));
+		msg = "Zone does not have dnssec-policy";
 		goto cleanup;
 	}

-	/* -status */
-	TIME_NOW(&timenow);
-	now = isc_time_seconds(&timenow);
+	/* Get DNSSEC keys. */
 	dir = dns_zone_getkeydirectory(zone);
 	LOCK(&kasp->lock);
 	result = dns_dnssec_findmatchingkeys(dns_zone_getorigin(zone), dir, now,
 					     dns_zone_getmctx(zone), &keys);
 	UNLOCK(&kasp->lock);
-
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		goto cleanup;
 	}
-	LOCK(&kasp->lock);
-	dns_keymgr_status(kasp, &keys, now, &output[0], sizeof(output));
-	UNLOCK(&kasp->lock);
-	CHECK(putstr(text, output));
+
+	if (status) {
+		/*
+		 * Output the DNSSEC status of the key and signing policy.
+		 */
+		LOCK(&kasp->lock);
+		dns_keymgr_status(kasp, &keys, now, &output[0], sizeof(output));
+		UNLOCK(&kasp->lock);
+		CHECK(putstr(text, output));
+	} else if (checkds) {
+		/*
+		 * Mark DS record has been seen, so it may move to the
+		 * rumoured state.
+		 */
+		char whenbuf[80];
+		isc_time_set(&timewhen, when, 0);
+		isc_time_formattimestamp(&timewhen, whenbuf, sizeof(whenbuf));
+
+		LOCK(&kasp->lock);
+		if (use_keyid) {
+			result = dns_keymgr_checkds_id(kasp, &keys, dir, when,
+						       dspublish, keyid,
+						       (unsigned int)algorithm);
+		} else {
+			result = dns_keymgr_checkds(kasp, &keys, dir, when,
+						    dspublish);
+		}
+		UNLOCK(&kasp->lock);
+
+		switch (result) {
+		case ISC_R_SUCCESS:
+			if (use_keyid) {
+				char tagbuf[6];
+				snprintf(tagbuf, sizeof(tagbuf), "%u", keyid);
+				CHECK(putstr(text, "KSK "));
+				CHECK(putstr(text, tagbuf));
+				CHECK(putstr(text, ": "));
+			}
+			CHECK(putstr(text, "Marked DS as "));
+			if (dspublish) {
+				CHECK(putstr(text, "published "));
+			} else {
+				CHECK(putstr(text, "withdrawn "));
+			}
+			CHECK(putstr(text, "since "));
+			CHECK(putstr(text, whenbuf));
+			break;
+		case ISC_R_NOTFOUND:
+			CHECK(putstr(text, "No matching KSK found"));
+			break;
+		case ISC_R_FAILURE:
+			CHECK(putstr(text,
+				     "Error: multiple possible KSKs found, "
+				     "retry command with -key id"));
+			break;
+		default:
+			CHECK(putstr(text, "Error executing checkds command"));
+			break;
+		}
+	}
 	CHECK(putnull(text));

 cleanup:
+	if (msg != NULL) {
+		(void)putstr(text, msg);
+		(void)putnull(text);
+	}
+
 	while (!ISC_LIST_EMPTY(keys)) {
 		key = ISC_LIST_HEAD(keys);
 		ISC_LIST_UNLINK(keys, key, link);
@@ -14905,23 +15070,6 @@ cleanup:
 	return (result);
 }

-static inline bool
-argcheck(char *cmd, const char *full) {
-	size_t l;
-
-	if (cmd == NULL || cmd[0] != '-') {
-		return (false);
-	}
-
-	cmd++;
-	l = strlen(cmd);
-	if (l > strlen(full) || strncasecmp(cmd, full, l) != 0) {
-		return (false);
-	}
-
-	return (true);
-}
-
 isc_result_t
 named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 		 isc_buffer_t **text) {
@@ -18,8 +18,12 @@ LDADD =				\
 	$(LIBISCCFG_LIBS)	\
 	$(LIBIRS_LIBS)		\
 	$(LIBBIND9_LIBS)	\
-	$(READLINE_LIB)		\
 	$(GSSAPI_LIBS)		\
 	$(KRB5_LIBS)

+if HAVE_READLINE
+LDADD +=			\
+	$(READLINE_LIBS)
+endif
+
 bin_PROGRAMS = nsupdate
@@ -36,6 +36,7 @@
 #include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/random.h>
+#include <isc/readline.h>
 #include <isc/region.h>
 #include <isc/sockaddr.h>
 #include <isc/socket.h>
@@ -94,20 +95,6 @@

 #include <bind9/getaddresses.h>

-#if defined(HAVE_READLINE)
-#if defined(HAVE_EDIT_READLINE_READLINE_H)
-#include <edit/readline/readline.h>
-#if defined(HAVE_EDIT_READLINE_HISTORY_H)
-#include <edit/readline/history.h>
-#endif /* if defined(HAVE_EDIT_READLINE_HISTORY_H) */
-#elif defined(HAVE_EDITLINE_READLINE_H)
-#include <editline/readline.h>
-#else /* if defined(HAVE_EDIT_READLINE_READLINE_H) */
-#include <readline/history.h>
-#include <readline/readline.h>
-#endif /* if defined(HAVE_EDIT_READLINE_READLINE_H) */
-#endif /* if defined(HAVE_READLINE) */
-
 #define MAXCMD	     (128 * 1024)
 #define MAXWIRE	     (64 * 1024)
 #define PACKETSIZE   ((64 * 1024) - 1)
@@ -2290,20 +2277,14 @@ static uint16_t
 get_next_command(void) {
 	uint16_t result = STATUS_QUIT;
 	char cmdlinebuf[MAXCMD];
-	char *cmdline;
+	char *cmdline = NULL, *ptr = NULL;

 	isc_app_block();
 	if (interactive) {
-#ifdef HAVE_READLINE
-		cmdline = readline("> ");
-		if (cmdline != NULL) {
-			add_history(cmdline);
+		cmdline = ptr = readline("> ");
+		if (ptr != NULL && *ptr != 0) {
+			add_history(ptr);
 		}
-#else  /* ifdef HAVE_READLINE */
-		fprintf(stdout, "> ");
-		fflush(stdout);
-		cmdline = fgets(cmdlinebuf, MAXCMD, input);
-#endif /* ifdef HAVE_READLINE */
 	} else {
 		cmdline = fgets(cmdlinebuf, MAXCMD, input);
 	}
@@ -2319,11 +2300,10 @@ get_next_command(void) {
 		(void)nsu_strsep(&tmp, "\r\n");
 		result = do_next_command(cmdline);
 	}
-#ifdef HAVE_READLINE
-	if (interactive) {
-		free(cmdline);
+	if (ptr != NULL) {
+		free(ptr);
 	}
-#endif /* ifdef HAVE_READLINE */
+
 	return (result);
 }

@@ -169,7 +169,7 @@ install_hooks(ns_hooktable_t *hooktable, isc_mem_t *mctx,
 		.action_data = inst,
 	};

-	ns_hook_add(hooktable, mctx, -NS_QUERY_QCTX_INITIALIZED, &filter_init);
+	ns_hook_add(hooktable, mctx, NS_QUERY_QCTX_INITIALIZED, &filter_init);
 	ns_hook_add(hooktable, mctx, NS_QUERY_RESPOND_BEGIN, &filter_respbegin);
 	ns_hook_add(hooktable, mctx, NS_QUERY_RESPOND_ANY_FOUND,
 		    &filter_respanyfound);
@@ -108,6 +108,12 @@ command is one of the following:\n\
 		Add zone to given view. Requires allow-new-zones option.\n\
  delzone [-clean] zone [class [view]]\n\
 		Removes zone from given view.\n\
+  dnssec -checkds [-key id [-alg algorithm] [-when time] (published|withdrawn) zone [class [view]]\n\
+		Mark the DS record for the KSK of the given zone as seen\n\
+		in the parent.  If the zone has multiple KSKs, select a\n\
+		specific key by providing the keytag with -key id and\n\
+		optionally the key's algorithm with -alg algorithm.\n\
+		Requires the zone to have a dnssec-policy.\n\
  dnssec -status zone [class [view]]\n\
 		Show the DNSSEC signing state for the specified zone.\n\
 		Requires the zone to have a dnssec-policy.\n\
@@ -161,9 +161,21 @@ Currently supported commands are:

   See also ``rndc addzone`` and ``rndc modzone``.

-``dnssec`` [**-status** *zone* [*class* [*view*]]
-   Show the DNSSEC signing state for the specified zone.  Requires the
-   zone to have a "dnssec-policy".
+``dnssec`` ( **-status** | **-checkds** [**-key** *id* [**-alg** *algorithm*]] [**-when** *time*] ( *published* | *withdrawn* )) *zone* [*class* [*view*]]
+   This command allows you to interact with the "dnssec-policy" of a given
+   zone.
+
+   ``rndc dnssec -status`` show the DNSSEC signing state for the specified
+   zone.
+
+   ``rndc dnssec -checkds`` will let ``named`` know that the DS for the given
+   key has been seen published into or withdrawn from the parent.  This is
+   required in order to complete a KSK rollover.  If the ``-key id`` argument
+   is specified, look for the key with the given identifier, otherwise if there
+   is only one key acting as a KSK in the zone, assume the DS of that key (if
+   there are multiple keys with the same tag, use ``-alg algorithm`` to
+   select the correct algorithm).  The time that the DS has been published or
+   withdrawn is set to now, unless otherwise specified with the argument ``-when time``.

 ``dnstap`` ( **-reopen** | **-roll** [*number*] )
   This command closes and re-opens DNSTAP output files. ``rndc dnstap -reopen`` allows
@@ -24,7 +24,6 @@ dnssec-policy "test" {
 	max-zone-ttl 86400;
 	parent-ds-ttl 7200;
 	parent-propagation-delay PT1H;
-	parent-registration-delay P1D;
 	publish-safety PT3600S;
 	retire-safety PT3600S;
 	signatures-refresh P3D;
@@ -24,7 +24,6 @@ dnssec-policy "test" {
 	max-zone-ttl 86400;
 	parent-ds-ttl 7200;
 	parent-propagation-delay PT1H;
-	parent-registration-delay P1D;
 	publish-safety PT3600S;
 	retire-safety PT3600S;
 	signatures-refresh P3D;
@@ -24,5 +24,5 @@ rm -f ns*/managed-keys.bind
 rm -f ns*/*.mkeys
 rm -f ns*/zones ns*/*.db.infile
 rm -f *.created published.test* retired.test*
-rm -f rndc.dnssec.status.out.*
+rm -f rndc.dnssec.*.out.*
 rm -f python.out.*
@@ -45,6 +45,27 @@ zone "default.kasp" {
 	dnssec-policy "default";
 };

+/* checkds: Zone with one KSK. */
+zone "checkds-ksk.kasp" {
+	type primary;
+	file "checkds-ksk.kasp.db";
+	dnssec-policy "checkds-ksk";
+};
+
+/* checkds: Zone with two KSKs. */
+zone "checkds-doubleksk.kasp" {
+	type primary;
+	file "checkds-doubleksk.kasp.db";
+	dnssec-policy "checkds-doubleksk";
+};
+
+/* checkds: Zone with one CSK. */
+zone "checkds-csk.kasp" {
+	type primary;
+	file "checkds-csk.kasp.db";
+	dnssec-policy "checkds-csk";
+};
+
 /* Key lifetime unlimited. */
 zone "unlimited.kasp" {
 	type primary;
@@ -36,7 +36,6 @@ dnssec-policy "enable-dnssec" {
 	publish-safety PT5M;

 	parent-propagation-delay 1h;
-	parent-registration-delay P1D;
 	parent-ds-ttl 2h;

 	keys {
@@ -82,7 +81,6 @@ dnssec-policy "ksk-doubleksk" {
 	max-zone-ttl 1d;

 	parent-ds-ttl 3600;
-	parent-registration-delay P1D;
 	parent-propagation-delay PT1H;
 };

@@ -104,7 +102,6 @@ dnssec-policy "csk-roll" {
 	max-zone-ttl P1D;

 	parent-ds-ttl 1h;
-	parent-registration-delay 1d;
 	parent-propagation-delay 1h;
 };

@@ -126,6 +123,5 @@ dnssec-policy "csk-roll2" {
 	max-zone-ttl 1d;

 	parent-ds-ttl PT1H;
-	parent-registration-delay P1W;
-	parent-propagation-delay PT1H;
+	parent-propagation-delay P1W;
 };
@@ -76,3 +76,30 @@ dnssec-policy "ecdsa384" {
 		zsk key-directory lifetime P1Y  algorithm 14 384;
 	};
 };
+
+dnssec-policy "checkds-ksk" {
+	dnskey-ttl 303;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm 13;
+		zsk key-directory lifetime unlimited algorithm 13;
+	};
+};
+
+dnssec-policy "checkds-doubleksk" {
+	dnskey-ttl 303;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm 13;
+		ksk key-directory lifetime unlimited algorithm 13;
+		zsk key-directory lifetime unlimited algorithm 13;
+	};
+};
+
+dnssec-policy "checkds-csk" {
+	dnskey-ttl 303;
+
+	keys {
+		csk key-directory lifetime unlimited algorithm 13;
+	};
+};
@@ -53,7 +53,7 @@ U="UNRETENTIVE"
 for zn in default rsasha1 dnssec-keygen some-keys legacy-keys pregenerated \
 	  rumoured rsasha1-nsec3 rsasha256 rsasha512 ecdsa256 ecdsa384 \
 	  dynamic dynamic-inline-signing inline-signing \
-	  inherit unlimited
+	  checkds-ksk checkds-doubleksk checkds-csk inherit unlimited
 do
 	setup "${zn}.kasp"
 	cp template.db.in "$zonefile"
@@ -221,23 +221,22 @@ setup step3.enable-dnssec.autosign
 # Step 4:
 # The DS has been submitted long enough ago to become OMNIPRESENT.
 setup step4.enable-dnssec.autosign
-# DS TTL:                    1 day (86400 seconds)
-# parent-registration-delay: 1 day (86400 seconds)
+# DS TTL:                    2 hour (7200 seconds)
 # parent-propagation-delay:  1 hour (3600 seconds)
 # retire-safety:             20 minutes (1200 seconds)
-# Total aditional time:      98400 seconds
-# 44700 + 98400 = 143100
-TpubN="now-143100s"
-# 43800 + 98400 = 142200
-TcotN="now-142200s"
-TsbmN="now-98400s"
+# Total aditional time:      12000 seconds
+# 44700 + 12000 = 56700
+TpubN="now-56700s"
+# 43800 + 12000 = 55800
+TcotN="now-55800s"
+TsbmN="now-12000s"
 keytimes="-P ${TpubN} -P sync ${TsbmN} -A ${TpubN}"
 CSK=$($KEYGEN -k enable-dnssec -l policies/autosign.conf $keytimes $zone 2> keygen.out.$zone.1)
 $SETTIME -s -g $O -k $O $TcotN -r $O $TcotN -d $R $TsbmN -z $O $TsbmN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone 13 "$CSK" >> "$infile"
 $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
-setup step3.enable-dnssec.autosign
+setup step4.enable-dnssec.autosign

 #
 # The zones at zsk-prepub.autosign represent the various steps of a ZSK
@@ -547,7 +546,7 @@ setup step3.ksk-doubleksk.autosign
 #                                   Tnow
 #
 # Lksk:           60d
-# Dreg:           1d
+# Dreg:           N/A
 # DprpP:          1h
 # TTLds:          1h
 # retire-safety:  2d
@@ -557,23 +556,23 @@ setup step3.ksk-doubleksk.autosign
 # publish-safety: 1d
 # IpubC:          27h
 #
-# Tact(N)    = Tnow + Dreg - Lksk = now + 1d - 60d = now - 59d
-# Tret(N)    = Tnow + Dreg = now + 1d
-# Trem(N)    = Tnow + Dreg + Iret = now + 1d + 50h = now + 74h
+# Tact(N)    = Tnow + Lksk = now - 60d = now - 60d
+# Tret(N)    = now
+# Trem(N)    = Tnow + Iret = now + 50h
 # Tpub(N+1)  = Tnow - IpubC = now - 27h
 # Tsbm(N+1)  = now
 # Tact(N+1)  = Tret(N)
-# Tret(N+1)  = Tnow + Dreg + Lksk = now + 1d + 60d = now + 61d
-# Trem(N+1)  = Tnow + Dreg + Lksk + Iret = now + 61d + 50h
-#            = now + 1464h + 50h = 1514h
-TactN="now-59d"
-TretN="now+1d"
-TremN="now+74h"
+# Tret(N+1)  = Tnow + Lksk = now + 60d
+# Trem(N+1)  = Tnow + Lksk + Iret = now + 60d + 50h
+#            = now + 1440h + 50h = 1490h
+TactN="now-60d"
+TretN="now"
+TremN="now+50h"
 TpubN1="now-27h"
 TsbmN1="now"
 TactN1="${TretN}"
-TretN1="now+61d"
-TremN1="now+1514h"
+TretN1="now+60d"
+TremN1="now+1490h"
 ksktimes="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}  -D ${TremN}"
 newtimes="-P ${TpubN1} -A ${TactN1} -P sync ${TsbmN1} -I ${TretN1} -D ${TremN1}"
 zsktimes="-P ${TactN}  -A ${TactN}"
@@ -597,7 +596,7 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer
 setup step4.ksk-doubleksk.autosign
 # According to RFC 7583:
 #
-# Tret(N)   = Tsbm(N+1) + Dreg
+# Tret(N)   = Tsbm(N+1)
 # Tdea(N)   = Tret(N) + Iret
 # Tact(N+1) = Tret(N)
 #
@@ -613,24 +612,24 @@ setup step4.ksk-doubleksk.autosign
 #                                                             Tnow
 #
 # Lksk: 60d
-# Dreg: 1d
+# Dreg: N/A
 # Iret: 50h
 #
 # Tact(N)   = Tnow - Lksk - Iret = now - 60d - 50h
 #           = now - 1440h - 50h = now - 1490h
 # Tret(N)   = Tnow - Iret = now - 50h
 # Trem(N)   = Tnow
-# Tpub(N+1) = Tnow - Iret - Dreg - IpubC = now - 50h - 1d - 27h
-#           = now - 101h
-# Tsbm(N+1) = Tnow - Iret - Dreg = now - 50h - 1d = now - 74h
+# Tpub(N+1) = Tnow - Iret - IpubC = now - 50h - 27h
+#           = now - 77h
+# Tsbm(N+1) = Tnow - Iret = now - 50h
 # Tact(N+1) = Tret(N)
 # Tret(N+1) = Tnow + Lksk - Iret = now + 60d - 50h = now + 1390h
 # Trem(N+1) = Tnow + Lksk = now + 60d
 TactN="now-1490h"
 TretN="now-50h"
 TremN="now"
-TpubN1="now-101h"
-TsbmN1="now-74h"
+TpubN1="now-77h"
+TsbmN1="now-50h"
 TactN1="${TretN}"
 TretN1="now+1390h"
 TremN1="now+60d"
@@ -657,21 +656,21 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer
 setup step5.ksk-doubleksk.autosign
 # Subtract DNSKEY TTL from all the times (2h).
 # Tact(N)   = now - 1490h - 2h = now - 1492h
-# Tret(N)   = now - 52h - 2h = now - 52h
+# Tret(N)   = now - 50h - 2h = now - 52h
 # Trem(N)   = now - 2h
-# Tpub(N+1) = now - 101h - 2h = now - 103h
-# Tsbm(N+1) = now - 74h - 2h = now - 76h
+# Tpub(N+1) = now - 77h - 2h = now - 79h
+# Tsbm(N+1) = now - 50h - 2h = now - 52h
 # Tact(N+1) = Tret(N)
 # Tret(N+1) = now + 1390h - 2h = now + 1388h
 # Trem(N+1) = now + 60d + 2h = now + 1442h
 TactN="now-1492h"
 TretN="now-52h"
 TremN="now-2h"
-TpubN1="now-103h"
-TsbmN1="now-76h"
+TpubN1="now-79h"
+TsbmN1="now-52h"
 TactN1="${TretN}"
 TretN1="now+1388h"
-TremN1="now+1438h"
+TremN1="now+1442h"
 ksktimes="-P ${TactN}  -A ${TactN} -P sync ${TactN}  -I ${TretN}  -D ${TremN}"
 newtimes="-P ${TpubN1} -A ${TretN} -P sync ${TsbmN1} -I ${TretN1} -D ${TremN1}"
 zsktimes="-P ${TactN}  -A ${TactN}"
@@ -694,11 +693,6 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer
 # The zones at csk-roll.autosign represent the various steps of a CSK rollover
 # (which is essentially a ZSK Pre-Publication / KSK Double-KSK rollover).
 #
-#
-# The activation time for zone signing (ZSK) is different than for chain of
-# trust validation (KSK). Therefor, for zone signing we use TactZ and TretZ
-# instead of Tact and Tret.
-#

 # Step 1:
 # Introduce the first key. This will immediately be active.
@@ -715,28 +709,25 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > si
 # It is time to introduce the new CSK.
 setup step2.csk-roll.autosign
 # According to RFC 7583:
-# KSK: Tpub(N+1) <= Tact(N) + Lksk - Dreg - IpubC
-# ZSK: Tpub(N+1) <= TactZ(N) + Lzsk - Ipub
+# KSK: Tpub(N+1) <= Tact(N) + Lksk - IpubC
+# ZSK: Tpub(N+1) <= Tact(N) + Lzsk - Ipub
 # IpubC = DprpC + TTLkey (+publish-safety)
 # Ipub  = IpubC
 # Lcsk = Lksk = Lzsk
 #
 # Lcsk:           6mo (186d, 4464h)
-# Dreg:           1d
+# Dreg:           N/A
 # DprpC:          1h
 # TTLkey:         1h
 # publish-safety: 1h
 # Ipub:           3h
 #
-# Tact(N)  = Tnow - Lcsk + Ipub + Dreg = now - 186d + 3h + 1d
-#          = now - 4464h + 3h + 24h = now - 4437h
-# TactZ(N) = Tnow - Lcsk + IpubC = now - 186d + 3h
-#          = now - 4464h + 3h = now - 4461h
-TactN="now-4437h"
-TactZN="now-4461h"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN}"
+# Tact(N) = Tnow - Lcsk + Ipub = now - 186d + 3h
+#         = now - 4464h + 3h = now - 4461h
+TactN="now-4461h"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN}"
 CSK=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
-$SETTIME -s -g $O -k $O $TactZN -r $O $TactZN -d $O $TactN -z $O $TactZN "$CSK" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone 13 "$CSK" >> "$infile"
 $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
@@ -747,15 +738,15 @@ setup step3.csk-roll.autosign
 # According to RFC 7583:
 #
 # Tsbm(N+1) >= Trdy(N+1)
-# KSK: Tact(N+1)  = Tsbm(N+1) + Dreg
-# ZSK: TactZ(N+1) = Tpub(N+1) + Ipub = Tsbm(N+1)
+# KSK: Tact(N+1) = Tsbm(N+1)
+# ZSK: Tact(N+1) = Tpub(N+1) + Ipub = Tsbm(N+1)
 # KSK: Iret  = DprpP + TTLds (+retire-safety)
 # ZSK: IretZ = Dsgn + Dprp + TTLsig (+retire-safety)
 #
 # Lcsk:           186d
 # Dprp:           1h
 # DprpP:          1h
-# Dreg:           1d
+# Dreg:           N/A
 # Dsgn:           25d
 # TTLds:          1h
 # TTLsig:         1d
@@ -764,37 +755,29 @@ setup step3.csk-roll.autosign
 # IretZ:          26d3h
 # Ipub:           3h
 #
-# TactZ(N)   = Tnow - Lcsk = now - 186d
-# TretZ(N)   = now
-# Tact(N)    = Tnow + Dreg - Lcsk = now + 1d - 186d = now - 185d
-# Tret(N)    = Tnow + Dreg = now + 1d
-# Trem(N)    = Tnow + IretZ = now + 26d3h = now + 627h
-# Tpub(N+1)  = Tnow - Ipub = now - 3h
-# Tsbm(N+1)  = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = Tnow + Lcsk = now + 186d
-# Tact(N+1)  = Tret(N)
-# Tret(N+1)  = Tnow + Dreg + Lcsk = now + 1d + 186d = now + 187d
-# Trem(N+1)  = Tnow + Lcsk + IretZ = now + 186d + 26d3h =
-#            = now + 5091h
-TactZN="now-186d"
-TretZN="now"
-TactN="now-185d"
-TretN="now+1d"
+# Tact(N)   = Tnow - Lcsk = now - 186d
+# Tret(N)   = now
+# Trem(N)   = Tnow + IretZ = now + 26d3h = now + 627h
+# Tpub(N+1) = Tnow - Ipub = now - 3h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = Tnow + Lcsk = now + 186d = now + 186d
+# Trem(N+1) = Tnow + Lcsk + IretZ = now + 186d + 26d3h =
+#           = now + 5091h
+TactN="now-186d"
+TretN="now"
 TremN="now+627h"
 TpubN1="now-3h"
 TsbmN1="now"
-TactZN1="${TsbmN1}"
-TretZN1="now+186d"
 TactN1="${TretN}"
-TretN1="now+187d"
+TretN1="now+186d"
 TremN1="now+5091h"
-csktimes="-P ${TactN}  -P sync ${TactZN} -A ${TactZN}  -I ${TretZN}  -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+csktimes="-P ${TactN}  -P sync ${TactN}  -A ${TactN}  -I ${TretN}  -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
 CSK1=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
 CSK2=$($KEYGEN -k csk-roll -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN  -r $O $TactZN -d $O $TactN  -z $O $TactZN "$CSK1" > settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $R $TpubN1  -r $R $TpubN1 -d $H $TpubN1 -z $H $TpubN1 "$CSK2" > settime.out.$zone.2 2>&1
+$SETTIME -s -g $H -k $O $TactN  -r $O $TactN  -d $O $TactN  -z $O $TactN  "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $R $TpubN1 -r $R $TpubN1 -d $H $TpubN1 -z $H $TpubN1 "$CSK2" > settime.out.$zone.2 2>&1
 # Set key rollover relationship.
 key_successor $CSK1 $CSK2
 # Sign zone.
@@ -806,50 +789,40 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > si
 # Step 4:
 # Some time later all the ZRRSIG records should be from the new CSK, and the
 # DS should be swapped.  The ZRRSIG records are all replaced after IretZ
-# (which is 26d3h).  The DS is swapped after Dreg + Iret (which is 1d4h).
+# (which is 26d3h).  The DS is swapped after Iret (which is 4h).
 # In other words, the DS is swapped before all zone signatures are replaced.
 setup step4.csk-roll.autosign
 # According to RFC 7583:
-# Trem(N)    = TretZ(N) + IretZ
-# Tnow       = Tsbm(N+1) + Dreg + Iret
+# Trem(N)    = Tret(N) - Iret + IretZ
+# Tnow       = Tsbm(N+1) + Iret
 #
 # Lcsk:   186d
 # Iret:   4h
 # IretZ:  26d3h
 #
-# TactZ(N)   = Tnow - Iret - Dreg - Lcsk = now - 4h - 24h - 4464h
-#            = now - 4492h
-# TretZ(N)   = Tnow - Iret - Dreg = now - 4h - 1d = now - 28h
-# Tact(N)    = Tnow - Iret - Lcsk = now - 4h - 186d = now - 4468h
-# Tret(N)    = Tnow - Iret = now - 4h = now - 4h
-# Trem(N)    = Tnow - Iret - Dreg + IretZ = now - 4h - 1d + 26d3h
-#            = now + 24d23h = now + 599h
-# Tpub(N+1)  = Tnow - Iret - Dreg - IpubC = now - 4h - 1d - 3h = now - 31h
-# Tsbm(N+1)  = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = Tnow - Iret - Dreg + Lcsk = now - 4h - 1d + 186d
-#            = now + 4436h
-# Tact(N+1)  = Tret(N)
-# Tret(N+1)  = Tnow - Iret + Lcsk = now + 6mo - 4h = now + 4460h
-# Trem(N+1)  = Tnow - Iret - Dreg + Lcsk + IretZ = now - 4h - 1d + 186d + 26d3h
-#	     = now + 5063h
-TactZN="now-4492h"
-TretZN="now-28h"
+# Tact(N)   = Tnow - Iret - Lcsk = now - 4h - 186d = now - 4468h
+# Tret(N)   = Tnow - Iret = now - 4h = now - 4h
+# Trem(N)   = Tnow - Iret + IretZ = now - 4h + 26d3h
+#           = now + 623h
+# Tpub(N+1) = Tnow - Iret - IpubC = now - 4h - 3h = now - 7h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = Tnow - Iret + Lcsk = now - 4h + 186d = now + 4460h
+# Trem(N+1) = Tnow - Iret + Lcsk + IretZ = now - 4h + 186d + 26d3h
+#	    = now + 5087h
 TactN="now-4468h"
 TretN="now-4h"
-TremN="now+599h"
-TpubN1="now-31h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+4436h"
+TremN="now+623h"
+TpubN1="now-7h"
+TsbmN1="${TretN}"
 TactN1="${TretN}"
 TretN1="now+4460h"
-TremN1="now+5063h"
-csktimes="-P ${TactN}  -P sync ${TactZN} -A ${TactZN}  -I ${TretZN}  -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TremN1="now+5087h"
+csktimes="-P ${TactN}  -P sync ${TactN}  -A ${TactN}  -I ${TretN}  -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
 CSK1=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
 CSK2=$($KEYGEN -k csk-roll -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $O $TactZN -d $U $TsbmN1 -z $U $TsbmN1 "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $H -k $O $TactN  -r $O $TactN  -d $U $TsbmN1 -z $U $TsbmN1 "$CSK1" > settime.out.$zone.1 2>&1
 $SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $R $TsbmN1 -z $R $TsbmN1 "$CSK2" > settime.out.$zone.2 2>&1
 # Set key rollover relationship.
 key_successor $CSK1 $CSK2
@@ -864,36 +837,28 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > si
 # At this time these have all become hidden.
 setup step5.csk-roll.autosign
 # Subtract DNSKEY TTL plus zone propagation delay from all the times (2h).
-# TactZ(N)   = now - 4492h - 2h = now - 4494h
-# TretZ(N)   = now - 28h - 2h = now - 30h
-# Tact(N)    = now - 4468h - 2h = now - 4470h
-# Tret(N)    = now - 4h - 2h = now - 6h
-# Trem(N)    = now + 599h - 2h = now + 597h
-# Tpub(N+1)  = now - 31h - 2h = now - 33h
-# Tsbm(N+1)  = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = now + 4436h - 2h = now + 4434h
-# Tact(N+1)  = Tret(N)
-# Tret(N+1)  = now + 4460h - 2h = now + 4458h
-# Trem(N+1)  = now + 5063h - 2h = now + 5061h
-TactZN="now-4494h"
-TretZN="now-30h"
+# Tact(N)   = now - 4468h - 2h = now - 4470h
+# Tret(N)   = now - 4h - 2h = now - 6h
+# Trem(N)   = now + 623h - 2h = now + 621h
+# Tpub(N+1) = now - 7h - 2h = now - 9h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = now + 4460h - 2h = now + 4458h
+# Trem(N+1) = now + 5087h - 2h = now + 5085h
 TactN="now-4470h"
 TretN="now-6h"
-TremN="now+597h"
-TpubN1="now-33h"
-TsbmN1="now-30h"
-TactZN1="${TsbmN1}"
-TretZN1="now+4434h"
+TremN="now+621h"
+TpubN1="now-9h"
+TsbmN1="${TretN}"
 TactN1="${TretN}"
 TretN1="now+4458h"
-TremN1="now+5061h"
-csktimes="-P ${TactN}  -P sync ${TactZN} -A ${TactZN}  -I ${TretZN}  -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TremN1="now+5085h"
+csktimes="-P ${TactN}  -P sync ${TactN}  -A ${TactN}  -I ${TretN}  -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
 CSK1=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
 CSK2=$($KEYGEN -k csk-roll -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $U now-2h  -d $H now-2h -z $U $TactZN1 "$CSK1" > settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $O now-2h -z $R $TactZN1 "$CSK2" > settime.out.$zone.2 2>&1
+$SETTIME -s -g $H -k $O $TactN  -r $U now-2h  -d $H now-2h -z $U $TactN1 "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $O now-2h -z $R $TactN1 "$CSK2" > settime.out.$zone.2 2>&1
 # Set key rollover relationship.
 key_successor $CSK1 $CSK2
 # Sign zone.
@@ -907,45 +872,35 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > si
 # removed from the zone.
 setup step6.csk-roll.autosign
 # According to RFC 7583:
-# Trem(N) = TretZ(N) + IretZ
-# TretZ(N) = TactZ(N) + Lcsk
+# Trem(N) = Tret(N) + IretZ
+# Tret(N) = Tact(N) + Lcsk
 #
 # Lcsk:   186d
 # Iret:   4h
 # IretZ:  26d3h
 #
-# TactZ(N)   = Tnow - IretZ - Lcsk = now - 627h - 186d
-#            = now - 627h - 4464h = now - 5091h
-# TretZ(N)   = Tnow - IretZ = now - 627h
-# Tact(N)    = Tnow - IretZ - Lcsk + Dreg = now - 627h - 186d + 1d =
-#              now - 627h - 4464h + 24h = now - 5067h
-# Tret(N)    = Tnow - IretZ + Dreg = now - 627h + 24h
-#            = Tnow - 603h
-# Trem(N)    = Tnow
-# Tpub(N+1)  = Tnow - IretZ - Ipub = now - 627h - 3h = now - 630h
-# Tsbm(N+1)  = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = Tnow - IretZ + Lcsk = now - 627h + 186d = now + 3837h
-# Tact(N+1)  = Tret(N)
-# Tret(N+1)  = Tnow - Iret + Lcsk = now - 4h + 186d = now + 4460h
-# Trem(N+1)  = Tnow + Lcsk = now + 186d
-TactZN="now-5091h"
-TretZN="now-627h"
-TactN="now-5067h"
-TretN="now-603h"
+# Tact(N)   = Tnow - IretZ - Lcsk = now - 627h - 186d
+#           = now - 627h - 4464h = now - 5091h
+# Tret(N)   = Tnow - IretZ = now - 627h
+# Trem(N)   = Tnow
+# Tpub(N+1) = Tnow - IretZ - Ipub = now - 627h - 3h = now - 630h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = Tnow - IretZ + Lcsk = now - 627h + 186d = now + 3837h
+# Trem(N+1) = Tnow + Lcsk = now + 186d
+TactN="now-5091h"
+TretN="now-627h"
 TremN="now"
 TpubN1="now-630h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+3837h"
+TsbmN1="${TretN}"
 TactN1="${TretN}"
-TretN1="now+4460h"
+TretN1="now+3837h"
 TremN1="now+186d"
-csktimes="-P ${TactN}  -P sync ${TactZN} -A ${TactZN}  -I ${TretZN}  -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+csktimes="-P ${TactN}  -P sync ${TactN}  -A ${TactN}  -I ${TretN}  -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
 CSK1=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
 CSK2=$($KEYGEN -k csk-roll -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $H $TremN  -d $H $TremN  -z $U $TsbmN1 "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $H -k $O $TactN  -r $H $TremN  -d $H $TremN  -z $U $TsbmN1 "$CSK1" > settime.out.$zone.1 2>&1
 $SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $O $TremN  -z $R $TsbmN1 "$CSK2" > settime.out.$zone.2 2>&1
 # Set key rollover relationship.
 key_successor $CSK1 $CSK2
@@ -959,36 +914,28 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > si
 # Some time later the predecessor DNSKEY enters the HIDDEN state.
 setup step7.csk-roll.autosign
 # Subtract DNSKEY TTL plus zone propagation delay from all the times (2h).
-# TactZ(N) = now - 5091h - 2h = now - 5093h
-# TretZ(N) = now - 627h - 2h  = now - 629h
-# Tact(N)  = now - 5067h - 2h = now - 5069h
-# Tret(N)  = now - 603h - 2h  = now - 605h
+# Tact(N) = now - 5091h - 2h = now - 5093h
+# Tret(N) = now - 627h - 2h  = now - 629h
 # Trem(N) = now - 2h
 # Tpub(N+1) = now - 630h - 2h = now - 632h
-# Tsbm(N+1) = now - 627h - 2h = now - 629h
-# TactZ(N+1) = Tsbm(N+1)
-# TretZ(N+1) = now + 3837h - 2h = now + 3835h
+# Tsbm(N+1) = Tret(N)
 # Tact(N+1) = Tret(N)
-# Tret(N+1) = now + 4460h - 2h = now + 4458h
+# Tret(N+1) = now + 3837h - 2h = now + 3835h
 # Trem(N+1) = now + 186d - 2h = now + 4462h
-TactZN="now-5093h"
-TretZN="now-629h"
-TactN="now-5069h"
-TretN="now-605h"
+TactN="now-5093h"
+TretN="now-629h"
 TremN="now-2h"
 TpubN1="now-632h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+3835h"
+TsbmN1="${TretN}"
 TactN1="${TretN}"
-TretN1="now+4458h"
+TretN1="now+3835h"
 TremN1="now+4462h"
-csktimes="-P ${TactN}  -P sync ${TactZN} -A ${TactZN}  -I ${TretZN}  -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+csktimes="-P ${TactN}  -P sync ${TactN}  -A ${TactN}  -I ${TretN}  -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
 CSK1=$($KEYGEN -k csk-roll -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
 CSK2=$($KEYGEN -k csk-roll -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $U $TremN  -r $H $TremN  -d $H $TremN  -z $H $TactZN1 "$CSK1" > settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $O $TactN1 -z $O $TactZN1 "$CSK2" > settime.out.$zone.2 2>&1
+$SETTIME -s -g $H -k $U $TremN  -r $H $TremN  -d $H $TremN  -z $H $TactN1 "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $O $TactN1 -z $O $TactN1 "$CSK2" > settime.out.$zone.2 2>&1
 # Set key rollover relationship.
 key_successor $CSK1 $CSK2
 # Sign zone.
@@ -1003,11 +950,6 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > si
 # This scenario differs from the above one because the zone signatures (ZRRSIG)
 # are replaced with the new key sooner than the DS is swapped.
 #
-#
-# The activation time for zone signing (ZSK) is different than for chain of
-# trust validation (KSK). Therefor, for zone signing we use TactZ and TretZ
-# instead of Tact and Tret.
-#

 # Step 1:
 # Introduce the first key. This will immediately be active.
@@ -1024,28 +966,25 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > si
 # It is time to introduce the new CSK.
 setup step2.csk-roll2.autosign
 # According to RFC 7583:
-# KSK: Tpub(N+1) <= Tact(N) + Lksk - Dreg - IpubC
-# ZSK: Tpub(N+1) <= TactZ(N) + Lzsk - Ipub
+# KSK: Tpub(N+1) <= Tact(N) + Lksk - IpubC
+# ZSK: Tpub(N+1) <= Tact(N) + Lzsk - Ipub
 # IpubC = DprpC + TTLkey (+publish-safety)
 # Ipub  = IpubC
 # Lcsk = Lksk = Lzsk
 #
 # Lcsk:           6mo (186d, 4464h)
-# Dreg:           1w
+# Dreg:           N/A
 # DprpC:          1h
 # TTLkey:         1h
 # publish-safety: 1h
 # Ipub:           3h
 #
-# Tact(N)  = Tnow - Lcsk + Ipub + Dreg = now - 186d + 3h + 1w
-#          = now - 4464h + 3h + 168h = now - 4293h
-# TactZ(N) = Tnow - Lcsk + IpubC = now - 186d + 3h
+# Tact(N)  = Tnow - Lcsk + Ipub = now - 186d + 3h
 #          = now - 4464h + 3h = now - 4461h
-TactN="now-4293h"
-TactZN="now-4461h"
-csktimes="-P ${TactN} -P sync ${TactZN} -A ${TactZN}"
+TactN="now-4461h"
+csktimes="-P ${TactN} -P sync ${TactN} -A ${TactN}"
 CSK=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
-$SETTIME -s -g $O -k $O $TactZN -r $O $TactZN -d $O $TactN -z $O $TactZN "$CSK" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN -z $O $TactN "$CSK" > settime.out.$zone.1 2>&1
 cat template.db.in "${CSK}.key" > "$infile"
 private_type_record $zone 13 "$CSK" >> "$infile"
 $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
@@ -1056,54 +995,46 @@ setup step3.csk-roll2.autosign
 # According to RFC 7583:
 #
 # Tsbm(N+1) >= Trdy(N+1)
-# KSK: Tact(N+1)  = Tsbm(N+1) + Dreg
-# ZSK: TactZ(N+1) = Tpub(N+1) + Ipub = Tsbm(N+1)
+# KSK: Tact(N+1) = Tsbm(N+1)
+# ZSK: Tact(N+1) = Tpub(N+1) + Ipub = Tsbm(N+1)
 # KSK: Iret  = DprpP + TTLds (+retire-safety)
 # ZSK: IretZ = Dsgn + Dprp + TTLsig (+retire-safety)
 #
 # Lcsk:           186d
 # Dprp:           1h
-# DprpP:          1h
-# Dreg:           1w
+# DprpP:          1w
+# Dreg:           N/A
 # Dsgn:           12h
 # TTLds:          1h
 # TTLsig:         1d
 # retire-safety:  1h
-# Iret:           3h
+# Iret:           170h
 # IretZ:          38h
 # Ipub:           3h
 #
-# TactZ(N)   = Tnow - Lcsk = now - 186d
-# TretZ(N)   = now
-# Tact(N)    = Tnow + Dreg - Lcsk = now + 1w - 186d = now - 179d
-# Tret(N)    = Tnow + Dreg = now + 7d
-# Trem(N)    = Tnow + Dreg + Iret = now + 1w + 3h = now + 171h
-# Tpub(N+1)  = Tnow - Ipub = now - 3h
-# Tsbm(N+1)  = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = Tnow + Lcsk = now + 186d
-# Tact(N+1)  = Tret(N)
-# Tret(N+1)  = Tnow + Lcsk + Dreg = now + 186d + 7d = now + 193d
-# Trem(N+1)  = Tnow + Lcsk + Dreg + Iret = now + 186d + 7d + 3h =
-#            = now + 193d + 3h = now + 4632h + 3h = now + 4635h
-TactZN="now-186d"
-TretZN="now"
-TactN="now-179d"
-TretN="now+7d"
-TremN="now+171h"
+# Tact(N)   = Tnow - Lcsk = now - 186d
+# Tret(N)   = now
+# Trem(N)   = Tnow + Iret = now + 170h
+# Tpub(N+1) = Tnow - Ipub = now - 3h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = Tnow + Lcsk = now + 186d
+# Trem(N+1) = Tnow + Lcsk + Iret = now + 186d + 170h =
+#           = now + 4464h + 170h = now + 4634h
+TactN="now-186d"
+TretN="now"
+TremN="now+170h"
 TpubN1="now-3h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+186d"
+TsbmN1="${TretN}"
 TactN1="${TretN}"
-TretN1="now+193d"
-TremN1="now+4635h"
-csktimes="-P ${TactN}  -P sync ${TactZN} -A ${TactZN}  -I ${TretZN}  -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TretN1="now+186d"
+TremN1="now+4634h"
+csktimes="-P ${TactN}  -P sync ${TactN}  -A ${TactN}  -I ${TretN}  -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
 CSK1=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
 CSK2=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN  -r $O $TactZN -d $O $TactN  -z $O $TactZN "$CSK1" > settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $R $TpubN1  -r $R $TpubN1 -d $H $TpubN1 -z $H $TpubN1 "$CSK2" > settime.out.$zone.2 2>&1
+$SETTIME -s -g $H -k $O $TactN  -r $O $TactN  -d $O $TactN  -z $O $TactN  "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $R $TpubN1 -r $R $TpubN1 -d $H $TpubN1 -z $H $TpubN1 "$CSK2" > settime.out.$zone.2 2>&1
 # Set key rollover relationship.
 key_successor $CSK1 $CSK2
 # Sign zone.
@@ -1119,49 +1050,38 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > si
 # signatures are replaced before the DS is swapped.
 setup step4.csk-roll2.autosign
 # According to RFC 7583:
-# Trem(N)    = Tret(N) + Iret
-# Tnow       = TretZ(N) + IretZ
+# Trem(N)    = Tret(N) + IretZ
 #
 # Lcsk:   186d
-# Dreg:   1w
-# Iret:   3h
+# Dreg:   N/A
+# Iret:   170h
 # IretZ:  38h
 #
-# TactZ(N)   = Tnow - IretZ = Lcsk = now - 38h - 186d
+# Tact(N)    = Tnow - IretZ = Lcsk = now - 38h - 186d
 #            = now - 38h - 4464h = now - 4502h
-# TretZ(N)   = Tnow - IretZ = now - 38h
-# Tact(N)    = Tnow - IretZ - Lcsk + Dreg = now - 38h - 4464h + 168h
-#            = now - 4334h
-# Tret(N)    = Tnow - IretZ + Dreg = now - 38h + 168h = now + 130h
-# Trem(N)    = Tnow - IretZ + Dreg + Iret = now + 130h + 3h = now + 133h
+# Tret(N)    = Tnow - IretZ = now - 38h
+# Trem(N)    = Tnow - IretZ + Iret = now - 38h + 170h = now + 132h
 # Tpub(N+1)  = Tnow - IretZ - IpubC = now - 38h - 3h = now - 41h
-# Tsbm(N+1)  = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = Tnow - IretZ + Lcsk = now - 38h + 186d
-#            = now + 4426h
+# Tsbm(N+1)  = Tret(N)
 # Tact(N+1)  = Tret(N)
-# Tret(N+1)  = Tnow - IretZ + Dreg + Lcsk = now - 38h + 168h + 4464h
-#            = now + 4594h
-# Trem(N+1)  = Tnow - IretZ + Dreg + Lcsk + Iret
-#            = now + 4594h + 3h = now + 4597h
-TactZN="now-4502h"
-TretZN="now-38h"
-TactN="now-4334h"
-TretN="now+130h"
-TremN="now+133h"
+# Tret(N+1)  = Tnow - IretZ + Lcsk = now - 38h + 186d
+#            = now + 4426h
+# Trem(N+1)  = Tnow - IretZ + Lcsk + Iret
+#            = now + 4426h + 3h = now + 4429h
+TactN="now-4502h"
+TretN="now-38h"
+TremN="now+132h"
 TpubN1="now-41h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+4426h"
+TsbmN1="${TretN}"
 TactN1="${TretN}"
-TretN1="now+4594h"
-TremN1="now+4597h"
-csktimes="-P ${TactN}  -P sync ${TactZN} -A ${TactZN}  -I ${TretZN}  -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TretN1="now+4426h"
+TremN1="now+4429h"
+csktimes="-P ${TactN}  -P sync ${TactN}  -A ${TactN}  -I ${TretN}  -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
 CSK1=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
 CSK2=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $O $TactZN -d $U $TsbmN1 -z $U $TretZN  "$CSK1" > settime.out.$zone.1 2>&1
-$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $R $TsbmN1 -z $R $TactZN1 "$CSK2" > settime.out.$zone.2 2>&1
+$SETTIME -s -g $H -k $O $TactN  -r $O $TactN  -d $U $TsbmN1 -z $U $TretN  "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $R $TsbmN1 -z $R $TactN1 "$CSK2" > settime.out.$zone.2 2>&1
 # Set key rollover relationship.
 key_successor $CSK1 $CSK2
 # Sign zone.
@@ -1174,37 +1094,29 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > si
 # Some time later the DS can be swapped and the old DNSKEY can be removed from
 # the zone.
 setup step5.csk-roll2.autosign
-# Subtract Dreg + Iret (171h) - IretZ (38h) = 133h.
+# Subtract Iret (170h) - IretZ (38h) = 132h.
 #
-# TactZ(N)   = now - 4502h - 133h = now - 4635h
-# TretZ(N)   = now - 38h - 133h = now - 171h
-# Tact(N)    = now - 4334h = 133h = now - 4467h
-# Tret(N)    = now + 130h - 133h = now - 3h
-# Trem(N)    = now + 133h - 133h = now
-# Tpub(N+1)  = now - 41h - 133h = now - 174h
-# Tsbm(N+1)  = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = now + 4426h - 133h = now + 4293h
-# Tact(N+1)  = Tret(N)
-# Tret(N+1)  = now + 4594h - 133h = now + 4461h
-# Trem(N+1)  = now + 4597h - 133h = now + 4464h = now + 186d
-TactZN="now-4635h"
-TretZN="now-171h"
-TactN="now-4467h"
-TretN="now-3h"
+# Tact(N)   = now - 4502h - 132h = now - 4634h
+# Tret(N)   = now - 38h - 132h = now - 170h
+# Trem(N)   = now + 132h - 132h = now
+# Tpub(N+1) = now - 41h - 132h = now - 173h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = now + 4426h - 132h = now + 4294h
+# Trem(N+1) = now + 4492h - 132h = now + 4360h
+TactN="now-4634h"
+TretN="now-170h"
 TremN="now"
-TpubN1="now-174h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+4293h"
+TpubN1="now-173h"
+TsbmN1="${TretN}"
 TactN1="${TretN}"
-TretN1="now+4461h"
-TremN1="now+186d"
-csktimes="-P ${TactN}  -P sync ${TactZN} -A ${TactZN}  -I ${TretZN}  -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TretN1="now+4294h"
+TremN1="now+4360h"
+csktimes="-P ${TactN}  -P sync ${TactN}  -A ${TactN}  -I ${TretN}  -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
 CSK1=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
 CSK2=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
-$SETTIME -s -g $H -k $O $TactZN -r $O $TactZN -d $U $TsbmN1 -z $H now-133h "$CSK1" > settime.out.$zone.1 2>&1
+$SETTIME -s -g $H -k $O $TactN  -r $O $TactN  -d $U $TsbmN1 -z $H now-133h "$CSK1" > settime.out.$zone.1 2>&1
 $SETTIME -s -g $O -k $O $TsbmN1 -r $O $TsbmN1 -d $R $TsbmN1 -z $O now-133h "$CSK2" > settime.out.$zone.2 2>&1
 # Set key rollover relationship.
 key_successor $CSK1 $CSK2
@@ -1219,32 +1131,24 @@ $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > si
 setup step6.csk-roll2.autosign
 # Subtract DNSKEY TTL plus zone propagation delay (2h).
 #
-# TactZ(N)   = now - 4635h - 2h = now - 4637h
-# TretZ(N)   = now - 171h - 2h = now - 173h
-# Tact(N)    = now - 4467h - 2h = now - 4469h
-# Tret(N)    = now - 3h - 2h = now - 5h
-# Trem(N)    = now - 2h
-# Tpub(N+1)  = now - 174h - 2h = now - 176h
-# Tsbm(N+1)  = TretZ(N)
-# TactZ(N+1) = TretZ(N)
-# TretZ(N+1) = now + 4293h - 2h = now + 4291h
-# Tact(N+1)  = Tret(N)
-# Tret(N+1)  = now + 4461h - 2h = now + 4459h
-# Trem(N+1)  = now + 4464h - 2h = now + 4462h
-TactZN="now-4637h"
-TretZN="now-173h"
-TactN="now-4469h"
-TretN="now-5h"
+# Tact(N)   = now - 4634h - 2h = now - 4636h
+# Tret(N)   = now - 170h - 2h = now - 172h
+# Trem(N)   = now - 2h
+# Tpub(N+1) = now - 173h - 2h = now - 175h
+# Tsbm(N+1) = Tret(N)
+# Tact(N+1) = Tret(N)
+# Tret(N+1) = now + 4294h - 2h = now + 4292h
+# Trem(N+1) = now + 4360h - 2h = now + 4358h
+TactN="now-4636h"
+TretN="now-172h"
 TremN="now-2h"
-TpubN1="now-176h"
-TsbmN1="${TretZN}"
-TactZN1="${TretZN}"
-TretZN1="now+4291h"
+TpubN1="now-175h"
+TsbmN1="${TretN}"
 TactN1="${TretN}"
-TretN1="now+4459h"
-TremN1="now+4462h"
-csktimes="-P ${TactN}  -P sync ${TactZN} -A ${TactZN}  -I ${TretZN}  -D ${TremN}"
-newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactZN1} -I ${TretZN1} -D ${TremN1}"
+TretN1="now+4292h"
+TremN1="now+4358h"
+csktimes="-P ${TactN}  -P sync ${TactN}  -A ${TactN}  -I ${TretN}  -D ${TremN}"
+newtimes="-P ${TpubN1} -P sync ${TsbmN1} -A ${TactN1} -I ${TretN1} -D ${TremN1}"
 CSK1=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $csktimes $zone 2> keygen.out.$zone.1)
 CSK2=$($KEYGEN -k csk-roll2 -l policies/autosign.conf $newtimes $zone 2> keygen.out.$zone.2)
 $SETTIME -s -g $H -k $U $TremN  -r $U $TremN  -d $H $TremN -z $H now-135h "$CSK1" > settime.out.$zone.1 2>&1
@@ -23,7 +23,6 @@ dnssec-policy "csk-algoroll" {
 	retire-safety 2h;
 	zone-propagation-delay 3600;
 	max-zone-ttl 6h;
-	parent-registration-delay 1d;
 	parent-propagation-delay pt1h;
 	parent-ds-ttl 7200;
 };
@@ -23,7 +23,6 @@ dnssec-policy "csk-algoroll" {
 	retire-safety 2h;
 	zone-propagation-delay 3600;
 	max-zone-ttl 6h;
-	parent-registration-delay 1d;
 	parent-propagation-delay pt1h;
 	parent-ds-ttl 7200;
 };
@@ -24,7 +24,6 @@ dnssec-policy "rsasha1" {
 	retire-safety 2h;
 	zone-propagation-delay 3600;
 	max-zone-ttl 6h;
-	parent-registration-delay 1d;
 	parent-propagation-delay pt1h;
 	parent-ds-ttl 7200;
 };
@@ -44,7 +43,6 @@ dnssec-policy "ecdsa256" {
 	retire-safety 2h;
 	zone-propagation-delay 3600;
 	max-zone-ttl 6h;
-	parent-registration-delay 1d;
 	parent-propagation-delay pt1h;
 	parent-ds-ttl 7200;
 };
@@ -74,8 +72,7 @@ dnssec-policy "migrate-nomatch-algnum" {
 	zone-propagation-delay 3600;
 	max-zone-ttl 11h;

-	// Together 24h
-	parent-registration-delay 21h;
+	// Together 3h
 	parent-propagation-delay pt1h;
 	parent-ds-ttl 7200;
 };
@@ -96,8 +93,7 @@ dnssec-policy "migrate-nomatch-alglen" {
 	zone-propagation-delay 3600;
 	max-zone-ttl 11h;

-	// Together 24h
-	parent-registration-delay 21h;
+	// Together 3h
 	parent-propagation-delay pt1h;
 	parent-ds-ttl 7200;
 };
@@ -56,7 +56,7 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer
 # ECDSAP256SHA256 keys.
 setup migrate-nomatch-algnum.kasp
 echo "$zone" >> zones
-Tds="now-24h"    # Time according to dnssec-policy that DS will be OMNIPRESENT
+Tds="now-3h"     # Time according to dnssec-policy that DS will be OMNIPRESENT
 Tkey="now-3900s" # DNSKEY TTL + propagation delay
 Tsig="now-12h"   # Zone's maximum TTL + propagation delay
 ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
@@ -74,7 +74,7 @@ $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer
 # dictates 2048 bits RSASHA1 keys.
 setup migrate-nomatch-alglen.kasp
 echo "$zone" >> zones
-Tds="now-24h"    # Time according to dnssec-policy that DS will be OMNIPRESENT
+Tds="now-3h"     # Time according to dnssec-policy that DS will be OMNIPRESENT
 Tkey="now-3900s" # DNSKEY TTL + propagation delay
 Tsig="now-12h"   # Zone's maximum TTL + propagation delay
 ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
@@ -252,7 +252,7 @@ else
 fi

 get_core_dumps() {
-    find "$systest/" \( -name 'core*' -or -name '*.core' \) ! -name '*.gz' ! -name '*.txt' | sort
+    find "$systest/" \( -name 'core' -or -name 'core.*' -or -name '*.core' \) ! -name '*.gz' ! -name '*.txt' | sort
 }

 core_dumps=$(get_core_dumps | tr '\n' ' ')
@@ -61,7 +61,7 @@ if [ -n "${FAILED_TESTS}" ]; then
 	status=1
 fi

-CRASHED_TESTS=$(find . -name 'core*' -or -name '*.core' | cut -d'/' -f2 | sort -u | sed -e 's/^/I:      /')
+CRASHED_TESTS=$(find . \( -name 'core' -or -name 'core.*' -or -name '*.core' \) ! -name '*.txt' | cut -d'/' -f2 | sort -u | sed -e 's/^/I:      /')
 if [ -n "${CRASHED_TESTS}" ]; then
 	echoinfo "I:Core dumps were found for the following system tests:"
 	echoinfo "${CRASHED_TESTS}"
@@ -121,7 +121,7 @@ AC_PROG_MKDIR_P
 # Initialize libtool
 LT_INIT([disable-static dlopen pic-only])

-AS_IF([test $enable_static != "no"],
+AS_IF([test "$enable_static" != "no" && test "$enable_developer" != "yes"],
      [AC_MSG_ERROR([Static linking is not supported as it disables dlopen() and certain security features (e.g. RELRO, ASLR)])])

 LT_CONFIG_LTDL_DIR([libltdl])
@@ -200,7 +200,7 @@ AC_ARG_ENABLE(buffer_useinline,
 	      AC_DEFINE([ISC_BUFFER_USEINLINE], [1]))

 AC_ARG_ENABLE([fuzzing],
-	      [AS_HELP_STRING([--enable-fuzzing=<afl|libfuzzer>],
+	      [AS_HELP_STRING([--enable-fuzzing=<afl|libfuzzer|ossfuzz>],
 			      [Enable fuzzing using American Fuzzy Lop or libFuzzer (default=no)])],
 	      [],
 	      [enable_fuzzing=no])
@@ -220,6 +220,9 @@ AS_CASE([$enable_fuzzing],
 	  LDFLAGS="$LDFLAGS -fsanitize=address,undefined"
 	  FUZZ_LDFLAGS="-fsanitize=fuzzer,address,undefined"
 	  FUZZ_LOG_COMPILER="libfuzzer.sh"],
+	[ossfuzz],[
+	    AC_MSG_RESULT([using OSS-Fuzz])
+	    FUZZ_LDFLAGS="$LIB_FUZZING_ENGINE"],
 	[*],[AC_MSG_ERROR([You need to explicitly select the fuzzer])])
 AM_CONDITIONAL([HAVE_FUZZ_LOG_COMPILER], [test -n "$FUZZ_LOG_COMPILER"])
 AC_SUBST([FUZZ_LOG_COMPILER])
@@ -973,66 +976,39 @@ AS_IF([test "$enable_tcp_fastopen" = "yes"],
 #
 AC_CHECK_FUNCS([strlcpy strlcat])

-AC_SUBST(READLINE_LIB)
-AC_ARG_WITH(readline,
-	    AS_HELP_STRING([--with-readline[=LIBSPEC]],
-			   [specify readline library [default auto]]),
-	    use_readline="$withval", use_readline="auto")
-case "$use_readline" in
-no)	;;
-*)
-	saved_LIBS="$LIBS"
-	case "$use_readline" in
-	yes|auto) try_readline="-ledit"; or_readline="-lreadline" ;;
-	*) try_readline="$use_readline"
-	esac
-	for readline in "$try_readline" $or_readline
-	do
-		LIBS="$readline"
-		AC_MSG_NOTICE(checking for readline with $readline)
-		AC_CHECK_FUNCS(readline)
-		if test "yes" = "$ac_cv_func_readline"
-		then
-			READLINE_LIB="$readline"
-			break
-		fi
-		for lib in -lterminfo -ltermcap -lncurses -lcurses
-		do
-			AC_MSG_NOTICE(checking for readline with $readline $lib)
-			unset ac_cv_func_readline
-			LIBS="$readline $lib"
-			AC_CHECK_FUNCS(readline)
-			if test "yes" = "$ac_cv_func_readline"
-			then
-				READLINE_LIB="$readline $lib"
-				break
-			fi
-		done
-		if test "yes" = "$ac_cv_func_readline"
-		then
-			break
-		fi
-	done
-	if test "auto" != "$use_readline" &&
-	   test "X$READLINE_LIB" = "X"
-	then
-		AC_MSG_ERROR([The readline library was not found.])
-	fi
-	LIBS="$saved_LIBS"
-	;;
-esac
-if test "yes" = "$ac_cv_func_readline"
-then
-	case "$READLINE_LIB" in
-	*edit*)
-		AC_CHECK_HEADERS(editline/readline.h)
-		AC_CHECK_HEADERS(edit/readline/readline.h)
-		AC_CHECK_HEADERS(edit/readline/history.h)
-		;;
-	esac
-	AC_CHECK_HEADERS(readline/readline.h)
-	AC_CHECK_HEADERS(readline/history.h)
-fi
+#
+# Check for readline support
+#
+
+AC_ARG_WITH([readline],
+	    [AS_HELP_STRING([--with-readline=yes|no|libedit|readline],
+			    [specify readline library [default auto]])],
+	    [], [with_readline="auto"])
+
+AS_CASE([$with_readline],
+	[no],[],
+	[auto],
+	[PKG_CHECK_MODULES([READLINE], [libedit],
+			   [AC_DEFINE([HAVE_READLINE_LIBEDIT], [1], [Build with libedit support])],
+			   [PKG_CHECK_MODULES([READLINE], [editline],
+					      [AC_DEFINE([HAVE_READLINE_EDITLINE], [1], [Build with editline support.])],
+					      [PKG_CHECK_MODULES([READLINE], [readline],
+								 [AC_DEFINE([HAVE_READLINE_READLINE], [1], [Build with readline support.])],
+								 [AS_IF([test "$with_readline" = "yes"],
+									[AC_MSG_ERROR([readline support requested, but none of the libraries have been found.])])])])])],
+	[libedit],
+	[PKG_CHECK_MODULES([READLINE], [libedit],
+			   [AC_DEFINE([HAVE_READLINE_LIBEDIT], [1], [Build with libedit support])])],
+	[editline],
+	[PKG_CHECK_MODULES([READLINE], [editline],
+			   [AC_DEFINE([HAVE_READLINE_EDITLINE], [1], [Build with editline support])])],
+	[readline],
+	[PKG_CHECK_MODULES([READLINE], [readline],
+			   [AC_DEFINE([HAVE_READLINE_READLINE], [1], [Build with readline support])])],
+	[AC_MSG_ERROR([Unknown readline '$with_readline' library requested.])])
+AM_CONDITIONAL([HAVE_READLINE], [test -n "$READLINE_LIBS"])
+AC_SUBST([READLINE_CFLAGS])
+AC_SUBST([READLINE_LIBS])

 #
 # Security Stuff
@@ -1327,7 +1327,7 @@ default is used.
   If all supported algorithms are disabled, the zones covered by the
   ``disable-algorithms`` setting are treated as insecure.

-   Configured trust anchors in ``trusted-anchors`` (or ``managed-keys`` or
+   Configured trust anchors in ``trust-anchors`` (or ``managed-keys`` or
   ``trusted-keys``) that match a disabled algorithm are ignored and treated
   as if they were not configured.

@@ -4901,12 +4901,6 @@ The following options can be specified in a ``dnssec-policy`` statement:
       is served by all of the parent zone's name servers.
       The default is ``PT1H`` (1 hour).

-     ``parent-registration-delay``
-       This is the expected registration delay from the time when a DS
-       RRset change is requested to the time when the DS RRset
-       is updated in the parent zone.  The default is
-       ``P1D`` (1 day).
-
 .. _managed-keys:

 ``managed-keys`` Statement Grammar
@@ -39,7 +39,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .sp
 \fBdnssec\-importkey\fP reads a public DNSKEY record and generates a pair
 of .key/.private files. The DNSKEY record may be read from an existing
-.key file, in which case a corresponding .private file is
+\&.key file, in which case a corresponding .private file is
 generated, or it may be read from any other file or from the standard
 input, in which case both .key and .private files are generated.
 .sp
@@ -107,7 +107,6 @@ dnssec\-policy string {
      max\-zone\-ttl duration;
      parent\-ds\-ttl duration;
      parent\-propagation\-delay duration;
-      parent\-registration\-delay duration;
      publish\-safety duration;
      retire\-safety duration;
      signatures\-refresh duration;
@@ -161,9 +161,21 @@ recreated. To remove it permanently, it must also be removed from
 .sp
 See also \fBrndc addzone\fP and \fBrndc modzone\fP\&.
 .TP
-\fBdnssec\fP [\fB\-status\fP \fIzone\fP [\fIclass\fP [\fIview\fP]]
-Show the DNSSEC signing state for the specified zone.  Requires the
-zone to have a "dnssec\-policy".
+\fBdnssec\fP ( \fB\-status\fP | \fB\-checkds\fP [\fB\-key\fP \fIid\fP [\fB\-alg\fP \fIalgorithm\fP]] [\fB\-when\fP \fItime\fP] ( \fIpublished\fP | \fIwithdrawn\fP )) \fIzone\fP [\fIclass\fP [\fIview\fP]]
+This command allows you to interact with the "dnssec\-policy" of a given
+zone.
+.sp
+\fBrndc dnssec \-status\fP show the DNSSEC signing state for the specified
+zone.
+.sp
+\fBrndc dnssec \-checkds\fP will let \fBnamed\fP know that the DS for the given
+key has been seen published into or withdrawn from the parent.  This is
+required in order to complete a KSK rollover.  If the \fB\-key id\fP argument
+is specified, look for the key with the given identifier, otherwise if there
+is only one key acting as a KSK in the zone, assume the DS of that key (if
+there are multiple keys with the same tag, use \fB\-alg algorithm\fP to
+select the correct algorithm).  The time that the DS has been published or
+withdrawn is set to now, unless otherwise specified with the argument \fB\-when time\fP\&.
 .TP
 \fBdnstap\fP ( \fB\-reopen\fP | \fB\-roll\fP [\fInumber\fP] )
 This command closes and re\-opens DNSTAP output files. \fBrndc dnstap \-reopen\fP allows
@@ -20,6 +20,5 @@ dnssec-policy "default" {

 	// Parent parameters
 	parent-ds-ttl 86400;
-	parent-registration-delay 24h;
 	parent-propagation-delay 1h;
 };
@@ -7,7 +7,6 @@
  	max-zone-ttl <duration>;
  	parent-ds-ttl <duration>;
  	parent-propagation-delay <duration>;
-  	parent-registration-delay <duration>;
  	publish-safety <duration>;
  	retire-safety <duration>;
  	signatures-refresh <duration>;
@@ -78,7 +78,6 @@ DNSSEC-POLICY
  	max-zone-ttl duration;
  	parent-ds-ttl duration;
  	parent-propagation-delay duration;
-  	parent-registration-delay duration;
  	publish-safety duration;
  	retire-safety duration;
  	signatures-refresh duration;
@@ -28,7 +28,7 @@ dnssec-policy <string> {
        max-zone-ttl <duration>;
        parent-ds-ttl <duration>;
        parent-propagation-delay <duration>;
-        parent-registration-delay <duration>;
+        parent-registration-delay <duration>; // obsolete
        publish-safety <duration>;
        retire-safety <duration>;
        signatures-refresh <duration>;
@@ -28,7 +28,6 @@ dnssec-policy <string> {
        max-zone-ttl <duration>;
        parent-ds-ttl <duration>;
        parent-propagation-delay <duration>;
-        parent-registration-delay <duration>;
        publish-safety <duration>;
        retire-safety <duration>;
        signatures-refresh <duration>;
@@ -24,6 +24,11 @@ Known Issues
 New Features
 ~~~~~~~~~~~~

+- New ``rndc`` command ``rndc dnssec -checkds`` to tell ``named``
+  that a DS record for a given zone or key has been published or withdrawn
+  from the parent. Replaces the time-based ``parent-registration-delay``
+  configuration option. [GL #1613]
+
 - ``rndc`` has been updated to use the new BIND network manager API.
  This change had the side effect of altering the TCP timeout for RNDC
  connections from 60 seconds to the ``tcp-idle-timeout`` value, which
@@ -20,6 +20,8 @@

 #include "fuzz.h"

+bool debug = false;
+
 static isc_mem_t *mctx = NULL;

 int
@@ -28,6 +28,8 @@

 #include "fuzz.h"

+bool debug = false;
+
 /*
 * Fuzz input to dns_rdata_fromwire(). Then convert the result
 * to text, back to wire format, to multiline text, and back to wire
@@ -59,13 +61,21 @@ LLVMFuzzerInitialize(int *argc __attribute__((unused)),

 static void
 nullmsg(dns_rdatacallbacks_t *cb, const char *fmt, ...) {
+	va_list args;
+
 	UNUSED(cb);
-	UNUSED(fmt);
+
+	if (debug) {
+		va_start(args, fmt);
+		vfprintf(stderr, fmt, args);
+		fprintf(stderr, "\n");
+		va_end(args);
+	}
 }

 int
 LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-	char totext[1024];
+	char totext[64 * 1044 * 4];
 	dns_compress_t cctx;
 	dns_decompress_t dctx;
 	dns_rdatatype_t rdtype;
@@ -85,7 +95,11 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	unsigned int classes = (sizeof(classlist) / sizeof(classlist[0]));
 	unsigned int types = 1, flags, t;

-	if (size < 2) {
+	/*
+	 * First 2 bytes are used to select type and class.
+	 * dns_rdata_fromwire() only accepts input up to 2^16-1 octets.
+	 */
+	if (size < 2 || size > 0xffff + 2) {
 		return (0);
 	}

@@ -113,10 +127,15 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	rdclass = classlist[(*data++) % classes];
 	size--;

+	if (debug) {
+		fprintf(stderr, "type=%u, class=%u\n", rdtype, rdclass);
+	}
+
 	dns_rdatacallbacks_init(&callbacks);
 	callbacks.warn = callbacks.error = nullmsg;

-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_ANY);
+	/* Disallow decompression as we are reading a packet */
+	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE);

 	isc_buffer_constinit(&source, data, size);
 	isc_buffer_add(&source, size);
@@ -129,14 +148,20 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	 */
 	CHECK(dns_rdata_fromwire(&rdata1, rdclass, rdtype, &source, &dctx, 0,
 				 &target));
+	assert(rdata1.length == size);

 	/*
 	 * Convert to text from wire.
 	 */
-	isc_buffer_init(&target, totext, sizeof(totext));
+	isc_buffer_init(&target, totext, sizeof(totext) - 1);
 	result = dns_rdata_totext(&rdata1, NULL, &target);
 	assert(result == ISC_R_SUCCESS);

+	/*
+	 * Make debugging easier by NUL terminating.
+	 */
+	totext[isc_buffer_usedlength(&target)] = 0;
+
 	/*
 	 * Convert to wire from text.
 	 */
@@ -147,6 +172,9 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	isc_buffer_init(&target, fromtext, sizeof(fromtext));
 	result = dns_rdata_fromtext(&rdata2, rdclass, rdtype, lex, dns_rootname,
 				    0, mctx, &target, &callbacks);
+	if (debug && result != ISC_R_SUCCESS) {
+		fprintf(stderr, "'%s'\n", totext);
+	}
 	assert(result == ISC_R_SUCCESS);
 	assert(rdata2.length == size);
 	assert(!memcmp(rdata2.data, data, size));
@@ -178,7 +206,7 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	 * Convert rdata back to wire.
 	 */
 	CHECK(dns_compress_init(&cctx, -1, mctx));
-	dns_compress_setsensitive(&cctx, true);
+	dns_compress_disable(&cctx);
 	isc_buffer_init(&target, towire, sizeof(towire));
 	result = dns_rdata_towire(&rdata1, &cctx, &target);
 	dns_compress_invalidate(&cctx);
@@ -0,0 +1 @@
+,000
@@ -0,0 +1 @@
+ﾓ0ｵ0琿00
@@ -0,0 +1 @@
+0000000000000000000À
@@ -0,0 +1 @@
+�000000000000000000000000��00�0�00000000000000000000�00�0000
@@ -0,0 +1 @@
+d000��
@@ -0,0 +1 @@
+�0�
@@ -0,0 +1 @@
+�0�
@@ -0,0 +1 @@
+�000000000��000
@@ -0,0 +1 @@
+i00000000000000000000
@@ -0,0 +1 @@
+%00
@@ -0,0 +1 @@
+�00
@@ -0,0 +1 @@
+�0�
@@ -0,0 +1 @@
+�00
@@ -0,0 +1 @@
+�000|
@@ -0,0 +1 @@
+�000000
@@ -0,0 +1 @@
+0000
@@ -0,0 +1 @@
+�00�00000000000000000000000000000000�000000000000
@@ -0,0 +1 @@
+�00
@@ -0,0 +1 @@
+簯0000000000000000000
@@ -0,0 +1 @@
+o0000000000000000000000000000»΅00000000000β000ο0»00»0θ°ο�000��000�0
@@ -0,0 +1 @@
+�0�00�0000�
@@ -0,0 +1 @@
+,000
@@ -0,0 +1 @@
+10000000000000000000000000000000000000000000�������������
@@ -1 +1 @@
-�-�e�<
+�00000
@@ -1 +1 @@
-|�|8
+|0000
@@ -23,6 +23,8 @@

 ISC_LANG_BEGINDECLS

+extern bool debug;
+
 int
 LLVMFuzzerInitialize(int *argc __attribute__((unused)),
 		     char ***argv __attribute__((unused)));
@@ -15,10 +15,13 @@
 #include <isc/buffer.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
+#include <isc/string.h>
 #include <isc/util.h>

 #include "fuzz.h"

+bool debug = false;
+
 int
 LLVMFuzzerInitialize(int *argc __attribute__((unused)),
 		     char ***argv __attribute__((unused)));
@@ -46,6 +49,21 @@ int
 LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	isc_buffer_t buf;
 	isc_result_t result;
+	isc_token_t token;
+	isc_tokentype_t expect;
+	bool eol;
+
+	if (size < sizeof(expect) + sizeof(eol)) {
+		return (0);
+	}
+
+	(void)memmove(&expect, data, sizeof(expect));
+	data += sizeof(expect);
+	size -= sizeof(expect);
+
+	eol = *data != 0;
+	data += 1;
+	size -= 1;

 	isc_buffer_constinit(&buf, data, size);
 	isc_buffer_add(&buf, size);
@@ -54,9 +72,8 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	CHECK(isc_lex_openbuffer(lex, &buf));

 	do {
-		isc_token_t token;
-		result = isc_lex_gettoken(lex, 0, &token);
-	} while (result == ISC_R_SUCCESS);
+		result = isc_lex_getmastertoken(lex, &token, expect, eol);
+	} while (result == ISC_R_SUCCESS && token.type != isc_tokentype_eof);

 	return (0);
 }
@@ -19,6 +19,8 @@

 #include "fuzz.h"

+bool debug = false;
+
 static isc_mem_t *mctx = NULL;
 static isc_lex_t *lex = NULL;

@@ -24,6 +24,48 @@

 #include <dirent.h>

+static void
+test_one_file(const char *filename) {
+	int fd;
+	struct stat st;
+	char *data;
+	ssize_t n;
+
+	if ((fd = open(filename, O_RDONLY)) == -1) {
+		fprintf(stderr, "Failed to open %s: %s\n", filename,
+			strerror(errno));
+		return;
+	}
+
+	if (fstat(fd, &st) != 0) {
+		fprintf(stderr, "Failed to stat %s: %s\n", filename,
+			strerror(errno));
+		goto closefd;
+	}
+
+	data = malloc(st.st_size);
+	n = read(fd, data, st.st_size);
+	if (n == st.st_size) {
+		printf("testing %zd bytes from %s\n", n, filename);
+		fflush(stdout);
+		LLVMFuzzerTestOneInput((const uint8_t *)data, n);
+		fflush(stderr);
+	} else {
+		if (n < 0) {
+			fprintf(stderr,
+				"Failed to read %zd bytes from %s: %s\n",
+				(ssize_t)st.st_size, filename, strerror(errno));
+		} else {
+			fprintf(stderr,
+				"Failed to read %zd bytes from %s, got %zd\n",
+				(ssize_t)st.st_size, filename, n);
+		}
+	}
+	free(data);
+closefd:
+	close(fd);
+}
+
 static void
 test_all_from(const char *dirname) {
 	DIR *dirp;
@@ -36,53 +78,13 @@ test_all_from(const char *dirname) {

 	while ((dp = readdir(dirp)) != NULL) {
 		char filename[strlen(dirname) + strlen(dp->d_name) + 2];
-		int fd;
-		struct stat st;
-		char *data;
-		ssize_t n;

 		if (dp->d_name[0] == '.') {
 			continue;
 		}
 		snprintf(filename, sizeof(filename), "%s/%s", dirname,
 			 dp->d_name);
-
-		if ((fd = open(filename, O_RDONLY)) == -1) {
-			fprintf(stderr, "Failed to open %s: %s\n", filename,
-				strerror(errno));
-			continue;
-		}
-
-		if (fstat(fd, &st) != 0) {
-			fprintf(stderr, "Failed to stat %s: %s\n", filename,
-				strerror(errno));
-			goto closefd;
-		}
-
-		data = malloc(st.st_size);
-		n = read(fd, data, st.st_size);
-		if (n == st.st_size) {
-			printf("testing %zd bytes from %s\n", n, filename);
-			fflush(stdout);
-			LLVMFuzzerTestOneInput((const uint8_t *)data, n);
-			fflush(stderr);
-		} else {
-			if (n < 0) {
-				fprintf(stderr,
-					"Failed to read %zd bytes from %s: "
-					"%s\n",
-					(ssize_t)st.st_size, filename,
-					strerror(errno));
-			} else {
-				fprintf(stderr,
-					"Failed to read %zd bytes from %s"
-					", got %zd\n",
-					(ssize_t)st.st_size, filename, n);
-			}
-		}
-		free(data);
-	closefd:
-		close(fd);
+		test_one_file(filename);
 	}

 	closedir(dirp);
@@ -95,8 +97,21 @@ main(int argc, char **argv) {

 	(void)LLVMFuzzerInitialize(&argc, &argv);

-	UNUSED(argc);
-	UNUSED(argv);
+	if (argv[1] != NULL && strcmp(argv[1], "-d") == 0) {
+		debug = true;
+		argv++;
+		argc--;
+	}
+
+	if (argv[1] != NULL) {
+		while (argv[1] != NULL) {
+			test_one_file(argv[1]);
+			argv++;
+			argc--;
+		}
+		POST(argc);
+		return (0);
+	}

 	target = (target != NULL) ? target + 1 : argv[0];
 	if (strncmp(target, "lt-", 3) == 0) {
@@ -110,7 +110,9 @@ static const char *timingtags[TIMING_NTAGS] = {

 	"DSPublish:",	 "SyncPublish:",  "SyncDelete:",

-	"DNSKEYChange:", "ZRRSIGChange:", "KRRSIGChange:", "DSChange:"
+	"DNSKEYChange:", "ZRRSIGChange:", "KRRSIGChange:", "DSChange:",
+
+	"DSRemoved:"
 };

 #define KEYSTATES_NTAGS (DST_MAX_KEYSTATES + 1)
@@ -1923,8 +1925,7 @@ printtime(const dst_key_t *key, int type, const char *tag, FILE *stream) {
 	}

 	isc_buffer_usedregion(&b, &r);
-	fprintf(stream, "%s: %.*s (%.*s)\n", tag, (int)r.length, r.base,
-		(int)strlen(output) - 1, output);
+	fprintf(stream, "%s: %.*s (%s)\n", tag, (int)r.length, r.base, output);
 	return;

 error:
@@ -2009,6 +2010,8 @@ write_key_state(const dst_key_t *key, int type, const char *directory) {
 		printtime(key, DST_TIME_INACTIVE, "Retired", fp);
 		printtime(key, DST_TIME_REVOKE, "Revoked", fp);
 		printtime(key, DST_TIME_DELETE, "Removed", fp);
+		printtime(key, DST_TIME_DSPUBLISH, "DSPublish", fp);
+		printtime(key, DST_TIME_DSDELETE, "DSRemoved", fp);
 		printtime(key, DST_TIME_SYNCPUBLISH, "PublishCDS", fp);
 		printtime(key, DST_TIME_SYNCDELETE, "DeleteCDS", fp);

@@ -779,7 +779,6 @@ main(int argc, char **argv) {
 		 * Add in reserved/special types.  This will let us
 		 * sort them without special cases.
 		 */
-		insert_into_typenames(0, "reserved0", RESERVED);
 		insert_into_typenames(100, "uinfo", RESERVEDNAME);
 		insert_into_typenames(101, "uid", RESERVEDNAME);
 		insert_into_typenames(102, "gid", RESERVEDNAME);
@@ -86,7 +86,6 @@ struct dns_kasp {
 	/* Parent settings */
 	dns_ttl_t parent_ds_ttl;
 	uint32_t  parent_propagation_delay;
-	uint32_t  parent_registration_delay;

 	/* TODO: The rest of the KASP configuration */
 };
@@ -105,7 +104,6 @@ struct dns_kasp {
 #define DNS_KASP_ZONE_MAXTTL	     (86400)
 #define DNS_KASP_ZONE_PROPDELAY	     (300)
 #define DNS_KASP_PARENT_PROPDELAY    (3600)
-#define DNS_KASP_PARENT_REGDELAY     (86400)

 /* Key roles */
 #define DNS_KASP_KEY_ROLE_KSK 0x01
@@ -443,30 +441,6 @@ dns_kasp_setparentpropagationdelay(dns_kasp_t *kasp, uint32_t value);
 *\li   'kasp' is a valid, thawed kasp.
 */

-uint32_t
-dns_kasp_parentregistrationdelay(dns_kasp_t *kasp);
-/*%<
- * Get parent registration delay for submitting new DS.
- *
- * Requires:
- *
- *\li   'kasp' is a valid, frozen kasp.
- *
- * Returns:
- *
- *\li   Parent registration delay.
- */
-
-void
-dns_kasp_setparentregistrationdelay(dns_kasp_t *kasp, uint32_t value);
-/*%<
- * Set parent registration delay.
- *
- * Requires:
- *
- *\li   'kasp' is a valid, thawed kasp.
- */
-
 isc_result_t
 dns_kasplist_find(dns_kasplist_t *list, const char *name, dns_kasp_t **kaspp);
 /*%<
@@ -51,6 +51,32 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 *\li		On error, keypool is unchanged
 */

+isc_result_t
+dns_keymgr_checkds(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
+		   const char *directory, isc_stdtime_t now, bool dspublish);
+isc_result_t
+dns_keymgr_checkds_id(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
+		      const char *directory, isc_stdtime_t now, bool dspublish,
+		      dns_keytag_t id, unsigned int algorithm);
+/*%<
+ * Check DS for one key in 'keyring'. The key must have the KSK role.
+ * If 'dspublish' is set to true, set the DS Publish time to 'now'.
+ * If 'dspublish' is set to false, set the DS Removed time to 'now'.
+ * If a specific key 'id' is given it must match the keytag.
+ * If the 'algorithm' is non-zero, it must match the key's algorithm.
+ * The result is stored in the key state file.
+ *
+ *	Requires:
+ *\li		'kasp' is not NULL.
+ *\li		'keyring' is not NULL.
+ *
+ *	Returns:
+ *\li		#ISC_R_SUCCESS (No error).
+ *\li		#ISC_R_FAILURE (More than one matching KSK found).
+ *\li		#ISC_R_NOTFOUND (No matching KSK found).
+ *
+ */
+
 void
 dns_keymgr_status(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
 		  isc_stdtime_t now, char *out, size_t out_len);
@@ -54,6 +54,7 @@ struct dns_ntatable {
 	isc_refcount_t references;
 	/* Locked by rwlock. */
 	dns_rbt_t *table;
+	bool	   shuttingdown;
 };

 #define NTATABLE_MAGIC	   ISC_MAGIC('N', 'T', 'A', 't')
@@ -197,6 +198,13 @@ dns_ntatable_save(dns_ntatable_t *ntatable, FILE *fp);
 /*%<
 * Save the NTA table to the file opened as 'fp', for later loading.
 */
+
+void
+dns_ntatable_shutdown(dns_ntatable_t *ntatable);
+/*%<
+ * Cancel future checks to see if NTAs can be removed.
+ */
+
 ISC_LANG_ENDDECLS

 #endif /* DNS_NTA_H */
@@ -133,7 +133,8 @@ typedef enum dst_key_state {
 #define DST_TIME_ZRRSIG	     10
 #define DST_TIME_KRRSIG	     11
 #define DST_TIME_DS	     12
-#define DST_MAX_TIMES	     12
+#define DST_TIME_DSDELETE    13
+#define DST_MAX_TIMES	     13

 /* Numeric metadata definitions */
 #define DST_NUM_PREDECESSOR 0
@@ -57,7 +57,6 @@ dns_kasp_create(isc_mem_t *mctx, const char *name, dns_kasp_t **kaspp) {

 	kasp->parent_ds_ttl = DNS_KASP_DS_TTL;
 	kasp->parent_propagation_delay = DNS_KASP_PARENT_PROPDELAY;
-	kasp->parent_registration_delay = DNS_KASP_PARENT_REGDELAY;

 	/* TODO: The rest of the KASP configuration */

@@ -298,22 +297,6 @@ dns_kasp_setparentpropagationdelay(dns_kasp_t *kasp, uint32_t value) {
 	kasp->parent_propagation_delay = value;
 }

-uint32_t
-dns_kasp_parentregistrationdelay(dns_kasp_t *kasp) {
-	REQUIRE(DNS_KASP_VALID(kasp));
-	REQUIRE(kasp->frozen);
-
-	return (kasp->parent_registration_delay);
-}
-
-void
-dns_kasp_setparentregistrationdelay(dns_kasp_t *kasp, uint32_t value) {
-	REQUIRE(DNS_KASP_VALID(kasp));
-	REQUIRE(!kasp->frozen);
-
-	kasp->parent_registration_delay = value;
-}
-
 isc_result_t
 dns_kasplist_find(dns_kasplist_t *list, const char *name, dns_kasp_t **kaspp) {
 	dns_kasp_t *kasp = NULL;
@@ -128,9 +128,6 @@ keymgr_settime_remove(dns_dnsseckey_t *key, dns_kasp_t *kasp) {
 			     dns_kasp_parentpropagationdelay(kasp) +
 			     dns_kasp_retiresafety(kasp);
 	}
-	if (zsk && ksk) {
-		ksk_remove += dns_kasp_parentregistrationdelay(kasp);
-	}

 	remove = ksk_remove > zsk_remove ? ksk_remove : zsk_remove;
 	dst_key_settime(key->key, DST_TIME_DELETE, remove);
@@ -263,12 +260,6 @@ keymgr_prepublication_time(dns_dnsseckey_t *key, dns_kasp_t *kasp,
 	 * so ignore the result code.
 	 */
 	(void)dst_key_getbool(key->key, DST_BOOL_ZSK, &zsk);
-	if (!zsk && ksk) {
-		/*
-		 * Include registration delay in prepublication time.
-		 */
-		prepub += dns_kasp_parentregistrationdelay(kasp);
-	}

 	ret = dst_key_gettime(key->key, DST_TIME_INACTIVE, &retire);
 	if (ret != ISC_R_SUCCESS) {
@@ -965,10 +956,14 @@ keymgr_have_rrsig(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key, int type,
 *    - First introduce the DNSKEY record, as well as the KRRSIG records.
 *    - Only if the DNSKEY record is OMNIPRESENT, suggest to introduce the DS.
 *
+ * Also check the DS Publish or Delete times, to see if the DS record
+ * already reached the parent.
 */
 static bool
 keymgr_policy_approval(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
-		       int type, dst_key_state_t next) {
+		       int type, dst_key_state_t next, isc_stdtime_t now) {
+	isc_result_t ret;
+	isc_stdtime_t dstime;
 	dst_key_state_t dnskeystate = HIDDEN;
 	dst_key_state_t ksk_present[4] = { OMNIPRESENT, NA, OMNIPRESENT,
 					   OMNIPRESENT };
@@ -980,10 +975,10 @@ keymgr_policy_approval(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 	dst_key_state_t ksk_retired[4] = { UNRETENTIVE, NA, NA, OMNIPRESENT };
 	dst_key_state_t na[4] = { NA, NA, NA, NA }; /* successor n/a */

-	if (next != RUMOURED) {
+	if (next != RUMOURED && next != UNRETENTIVE) {
 		/*
 		 * Local policy only adds an extra barrier on transitions to
-		 * the RUMOURED state.
+		 * the RUMOURED and UNRETENTIVE states.
 		 */
 		return (true);
 	}
@@ -993,6 +988,9 @@ keymgr_policy_approval(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 		/* No restrictions. */
 		return (true);
 	case DST_KEY_ZRRSIG:
+		if (next != RUMOURED) {
+			return (true);
+		}
 		/* Make sure the DNSKEY record is OMNIPRESENT. */
 		(void)dst_key_getstate(key->key, DST_KEY_DNSKEY, &dnskeystate);
 		if (dnskeystate == OMNIPRESENT) {
@@ -1013,13 +1011,35 @@ keymgr_policy_approval(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 				  keyring, key, type, next, ksk_retired,
 				  ksk_rumoured, true, true)));
 	case DST_KEY_KRRSIG:
+		if (next != RUMOURED) {
+			return (true);
+		}
 		/* Only introduce if the DNSKEY is also introduced. */
 		(void)dst_key_getstate(key->key, DST_KEY_DNSKEY, &dnskeystate);
 		return (dnskeystate != HIDDEN);
 	case DST_KEY_DS:
-		/* Make sure the DNSKEY record is OMNIPRESENT. */
-		(void)dst_key_getstate(key->key, DST_KEY_DNSKEY, &dnskeystate);
-		return (dnskeystate == OMNIPRESENT);
+		if (next == RUMOURED) {
+			/* Make sure the DNSKEY record is OMNIPRESENT. */
+			(void)dst_key_getstate(key->key, DST_KEY_DNSKEY,
+					       &dnskeystate);
+			if (dnskeystate != OMNIPRESENT) {
+				return (false);
+			}
+			/* Make sure DS has been seen in the parent. */
+			ret = dst_key_gettime(key->key, DST_TIME_DSPUBLISH,
+					      &dstime);
+			if (ret != ISC_R_SUCCESS || dstime > now) {
+				return (false);
+			}
+		} else if (next == UNRETENTIVE) {
+			/* Make sure DS has been withdrawn from the parent. */
+			ret = dst_key_gettime(key->key, DST_TIME_DSDELETE,
+					      &dstime);
+			if (ret != ISC_R_SUCCESS || dstime > now) {
+				return (false);
+			}
+		}
+		return (true);
 	default:
 		return (false);
 	}
@@ -1203,16 +1223,13 @@ keymgr_transition_time(dns_dnsseckey_t *key, int type,
 			 *
 			 *      Iret = DprpP + TTLds
 			 *
-			 * So we need to wait Dreg + Iret before the DS becomes
-			 * OMNIPRESENT. This translates to:
+			 * This translates to:
 			 *
-			 *      parent-registration-delay +
 			 *      parent-propagation-delay + parent-ds-ttl.
 			 *
 			 * We will also add the retire-safety interval.
 			 */
 			nexttime = lastchange + dns_kasp_dsttl(kasp) +
-				   dns_kasp_parentregistrationdelay(kasp) +
 				   dns_kasp_parentpropagationdelay(kasp) +
 				   dns_kasp_retiresafety(kasp);
 			break;
@@ -1302,7 +1319,7 @@ transition:

 			/* Is the transition allowed according to policy? */
 			if (!keymgr_policy_approval(keyring, dkey, i,
-						    next_state)) {
+						    next_state, now)) {
 				/* No, please respect rollover methods. */
 				isc_log_write(
 					dns_lctx, DNS_LOGCATEGORY_DNSSEC,
@@ -1433,7 +1450,6 @@ keymgr_key_init(dns_dnsseckey_t *key, dns_kasp_t *kasp, isc_stdtime_t now) {
 	ret = dst_key_gettime(key->key, DST_TIME_SYNCPUBLISH, &syncpub);
 	if (syncpub <= now && ret == ISC_R_SUCCESS) {
 		dns_ttl_t ds_ttl = dns_kasp_dsttl(kasp);
-		ds_ttl += dns_kasp_parentregistrationdelay(kasp);
 		ds_ttl += dns_kasp_parentpropagationdelay(kasp);
 		if ((syncpub + ds_ttl) <= now) {
 			ds_state = OMNIPRESENT;
@@ -1854,6 +1870,86 @@ failure:
 	return (result);
 }

+static isc_result_t
+keymgr_checkds(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
+	       const char *directory, isc_stdtime_t now, bool dspublish,
+	       dns_keytag_t id, unsigned int alg, bool check_id) {
+	int options = (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC | DST_TYPE_STATE);
+	isc_dir_t dir;
+	isc_result_t result;
+	dns_dnsseckey_t *ksk_key = NULL;
+
+	REQUIRE(DNS_KASP_VALID(kasp));
+	REQUIRE(keyring != NULL);
+
+	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
+	     dkey = ISC_LIST_NEXT(dkey, link))
+	{
+		isc_result_t ret;
+		bool ksk = false;
+
+		ret = dst_key_getbool(dkey->key, DST_BOOL_KSK, &ksk);
+		if (ret == ISC_R_SUCCESS && ksk) {
+			if (check_id && dst_key_id(dkey->key) != id) {
+				continue;
+			}
+			if (alg > 0 && dst_key_alg(dkey->key) != alg) {
+				continue;
+			}
+
+			if (ksk_key != NULL) {
+				/*
+				 * Only checkds for one key at a time.
+				 */
+				return (ISC_R_FAILURE);
+			}
+
+			ksk_key = dkey;
+		}
+	}
+
+	if (ksk_key == NULL) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	if (dspublish) {
+		dst_key_settime(ksk_key->key, DST_TIME_DSPUBLISH, now);
+	} else {
+		dst_key_settime(ksk_key->key, DST_TIME_DSDELETE, now);
+	}
+
+	/* Store key state and update hints. */
+	isc_dir_init(&dir);
+	if (directory == NULL) {
+		directory = ".";
+	}
+	result = isc_dir_open(&dir, directory);
+	if (result != ISC_R_SUCCESS) {
+		return result;
+	}
+
+	dns_dnssec_get_hints(ksk_key, now);
+	result = dst_key_tofile(ksk_key->key, options, directory);
+	isc_dir_close(&dir);
+
+	return (result);
+}
+
+isc_result_t
+dns_keymgr_checkds(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
+		   const char *directory, isc_stdtime_t now, bool dspublish) {
+	return (keymgr_checkds(kasp, keyring, directory, now, dspublish, 0, 0,
+			       false));
+}
+
+isc_result_t
+dns_keymgr_checkds_id(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
+		      const char *directory, isc_stdtime_t now, bool dspublish,
+		      dns_keytag_t id, unsigned int alg) {
+	return (keymgr_checkds(kasp, keyring, directory, now, dspublish, id,
+			       alg, true));
+}
+
 static void
 keytime_status(dst_key_t *key, isc_stdtime_t now, isc_buffer_t *buf,
 	       const char *pre, int ks, int kt) {
@@ -128,6 +128,7 @@ dns_ntatable_create(dns_view_t *view, isc_taskmgr_t *taskmgr,
 		goto cleanup_rbt;
 	}

+	ntatable->shuttingdown = false;
 	ntatable->timermgr = timermgr;
 	ntatable->taskmgr = taskmgr;

@@ -239,13 +240,14 @@ fetch_done(isc_task_t *task, isc_event_t *event) {
 				      NULL, true);
 	}
 	nta_detach(view->mctx, &nta);
+	dns_view_weakdetach(&view);
 }

 static void
 checkbogus(isc_task_t *task, isc_event_t *event) {
 	dns_nta_t *nta = event->ev_arg;
 	dns_ntatable_t *ntatable = nta->ntatable;
-	dns_view_t *view = ntatable->view;
+	dns_view_t *view = NULL;
 	isc_result_t result;

 	if (nta->fetch != NULL) {
@@ -262,11 +264,13 @@ checkbogus(isc_task_t *task, isc_event_t *event) {
 	isc_event_free(&event);

 	nta_ref(nta);
+	dns_view_weakattach(ntatable->view, &view);
 	result = dns_resolver_createfetch(
 		view->resolver, nta->name, dns_rdatatype_nsec, NULL, NULL, NULL,
 		NULL, 0, DNS_FETCHOPT_NONTA, 0, NULL, task, fetch_done, nta,
 		&nta->rdataset, &nta->sigrdataset, &nta->fetch);
 	if (result != ISC_R_SUCCESS) {
+		dns_view_weakdetach(&view);
 		nta_detach(view->mctx, &nta);
 	}
 }
@@ -330,7 +334,7 @@ nta_create(dns_ntatable_t *ntatable, const dns_name_t *name,
 isc_result_t
 dns_ntatable_add(dns_ntatable_t *ntatable, const dns_name_t *name, bool force,
 		 isc_stdtime_t now, uint32_t lifetime) {
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 	dns_nta_t *nta = NULL;
 	dns_rbtnode_t *node;
 	dns_view_t *view;
@@ -339,16 +343,20 @@ dns_ntatable_add(dns_ntatable_t *ntatable, const dns_name_t *name, bool force,

 	view = ntatable->view;

+	RWLOCK(&ntatable->rwlock, isc_rwlocktype_write);
+
+	if (ntatable->shuttingdown) {
+		goto unlock;
+	}
+
 	result = nta_create(ntatable, name, &nta);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		goto unlock;
 	}

 	nta->expiry = now + lifetime;
 	nta->forced = force;

-	RWLOCK(&ntatable->rwlock, isc_rwlocktype_write);
-
 	node = NULL;
 	result = dns_rbt_addnode(ntatable->table, name, &node);
 	if (result == ISC_R_SUCCESS) {
@@ -372,6 +380,7 @@ dns_ntatable_add(dns_ntatable_t *ntatable, const dns_name_t *name, bool force,
 		result = ISC_R_SUCCESS;
 	}

+unlock:
 	RWUNLOCK(&ntatable->rwlock, isc_rwlocktype_write);

 	if (nta != NULL) {
@@ -663,3 +672,33 @@ cleanup:
 		return (written ? ISC_R_SUCCESS : ISC_R_NOTFOUND);
 	}
 }
+
+void
+dns_ntatable_shutdown(dns_ntatable_t *ntatable) {
+	isc_result_t result;
+	dns_rbtnode_t *node;
+	dns_rbtnodechain_t chain;
+
+	REQUIRE(VALID_NTATABLE(ntatable));
+
+	RWLOCK(&ntatable->rwlock, isc_rwlocktype_write);
+	ntatable->shuttingdown = true;
+
+	dns_rbtnodechain_init(&chain);
+	result = dns_rbtnodechain_first(&chain, ntatable->table, NULL, NULL);
+	while (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
+		dns_rbtnodechain_current(&chain, NULL, NULL, &node);
+		if (node->data != NULL) {
+			dns_nta_t *nta = (dns_nta_t *)node->data;
+			if (nta->timer != NULL) {
+				(void)isc_timer_reset(nta->timer,
+						      isc_timertype_inactive,
+						      NULL, NULL, true);
+			}
+		}
+		result = dns_rbtnodechain_next(&chain, NULL, NULL);
+	}
+
+	dns_rbtnodechain_invalidate(&chain);
+	RWUNLOCK(&ntatable->rwlock, isc_rwlocktype_write);
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Mark Andrews	6c0747fc2b	add missing decrements; set *versionp to NULL at start of closeversion	2020-08-19 12:31:38 +10:00
Mark Andrews	ac67436758	Merge branch '2077-negative-hook-point-value-in-filter-aaaa-c' into 'main' Resolve "negative hook point value in filter-aaaa.c" Closes #2077 See merge request isc-projects/bind9!3985	2020-08-19 00:17:05 +00:00
Mark Andrews	2fd5ba6507	Remove stray '-' from filter-aaaa initialisation	2020-08-19 09:21:59 +10:00
Ondřej Surý	e51c8613e4	Merge branch 'ondrej/dns_rdata_fromwire_text-corpus-update' into 'main' Expand, but minimize (tmin, cmin) dns_rdata_fromwire_text corpus See merge request isc-projects/bind9!3981	2020-08-18 15:44:11 +00:00
Ondřej Surý	df26656e4b	Expand, but minimize (tmin, cmin) dns_rdata_fromwire_text corpus	2020-08-18 16:39:23 +02:00
Ondřej Surý	2a8c0282da	Merge branch 'marka-fuzz-consolidated' into 'main' Consolidated fuzz fixes See merge request isc-projects/bind9!3975	2020-08-18 09:07:47 +00:00
Ondřej Surý	62c448beaf	Merge branch 'ondrej/update-readline-support' into 'main' Update and cleanup the readline library support See merge request isc-projects/bind9!3942	2020-08-18 09:05:51 +00:00
Mark AndrewsandOndřej Surý	8452404bd7	A6: return FORMERR in fromwire if bits are non zero. oss_fuzz: Issue 24864: bind9:dns_rdata_fromwire_text_fuzzer: Overwrites-const-input in dns_rdata_fromwire_text_fuzzer	2020-08-18 11:04:05 +02:00
Mark AndrewsandOndřej Surý	f6d7b8c20d	RRSIG: reject records with empty SIG section	2020-08-18 11:04:05 +02:00
Mark AndrewsandOndřej Surý	3e743da1bd	Disable compression in dns_rdata_fromwire_text()	2020-08-18 11:04:05 +02:00
Mark AndrewsandOndřej Surý	aa811801cb	dns_rdata_fromwire() only accepts input up to 2^16-1 octets.	2020-08-18 11:04:05 +02:00
Mark AndrewsandOndřej Surý	e4d30cb007	Print out input if dns_rdata_fromtext() fails in debug mode.	2020-08-18 11:04:05 +02:00
Mark AndrewsandOndřej Surý	2e748ba397	Add the ability to specify an input file	2020-08-18 11:04:05 +02:00
Ondřej Surý	be8c589f28	Add CHANGES note for GL !3942	2020-08-18 10:27:37 +02:00
Ondřej Surý	ba2376b9e0	Update and cleanup the readline library support This commit updates and simplifies the checks for the readline support in nslookup and nsupdate: * Change the autoconf checks to pkg-config only, all supported libraries have accompanying .pc files now. * Add editline support in addition to libedit and GNU readline * Add isc/readline.h shim header that defines dummy readline() function when no readline library is available	2020-08-18 10:27:14 +02:00
Michal Nowak	99ca842e0a	Merge branch 'mnowak/gcovr' into 'main' Report coverage with gcovr Closes isc-private/bind-qa#23 See merge request isc-projects/bind9!3606	2020-08-17 15:21:41 +00:00
Michal Nowak	8d15bef0dd	Report coverage with gcovr	2020-08-17 17:19:32 +02:00
Michal Nowak	d5350db5bc	Merge branch 'mnowak/broaden-abi-check-scope' into 'main' Broaden scope of abi-check See merge request isc-projects/bind9!3927	2020-08-17 13:07:15 +00:00
Michal Nowak	8e43f5e860	Broaden scope of abi-check For abi-check we should use as broad 'configure' options as possible.	2020-08-17 14:58:32 +02:00
Mark Andrews	f85bb0691c	Merge branch 'patch-3' into 'main' Option -s is not supported in tsig-keygen See merge request isc-projects/bind9!3966	2020-08-17 02:35:33 +00:00
JP Mens	b01d26c608	Option -s is not supported in tsig-keygen	2020-08-16 16:23:48 +00:00
Mark Andrews	4005cc3864	Merge branch 'marka-bad-bool-value' into 'main' Ensure that a bool is stored in 'eol' See merge request isc-projects/bind9!3960	2020-08-14 04:42:23 +00:00
Mark Andrews	8b75833aaa	Ensure that a bool is stored in 'eol' oss-fuzz: Issue 24875: bind9:isc_lex_getmastertoken_fuzzer: Invalid-bool-value in isc_lex_getmastertoken.c	2020-08-14 08:35:17 +10:00
Ondřej Surý	53f229f499	Merge branch 'ondrej/fix-oss-fuzz-debug' into 'main' Move the debug variable from main.c to individual fuzzer See merge request isc-projects/bind9!3959	2020-08-13 16:00:08 +00:00
Ondřej Surý	915616a34e	Move the debug variable from main.c to individual fuzzer The fuzzers needs to be completely independent of the main.c for OSS-Fuzz to work.	2020-08-13 17:55:38 +02:00
Mark Andrews	dd29e2550c	Merge branch 'marka-fuzz-fixes' into 'main' Add issues found by dns_rdata_fromwiretext fuzzer. See merge request isc-projects/bind9!3953	2020-08-13 14:08:50 +00:00
Mark Andrews	80d69ba04c	Add CHANGES note	2020-08-13 23:16:18 +10:00
Mark Andrews	7ae055cef1	Add previously detected dns_rdata_fromwire_text failures	2020-08-13 23:16:18 +10:00
Mark Andrews	7e49689746	X25: Check that record is all ASCII digits	2020-08-13 23:06:55 +10:00
Mark Andrews	9d446142d8	WKS: reject records with zero octets at the end of the bitmap	2020-08-13 23:06:55 +10:00
Mark Andrews	3429c35f52	TLSA: fix fromwire length checks	2020-08-13 23:06:55 +10:00
Mark Andrews	9b93e5d684	SIG: reject records with a zero length signature	2020-08-13 23:06:55 +10:00
Mark Andrews	73dd849655	NXT: fix fromwire bitmap checks	2020-08-13 23:06:55 +10:00
Mark Andrews	7dc8e720ff	NSEC3PARAM: check that saltlen is consistent with the rdata length	2020-08-13 23:06:55 +10:00
Mark Andrews	031ee9e279	NSEC3: reject records with a zero length hash field	2020-08-13 23:06:55 +10:00
Mark Andrews	d7f7014803	IPSECKEY: require non-zero length public keys	2020-08-13 23:06:55 +10:00
Mark Andrews	a238f37239	CERT: reject records with a empty certificate field	2020-08-13 23:06:55 +10:00
Mark Andrews	3c492b3ef1	Get rid of type 'RESERVED0'.	2020-08-13 23:06:55 +10:00
Mark Andrews	a92d973430	dns_rdata_fromwire_text fixes: * Disallow compression pointers in names as we are not reading from a packet and as a result length checks fail. * Increase totext buffer size as fuzzer ran out of space on big bitmaps. * NUL terminate totext to make fault diagnosis easier. * Add debugging messages to make fault diagnosie easier.	2020-08-13 23:06:55 +10:00
Mark Andrews	6c7e50c267	base32_decode*() could incorrectly decode a input. base32_decode_char() added a extra zero octet to the output if the fifth character was a pad character. The length of octets to copy to the output was set to 3 instead of 2.	2020-08-13 23:06:55 +10:00
Matthijs Mekking	9bb966d579	Merge branch 'matthijs-fix-kasp-test-next-key-event' into 'main' Update check next key events after rndc checkds See merge request isc-projects/bind9!3937	2020-08-13 10:04:10 +00:00
Matthijs Mekking	262b52a154	Fix check next key event check in kasp test Prevent intermittent false positives on slow platforms by subtracting the number of seconds which passed between key creation and invoking 'rndc dnssec -checkds'. This particularly fails for the step3.csk-roll2.autosign zone because the closest next key event is when the zone signatures become omnipresent. Running 'rndc dnssec -checkds' some time later means that the next key event is in fact closer than the calculated time and thus we need to adjust the expected time by the time already passed.	2020-08-13 10:30:31 +02:00
Ondřej Surý	eeb8b80547	Merge branch 'marka-handle-eof' into 'main' Address infinite loop on EOF. See merge request isc-projects/bind9!3954	2020-08-13 07:21:19 +00:00
Mark Andrews	c59ab04f6f	Address infinite loop on EOF.	2020-08-13 16:42:40 +10:00
Ondřej Surý	191887ef2b	Merge branch 'ondrej/oss-fuzz' into 'main' Couple of minor changes to the autoconf for the OSS-Fuzz project See merge request isc-projects/bind9!3951	2020-08-12 20:56:50 +00:00
Ondřej Surý	f9aba90342	Add explicit support of OSS-Fuzz The --enable-fuzzing option now allows third choice "ossfuzz" that just adds $LIB_FUZZING_ENGINE to FUZZ_LDFLAGS to make the fuzzer builds compatible with OSS-Fuzz project that has some special quirks (the main() routine is provided in the static library the project provides).	2020-08-12 21:58:45 +02:00
Ondřej Surý	eb0d5a9526	Allow static linking in the developer mode Previously, we have disallowed static linking (for good reasons). However, there are legitimate reasons where static linking might be useful, and one of the reasons is the OSS-Fuzz project that doesn't have the libraries used for build, so static linking is the sane option here. The static linking is still disallowed in the "production" builds, but it's not possible to disable shared and enable static libraries when used together with --enable-developer.	2020-08-12 21:56:37 +02:00
Ondřej Surý	c8538c50b4	Merge branch '2064-fix-isc_lex_getmastertoken-fuzzing' into 'main' Really fuzz isc_lex_getmastertoken() in the test Closes #2064 See merge request isc-projects/bind9!3949	2020-08-12 19:53:49 +00:00
Ondřej SurýandOndřej Surý	790476332e	Really fuzz isc_lex_getmastertoken() in the test There was a copy&paste error in fuzz/isc_lex_getmastertoken.c where we didn't really test the function we wanted to test. Update the test to have the input data to always include expected 'tokentype' in the first byte, `eol` argument in the second byte and the rest of the input is the data to parse.	2020-08-12 21:49:31 +02:00
Michal Nowak	88ad7b85e6	Merge branch 'mnowak/fix-core-dumps-were-found-line' into 'main' Make sure .txt files are not identified as crashed test See merge request isc-projects/bind9!3909	2020-08-12 07:48:05 +00:00
Michal Nowak	c2dcd95966	Make sure .txt files are not identified as crashed test Previously .txt files with full backtrace may be identified as a crashed test: I:Core dumps were found for the following system tests: I: core.19948-backtrace.txt I: shutdown Now .txt files are removed from the list. Change 'run.sh.in' to match the core matching pattern in 'testsummary.sh'.	2020-08-12 09:45:56 +02:00
Mark Andrews	852a2d834f	Merge branch '2045-readline-rltypedefs-h-35-22-error-this-function-declaration-is-not-a-prototype-on-netbsd-9' into 'main' Resolve "readline/rltypedefs.h:35:22: error: this function declaration is not a prototype on NetBSD 9" Closes #2045 See merge request isc-projects/bind9!3926	2020-08-11 23:34:55 +00:00
Mark Andrews	fd126553d4	Ensure rl_message() gets prototype.	2020-08-11 23:21:17 +00:00
Mark Andrews	1532a34658	Stop deprecated functions being defined	2020-08-11 23:21:17 +00:00
Michal Nowak	a53a0a8df1	Merge branch 'mnowak/run-tarball-tests-in-schedule' into 'main' Run unit and system tarball tests on schedules See merge request isc-projects/bind9!3928	2020-08-11 14:59:35 +00:00
Michal Nowak	439fe9bc3c	Run unit and system tarball tests on schedules To prevent problems with unit and system tarball tests being revealed during release process, run these tests on schedules.	2020-08-11 16:58:28 +02:00
Mark Andrews	ba6af6d507	Merge branch '2067-nta-related-crash-in-checkbogus-after-an-rndc-reload' into 'main' Resolve "NTA-related crash in checkbogus() after an "rndc reload"" Closes #2067 See merge request isc-projects/bind9!3930	2020-08-11 01:45:43 +00:00
Mark Andrews	0b2555e8cf	Address use after free between view, resolver and nta. Hold a weak reference to the view so that it can't go away while nta is performing its lookups. Cancel nta timers once all external references to the view have gone to prevent them triggering new work.	2020-08-11 11:00:49 +10:00
Mark Andrews	f9537a6f2a	Merge branch '2027-update-managed-keys-log-messages' into 'main' Resolve "Slightly misleading diagnostic when revoked key is removed from managed-keys zone" Closes #2027 See merge request isc-projects/bind9!3934	2020-08-11 00:54:39 +00:00
Mark Andrews	c9f019c931	Update managed keys log messages to be less confusing.	2020-08-11 00:10:10 +00:00
Evan Hunt	fec73c7e79	Merge branch 'each-fix-typo' into 'main' fix ARM typo See merge request isc-projects/bind9!3938	2020-08-10 19:38:49 +00:00
Evan Hunt	a69afb37e0	fix ARM typo	2020-08-10 12:36:29 -07:00
Michał Kępień	e151eb3aa3	Merge branch '1775-pick-smaller-default-rbt-hash-table-size' into 'main' Reduce the default rbt hashtable size to 16 entries (4 bits) Closes #1775 See merge request isc-projects/bind9!3935	2020-08-10 09:29:16 +00:00
Ondřej Surý	1e043a011b	Reduce the default RBT hash table size to 16 entries (4 bits) The hash table rework MRs (!3865, !3871) increased the default RBT hash table size from 64 to 65,536 entries (for 64-bit architectures, that is 512 bytes before vs. 524,288 bytes after). This works fine for RBTs used for cache databases, but since three separate RBT databases are created for every zone loaded (RRs, NSEC, NSEC3), memory usage would skyrocket when BIND 9 is used as an authoritative DNS server with many zones. The default RBT hash table size before the rework was 64 entries, this commit reduces it to 16 entries because our educated guess is that most zones are just couple of entries (SOA, NS, A, AAAA, MX) and rehashing small hash tables is actually cheap. The rework we did in the previous MRs tries to avoid growing the hash tables for big-to-huge caches where growing the hash table comes at a price because the whole cache needs to be locked.	2020-08-10 10:31:19 +02:00
Michal Nowak	cde7f982eb	Merge branch 'michal/do-not-run-make-recheck-if-the-test-suite-fails' into 'main' Do not run "make recheck" if the test suite fails See merge request isc-projects/bind9!3932	2020-08-07 14:38:38 +00:00
Michał Kępień	5a4076fc40	Do not run "make recheck" if the test suite fails Running "make recheck" after the test suite fails hides intermittent system test failures in GitLab CI. This makes it hard to identify which branches are affected by a particular test failure mode and causes CI results to be overly optimistic. Prevent "make recheck" from being run when "make check" fails to ensure GitLab CI results properly reflect the stability of the "main" branch.	2020-08-07 14:35:05 +02:00
Matthijs Mekking	82e9287459	Merge branch '1613-rndc-dnssec-checkds' into 'main' Resolve "Signal DS submitting via rndc" Closes #1613 See merge request isc-projects/bind9!3906	2020-08-07 11:19:09 +00:00
Matthijs Mekking	46fcd927e7	rndc dnssec -checkds set algorithm In the rare case that you have multiple keys acting as KSK and that have the same keytag, you can now set the algorithm when calling '-checkds'.	2020-08-07 11:26:09 +02:00
Matthijs Mekking	e4c82fc7ae	Add notes for #1613 (rndc dnssec -checkds) This is a new feature that should be mentioned in the notes.	2020-08-07 11:26:09 +02:00
Matthijs Mekking	a43bb41909	Test 'rndc dnssec -checkds' on multiple zones Make sure the 'checkds' command correctly sets the right key timing metadata and also make sure that it rejects setting the key timing metadata if there are multiple keys with the KSK role and no key identifier is provided.	2020-08-07 11:26:09 +02:00
Matthijs Mekking	a25f49f153	Make 'parent-registration-delay' obsolete With the introduction of 'checkds', the 'parent-registration-delay' option becomes obsolete.	2020-08-07 11:26:09 +02:00
Matthijs Mekking	38cb43bc86	Adjust kasp tests to use 'checkds' With 'checkds' replacing 'parent-registration-delay', the kasp test needs the expected times to be adjusted. Also the system test needs to call 'rndc dnssec -checkds' to progress the rollovers. Since we pretend that the KSK is active as soon as the DS is submitted (and parent registration delay is no longer applicable) we can simplify the 'csk_rollover_predecessor_keytimes' function to take only one "addtime" parameter. This commit also slightly changes the 'check_dnssecstatus' function, passing the zone as a parameter.	2020-08-07 11:26:09 +02:00
Matthijs Mekking	e3eb55fd1c	Fix time printing in key files Don't strip off the final character when printing times in key files. With the introduction of 'rndc dnssec -status' we introduced 'isc_stdtime_tostring()'. This changed in behavior such that it was no longer needed to strip of the final '\n' of the string format datetime. However, in 'printtime()' it still stripped the final character.	2020-08-07 11:26:09 +02:00
Matthijs Mekking	04d8fc0143	Implement 'rndc dnssec -checkds' Add a new 'rndc' command 'dnssec -checkds' that allows the user to signal named that a new DS record has been seen published in the parent, or that an existing DS record has been withdrawn from the parent. Upon the 'checkds' request, 'named' will write out the new state for the key, updating the 'DSPublish' or 'DSRemoved' timing metadata. This replaces the "parent-registration-delay" configuration option, this was unreliable because it was purely time based (if the user did not actually submit the new DS to the parent for example, this could result in an invalid DNSSEC state). Because we cannot rely on the parent registration delay for state transition, we need to replace it with a different guard. Instead, if a key wants its DS state to be moved to RUMOURED, the "DSPublish" time must be set and must not be in the future. If a key wants its DS state to be moved to UNRETENTIVE, the "DSRemoved" time must be set and must not be in the future. By default, with '-checkds' you set the time that the DS has been published or withdrawn to now, but you can set a different time with '-when'. If there is only one KSK for the zone, that key has its DS state moved to RUMOURED. If there are multiple keys for the zone, specify the right key with '-key'.	2020-08-07 11:26:09 +02:00
				`@@ -0,0 +1 @@`
				`�000000000000000000000000��00�0�00000000000000000000�00�0000`
				`@@ -0,0 +1 @@`
				`�00�00000000000000000000000000000000�000000000000`
				`@@ -0,0 +1 @@`
				`o0000000000000000000000000000»΅00000000000β000ο0»00»0θ°ο�000��000�0`
				`@@ -0,0 +1 @@`
				`10000000000000000000000000000000000000000000��`