Minor tone edits during review with Vicky

2020-07-09 22:48:16 +00:00
422 changed files with 3487 additions and 5467 deletions
@@ -44,7 +44,9 @@ stages:

 ### Runner Tag Templates

-.libvirt-amd64: &libvirt_amd64
+# Note: BSD runners extract the operating system version to use from job name
+
+.freebsd-amd64: &freebsd_amd64
  tags:
    - libvirt
    - amd64
@@ -54,11 +56,21 @@ stages:
    - linux
    - amd64

+.linux-arm64: &linux_arm64
+  tags:
+    - linux
+    - arm64
+
 .linux-i386: &linux_i386
  tags:
    - linux
    - i386

+.openbsd-amd64: &openbsd_amd64
+  tags:
+    - libvirt
+    - amd64
+
 ### Docker Image Templates

 # Alpine Linux
@@ -69,6 +81,10 @@ stages:

 # CentOS

+.centos-centos6-amd64: &centos_centos6_amd64_image
+  image: "$CI_REGISTRY_IMAGE:centos-centos6-amd64"
+  <<: *linux_amd64
+
 .centos-centos7-amd64: &centos_centos7_amd64_image
  image: "$CI_REGISTRY_IMAGE:centos-centos7-amd64"
  <<: *linux_amd64
@@ -91,6 +107,10 @@ stages:
  image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
  <<: *linux_amd64

+.debian-sid-arm64: &debian_sid_arm64_image
+  image: "$CI_REGISTRY_IMAGE:debian-sid-arm64"
+  <<: *linux_arm64
+
 .debian-sid-i386: &debian_sid_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-i386"
  <<: *linux_i386
@@ -123,20 +143,6 @@ stages:
 .base: &base_image
  <<: *debian_buster_amd64_image

-### QCOW2 Image Templates
-
-.freebsd-11-amd64: &freebsd_11_amd64_image
-  image: "freebsd-11.4-x86_64"
-  <<: *libvirt_amd64
-
-.freebsd-12-amd64: &freebsd_12_amd64_image
-  image: "freebsd-12.1-x86_64"
-  <<: *libvirt_amd64
-
-.openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-6.7-x86_64"
-  <<: *libvirt_amd64
-
 ### Job Templates

 .default-triggering-rules: &default_triggering_rules
@@ -174,10 +180,13 @@ stages:
    ${CONFIGURE} \
    --disable-maintainer-mode \
    --enable-developer \
+    --with-libtool \
    --with-cmocka \
    --with-libxml2 \
    --with-json-c \
    --prefix=$HOME/.local \
+    --without-make-clean \
+    --with-python=python3 \
    $EXTRA_CONFIGURE \
    || cat config.log

@@ -388,7 +397,6 @@ misc:
    - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
    - sh util/check-win32util-configure
    - sh util/check-categories.sh
-    - if git grep SYSTEMTESTTOP -- ':!.gitlab-ci.yml'; then echo 'Please use relative paths instead of $SYSTEMTESTTOP.'; exit 1; fi
  needs: []
  artifacts:
    paths:
@@ -452,7 +460,6 @@ pylint:
 tarball-create:
  stage: precheck
  <<: *base_image
-  <<: *default_triggering_rules
  script:
    - *configure
    - make -j${BUILD_PARALLEL_JOBS:-1} all V=1
@@ -463,6 +470,8 @@ tarball-create:
  needs:
    - job: autoreconf
      artifacts: true
+  only:
+    - tags

 # Jobs for doc builds on Debian 10 "buster" (amd64)

@@ -523,6 +532,30 @@ unit:gcc:alpine3.12:amd64:
    - job: gcc:alpine3.12:amd64
      artifacts: true

+# Jobs for regular GCC builds on CentOS 6 (amd64)
+
+gcc:centos6:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2 --disable-warn-error --without-python"
+  <<: *centos_centos6_amd64_image
+  <<: *build_job
+
+system:gcc:centos6:amd64:
+  <<: *centos_centos6_amd64_image
+  <<: *system_test_job
+  needs:
+    - job: gcc:centos6:amd64
+      artifacts: true
+
+unit:gcc:centos6:amd64:
+  <<: *centos_centos6_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: gcc:centos6:amd64
+      artifacts: true
+
 # Jobs for regular GCC builds on CentOS 7 (amd64)

 gcc:centos7:amd64:
@@ -734,13 +767,37 @@ unit:gcc:tarball:
  only:
    - tags

+# Jobs for regular GCC builds on Debian "sid" (arm64)
+
+gcc:sid:arm64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_sid_arm64_image
+  <<: *build_job
+
+system:gcc:sid:arm64:
+  <<: *debian_sid_arm64_image
+  <<: *system_test_job
+  needs:
+    - job: gcc:sid:arm64
+      artifacts: true
+
+unit:gcc:sid:arm64:
+  <<: *debian_sid_arm64_image
+  <<: *unit_test_job
+  needs:
+    - job: gcc:sid:arm64
+      artifacts: true
+
 # Jobs for regular GCC builds on Debian "sid" (i386)

 gcc:sid:i386:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-python"
  <<: *debian_sid_i386_image
  <<: *build_job

@@ -764,7 +821,7 @@ gcc:tumbleweed:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2 --with-gssapi=/usr/lib/mit/bin/krb5-config"
+    EXTRA_CONFIGURE: "--with-libidn2 --with-python --with-gssapi=/usr/lib/mit/bin/krb5-config"
  <<: *tumbleweed_latest_amd64_image
  <<: *build_job

@@ -972,6 +1029,7 @@ clang:buster:amd64:
  variables:
    CC: ${CLANG}
    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
+    EXTRA_CONFIGURE: "--with-python=python3"
  <<: *debian_buster_amd64_image
  <<: *build_job

@@ -1037,75 +1095,78 @@ unit:gcc:softhsm2.6:
    - job: gcc:softhsm2.6
      artifacts: true

-# Jobs for Clang builds on FreeBSD 11 (amd64)
+# Jobs for Clang builds on FreeBSD 11.4 (amd64)

-clang:freebsd11:amd64:
+clang:freebsd11.4:amd64:
  variables:
    CFLAGS: "${CFLAGS_COMMON}"
    USER: gitlab-runner
-  <<: *freebsd_11_amd64_image
+    # Temporarily disable LMDB support [GL #1976]
+    EXTRA_CONFIGURE: "--without-lmdb"
+  <<: *freebsd_amd64
  <<: *build_job

-system:clang:freebsd11:amd64:
-  <<: *freebsd_11_amd64_image
+system:clang:freebsd11.4:amd64:
+  <<: *freebsd_amd64
  <<: *system_test_job
  variables:
    USER: gitlab-runner
    TEST_PARALLEL_JOBS: 4
  needs:
-    - job: clang:freebsd11:amd64
+    - job: clang:freebsd11.4:amd64
      artifacts: true

-unit:clang:freebsd11:amd64:
-  <<: *freebsd_11_amd64_image
+unit:clang:freebsd11.4:amd64:
+  <<: *freebsd_amd64
  <<: *unit_test_job
  needs:
-    - job: clang:freebsd11:amd64
+    - job: clang:freebsd11.4:amd64
      artifacts: true

-# Jobs for Clang builds on FreeBSD 12 (amd64)
+# Jobs for Clang builds on FreeBSD 12.1 (amd64)

-clang:freebsd12:amd64:
+clang:freebsd12.1:amd64:
  variables:
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--enable-dnstap"
+    # Temporarily disable LMDB support [GL #1976]
+    EXTRA_CONFIGURE: "--enable-dnstap --without-lmdb"
    USER: gitlab-runner
-  <<: *freebsd_12_amd64_image
+  <<: *freebsd_amd64
  <<: *build_job

-system:clang:freebsd12:amd64:
-  <<: *freebsd_12_amd64_image
+system:clang:freebsd12.1:amd64:
+  <<: *freebsd_amd64
  <<: *system_test_job
  variables:
    USER: gitlab-runner
    TEST_PARALLEL_JOBS: 4
  needs:
-    - job: clang:freebsd12:amd64
+    - job: clang:freebsd12.1:amd64
      artifacts: true

-unit:clang:freebsd12:amd64:
-  <<: *freebsd_12_amd64_image
+unit:clang:freebsd12.1:amd64:
+  <<: *freebsd_amd64
  <<: *unit_test_job
  needs:
-    - job: clang:freebsd12:amd64
+    - job: clang:freebsd12.1:amd64
      artifacts: true

-# Jobs for Clang builds on OpenBSD (amd64)
+# Jobs for Clang builds on OpenBSD 6.7 (amd64)

-clang:openbsd:amd64:
+clang:openbsd6.7:amd64:
  variables:
    CC: clang
    USER: gitlab-runner
-  <<: *openbsd_amd64_image
+  <<: *openbsd_amd64
  <<: *build_job

-system:clang:openbsd:amd64:
-  <<: *openbsd_amd64_image
+system:clang:openbsd6.7:amd64:
+  <<: *openbsd_amd64
  <<: *system_test_job
  variables:
    USER: gitlab-runner
  needs:
-    - job: clang:openbsd:amd64
+    - job: clang:openbsd6.7:amd64
      artifacts: true
  only:
    - schedules
@@ -1258,13 +1319,13 @@ respdiff:
    BIND_BASELINE_VERSION: v9_11_3
  script:
    - autoreconf -fi
-    - ./configure
+    - ./configure --without-make-clean
    - make -j${BUILD_PARALLEL_JOBS:-1} V=1
    - *setup_interfaces
    - git clone --depth 1 https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.isc.org/isc-private/bind-qa.git
    - git clone --branch "${BIND_BASELINE_VERSION}" --depth 1 https://gitlab.isc.org/isc-projects/bind9.git refbind
    - cd refbind/
-    - ./configure
+    - ./configure --without-make-clean
    - make -j${BUILD_PARALLEL_JOBS:-1} V=1
    - cd ../bind-qa/bind9/respdiff
    - bash respdiff.sh -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}/refbind" "${CI_PROJECT_DIR}"
@@ -1291,7 +1352,7 @@ abi-check:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
-    BIND_BASELINE_VERSION: v9_17_3
+    BIND_BASELINE_VERSION: v9_17_2
  script:
    - *configure
    - make -j${BUILD_PARALLEL_JOBS:-1} V=1
@@ -67,7 +67,6 @@
 - [ ] ***(SwEng)*** Push tags for the published releases to the public repository.
 - [ ] ***(QA)*** For each maintained branch, update the `BIND_BASELINE_VERSION` variable for the `abi-check` job in `.gitlab-ci.yml` to the latest published BIND version tag for a given branch.
 - [ ] ***(QA)*** Prepare empty release notes for the next set of releases.
- - [ ] ***(QA)*** Sanitize all confidential issues assigned to the release milestone and make them public.
 - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.

 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
@@ -1,125 +1,15 @@
-	--- 9.17.4 released ---
-
-5485.	[placeholder]
-
-5484.	[func]		Expire zero TTL records quickly rather than using them
-			for stale answers. [GL #1829]
-
-5483.	[func]		Keeping "stale" answers in cache has been disabled by
-			default and can be re-enabled with a new configuration
-			option "stale-cache-enable". [GL #1712]
-
-5482.	[bug]		If the Duplicate Address Detection (DAD) mechanism had
-			not yet finished after adding a new IPv6 address to the
-			system, BIND 9 would fail to bind to IPv6 addresses in a
-			tentative state. [GL #2038]
-
-5481.	[security]	"update-policy" rules of type "subdomain" were
-			incorrectly treated as "zonesub" rules, which allowed
-			keys used in "subdomain" rules to update names outside
-			of the specified subdomains. The problem was fixed by
-			making sure "subdomain" rules are again processed as
-			described in the ARM. (CVE-2020-8624) [GL #2055]
-
-5480.	[security]	When BIND 9 was compiled with native PKCS#11 support, it
-			was possible to trigger an assertion failure in code
-			determining the number of bits in the PKCS#11 RSA public
-			key with a specially crafted packet. (CVE-2020-8623)
-			[GL #2037]
-
-5479.	[security]	named could crash in certain query resolution scenarios
-			where QNAME minimization and forwarding were both
-			enabled. (CVE-2020-8621) [GL #1997]
-
-5478.	[security]	It was possible to trigger an assertion failure by
-			sending a specially crafted large TCP DNS message.
-			(CVE-2020-8620) [GL #1996]
-
-5477.	[bug]		The idle timeout for connected TCP sockets, which was
-			previously set to a high fixed value, is now derived
-			from the client query processing timeout configured for
-			a resolver. [GL #2024]
-
-5476.	[security]	It was possible to trigger an assertion failure when
-			verifying the response to a TSIG-signed request.
-			(CVE-2020-8622) [GL #2028]
-
-5475.	[bug]		Wildcard RPZ passthru rules could incorrectly be
-			overridden by other rules that were loaded from RPZ
-			zones which appeared later in the "response-policy"
-			statement. This has been fixed. [GL #1619]
-
-5474.	[bug]		dns_rdata_hip_next() failed to return ISC_R_NOMORE
-			when it should have. [GL !3880]
-
-5473.	[func]		The RBT hash table implementation has been changed
-			to use a faster hash function (HalfSipHash2-4) and
-			Fibonacci hashing for better distribution. Setting
-			"max-cache-size" now preallocates a fixed-size hash
-			table so that rehashing does not cause resolution
-			brownouts while the hash table is grown. [GL #1775]
-
-5472.	[func]		The statistics channel has been updated to use the
-			new network manager. [GL #2022]
-
-5471.	[bug]		The introduction of KASP support inadvertently caused
-			the second field of "sig-validity-interval" to always be
-			calculated in hours, even in cases when it should have
-			been calculated in days. This has been fixed. (Thanks to
-			Tony Finch.) [GL !3735]
-
-5470.	[port]		gsskrb5_register_acceptor_identity() is now only called
-			if gssapi_krb5.h is present. [GL #1995]
-
-5469.	[port]		On illumos, a constant called SEC is already defined in
-			<sys/time.h>, which conflicts with an identically named
-			constant in libbind9. This conflict has been resolved.
-			[GL #1993]
-
-5468.	[bug]		Addressed potential double unlock in process_fd().
-			[GL #2005]
-
-5467.	[func]		The control channel and the rndc utility have been
-			updated to use the new network manager. To support
-			this, the network manager was updated to enable
-			the initiation of client TCP connections. Its
-			internal reference counting has been refactored.
-
-			Note: As a side effect of this change, rndc cannot
-			currently be used with UNIX-domain sockets, and its
-			default timeout has changed from 60 seconds to 30.
-			These will be addressed in a future release.
-			[GL #1759]
-
-5466.	[bug]		Addressed an error in recursive clients stats reporting.
-			[GL #1719]
-
-5465.	[func]		Added fallback to built-in trust-anchors, managed-keys,
-			or trusted-keys if the bindkeys-file (bind.keys) cannot
-			be parsed. [GL #1235]
-
-5464.	[bug]		Requesting more than 128 files to be saved when rolling
-			dnstap log files caused a buffer overflow. This has been
-			fixed. [GL #1989]
-
-5463.	[placeholder]
-
-5462.	[bug]		Move LMDB locking from LMDB itself to named. [GL #1976]
-
-5461.	[bug]		The STALE rdataset header attribute was updated while
-			the write lock was not being held, leading to incorrect
-			statistics. The header attributes are now converted to
-			use atomic operations. [GL #1475]
+5461.	[bug]		The header STALE attribute was not being updated with
+			the write lock being held leading to incorrect
+			statistics.  Convert the header attributes to use atomic
+			operations. [GL #1475]

 5460.	[cleanup]	tsig-keygen was previously an alias for
 			ddns-confgen and was documented in the ddns-confgen
 			man page. This has been reversed; tsig-keygen is
 			now the primary name. [GL #1998]

-5459.	[bug]		Fixed bad isc_mem_put() size when an invalid type was
-			specified in an "update-policy" rule. [GL #1990]
-
-	--- 9.17.3 released ---
+5459.	[bug]		Bad isc_mem_put() size when an invalid type was
+			specified in a update-policy rule. [GL #1990]

 5458.	[bug]		Prevent a theoretically possible NULL dereference caused
 			by a data race between zone_maintenance() and
@@ -129,21 +19,23 @@

 5456.	[func]		Added "primaries" as a synonym for "masters" in
 			named.conf, and "primary-only" as a synonym for
-			"master-only" in the parameters to "notify", to bring
-			terminology up-to-date with RFC 8499. [GL #1948]
+			"master-only" in the parameters to "notify",
+			in order to bring terminology up to date with
+			RFC 8499. [GL #1948]

-5455.	[bug]		named could crash when cleaning dead nodes in
-			lib/dns/rbtdb.c that were being reused. [GL #1968]
+5455.	[bug]		`named` could crash when cleaning dead nodes
+			in lib/dns/rbtdb.c that have been reused meanwhile.
+			[GL #1968]

-5454.	[bug]		Address a startup crash that occurred when the server
-			was under load and the root zone had not yet been
-			loaded. [GL #1862]
+5454.	[bug]		Address a startup crash happening when server is
+			under load and root zone is not yet loaded. [GL #1862]

-5453.	[bug]		named crashed on shutdown when a new rndc connection was
-			received during shutdown. [GL #1747]
+5453.	[bug]		`named` would crash on shutdown when new `rndc`
+			connection is received at the same time as
+			shutting down. [GL #1747]

-5452.	[bug]		The "blackhole" ACL was accidentally disabled for client
-			queries. [GL #1936]
+5452.	[bug]		The "blackhole" ACL was accidentally disabled with
+			respect to client queries. [GL #1936]

 5451.	[func]		Add 'rndc dnssec -status' command. [GL #1612]

@@ -161,14 +53,14 @@

 5446.	[bug]		The validator could fail to accept a properly signed
 			RRset if an unsupported algorithm appeared earlier in
-			the DNSKEY RRset than a supported algorithm. It could
+			the DNSKEY RRset than a supported algorithm.  It could
 			also stop if it detected a malformed public key.
 			[GL #1689]

 5445.	[cleanup]	Disable and disallow static linking. [GL #1933]

-5444.	[bug]		'rndc dnstap -roll <value>' did not limit the number of
-			saved files to <value>. [GL !3728]
+5444.	[bug]		'rndc dnstap -roll <value>' was not limiting the
+			number of saved files to <value>. [GL !3728]

 5443.	[bug]		The "primary" and "secondary" keywords, when used
 			as parameters for "check-names", were not
@@ -181,8 +73,8 @@

 5440.	[placeholder]

-5439.	[bug]		The DS RRset returned by dns_keynode_dsset() was used in
-			a non-thread-safe manner. [GL #1926]
+5439.	[bug]		The dsset returned by dns_keynode_dsset() was not
+			thread safe. [GL #1926]

 	--- 9.17.2 released ---

@@ -6,8 +6,8 @@ on every aspect of the mission - including mentorship, teaching, and connecting
 people.

 Diversity is one of our huge strengths, but it can also lead to communication
-issues and unhappiness. To that end, we have a few ground rules that we ask
-people to adhere to. This code applies equally to the core development team, open source contributors and those
+issues and unhappiness. To that end, we have a few ground rules to which we expect
+people to adhere. This code applies equally to the core development team, open source contributors and those
 seeking help and guidance.

 This isn't an exhaustive list of things that you can't do. Rather, take it in
@@ -1,6 +1,6 @@
 include $(top_srcdir)/Makefile.top

-SUBDIRS = . libltdl lib doc bin fuzz
+SUBDIRS = . libltdl lib doc bin

 BUILT_SOURCES = bind.keys.h
 CLEANFILES = bind.keys.h
@@ -185,8 +185,9 @@ command:
 Building on macOS assumes that the "Command Tools for Xcode" are installed.
 These can be downloaded from
 [https://developer.apple.com/download/more/](https://developer.apple.com/download/more/)
-or, if you have Xcode already installed, you can run `xcode-select --install`.
-(Note that an Apple ID may be required to access the download page.)
+or, if you have Xcode already installed, you can run
+`xcode-select--install`. (Note that an Apple ID may be required to access the download
+page.)

 #### <a name="dependencies"> Dependencies

@@ -207,6 +208,9 @@ installed:

 To see a full list of configuration options, run `configure --help`.

+To build shared libraries, specify `--with-libtool` on the `configure`
+command line.
+
 For the server to support DNSSEC, you need to build it with crypto support.
 To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed. If the
 OpenSSL library is installed in a nonstandard location, specify the prefix
@@ -15,7 +15,6 @@ AM_CPPFLAGS +=				\
 	$(LMDB_CFLAGS)			\
 	$(MAXMINDDB_CFLAGS)		\
 	$(DNSTAP_CFLAGS)		\
-	$(LIBUV_CFLAGS)			\
 	$(ZLIB_CFLAGS)

 if HAVE_JSON_C
@@ -103,7 +102,6 @@ named_LDADD =					\
 	$(LMDB_LIBS)				\
 	$(MAXMINDDB_LIBS)			\
 	$(DNSTAP_LIBS)				\
-	$(LIBUV_LIBS)				\
 	$(LIBXML2_LIBS)				\
 	$(ZLIB_LIBS)

@@ -196,7 +196,6 @@ options {\n\
 #	sortlist <none>\n\
 	stale-answer-enable false;\n\
 	stale-answer-ttl 1; /* 1 second */\n\
-	stale-cache-enable false;\n\
 	synth-from-dnssec no;\n\
 #	topology <none>\n\
 	transfer-format many-answers;\n\
@@ -38,7 +38,6 @@
 #define NAMED_EVENTCLASS    ISC_EVENTCLASS(0x4E43)
 #define NAMED_EVENT_RELOAD  (NAMED_EVENTCLASS + 0)
 #define NAMED_EVENT_DELZONE (NAMED_EVENTCLASS + 1)
-#define NAMED_EVENT_COMMAND (NAMED_EVENTCLASS + 2)

 /*%
 * Name server state.  Better here than in lots of separate global variables.
@@ -81,6 +80,8 @@ struct named_server {
 	uint32_t interface_interval;
 	uint32_t heartbeat_interval;

+	isc_mutex_t    reload_event_lock;
+	isc_event_t *  reload_event;
 	named_reload_t reload_status;

 	bool flushonshutdown;
@@ -16,7 +16,6 @@
 #include <stdbool.h>
 #include <stdlib.h>
 #include <string.h>
-#include <uv.h>

 #include <isc/app.h>
 #include <isc/attributes.h>
@@ -526,9 +525,6 @@ printversion(bool verbose) {
 	printf("linked to OpenSSL version: %s\n",
 	       SSLeay_version(SSLEAY_VERSION));
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-	printf("compiled with libuv version: %d.%d.%d\n", UV_VERSION_MAJOR,
-	       UV_VERSION_MINOR, UV_VERSION_PATCH);
-	printf("linked to libuv version: %s\n", uv_version_string());
 #ifdef HAVE_LIBXML2
 	printf("compiled with libxml2 version: %s\n", LIBXML_DOTTED_VERSION);
 	printf("linked to libxml2 version: %s\n", xmlParserVersion);
@@ -401,7 +401,6 @@ OPTIONS
  	stacksize ( default | unlimited | sizeval );
  	stale-answer-enable boolean;
  	stale-answer-ttl duration;
-  	stale-cache-enable boolean;
  	startup-notify-rate integer;
  	statistics-file quoted_string;
  	synth-from-dnssec boolean;
@@ -786,7 +785,6 @@ VIEW
  	sortlist { address_match_element; ... };
  	stale-answer-enable boolean;
  	stale-answer-ttl duration;
-  	stale-cache-enable boolean;
  	synth-from-dnssec boolean;
  	transfer-format ( many-answers | one-answer );
  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
@@ -3895,7 +3895,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	uint32_t max_cache_size_percent = 0;
 	size_t max_adb_size;
 	uint32_t lame_ttl, fail_ttl;
-	uint32_t max_stale_ttl = 0;
+	uint32_t max_stale_ttl;
 	dns_tsig_keyring_t *ring = NULL;
 	dns_view_t *pview = NULL; /* Production view */
 	isc_mem_t *cmctx = NULL, *hmctx = NULL;
@@ -4358,18 +4358,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	view->synthfromdnssec = cfg_obj_asboolean(obj);

 	obj = NULL;
-	result = named_config_get(maps, "stale-cache-enable", &obj);
+	result = named_config_get(maps, "max-stale-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	if (cfg_obj_asboolean(obj)) {
-		obj = NULL;
-		result = named_config_get(maps, "max-stale-ttl", &obj);
-		INSIST(result == ISC_R_SUCCESS);
-		max_stale_ttl = ISC_MAX(cfg_obj_asduration(obj), 1);
-	}
-	/*
-	 * If 'stale-cache-enable' is false, max_stale_ttl is set to 0,
-	 * meaning keeping stale RRsets in cache is disabled.
-	 */
+	max_stale_ttl = ISC_MAX(cfg_obj_asduration(obj), 1);

 	obj = NULL;
 	result = named_config_get(maps, "stale-answer-enable", &obj);
@@ -7583,8 +7574,6 @@ count_newzones(dns_view_t *view, ns_cfgctx_t *nzcfg, int *num_zonesp) {

 	REQUIRE(num_zonesp != NULL);

-	LOCK(&view->new_zone_lock);
-
 	CHECK(migrate_nzf(view));

 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -7607,8 +7596,6 @@ cleanup:
 		*num_zonesp = 0;
 	}

-	UNLOCK(&view->new_zone_lock);
-
 	return (ISC_R_SUCCESS);
 }

@@ -7937,8 +7924,6 @@ typedef isc_result_t (*newzone_cfg_cb_t)(const cfg_obj_t *zconfig,
 * Immediately interrupt processing if an error is encountered while
 * transforming NZD data into a zone configuration object or if "callback"
 * returns an error.
- *
- * Caller must hold 'view->new_zone_lock'.
 */
 static isc_result_t
 for_all_newzone_cfgs(newzone_cfg_cb_t callback, cfg_obj_t *config,
@@ -8047,11 +8032,8 @@ configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		return (ISC_R_SUCCESS);
 	}

-	LOCK(&view->new_zone_lock);
-
 	result = nzd_open(view, MDB_RDONLY, &txn, &dbi);
 	if (result != ISC_R_SUCCESS) {
-		UNLOCK(&view->new_zone_lock);
 		return (ISC_R_SUCCESS);
 	}

@@ -8077,9 +8059,6 @@ configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	}

 	(void)nzd_close(&txn, false);
-
-	UNLOCK(&view->new_zone_lock);
-
 	return (result);
 }

@@ -8100,8 +8079,6 @@ get_newzone_config(dns_view_t *view, const char *zonename,

 	INSIST(zoneconfig != NULL && *zoneconfig == NULL);

-	LOCK(&view->new_zone_lock);
-
 	CHECK(nzd_open(view, MDB_RDONLY, &txn, &dbi));

 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -8135,8 +8112,6 @@ get_newzone_config(dns_view_t *view, const char *zonename,
 cleanup:
 	(void)nzd_close(&txn, false);

-	UNLOCK(&view->new_zone_lock);
-
 	if (zoneconf != NULL) {
 		cfg_obj_destroy(named_g_addparser, &zoneconf);
 	}
@@ -8387,14 +8362,7 @@ load_configuration(const char *filename, named_server_t *server,

 		result = cfg_parse_file(bindkeys_parser, server->bindkeysfile,
 					&cfg_type_bindkeys, &bindkeys);
-		if (result != ISC_R_SUCCESS) {
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-				      "unable to parse '%s' error '%s'; using "
-				      "built-in keys instead",
-				      server->bindkeysfile,
-				      isc_result_totext(result));
-		}
+		CHECK(result);
 	} else {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
@@ -9673,7 +9641,7 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 		isc_refcount_increment(&zl->refs);
 		result = dns_view_asyncload(view, reconfig, view_loaded, zl);
 		if (result != ISC_R_SUCCESS) {
-			isc_refcount_decrement1(&zl->refs);
+			(void)isc_refcount_decrement(&zl->refs);
 			goto cleanup;
 		}
 	}
@@ -9945,6 +9913,14 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 				     &server->in_roothints),
 		   "setting up root hints");

+	isc_mutex_init(&server->reload_event_lock);
+
+	server->reload_event = isc_event_allocate(
+		named_g_mctx, server, NAMED_EVENT_RELOAD, named_server_reload,
+		server, sizeof(isc_event_t));
+	CHECKFATAL(server->reload_event == NULL ? ISC_R_NOMEMORY
+						: ISC_R_SUCCESS,
+		   "allocating reload event");
 	server->reload_status = NAMED_RELOAD_IN_PROGRESS;

 	/*
@@ -10114,6 +10090,9 @@ named_server_destroy(named_server_t **serverp) {

 	dst_lib_destroy();

+	isc_event_free(&server->reload_event);
+	isc_mutex_destroy(&server->reload_event_lock);
+
 	INSIST(ISC_LIST_EMPTY(server->kasplist));
 	INSIST(ISC_LIST_EMPTY(server->viewlist));
 	INSIST(ISC_LIST_EMPTY(server->cachelist));
@@ -10125,7 +10104,7 @@ named_server_destroy(named_server_t **serverp) {

 static void
 fatal(named_server_t *server, const char *msg, isc_result_t result) {
-	if (server != NULL && server->task != NULL) {
+	if (server != NULL) {
 		/*
 		 * Prevent races between the OpenSSL on_exit registered
 		 * function and any other OpenSSL calls from other tasks
@@ -10291,7 +10270,7 @@ cleanup:
 */
 static void
 named_server_reload(isc_task_t *task, isc_event_t *event) {
-	named_server_t *server = (named_server_t *)event->ev_sender;
+	named_server_t *server = (named_server_t *)event->ev_arg;

 	INSIST(task == server->task);
 	UNUSED(task);
@@ -10301,15 +10280,19 @@ named_server_reload(isc_task_t *task, isc_event_t *event) {
 		      "received SIGHUP signal to reload zones");
 	(void)reload(server);

-	isc_event_free(&event);
+	LOCK(&server->reload_event_lock);
+	INSIST(server->reload_event == NULL);
+	server->reload_event = event;
+	UNLOCK(&server->reload_event_lock);
 }

 void
 named_server_reloadwanted(named_server_t *server) {
-	isc_event_t *event = isc_event_allocate(
-		named_g_mctx, server, NAMED_EVENT_RELOAD, named_server_reload,
-		NULL, sizeof(isc_event_t));
-	isc_task_send(server->task, &event);
+	LOCK(&server->reload_event_lock);
+	if (server->reload_event != NULL) {
+		isc_task_send(server->task, &server->reload_event);
+	}
+	UNLOCK(&server->reload_event_lock);
 }

 void
@@ -12080,10 +12063,12 @@ cleanup:

 isc_result_t
 named_server_tsiglist(named_server_t *server, isc_buffer_t **text) {
-	isc_result_t result = ISC_R_SUCCESS;
+	isc_result_t result;
 	dns_view_t *view;
 	unsigned int foundkeys = 0;

+	result = isc_task_beginexclusive(server->task);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
@@ -12092,6 +12077,7 @@ named_server_tsiglist(named_server_t *server, isc_buffer_t **text) {
 				       &foundkeys);
 		RWUNLOCK(&view->statickeys->lock, isc_rwlocktype_read);
 		if (result != ISC_R_SUCCESS) {
+			isc_task_endexclusive(server->task);
 			return (result);
 		}
 		RWLOCK(&view->dynamickeys->lock, isc_rwlocktype_read);
@@ -12099,9 +12085,11 @@ named_server_tsiglist(named_server_t *server, isc_buffer_t **text) {
 				       &foundkeys);
 		RWUNLOCK(&view->dynamickeys->lock, isc_rwlocktype_read);
 		if (result != ISC_R_SUCCESS) {
+			isc_task_endexclusive(server->task);
 			return (result);
 		}
 	}
+	isc_task_endexclusive(server->task);

 	if (foundkeys == 0) {
 		CHECK(putstr(text, "no tsig keys found."));
@@ -12581,6 +12569,8 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,

 	nzd_setkey(&key, dns_zone_getorigin(zone), namebuf, sizeof(namebuf));

+	LOCK(&view->new_zone_lock);
+
 	if (zconfig == NULL) {
 		/* We're deleting the zone from the database */
 		status = mdb_del(*txnp, dbi, &key, NULL);
@@ -12660,6 +12650,8 @@ cleanup:
 	}
 	*txnp = NULL;

+	UNLOCK(&view->new_zone_lock);
+
 	if (text != NULL) {
 		isc_buffer_free(&text);
 	}
@@ -12667,11 +12659,6 @@ cleanup:
 	return (result);
 }

-/*
- * Check whether the new zone database for 'view' can be opened for writing.
- *
- * Caller must hold 'view->new_zone_lock'.
- */
 static isc_result_t
 nzd_writable(dns_view_t *view) {
 	isc_result_t result = ISC_R_SUCCESS;
@@ -12701,11 +12688,6 @@ nzd_writable(dns_view_t *view) {
 	return (result);
 }

-/*
- * Open the new zone database for 'view' and start a transaction for it.
- *
- * Caller must hold 'view->new_zone_lock'.
- */
 static isc_result_t
 nzd_open(dns_view_t *view, unsigned int flags, MDB_txn **txnp, MDB_dbi *dbi) {
 	int status;
@@ -12833,13 +12815,6 @@ cleanup:
 	return (result);
 }

-/*
- * If 'commit' is true, commit the new zone database transaction pointed to by
- * 'txnp'; otherwise, abort that transaction.
- *
- * Caller must hold 'view->new_zone_lock' for the view that the transaction
- * pointed to by 'txnp' was started for.
- */
 static isc_result_t
 nzd_close(MDB_txn **txnp, bool commit) {
 	isc_result_t result = ISC_R_SUCCESS;
@@ -12862,12 +12837,6 @@ nzd_close(MDB_txn **txnp, bool commit) {
 	return (result);
 }

-/*
- * Count the zones configured in the new zone database for 'view' and store the
- * result in 'countp'.
- *
- * Caller must hold 'view->new_zone_lock'.
- */
 static isc_result_t
 nzd_count(dns_view_t *view, int *countp) {
 	isc_result_t result;
@@ -12900,10 +12869,6 @@ cleanup:
 	return (result);
 }

-/*
- * Migrate zone configuration from an NZF file to an NZD database.
- * Caller must hold view->new_zone_lock.
- */
 static isc_result_t
 migrate_nzf(dns_view_t *view) {
 	isc_result_t result;
@@ -13263,7 +13228,6 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	MDB_dbi dbi;

 	UNUSED(zoneconf);
-	LOCK(&view->new_zone_lock);
 #endif /* HAVE_LMDB */

 	/* Zone shouldn't already exist */
@@ -13417,7 +13381,6 @@ cleanup:
 	if (txn != NULL) {
 		(void)nzd_close(&txn, false);
 	}
-	UNLOCK(&view->new_zone_lock);
 #endif /* HAVE_LMDB */

 	if (zone != NULL) {
@@ -13441,7 +13404,6 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 #else  /* HAVE_LMDB */
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
-	LOCK(&view->new_zone_lock);
 #endif /* HAVE_LMDB */

 	/* Zone must already exist */
@@ -13639,7 +13601,6 @@ cleanup:
 	if (txn != NULL) {
 		(void)nzd_close(&txn, false);
 	}
-	UNLOCK(&view->new_zone_lock);
 #endif /* HAVE_LMDB */

 	if (zone != NULL) {
@@ -13803,7 +13764,6 @@ rmzone(isc_task_t *task, isc_event_t *event) {
 	if (added && cfg != NULL) {
 #ifdef HAVE_LMDB
 		/* Make sure we can open the NZD database */
-		LOCK(&view->new_zone_lock);
 		result = nzd_open(view, 0, &txn, &dbi);
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -13821,11 +13781,6 @@ rmzone(isc_task_t *task, isc_event_t *event) {
 				      "delete zone configuration: %s",
 				      isc_result_totext(result));
 		}
-
-		if (txn != NULL) {
-			(void)nzd_close(&txn, false);
-		}
-		UNLOCK(&view->new_zone_lock);
 #else  /* ifdef HAVE_LMDB */
 		result = delete_zoneconf(view, cfg->add_parser, cfg->nzf_config,
 					 dns_zone_getorigin(zone),
@@ -13915,6 +13870,11 @@ rmzone(isc_task_t *task, isc_event_t *event) {
 		}
 	}

+#ifdef HAVE_LMDB
+	if (txn != NULL) {
+		(void)nzd_close(&txn, false);
+	}
+#endif /* ifdef HAVE_LMDB */
 	if (raw != NULL) {
 		dns_zone_detach(&raw);
 	}
@@ -14150,6 +14110,7 @@ named_server_showzone(named_server_t *server, isc_lex_t *lex,
 	dns_view_t *view = NULL;
 	dns_zone_t *zone = NULL;
 	ns_cfgctx_t *cfg = NULL;
+	bool exclusive = false;
 #ifdef HAVE_LMDB
 	cfg_obj_t *nzconfig = NULL;
 #endif /* HAVE_LMDB */
@@ -14174,6 +14135,10 @@ named_server_showzone(named_server_t *server, isc_lex_t *lex,
 		goto cleanup;
 	}

+	result = isc_task_beginexclusive(server->task);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	exclusive = true;
+
 	if (!added) {
 		/* Find the view statement */
 		vconfig = find_name_in_list_from_map(cfg->config, "view",
@@ -14232,6 +14197,9 @@ cleanup:
 	if (isc_buffer_usedlength(*text) > 0) {
 		(void)putnull(text);
 	}
+	if (exclusive) {
+		isc_task_endexclusive(server->task);
+	}

 	return (result);
 }
@@ -22,6 +22,7 @@
 #include <isc/socket.h>
 #include <isc/stats.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/util.h>

 #include <dns/cache.h>
@@ -53,14 +54,6 @@

 #include "xsl_p.h"

-#define CHECK(m)                               \
-	do {                                   \
-		result = (m);                  \
-		if (result != ISC_R_SUCCESS) { \
-			goto cleanup;          \
-		}                              \
-	} while (0)
-
 struct named_statschannel {
 	/* Unlocked */
 	isc_httpdmgr_t *httpdmgr;
@@ -177,11 +170,11 @@ static const char *gluecachestats_xmldesc[dns_gluecachestatscounter_max];
 #define gluecachestats_xmldesc	NULL
 #endif /* EXTENDED_STATS */

-#define TRY0(a)                       \
-	do {                          \
-		xmlrc = (a);          \
-		if (xmlrc < 0)        \
-			goto cleanup; \
+#define TRY0(a)                     \
+	do {                        \
+		xmlrc = (a);        \
+		if (xmlrc < 0)      \
+			goto error; \
 	} while (0)

 /*%
@@ -1431,7 +1424,7 @@ dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 	}
 	return (ISC_R_SUCCESS);
 #ifdef HAVE_LIBXML2
-cleanup:
+error:
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "failed at dump_counters()");
@@ -1493,7 +1486,7 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	}
 	return;
 #ifdef HAVE_LIBXML2
-cleanup:
+error:
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "failed at rdtypestat_dump()");
@@ -1581,7 +1574,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	}
 	return;
 #ifdef HAVE_LIBXML2
-cleanup:
+error:
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "failed at rdatasetstats_dump()");
@@ -1636,7 +1629,7 @@ opcodestat_dump(dns_opcode_t code, uint64_t val, void *arg) {
 	return;

 #ifdef HAVE_LIBXML2
-cleanup:
+error:
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "failed at opcodestat_dump()");
@@ -1692,7 +1685,7 @@ rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {
 	return;

 #ifdef HAVE_LIBXML2
-cleanup:
+error:
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "failed at rcodestat_dump()");
@@ -1745,7 +1738,7 @@ dnssecsignstat_dump(dns_keytag_t tag, uint64_t val, void *arg) {
 	}
 	return;
 #ifdef HAVE_LIBXML2
-cleanup:
+error:
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "failed at dnssecsignstat_dump()");
@@ -1779,7 +1772,6 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	int xmlrc;
 	stats_dumparg_t dumparg;
 	const char *ztype;
-	isc_time_t timestamp;

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
@@ -1822,8 +1814,12 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	 * master zones, only include the loaded time.  For slave zones, also
 	 * include the expires and refresh times.
 	 */
+	isc_time_t timestamp;

-	CHECK(dns_zone_getloadtime(zone, &timestamp));
+	result = dns_zone_getloadtime(zone, &timestamp);
+	if (result != ISC_R_SUCCESS) {
+		goto error;
+	}

 	isc_time_formatISO8601(&timestamp, buf, 64);
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "loaded"));
@@ -1831,13 +1827,19 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterEndElement(writer));

 	if (dns_zone_gettype(zone) == dns_zone_slave) {
-		CHECK(dns_zone_getexpiretime(zone, &timestamp));
+		result = dns_zone_getexpiretime(zone, &timestamp);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}
 		isc_time_formatISO8601(&timestamp, buf, 64);
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "expires"));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR buf));
 		TRY0(xmlTextWriterEndElement(writer));

-		CHECK(dns_zone_getrefreshtime(zone, &timestamp));
+		result = dns_zone_getrefreshtime(zone, &timestamp);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}
 		isc_time_formatISO8601(&timestamp, buf, 64);
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "refresh"));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR buf));
@@ -1860,11 +1862,14 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 							 ISC_XMLCHAR "type",
 							 ISC_XMLCHAR "rcode"));

-			CHECK(dump_counters(zonestats, isc_statsformat_xml,
-					    writer, NULL, nsstats_xmldesc,
-					    ns_statscounter_max, nsstats_index,
-					    nsstat_values,
-					    ISC_STATSDUMP_VERBOSE));
+			result = dump_counters(zonestats, isc_statsformat_xml,
+					       writer, NULL, nsstats_xmldesc,
+					       ns_statscounter_max,
+					       nsstats_index, nsstat_values,
+					       ISC_STATSDUMP_VERBOSE);
+			if (result != ISC_R_SUCCESS) {
+				goto error;
+			}
 			/* counters type="rcode"*/
 			TRY0(xmlTextWriterEndElement(writer));
 		}
@@ -1877,12 +1882,15 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 				writer, ISC_XMLCHAR "type",
 				ISC_XMLCHAR "gluecache"));

-			CHECK(dump_counters(
+			result = dump_counters(
 				gluecachestats, isc_statsformat_xml, writer,
 				NULL, gluecachestats_xmldesc,
 				dns_gluecachestatscounter_max,
 				gluecachestats_index, gluecachestats_values,
-				ISC_STATSDUMP_VERBOSE));
+				ISC_STATSDUMP_VERBOSE);
+			if (result != ISC_R_SUCCESS) {
+				goto error;
+			}
 			/* counters type="rcode"*/
 			TRY0(xmlTextWriterEndElement(writer));
 		}
@@ -1898,7 +1906,9 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 			dumparg.result = ISC_R_SUCCESS;
 			dns_rdatatypestats_dump(rcvquerystats, rdtypestat_dump,
 						&dumparg, 0);
-			CHECK(dumparg.result);
+			if (dumparg.result != ISC_R_SUCCESS) {
+				goto error;
+			}

 			/* counters type="qtype"*/
 			TRY0(xmlTextWriterEndElement(writer));
@@ -1917,7 +1927,9 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 			dns_dnssecsignstats_dump(
 				dnssecsignstats, dns_dnssecsignstats_sign,
 				dnssecsignstat_dump, &dumparg, 0);
-			CHECK(dumparg.result);
+			if (dumparg.result != ISC_R_SUCCESS) {
+				goto error;
+			}

 			/* counters type="dnssec-sign"*/
 			TRY0(xmlTextWriterEndElement(writer));
@@ -1933,7 +1945,9 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 			dns_dnssecsignstats_dump(
 				dnssecsignstats, dns_dnssecsignstats_refresh,
 				dnssecsignstat_dump, &dumparg, 0);
-			CHECK(dumparg.result);
+			if (dumparg.result != ISC_R_SUCCESS) {
+				goto error;
+			}

 			/* counters type="dnssec-refresh"*/
 			TRY0(xmlTextWriterEndElement(writer));
@@ -1943,7 +1957,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterEndElement(writer)); /* zone */

 	return (ISC_R_SUCCESS);
-cleanup:
+error:
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "Failed at zone_xmlrender()");
@@ -1985,7 +1999,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,

 	writer = xmlNewTextWriterDoc(&doc, 0);
 	if (writer == NULL) {
-		goto cleanup;
+		goto error;
 	}
 	TRY0(xmlTextWriterStartDocument(writer, NULL, "UTF-8", NULL));
 	TRY0(xmlTextWriterWritePI(writer, ISC_XMLCHAR "xml-stylesheet",
@@ -2023,7 +2037,9 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,

 		dns_opcodestats_dump(server->sctx->opcodestats, opcodestat_dump,
 				     &dumparg, ISC_STATSDUMP_VERBOSE);
-		CHECK(dumparg.result);
+		if (dumparg.result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer));

@@ -2033,7 +2049,9 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,

 		dns_rcodestats_dump(server->sctx->rcodestats, rcodestat_dump,
 				    &dumparg, ISC_STATSDUMP_VERBOSE);
-		CHECK(dumparg.result);
+		if (dumparg.result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer));

@@ -2044,19 +2062,23 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		dumparg.result = ISC_R_SUCCESS;
 		dns_rdatatypestats_dump(server->sctx->rcvquerystats,
 					rdtypestat_dump, &dumparg, 0);
-		CHECK(dumparg.result);
-
+		if (dumparg.result != ISC_R_SUCCESS) {
+			goto error;
+		}
 		TRY0(xmlTextWriterEndElement(writer)); /* counters */

 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"));
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "nsstat"));

-		CHECK(dump_counters(ns_stats_get(server->sctx->nsstats),
-				    isc_statsformat_xml, writer, NULL,
-				    nsstats_xmldesc, ns_statscounter_max,
-				    nsstats_index, nsstat_values,
-				    ISC_STATSDUMP_VERBOSE));
+		result = dump_counters(ns_stats_get(server->sctx->nsstats),
+				       isc_statsformat_xml, writer, NULL,
+				       nsstats_xmldesc, ns_statscounter_max,
+				       nsstats_index, nsstat_values,
+				       ISC_STATSDUMP_VERBOSE);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer)); /* /nsstat */

@@ -2064,10 +2086,14 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "zonestat"));

-		CHECK(dump_counters(server->zonestats, isc_statsformat_xml,
-				    writer, NULL, zonestats_xmldesc,
-				    dns_zonestatscounter_max, zonestats_index,
-				    zonestat_values, ISC_STATSDUMP_VERBOSE));
+		result = dump_counters(server->zonestats, isc_statsformat_xml,
+				       writer, NULL, zonestats_xmldesc,
+				       dns_zonestatscounter_max,
+				       zonestats_index, zonestat_values,
+				       ISC_STATSDUMP_VERBOSE);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer)); /* /zonestat */

@@ -2078,11 +2104,13 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"));
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "resstat"));
-		CHECK(dump_counters(server->resolverstats, isc_statsformat_xml,
-				    writer, NULL, resstats_xmldesc,
-				    dns_resstatscounter_max, resstats_index,
-				    resstat_values, 0));
-
+		result = dump_counters(
+			server->resolverstats, isc_statsformat_xml, writer,
+			NULL, resstats_xmldesc, dns_resstatscounter_max,
+			resstats_index, resstat_values, 0);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}
 		TRY0(xmlTextWriterEndElement(writer)); /* resstat */

 #ifdef HAVE_DNSTAP
@@ -2099,8 +2127,9 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 				dnstapstats_xmldesc, dns_dnstapcounter_max,
 				dnstapstats_index, dnstapstat_values, 0);
 			isc_stats_detach(&dnstapstats);
-			CHECK(result);
-
+			if (result != ISC_R_SUCCESS) {
+				goto error;
+			}
 			TRY0(xmlTextWriterEndElement(writer)); /* dnstap */
 		}
 #endif /* ifdef HAVE_DNSTAP */
@@ -2111,10 +2140,14 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "sockstat"));

-		CHECK(dump_counters(server->sockstats, isc_statsformat_xml,
-				    writer, NULL, sockstats_xmldesc,
-				    isc_sockstatscounter_max, sockstats_index,
-				    sockstat_values, ISC_STATSDUMP_VERBOSE));
+		result = dump_counters(server->sockstats, isc_statsformat_xml,
+				       writer, NULL, sockstats_xmldesc,
+				       isc_sockstatscounter_max,
+				       sockstats_index, sockstat_values,
+				       ISC_STATSDUMP_VERBOSE);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer)); /* /sockstat */
 	}
@@ -2128,10 +2161,13 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "request-size"));

-		CHECK(dump_counters(
+		result = dump_counters(
 			server->sctx->udpinstats4, isc_statsformat_xml, writer,
 			NULL, udpinsizestats_xmldesc, dns_sizecounter_in_max,
-			udpinsizestats_index, udpinsizestat_values, 0));
+			udpinsizestats_index, udpinsizestat_values, 0);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */

@@ -2139,10 +2175,13 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "response-size"));

-		CHECK(dump_counters(
+		result = dump_counters(
 			server->sctx->udpoutstats4, isc_statsformat_xml, writer,
 			NULL, udpoutsizestats_xmldesc, dns_sizecounter_out_max,
-			udpoutsizestats_index, udpoutsizestat_values, 0));
+			udpoutsizestats_index, udpoutsizestat_values, 0);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */
 		TRY0(xmlTextWriterEndElement(writer)); /* </udp> */
@@ -2152,20 +2191,27 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "request-size"));

-		CHECK(dump_counters(
+		result = dump_counters(
 			server->sctx->tcpinstats4, isc_statsformat_xml, writer,
 			NULL, tcpinsizestats_xmldesc, dns_sizecounter_in_max,
-			tcpinsizestats_index, tcpinsizestat_values, 0));
+			tcpinsizestats_index, tcpinsizestat_values, 0);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */
+
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"));
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "response-size"));

-		CHECK(dump_counters(
+		result = dump_counters(
 			server->sctx->tcpoutstats4, isc_statsformat_xml, writer,
 			NULL, tcpoutsizestats_xmldesc, dns_sizecounter_out_max,
-			tcpoutsizestats_index, tcpoutsizestat_values, 0));
+			tcpoutsizestats_index, tcpoutsizestat_values, 0);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */
 		TRY0(xmlTextWriterEndElement(writer)); /* </tcp> */
@@ -2177,10 +2223,13 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "request-size"));

-		CHECK(dump_counters(
+		result = dump_counters(
 			server->sctx->udpinstats6, isc_statsformat_xml, writer,
 			NULL, udpinsizestats_xmldesc, dns_sizecounter_in_max,
-			udpinsizestats_index, udpinsizestat_values, 0));
+			udpinsizestats_index, udpinsizestat_values, 0);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */

@@ -2188,10 +2237,13 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "response-size"));

-		CHECK(dump_counters(
+		result = dump_counters(
 			server->sctx->udpoutstats6, isc_statsformat_xml, writer,
 			NULL, udpoutsizestats_xmldesc, dns_sizecounter_out_max,
-			udpoutsizestats_index, udpoutsizestat_values, 0));
+			udpoutsizestats_index, udpoutsizestat_values, 0);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */
 		TRY0(xmlTextWriterEndElement(writer)); /* </udp> */
@@ -2201,10 +2253,13 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "request-size"));

-		CHECK(dump_counters(
+		result = dump_counters(
 			server->sctx->tcpinstats6, isc_statsformat_xml, writer,
 			NULL, tcpinsizestats_xmldesc, dns_sizecounter_in_max,
-			tcpinsizestats_index, tcpinsizestat_values, 0));
+			tcpinsizestats_index, tcpinsizestat_values, 0);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */

@@ -2212,10 +2267,13 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "response-size"));

-		CHECK(dump_counters(
+		result = dump_counters(
 			server->sctx->tcpoutstats6, isc_statsformat_xml, writer,
 			NULL, tcpoutsizestats_xmldesc, dns_sizecounter_out_max,
-			tcpoutsizestats_index, tcpoutsizestat_values, 0));
+			tcpoutsizestats_index, tcpoutsizestat_values, 0);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}

 		TRY0(xmlTextWriterEndElement(writer)); /* </counters> */
 		TRY0(xmlTextWriterEndElement(writer)); /* </tcp> */
@@ -2238,8 +2296,11 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		if ((flags & STATS_XML_ZONES) != 0) {
 			TRY0(xmlTextWriterStartElement(writer,
 						       ISC_XMLCHAR "zones"));
-			CHECK(dns_zt_apply(view->zonetable, true, NULL,
-					   zone_xmlrender, writer));
+			result = dns_zt_apply(view->zonetable, true, NULL,
+					      zone_xmlrender, writer);
+			if (result != ISC_R_SUCCESS) {
+				goto error;
+			}
 			TRY0(xmlTextWriterEndElement(writer)); /* /zones */
 		}

@@ -2257,7 +2318,9 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 			dumparg.result = ISC_R_SUCCESS;
 			dns_rdatatypestats_dump(view->resquerystats,
 						rdtypestat_dump, &dumparg, 0);
-			CHECK(dumparg.result);
+			if (dumparg.result != ISC_R_SUCCESS) {
+				goto error;
+			}
 		}
 		TRY0(xmlTextWriterEndElement(writer));

@@ -2266,11 +2329,14 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "resstats"));
 		if (view->resstats != NULL) {
-			CHECK(dump_counters(view->resstats, isc_statsformat_xml,
-					    writer, NULL, resstats_xmldesc,
-					    dns_resstatscounter_max,
-					    resstats_index, resstat_values,
-					    ISC_STATSDUMP_VERBOSE));
+			result = dump_counters(
+				view->resstats, isc_statsformat_xml, writer,
+				NULL, resstats_xmldesc, dns_resstatscounter_max,
+				resstats_index, resstat_values,
+				ISC_STATSDUMP_VERBOSE);
+			if (result != ISC_R_SUCCESS) {
+				goto error;
+			}
 		}
 		TRY0(xmlTextWriterEndElement(writer)); /* </resstats> */

@@ -2284,7 +2350,9 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 			dumparg.result = ISC_R_SUCCESS;
 			dns_rdatasetstats_dump(cacherrstats, rdatasetstats_dump,
 					       &dumparg, 0);
-			CHECK(dumparg.result);
+			if (dumparg.result != ISC_R_SUCCESS) {
+				goto error;
+			}
 			TRY0(xmlTextWriterEndElement(writer)); /* cache */
 		}

@@ -2293,11 +2361,14 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "type",
 						 ISC_XMLCHAR "adbstat"));
 		if (view->adbstats != NULL) {
-			CHECK(dump_counters(view->adbstats, isc_statsformat_xml,
-					    writer, NULL, adbstats_xmldesc,
-					    dns_adbstats_max, adbstats_index,
-					    adbstat_values,
-					    ISC_STATSDUMP_VERBOSE));
+			result = dump_counters(
+				view->adbstats, isc_statsformat_xml, writer,
+				NULL, adbstats_xmldesc, dns_adbstats_max,
+				adbstats_index, adbstat_values,
+				ISC_STATSDUMP_VERBOSE);
+			if (result != ISC_R_SUCCESS) {
+				goto error;
+			}
 		}
 		TRY0(xmlTextWriterEndElement(writer)); /* </adbstats> */

@@ -2340,12 +2411,12 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,

 	xmlDocDumpFormatMemoryEnc(doc, buf, buflen, "UTF-8", 0);
 	if (*buf == NULL) {
-		goto cleanup;
+		goto error;
 	}
 	xmlFreeDoc(doc);
 	return (ISC_R_SUCCESS);

-cleanup:
+error:
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "failed generating XML response");
@@ -2502,11 +2573,18 @@ render_xml_traffic(const char *url, isc_httpdurl_t *urlinfo,
 #define STATS_JSON_TRAFFIC 0x20
 #define STATS_JSON_ALL	   0xff

+#define CHECK(m)                             \
+	do {                                 \
+		result = (m);                \
+		if (result != ISC_R_SUCCESS) \
+			goto error;          \
+	} while (0)
+
 #define CHECKMEM(m)                              \
 	do {                                     \
 		if (m == NULL) {                 \
 			result = ISC_R_NOMEMORY; \
-			goto cleanup;            \
+			goto error;              \
 		}                                \
 	} while (0)

@@ -2586,18 +2664,27 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {

 	isc_time_t timestamp;

-	CHECK(dns_zone_getloadtime(zone, &timestamp));
+	result = dns_zone_getloadtime(zone, &timestamp);
+	if (result != ISC_R_SUCCESS) {
+		goto error;
+	}

 	isc_time_formatISO8601(&timestamp, buf, 64);
 	json_object_object_add(zoneobj, "loaded", json_object_new_string(buf));

 	if (dns_zone_gettype(zone) == dns_zone_slave) {
-		CHECK(dns_zone_getexpiretime(zone, &timestamp));
+		result = dns_zone_getexpiretime(zone, &timestamp);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}
 		isc_time_formatISO8601(&timestamp, buf, 64);
 		json_object_object_add(zoneobj, "expires",
 				       json_object_new_string(buf));

-		CHECK(dns_zone_getrefreshtime(zone, &timestamp));
+		result = dns_zone_getrefreshtime(zone, &timestamp);
+		if (result != ISC_R_SUCCESS) {
+			goto error;
+		}
 		isc_time_formatISO8601(&timestamp, buf, 64);
 		json_object_object_add(zoneobj, "refresh",
 				       json_object_new_string(buf));
@@ -2616,7 +2703,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 			json_object *counters = json_object_new_object();
 			if (counters == NULL) {
 				result = ISC_R_NOMEMORY;
-				goto cleanup;
+				goto error;
 			}

 			result = dump_counters(zonestats, isc_statsformat_json,
@@ -2625,7 +2712,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 					       nsstats_index, nsstat_values, 0);
 			if (result != ISC_R_SUCCESS) {
 				json_object_put(counters);
-				goto cleanup;
+				goto error;
 			}

 			if (json_object_get_object(counters)->count != 0) {
@@ -2641,7 +2728,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 			json_object *counters = json_object_new_object();
 			if (counters == NULL) {
 				result = ISC_R_NOMEMORY;
-				goto cleanup;
+				goto error;
 			}

 			result = dump_counters(
@@ -2651,7 +2738,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 				gluecachestats_index, gluecachestats_values, 0);
 			if (result != ISC_R_SUCCESS) {
 				json_object_put(counters);
-				goto cleanup;
+				goto error;
 			}

 			if (json_object_get_object(counters)->count != 0) {
@@ -2675,7 +2762,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 						&dumparg, 0);
 			if (dumparg.result != ISC_R_SUCCESS) {
 				json_object_put(counters);
-				goto cleanup;
+				goto error;
 			}

 			if (json_object_get_object(counters)->count != 0) {
@@ -2700,7 +2787,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 				dnssecsignstat_dump, &dumparg, 0);
 			if (dumparg.result != ISC_R_SUCCESS) {
 				json_object_put(sign_counters);
-				goto cleanup;
+				goto error;
 			}

 			if (json_object_get_object(sign_counters)->count != 0) {
@@ -2722,7 +2809,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 				dnssecsignstat_dump, &dumparg, 0);
 			if (dumparg.result != ISC_R_SUCCESS) {
 				json_object_put(refresh_counters);
-				goto cleanup;
+				goto error;
 			}

 			if (json_object_get_object(refresh_counters)->count !=
@@ -2740,7 +2827,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	zoneobj = NULL;
 	result = ISC_R_SUCCESS;

-cleanup:
+error:
 	if (zoneobj != NULL) {
 		json_object_put(zoneobj);
 	}
@@ -2825,7 +2912,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 				     &dumparg, ISC_STATSDUMP_VERBOSE);
 		if (dumparg.result != ISC_R_SUCCESS) {
 			json_object_put(counters);
-			goto cleanup;
+			goto error;
 		}

 		if (json_object_get_object(counters)->count != 0) {
@@ -2844,7 +2931,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 				    &dumparg, ISC_STATSDUMP_VERBOSE);
 		if (dumparg.result != ISC_R_SUCCESS) {
 			json_object_put(counters);
-			goto cleanup;
+			goto error;
 		}

 		if (json_object_get_object(counters)->count != 0) {
@@ -2863,7 +2950,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 					rdtypestat_dump, &dumparg, 0);
 		if (dumparg.result != ISC_R_SUCCESS) {
 			json_object_put(counters);
-			goto cleanup;
+			goto error;
 		}

 		if (json_object_get_object(counters)->count != 0) {
@@ -2884,7 +2971,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 				       nsstats_index, nsstat_values, 0);
 		if (result != ISC_R_SUCCESS) {
 			json_object_put(counters);
-			goto cleanup;
+			goto error;
 		}

 		if (json_object_get_object(counters)->count != 0) {
@@ -2905,7 +2992,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 				       zonestats_index, zonestat_values, 0);
 		if (result != ISC_R_SUCCESS) {
 			json_object_put(counters);
-			goto cleanup;
+			goto error;
 		}

 		if (json_object_get_object(counters)->count != 0) {
@@ -2927,7 +3014,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 			resstats_index, resstat_values, 0);
 		if (result != ISC_R_SUCCESS) {
 			json_object_put(counters);
-			goto cleanup;
+			goto error;
 		}

 		if (json_object_get_object(counters)->count != 0) {
@@ -2952,7 +3039,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 			isc_stats_detach(&dnstapstats);
 			if (result != ISC_R_SUCCESS) {
 				json_object_put(counters);
-				goto cleanup;
+				goto error;
 			}

 			if (json_object_get_object(counters)->count != 0) {
@@ -2982,8 +3069,12 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 			CHECKMEM(za);

 			if ((flags & STATS_JSON_ZONES) != 0) {
-				CHECK(dns_zt_apply(view->zonetable, true, NULL,
-						   zone_jsonrender, za));
+				result = dns_zt_apply(view->zonetable, true,
+						      NULL, zone_jsonrender,
+						      za);
+				if (result != ISC_R_SUCCESS) {
+					goto error;
+				}
 			}

 			if (json_object_array_length(za) != 0) {
@@ -3016,7 +3107,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 					if (result != ISC_R_SUCCESS) {
 						json_object_put(counters);
 						result = dumparg.result;
-						goto cleanup;
+						goto error;
 					}

 					json_object_object_add(res, "stats",
@@ -3036,7 +3127,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 					if (dumparg.result != ISC_R_SUCCESS) {
 						json_object_put(counters);
 						result = dumparg.result;
-						goto cleanup;
+						goto error;
 					}

 					json_object_object_add(res, "qtypes",
@@ -3056,7 +3147,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 					if (dumparg.result != ISC_R_SUCCESS) {
 						json_object_put(counters);
 						result = dumparg.result;
-						goto cleanup;
+						goto error;
 					}

 					json_object_object_add(res, "cache",
@@ -3070,7 +3161,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 							      counters);
 				if (result != ISC_R_SUCCESS) {
 					json_object_put(counters);
-					goto cleanup;
+					goto error;
 				}

 				json_object_object_add(res, "cachestats",
@@ -3091,7 +3182,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 					if (result != ISC_R_SUCCESS) {
 						json_object_put(counters);
 						result = dumparg.result;
-						goto cleanup;
+						goto error;
 					}

 					json_object_object_add(res, "adb",
@@ -3117,7 +3208,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 				       sockstats_index, sockstat_values, 0);
 		if (result != ISC_R_SUCCESS) {
 			json_object_put(counters);
-			goto cleanup;
+			goto error;
 		}

 		if (json_object_get_object(counters)->count != 0) {
@@ -3133,7 +3224,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 		result = isc_socketmgr_renderjson(named_g_socketmgr, sockets);
 		if (result != ISC_R_SUCCESS) {
 			json_object_put(sockets);
-			goto cleanup;
+			goto error;
 		}

 		json_object_object_add(bindstats, "socketmgr", sockets);
@@ -3146,7 +3237,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 		result = isc_taskmgr_renderjson(named_g_taskmgr, tasks);
 		if (result != ISC_R_SUCCESS) {
 			json_object_put(tasks);
-			goto cleanup;
+			goto error;
 		}

 		json_object_object_add(bindstats, "taskmgr", tasks);
@@ -3159,7 +3250,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 		result = isc_mem_renderjson(memory);
 		if (result != ISC_R_SUCCESS) {
 			json_object_put(memory);
-			goto cleanup;
+			goto error;
 		}

 		json_object_object_add(bindstats, "memory", memory);
@@ -3284,7 +3375,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,

 	result = ISC_R_SUCCESS;

-cleanup:
+error:
 	if (udpreq4 != NULL) {
 		json_object_put(udpreq4);
 	}
@@ -3563,7 +3654,7 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {

 static void
 destroy_listener(void *arg) {
-	named_statschannel_t *listener = (named_statschannel_t *)arg;
+	named_statschannel_t *listener = arg;

 	REQUIRE(listener != NULL);
 	REQUIRE(!ISC_LINK_LINKED(listener, link));
@@ -3581,15 +3672,22 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	     isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
 	     const char *socktext) {
 	isc_result_t result;
-	named_statschannel_t *listener = NULL;
-	const cfg_obj_t *allow = NULL;
+	named_statschannel_t *listener;
+	isc_task_t *task = NULL;
+	isc_socket_t *sock = NULL;
+	const cfg_obj_t *allow;
 	dns_acl_t *new_acl = NULL;
-	int pf;

 	listener = isc_mem_get(server->mctx, sizeof(*listener));
-	*listener = (named_statschannel_t){ .address = *addr };
+
+	listener->httpdmgr = NULL;
+	listener->address = *addr;
+	listener->acl = NULL;
+	listener->mctx = NULL;
 	ISC_LINK_INIT(listener, link);
+
 	isc_mutex_init(&listener->lock);
+
 	isc_mem_attach(server->mctx, &listener->mctx);

 	allow = cfg_tuple_get(listen_params, "allow");
@@ -3600,80 +3698,104 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
-	CHECK(result);
-
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
 	dns_acl_attach(new_acl, &listener->acl);
 	dns_acl_detach(&new_acl);

-	pf = isc_sockaddr_pf(&listener->address);
-	if ((pf == AF_INET && isc_net_probeipv4() != ISC_R_SUCCESS) ||
-	    (pf == AF_INET6 && isc_net_probeipv6() != ISC_R_SUCCESS))
-	{
-		CHECK(ISC_R_FAMILYNOSUPPORT);
+	result = isc_task_create(named_g_taskmgr, 0, &task);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+	isc_task_setname(task, "statchannel", NULL);
+
+	result = isc_socket_create(named_g_socketmgr, isc_sockaddr_pf(addr),
+				   isc_sockettype_tcp, &sock);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+	isc_socket_setname(sock, "statchannel", NULL);
+
+#ifndef ISC_ALLOW_MAPPED
+	isc_socket_ipv6only(sock, true);
+#endif /* ifndef ISC_ALLOW_MAPPED */
+
+	result = isc_socket_bind(sock, addr, ISC_SOCKET_REUSEADDRESS);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
 	}

-	CHECK(isc_httpdmgr_create(named_g_nm, server->mctx, addr, client_ok,
-				  destroy_listener, listener,
-				  &listener->httpdmgr));
+	result = isc_httpdmgr_create(server->mctx, sock, task, client_ok,
+				     destroy_listener, listener,
+				     named_g_timermgr, &listener->httpdmgr);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}

 #ifdef HAVE_LIBXML2
-	isc_httpdmgr_addurl(listener->httpdmgr, "/", false, render_xml_all,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/", render_xml_all, server);
+	isc_httpdmgr_addurl(listener->httpdmgr, "/xml", render_xml_all, server);
+	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3", render_xml_all,
 			    server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml", false, render_xml_all,
-			    server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3", false,
-			    render_xml_all, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/status", false,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/status",
 			    render_xml_status, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/server", false,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/server",
 			    render_xml_server, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/zones", false,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/zones",
 			    render_xml_zones, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/net", false,
-			    render_xml_net, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/tasks", false,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/net", render_xml_net,
+			    server);
+	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/tasks",
 			    render_xml_tasks, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/mem", false,
-			    render_xml_mem, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/traffic", false,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/mem", render_xml_mem,
+			    server);
+	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/traffic",
 			    render_xml_traffic, server);
 #endif /* ifdef HAVE_LIBXML2 */
 #ifdef HAVE_JSON_C
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json", false, render_json_all,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/json", render_json_all,
 			    server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1", false,
-			    render_json_all, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/status", false,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1", render_json_all,
+			    server);
+	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/status",
 			    render_json_status, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/server", false,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/server",
 			    render_json_server, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/zones", false,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/zones",
 			    render_json_zones, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/tasks", false,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/tasks",
 			    render_json_tasks, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/net", false,
-			    render_json_net, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/mem", false,
-			    render_json_mem, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/traffic", false,
+	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/net", render_json_net,
+			    server);
+	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/mem", render_json_mem,
+			    server);
+	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/traffic",
 			    render_json_traffic, server);
 #endif /* ifdef HAVE_JSON_C */
-	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
-			    server);
+	isc_httpdmgr_addurl2(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
+			     server);

 	*listenerp = listener;
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
 		      "statistics channel listening on %s", socktext);

-	return (ISC_R_SUCCESS);
-
 cleanup:
-	if (listener->acl != NULL) {
-		dns_acl_detach(&listener->acl);
+	if (result != ISC_R_SUCCESS) {
+		if (listener->acl != NULL) {
+			dns_acl_detach(&listener->acl);
+		}
+		isc_mutex_destroy(&listener->lock);
+		isc_mem_putanddetach(&listener->mctx, listener,
+				     sizeof(*listener));
+	}
+	if (task != NULL) {
+		isc_task_detach(&task);
+	}
+	if (sock != NULL) {
+		isc_socket_detach(&sock);
 	}
-	isc_mutex_destroy(&listener->lock);
-	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));

 	return (result);
 }
@@ -67,7 +67,7 @@
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>@LIBUV_INC@@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
@@ -75,7 +75,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBUV_LIB@@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PreBuildEvent>
      <Command>cd ..
@@ -103,7 +103,7 @@ perl -e "print \";\";" &gt;&gt; xsl.c
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>@LIBUV_INC@@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
@@ -114,7 +114,7 @@ perl -e "print \";\";" &gt;&gt; xsl.c
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBUV_LIB@@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PreBuildEvent>
      <Command>cd ..
@@ -252,8 +252,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		str = cfg_obj_asstring(matchtype);
 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
-		if (mtype == dns_ssumatchtype_subdomain &&
-		    strcasecmp(str, "zonesub") == 0) {
+		if (mtype == dns_ssumatchtype_subdomain) {
 			usezone = true;
 		}

@@ -1595,11 +1594,11 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			if (cfg_obj_isvoid(resign)) {
 				seconds /= 4;
 			} else if (!sigvalinsecs) {
-				uint32_t r = cfg_obj_asuint32(resign);
+				seconds = cfg_obj_asuint32(resign);
 				if (seconds > 7 * 86400) {
-					seconds = r * 86400;
+					seconds *= 86400;
 				} else {
-					seconds = r * 3600;
+					seconds *= 3600;
 				}
 			} else {
 				seconds = cfg_obj_asuint32(resign);
@@ -55,14 +55,11 @@

 #define SERVERADDRS 10

-const char *progname = NULL;
+const char *progname;
 bool verbose;

-static isc_taskmgr_t *taskmgr = NULL;
-static isc_task_t *rndc_task = NULL;
-
-static const char *admin_conffile = NULL;
-static const char *admin_keyfile = NULL;
+static const char *admin_conffile;
+static const char *admin_keyfile;
 static const char *version = PACKAGE_VERSION;
 static const char *servername = NULL;
 static isc_sockaddr_t serveraddrs[SERVERADDRS];
@@ -71,27 +68,27 @@ static bool local4set = false, local6set = false;
 static int nserveraddrs;
 static int currentaddr = 0;
 static unsigned int remoteport = 0;
-static isc_nm_t *netmgr = NULL;
-static isc_buffer_t *databuf = NULL;
-static isccc_ccmsg_t rndc_ccmsg;
+static isc_socketmgr_t *socketmgr = NULL;
+static isc_buffer_t *databuf;
+static isccc_ccmsg_t ccmsg;
 static uint32_t algorithm;
 static isccc_region_t secret;
 static bool failed = false;
 static bool c_flag = false;
-static isc_mem_t *rndc_mctx = NULL;
+static isc_mem_t *rndc_mctx;
 static atomic_uint_fast32_t sends = ATOMIC_VAR_INIT(0);
 static atomic_uint_fast32_t recvs = ATOMIC_VAR_INIT(0);
 static atomic_uint_fast32_t connects = ATOMIC_VAR_INIT(0);
-static char *command = NULL;
-static char *args = NULL;
+static char *command;
+static char *args;
 static char program[256];
+static isc_socket_t *sock = NULL;
 static uint32_t serial;
 static bool quiet = false;
 static bool showresult = false;
-static bool shuttingdown = false;

 static void
-rndc_startconnect(isc_sockaddr_t *addr);
+rndc_startconnect(isc_sockaddr_t *addr, isc_task_t *task);

 ISC_NORETURN static void
 usage(int status);
@@ -117,7 +114,7 @@ command is one of the following:\n\
 		Close, rename and re-open the DNSTAP output file(s).\n\
  dumpdb [-all|-cache|-zones|-adb|-bad|-fail] [view ...]\n\
 		Dump cache(s) to the dump file (named_dump.db).\n\
-  flush         Flushes all of the server's caches.\n\
+  flush 	Flushes all of the server's caches.\n\
  flush [view]	Flushes the server's cache for a view.\n\
  flushname name [view]\n\
 		Flush the given name from the server's cache(s)\n\
@@ -281,54 +278,51 @@ get_addresses(const char *host, in_port_t port) {
 }

 static void
-rndc_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
-	UNUSED(arg);
+rndc_senddone(isc_task_t *task, isc_event_t *event) {
+	isc_socketevent_t *sevent = (isc_socketevent_t *)event;

-	if (result != ISC_R_SUCCESS) {
-		fatal("send failed: %s", isc_result_totext(result));
+	UNUSED(task);
+
+	if (sevent->result != ISC_R_SUCCESS) {
+		fatal("send failed: %s", isc_result_totext(sevent->result));
 	}
-
+	isc_event_free(&event);
 	if (atomic_fetch_sub_release(&sends, 1) == 1 &&
 	    atomic_load_acquire(&recvs) == 0)
 	{
-		shuttingdown = true;
-		isc_task_shutdown(rndc_task);
+		isc_socket_detach(&sock);
+		isc_task_shutdown(task);
 		isc_app_shutdown();
-		isc_nmhandle_unref(handle);
 	}
 }

 static void
-rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
-	isccc_ccmsg_t *ccmsg = (isccc_ccmsg_t *)arg;
+rndc_recvdone(isc_task_t *task, isc_event_t *event) {
 	isccc_sexpr_t *response = NULL;
 	isccc_sexpr_t *data;
 	isccc_region_t source;
 	char *errormsg = NULL;
 	char *textmsg = NULL;
-
-	REQUIRE(ccmsg != NULL);
+	isc_result_t result;

 	atomic_fetch_sub_release(&recvs, 1);

-	if (shuttingdown && (result == ISC_R_EOF || result == ISC_R_CANCELED)) {
-		isc_nmhandle_unref(handle);
-		return;
-	} else if (result == ISC_R_EOF) {
-		fatal("connection to remote host closed.\n"
-		      "* This may indicate that the\n"
-		      "* remote server is using an older\n"
-		      "* version of the command protocol,\n"
+	if (ccmsg.result == ISC_R_EOF) {
+		fatal("connection to remote host closed\n"
+		      "This may indicate that\n"
+		      "* the remote server is using an older version of"
+		      " the command protocol,\n"
 		      "* this host is not authorized to connect,\n"
-		      "* the clocks are not synchronized,\n"
-		      "* the key signing algorithm is incorrect,\n"
-		      "* or the key is invalid.");
-	} else if (result != ISC_R_SUCCESS && result != ISC_R_CANCELED) {
-		fatal("recv failed: %s", isc_result_totext(result));
+		      "* the clocks are not synchronized, or\n"
+		      "* the key is invalid.");
 	}

-	source.rstart = isc_buffer_base(ccmsg->buffer);
-	source.rend = isc_buffer_used(ccmsg->buffer);
+	if (ccmsg.result != ISC_R_SUCCESS) {
+		fatal("recv failed: %s", isc_result_totext(ccmsg.result));
+	}
+
+	source.rstart = isc_buffer_base(&ccmsg.buffer);
+	source.rend = isc_buffer_used(&ccmsg.buffer);

 	DO("parse message",
 	   isccc_cc_fromwire(&source, &response, algorithm, &secret));
@@ -368,23 +362,22 @@ rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		}
 	}

+	isc_event_free(&event);
 	isccc_sexpr_free(&response);
-
 	if (atomic_load_acquire(&sends) == 0 &&
 	    atomic_load_acquire(&recvs) == 0) {
-		shuttingdown = true;
-		isc_nmhandle_unref(handle);
-		isc_task_shutdown(rndc_task);
+		isc_socket_detach(&sock);
+		isc_task_shutdown(task);
 		isc_app_shutdown();
 	}
 }

 static void
-rndc_recvnonce(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
-	isccc_ccmsg_t *ccmsg = (isccc_ccmsg_t *)arg;
+rndc_recvnonce(isc_task_t *task, isc_event_t *event) {
 	isccc_sexpr_t *response = NULL;
 	isccc_sexpr_t *_ctrl;
 	isccc_region_t source;
+	isc_result_t result;
 	uint32_t nonce;
 	isccc_sexpr_t *request = NULL;
 	isccc_time_t now;
@@ -392,28 +385,25 @@ rndc_recvnonce(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	isccc_sexpr_t *data;
 	isc_buffer_t b;

-	REQUIRE(ccmsg != NULL);
-
 	atomic_fetch_sub_release(&recvs, 1);

-	if (shuttingdown && result == ISC_R_EOF) {
-		isc_nmhandle_unref(handle);
-		return;
-	} else if (result == ISC_R_EOF) {
-		fatal("connection to remote host closed.\n"
-		      "* This may indicate that the\n"
-		      "* remote server is using an older\n"
-		      "* version of the command protocol,\n"
+	if (ccmsg.result == ISC_R_EOF) {
+		fatal("connection to remote host closed\n"
+		      "This may indicate that\n"
+		      "* the remote server is using an older version of"
+		      " the command protocol,\n"
 		      "* this host is not authorized to connect,\n"
 		      "* the clocks are not synchronized,\n"
-		      "* the key signing algorithm is incorrect\n"
-		      "* or the key is invalid.");
-	} else if (result != ISC_R_SUCCESS) {
-		fatal("recv failed: %s", isc_result_totext(result));
+		      "* the key signing algorithm is incorrect, or\n"
+		      "* the key is invalid.");
 	}

-	source.rstart = isc_buffer_base(ccmsg->buffer);
-	source.rend = isc_buffer_used(ccmsg->buffer);
+	if (ccmsg.result != ISC_R_SUCCESS) {
+		fatal("recv failed: %s", isc_result_totext(ccmsg.result));
+	}
+
+	source.rstart = isc_buffer_base(&ccmsg.buffer);
+	source.rend = isc_buffer_used(&ccmsg.buffer);

 	DO("parse message",
 	   isccc_cc_fromwire(&source, &response, algorithm, &secret));
@@ -461,44 +451,48 @@ rndc_recvnonce(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	r.base = databuf->base;
 	r.length = databuf->used;

+	isccc_ccmsg_cancelread(&ccmsg);
 	DO("schedule recv",
-	   isccc_ccmsg_readmessage(ccmsg, rndc_recvdone, ccmsg));
+	   isccc_ccmsg_readmessage(&ccmsg, task, rndc_recvdone, NULL));
 	atomic_fetch_add_relaxed(&recvs, 1);
-
-	DO("send message", isc_nm_send(handle, &r, rndc_senddone, NULL));
+	DO("send message",
+	   isc_socket_send(sock, &r, task, rndc_senddone, NULL));
 	atomic_fetch_add_relaxed(&sends, 1);

+	isc_event_free(&event);
 	isccc_sexpr_free(&response);
 	isccc_sexpr_free(&request);
 	return;
 }

 static void
-rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
-	isccc_ccmsg_t *ccmsg = (isccc_ccmsg_t *)arg;
+rndc_connected(isc_task_t *task, isc_event_t *event) {
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
+	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
 	isccc_sexpr_t *request = NULL;
 	isccc_sexpr_t *data;
 	isccc_time_t now;
 	isc_region_t r;
 	isc_buffer_t b;
-
-	REQUIRE(ccmsg != NULL);
+	isc_result_t result;

 	atomic_fetch_sub_release(&connects, 1);

-	if (result != ISC_R_SUCCESS) {
+	if (sevent->result != ISC_R_SUCCESS) {
 		isc_sockaddr_format(&serveraddrs[currentaddr], socktext,
 				    sizeof(socktext));
-		if (++currentaddr < nserveraddrs) {
+		if (sevent->result != ISC_R_CANCELED &&
+		    ++currentaddr < nserveraddrs) {
 			notify("connection failed: %s: %s", socktext,
-			       isc_result_totext(result));
-			rndc_startconnect(&serveraddrs[currentaddr]);
+			       isc_result_totext(sevent->result));
+			isc_socket_detach(&sock);
+			isc_event_free(&event);
+			rndc_startconnect(&serveraddrs[currentaddr], task);
 			return;
+		} else {
+			fatal("connect failed: %s: %s", socktext,
+			      isc_result_totext(sevent->result));
 		}
-
-		fatal("connect failed: %s: %s", socktext,
-		      isc_result_totext(result));
 	}

 	isc_stdtime_get(&now);
@@ -525,52 +519,50 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	r.base = databuf->base;
 	r.length = databuf->used;

-	isccc_ccmsg_init(rndc_mctx, handle, ccmsg);
-	isccc_ccmsg_setmaxsize(ccmsg, 1024 * 1024);
-
-	isc_nmhandle_ref(handle);
+	isccc_ccmsg_init(rndc_mctx, sock, &ccmsg);
+	isccc_ccmsg_setmaxsize(&ccmsg, 1024 * 1024);

 	DO("schedule recv",
-	   isccc_ccmsg_readmessage(ccmsg, rndc_recvnonce, ccmsg));
+	   isccc_ccmsg_readmessage(&ccmsg, task, rndc_recvnonce, NULL));
 	atomic_fetch_add_relaxed(&recvs, 1);
-
-	DO("send message", isc_nm_send(handle, &r, rndc_senddone, NULL));
+	DO("send message",
+	   isc_socket_send(sock, &r, task, rndc_senddone, NULL));
 	atomic_fetch_add_relaxed(&sends, 1);
-
+	isc_event_free(&event);
 	isccc_sexpr_free(&request);
 }

 static void
-rndc_startconnect(isc_sockaddr_t *addr) {
+rndc_startconnect(isc_sockaddr_t *addr, isc_task_t *task) {
 	isc_result_t result;
+	int pf;
+	isc_sockettype_t type;
+
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
-	isc_sockaddr_t *local = NULL;

 	isc_sockaddr_format(addr, socktext, sizeof(socktext));

 	notify("using server %s (%s)", servername, socktext);

+	pf = isc_sockaddr_pf(addr);
+	if (pf == AF_INET || pf == AF_INET6) {
+		type = isc_sockettype_tcp;
+	} else {
+		type = isc_sockettype_unix;
+	}
+	DO("create socket", isc_socket_create(socketmgr, pf, type, &sock));
 	switch (isc_sockaddr_pf(addr)) {
 	case AF_INET:
-		local = &local4;
+		DO("bind socket", isc_socket_bind(sock, &local4, 0));
 		break;
 	case AF_INET6:
-		local = &local6;
+		DO("bind socket", isc_socket_bind(sock, &local6, 0));
 		break;
-	case AF_UNIX:
-		/*
-		 * TODO: support UNIX domain sockets in netgmr.
-		 */
-		fatal("UNIX domain sockets not currently supported");
 	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
+		break;
 	}
-
-	DO("create connection",
-	   isc_nm_tcpconnect(netmgr, (isc_nmiface_t *)local,
-			     (isc_nmiface_t *)addr, rndc_connected, &rndc_ccmsg,
-			     0));
+	DO("connect",
+	   isc_socket_connect(sock, addr, task, rndc_connected, NULL));
 	atomic_fetch_add_relaxed(&connects, 1);
 }

@@ -578,10 +570,8 @@ static void
 rndc_start(isc_task_t *task, isc_event_t *event) {
 	isc_event_free(&event);

-	UNUSED(task);
-
 	currentaddr = 0;
-	rndc_startconnect(&serveraddrs[currentaddr]);
+	rndc_startconnect(&serveraddrs[currentaddr], task);
 }

 static void
@@ -662,7 +652,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 		if (servers != NULL) {
 			for (elt = cfg_list_first(servers); elt != NULL;
 			     elt = cfg_list_next(elt)) {
-				const char *name = NULL;
+				const char *name;
 				server = cfg_listelt_value(elt);
 				name = cfg_obj_asstring(
 					cfg_map_getname(server));
@@ -699,11 +689,9 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 		DO("get config key list", cfg_map_get(config, "key", &keys));
 		for (elt = cfg_list_first(keys); elt != NULL;
 		     elt = cfg_list_next(elt)) {
-			const char *name = NULL;
-
 			key = cfg_listelt_value(elt);
-			name = cfg_obj_asstring(cfg_map_getname(key));
-			if (strcasecmp(name, keyname) == 0) {
+			if (strcasecmp(cfg_obj_asstring(cfg_map_getname(key)),
+				       keyname) == 0) {
 				break;
 			}
 		}
@@ -863,6 +851,8 @@ int
 main(int argc, char **argv) {
 	isc_result_t result = ISC_R_SUCCESS;
 	bool show_final_mem = false;
+	isc_taskmgr_t *taskmgr = NULL;
+	isc_task_t *task = NULL;
 	isc_log_t *log = NULL;
 	isc_logconfig_t *logconfig = NULL;
 	isc_logdestination_t logdest;
@@ -988,23 +978,19 @@ main(int argc, char **argv) {
 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;

-	if (argv[0] == NULL) {
+	if (argc < 1) {
 		usage(1);
-	} else {
-		command = argv[0];
-		if (strcmp(command, "restart") == 0) {
-			fatal("'%s' is not implemented", command);
-		}
-		notify("%s", command);
 	}

 	serial = isc_random32();

 	isc_mem_create(&rndc_mctx);
-	netmgr = isc_nm_start(rndc_mctx, 1);
+	DO("create socket manager",
+	   isc_socketmgr_create(rndc_mctx, &socketmgr));
 	DO("create task manager",
 	   isc_taskmgr_create(rndc_mctx, 1, 0, NULL, &taskmgr));
-	DO("create task", isc_task_create(taskmgr, 0, &rndc_task));
+	DO("create task", isc_task_create(taskmgr, 0, &task));
+
 	isc_log_create(rndc_mctx, &log, &logconfig);
 	isc_log_setcontext(log);
 	isc_log_settag(logconfig, progname);
@@ -1022,6 +1008,8 @@ main(int argc, char **argv) {

 	isccc_result_register();

+	command = *argv;
+
 	isc_buffer_allocate(rndc_mctx, &databuf, 2048);

 	/*
@@ -1048,30 +1036,32 @@ main(int argc, char **argv) {
 	*p++ = '\0';
 	INSIST(p == args + argslen);

+	notify("%s", command);
+
+	if (strcmp(command, "restart") == 0) {
+		fatal("'%s' is not implemented", command);
+	}
+
 	if (nserveraddrs == 0 && servername != NULL) {
 		get_addresses(servername, (in_port_t)remoteport);
 	}

-	DO("post event", isc_app_onrun(rndc_mctx, rndc_task, rndc_start, NULL));
+	DO("post event", isc_app_onrun(rndc_mctx, task, rndc_start, NULL));

 	result = isc_app_run();
 	if (result != ISC_R_SUCCESS) {
 		fatal("isc_app_run() failed: %s", isc_result_totext(result));
 	}

-	isc_task_detach(&rndc_task);
+	if (atomic_load_acquire(&connects) > 0 ||
+	    atomic_load_acquire(&sends) > 0 || atomic_load_acquire(&recvs) > 0)
+	{
+		isc_socket_cancel(sock, task, ISC_SOCKCANCEL_ALL);
+	}
+
+	isc_task_detach(&task);
 	isc_taskmgr_destroy(&taskmgr);
-
-	isc_nm_destroy(&netmgr);
-
-	/*
-	 * Note: when TCP connections are shut down, there will be a final
-	 * call to the isccc callback routine with &rndc_ccmsg as its
-	 * argument. We therefore need to delay invalidating it until
-	 * after the netmgr is destroyed.
-	 */
-	isccc_ccmsg_invalidate(&rndc_ccmsg);
-
+	isc_socketmgr_destroy(&socketmgr);
 	isc_log_destroy(&log);
 	isc_log_setcontext(NULL);

@@ -1079,6 +1069,7 @@ main(int argc, char **argv) {
 	cfg_parser_destroy(&pctx);

 	isc_mem_put(rndc_mctx, args, argslen);
+	isccc_ccmsg_invalidate(&ccmsg);

 	isc_buffer_free(&databuf);

@@ -374,7 +374,7 @@ a run of the full test suite (e.g. the tests are started with "runall.sh").

 3.  Each script should start with the following lines:

-    . ../conf.sh
+    . $SYSTEMTESTTOP/conf.sh

 "conf.sh" defines a series of environment variables together with functions
 useful for the test scripts. (conf.sh.win32 is the Windows equivalent of this
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 $SHELL clean.sh
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 3 >ns2/example.db
@@ -9,10 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

 status=0
 t=0
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 $SHELL clean.sh
 copy_setports ns1/named1.conf.in ns1/named.conf
@@ -9,10 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="-p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

 status=0
 n=0
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 cp -f ns1/redirect.db.1 ns1/redirect.db
 cp -f ns2/redirect.db.1 ns2/redirect.db
@@ -9,10 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

 check_zonestatus() (
    $RNDCCMD "10.53.0.$1" zonestatus -redirect > "zonestatus.out.ns$1.$n" &&
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ../common/controls.conf.in ns2/controls.conf
 copy_setports  ns1/named.conf.in ns1/named.conf
@@ -50,7 +50,7 @@
 # and querying as necessary.
 #

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"

@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="+tcp -p ${PORT}"

@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 zone=.
 zonefile=root.db
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 # Have the child generate subdomain keys and pass DS sets to us.
 ( cd ../ns3 && $SHELL keygen.sh )
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 SYSTESTDIR=autosign

@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -9,13 +9,13 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 n=0

 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

 # convert private-type records to readable form
 showprivate () {
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -7,10 +7,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="-p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

 status=0
 n=0
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 n=0
@@ -7,7 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 cp -f ns1/dynamic.db.in ns1/dynamic.db
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="+tcp +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"

@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 $SHELL clean.sh

@@ -12,14 +12,14 @@
 set -e

 # shellcheck source=conf.sh
-. ../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 dig_with_opts() {
 	"$DIG" -p "${PORT}" "$@"
 }

 rndccmd() (
-	"$RNDC" -c ../common/rndc.conf -p "${CONTROLPORT}" -s "$@"
+	"$RNDC" -c "$SYSTEMTESTTOP/common/rndc.conf" -p "${CONTROLPORT}" -s "$@"
 )

 _wait_for_message() (
@@ -11,7 +11,7 @@

 set -eu

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 touch empty

@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 n=0
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 zone=example.
 zonefile=example.db
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -7,10 +7,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="-p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

 sendcmd() {
    send 10.53.0.4 "${EXTRAPORT1}"
@@ -7,7 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 n=0
@@ -7,7 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 $SHELL clean.sh

@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 n=1
@@ -7,7 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 ln -s $CHECKZONE named-compilezone

@@ -7,7 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 n=1
@@ -13,7 +13,8 @@
 # Clean up after system tests.
 #

-. ./conf.sh
+SYSTEMTESTTOP=.
+. $SYSTEMTESTTOP/conf.sh


 find . -type f \( \
@@ -24,7 +25,7 @@ find . -type f \( \

 status=0

-rm -f ../random.data
+rm -f $SYSTEMTESTTOP/random.data

 for d in $SUBDIRS
 do
@@ -9,6 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 [ -x "$TOP_BUILDDIR/bin/pkcs11/pkcs11-destroy" ] && $PK11DEL -w0 > /dev/null 2>&1
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -9,10 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="-p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

 status=0
 n=0
@@ -9,6 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named1.conf.in ns1/named.conf
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 n=0
@@ -9,6 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 $SHELL clean.sh
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p 5300"
 status=0
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0

@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 # shellcheck source=conf.sh
-. ../../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 set -e

@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 # shellcheck source=conf.sh
-. ../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 set -e

@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 # shellcheck source=conf.sh
-. ../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 set -e

@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 if ! $FEATURETEST --with-dlz-filesystem; then
        echo_i "DLZ filesystem driver not supported"
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 $SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 n=0
@@ -1,4 +1,4 @@
-#!/bin/sh -ex
+#!/bin/sh
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
@@ -9,4 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-exec "${2}" "${1}/$(basename "${2}").in" -max_total_time=5 -print_pcs=1 -print_final_stats=1 -print_corpus_stats=1 -print_coverage=1
+. $SYSTEMTESTTOP/conf.sh
+
+$FEATURETEST --have-dlopen ||  {
+        echo_i "dlopen() not supported - skipping dlzexternal test"
+        exit 255
+}
+exit 0
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 $TSIGKEYGEN ddns-key.example.nil > ns1/ddns.key

@@ -9,13 +9,13 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 n=0

 DIGOPTS="@10.53.0.1 -p ${PORT} +nocookie"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

 newtest() {
 	n=`expr $n + 1`
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 zone=signed
 infile=example.db
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 n=0
@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 # shellcheck source=conf.sh
-. ../../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 set -e

@@ -1,165 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				2000042407 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns2
-			NS	ns3
-ns2			A	10.53.0.2
-ns3			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-d			A	10.0.0.4
-
-; Used for testing ANY queries
-foo			TXT	"testing"
-foo			A	10.0.1.0
-
-bad-cname		CNAME   a
-bad-dname		DNAME   @
-
-; Used for testing CNAME queries
-cname1			CNAME	cname1-target
-cname1-target		TXT	"testing cname"
-
-cname2			CNAME	cname2-target
-cname2-target		TXT	"testing cname"
-
-; Used for testing DNAME queries
-dname1			DNAME	dname1-target
-foo.dname1-target	TXT	"testing dname"
-
-dname2			DNAME	dname2-target
-foo.dname2-target	TXT	"testing dname"
-
-; A secure subdomain
-secure			NS	ns3.secure
-ns3.secure		A	10.53.0.3
-
-; An insecure subdomain
-insecure		NS	ns.insecure
-ns.insecure		A	10.53.0.3
-
-; A secure subdomain we're going to inject bogus data into
-bogus			NS	ns.bogus
-ns.bogus		A	10.53.0.3
-
-; A subdomain with a corrupt DS
-badds			NS	ns.badds
-ns.badds		A	10.53.0.3
-
-; A dynamic secure subdomain
-dynamic			NS	dynamic
-dynamic			A	10.53.0.3
-
-; A insecure subdomain
-mustbesecure		NS	ns.mustbesecure
-ns.mustbesecure		A	10.53.0.3
-
-; A subdomain with expired signatures
-expired			NS	ns.expired
-ns.expired		A	10.53.0.3
-
-; A rfc2535 signed zone w/ CNAME
-rfc2535			NS	ns.rfc2535
-ns.rfc2535		A	10.53.0.3
-
-z			A	10.0.0.26
-
-keyless			NS	ns.keyless
-ns.keyless		A	10.53.0.3
-
-nsec3			NS	ns.nsec3
-ns.nsec3		A	10.53.0.3
-
-optout			NS	ns.optout
-ns.optout		A	10.53.0.3
-
-nsec3-unknown		NS	ns.nsec3-unknown
-ns.nsec3-unknown	A	10.53.0.3
-
-optout-unknown		NS	ns.optout-unknown
-ns.optout-unknown	A	10.53.0.3
-
-dnskey-unknown		NS	ns.dnskey-unknown
-ns.dnskey-unknown	A	10.53.0.3
-
-dnskey-unsupported	NS	ns.dnskey-unsupported
-ns.dnskey-unsupported	A	10.53.0.3
-
-dnskey-nsec3-unknown	NS	ns.dnskey-nsec3-unknown
-ns.dnskey-nsec3-unknown	A	10.53.0.3
-
-multiple		NS	ns.multiple
-ns.multiple		A	10.53.0.3
-
-*.wild			A	10.0.0.27
-
-rsasha256		NS	ns.rsasha256
-ns.rsasha256		A	10.53.0.3
-
-rsasha512		NS	ns.rsasha512
-ns.rsasha512		A	10.53.0.3
-
-kskonly			NS	ns.kskonly
-ns.kskonly		A	10.53.0.3
-
-update-nsec3		NS	ns.update-nsec3
-ns.update-nsec3		A	10.53.0.3
-
-auto-nsec		NS	ns.auto-nsec
-ns.auto-nsec		A	10.53.0.3
-
-auto-nsec3		NS	ns.auto-nsec3
-ns.auto-nsec3		A	10.53.0.3
-
-
-below-cname		CNAME	some.where.else.
-
-insecure.below-cname	NS	ns.insecure.below-cname
-ns.insecure.below-cname	A	10.53.0.3
-
-secure.below-cname	NS	ns.secure.below-cname
-ns.secure.below-cname	A	10.53.0.3
-
-ttlpatch		NS	ns.ttlpatch
-ns.ttlpatch		A	10.53.0.3
-
-split-dnssec		NS	ns.split-dnssec
-ns.split-dnssec		A	10.53.0.3
-
-split-smart		NS	ns.split-smart
-ns.split-smart		A	10.53.0.3
-
-upper			NS	ns.upper
-ns.upper		A	10.53.0.3
-
-LOWER			NS	NS.LOWER
-NS.LOWER		A	10.53.0.3
-
-expiring                 NS      ns.expiring
-ns.expiring              A       10.53.0.3
-
-future			NS	ns.future
-ns.future		A	10.53.0.3
-
-managed-future		NS	ns.managed-future
-ns.managed-future	A	10.53.0.3
-
-revkey			NS	ns.revkey
-ns.revkey		A	10.53.0.3
-
-dname-at-apex-nsec3	NS	ns3
@@ -182,13 +182,4 @@ zone "corp" {
 	file "corp.db";
 };

-zone "hours-vs-days" {
-	type master;
-	file "hours-vs-days.db.signed";
-	auto-dnssec maintain;
-	/* validity 500 days, resign in 499 days */
-	sig-validity-interval 500 499;
-	allow-update { any; };
-};
-
 include "trusted.conf";
@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 # shellcheck source=conf.sh
-. ../../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 set -e

@@ -308,11 +308,3 @@ sed 's/DNSKEY/CDNSKEY/' "$key1.key" > "$key1.cdnskey"
 cat "$infile" "$key1.key" "$key2.key" "$key1.cdnskey" "$key1.cds" > "$zonefile"
 # Don't sign, let auto-dnssec maintain do it.
 mv $zonefile "$zonefile.signed"
-
-zone=hours-vs-days
-infile=hours-vs-days.db.in
-zonefile=hours-vs-days.db
-key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
-key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
-$SETTIME -P sync now "$key1" > /dev/null
-cat "$infile" > "$zonefile.signed"
@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 # shellcheck source=conf.sh
-. ../../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 set -e

@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 # shellcheck source=conf.sh
-. ../../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 set -e

@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 # shellcheck source=conf.sh
-. ../../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 set -e

@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 # shellcheck source=conf.sh
-. ../../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 set -e

@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 # shellcheck source=conf.sh
-. ../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 set -e

@@ -10,7 +10,7 @@
 # information regarding copyright ownership.

 # shellcheck source=conf.sh
-. ../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 set -e

@@ -36,7 +36,7 @@ delv_with_opts() {
 }

 rndccmd() {
-    "$RNDC" -c ../common/rndc.conf -p "$CONTROLPORT" -s "$@"
+    "$RNDC" -c "$SYSTEMTESTTOP/common/rndc.conf" -p "$CONTROLPORT" -s "$@"
 }

 # TODO: Move loadkeys_on to conf.sh.common
@@ -3806,7 +3806,7 @@ ret=0
 dig_with_opts . dnskey +ednsopt=KEY-TAG:fffe +ednsopt=KEY-TAG:fffd @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep "trust-anchor-telemetry './IN' from .* 65534" ns1/named.run > /dev/null || ret=1
 grep "trust-anchor-telemetry './IN' from .* 65533" ns1/named.run > /dev/null && ret=1
-$PERL ../stop.pl dnssec ns1 || ret=1
+$PERL $SYSTEMTESTTOP/stop.pl dnssec ns1 || ret=1
 nextpart ns1/named.run > /dev/null
 start_server --noclean --restart --port ${PORT} dnssec ns1 || ret=1
 n=$(($n+1))
@@ -4270,16 +4270,5 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

-echo_i "checking sig-validity-interval second field hours vs days ($n)"
-ret=0
-# zone configured with 'sig-validity-interval 500 499;'
-# 499 days in the future w/ a 20 minute runtime to now allowance
-min=$(TZ=UTC $PERL -e '@lt=localtime(time() + 499*3600*24 - 20*60); printf "%.4d%0.2d%0.2d%0.2d%0.2d%0.2d\n",$lt[5]+1900,$lt[4]+1,$lt[3],$lt[2],$lt[1],$lt[0];')
-dig_with_opts @10.53.0.2 hours-vs-days AXFR > dig.out.ns2.test$n
-awk -v min=$min '$4 == "RRSIG" { if ($9 < min) { exit(1); } }' dig.out.ns2.test$n || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="+short -p ${PORT}"
 RNDCCMD="$RNDC -p ${CONTROLPORT} -c ../common/rndc.conf"
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -7,7 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 DIGOPTS="+tcp +noadd +nosea +nostat +noquest -p ${PORT}"

@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 zone=.
 infile=root.db.in
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 zone1=good
 infile1=good.db.in
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0

@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 zone=signing.test
 rm -rf keys/signing.test
@@ -7,7 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 $SHELL clean.sh

@@ -7,7 +7,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 start=`date +%s`
@@ -589,8 +589,7 @@ static dns_dbmethods_t sampledb_methods = {
 	NULL, /* getsize */
 	NULL, /* setservestalettl */
 	NULL, /* getservestalettl */
-	NULL, /* setgluecachestats */
-	NULL  /* adjusthashsize */
+	NULL  /* setgluecachestats */
 };

 /* Auxiliary driver functions. */
@@ -9,6 +9,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-echo "The AFL log compiler is not implemented yet."
+. $SYSTEMTESTTOP/conf.sh

-exit 1
+$FEATURETEST --have-dlopen ||  {
+        echo_i "dlopen() not supported - skipping dyndb test"
+        exit 255
+}
+exit 0
@@ -9,6 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 copy_setports ns1/named.conf.in ns1/named.conf
@@ -9,13 +9,13 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-. ../conf.sh
+. $SYSTEMTESTTOP/conf.sh

 status=0
 n=0

 DIGOPTS="@10.53.0.1 -p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

 newtest() {
 	n=`expr $n + 1`
@@ -11,7 +11,7 @@

 set -e

-. ../../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 zone=.
 infile=root.db.in
@@ -11,7 +11,7 @@

 set -e

-. ../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
@@ -11,7 +11,7 @@

 set -e

-. ../conf.sh
+. "$SYSTEMTESTTOP/conf.sh"

 status=0
 n=1
--- a/Show More
+++ b/Show More