WIP: Add preliminary DoH client support to dig

Unit-test fixes and manual page updates for DoH configuration
This commit contains fixes to unit tests to make them work well on various platforms (in particular ones shipping old versions of OpenSSL) and fo different configurations. It also updates the generated manpage to include DoH configuration options.
2021-02-02 20:20:10 +02:00 · 2021-02-02 20:20:10 +02:00 · 2021-02-02 20:20:01 +02:00 · 2021-02-02 20:02:13 +02:00 · 2021-02-02 19:53:34 +02:00 · 2021-02-02 19:44:52 +02:00
396 changed files with 39353 additions and 8964 deletions
@@ -11,6 +11,7 @@ BraceWrapping:
  AfterFunction:   false # should also be MultiLine, but not yet supported
  AfterExternBlock: false
  BeforeElse:      false
+  BeforeWhile:     false
  IndentBraces:    false
  SplitEmptyFunction: true
 AllowShortIfStatementsOnASingleLine: false
@@ -19,6 +20,7 @@ AlwaysBreakAfterReturnType: All
 Cpp11BracedListStyle: false
 ColumnLimit: 80
 AlignAfterOpenBracket: Align
+AlignConsecutiveBitFields: true
 AlignConsecutiveDeclarations: false
 AlignConsecutiveMacros: true
 AlignTrailingComments: true
@@ -62,6 +64,7 @@ IncludeCategories:
    Priority:        1
  - Regex:           '.*'
    Priority:        0
+IndentExternBlock: NoIndent
 KeepEmptyLinesAtTheStartOfBlocks: false
 MaxEmptyLinesToKeep: 1
 PenaltyBreakAssignment: 30
@@ -11,6 +11,7 @@ BraceWrapping:
  AfterFunction:   false # should also be MultiLine, but not yet supported
  AfterExternBlock: false
  BeforeElse:      false
+  BeforeWhile:     false
  IndentBraces:    false
  SplitEmptyFunction: true
 AllowShortIfStatementsOnASingleLine: false
@@ -19,6 +20,7 @@ AlwaysBreakAfterReturnType: All
 Cpp11BracedListStyle: false
 ColumnLimit: 80
 AlignAfterOpenBracket: Align
+AlignConsecutiveBitFields: true
 AlignConsecutiveDeclarations: true
 AlignConsecutiveMacros: true
 AlignTrailingComments: true
@@ -50,6 +52,7 @@ IncludeCategories:
    Priority:        1
  - Regex:           '".*"'
    Priority:        9
+IndentExternBlock: NoIndent
 KeepEmptyLinesAtTheStartOfBlocks: false
 MaxEmptyLinesToKeep: 1
 PenaltyBreakAssignment: 30
@@ -106,6 +106,9 @@
 	 (list
 	  "--enable=all"
 	  "--suppress=missingIncludeSystem"
+	  "--suppress=nullPointerRedundantCheck"
+	  (concat "--suppressions-list=" (expand-file-name
+			       (concat directory-of-current-dir-locals-file "util/suppressions.txt")))
 	  (concat "-include=" (expand-file-name
 			       (concat directory-of-current-dir-locals-file "config.h")))
 	  )
@@ -61,6 +61,8 @@ named.memstats
 named.run
 timestamp
 /compile_commands.json
+# Gets generated by Build Ear (bear)
+/compile_commands.commands.json
 /cppcheck_html/
 /cppcheck.results
 /tsan
@@ -87,3 +89,13 @@ doc/man/pkcs11-destroy.8in
 doc/man/pkcs11-keygen.8in
 doc/man/pkcs11-list.8in
 doc/man/pkcs11-tokens.8in
+# clangd index directory
+/\.cache/
+# GNU Global index files
+/GPATH
+/GRTAGS
+/GTAGS
+# Emacs specific files
+\.dir-locals-2.el
+/emacs.desktop
+/emacs.desktop-lock
@@ -16,16 +16,16 @@ variables:
  TEST_PARALLEL_JOBS: 6

  CONFIGURE: ./configure
-  CLANG: clang-10
-  SCAN_BUILD: scan-build-10
-  ASAN_SYMBOLIZER_PATH: /usr/lib/llvm-10/bin/llvm-symbolizer
-  CLANG_FORMAT: clang-format-10
+  CLANG: clang-11
+  SCAN_BUILD: scan-build-11
+  ASAN_SYMBOLIZER_PATH: /usr/lib/llvm-11/bin/llvm-symbolizer
+  CLANG_FORMAT: clang-format-11

  CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls -O1 -g -Wall -Wextra 

  # Pass run-time flags to AddressSanitizer to get core dumps on error.
  ASAN_OPTIONS_COMMON: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
-  TSAN_OPTIONS_COMMON: "second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=/usr/lib/llvm-10/bin/llvm-symbolizer"
+  TSAN_OPTIONS_COMMON: "second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=/usr/lib/llvm-11/bin/llvm-symbolizer"

  TARBALL_EXTENSION: xz

@@ -42,6 +42,10 @@ variables:
  # In multithreaded unit tests, abort on the first failure
  CMOCKA_TEST_ABORT: 1

+  # Default platforms to run "stress" tests on
+  BIND_STRESS_TEST_OS: linux
+  BIND_STRESS_TEST_ARCH: amd64
+
 stages:
  - autoconf
  - precheck
@@ -281,6 +285,7 @@ stages:
         "with-openssl=C:/OpenSSL"
         "with-libxml2=C:/libxml2"
         "with-libuv=C:/libuv"
+         "with-nghttp2=C:/nghttp2"
         "without-python"
         "with-system-tests"
         x64'
@@ -379,6 +384,7 @@ stages:
  <<: *default_triggering_rules
  stage: unit
  before_script:
+    - if [ -n "$TCP_CONNECTIONTIMEOUT" ]; then sudo sysctl 'net.inet.tcp.keepinittime=1'; fi
    - *setup_softhsm
  script:
    - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1
@@ -418,9 +424,6 @@ stages:
  <<: *default_triggering_rules
  stage: postcheck
  script:
-    # Workaround for cppcheck 2.0 uninitvar false positives triggered by (&var)->field syntax
-    # (see: https://sourceforge.net/p/cppcheck/discussion/general/thread/122153e3c1/)
-    - sed -i '/^#define ISC__BUFFER.*\\$/{s|_b|__b|;N;s|do {|\0 isc_buffer_t *_b = (isc_buffer_t *)__b;|}; /^#define ISC__BUFFER.*REGION.*\\$/{s|_r|__r|;N;s|do {|\0 isc_region_t *_r = (isc_region_t *)__r;|; /USEDREGION/{s|isc_buffer_t|const \0|g}}' lib/isc/include/isc/buffer.h
    - *configure
    - (make -nwk all || true) | compiledb
    - export GCC_VERSION=$(gcc --version | sed -n 's/.* \([0-9]\+\)\.[0-9]\+\.[0-9]\+.*/\1/p')
@@ -453,9 +456,11 @@ misc:
    - sh util/tabify-changes < CHANGES > CHANGES.tmp
    - diff -urNap CHANGES CHANGES.tmp
    - perl util/check-changes CHANGES
+    - sh util/check-line-length.sh CHANGES
    - test ! -f CHANGES.SE || sh util/tabify-changes < CHANGES.SE > CHANGES.tmp
    - test ! -f CHANGES.SE || diff -urNap CHANGES.SE CHANGES.tmp
    - test ! -f CHANGES.SE || perl util/check-changes master=0 CHANGES.SE
+    - test ! -f CHANGES.SE || sh util/check-line-length.sh CHANGES.SE
    - rm CHANGES.tmp
    - perl -w util/merge_copyrights
    - diff -urNap util/copyrights util/newcopyrights
@@ -1215,6 +1220,8 @@ unit:clang:openbsd:amd64:
  <<: *unit_test_job
  variables:
    USER: gitlab-runner
+    # There's no socket option on OpenBSD, so we need to set this globally
+    TCP_CONNECTIONTIMEOUT: 1
  needs:
    - job: clang:openbsd:amd64
      artifacts: true
@@ -1317,10 +1324,10 @@ release:
  )
  test "$(md5sum cov-analysis-linux64.tgz | awk '{ print $1 }')" = "$(cat cov-analysis-linux64.md5)"
  tar --extract --gzip --file=cov-analysis-linux64.tgz
-  test -d cov-analysis-linux64-2019.03
+  test -d cov-analysis-linux64-2020.09

 .coverity_build: &coverity_build |
-  cov-analysis-linux64-2019.03/bin/cov-build --dir cov-int sh -c 'make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1'
+  cov-analysis-linux64-2020.09/bin/cov-build --dir cov-int sh -c 'make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1'
  tar --create --gzip --file=cov-int.tar.gz cov-int/
  curl -v https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME \
       --form token=$COVERITY_SCAN_TOKEN \
@@ -1356,7 +1363,7 @@ coverity:
      - $COVERITY_SCAN_PROJECT_NAME
      - $COVERITY_SCAN_TOKEN
  cache:
-    key: cov-analysis-linux64-2019.03
+    key: cov-analysis-linux64-2020.09
    paths:
      - cov-analysis-linux64.md5
      - cov-analysis-linux64.tgz
@@ -1410,9 +1417,6 @@ respdiff:
  needs:
    - job: autoreconf
      artifacts: true
-  only:
-    - schedules
-    - tags
  artifacts:
    untracked: true
    expire_in: "1 day"
@@ -1429,6 +1433,9 @@ stress:authoritative:fedora:33:amd64:
    MODE: authoritative
    RATE: 10000
    RUN_TIME: 1
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

 stress:recursive:fedora:33:amd64:
  <<: *fedora_33_amd64_image
@@ -1440,6 +1447,9 @@ stress:recursive:fedora:33:amd64:
    MODE: recursive
    RATE: 10000
    RUN_TIME: 1
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

 stress:authoritative:fedora:33:arm64:
  <<: *fedora_33_arm64_image
@@ -1451,6 +1461,9 @@ stress:authoritative:fedora:33:arm64:
    MODE: authoritative
    RATE: 10000
    RUN_TIME: 1
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

 stress:recursive:fedora:33:arm64:
  <<: *fedora_33_arm64_image
@@ -1462,8 +1475,11 @@ stress:recursive:fedora:33:arm64:
    MODE: recursive
    RATE: 10000
    RUN_TIME: 1
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:authoritative:freebsd12:
+stress:authoritative:freebsd12:amd64:
  <<: *freebsd_12_amd64_image
  <<: *freebsd_stress_amd64
  <<: *stress_job
@@ -1473,10 +1489,11 @@ stress:authoritative:freebsd12:
    MODE: authoritative
    RATE: 10000
    RUN_TIME: 1
-  # See: https://gitlab.isc.org/isc-projects/bind9/-/issues/1941
-  allow_failure: true
+  only:
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:recursive:freebsd12:
+stress:recursive:freebsd12:amd64:
  <<: *freebsd_12_amd64_image
  <<: *freebsd_stress_amd64
  <<: *stress_job
@@ -1486,41 +1503,9 @@ stress:recursive:freebsd12:
    MODE: recursive
    RATE: 10000
    RUN_TIME: 1
-  # See: https://gitlab.isc.org/isc-projects/bind9/-/issues/1941
-  allow_failure: true
-
-# ABI check
-
-abi-check:
-  <<: *base_image
-  stage: build
-  needs:
-    - job: autoreconf
-      artifacts: true
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
-    BIND_BASELINE_VERSION: v9_17_6
-  script:
-    - *configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} V=1
-    - git clone --branch "${BIND_BASELINE_VERSION}" --depth 1 https://gitlab.isc.org/isc-projects/bind9.git refbind
-    - cd refbind/
-    - autoreconf -fi
-    - *configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} V=1
-    - cd ..
-    - util/api-checker.sh . refbind
-  artifacts:
-    paths:
-      - "*-lib*.html"
-      - "*-lib*.txt"
-      - "abi-*.dump"
-    expire_in: "1 week"
  only:
-    - main@isc-projects/bind9
-    - /^v9_[1-9][0-9]$/@isc-projects/bind9
+    variables:
+      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

 gcov:
  <<: *base_image
@@ -6,6 +6,26 @@

 **Public Release:**

+## Documentation Review Links
+
+**Closed issues assigned to the milestone without a release note:**
+
+ - []()
+ - []()
+ - []()
+
+**Merge requests merged into the milestone without a release note:**
+
+ - []()
+ - []()
+ - []()
+
+**Merge requests merged into the milestone without a `CHANGES` entry:**
+
+ - []()
+ - []()
+ - []()
+
 ## Release Checklist

 ### Before the Code Freeze
@@ -21,20 +41,17 @@

 - [ ] ***(QA)*** Look for outstanding documentation issues (e.g. `CHANGES` mistakes) and address them if any are found.
 - [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well.
- - [ ] ***(Support)*** Check release notes, ask QA to correct any mistakes found.
- - [ ] ***(Marketing)*** Check release notes, ask QA to correct any mistakes found.
- - [ ] ***(SwEng)*** Update API files for libraries with new version information.
- - [ ] ***(SwEng)*** Change software version and library versions in `configure.ac` (new major release only).
- - [ ] ***(SwEng)*** Rebuild `configure` using Autoconf on `docs.isc.org`.
- - [ ] ***(SwEng)*** Update `CHANGES`.
- - [ ] ***(SwEng)*** Update `CHANGES.SE` (Subscription Edition only).
- - [ ] ***(SwEng)*** Update `README.md`.
- - [ ] ***(SwEng)*** Update `version`.
- - [ ] ***(SwEng)*** Build documentation on `docs.isc.org`.
- - [ ] ***(QA)*** Check that all the above steps were performed correctly.
+ - [ ] ***(QA)*** Update API files for libraries with new version information.
+ - [ ] ***(QA)*** Change software version and library versions in `configure.ac` (new major release only).
+ - [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org`.
+ - [ ] ***(QA)*** Update `CHANGES`.
+ - [ ] ***(QA)*** Update `CHANGES.SE` (Subscription Edition only).
+ - [ ] ***(QA)*** Update `README.md`.
+ - [ ] ***(QA)*** Update `version`.
+ - [ ] ***(QA)*** Build documentation on `docs.isc.org`.
 - [ ] ***(QA)*** Check that the formatting is correct for text, PDF, and HTML versions of release notes.
- - [ ] ***(SwEng)*** Tag the releases[^2].  (Tags may only be pushed to the public repository for releases which are *not* security releases.)
- - [ ] ***(SwEng)*** If this is the first tag for a release (e.g. beta), create a release branch named `release_v9_X_Y` to allow development to continue on the maintenance branch whilst release engineering continues.
+ - [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
+ - [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9_x_y`).

 ### Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)

@@ -64,13 +81,11 @@
 - [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
 - [ ] ***(Marketing)*** Write blog article (if a major release).
 - [ ] ***(QA)*** Ensure all new tags are annotated and signed.
- - [ ] ***(SwEng)*** Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`).
- - [ ] ***(SwEng)*** Push tags for the published releases to the public repository.
+ - [ ] ***(QA)*** Push tags for the published releases to the public repository.
+ - [ ] ***(QA)*** Merge the automatically prepared `prep 9.x.y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_x`).
 - [ ] ***(QA)*** For each maintained branch, update the `BIND_BASELINE_VERSION` variable for the `abi-check` job in `.gitlab-ci.yml` to the latest published BIND version tag for a given branch.
 - [ ] ***(QA)*** Prepare empty release notes for the next set of releases.
 - [ ] ***(QA)*** Sanitize all confidential issues assigned to the release milestone and make them public.
 - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.

 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
-
-[^2]: Preferred command line: `git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]`, where `[alphatag]` is an optional string such as `b1`, `rc1`, etc.
@@ -1,48 +1,206 @@
-5533.	[func]		Add "stale-refresh-time" option, a time window that
-			starts after a failed lookup, during which stale rrset
-			will be served directly from cache before a new
-			attempt to refresh it is made. [GL #2066]
+5575.	[func]		Initial support for DNS-over-HTTP(S). BIND now
+			includes DNS-over-HTTP(S) layer built on top of nghttp2.
+			Both encrypted (via TLS) and unencrypted HTTP/2 connections
+			are supported.
+
+5574.	[func]		Incoming zone transfers can now use TLS.
+			Addresses in a "primaries" list take an optional
+			"tls" argument, specifying either a previously
+			configured "tls" block or "ephemeral"; SOA queries
+			and zone transfer requests will then be sent via
+			TLS. [GL #2392]
+
+5573.	[func]		Also return stale data if an error occurred and we are
+			not resuming. Only start the stale-refresh-time window
+			if we timed out. [GL #2434]
+
+5572.	[bug]		Address potential double free in generatexml.
+			[GL #2420]
+
+5571.	[bug]		If a zone had a non-builtin named allow-update acl
+			named failed to start. [GL #2413]
+
+5570.	[bug]		Improve the performance of dnssec-verify by reducing
+			the number of repeated calls to dns_dnssec_keyfromrdata.
+			[GL #2073]
+
+5569.	[bug]		Emit useful error message when 'rndc retransfer' is
+			applied to a zone of inappropriate type. [GL #2342]
+
+5568.	[bug]		Fixed a crash in "dnssec-keyfromlabel" when using ECDSA
+			keys. [GL #2178]
+
+5567.	[bug]		Dig now reports unknown dash options while pre-parsing
+			the options.  This prevents '-multi' instead of
+			'+multi' reporting memory usage before ending option
+			parsing on 'Invalid option: -lti'. [GL #2403]
+
+5566.	[func]		Add "stale-answer-client-timeout" option, which
+			is the amount of time a recursive resolver waits before
+			attempting to answer the query using stale data from
+			cache. [GL #2247]
+
+5565.	[func]		The SONAMEs for BIND 9 libraries now include the current
+			BIND 9 version number, in an effort to tightly couple
+			internal libraries with a specific release. [GL #2387]
+
+5564.	[cleanup]	Refactored the network manager TLSDNS module to use
+			libuv and libssl directly, rather than opening a
+			TLS/TCP socket stack. [GL #2235]
+
+5563.	[cleanup]	Changed several obsolete configuration options to
+			ancient, making them into fatal errors. Also cleaned
+			up the number of clause flags in the configuration
+			parser. [GL #1086]
+
+5562.	[placeholder]
+
+5561.	[bug]		KASP incorrectly set signature validity to the value
+			of the DNSKEY signature validity. This is now fixed.
+			[GL #2383]
+
+5560.	[func]		The default value of "max-stale-ttl" has been changed
+			from 12 hours to 1 day and the default value of
+			"stale-answer-ttl" has been changed from 1 second to
+			30 seconds, following RFC 8767 recommendations.
+			[GL #2248]
+
+	--- 9.17.9 released ---
+
+5559.	[bug]		The --with-maxminddb=PATH form of the build-time option
+			enabling support for libmaxminddb was not working
+			correctly. This has been fixed. [GL #2366]
+
+5558.	[bug]		Asynchronous hook modules could trigger an assertion
+			failure when the fetch handle was detached too late.
+			Thanks to Jinmei Tatuya at Infoblox. [GL #2379]
+
+5557.	[bug]		Prevent RBTDB instances from being destroyed by multiple
+			threads at the same time. [GL #2317]
+
+5556.	[bug]		Further tweak newline printing in dnssec-signzone and
+			dnssec-verify. [GL #2359]
+
+5555.	[placeholder]
+
+5554.	[bug]		dnssec-signzone and dnssec-verify were missing newlines
+			between log messages. [GL #2359]
+
+5553.	[bug]		When reconfiguring named, removing "auto-dnssec" did not
+			turn off DNSSEC maintenance. [GL #2341]
+
+5552.	[func]		When switching to "dnssec-policy none;", named now
+			permits a safe transition to insecure mode and publishes
+			the CDS and CDNSKEY DELETE records, as described in RFC
+			8078. [GL #1750]
+
+5551.	[bug]		named no longer attempts to assign threads to CPUs
+			outside the CPU affinity set. Thanks to Ole Bjørn
+			Hessen. [GL #2245]
+
+5550.	[func]		dnssec-signzone and named now log a warning when falling
+			back to the "increment" SOA serial method. [GL #2058]
+
+5549.	[protocol]	ipv4only.arpa is now served when DNS64 is configured.
+			[GL #385]
+
+5548.	[placeholder]
+
+5547.	[placeholder]
+
+	--- 9.17.8 released ---
+
+5546.	[placeholder]
+
+5545.	[func]		OS support for load-balanced sockets is no longer
+			required to receive incoming queries in multiple netmgr
+			threads. [GL #2137]
+
+5544.	[func]		Restore the default value of "nocookie-udp-size" to 4096
+			bytes. [GL #2250]
+
+5543.	[bug]		Fix UDP performance issues caused by making netmgr
+			callbacks asynchronous-only. [GL #2320]
+
+5542.	[bug]		Refactor netmgr. [GL #1920] [GL #2034] [GL #2061]
+			[GL #2194] [GL #2221] [GL #2266] [GL #2283] [GL #2318]
+			[GL #2321]
+
+5541.	[func]		Adjust the "max-recursion-queries" default from 75 to
+			100. [GL #2305]
+
+5540.	[port]		Fix building with native PKCS#11 support for AEP Keyper.
+			[GL #2315]
+
+5539.	[bug]		Tighten handling of missing DNS COOKIE responses over
+			UDP by falling back to TCP. [GL #2275]
+
+5538.	[func]		Add NSEC3 support to KASP. A new option for
+			"dnssec-policy", "nsec3param", can be used to set the
+			desired NSEC3 parameters. NSEC3 salt collisions are
+			automatically prevented during resalting. Salt
+			generation is now logged with zone context. [GL #1620]
+
+5537.	[func]		The query plugin mechanism has been extended
+			to support asynchronous operations. For example, a
+			plugin can now trigger recursion and resume
+			processing when it is complete. Thanks to Jinmei
+			Tatuya at Infoblox. [GL #2141]
+
+5536.	[func]		Dig can now report the DNS64 prefixes in use
+			(+dns64prefix). [GL #1154]
+
+5535.	[bug]		dig/nslookup/host could crash on shutdown after an
+			interrupt. [GL #2287] [GL #2288]
+
+5534.	[bug]		The CNAME synthesized from a DNAME was incorrectly
+			followed when the QTYPE was CNAME or ANY. [GL #2280]
+
+	--- 9.17.7 released ---
+
+5533.	[func]		Add the "stale-refresh-time" option, a time window that
+			starts after a failed lookup, during which a stale RRset
+			is served directly from cache before a new attempt to
+			refresh it is made. [GL #2066]

 5532.	[cleanup]	Unused header files were removed:
 			bin/rndc/include/rndc/os.h, lib/isc/timer_p.h,
 			lib/isccfg/include/isccfg/dnsconf.h and code related
 			to those files. [GL #1913]

-5531.	[func]		Add a netmgr TLS layer, enabling server-side DoT
-			support (not yet available), and client-side DoT
-			support in dig with "dig +tls". [GL #1840]
+5531.	[func]		Add support for DNS over TLS (DoT) to dig and named.
+			dig output now includes the transport protocol used.
+			[GL #1816] [GL #1840]

-5530.	[bug]		DNSTAP did not capture responses to forwarded
-			UPDATE requests. [GL #2252]
+5530.	[bug]		dnstap did not capture responses to forwarded UPDATE
+			requests. [GL #2252]

-5529.	[func]		The network manager API is now used by named
-			to send zone transfer requests. [GL #2016]
+5529.	[func]		The network manager API is now used by named to send
+			zone transfer requests. [GL #2016]

-5528.	[func]		Convert "dig", "host" and "nslookup" to use the
-			network manager. As a side effect of this change,
-			"dig +unexpected" no longer works, and has been
-			disabled. [GL #2140]
+5528.	[func]		Convert dig, host, and nslookup to use the network
+			manager API. As a side effect of this change, "dig
+			+unexpected" no longer works, and has been disabled.
+			[GL #2140]

-5527.	[bug]		There was a NULL pointer dereference if the creation
-			of the fetch to determine if a negative trust anchor
-			was still valid failed. [GL #2244]
+5527.	[bug]		A NULL pointer dereference occurred when creating an NTA
+			recheck query failed. [GL #2244]

 5526.	[bug]		Fix a race/NULL dereference in TCPDNS read. [GL #2227]

 5525.	[placeholder]

-5524.	[func]		Added functionality to the network manager to
-			support outgoing DNS queries in addition to
-			incoming ones. [GL #2235]
+5524.	[func]		Added functionality to the network manager to support
+			outgoing DNS queries in addition to incoming ones.
+			[GL #2235]

-5523.	[bug]		The initial lookup of a zone transitioning to/from
-			the signed state could fail if the DNSKEY RRset was
-			not found.  Subsequent lookups would succeed.
-			[GL #2236]
+5523.	[bug]		The initial lookup in a zone transitioning to/from a
+			signed state could fail if the DNSKEY RRset was not
+			found. [GL #2236]

-5522.	[bug]		Fix a race/NULL dereference in TCPDNS send. [GL #2227]
+5522.	[bug]		Fixed a race/NULL dereference in TCPDNS send. [GL #2227]

-5521.	[func]		All use of libltdl was dropped.  libuv's shared library
+5521.	[func]		All use of libltdl was dropped. libuv's shared library
 			handling interface is now used instead. [GL !4278]

 5520.	[bug]		Fixed a number of shutdown races, reference counting
@@ -53,12 +211,11 @@
 			lib/dns/portlist.c, lib/isc/bufferlist.c, and code
 			related to those files. [GL #2060]

-5518.	[bug]		Fix stub zone not transferring nameserver addresses
-			from masters configured with 'minimal-responses yes'.
-			[GL #1736]
+5518.	[bug]		Stub zones now work correctly with primary servers using
+			"minimal-responses yes". [GL #1736]

-5517.	[bug]		Handle 'UV_EOF' differently and don't contribute it to
-			the RECVFAIL statistic count. [GL #2208]
+5517.	[bug]		Do not treat UV_EOF as a TCP4RecvErr or a TCP6RecvErr.
+			[GL #2208]

 	--- 9.17.6 released ---

@@ -39,7 +39,7 @@ anyone can see the source, but only ISC employees have commit access.
 In the past, the source could only be seen once ISC had published
 a release; read access to the source repository was restricted just
 as commit access was.  That has changed, as ISC now provides a
-public git mirror to the BIND source tree (see below).
+public git repository of the BIND source tree (see below).

 At ISC, we're committed to
 building communities that are welcoming and inclusive: environments where people
@@ -55,14 +55,12 @@ the industry.
 Public BIND releases are always available from the
 [ISC FTP site](ftp://ftp.isc.org/isc/bind9).

-A public-access GIT repository is also available at
-[https://gitlab.isc.org](https://gitlab.isc.org).
-This repository is a mirror, updated several times per day, of the
-source repository maintained by ISC.  It contains all the public release
-branches; upcoming releases can be viewed in their current state at any
-time.  It does *not* contain development branches or unreviewed work in
-progress.  Commits which address security vulnerablilities are withheld
-until after public disclosure.
+A public-access git repository is also available at
+[https://gitlab.isc.org](https://gitlab.isc.org).  This repository
+contains all public release branches. Upcoming releases can be viewed in
+their current state at any time.  Short-lived development branches
+contain unreviewed work in progress.  Commits which address security
+vulnerablilities are withheld until after public disclosure.

 You can browse the source online via
 [https://gitlab.isc.org/isc-projects/bind9](https://gitlab.isc.org/isc-projects/bind9)
@@ -1,4 +1,4 @@
-Copyright (C) 1996-2020  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2021  Internet Systems Consortium, Inc. ("ISC")

 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -367,3 +367,25 @@ distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
+
+-----------------------------------------------------------------------------
+
+Copyright Joyent, Inc. and other Node contributors. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.
@@ -8,20 +8,19 @@
 - See the COPYRIGHT file distributed with this work for additional
 - information regarding copyright ownership.
 -->
-Setting the `STD_CDEFINES` environment variable before running `configure`
-can be used to enable certain compile-time options that are not explicitly
-defined in `configure`.
+Setting the `CPPFLAGS` environment variable before running `configure`
+can be used to enable certain compile-time options that are not
+explicitly defined in `configure`.

 Some of these settings are:

-|Setting                            |Description |
-|-----------------------------------|----------------------------------------|
-|`-DISC_MEM_DEFAULTFILL=1`|Overwrite memory with tag values when allocating or freeing it; this impairs performance but makes debugging of memory problems easier.|
-|`-DISC_MEM_TRACKLINES=0`|Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult.|
-|<nobr>`-DISC_FACILITY=LOG_LOCAL0`</nobr>|Change the default syslog facility for `named`|
-|`-DNS_CLIENT_DROPPORT=0`|Disable dropping queries from particular well-known ports:|
-|`-DCHECK_SIBLING=0`|Don't check sibling glue in `named-checkzone`|
-|`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
-|`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
-|`-DISC_BUFFER_USEINLINE=0`|Disable the use of inline functions to implement the `isc_buffer` API: this reduces performance but may be useful when debugging |
-|`-DISC_HEAP_CHECK`|Test heap consistency after every heap operation; used when debugging|
+| Setting                      | Description                                                                                                                            |
+| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| `-DCHECK_LOCAL=0`            | Don't check out-of-zone addresses in `named-checkzone`                                                                                 |
+| `-DCHECK_SIBLING=0`          | Don't check sibling glue in `named-checkzone`                                                                                          |
+| `-DISC_FACILITY=LOG_LOCAL0`  | Change the default syslog facility for `named`                                                                                         |
+| `-DISC_HEAP_CHECK`           | Test heap consistency after every heap operation; used when debugging                                                                  |
+| `-DISC_MEM_DEFAULTFILL=1`    | Overwrite memory with tag values when allocating or freeing it; this impairs performance but makes debugging of memory problems easier |
+| `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
+| `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
+| `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
@@ -61,7 +61,7 @@ The following are platforms on which BIND is known to build and run.
 ISC makes every effort to fix bugs on these platforms, but may be unable to
 do so quickly due to lack of hardware, less familiarity on the part of
 engineering staff, and other constraints. With the exception of Windows
-Server 2012 R2, none of these are tested regularly by ISC.
+Server 2016, none of these are tested regularly by ISC.

 * Windows Server 2012 R2, 2016 / x64
 * Windows 10 / x64
@@ -15,7 +15,6 @@
 1. [Introduction](#intro)
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
-1. [BIND 9.17 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
 1. [Dependencies](#dependencies)
@@ -125,16 +124,6 @@ If you prefer, you may also submit code by opening a
 including your patch as an attachment, preferably generated by
 `git format-patch`.

-### <a name="features"/> BIND 9.17 features
-
-BIND 9.17 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.16 and earlier releases. New features include:
-
-* The new option `max-ixfr-ratio` to limit the size of outgoing IXFR responses
-  before falling back to full zone transfers.
-* `rndc nta -d` and `rndc secroots` now include `validate-except` entries
-  when listing negative trust anchors.
-
 ### <a name="build"/> Building BIND 9

 At a minimum, BIND requires a Unix or Linux system with an ANSI C compiler,
@@ -162,8 +151,7 @@ To build on a Unix or Linux system, use:
 		$ ./configure
 		$ make

-If you're planning on making changes to the BIND 9 source, you should run
-`make depend`.  If you're using Emacs, you might find `make tags` helpful.
+If you're using Emacs, you might find `make tags` helpful.

 Several environment variables, which can be set before running `configure`,
 affect compilation.  Significant ones are:
@@ -610,11 +610,13 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	dns_name_t *keyname;
 	isc_result_t result;
 	bool match_root = false;
-	enum { INITIAL_KEY,
-	       STATIC_KEY,
-	       INITIAL_DS,
-	       STATIC_DS,
-	       TRUSTED } anchortype;
+	enum {
+		INITIAL_KEY,
+		STATIC_KEY,
+		INITIAL_DS,
+		STATIC_DS,
+		TRUSTED
+	} anchortype;
 	const cfg_obj_t *obj;

 	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
@@ -30,6 +30,7 @@
 #include <pk11/site.h>

 #include <dns/byaddr.h>
+#include <dns/dns64.h>
 #include <dns/fixedname.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
@@ -206,6 +207,8 @@ help(void) {
 	       "                                      fields in records)\n"
 	       "                 +[no]defname        (Use search list "
 	       "(+[no]search))\n"
+	       "                 +[no]dns64prefix    (Get the DNS64 prefixes "
+	       "from ipv4only.arpa)\n"
 	       "                 +[no]dnssec         (Request DNSSEC records)\n"
 	       "                 +domain=###         (Set default domainname)\n"
 	       "                 +[no]dscp[=###]     (Set the DSCP value to "
@@ -225,6 +228,10 @@ help(void) {
 	       "SERVFAIL)\n"
 	       "                 +[no]header-only    (Send query without a "
 	       "question section)\n"
+	       "                 +[no]https[=###]    (DNS over HTTPS mode) "
+	       "[/]\n"
+	       "                 +[no]https-get      (Use GET instead of "
+	       "default POST method\n"
 	       "                 +[no]identify       (ID responders in short "
 	       "answers)\n"
 #ifdef HAVE_LIBIDN2
@@ -345,6 +352,8 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		}
 		if (query->lookup->tls_mode) {
 			proto = "TLS";
+		} else if (query->lookup->https_mode) {
+			proto = "HTTPS";
 		} else if (query->lookup->tcp_mode) {
 			proto = "TCP";
 		} else {
@@ -473,6 +482,50 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	return (ISC_R_SUCCESS);
 }

+/*%
+ * short_form message print handler.  Calls above say_message()
+ */
+static isc_result_t
+dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
+	dns_rdataset_t *rdataset = NULL;
+	dns_fixedname_t fixed;
+	dns_name_t *name;
+	isc_result_t result;
+	isc_netprefix_t prefix[10];
+	size_t i, count = 10;
+
+	name = dns_fixedname_initname(&fixed);
+	result = dns_name_fromstring(name, "ipv4only.arpa", 0, NULL);
+	check_result(result, "dns_name_fromstring");
+
+	result = dns_message_findname(msg, DNS_SECTION_ANSWER, name,
+				      dns_rdatatype_aaaa, dns_rdatatype_none,
+				      NULL, &rdataset);
+	if (result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) {
+		return (ISC_R_SUCCESS);
+	} else if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
+
+	result = dns_dns64_findprefix(rdataset, prefix, &count);
+	if (result == ISC_R_NOTFOUND)
+		return (ISC_R_SUCCESS);
+	if (count > 10)
+		count = 10;
+	for (i = 0; i < count; i++) {
+		result = isc_netaddr_totext(&prefix[i].addr, buf);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+		result = isc_buffer_printf(buf, "/%u\n", prefix[i].prefixlen);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
 /*%
 * short_form message print handler.  Calls above say_message()
 */
@@ -559,6 +612,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	dns_master_style_t *style = NULL;
 	unsigned int styleflags = 0;
 	bool isquery = (msg == query->lookup->sendmsg);
+	bool dns64prefix = query->lookup->dns64prefix;

 	UNUSED(msgbuf);

@@ -623,14 +677,16 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	check_result(result, "dns_master_stylecreate");

 	if (query->lookup->cmdline[0] != 0) {
-		if (!short_form && printcmd) {
+		if (!short_form && !dns64prefix && printcmd) {
 			printf("%s", query->lookup->cmdline);
 		}
 		query->lookup->cmdline[0] = '\0';
 	}
 	debug("printmessage(%s %s %s)", headers ? "headers" : "noheaders",
 	      query->lookup->comments ? "comments" : "nocomments",
-	      short_form ? "short_form" : "long_form");
+	      short_form    ? "short_form"
+	      : dns64prefix ? "dns64prefix_form"
+			    : "long_form");

 	flags = 0;
 	if (!headers) {
@@ -751,7 +807,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printf("    %s:\n", isquery ? "query_message_data"
 					    : "response_message_data");
 		result = dns_message_headertotext(msg, style, flags, buf);
-	} else if (query->lookup->comments && !short_form) {
+	} else if (query->lookup->comments && !short_form && !dns64prefix) {
 		if (query->lookup->cmdline[0] != '\0' && printcmd) {
 			printf("; %s\n", query->lookup->cmdline);
 		}
@@ -832,7 +888,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 repopulate_buffer:

-	if (query->lookup->comments && headers && !short_form) {
+	if (query->lookup->comments && headers && !short_form && !dns64prefix) {
 		result = dns_message_pseudosectiontotext(
 			msg, DNS_PSEUDOSECTION_OPT, style, flags, buf);
 		if (result == ISC_R_NOSPACE) {
@@ -846,7 +902,7 @@ repopulate_buffer:
 	}

 	if (query->lookup->section_question && headers) {
-		if (!short_form) {
+		if (!short_form && !dns64prefix) {
 			result = dns_message_sectiontotext(
 				msg, DNS_SECTION_QUESTION, style, flags, buf);
 			if (result == ISC_R_NOSPACE) {
@@ -856,13 +912,18 @@ repopulate_buffer:
 		}
 	}
 	if (query->lookup->section_answer) {
-		if (!short_form) {
+		if (!short_form && !dns64prefix) {
 			result = dns_message_sectiontotext(
 				msg, DNS_SECTION_ANSWER, style, flags, buf);
 			if (result == ISC_R_NOSPACE) {
 				goto buftoosmall;
 			}
 			check_result(result, "dns_message_sectiontotext");
+		} else if (dns64prefix) {
+			result = dns64prefix_answer(msg, buf);
+			if (result == ISC_R_NOSPACE)
+				goto buftoosmall;
+			check_result(result, "dns64prefix_answer");
 		} else {
 			result = short_answer(msg, flags, buf, query);
 			if (result == ISC_R_NOSPACE) {
@@ -872,7 +933,7 @@ repopulate_buffer:
 		}
 	}
 	if (query->lookup->section_authority) {
-		if (!short_form) {
+		if (!short_form && !dns64prefix) {
 			result = dns_message_sectiontotext(
 				msg, DNS_SECTION_AUTHORITY, style, flags, buf);
 			if (result == ISC_R_NOSPACE) {
@@ -882,7 +943,7 @@ repopulate_buffer:
 		}
 	}
 	if (query->lookup->section_additional) {
-		if (!short_form) {
+		if (!short_form && !dns64prefix) {
 			result = dns_message_sectiontotext(
 				msg, DNS_SECTION_ADDITIONAL, style, flags, buf);
 			if (result == ISC_R_NOSPACE) {
@@ -976,8 +1037,9 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 * XXX doc options
 */

-static void
-plus_option(char *option, bool is_batchfile, dig_lookup_t *lookup) {
+static dig_lookup_t *
+plus_option(char *option, bool is_batchfile, bool *need_clone,
+	    dig_lookup_t *lookup) {
 	isc_result_t result;
 	char *cmd, *value, *last = NULL, *code, *extra;
 	uint32_t num;
@@ -988,7 +1050,7 @@ plus_option(char *option, bool is_batchfile, dig_lookup_t *lookup) {

 	if ((cmd = strtok_r(option, "=", &last)) == NULL) {
 		printf(";; Invalid option %s\n", option);
-		return;
+		return (lookup);
 	}
 	if (strncasecmp(cmd, "no", 2) == 0) {
 		cmd += 2;
@@ -1155,13 +1217,57 @@ plus_option(char *option, bool is_batchfile, dig_lookup_t *lookup) {
 				usesearch = state;
 			}
 			break;
-		case 'n': /* dnssec */
-			FULLCHECK("dnssec");
-		dnssec:
-			if (state && lookup->edns == -1) {
-				lookup->edns = DEFAULT_EDNS_VERSION;
+		case 'n':
+			switch (cmd[2]) {
+			case 's':
+				switch (cmd[3]) {
+				case '6': /* dns64prefix */
+					FULLCHECK("dns64prefix");
+					if (state) {
+						if (*need_clone) {
+							lookup = clone_lookup(
+								default_lookup,
+								true);
+						}
+						*need_clone = true;
+						lookup->dns64prefix = state;
+						strlcpy(lookup->textname,
+							"ipv4only.arpa",
+							sizeof(lookup->textname));
+						printcmd = false;
+						lookup->section_additional =
+							false;
+						lookup->section_answer = true;
+						lookup->section_authority =
+							false;
+						lookup->section_question =
+							false;
+						lookup->comments = false;
+						lookup->stats = false;
+						lookup->rrcomments = -1;
+						lookup->rdtype =
+							dns_rdatatype_aaaa;
+						lookup->rdtypeset = true;
+						ISC_LIST_APPEND(lookup_list,
+								lookup, link);
+					}
+					break;
+				case 's': /* dnssec */
+					FULLCHECK("dnssec");
+				dnssec:
+					if (state && lookup->edns == -1) {
+						lookup->edns =
+							DEFAULT_EDNS_VERSION;
+					}
+					lookup->dnssec = state;
+					break;
+				default:
+					goto invalid_option;
+				}
+				break;
+			default:
+				goto invalid_option;
 			}
-			lookup->dnssec = state;
 			break;
 		case 'o': /* domain ... but treat "do" as synonym for dnssec */
 			if (cmd[2] == '\0') {
@@ -1312,8 +1418,39 @@ plus_option(char *option, bool is_batchfile, dig_lookup_t *lookup) {
 		lookup->servfail_stops = state;
 		break;
 	case 'h':
-		FULLCHECK("header-only");
-		lookup->header_only = state;
+		switch (cmd[1]) {
+		case 'e': /* header-only */
+			FULLCHECK("header-only");
+			lookup->header_only = state;
+			break;
+		case 't':
+			FULLCHECK2("https", "https-get");
+			switch (cmd[5]) {
+			case '\0':
+				FULLCHECK("https");
+				lookup->https_mode = state;
+				if (!lookup->tcp_mode_set) {
+					lookup->tcp_mode = state;
+				}
+				if (value == NULL) {
+					lookup->https_path = isc_mem_strdup(
+						mctx, DEFAULT_HTTPS_PATH);
+					break;
+				}
+				lookup->https_path = isc_mem_strdup(mctx,
+								    value);
+				break;
+			case '-':
+				FULLCHECK("https-get");
+				lookup->https_get = true;
+				break;
+			default:
+				goto invalid_option;
+			}
+			break;
+		default:
+			goto invalid_option;
+		}
 		break;
 	case 'i':
 		switch (cmd[1]) {
@@ -1871,7 +2008,7 @@ plus_option(char *option, bool is_batchfile, dig_lookup_t *lookup) {
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
-	return;
+	return (lookup);

 #if !TARGET_OS_IPHONE
 exit_or_usage:
@@ -2241,16 +2378,20 @@ preparse_args(int argc, char **argv) {
 			continue;
 		}
 		/* Look for dash value option. */
-		if (strpbrk(option, dash_opts) != &option[0] ||
-		    strlen(option) > 1U) {
-			/* Error or value in option. */
+		if (strpbrk(option, dash_opts) != &option[0]) {
+			goto invalid_option;
+		}
+		if (strlen(option) > 1U) {
+			/* value in option. */
 			continue;
 		}
 		/* Dash value is next argument so we need to skip it. */
 		rc--, rv++;
 		/* Handle missing argument */
 		if (rc == 0) {
-			break;
+		invalid_option:
+			fprintf(stderr, "Invalid option: -%s\n", option);
+			usage();
 		}
 	}
 }
@@ -2382,7 +2523,8 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 				}
 			}
 		} else if (rv[0][0] == '+') {
-			plus_option(&rv[0][1], is_batchfile, lookup);
+			lookup = plus_option(&rv[0][1], is_batchfile,
+					     &need_clone, lookup);
 		} else if (rv[0][0] == '-') {
 			if (rc <= 1) {
 				if (dash_option(&rv[0][1], NULL, &lookup,
@@ -297,6 +297,9 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
 ``+[no]defname``
   This option, which is deprecated, is treated as a synonym for ``+[no]search``.

+``+[no]dns64prefix``
+   Lookup IPV4ONLY.ARPA AAAA and print any DNS64 prefixes found.
+
 ``+[no]dnssec``
   This option requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in
   the OPT record in the additional section of the query.
@@ -608,100 +608,38 @@ make_empty_lookup(void) {

 	INSIST(!free_now);

-	looknew = isc_mem_allocate(mctx, sizeof(struct dig_lookup));
-	looknew->pending = true;
-	looknew->textname[0] = 0;
-	looknew->cmdline[0] = 0;
-	looknew->rdtype = dns_rdatatype_a;
-	looknew->qrdtype = dns_rdatatype_a;
-	looknew->rdclass = dns_rdataclass_in;
-	looknew->rdtypeset = false;
-	looknew->rdclassset = false;
-	looknew->sendspace = NULL;
-	looknew->sendmsg = NULL;
-	looknew->name = NULL;
-	looknew->oname = NULL;
-	looknew->xfr_q = NULL;
-	looknew->current_query = NULL;
-	looknew->doing_xfr = false;
-	looknew->ixfr_serial = 0;
-	looknew->trace = false;
-	looknew->trace_root = false;
-	looknew->identify = false;
-	looknew->identify_previous_line = false;
-	looknew->ignore = false;
-	looknew->servfail_stops = true;
-	looknew->besteffort = true;
-	looknew->dnssec = false;
-	looknew->ednsflags = 0;
-	looknew->opcode = dns_opcode_query;
-	looknew->expire = false;
-	looknew->nsid = false;
-	looknew->tcp_keepalive = false;
-	looknew->padding = 0;
-	looknew->header_only = false;
-	looknew->sendcookie = false;
-	looknew->seenbadcookie = false;
-	looknew->badcookie = true;
-	looknew->multiline = false;
-	looknew->nottl = false;
-	looknew->noclass = false;
-	looknew->onesoa = false;
-	looknew->use_usec = false;
-	looknew->nocrypto = false;
-	looknew->ttlunits = false;
-	looknew->expandaaaa = false;
-	looknew->qr = false;
+	looknew = isc_mem_allocate(mctx, sizeof(*looknew));
+	*looknew = (dig_lookup_t){
+		.pending = true,
+		.rdtype = dns_rdatatype_a,
+		.qrdtype = dns_rdatatype_a,
+		.rdclass = dns_rdataclass_in,
+		.servfail_stops = true,
+		.besteffort = true,
+		.opcode = dns_opcode_query,
+		.badcookie = true,
 #ifdef HAVE_LIBIDN2
-	looknew->idnin = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false;
-	looknew->idnout = looknew->idnin;
-#else  /* ifdef HAVE_LIBIDN2 */
-	looknew->idnin = false;
-	looknew->idnout = false;
+		.idnin = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false,
+		.idnout = looknew->idnin,
 #endif /* HAVE_LIBIDN2 */
-	looknew->udpsize = -1;
-	looknew->edns = -1;
-	looknew->recurse = true;
-	looknew->aaonly = false;
-	looknew->adflag = false;
-	looknew->cdflag = false;
-	looknew->raflag = false;
-	looknew->tcflag = false;
-	looknew->print_unknown_format = false;
-	looknew->zflag = false;
-	looknew->setqid = false;
-	looknew->qid = 0;
-	looknew->ns_search_only = false;
-	looknew->origin = NULL;
-	looknew->tsigctx = NULL;
-	looknew->querysig = NULL;
-	looknew->retries = tries;
-	looknew->nsfound = 0;
-	looknew->tcp_mode = false;
-	looknew->tcp_mode_set = false;
-	looknew->tls_mode = false;
-	looknew->comments = true;
-	looknew->stats = true;
-	looknew->section_question = true;
-	looknew->section_answer = true;
-	looknew->section_authority = true;
-	looknew->section_additional = true;
-	looknew->new_search = false;
-	looknew->done_as_is = false;
-	looknew->need_search = false;
-	looknew->ecs_addr = NULL;
-	looknew->cookie = NULL;
-	looknew->ednsopts = NULL;
-	looknew->ednsoptscnt = 0;
-	looknew->ednsneg = true;
-	looknew->mapped = true;
-	looknew->dscp = -1;
-	looknew->rrcomments = 0;
-	looknew->eoferr = 0;
+		.udpsize = -1,
+		.edns = -1,
+		.recurse = true,
+		.retries = tries,
+		.comments = true,
+		.stats = true,
+		.section_question = true,
+		.section_answer = true,
+		.section_authority = true,
+		.section_additional = true,
+		.ednsneg = true,
+		.mapped = true,
+		.dscp = -1,
+	};
+
 	dns_fixedname_init(&looknew->fdomain);
 	ISC_LINK_INIT(looknew, link);
 	ISC_LIST_INIT(looknew->q);
-	ISC_LIST_INIT(looknew->connecting);
 	ISC_LIST_INIT(looknew->my_server_list);

 	isc_refcount_init(&looknew->references, 1);
@@ -779,6 +717,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->ignore = lookold->ignore;
 	looknew->servfail_stops = lookold->servfail_stops;
 	looknew->besteffort = lookold->besteffort;
+	looknew->dns64prefix = lookold->dns64prefix;
 	looknew->dnssec = lookold->dnssec;
 	looknew->ednsflags = lookold->ednsflags;
 	looknew->opcode = lookold->opcode;
@@ -786,6 +725,11 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->nsid = lookold->nsid;
 	looknew->tcp_keepalive = lookold->tcp_keepalive;
 	looknew->header_only = lookold->header_only;
+	looknew->https_mode = lookold->https_mode;
+	if (lookold->https_path != NULL) {
+		looknew->https_path = isc_mem_strdup(mctx, lookold->https_path);
+	}
+	looknew->https_get = lookold->https_get;
 	looknew->sendcookie = lookold->sendcookie;
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
@@ -1598,7 +1542,6 @@ _destroy_lookup(dig_lookup_t *lookup) {
 	isc_refcount_destroy(&lookup->references);

 	REQUIRE(ISC_LIST_EMPTY(lookup->q));
-	REQUIRE(ISC_LIST_EMPTY(lookup->connecting));

 	s = ISC_LIST_HEAD(lookup->my_server_list);
 	while (s != NULL) {
@@ -1638,6 +1581,10 @@ _destroy_lookup(dig_lookup_t *lookup) {
 		isc_mem_free(mctx, lookup->ednsopts);
 	}

+	if (lookup->https_path) {
+		isc_mem_free(mctx, lookup->https_path);
+	}
+
 	isc_mem_free(mctx, lookup);
 }

@@ -1743,9 +1690,6 @@ _query_detach(dig_query_t **queryp, const char *file, unsigned int line) {
 	if (ISC_LINK_LINKED(query, link)) {
 		ISC_LIST_UNLINK(lookup->q, query, link);
 	}
-	if (ISC_LINK_LINKED(query, clink)) {
-		ISC_LIST_UNLINK(lookup->connecting, query, clink);
-	}

 	debug("%s:%u:query_detach(%p) = %" PRIuFAST32, file, line, query,
 	      isc_refcount_current(&query->references) - 1);
@@ -1808,7 +1752,6 @@ clear_current_lookup() {
 	dig_lookup_t *lookup = current_lookup;

 	INSIST(!free_now);
-	INSIST(lookup != NULL);

 	debug("clear_current_lookup()");

@@ -2764,7 +2707,17 @@ start_tcp(dig_query_t *query) {
 	 * For TLS connections, we want to override the default
 	 * port number.
 	 */
-	port = port_set ? port : (query->lookup->tls_mode ? 853 : 53);
+	if (!port_set) {
+		if (query->lookup->tls_mode) {
+			port = 853;
+		} else if (query->lookup->https_mode) {
+			port = 443;
+		} else {
+			port = 53;
+		}
+	}
+
+	fprintf(stderr, "query->servname = %s\n", query->servname);

 	result = get_address(query->servname, port, &query->sockaddr);
 	if (result != ISC_R_SUCCESS) {
@@ -2832,11 +2785,34 @@ start_tcp(dig_query_t *query) {
 		REQUIRE(query != NULL);

 		if (query->lookup->tls_mode) {
+			result = isc_tlsctx_createclient(&query->tlsctx);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			result = isc_nm_tlsdnsconnect(
 				netmgr, (isc_nmiface_t *)&localaddr,
 				(isc_nmiface_t *)&query->sockaddr,
-				tcp_connected, query, local_timeout, 0);
-			check_result(result, "isc_nm_tcpdnsconnect");
+				tcp_connected, query, local_timeout, 0,
+				query->tlsctx);
+			check_result(result, "isc_nm_tlsdnsconnect");
+		} else if (query->lookup->https_mode) {
+			char portbuf[12];
+			char uri[4096] = { 0 };
+			snprintf(portbuf, sizeof(portbuf), "%u",
+				 (uint16_t)port);
+
+			strlcpy(uri, "https://", sizeof(uri));
+			strlcat(uri, query->servname, sizeof(uri));
+			strlcat(uri, ":", sizeof(uri));
+			strlcat(uri, portbuf, sizeof(uri));
+			strlcat(uri, query->lookup->https_path, sizeof(uri));
+
+			result = isc_tlsctx_createclient(&query->tlsctx);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
+			result = isc_nm_httpconnect(
+				netmgr, (isc_nmiface_t *)&localaddr,
+				(isc_nmiface_t *)&query->sockaddr, uri,
+				!query->lookup->https_get, tcp_connected, query,
+				query->tlsctx, local_timeout, 0);
+			check_result(result, "isc_nm_httpconnect");
 		} else {
 			result = isc_nm_tcpdnsconnect(
 				netmgr, (isc_nmiface_t *)&localaddr,
@@ -2860,7 +2836,6 @@ start_tcp(dig_query_t *query) {
 		} else {
 			next = NULL;
 		}
-		ISC_LIST_ENQUEUE(query->lookup->connecting, query, clink);
 		if (next != NULL) {
 			start_tcp(next);
 		}
@@ -3185,7 +3160,12 @@ launch_next_query(dig_query_t *query) {
 	isc_nmhandle_settimeout(query->handle, local_timeout);

 	query_attach(query, &readquery);
-	isc_nm_read(query->handle, recv_done, readquery);
+	if (query->lookup->https_mode) {
+		isc_nm_httprequest(query->handle, &r, recv_done, readquery);
+		goto cleanup;
+	} else {
+		isc_nm_read(query->handle, recv_done, readquery);
+	}

 	if (!query->first_soa_rcvd) {
 		dig_query_t *sendquery = NULL;
@@ -3213,6 +3193,7 @@ launch_next_query(dig_query_t *query) {
 			}
 		}
 	}
+cleanup:
 	lookup_detach(&l);
 	return;
 }
@@ -3229,15 +3210,26 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	char sockstr[ISC_SOCKADDR_FORMATSIZE];
 	dig_lookup_t *l = NULL;

+	debug("tcp_connected()");
+
+	if (atomic_load(&cancel_now)) {
+		return;
+	}
+
 	REQUIRE(DIG_VALID_QUERY(query));
 	REQUIRE(query->handle == NULL);
 	INSIST(!free_now);

-	debug("tcp_connected()");
+	debug("tcp_connected(%p, %s, %p)", handle, isc_result_totext(eresult),
+	      query);

 	LOCK_LOOKUP;
 	lookup_attach(query->lookup, &l);

+	if (query->tlsctx != NULL) {
+		isc_tlsctx_free(&query->tlsctx);
+	}
+
 	if (eresult == ISC_R_CANCELED) {
 		debug("in cancel handler");
 		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
@@ -3304,7 +3296,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {

 	launch_next_query(query);
 	query_detach(&query);
-	isc_nmhandle_detach(&handle);
 	lookup_detach(&l);
 	UNLOCK_LOOKUP;
 }
@@ -3584,14 +3575,14 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	LOCK_LOOKUP;
 	lookup_attach(query->lookup, &l);

+	isc_refcount_decrement0(&recvcount);
+	debug("recvcount=%" PRIuFAST32, isc_refcount_current(&recvcount));
+
 	if (eresult == ISC_R_CANCELED) {
 		debug("recv_done: cancel");
 		goto detach_query;
 	}

-	isc_refcount_decrement0(&recvcount);
-	debug("recvcount=%" PRIuFAST32, isc_refcount_current(&recvcount));
-
 	TIME_NOW(&query->time_recv);

 	if (eresult == ISC_R_TIMEDOUT && !l->tcp_mode && l->retries > 1) {
@@ -3729,7 +3720,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	}

 	debug("before parse starts");
-	parseflags = DNS_MESSAGEPARSE_PRESERVEORDER;
+	parseflags = l->dns64prefix ? 0 : DNS_MESSAGEPARSE_PRESERVEORDER;
 	if (l->besteffort) {
 		parseflags |= DNS_MESSAGEPARSE_BESTEFFORT;
 		parseflags |= DNS_MESSAGEPARSE_IGNORETRUNCATION;
@@ -4210,13 +4201,6 @@ cancel_all(void) {
 			}
 			query_detach(&q);
 		}
-		for (q = ISC_LIST_HEAD(current_lookup->connecting); q != NULL;
-		     q = nq) {
-			nq = ISC_LIST_NEXT(q, clink);
-			debug("canceling connecting query %p, belonging to %p",
-			      q, current_lookup);
-			query_detach(&q);
-		}
 		lookup_detach(&current_lookup);
 	}
 	l = ISC_LIST_HEAD(lookup_list);
@@ -24,6 +24,7 @@
 #include <isc/list.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
+#include <isc/netmgr.h>
 #include <isc/print.h>
 #include <isc/refcount.h>
 #include <isc/sockaddr.h>
@@ -75,6 +76,9 @@
 #define DEFAULT_EDNS_VERSION 0
 #define DEFAULT_EDNS_BUFSIZE 1232

+#define DEFAULT_HTTPS_PATH  "/dns-query"
+#define DEFAULT_HTTPS_QUERY "?dns="
+
 /*%
 * Lookup_limit is just a limiter, keeping too many lookups from being
 * created.  It's job is mainly to prevent the program from running away
@@ -101,29 +105,27 @@ typedef struct dig_searchlist dig_searchlist_t;
 struct dig_lookup {
 	unsigned int magic;
 	isc_refcount_t references;
-	bool pending, /*%< Pending a successful answer */
-		waiting_connect, doing_xfr, ns_search_only, /*%< dig
-							     * +nssearch,
-							     * host -C */
-		identify, /*%< Append an "on server <foo>" message */
-		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
-					 * message, with newline and tab */
-		ignore, recurse, aaonly, adflag, cdflag, raflag, tcflag, zflag,
+	bool aaonly, adflag, badcookie, besteffort, cdflag, comments,
+		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
+		expire, header_only, identify, /*%< Append an "on server <foo>"
+						  message */
+		identify_previous_line,	       /*% Prepend a "Nameserver <foo>:"
+						  message, with newline and tab */
+		idnin, idnout, ignore, mapped, multiline, need_search,
+		new_search, noclass, nocrypto, nottl,
+		ns_search_only,	 /*%< dig +nssearch, host -C */
+		nsid,		 /*% Name Server ID (RFC 5001) */
+		onesoa, pending, /*%< Pending a successful answer */
+		print_unknown_format, qr, raflag, recurse, section_additional,
+		section_answer, section_authority, section_question,
+		seenbadcookie, sendcookie, servfail_stops,
+		setqid, /*% use a speciied query ID */
+		stats, tcflag, tcp_keepalive, tcp_mode, tcp_mode_set,
+		tls_mode,   /*% connect using TLS */
 		trace,	    /*% dig +trace */
-		trace_root, /*% initial query for either +trace or +nssearch
-			     * */
-		tcp_mode, tcp_mode_set, comments, stats, section_question,
-		section_answer, section_authority, section_additional,
-		servfail_stops, new_search, need_search, done_as_is, besteffort,
-		dnssec, expire, sendcookie, seenbadcookie, badcookie,
-		nsid, /*% Name Server ID (RFC 5001) */
-		tcp_keepalive, header_only, ednsneg, mapped,
-		print_unknown_format, multiline, nottl, noclass, onesoa,
-		use_usec, nocrypto, ttlunits, idnin, idnout, expandaaaa, qr,
-		setqid,	       /*% use a specified query ID */
-		tls_mode;      /*% connect using TLS */
-	char textname[MXNAME]; /*% Name we're going to be
-				* looking up */
+		trace_root, /*% initial query for either +trace or +nssearch */
+		ttlunits, use_usec, waiting_connect, zflag;
+	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;
 	dns_rdatatype_t qrdtype;
@@ -169,6 +171,11 @@ struct dig_lookup {
 	int rrcomments;
 	unsigned int eoferr;
 	uint16_t qid;
+	struct {
+		bool https_mode;
+		bool https_get;
+		char *https_path;
+	};
 };

 /*% The dig_query structure */
@@ -201,6 +208,7 @@ struct dig_query {
 	uint64_t byte_count;
 	isc_timer_t *timer;
 	uint8_t tries;
+	isc_tlsctx_t *tlsctx;
 };

 struct dig_server {
@@ -362,7 +362,6 @@ main(int argc, char **argv) {
 	setup_logging(mctx, &log);

 	if (predecessor == NULL) {
-		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (label == NULL) {
 			fatal("the key label was not specified");
 		}
@@ -384,7 +383,6 @@ main(int argc, char **argv) {
 			      isc_result_totext(ret));
 		}

-		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (strchr(label, ':') == NULL) {
 			char *l;
 			int len;
@@ -396,13 +394,11 @@ main(int argc, char **argv) {
 			label = l;
 		}

-		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (algname == NULL) {
 			fatal("no algorithm specified");
 		}

 		r.base = algname;
-		/* cppcheck-suppress nullPointerRedundantCheck */
 		r.length = strlen(algname);
 		ret = dns_secalg_fromtext(&alg, &r);
 		if (ret != ISC_R_SUCCESS) {
@@ -76,9 +76,9 @@ Options
 ``-E engine``
   This option specifies the cryptographic hardware to use.

-   When BIND 9 is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -269,8 +269,8 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 			continue;
 		}

-		result = cfg_kasp_fromconfig(kconfig, mctx, lctx, &kasplist,
-					     &kasp);
+		result = cfg_kasp_fromconfig(kconfig, NULL, mctx, lctx,
+					     &kasplist, &kasp);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure dnssec-policy '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -284,7 +284,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 	*kaspp = kasp;

 	/*
-	 * Same cleanup for kasp list.
+	 * Cleanup kasp list.
 	 */
 	for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
 		kasp_next = ISC_LIST_NEXT(kasp, link);
@@ -782,7 +782,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		}

 		/* Set dnssec-policy related metadata */
-		if (ctx->policy) {
+		if (ctx->policy != NULL) {
 			dst_key_setnum(key, DST_NUM_LIFETIME, ctx->lifetime);
 			dst_key_setbool(key, DST_BOOL_KSK, ctx->ksk);
 			dst_key_setbool(key, DST_BOOL_ZSK, ctx->zsk);
@@ -1180,12 +1180,10 @@ main(int argc, char **argv) {
 	}

 	if (ctx.predecessor == NULL && ctx.policy == NULL) {
-		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (algname == NULL) {
 			fatal("no algorithm specified");
 		}
 		r.base = algname;
-		/* cppcheck-suppress nullPointerRedundantCheck */
 		r.length = strlen(algname);
 		ret = dns_secalg_fromtext(&ctx.alg, &r);
 		if (ret != ISC_R_SUCCESS) {
@@ -103,9 +103,9 @@ Options
 ``-E engine``
   This option specifies the cryptographic hardware to use, when applicable.

-   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -59,9 +59,9 @@ Options
 ``-E engine``
   This option specifies the cryptographic hardware to use, when applicable.

-   When BIND 9 is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -102,9 +102,9 @@ Options
 ``-E engine``
   This option specifies the cryptographic hardware to use, when applicable.

-   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -591,10 +591,10 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
 					 expired ? "expired"
-						 : rrsig.originalttl != set->ttl
-							   ? "ttl change"
-							   : "failed to "
-							     "verify");
+					 : rrsig.originalttl != set->ttl
+						 ? "ttl change"
+						 : "failed to "
+						   "verify");
 				resign = true;
 			}
 		} else if (!ispublishedkey(key) && remove_orphansigs) {
@@ -612,10 +612,10 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
 					 expired ? "expired"
-						 : rrsig.originalttl != set->ttl
-							   ? "ttl change"
-							   : "failed to "
-							     "verify");
+					 : rrsig.originalttl != set->ttl
+						 ? "ttl change"
+						 : "failed to "
+						   "verify");
 			}
 		} else if (!expired) {
 			vbprintf(2, "\trrsig by %s retained\n", sigstr);
@@ -1352,7 +1352,8 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {
 	dns_dbnode_t *node = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	uint32_t old_serial, new_serial;
+	uint32_t old_serial, new_serial = 0;
+	dns_updatemethod_t used = dns_updatemethod_none;

 	result = dns_db_getoriginnode(gdb, &node);
 	if (result != ISC_R_SUCCESS) {
@@ -1376,16 +1377,20 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {

 	if (method == dns_updatemethod_date ||
 	    method == dns_updatemethod_unixtime) {
-		new_serial = dns_update_soaserial(old_serial, method);
+		new_serial = dns_update_soaserial(old_serial, method, &used);
 	} else if (serial != 0 || method == dns_updatemethod_none) {
 		/* Set SOA serial to the value provided. */
 		new_serial = serial;
+		used = method;
 	} else {
-		/* Increment SOA serial using RFC 1982 arithmetic */
-		new_serial = (old_serial + 1) & 0xFFFFFFFF;
-		if (new_serial == 0) {
-			new_serial = 1;
-		}
+		new_serial = dns_update_soaserial(old_serial, method, &used);
+	}
+
+	if (method != used) {
+		fprintf(stderr,
+			"%s: warning: Serial number would not advance, "
+			"using increment method instead\n",
+			program);
 	}

 	/* If the new serial is not likely to cause a zone transfer
@@ -2723,10 +2728,13 @@ static void
 report(const char *format, ...) {
 	if (!quiet) {
 		FILE *out = output_stdout ? stderr : stdout;
+		char buf[4096];
 		va_list args;
+
 		va_start(args, format);
-		vfprintf(out, format, args);
+		vsnprintf(buf, sizeof(buf), format, args);
 		va_end(args);
+		fprintf(out, "%s\n", buf);
 	}
 }

@@ -69,9 +69,9 @@ Options
   This option specifies the hardware to use for cryptographic
   operations, such as a secure key store used for signing, when applicable.

-   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -202,10 +202,16 @@ Options
      This format increments the SOA serial number using :rfc:`1982` arithmetic.

   **unixtime**
-      This format sets the SOA serial number to the number of seconds since the beginning of the Unix epoch.
+      This format sets the SOA serial number to the number of seconds
+      since the beginning of the Unix epoch, unless the serial
+      number is already greater than or equal to that value, in
+      which case it is simply incremented by one.

   **date**
-      This format sets the SOA serial number to today's date, in YYYYMMDDNN format.
+      This format sets the SOA serial number to today's date, in
+      YYYYMMDDNN format, unless the serial number is already greater
+      than or equal to that value, in which case it is simply
+      incremented by one.

 ``-o origin``
   This option sets the zone origin. If not specified, the name of the zone file is
@@ -82,10 +82,13 @@ static bool keyset_kskonly = false;
 static void
 report(const char *format, ...) {
 	if (!quiet) {
+		char buf[4096];
 		va_list args;
+
 		va_start(args, format);
-		vfprintf(stdout, format, args);
+		vsnprintf(buf, sizeof(buf), format, args);
 		va_end(args);
+		fprintf(stdout, "%s\n", buf);
 	}
 }

@@ -47,9 +47,9 @@ Options
 ``-E engine``
   This option specifies the cryptographic hardware to use, when applicable.

-   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -43,8 +43,12 @@ extern uint8_t dtype[8];

 typedef void(fatalcallback_t)(void);

+#ifndef CPPCHECK
 ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+#else /* CPPCHECK */
+#define fatal(...) exit(1)
+#endif

 void
 setfatalcallback(fatalcallback_t *callback);
@@ -59,6 +59,7 @@ named_SOURCES =				\
 	server.c			\
 	statschannel.c			\
 	tkeyconf.c			\
+	transportconf.c			\
 	tsigconf.c			\
 	zoneconf.c			\
 	unix/dlz_dlopen_driver.c	\
@@ -77,6 +78,7 @@ named_SOURCES =				\
 	include/named/smf_globals.h	\
 	include/named/statschannel.h	\
 	include/named/tkeyconf.h	\
+	include/named/transportconf.h	\
 	include/named/tsigconf.h	\
 	include/named/types.h		\
 	include/named/zoneconf.h	\
@@ -32,18 +32,22 @@

 typedef struct builtin builtin_t;

-static isc_result_t
-do_version_lookup(dns_sdblookup_t *lookup);
-static isc_result_t
-do_hostname_lookup(dns_sdblookup_t *lookup);
 static isc_result_t
 do_authors_lookup(dns_sdblookup_t *lookup);
 static isc_result_t
-do_id_lookup(dns_sdblookup_t *lookup);
+do_dns64_lookup(dns_sdblookup_t *lookup);
 static isc_result_t
 do_empty_lookup(dns_sdblookup_t *lookup);
 static isc_result_t
-do_dns64_lookup(dns_sdblookup_t *lookup);
+do_hostname_lookup(dns_sdblookup_t *lookup);
+static isc_result_t
+do_id_lookup(dns_sdblookup_t *lookup);
+static isc_result_t
+do_ipv4only_lookup(dns_sdblookup_t *lookup);
+static isc_result_t
+do_ipv4reverse_lookup(dns_sdblookup_t *lookup);
+static isc_result_t
+do_version_lookup(dns_sdblookup_t *lookup);

 /*
 * We can't use function pointers as the db_data directly
@@ -57,12 +61,14 @@ struct builtin {
 	char *contact;
 };

-static builtin_t version_builtin = { do_version_lookup, NULL, NULL };
-static builtin_t hostname_builtin = { do_hostname_lookup, NULL, NULL };
 static builtin_t authors_builtin = { do_authors_lookup, NULL, NULL };
-static builtin_t id_builtin = { do_id_lookup, NULL, NULL };
-static builtin_t empty_builtin = { do_empty_lookup, NULL, NULL };
 static builtin_t dns64_builtin = { do_dns64_lookup, NULL, NULL };
+static builtin_t empty_builtin = { do_empty_lookup, NULL, NULL };
+static builtin_t hostname_builtin = { do_hostname_lookup, NULL, NULL };
+static builtin_t id_builtin = { do_id_lookup, NULL, NULL };
+static builtin_t ipv4only_builtin = { do_ipv4only_lookup, NULL, NULL };
+static builtin_t ipv4reverse_builtin = { do_ipv4reverse_lookup, NULL, NULL };
+static builtin_t version_builtin = { do_version_lookup, NULL, NULL };

 static dns_sdbimplementation_t *builtin_impl;
 static dns_sdbimplementation_t *dns64_impl;
@@ -89,7 +95,8 @@ static const unsigned char hex16[256] = {
 	1, 1,	1,   1,	  1,   1,   1,	 1,   1,   1,	1, 1, 1, 1, 1, 1  /*F0*/
 };

-const unsigned char decimal[] = "0123456789";
+static const unsigned char decimal[] = "0123456789";
+static const unsigned char ipv4only[] = "\010ipv4only\004arpa";

 static size_t
 dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
@@ -289,6 +296,16 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name,
 		 */
 		return (ISC_R_NOTFOUND);
 	}
+
+	/*
+	 * Reverse of 192.0.0.170 or 192.0.0.171 maps to ipv4only.arpa.
+	 */
+	if ((v[0] == 170 || v[0] == 171) && v[1] == 0 && v[2] == 0 &&
+	    v[3] == 192) {
+		return (dns_sdb_putrdata(lookup, dns_rdatatype_ptr, 3600,
+					 ipv4only, sizeof(ipv4only)));
+	}
+
 	return (dns_sdb_putrdata(lookup, dns_rdatatype_cname, 600, rdata,
 				 (unsigned int)len));
 }
@@ -429,6 +446,30 @@ do_empty_lookup(dns_sdblookup_t *lookup) {
 	return (ISC_R_SUCCESS);
 }

+static isc_result_t
+do_ipv4only_lookup(dns_sdblookup_t *lookup) {
+	isc_result_t result;
+	unsigned char data[2][4] = { { 192, 0, 0, 170 }, { 192, 0, 0, 171 } };
+
+	for (int i = 0; i < 2; i++) {
+		result = dns_sdb_putrdata(lookup, dns_rdatatype_a, 3600,
+					  data[i], 4);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+do_ipv4reverse_lookup(dns_sdblookup_t *lookup) {
+	isc_result_t result;
+
+	result = dns_sdb_putrdata(lookup, dns_rdatatype_ptr, 3600, ipv4only,
+				  sizeof(ipv4only));
+	return (result);
+}
+
 static isc_result_t
 builtin_authority(const char *zone, void *dbdata, dns_sdblookup_t *lookup) {
 	isc_result_t result;
@@ -472,7 +513,10 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
 	UNUSED(zone);
 	UNUSED(driverdata);

-	if (strcmp(argv[0], "empty") == 0 || strcmp(argv[0], "dns64") == 0) {
+	if (strcmp(argv[0], "dns64") == 0 || strcmp(argv[0], "empty") == 0 ||
+	    strcmp(argv[0], "ipv4only") == 0 ||
+	    strcmp(argv[0], "ipv4reverse") == 0)
+	{
 		if (argc != 3) {
 			return (DNS_R_SYNTAX);
 		}
@@ -480,19 +524,27 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
 		return (DNS_R_SYNTAX);
 	}

-	if (strcmp(argv[0], "version") == 0) {
-		*dbdata = &version_builtin;
+	if (strcmp(argv[0], "authors") == 0) {
+		*dbdata = &authors_builtin;
 	} else if (strcmp(argv[0], "hostname") == 0) {
 		*dbdata = &hostname_builtin;
-	} else if (strcmp(argv[0], "authors") == 0) {
-		*dbdata = &authors_builtin;
 	} else if (strcmp(argv[0], "id") == 0) {
 		*dbdata = &id_builtin;
-	} else if (strcmp(argv[0], "empty") == 0 ||
-		   strcmp(argv[0], "dns64") == 0) {
+	} else if (strcmp(argv[0], "version") == 0) {
+		*dbdata = &version_builtin;
+	} else if (strcmp(argv[0], "dns64") == 0 ||
+		   strcmp(argv[0], "empty") == 0 ||
+		   strcmp(argv[0], "ipv4only") == 0 ||
+		   strcmp(argv[0], "ipv4reverse") == 0)
+	{
 		builtin_t *empty;
 		char *server;
 		char *contact;
+
+		if (argc != 3) {
+			return (DNS_R_SYNTAX);
+		}
+
 		/*
 		 * We don't want built-in zones to fail.  Fallback to
 		 * the static configuration if memory allocation fails.
@@ -501,10 +553,14 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
 		server = isc_mem_strdup(named_g_mctx, argv[1]);
 		contact = isc_mem_strdup(named_g_mctx, argv[2]);
 		if (empty == NULL || server == NULL || contact == NULL) {
-			if (strcmp(argv[0], "empty") == 0) {
-				*dbdata = &empty_builtin;
-			} else {
+			if (strcmp(argv[0], "dns64") == 0) {
 				*dbdata = &dns64_builtin;
+			} else if (strcmp(argv[0], "empty") == 0) {
+				*dbdata = &empty_builtin;
+			} else if (strcmp(argv[0], "ipv4only") == 0) {
+				*dbdata = &ipv4only_builtin;
+			} else {
+				*dbdata = &ipv4reverse_builtin;
 			}
 			if (server != NULL) {
 				isc_mem_free(named_g_mctx, server);
@@ -517,11 +573,17 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
 					    sizeof(*empty));
 			}
 		} else {
-			if (strcmp(argv[0], "empty") == 0) {
+			if (strcmp(argv[0], "dns64") == 0) {
+				memmove(empty, &dns64_builtin,
+					sizeof(empty_builtin));
+			} else if (strcmp(argv[0], "empty") == 0) {
 				memmove(empty, &empty_builtin,
 					sizeof(empty_builtin));
+			} else if (strcmp(argv[0], "ipv4only") == 0) {
+				memmove(empty, &ipv4only_builtin,
+					sizeof(empty_builtin));
 			} else {
-				memmove(empty, &dns64_builtin,
+				memmove(empty, &ipv4reverse_builtin,
 					sizeof(empty_builtin));
 			}
 			empty->server = server;
@@ -544,9 +606,10 @@ builtin_destroy(const char *zone, void *driverdata, void **dbdata) {
 	/*
 	 * Don't free the static versions.
 	 */
-	if (*dbdata == &version_builtin || *dbdata == &hostname_builtin ||
-	    *dbdata == &authors_builtin || *dbdata == &id_builtin ||
-	    *dbdata == &empty_builtin || *dbdata == &dns64_builtin)
+	if (*dbdata == &authors_builtin || *dbdata == &dns64_builtin ||
+	    *dbdata == &empty_builtin || *dbdata == &hostname_builtin ||
+	    *dbdata == &id_builtin || *dbdata == &ipv4only_builtin ||
+	    *dbdata == &ipv4reverse_builtin || *dbdata == &version_builtin)
 	{
 		return;
 	}
@@ -87,13 +87,15 @@ options {\n\
 	memstatistics-file \"named.memstats\";\n\
 #	multiple-cnames <obsolete>;\n\
 #	named-xfer <obsolete>;\n\
-	nocookie-udp-size 1232;\n\
+	nocookie-udp-size 4096;\n\
 	notify-rate 20;\n\
 	nta-lifetime 3600;\n\
 	nta-recheck 300;\n\
 #	pid-file \"" NAMED_LOCALSTATEDIR "/run/named/named.pid\"; \n\
 	port 53;\n\
 	tls-port 853;\n\
+	http-port 80;\n\
+	https-port 443;\n\
 	prefetch 2 9;\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
@@ -131,7 +133,6 @@ options {\n\
 #	treat-cr-as-space <obsolete>;\n\
 	trust-anchor-telemetry yes;\n\
 #	use-id-pool <obsolete>;\n\
-#	use-ixfr <obsolete>;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
@@ -141,7 +142,6 @@ options {\n\
 	allow-recursion { localnets; localhost; };\n\
 	allow-recursion-on { any; };\n\
 	allow-update-forwarding {none;};\n\
-#	allow-v6-synthesis <obsolete>;\n\
 	auth-nxdomain false;\n\
 	check-dup-records warn;\n\
 	check-mx warn;\n\
@@ -170,8 +170,8 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 75;\n\
-	max-stale-ttl 43200; /* 12 hours */\n\
+	max-recursion-queries 100;\n\
+	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
 	min-cache-ttl 0; /* 0 seconds */\n\
@@ -196,9 +196,10 @@ options {\n\
 	servfail-ttl 1;\n\
 #	sortlist <none>\n\
 	stale-answer-enable false;\n\
-	stale-refresh-time 30; /* 30 seconds */\n\
-	stale-answer-ttl 1; /* 1 second */\n\
+	stale-answer-client-timeout 1800; /* in milliseconds */\n\
+	stale-answer-ttl 30; /* 30 seconds */\n\
 	stale-cache-enable false;\n\
+	stale-refresh-time 30; /* 30 seconds */\n\
 	synth-from-dnssec no;\n\
 #	topology <none>\n\
 	transfer-format many-answers;\n\
@@ -609,10 +610,76 @@ named_config_getprimariesdef(const cfg_obj_t *cctx, const char *name,
 	return (result);
 }

+static isc_result_t
+named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
+		     dns_name_t **namep) {
+	REQUIRE(namep != NULL && *namep == NULL);
+
+	const char *objstr;
+	isc_result_t result;
+	isc_buffer_t b;
+	dns_fixedname_t fname;
+
+	if (!cfg_obj_isstring(obj)) {
+		*namep = NULL;
+		return (ISC_R_SUCCESS);
+	}
+
+	*namep = isc_mem_get(mctx, sizeof(**namep));
+	dns_name_init(*namep, NULL);
+
+	objstr = cfg_obj_asstring(obj);
+	isc_buffer_constinit(&b, objstr, strlen(objstr));
+	isc_buffer_add(&b, strlen(objstr));
+	dns_fixedname_init(&fname);
+	result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
+				   0, NULL);
+	if (result != ISC_R_SUCCESS) {
+		isc_mem_put(mctx, *namep, sizeof(*namep));
+		*namep = NULL;
+		return (result);
+	}
+	dns_name_dup(dns_fixedname_name(&fname), mctx, *namep);
+
+	return (ISC_R_SUCCESS);
+}
+
+#define grow_array(mctx, array, newlen, oldlen)                    \
+	if (newlen >= oldlen) {                                    \
+		size_t newsize = (newlen + 16) * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]);        \
+		void *tmp = isc_mem_get(mctx, newsize);            \
+		memset(tmp, 0, newsize);                           \
+		if (oldlen != 0) {                                 \
+			memmove(tmp, array, oldsize);              \
+			isc_mem_put(mctx, array, oldsize);         \
+		}                                                  \
+		array = tmp;                                       \
+		oldlen = newlen + 16;                              \
+	}
+
+#define shrink_array(mctx, array, newlen, oldlen)           \
+	if (newlen < oldlen) {                              \
+		void *tmp = NULL;                           \
+		size_t newsize = newlen * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]); \
+		if (newlen != 0) {                          \
+			tmp = isc_mem_get(mctx, newsize);   \
+			memset(tmp, 0, newsize);            \
+			memmove(tmp, array, newsize);       \
+		} else {                                    \
+			tmp = NULL;                         \
+		}                                           \
+		isc_mem_put(mctx, array, oldsize);          \
+		array = tmp;                                \
+		oldlen = newlen;                            \
+	}
+
 isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
-	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, i = 0;
+	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, tlscount = 0,
+		 i = 0;
 	uint32_t listcount = 0, l = 0, j;
 	uint32_t stackcount = 0, pushed = 0;
 	isc_result_t result;
@@ -620,12 +687,14 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	const cfg_obj_t *addrlist;
 	const cfg_obj_t *portobj;
 	const cfg_obj_t *dscpobj;
-	in_port_t port;
+	in_port_t port = (in_port_t)0;
+	in_port_t def_port;
+	in_port_t def_tlsport;
 	isc_dscp_t dscp = -1;
-	dns_fixedname_t fname;
 	isc_sockaddr_t *addrs = NULL;
 	isc_dscp_t *dscps = NULL;
 	dns_name_t **keys = NULL;
+	dns_name_t **tlss = NULL;
 	struct {
 		const char *name;
 	} *lists = NULL;
@@ -639,6 +708,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	REQUIRE(ipkl->count == 0);
 	REQUIRE(ipkl->addrs == NULL);
 	REQUIRE(ipkl->keys == NULL);
+	REQUIRE(ipkl->tlss == NULL);
 	REQUIRE(ipkl->dscps == NULL);
 	REQUIRE(ipkl->labels == NULL);
 	REQUIRE(ipkl->allocated == 0);
@@ -646,7 +716,12 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	/*
 	 * Get system defaults.
 	 */
-	result = named_config_getport(config, "port", &port);
+	result = named_config_getport(config, "port", &def_port);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
+	result = named_config_getport(config, "tls-port", &def_tlsport);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -690,33 +765,20 @@ resume:
 	for (; element != NULL; element = cfg_list_next(element)) {
 		const cfg_obj_t *addr;
 		const cfg_obj_t *key;
-		const char *keystr;
-		isc_buffer_t b;
+		const cfg_obj_t *tls;

 		addr = cfg_tuple_get(cfg_listelt_value(element),
 				     "primarieselement");
 		key = cfg_tuple_get(cfg_listelt_value(element), "key");
+		tls = cfg_tuple_get(cfg_listelt_value(element), "tls");

 		if (!cfg_obj_issockaddr(addr)) {
 			const char *listname = cfg_obj_asstring(addr);
 			isc_result_t tresult;

 			/* Grow lists? */
-			if (listcount == l) {
-				void *tmp;
-				uint32_t newlen = listcount + 16;
-				size_t newsize, oldsize;
+			grow_array(mctx, lists, l, listcount);

-				newsize = newlen * sizeof(*lists);
-				oldsize = listcount * sizeof(*lists);
-				tmp = isc_mem_get(mctx, newsize);
-				if (listcount != 0) {
-					memmove(tmp, lists, oldsize);
-					isc_mem_put(mctx, lists, oldsize);
-				}
-				lists = tmp;
-				listcount = newlen;
-			}
 			/* Seen? */
 			for (j = 0; j < l; j++) {
 				if (strcasecmp(lists[j].name, listname) == 0) {
@@ -742,21 +804,7 @@ resume:
 			}
 			lists[l++].name = listname;
 			/* Grow stack? */
-			if (stackcount == pushed) {
-				void *tmp;
-				uint32_t newlen = stackcount + 16;
-				size_t newsize, oldsize;
-
-				newsize = newlen * sizeof(*stack);
-				oldsize = stackcount * sizeof(*stack);
-				tmp = isc_mem_get(mctx, newsize);
-				if (stackcount != 0) {
-					memmove(tmp, stack, oldsize);
-					isc_mem_put(mctx, stack, oldsize);
-				}
-				stack = tmp;
-				stackcount = newlen;
-			}
+			grow_array(mctx, stack, pushed, stackcount);
 			/*
 			 * We want to resume processing this list on the
 			 * next element.
@@ -768,68 +816,44 @@ resume:
 			goto newlist;
 		}

-		if (i == addrcount) {
-			void *tmp;
-			uint32_t newlen = addrcount + 16;
-			size_t newsize, oldsize;
-
-			newsize = newlen * sizeof(isc_sockaddr_t);
-			oldsize = addrcount * sizeof(isc_sockaddr_t);
-			tmp = isc_mem_get(mctx, newsize);
-			if (addrcount != 0) {
-				memmove(tmp, addrs, oldsize);
-				isc_mem_put(mctx, addrs, oldsize);
-			}
-			addrs = tmp;
-			addrcount = newlen;
-
-			newsize = newlen * sizeof(isc_dscp_t);
-			oldsize = dscpcount * sizeof(isc_dscp_t);
-			tmp = isc_mem_get(mctx, newsize);
-			if (dscpcount != 0) {
-				memmove(tmp, dscps, oldsize);
-				isc_mem_put(mctx, dscps, oldsize);
-			}
-			dscps = tmp;
-			dscpcount = newlen;
-
-			newsize = newlen * sizeof(dns_name_t *);
-			oldsize = keycount * sizeof(dns_name_t *);
-			tmp = isc_mem_get(mctx, newsize);
-			if (keycount != 0) {
-				memmove(tmp, keys, oldsize);
-				isc_mem_put(mctx, keys, oldsize);
-			}
-			keys = tmp;
-			keycount = newlen;
-		}
+		grow_array(mctx, addrs, i, addrcount);
+		grow_array(mctx, dscps, i, dscpcount);
+		grow_array(mctx, keys, i, keycount);
+		grow_array(mctx, tlss, i, tlscount);

 		addrs[i] = *cfg_obj_assockaddr(addr);
-		if (isc_sockaddr_getport(&addrs[i]) == 0) {
-			isc_sockaddr_setport(&addrs[i], port);
-		}
 		dscps[i] = cfg_obj_getdscp(addr);
 		if (dscps[i] == -1) {
 			dscps[i] = dscp;
 		}
-		keys[i] = NULL;
-		i++; /* Increment here so that cleanup on error works. */
-		if (!cfg_obj_isstring(key)) {
-			continue;
-		}
-		keys[i - 1] = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(keys[i - 1], NULL);

-		keystr = cfg_obj_asstring(key);
-		isc_buffer_constinit(&b, keystr, strlen(keystr));
-		isc_buffer_add(&b, strlen(keystr));
-		dns_fixedname_init(&fname);
-		result = dns_name_fromtext(dns_fixedname_name(&fname), &b,
-					   dns_rootname, 0, NULL);
+		result = named_config_getname(mctx, key, &keys[i]);
 		if (result != ISC_R_SUCCESS) {
+			i++; /* Increment here so that cleanup on error works.
+			      */
 			goto cleanup;
 		}
-		dns_name_dup(dns_fixedname_name(&fname), mctx, keys[i - 1]);
+
+		result = named_config_getname(mctx, tls, &tlss[i]);
+		if (result != ISC_R_SUCCESS) {
+			i++; /* Increment here so that cleanup on error works.
+			      */
+			goto cleanup;
+		}
+
+		/* Set the default port or tls-port */
+		if (port == 0) {
+			if (tlss[i] != NULL) {
+				port = def_tlsport;
+			} else {
+				port = def_port;
+			}
+		}
+
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			isc_sockaddr_setport(&addrs[i], port);
+		}
+		i++;
 	}
 	if (pushed != 0) {
 		pushed--;
@@ -838,61 +862,28 @@ resume:
 		dscp = stack[pushed].dscp;
 		goto resume;
 	}
-	if (i < addrcount) {
-		void *tmp;
-		size_t newsize, oldsize;

-		newsize = i * sizeof(isc_sockaddr_t);
-		oldsize = addrcount * sizeof(isc_sockaddr_t);
-		if (i != 0) {
-			tmp = isc_mem_get(mctx, newsize);
-			memmove(tmp, addrs, newsize);
-		} else {
-			tmp = NULL;
-		}
-		isc_mem_put(mctx, addrs, oldsize);
-		addrs = tmp;
-		addrcount = i;
-
-		newsize = i * sizeof(isc_dscp_t);
-		oldsize = dscpcount * sizeof(isc_dscp_t);
-		if (i != 0) {
-			tmp = isc_mem_get(mctx, newsize);
-			memmove(tmp, dscps, newsize);
-		} else {
-			tmp = NULL;
-		}
-		isc_mem_put(mctx, dscps, oldsize);
-		dscps = tmp;
-		dscpcount = i;
-
-		newsize = i * sizeof(dns_name_t *);
-		oldsize = keycount * sizeof(dns_name_t *);
-		if (i != 0) {
-			tmp = isc_mem_get(mctx, newsize);
-			memmove(tmp, keys, newsize);
-		} else {
-			tmp = NULL;
-		}
-		isc_mem_put(mctx, keys, oldsize);
-		keys = tmp;
-		keycount = i;
-	}
+	shrink_array(mctx, addrs, i, addrcount);
+	shrink_array(mctx, dscps, i, dscpcount);
+	shrink_array(mctx, keys, i, keycount);
+	shrink_array(mctx, tlss, i, tlscount);

 	if (lists != NULL) {
-		isc_mem_put(mctx, lists, listcount * sizeof(*lists));
+		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
 	}
 	if (stack != NULL) {
-		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
+		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
 	}

 	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
+	INSIST(tlscount == addrcount);
 	INSIST(keycount == dscpcount);

 	ipkl->addrs = addrs;
 	ipkl->dscps = dscps;
 	ipkl->keys = keys;
+	ipkl->tlss = tlss;
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;

@@ -900,10 +891,10 @@ resume:

 cleanup:
 	if (addrs != NULL) {
-		isc_mem_put(mctx, addrs, addrcount * sizeof(isc_sockaddr_t));
+		isc_mem_put(mctx, addrs, addrcount * sizeof(addrs[0]));
 	}
 	if (dscps != NULL) {
-		isc_mem_put(mctx, dscps, dscpcount * sizeof(isc_dscp_t));
+		isc_mem_put(mctx, dscps, dscpcount * sizeof(dscps[0]));
 	}
 	if (keys != NULL) {
 		for (j = 0; j < i; j++) {
@@ -913,15 +904,27 @@ cleanup:
 			if (dns_name_dynamic(keys[j])) {
 				dns_name_free(keys[j], mctx);
 			}
-			isc_mem_put(mctx, keys[j], sizeof(dns_name_t));
+			isc_mem_put(mctx, keys[j], sizeof(*keys[j]));
 		}
-		isc_mem_put(mctx, keys, keycount * sizeof(dns_name_t *));
+		isc_mem_put(mctx, keys, keycount * sizeof(keys[0]));
+	}
+	if (tlss != NULL) {
+		for (j = 0; j < i; j++) {
+			if (tlss[j] == NULL) {
+				continue;
+			}
+			if (dns_name_dynamic(tlss[j])) {
+				dns_name_free(tlss[j], mctx);
+			}
+			isc_mem_put(mctx, tlss[j], sizeof(*tlss[j]));
+		}
+		isc_mem_put(mctx, tlss, tlscount * sizeof(tlss[0]));
 	}
 	if (lists != NULL) {
-		isc_mem_put(mctx, lists, listcount * sizeof(*lists));
+		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
 	}
 	if (stack != NULL) {
-		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
+		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
 	}
 	return (result);
 }
@@ -983,13 +986,15 @@ named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp) {

 struct keyalgorithms {
 	const char *str;
-	enum { hmacnone,
-	       hmacmd5,
-	       hmacsha1,
-	       hmacsha224,
-	       hmacsha256,
-	       hmacsha384,
-	       hmacsha512 } hmac;
+	enum {
+		hmacnone,
+		hmacmd5,
+		hmacsha1,
+		hmacsha224,
+		hmacsha256,
+		hmacsha384,
+		hmacsha512
+	} hmac;
 	unsigned int type;
 	uint16_t size;
 } algorithms[] = { { "hmac-md5", hmacmd5, DST_ALG_HMACMD5, 128 },
@@ -64,16 +64,18 @@ EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
 EXTERN isc_socketmgr_t *named_g_socketmgr INIT(NULL);
 EXTERN isc_nm_t *named_g_nm INIT(NULL);
 EXTERN cfg_parser_t *named_g_parser INIT(NULL);
-EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
-EXTERN const char *named_g_version     INIT(PACKAGE_VERSION);
-EXTERN const char *named_g_product     INIT(PACKAGE_NAME);
-EXTERN const char *named_g_description INIT(PACKAGE_DESCRIPTION);
-EXTERN const char *named_g_srcid       INIT(PACKAGE_SRCID);
-EXTERN const char *named_g_configargs  INIT(PACKAGE_CONFIGARGS);
-EXTERN const char *named_g_builder     INIT(PACKAGE_BUILDER);
-EXTERN in_port_t named_g_port	       INIT(0);
-EXTERN in_port_t named_g_tlsport       INIT(0);
-EXTERN isc_dscp_t named_g_dscp	       INIT(-1);
+EXTERN cfg_parser_t *named_g_addparser	  INIT(NULL);
+EXTERN const char *named_g_version	  INIT(PACKAGE_VERSION);
+EXTERN const char *named_g_product	  INIT(PACKAGE_NAME);
+EXTERN const char *named_g_description	  INIT(PACKAGE_DESCRIPTION);
+EXTERN const char *named_g_srcid	  INIT(PACKAGE_SRCID);
+EXTERN const char *named_g_configargs	  INIT(PACKAGE_CONFIGARGS);
+EXTERN const char *named_g_builder	  INIT(PACKAGE_BUILDER);
+EXTERN in_port_t named_g_port		  INIT(0);
+EXTERN in_port_t named_g_tlsport	  INIT(0);
+EXTERN in_port_t named_g_http_secure_port INIT(0);
+EXTERN in_port_t named_g_http_port	  INIT(0);
+EXTERN isc_dscp_t named_g_dscp		  INIT(-1);

 EXTERN named_server_t *named_g_server INIT(NULL);

@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file */
+
+#include <isc/lang.h>
+#include <isc/types.h>
+
+#include <dns/transport.h>
+
+#include <isccfg/cfg.h>
+
+ISC_LANG_BEGINDECLS
+
+isc_result_t
+named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
+			    isc_mem_t *mctx, dns_transport_list_t **listp);
+/*%<
+ * Create a list of transport objects (DoT or DoH) and configure them
+ * according to 'key-file', 'cert-file', 'ca-file' or 'hostname'
+ * statements.
+ *
+ *	Requires:
+ *	\li	'config' is not NULL.
+ *	\li	'vconfig' is not NULL.
+ *	\li	'mctx' is not NULL
+ *	\li	'listp' is not NULL, and '*listp' is NULL
+ *
+ */
+
+ISC_LANG_ENDDECLS
@@ -43,7 +43,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 */

 bool
-named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig);
+named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
+		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
+		    cfg_aclconfctx_t *actx);
 /*%<
 * If 'zone' can be safely reconfigured according to the configuration
 * data in 'zconfig', return true.  If the configuration data is so
@@ -51,6 +53,15 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig);
 * and recreated, return false.
 */

+bool
+named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
+			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
+			 cfg_aclconfctx_t *actx);
+/*%<
+ * Determine if zone uses inline-signing. This is true if inline-signing
+ * is set to yes, or if there is a dnssec-policy on a non-dynamic zone.
+ */
+
 isc_result_t
 named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 				   dns_rdataclass_t rdclass, dns_name_t *name);
@@ -705,7 +705,7 @@ parse_T_opt(char *option) {

 static void
 parse_port(char *arg) {
-	enum { DNSPORT, TLSPORT } ptype = DNSPORT;
+	enum { DNSPORT, TLSPORT, HTTP_SECURE_PORT, HTTP_PORT } ptype = DNSPORT;
 	char *value = arg;
 	int port;

@@ -714,6 +714,12 @@ parse_port(char *arg) {
 	} else if (strncmp(arg, "tls=", 4) == 0) {
 		value = arg + 4;
 		ptype = TLSPORT;
+	} else if (strncmp(arg, "https=", 6) == 0) {
+		value = arg + 6;
+		ptype = HTTP_SECURE_PORT;
+	} else if (strncmp(arg, "http=", 5) == 0) {
+		value = arg + 6;
+		ptype = HTTP_PORT;
 	}

 	port = parse_int(value, "port");
@@ -728,6 +734,12 @@ parse_port(char *arg) {
 	case TLSPORT:
 		named_g_tlsport = port;
 		break;
+	case HTTP_SECURE_PORT:
+		named_g_http_secure_port = port;
+		break;
+	case HTTP_PORT:
+		named_g_http_port = port;
+		break;
 	default:
 		INSIST(0);
 		ISC_UNREACHABLE();
@@ -66,6 +66,8 @@ DNSSEC-POLICY
  	keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
  	    duration_or_unlimited algorithm string [ integer ]; ... };
  	max-zone-ttl duration;
+  	nsec3param [ iterations integer ] [ optout boolean ] [
+  	    salt-length integer ];
  	parent-ds-ttl duration;
  	parent-propagation-delay duration;
  	publish-safety duration;
@@ -84,6 +86,15 @@ DYNDB
  dyndb string quoted_string {
      unspecified-text };

+HTTP
+^^^^
+
+::
+
+  http string {
+  	endpoints { quoted_string; ... }; // experimental
+  };
+
 KEY
 ^^^

@@ -135,7 +146,8 @@ MASTERS
  masters string [ port integer ] [ dscp
      integer ] { ( primaries | ipv4_address
      [ port integer ] | ipv6_address [ port
-      integer ] ) [ key string ]; ... };
+      integer ] ) [ key string ] [ tls
+      string ]; ... };

 OPTIONS
 ^^^^^^^
@@ -156,14 +168,14 @@ OPTIONS
  	allow-update-forwarding { address_match_element; ... };
  	also-notify [ port integer ] [ dscp integer ] { ( primaries |
  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
+  	    integer ] ) [ key string ] [ tls string ]; ... };
  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
  	    ] [ dscp integer ];
  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
  	    * ) ] [ dscp integer ];
  	answer-cookie boolean;
  	attach-cache string;
-  	auth-nxdomain boolean; // default changed
+  	auth-nxdomain boolean;
  	auto-dnssec ( allow | maintain | off );
  	automatic-interface-scan boolean;
  	avoid-v4-udp-ports { portrange; ... };
@@ -174,8 +186,9 @@ OPTIONS
  	catalog-zones { zone string [ default-masters [ port integer ]
  	    [ dscp integer ] { ( primaries | ipv4_address [ port
  	    integer ] | ipv6_address [ port integer ] ) [ key
-  	    string ]; ... } ] [ zone-directory quoted_string ] [
-  	    in-memory boolean ] [ min-update-interval duration ]; ... };
+  	    string ] [ tls string ]; ... } ] [ zone-directory
+  	    quoted_string ] [ in-memory boolean ] [ min-update-interval
+  	    duration ]; ... };
  	check-dup-records ( fail | warn | ignore );
  	check-integrity boolean;
  	check-mx ( fail | warn | ignore );
@@ -260,18 +273,25 @@ OPTIONS
  	glue-cache boolean;// deprecated
  	heartbeat-interval integer;
  	hostname ( quoted_string | none );
+  	http-port integer;
+  	https-port integer;
  	inline-signing boolean;
  	interface-interval duration;
+  	ipv4only-contact string;
+  	ipv4only-enable boolean;
+  	ipv4only-server string;
  	ixfr-from-differences ( primary | master | secondary | slave |
  	    boolean );
  	keep-response-order { address_match_element; ... };
  	key-directory quoted_string;
  	lame-ttl duration;
  	listen-on [ port integer ] [ dscp
-  	    integer ] [ tls string ] {
+  	    integer ] [ tls string ] [ http
+  	    string ] {
  	    address_match_element; ... };
  	listen-on-v6 [ port integer ] [ dscp
-  	    integer ] [ tls string ] {
+  	    integer ] [ tls string ] [ http
+  	    string ] {
  	    address_match_element; ... };
  	lmdb-mapsize sizeval;
  	lock-file ( quoted_string | none );
@@ -398,6 +418,7 @@ OPTIONS
  	sig-validity-interval integer [ integer ];
  	sortlist { address_match_element; ... };
  	stacksize ( default | unlimited | sizeval );
+  	stale-answer-client-timeout ( disabled | off | integer );
  	stale-answer-enable boolean;
  	stale-answer-ttl duration;
  	stale-cache-enable boolean;
@@ -455,7 +476,8 @@ PRIMARIES
  primaries string [ port integer ] [ dscp
      integer ] { ( primaries | ipv4_address
      [ port integer ] | ipv6_address [ port
-      integer ] ) [ key string ]; ... };
+      integer ] ) [ key string ] [ tls
+      string ]; ... };

 SERVER
 ^^^^^^
@@ -513,8 +535,13 @@ TLS
 ::

  tls string {
+  	ca-file quoted_string;
  	cert-file quoted_string;
+  	ciphers string; // experimental
+  	dh-param quoted_string; // experimental
+  	hostname quoted_string;
  	key-file quoted_string;
+  	protocols sslprotos; // experimental
  };

 TRUST-ANCHORS
@@ -557,20 +584,21 @@ VIEW
  	allow-update-forwarding { address_match_element; ... };
  	also-notify [ port integer ] [ dscp integer ] { ( primaries |
  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
+  	    integer ] ) [ key string ] [ tls string ]; ... };
  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
  	    ] [ dscp integer ];
  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
  	    * ) ] [ dscp integer ];
  	attach-cache string;
-  	auth-nxdomain boolean; // default changed
+  	auth-nxdomain boolean;
  	auto-dnssec ( allow | maintain | off );
  	cache-file quoted_string;
  	catalog-zones { zone string [ default-masters [ port integer ]
  	    [ dscp integer ] { ( primaries | ipv4_address [ port
  	    integer ] | ipv6_address [ port integer ] ) [ key
-  	    string ]; ... } ] [ zone-directory quoted_string ] [
-  	    in-memory boolean ] [ min-update-interval duration ]; ... };
+  	    string ] [ tls string ]; ... } ] [ zone-directory
+  	    quoted_string ] [ in-memory boolean ] [ min-update-interval
+  	    duration ]; ... };
  	check-dup-records ( fail | warn | ignore );
  	check-integrity boolean;
  	check-mx ( fail | warn | ignore );
@@ -638,6 +666,9 @@ VIEW
  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
  	glue-cache boolean;// deprecated
  	inline-signing boolean;
+  	ipv4only-contact string;
+  	ipv4only-enable boolean;
+  	ipv4only-server string;
  	ixfr-from-differences ( primary | master | secondary | slave |
  	    boolean );
  	key string {
@@ -795,6 +826,7 @@ VIEW
  	sig-signing-type integer;
  	sig-validity-interval integer [ integer ];
  	sortlist { address_match_element; ... };
+  	stale-answer-client-timeout ( disabled | off | integer );
  	stale-answer-enable boolean;
  	stale-answer-ttl duration;
  	stale-cache-enable boolean;
@@ -830,8 +862,8 @@ VIEW
  		allow-update-forwarding { address_match_element; ... };
  		also-notify [ port integer ] [ dscp integer ] { (
  		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ];
-  		    ... };
+  		    ipv6_address [ port integer ] ) [ key string ] [
+  		    tls string ]; ... };
  		alt-transfer-source ( ipv4_address | * ) [ port (
  		    integer | * ) ] [ dscp integer ];
  		alt-transfer-source-v6 ( ipv6_address | * ) [ port (
@@ -871,8 +903,8 @@ VIEW
  		masterfile-style ( full | relative );
  		masters [ port integer ] [ dscp integer ] { (
  		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ];
-  		    ... };
+  		    ipv6_address [ port integer ] ) [ key string ] [
+  		    tls string ]; ... };
  		max-ixfr-ratio ( unlimited | percentage );
  		max-journal-size ( default | unlimited | sizeval );
  		max-records integer;
@@ -895,8 +927,8 @@ VIEW
  		notify-to-soa boolean;
  		primaries [ port integer ] [ dscp integer ] { (
  		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ];
-  		    ... };
+  		    ipv6_address [ port integer ] ) [ key string ] [
+  		    tls string ]; ... };
  		request-expire boolean;
  		request-ixfr boolean;
  		serial-update-method ( date | increment | unixtime );
@@ -941,7 +973,7 @@ ZONE
  	allow-update-forwarding { address_match_element; ... };
  	also-notify [ port integer ] [ dscp integer ] { ( primaries |
  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
+  	    integer ] ) [ key string ] [ tls string ]; ... };
  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
  	    ] [ dscp integer ];
  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
@@ -979,7 +1011,7 @@ ZONE
  	masterfile-style ( full | relative );
  	masters [ port integer ] [ dscp integer ] { ( primaries |
  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
+  	    integer ] ) [ key string ] [ tls string ]; ... };
  	max-ixfr-ratio ( unlimited | percentage );
  	max-journal-size ( default | unlimited | sizeval );
  	max-records integer;
@@ -1002,7 +1034,7 @@ ZONE
  	notify-to-soa boolean;
  	primaries [ port integer ] [ dscp integer ] { ( primaries |
  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
+  	    integer ] ) [ key string ] [ tls string ]; ... };
  	request-expire boolean;
  	request-ixfr boolean;
  	serial-update-method ( date | increment | unixtime );
@@ -72,9 +72,9 @@ Options
   When applicable, this option specifies the hardware to use for cryptographic
   operations, such as a secure key store used for signing.

-   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -115,7 +115,11 @@ Options
   ``portnum``; if not not specified, the default is port 53. If
   ``value`` is of the form ``tls=<portnum>``, the server will
   listen for TLS queries on ``portnum``; the default is 853.
-
+   If ``value`` is of the form ``https=<portnum>``, the server will
+   listen for HTTPS queries on ``portnum``; the default is 443.
+   If ``value`` is of the form ``http=<portnum>``, the server will
+   listen for HTTP queries on ``portnum``; the default is 80.
+   
 ``-s``
   This option writes memory usage statistics to ``stdout`` on exit.

@@ -235,4 +239,4 @@ Files
 See Also
 ~~~~~~~~

-:rfc:`1033`, :rfc:`1034`, :rfc:`1035`, :manpage:`named-checkconf(8)`, :manpage:`named-checkzone(8)`, :manpage:`rndc(8), :manpage:`named.conf(5)`, BIND 9 Administrator Reference Manual.
+:rfc:`1033`, :rfc:`1034`, :rfc:`1035`, :manpage:`named-checkconf(8)`, :manpage:`named-checkzone(8)`, :manpage:`rndc(8)`, :manpage:`named.conf(5)`, BIND 9 Administrator Reference Manual.
@@ -2336,12 +2336,12 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	TRY0(xmlTextWriterEndElement(writer)); /* /statistics */
 	TRY0(xmlTextWriterEndDocument(writer));

-	xmlFreeTextWriter(writer);
-
 	xmlDocDumpFormatMemoryEnc(doc, buf, buflen, "UTF-8", 0);
 	if (*buf == NULL) {
 		goto cleanup;
 	}
+
+	xmlFreeTextWriter(writer);
 	xmlFreeDoc(doc);
 	return (ISC_R_SUCCESS);

@@ -0,0 +1,201 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <inttypes.h>
+
+#include <isc/buffer.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <dns/name.h>
+#include <dns/transport.h>
+
+#include <isccfg/cfg.h>
+
+#include <named/log.h>
+#include <named/transportconf.h>
+
+#define create_name(id, name)                                      \
+	isc_buffer_t namesrc, namebuf;                             \
+	char namedata[DNS_NAME_FORMATSIZE + 1];                    \
+	dns_name_init(name, NULL);                                 \
+	isc_buffer_constinit(&namesrc, id, strlen(id));            \
+	isc_buffer_add(&namesrc, strlen(id));                      \
+	isc_buffer_init(&namebuf, namedata, sizeof(namedata));     \
+	result = (dns_name_fromtext(name, &namesrc, dns_rootname,  \
+				    DNS_NAME_DOWNCASE, &namebuf)); \
+	if (result != ISC_R_SUCCESS) {                             \
+		goto failure;                                      \
+	}
+
+#define parse_transport_option(map, transport, name, setter)      \
+	{                                                         \
+		const cfg_obj_t *obj = NULL;                      \
+		cfg_map_get(map, name, &obj);                     \
+		if (obj != NULL) {                                \
+			setter(transport, cfg_obj_asstring(obj)); \
+		}                                                 \
+	}
+
+static isc_result_t
+add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
+	const cfg_obj_t *doh = NULL;
+	const char *dohid = NULL;
+	isc_result_t result;
+
+	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
+	     element != NULL; element = cfg_list_next(element))
+	{
+		dns_name_t dohname;
+		dns_transport_t *transport;
+
+		doh = cfg_listelt_value(element);
+		dohid = cfg_obj_asstring(cfg_map_getname(doh));
+
+		create_name(dohid, &dohname);
+
+		transport = dns_transport_new(&dohname, DNS_TRANSPORT_DOH,
+					      list);
+
+		parse_transport_option(doh, transport, "key-file",
+				       dns_transport_set_keyfile);
+		parse_transport_option(doh, transport, "cert-file",
+				       dns_transport_set_certfile);
+		parse_transport_option(doh, transport, "ca-file",
+				       dns_transport_set_cafile);
+		parse_transport_option(doh, transport, "hostname",
+				       dns_transport_set_hostname);
+	}
+
+	return (ISC_R_SUCCESS);
+failure:
+	cfg_obj_log(doh, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring DoH '%s': %s", dohid,
+		    isc_result_totext(result));
+
+	return (result);
+}
+
+static isc_result_t
+add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
+	const cfg_obj_t *tls = NULL;
+	const char *tlsid = NULL;
+	isc_result_t result;
+
+	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
+	     element != NULL; element = cfg_list_next(element))
+	{
+		dns_name_t tlsname;
+		dns_transport_t *transport;
+
+		tls = cfg_listelt_value(element);
+		tlsid = cfg_obj_asstring(cfg_map_getname(tls));
+
+		if (!strcmp(tlsid, "ephemeral")) {
+			result = ISC_R_UNEXPECTEDTOKEN;
+			goto failure;
+		}
+
+		create_name(tlsid, &tlsname);
+
+		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
+					      list);
+
+		parse_transport_option(tls, transport, "key-file",
+				       dns_transport_set_keyfile);
+		parse_transport_option(tls, transport, "cert-file",
+				       dns_transport_set_certfile);
+		parse_transport_option(tls, transport, "ca-file",
+				       dns_transport_set_cafile);
+		parse_transport_option(tls, transport, "hostname",
+				       dns_transport_set_hostname);
+	}
+
+	return (ISC_R_SUCCESS);
+failure:
+	cfg_obj_log(tls, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring tls '%s': %s", tlsid,
+		    isc_result_totext(result));
+
+	return (result);
+}
+
+#define CHECK(f)                             \
+	if ((result = f) != ISC_R_SUCCESS) { \
+		goto failure;                \
+	}
+
+static isc_result_t
+transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
+	const cfg_obj_t *obj = NULL;
+	isc_result_t result = ISC_R_SUCCESS;
+
+	if (result == ISC_R_SUCCESS &&
+	    cfg_map_get(config, "tls", &obj) == ISC_R_SUCCESS)
+	{
+		result = add_tls_transports(obj, list);
+		obj = NULL;
+	}
+
+	if (result == ISC_R_SUCCESS &&
+	    cfg_map_get(config, "doh", &obj) == ISC_R_SUCCESS)
+	{
+		result = add_doh_transports(obj, list);
+		obj = NULL;
+	}
+
+	return (result);
+}
+
+static void
+transport_list_add_ephemeral(dns_transport_list_t *list) {
+	isc_result_t result;
+	dns_name_t tlsname;
+
+	create_name("ephemeral", &tlsname);
+
+	(void)dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, list);
+
+	return;
+failure:
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+}
+
+isc_result_t
+named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
+			    isc_mem_t *mctx, dns_transport_list_t **listp) {
+	isc_result_t result;
+	dns_transport_list_t *list = dns_transport_list_new(mctx);
+
+	REQUIRE(listp != NULL && *listp == NULL);
+
+	transport_list_add_ephemeral(list);
+
+	if (config != NULL) {
+		result = transport_list_fromconfig(config, list);
+		if (result != ISC_R_SUCCESS) {
+			goto failure;
+		}
+	}
+
+	if (vconfig != NULL) {
+		config = cfg_tuple_get(vconfig, "options");
+		transport_list_fromconfig(config, list);
+	}
+
+	*listp = list;
+	return (ISC_R_SUCCESS);
+failure:
+	dns_transport_list_detach(&list);
+	return (result);
+}
@@ -59,6 +59,9 @@
    <ClCompile Include="..\tkeyconf.c">
      <Filter>Source Files</Filter>
    </ClCompile>
+    <ClCompile Include="..\transportconf.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
    <ClCompile Include="..\tsigconf.c">
      <Filter>Source Files</Filter>
    </ClCompile>
@@ -111,6 +114,9 @@
    <ClInclude Include="..\include\named\tkeyconf.h">
      <Filter>Header Files</Filter>
    </ClInclude>
+    <ClInclude Include="..\include\named\transportconf.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
    <ClInclude Include="..\include\named\tsigconf.h">
      <Filter>Header Files</Filter>
    </ClInclude>
@@ -138,6 +138,7 @@ perl -e "print \";\";" &gt;&gt; xsl.c
    <ClCompile Include="..\server.c" />
    <ClCompile Include="..\statschannel.c" />
    <ClCompile Include="..\tkeyconf.c" />
+    <ClCompile Include="..\transportconf.c" />
    <ClCompile Include="..\tsigconf.c" />
    <ClCompile Include="..\xsl.c" />
    <ClCompile Include="..\zoneconf.c" />
@@ -159,6 +160,7 @@ perl -e "print \";\";" &gt;&gt; xsl.c
    <ClInclude Include="..\include\named\server.h" />
    <ClInclude Include="..\include\named\statschannel.h" />
    <ClInclude Include="..\include\named\tkeyconf.h" />
+    <ClInclude Include="..\include\named\transportconf.h" />
    <ClInclude Include="..\include\named\tsigconf.h" />
    <ClInclude Include="..\include\named\types.h" />
    <ClInclude Include="..\xsl_p.h" />
@@ -29,6 +29,7 @@
 #include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
+#include <dns/nsec3.h>
 #include <dns/rdata.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
@@ -175,7 +176,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,

 parse_acl:
 	result = cfg_acl_fromconfig(aclobj, config, named_g_lctx, actx,
-				    dns_zone_getmctx(zone), 0, &acl);
+				    named_g_mctx, 0, &acl);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -912,6 +913,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
 	bool ixfrdiff;
+	bool use_kasp = false;
 	dns_masterformat_t masterformat;
 	const dns_master_style_t *masterstyle = &dns_master_style_default;
 	isc_stats_t *zoneqrystats;
@@ -1247,19 +1249,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "dnssec-policy", &obj);
 		if (result == ISC_R_SUCCESS) {
 			kaspname = cfg_obj_asstring(obj);
-			if (strcmp(kaspname, "none") != 0) {
-				result = dns_kasplist_find(kasplist, kaspname,
-							   &kasp);
-				if (result != ISC_R_SUCCESS) {
-					cfg_obj_log(obj, named_g_lctx,
-						    ISC_LOG_ERROR,
-						    "'dnssec-policy '%s' not "
-						    "found ",
-						    kaspname);
-					RETERR(result);
-				}
-				dns_zone_setkasp(zone, kasp);
+			result = dns_kasplist_find(kasplist, kaspname, &kasp);
+			if (result != ISC_R_SUCCESS) {
+				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
+					    "'dnssec-policy '%s' not found ",
+					    kaspname);
+				RETERR(result);
 			}
+			dns_zone_setkasp(zone, kasp);
+			use_kasp = dns_zone_use_kasp(zone);
 		}

 		obj = NULL;
@@ -1304,13 +1302,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 			RETERR(named_config_getipandkeylist(config, obj, mctx,
 							    &ipkl));
-			result = dns_zone_setalsonotifydscpkeys(
-				zone, ipkl.addrs, ipkl.dscps, ipkl.keys,
-				ipkl.count);
+			result = dns_zone_setalsonotify(zone, ipkl.addrs,
+							ipkl.dscps, ipkl.keys,
+							ipkl.tlss, ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
 			RETERR(result);
 		} else {
-			RETERR(dns_zone_setalsonotify(zone, NULL, 0));
+			RETERR(dns_zone_setalsonotify(zone, NULL, NULL, NULL,
+						      NULL, 0));
 		}

 		obj = NULL;
@@ -1560,7 +1559,21 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		bool allow = false, maint = false;
 		bool sigvalinsecs;

-		if (kasp) {
+		if (use_kasp) {
+			if (dns_kasp_nsec3(kasp)) {
+				result = dns_zone_setnsec3param(
+					zone, 1, dns_kasp_nsec3flags(kasp),
+					dns_kasp_nsec3iter(kasp),
+					dns_kasp_nsec3saltlen(kasp), NULL, true,
+					false);
+			} else {
+				result = dns_zone_setnsec3param(
+					zone, 0, 0, 0, 0, NULL, true, false);
+			}
+			INSIST(result == ISC_R_SUCCESS);
+		}
+
+		if (use_kasp) {
 			seconds = (uint32_t)dns_kasp_sigvalidity_dnskey(kasp);
 		} else {
 			obj = NULL;
@@ -1571,7 +1584,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setkeyvalidityinterval(zone, seconds);

-		if (kasp) {
+		if (use_kasp) {
 			seconds = (uint32_t)dns_kasp_sigvalidity(kasp);
 			dns_zone_setsigvalidityinterval(zone, seconds);
 			seconds = (uint32_t)dns_kasp_sigrefresh(kasp);
@@ -1658,7 +1671,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
-		if (dns_zone_getkasp(zone) != NULL) {
+		if (kasp != NULL && strcmp(dns_kasp_getname(kasp), "none") != 0)
+		{
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, true);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, true);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, true);
@@ -1677,6 +1691,11 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
+		} else {
+			bool s2i = dns_zone_secure_to_insecure(zone, false);
+			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, s2i);
+			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
+			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, s2i);
 		}
 	}

@@ -1892,13 +1911,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 			RETERR(named_config_getipandkeylist(config, obj, mctx,
 							    &ipkl));
-			result = dns_zone_setprimarieswithkeys(
-				mayberaw, ipkl.addrs, ipkl.keys, ipkl.count);
+			result = dns_zone_setprimaries(mayberaw, ipkl.addrs,
+						       ipkl.keys, ipkl.tlss,
+						       ipkl.count);
 			count = ipkl.count;
 			dns_ipkeylist_clear(mctx, &ipkl);
 			RETERR(result);
 		} else {
-			result = dns_zone_setprimaries(mayberaw, NULL, 0);
+			result = dns_zone_setprimaries(mayberaw, NULL, NULL,
+						       NULL, 0);
 		}
 		RETERR(result);

@@ -2049,13 +2070,15 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 }

 bool
-named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
+named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
+		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
+		    cfg_aclconfctx_t *actx) {
 	const cfg_obj_t *zoptions = NULL;
 	const cfg_obj_t *obj = NULL;
 	const char *cfilename;
 	const char *zfilename;
 	dns_zone_t *raw = NULL;
-	bool has_raw;
+	bool has_raw, inline_signing;
 	dns_zonetype_t ztype;

 	zoptions = cfg_tuple_get(zconfig, "options");
@@ -2083,13 +2106,13 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 		has_raw = false;
 	}

-	obj = NULL;
-	(void)cfg_map_get(zoptions, "inline-signing", &obj);
-	if ((obj == NULL || !cfg_obj_asboolean(obj)) && has_raw) {
+	inline_signing = named_zone_inlinesigning(zone, zconfig, vconfig,
+						  config, actx);
+	if (!inline_signing && has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was inline-signing");
 		return (false);
-	} else if ((obj != NULL && cfg_obj_asboolean(obj)) && !has_raw) {
+	} else if (inline_signing && !has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was not inline-signing");
 		return (false);
@@ -2119,3 +2142,89 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {

 	return (true);
 }
+
+bool
+named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
+			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
+			 cfg_aclconfctx_t *actx) {
+	isc_result_t res;
+	const cfg_obj_t *zoptions = NULL;
+	const cfg_obj_t *voptions = NULL;
+	const cfg_obj_t *options = NULL;
+	const cfg_obj_t *signing = NULL;
+	const cfg_obj_t *allowupdate = NULL;
+	const cfg_obj_t *updatepolicy = NULL;
+	bool zone_is_dynamic = false;
+	bool inline_signing = false;
+
+	(void)cfg_map_get(config, "options", &options);
+
+	zoptions = cfg_tuple_get(zconfig, "options");
+	if (vconfig != NULL) {
+		voptions = cfg_tuple_get(vconfig, "options");
+	}
+
+	inline_signing = (cfg_map_get(zoptions, "inline-signing", &signing) ==
+				  ISC_R_SUCCESS &&
+			  cfg_obj_asboolean(signing));
+	if (inline_signing) {
+		return (true);
+	}
+
+	if (cfg_map_get(zoptions, "update-policy", &updatepolicy) ==
+	    ISC_R_SUCCESS) {
+		zone_is_dynamic = true;
+	} else {
+		res = cfg_map_get(zoptions, "allow-update", &allowupdate);
+		if (res != ISC_R_SUCCESS && voptions != NULL) {
+			res = cfg_map_get(voptions, "allow-update",
+					  &allowupdate);
+		}
+		if (res != ISC_R_SUCCESS && options != NULL) {
+			res = cfg_map_get(options, "allow-update",
+					  &allowupdate);
+		}
+		if (res == ISC_R_SUCCESS) {
+			dns_acl_t *acl = NULL;
+			res = cfg_acl_fromconfig(
+				allowupdate, config, named_g_lctx, actx,
+				dns_zone_getmctx(zone), 0, &acl);
+			if (res == ISC_R_SUCCESS && acl != NULL &&
+			    !dns_acl_isnone(acl)) {
+				zone_is_dynamic = true;
+			}
+			if (acl != NULL) {
+				dns_acl_detach(&acl);
+			}
+		}
+	}
+
+	/*
+	 * If inline-signing is not set, perhaps implictly through a
+	 * dnssec-policy.  Since automated DNSSEC maintenance requires
+	 * a dynamic zone, or inline-siging to be enabled, check if
+	 * the zone with dnssec-policy allows updates.  If not, enable
+	 * inline-signing.
+	 */
+	signing = NULL;
+	if (!inline_signing && !zone_is_dynamic &&
+	    cfg_map_get(zoptions, "dnssec-policy", &signing) == ISC_R_SUCCESS &&
+	    signing != NULL)
+	{
+		if (strcmp(cfg_obj_asstring(signing), "none") != 0) {
+			inline_signing = true;
+			dns_zone_log(zone, ISC_LOG_DEBUG(1),
+				     "inline-signing: "
+				     "implicitly through dnssec-policy");
+		} else {
+			inline_signing = dns_zone_secure_to_insecure(zone,
+								     true);
+			dns_zone_log(
+				zone, ISC_LOG_DEBUG(1), "inline-signing: %s",
+				inline_signing ? "transitioning to insecure"
+					       : "no");
+		}
+	}
+
+	return (inline_signing);
+}
@@ -1,5 +1,4 @@
 .libs
-headerdep_test.sh
 nxtify
 sdig
 *_test
@@ -9,3 +8,6 @@ dlopen
 keycreate
 keydelete
 gssapi_krb
+/wire_test
+/test_client
+/test_server
@@ -2,13 +2,33 @@ include $(top_srcdir)/Makefile.top

 SUBDIRS = system

-noinst_PROGRAMS = wire_test
+noinst_PROGRAMS =	\
+	test_client	\
+	test_server	\
+	wire_test

-AM_CPPFLAGS +=			\
+test_client_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(LIBISC_CFLAGS)
+
+test_client_LDADD =		\
+	$(LIBISC_LIBS)		\
+	$(LIBDNS_LIBS)
+
+test_server_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(LIBISC_CFLAGS)
+
+test_server_LDADD =		\
+	$(LIBISC_LIBS)		\
+	$(LIBDNS_LIBS)
+
+wire_test_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)

-LDADD =				\
+wire_test_LDADD =		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)

@@ -1,49 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Check the installed bind9 headers to make sure that no header
-# depends on another header having been included first.
-#
-
-prefix=@prefix@
-tmp=/tmp/thdr$$.tmp
-
-status=0
-
-echo "Checking for header interdependencies..."
-
-# Make a list of header files.
-(cd $prefix/include; find . -name '*.h' -print | sed 's!^./!!') > $tmp
-
-# Check each header.
-while read h
-do
-    echo " - <$h>"
-
-    # Build a test program.
-    cat <<EOF >test.c
-#include <$h>
-EOF
-
-    # Compile the test program.
-    if
-       gcc @STD_CWARNINGS@ @STD_CINCLUDES@ -I$prefix/include -c test.c 2>&1
-    then
-       :
-    else
-       status=1
-    fi
-done <$tmp
-
-rm -f test.c test.o $tmp
-
-exit $status
@@ -26,9 +26,6 @@
 // watch out for ";" -- it's important!

 options {
-	additional-from-auth true;
-	additional-from-cache false;
-
 	version "my version string";
 	random-device "/dev/random";
 	directory "/tmp";
@@ -265,8 +262,6 @@ view "test-view" in {
 	sig-validity-interval 45;
 	max-cache-size 100000;
 	allow-query { 10.0.0.30;};
-	additional-from-cache false;
-	additional-from-auth no;
 	match-clients { 10.0.0.1 ; };
 	check-names master warn;
 	check-names slave ignore;
@@ -418,9 +413,6 @@ server 1.2.3.4 {
 	keys { "sample_key" };	// for TSIG; supported by the parser
 					// but not yet implemented in the
 					// rest of the server
-# Now called 'request-ixfr'
-#	support-ixfr yes;      // for IXFR supported by server
-					// if yes, the listed server talks IXFR
 };

 logging {
@@ -9,7 +9,7 @@ dist-hook:
 	        sed -n "s|^Would remove \(.*\)|$(distdir)/\1|p" | \
 	        xargs -I{} rm -rf "{}"

-SUBDIRS = dyndb/driver dlzexternal/driver
+SUBDIRS = dyndb/driver dlzexternal/driver hooks/driver

 AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)
@@ -90,7 +90,7 @@ TESTS +=			\
 	checkconf		\
 	checknames		\
 	checkzone		\
-	cookie			\
+	cpu			\
 	database		\
 	dlz			\
 	dlzexternal		\
@@ -109,6 +109,7 @@ TESTS +=			\
 	include-multiplecfg	\
 	inline			\
 	integrity		\
+	hooks			\
 	keepalive		\
 	legacy			\
 	limits			\
@@ -120,6 +121,7 @@ TESTS +=			\
 	mkeys			\
 	names			\
 	notify			\
+	nsec3			\
 	nslookup		\
 	padding			\
 	pending			\
@@ -149,6 +151,7 @@ TESTS +=			\
 	views			\
 	wildcard		\
 	xferquota		\
+	xot			\
 	zonechecks

 # eddsa test is broken
@@ -200,7 +203,7 @@ if HAVE_PYTHON
 TESTS += kasp tcp pipelined

 if HAVE_PYMOD_DNS
-TESTS += qmin
+TESTS += qmin cookie

 if HAVE_PERLMOD_NET_DNS
 TESTS += dnssec
@@ -20,3 +20,4 @@ ns                      A       10.53.0.1
 www			CNAME	server.example.net.
 inzone			CNAME	a.example.com.
 a			A	10.53.0.1
+dname			DNAME	@
@@ -70,7 +70,7 @@ grep "server.example.net.*A.*10.53.0.100" dig.out.test$n > /dev/null && ret=1
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo_i "check that cross-zone CNAME records returns target data (rd=1/ra=1) ($n)"
+echo_i "check that cross-zone CNAME records return target data (rd=1/ra=1) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 www.example.com > dig.out.test$n || ret=1
 grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
@@ -84,7 +84,7 @@ status=`expr $status + $ret`
 # In-zone CNAME records should always be followed regardless of RD and RA.
 #
 n=`expr $n + 1`
-echo_i "check that in-zone CNAME records returns target data (rd=0/ra=0) ($n)"
+echo_i "check that in-zone CNAME records return target data (rd=0/ra=0) ($n)"
 ret=0
 $DIG $DIGOPTS +norec @10.53.0.1 inzone.example.com > dig.out.test$n || ret=1
 grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
@@ -106,7 +106,7 @@ grep "a.example.com.*A.*10.53.0.1" dig.out.test$n > /dev/null || ret=1
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo_i "check that in-zone CNAME records returns target data (rd=0/ra=1) ($n)"
+echo_i "check that in-zone CNAME records return target data (rd=0/ra=1) ($n)"
 ret=0
 $DIG $DIGOPTS +norec @10.53.0.2 inzone.example.com > dig.out.test$n || ret=1
 grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
@@ -117,7 +117,7 @@ grep "a.example.com.*A.*10.53.0.1" dig.out.test$n > /dev/null || ret=1
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo_i "check that in-zone CNAME records returns target data (rd=1/ra=1) ($n)"
+echo_i "check that in-zone CNAME records return target data (rd=1/ra=1) ($n)"
 ret=0
 $DIG $DIGOPTS @10.53.0.2 inzone.example.com > dig.out.test$n || ret=1
 grep "ANSWER: 2," dig.out.test$n > /dev/null || ret=1
@@ -127,6 +127,54 @@ grep "a.example.com.*A.*10.53.0.1" dig.out.test$n > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo_i "check that in-zone CNAME records does not return target data when QTYPE is CNAME (rd=1/ra=1) ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 -t cname inzone.example.com > dig.out.test$n || ret=1
+grep 'ANSWER: 1,' dig.out.test$n > /dev/null || ret=1
+grep 'flags: qr aa rd ra;' dig.out.test$n > /dev/null || ret=1
+grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null || ret=1
+grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "check that in-zone CNAME records does not return target data when QTYPE is ANY (rd=1/ra=1) ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 -t any inzone.example.com > dig.out.test$n || ret=1
+grep 'ANSWER: 1,' dig.out.test$n > /dev/null || ret=1
+grep 'flags: qr aa rd ra;' dig.out.test$n > /dev/null || ret=1
+grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null || ret=1
+grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "check that in-zone DNAME records does not return target data when QTYPE is CNAME (rd=1/ra=1) ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 -t cname inzone.dname.example.com > dig.out.test$n || ret=1
+grep 'ANSWER: 2,' dig.out.test$n > /dev/null || ret=1
+grep 'flags: qr aa rd ra;' dig.out.test$n > /dev/null || ret=1
+grep 'dname\.example\.com\..*DNAME.example\.com\.' dig.out.test$n > /dev/null || ret=1
+grep 'inzone\.dname\.example\.com\..*CNAME.inzone\.example\.com\.' dig.out.test$n > /dev/null || ret=1
+grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null && ret=1
+grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "check that in-zone DNAME records does not return target data when QTYPE is ANY (rd=1/ra=1) ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 -t any inzone.dname.example.com > dig.out.test$n || ret=1
+grep 'ANSWER: 2,' dig.out.test$n > /dev/null || ret=1
+grep 'flags: qr aa rd ra;' dig.out.test$n > /dev/null || ret=1
+grep 'dname\.example\.com\..*DNAME.example\.com\.' dig.out.test$n > /dev/null || ret=1
+grep 'inzone\.dname\.example\.com\..*CNAME.inzone\.example\.com\.' dig.out.test$n > /dev/null || ret=1
+grep 'inzone\.example\.com.*CNAME.a\.example\.com\.' dig.out.test$n > /dev/null && ret=1
+grep 'a\.example\.com.*A.10\.53\.0\.1' dig.out.test$n > /dev/null && ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "check that CHAOS addresses are compared correctly ($n)"
 ret=0
@@ -9,6 +9,17 @@
 * information regarding copyright ownership.
 */

-options {
-	dnssec-enable no;
+view view1 {
+	match-clients { any; };
+	dnssec-validation yes;
+};
+
+view view2 {
+	match-clients { none; };
+	dnssec-validation auto;
+};
+
+view view3 {
+	match-clients { none; };
+	auto-dnssec maintain;
 };
@@ -11,15 +11,22 @@

 view view1 {
 	match-clients { any; };
-	dnssec-validation yes;
 };

 view view2 {
 	match-clients { none; };
-	dnssec-validation auto;
 };

 view view3 {
 	match-clients { none; };
-	auto-dnssec maintain;
+	dnssec-validation auto;
+};
+
+view view4 {
+	match-clients { none; };
+};
+
+view view5 {
+	match-clients { none; };
+	auto-dnssec off;
 };
@@ -1,32 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-view view1 {
-	match-clients { any; };
-};
-
-view view2 {
-	match-clients { none; };
-};
-
-view view3 {
-	match-clients { none; };
-	dnssec-validation auto;
-};
-
-view view4 {
-	match-clients { none; };
-};
-
-view view5 {
-	match-clients { none; };
-	auto-dnssec off;
-};
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+tls local-tls {
+	key-file "key.pem";
+	cert-file "cert.pem";
+};
+
+http local-http-server {
+	endpoints { "/dns-query"; };
+};
+
+options {
+	listen-on { 10.53.0.1; };
+	http-port 80;
+	https-port 443;
+	listen-on port 443 tls local-tls http local-http-server { 10.53.0.1; };
+	listen-on port 8080 http local-http-server { 10.53.0.1; };
+};
@@ -9,6 +9,11 @@
 * information regarding copyright ownership.
 */

+tls local-tls {
+	key-file "key.pem";
+	cert-file "cert.pem";
+};
+
 options {
-	dnssec-lookaside . trust-anchor dlv.example.com;
+	listen-on port 853 tls local-tls { 10.53.0.1; };
 };
@@ -22,6 +22,7 @@ dnssec-policy "test" {
 		csk key-directory lifetime unlimited algorithm rsasha256 2048;
 	};
 	max-zone-ttl 86400;
+	nsec3param iterations 5 optout no salt-length 8;
 	parent-ds-ttl 7200;
 	parent-propagation-delay PT1H;
 	publish-safety PT3600S;
@@ -22,6 +22,7 @@ dnssec-policy "test" {
 		csk key-directory lifetime P30D algorithm 8 2048;
 	};
 	max-zone-ttl 86400;
+	nsec3param ;
 	parent-ds-ttl 7200;
 	parent-propagation-delay PT1H;
 	publish-safety PT3600S;
@@ -9,6 +9,14 @@
 * information regarding copyright ownership.
 */

-options {
-	dnssec-lookaside auto;
+dnssec-policy "bad-keylen" {
+	keys {
+		csk lifetime P10Y algorithm rsasha1 511;
+	};
+};
+
+zone "example.net" {
+	type master;
+	file "example.db";
+	dnssec-policy "badkeylen";
 };
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "bad-salt" {
+	keys {
+		csk lifetime unlimited algorithm rsasha1;
+	};
+	nsec3param ;
+};
+
+zone "example.net" {
+	type master;
+	file "example.db";
+	dnssec-policy "bad-salt";
+};
+
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "rsasha1" {
+	keys {
+		csk lifetime P10Y algorithm nsec3rsasha1 1024;
+	};
+	nsec3param iterations 150;
+};
+
+dnssec-policy "rsasha1-bad" {
+	keys {
+		csk lifetime P10Y algorithm nsec3rsasha1 1024;
+	};
+	nsec3param iterations 151;
+};
+
+dnssec-policy "rsasha256" {
+	keys {
+		csk lifetime P10Y algorithm rsasha256 2048;
+	};
+	nsec3param iterations 500;
+};
+
+dnssec-policy "rsasha256-bad" {
+	keys {
+		csk lifetime P10Y algorithm rsasha256 2048;
+	};
+	nsec3param iterations 501;
+};
+
+dnssec-policy "rsasha512" {
+	keys {
+		csk lifetime P10Y algorithm rsasha512 4096;
+	};
+	nsec3param iterations 2500;
+};
+
+dnssec-policy "rsasha512-bad" {
+	keys {
+		csk lifetime P10Y algorithm rsasha512 4096;
+	};
+	nsec3param iterations 2501;
+};
+
+zone "example.net" {
+	type master;
+	file "example.db";
+	dnssec-policy "default";
+};
@@ -9,6 +9,13 @@
 * information regarding copyright ownership.
 */

-options {
-	dnssec-lookaside . trust-anchor dlv.isc.org;
+dnssec-policy "bad-salt" {
+	nsec3param salt "pepper";
 };
+
+zone "example.net" {
+	type master;
+	file "example.db";
+	dnssec-policy "bad-salt";
+};
+
@@ -78,6 +78,24 @@ do
 	status=`expr $status + $ret`
 done

+for lmdb in lmdb-*.conf
+do
+	n=`expr $n + 1`
+	ret=0
+
+	$FEATURETEST --with-lmdb
+	if [ $? -eq 0 ]; then
+		echo_i "checking that named-checkconf detects no error in $lmdb ($n)"
+		$CHECKCONF $lmdb > checkconf.out$n 2>&1
+		if [ $? != 0 ]; then echo_i "failed"; ret=1; fi
+	else
+		echo_i "checking that named-checkconf detects error in $lmdb ($n)"
+		$CHECKCONF $lmdb > checkconf.out$n 2>&1
+		if [ $? == 0 ]; then echo_i "failed"; ret=1; fi
+	fi
+	status=`expr $status + $ret`
+done
+
 n=`expr $n + 1`
 echo_i "checking that ancient options report a fatal error ($n)"
 ret=0
@@ -113,14 +131,11 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking named-checkconf dnssec warnings ($n)"
 ret=0
-# dnssec.1: dnssec-enable is obsolete
-$CHECKCONF dnssec.1 > checkconf.out$n.1 2>&1
-grep "'dnssec-enable' is obsolete and should be removed" < checkconf.out$n.1 > /dev/null || ret=1
-# dnssec.2: auto-dnssec warning
-$CHECKCONF dnssec.2 > checkconf.out$n.2 2>&1
+# dnssec.1: auto-dnssec warning
+$CHECKCONF dnssec.1 > checkconf.out$n.2 2>&1
 grep 'auto-dnssec may only be ' < checkconf.out$n.2 > /dev/null || ret=1
-# dnssec.3: should have no warnings
-$CHECKCONF dnssec.3 > checkconf.out$n.3 2>&1
+# dnssec.2: should have no warnings
+$CHECKCONF dnssec.2 > checkconf.out$n.3 2>&1
 grep '.*' < checkconf.out$n.3 > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -403,30 +418,6 @@ diff good.zonelist checkconf.out$n > diff.out$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo_i "check that 'dnssec-lookaside auto;' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-dlv-auto.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "option 'dnssec-lookaside' is obsolete and should be removed" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "check that 'dnssec-lookaside . trust-anchor dlv.isc.org;' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-dlv-dlv.isc.org.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "option 'dnssec-lookaside' is obsolete and should be removed" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "check that 'dnssec-lookaside . trust-anchor dlv.example.com;' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-dlv-dlv.example.com.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "option 'dnssec-lookaside' is obsolete and should be removed" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "check that the 2010 ICANN ROOT KSK without the 2017 ICANN ROOT KSK generates a warning ($n)"
 ret=0
@@ -484,15 +475,6 @@ grep "use of managed-keys is not allowed" checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

-n=`expr $n + 1`
-echo_i "check that 'geoip-use-ecs no' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-geoip-use-ecs.conf > checkconf.out$n 2>/dev/null || ret=1
-[ -s checkconf.out$n ] || ret=1
-grep "'geoip-use-ecs' is obsolete" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "checking named-checkconf kasp errors ($n)"
 ret=0
@@ -509,7 +491,35 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo_i "checking named-checkconf kasp predefined key lengths ($n)"
+echo_i "checking named-checkconf kasp nsec3 iterations errors ($n)"
+ret=0
+$CHECKCONF kasp-bad-nsec3-iter.conf > checkconf.out$n 2>&1 && ret=1
+grep "dnssec-policy: nsec3 iterations value 151 out of range" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: nsec3 iterations value 501 out of range" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: nsec3 iterations value 2501 out of range" < checkconf.out$n > /dev/null || ret=1
+lines=$(wc -l < "checkconf.out$n")
+if [ $lines != 3 ]; then ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "checking named-checkconf kasp nsec3 algorithm errors ($n)"
+ret=0
+$CHECKCONF kasp-bad-nsec3-alg.conf > checkconf.out$n 2>&1 && ret=1
+grep "dnssec-policy: cannot use nsec3 with algorithm 'RSASHA1'" < checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "checking named-checkconf kasp key errors ($n)"
+ret=0
+$CHECKCONF kasp-bad-keylen.conf > checkconf.out$n 2>&1 && ret=1
+grep "dnssec-policy: key with algorithm rsasha1 has invalid key length 511" < checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "checking named-checkconf kasp predefined key length ($n)"
 ret=0
 $CHECKCONF kasp-ignore-keylen.conf > checkconf.out$n 2>&1 || ret=1
 grep "dnssec-policy: key algorithm ecdsa256 has predefined length; ignoring length value 2048" < checkconf.out$n > /dev/null || ret=1
@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	geoip-use-ecs no;
-};
@@ -66,7 +66,6 @@ cds
 checkconf
 checknames
 checkzone
-cookie
 database
 digdelv
 dlz
@@ -88,7 +87,6 @@ inline
 integrity
 ixfr
 keepalive
-legacy
 limits
 masterfile
 masterformat
@@ -97,6 +95,7 @@ mirror
 mkeys
 names
 notify
+nsec3
 nslookup
 nsupdate
 padding
@@ -669,6 +668,8 @@ copy_setports() {
    atsign="@"
    sed -e "s/${atsign}PORT${atsign}/${PORT}/g" \
        -e "s/${atsign}TLSPORT${atsign}/${TLSPORT}/g" \
+		-e "s/${atsign}HTTPPORT${atsign}/${HTTPSPORT}/g" \
+        -e "s/${atsign}HTTPSPORT${atsign}/${HTTPSPORT}/g" \
        -e "s/${atsign}EXTRAPORT1${atsign}/${EXTRAPORT1}/g" \
        -e "s/${atsign}EXTRAPORT2${atsign}/${EXTRAPORT2}/g" \
        -e "s/${atsign}EXTRAPORT3${atsign}/${EXTRAPORT3}/g" \
@@ -81,11 +81,13 @@ SEQUENTIALDIRS="$SEQUENTIAL_COMMON $SEQUENTIAL_UNIX"

 PARALLEL_UNIX="@DNSTAP@
 chain
+cookie
 dlzexternal
 dnssec
 dyndb
 filter-aaaa
 kasp
+legacy
 logfileconfig
 nzd2nzf
 pipelined
@@ -122,7 +124,7 @@ PERL=$(command -v "@PERL@")
 # Windows process management leave empty
 PSSUSPEND=

-PYTHON=$(command -v "@PYTHON@")
+PYTHON=$(command -v "@PYTHON@" || true)
 PYTEST=@PYTEST@

 #
@@ -0,0 +1,277 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+from __future__ import print_function
+import os
+import sys
+import signal
+import socket
+import select
+from datetime import datetime, timedelta
+import time
+import functools
+
+import dns
+import dns.edns
+import dns.flags
+import dns.message
+import dns.query
+import dns.tsig
+import dns.tsigkeyring
+import dns.version
+
+from dns.edns import *
+from dns.name import *
+from dns.rcode import *
+from dns.rdataclass import *
+from dns.rdatatype import *
+from dns.tsig import *
+
+# Log query to file
+def logquery(type, qname):
+    with open("qlog", "a") as f:
+        f.write("%s %s\n", type, qname)
+
+# DNS 2.0 keyring specifies the algorithm
+try:
+    keyring = dns.tsigkeyring.from_text({ "foo" : {
+                                                   "hmac-sha256",
+                                                   "aaaaaaaaaaaa"
+                                                  } ,
+                                          "fake" : {
+                                                   "hmac-sha256",
+                                                   "aaaaaaaaaaaa"
+                                                  }
+                                         })
+except:
+    keyring = dns.tsigkeyring.from_text({ "foo" : "aaaaaaaaaaaa",
+                                           "fake" : "aaaaaaaaaaaa" })
+
+dopass2 = False
+
+############################################################################
+#
+# This server will serve valid and spoofed answers. A spoofed answer will
+# have the address 10.53.0.10 included.
+#
+# When receiving a query over UDP:
+#
+# A query to "nocookie"/A will result in a spoofed answer with no cookie set.
+# A query to "tcponly"/A will result in a spoofed answer with no cookie set.
+# A query to "withtsig"/A will result in two responses, the first is a spoofed
+# answer that is TSIG signed, the second is a valid answer with a cookie set.
+# A query to anything else will result in a valid answer with a cookie set.
+#
+# When receiving a query over TCP:
+#
+# A query to "nocookie"/A will result in a valid answer with no cookie set.
+# A query to anything else will result in a valid answer with a cookie set.
+#
+############################################################################
+def create_response(msg, tcp, first, ns10):
+    global dopass2
+    m = dns.message.from_wire(msg, keyring=keyring)
+    qname = m.question[0].name.to_text()
+    lqname = qname.lower()
+    labels = lqname.split('.')
+    rrtype = m.question[0].rdtype
+    typename = dns.rdatatype.to_text(rrtype)
+
+    with open("query.log", "a") as f:
+        f.write("%s %s\n" % (typename, qname))
+        print("%s %s" % (typename, qname), end=" ")
+
+    r = dns.message.make_response(m)
+    r.set_rcode(NOERROR)
+    if rrtype == A:
+        # exempt potential nameserver A records.
+        if labels[0] == "ns" and ns10:
+            r.answer.append(dns.rrset.from_text(qname, 1, IN, A, "10.53.0.10"))
+        else:
+            r.answer.append(dns.rrset.from_text(qname, 1, IN, A, "10.53.0.9"))
+        if not tcp and labels[0] == "nocookie":
+            r.answer.append(dns.rrset.from_text(qname, 1, IN, A, "10.53.0.10"))
+        if not tcp and labels[0] == "tcponly":
+            r.answer.append(dns.rrset.from_text(qname, 1, IN, A, "10.53.0.10"))
+        if first and not tcp and labels[0] == "withtsig":
+            r.answer.append(dns.rrset.from_text(qname, 1, IN, A, "10.53.0.10"))
+            dopass2 = True
+    elif rrtype == NS:
+        r.answer.append(dns.rrset.from_text(qname, 1, IN, NS, "."))
+    elif rrtype == SOA:
+        r.answer.append(dns.rrset.from_text(qname, 1, IN, SOA, ". . 0 0 0 0 0"))
+    else:
+        r.authority.append(dns.rrset.from_text(qname, 1, IN, SOA, ". . 0 0 0 0 0"))
+    # Add a server cookie to the response
+    if labels[0] != "nocookie":
+        for o in m.options:
+            if o.otype == 10: # Use 10 instead of COOKIE
+                 if first and labels[0] == "withtsig" and not tcp:
+                     r.use_tsig(keyring = keyring,
+                                keyname = dns.name.from_text("fake"),
+                                algorithm = HMAC_SHA256)
+                 elif labels[0] != "tcponly" or tcp:
+                     cookie = o
+                     if len(o.data) == 8:
+                         cookie.data = o.data + o.data
+                     else:
+                         cookie.data = o.data
+                     r.use_edns(options=[cookie])
+    r.flags |= dns.flags.AA
+    return r
+
+def sigterm(signum, frame):
+    print ("Shutting down now...")
+    os.remove('ans.pid')
+    running = False
+    sys.exit(0)
+
+############################################################################
+# Main
+#
+# Set up responder and control channel, open the pid file, and start
+# the main loop, listening for queries on the query channel or commands
+# on the control channel and acting on them.
+############################################################################
+ip4_addr1 = "10.53.0.9"
+ip4_addr2 = "10.53.0.10"
+ip6_addr1 = "fd92:7065:b8e:ffff::9"
+ip6_addr2 = "fd92:7065:b8e:ffff::10"
+
+try: port=int(os.environ['PORT'])
+except: port=5300
+
+query4_udp1 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+query4_udp1.bind((ip4_addr1, port))
+query4_tcp1 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+query4_tcp1.bind((ip4_addr1, port))
+query4_tcp1.listen(1)
+query4_tcp1.settimeout(1)
+
+query4_udp2 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+query4_udp2.bind((ip4_addr2, port))
+query4_tcp2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+query4_tcp2.bind((ip4_addr2, port))
+query4_tcp2.listen(1)
+query4_tcp2.settimeout(1)
+
+havev6 = True
+query6_udp1 = None
+query6_udp2 = None
+query6_tcp1 = None
+query6_tcp2 = None
+try:
+    query6_udp1 = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    query6_udp1.bind((ip6_addr1, port))
+    query6_tcp1 = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
+    query6_tcp1.bind((ip6_addr1, port))
+    query6_tcp1.listen(1)
+    query6_tcp1.settimeout(1)
+
+    query6_udp2 = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    query6_udp2.bind((ip6_addr2, port))
+    query6_tcp2 = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
+    query6_tcp2.bind((ip6_addr2, port))
+    query6_tcp2.listen(1)
+    query6_tcp2.settimeout(1)
+except:
+    if query6_udp1 != None:
+        query6_udp1.close()
+    if query6_tcp1 != None:
+        query6_tcp1.close()
+    if query6_udp2 != None:
+        query6_udp2.close()
+    if query6_tcp2 != None:
+        query6_tcp2.close()
+    havev6 = False
+
+signal.signal(signal.SIGTERM, sigterm)
+
+f = open('ans.pid', 'w')
+pid = os.getpid()
+print (pid, file=f)
+f.close()
+
+running = True
+
+print ("Using DNS version %s" % dns.version.version)
+print ("Listening on %s port %d" % (ip4_addr1, port))
+print ("Listening on %s port %d" % (ip4_addr2, port))
+if havev6:
+    print ("Listening on %s port %d" % (ip6_addr1, port))
+    print ("Listening on %s port %d" % (ip6_addr2, port))
+print ("Ctrl-c to quit")
+
+if havev6:
+    input = [query4_udp1, query6_udp1, query4_tcp1, query6_tcp1,
+             query4_udp2, query6_udp2, query4_tcp2, query6_tcp2]
+else:
+    input = [query4_udp1, query4_tcp1, query4_udp2, query4_tcp2]
+
+while running:
+    try:
+        inputready, outputready, exceptready = select.select(input, [], [])
+    except select.error as e:
+        break
+    except socket.error as e:
+        break
+    except KeyboardInterrupt:
+        break
+
+    for s in inputready:
+        ns10 = False
+        if s == query4_udp1 or s == query6_udp1 or \
+           s == query4_udp2 or s == query6_udp2:
+            if s == query4_udp1 or s == query6_udp1:
+                print ("UDP Query received on %s" %
+                       (ip4_addr1 if s == query4_udp1 else ip6_addr1), end=" ")
+            if s == query4_udp2 or s == query6_udp2:
+                print ("UDP Query received on %s" %
+                       (ip4_addr2 if s == query4_udp2 else ip6_addr2), end=" ")
+                ns10 = True
+            # Handle incoming queries
+            msg = s.recvfrom(65535)
+            dopass2 = False
+            rsp = create_response(msg[0], False, True, ns10)
+            print(dns.rcode.to_text(rsp.rcode()))
+            s.sendto(rsp.to_wire(), msg[1])
+            if dopass2:
+                print ("Sending second UDP response without TSIG", end=" ")
+                rsp = create_response(msg[0], False, False, ns10)
+                s.sendto(rsp.to_wire(), msg[1])
+                print(dns.rcode.to_text(rsp.rcode()))
+
+        if s == query4_tcp1 or s == query6_tcp1 or \
+           s == query4_tcp2 or s == query6_tcp2:
+            try:
+                (cs, _) = s.accept()
+                if s == query4_tcp1 or s == query6_tcp1:
+                    print ("TCP Query received on %s" %
+                           (ip4_addr1 if s == query4_tcp1 else ip6_addr1), end=" ")
+                if s == query4_tcp2 or s == query6_tcp2:
+                    print ("TCP Query received on %s" %
+                           (ip4_addr2 if s == query4_tcp2 else ip6_addr2), end=" ")
+                    ns10 = True
+                # get TCP message length
+                buf = cs.recv(2)
+                length = struct.unpack('>H', buf[:2])[0]
+                # grep DNS message
+                msg = cs.recv(length)
+                rsp = create_response(msg, True, True, ns10)
+                print(dns.rcode.to_text(rsp.rcode()))
+                wire = rsp.to_wire()
+                cs.send(struct.pack('>H', len(wire)))
+                cs.send(wire)
+                cs.close()
+            except s.timeout:
+                pass
+    if not running:
+        break
@@ -9,9 +9,12 @@

 rm -f ns*/named.conf
 rm -f dig.out.*
+rm -f named.run.*
 rm -f rndc.out.*
 rm -f ns1/named_dump.db*
 rm -f ns*/named.memstats
 rm -f ns*/named.run
 rm -f ns*/named.lock
 rm -f ns*/managed-keys.bind*
+rm -f ns*/named.run.prev
+rm -f ans*/ans.run ans*/ans.log
@@ -14,6 +14,15 @@ key rndc_key {
 	algorithm hmac-sha256;
 };

+key foo {
+	secret "aaaaaaaaaaaa";
+	algorithm hmac-sha256;
+};
+
+server 10.53.0.10 {
+	keys foo;
+};
+
 controls {
 	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
@@ -20,3 +20,7 @@ large.xxx TXT	( large large large large large large large large
 		  large large large large large large large large
 		  large large large large large large large large
 		  large large large large large large large large )
+tld.	NS	ns.tld.
+ns.tld	A	10.53.0.9
+tsig.	NS	ns.tsig.
+ns.tsig	A	10.53.0.10
@@ -302,5 +302,211 @@ grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo_i "check that test server is correctly configured ($n)"
+ret=0
+pat="; COOKIE: ................................ (good)"
+#UDP
+$DIG $DIGOPTS @10.53.0.9 +notcp tld > dig.out.test$n.1
+grep "status: NOERROR" dig.out.test$n.1 > /dev/null || ret=1
+grep "$pat" dig.out.test$n.1 > /dev/null || ret=1
+grep 'A.10\.53\.0\.9' dig.out.test$n.1 > /dev/null || ret=1
+grep 'A.10\.53\.0\.10' dig.out.test$n.1 > /dev/null && ret=1
+grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.1 > /dev/null && ret=1
+
+$DIG $DIGOPTS @10.53.0.9 +notcp tcponly.tld > dig.out.test$n.2
+grep "status: NOERROR" dig.out.test$n.2 > /dev/null || ret=1
+grep "; COOKIE:" dig.out.test$n.2 > /dev/null && ret=1
+grep 'A.10\.53\.0\.9' dig.out.test$n.2 > /dev/null || ret=1
+grep 'A.10\.53\.0\.10' dig.out.test$n.2 > /dev/null  || ret=1
+grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.1 > /dev/null && ret=1
+
+$DIG $DIGOPTS @10.53.0.9 +notcp nocookie.tld > dig.out.test$n.3
+grep "status: NOERROR" dig.out.test$n.3 > /dev/null || ret=1
+grep "; COOKIE:" dig.out.test$n.3 > /dev/null && ret=1
+grep 'A.10\.53\.0\.9' dig.out.test$n.3 > /dev/null || ret=1
+grep 'A.10\.53\.0\.10' dig.out.test$n.3 > /dev/null  || ret=1
+grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.1 > /dev/null && ret=1
+
+$DIG $DIGOPTS @10.53.0.9 +notcp withtsig.tld > dig.out.test$n.4
+grep "status: NOERROR" dig.out.test$n.4 > /dev/null || ret=1
+grep "; COOKIE:" dig.out.test$n.4 > /dev/null && ret=1
+grep 'A.10\.53\.0\.9' dig.out.test$n.4 > /dev/null || ret=1
+grep 'A.10\.53\.0\.10' dig.out.test$n.4 > /dev/null || ret=1
+grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.4 > /dev/null || ret=1
+
+#TCP
+$DIG $DIGOPTS @10.53.0.9 +tcp tld > dig.out.test$n.5
+grep "status: NOERROR" dig.out.test$n.5 > /dev/null || ret=1
+grep "$pat" dig.out.test$n.5 > /dev/null || ret=1
+grep 'A.10\.53\.0\.9' dig.out.test$n.5 > /dev/null || ret=1
+grep 'A.10\.53\.0\.10' dig.out.test$n.5 > /dev/null && ret=1
+grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.1 > /dev/null && ret=1
+
+$DIG $DIGOPTS @10.53.0.9 +tcp tcponly.tld > dig.out.test$n.6
+grep "status: NOERROR" dig.out.test$n.6 > /dev/null || ret=1
+grep "$pat" dig.out.test$n.6 > /dev/null || ret=1
+grep 'A.10\.53\.0\.9' dig.out.test$n.6 > /dev/null || ret=1
+grep 'A.10\.53\.0\.10' dig.out.test$n.6 > /dev/null && ret=1
+grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.1 > /dev/null && ret=1
+
+$DIG $DIGOPTS @10.53.0.9 +tcp nocookie.tld > dig.out.test$n.7
+grep "status: NOERROR" dig.out.test$n.7 > /dev/null || ret=1
+grep "; COOKIE:" dig.out.test$n.7 > /dev/null && ret=1
+grep 'A.10\.53\.0\.9' dig.out.test$n.7 > /dev/null || ret=1
+grep 'A.10\.53\.0\.10' dig.out.test$n.7 > /dev/null && ret=1
+grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.1 > /dev/null && ret=1
+
+$DIG $DIGOPTS @10.53.0.9 +tcp withtsig.tld > dig.out.test$n.8
+grep "status: NOERROR" dig.out.test$n.8 > /dev/null || ret=1
+grep "$pat" dig.out.test$n.8 > /dev/null || ret=1
+grep 'A.10\.53\.0\.9' dig.out.test$n.8 > /dev/null || ret=1
+grep 'A.10\.53\.0\.10' dig.out.test$n.8 > /dev/null && ret=1
+grep ";; TSIG PSEUDOSECTION:" dig.out.test$n.8 > /dev/null && ret=1
+
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "check that spoofed response is dropped when we have a server cookie ($n)"
+ret=0
+msg="missing expected cookie from"
+pat='10\.53\.0\.9 .*\[cookie=................................\] \[ttl'
+# prime EDNS COOKIE state
+$DIG $DIGOPTS @10.53.0.1 tld > dig.out.test$n.1
+grep "status: NOERROR" dig.out.test$n.1 > /dev/null || ret=1
+rndc_dumpdb ns1
+grep "$pat" ns1/named_dump.db.test$n > /dev/null || ret=1
+# spoofed response contains 10.53.0.10
+nextpart ns1/named.run >/dev/null
+$DIG $DIGOPTS @10.53.0.1 tcponly.tld > dig.out.test$n.2
+wait_for_log 5 "$msg" ns1/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n.2 > /dev/null || ret=1
+grep 'A.10\.53\.0\.9' dig.out.test$n.2 > /dev/null || ret=1
+grep 'A.10\.53\.0\.10' dig.out.test$n.2 > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "check that gracefully handle server disabling DNS COOKIE we have a server cookie ($n)"
+ret=0
+msg="missing expected cookie from"
+pat='10\.53\.0\.9 .*\[cookie=................................\] \[ttl'
+# prime EDNS COOKIE state
+$DIG $DIGOPTS @10.53.0.1 tld > dig.out.test$n.1
+grep "status: NOERROR" dig.out.test$n.1 > /dev/null || ret=1
+rndc_dumpdb ns1
+grep "$pat" ns1/named_dump.db.test$n > /dev/null || ret=1
+# check the disabled server response
+nextpart ns1/named.run >/dev/null
+$DIG $DIGOPTS @10.53.0.1 nocookie.tld > dig.out.test$n.2
+wait_for_log 5 "$msg" ns1/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n.2 > /dev/null || ret=1
+grep 'A.10\.53\.0\.9' dig.out.test$n.2 > /dev/null || ret=1
+grep 'A.10\.53\.0\.10' dig.out.test$n.2 > /dev/null && ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+n=`expr $n + 1`
+echo_i "check that spoofed response with a TSIG is dropped when we have a server cookie ($n)"
+ret=0
+pat='10\.53\.0\.9 .*\[cookie=................................\] \[ttl'
+# prime EDNS COOKIE state
+$DIG $DIGOPTS @10.53.0.1 tld > dig.out.test$n.1
+grep "status: NOERROR" dig.out.test$n.1 > /dev/null || ret=1
+rndc_dumpdb ns1
+grep "$pat" ns1/named_dump.db.test$n > /dev/null || ret=1
+# spoofed response contains 10.53.0.10
+nextpart ns1/named.run >/dev/null
+$DIG $DIGOPTS @10.53.0.1 withtsig.tld > dig.out.test$n.2
+grep "status: NOERROR" dig.out.test$n.2 > /dev/null || ret=1
+grep 'A.10\.53\.0\.9' dig.out.test$n.2 > /dev/null || ret=1
+grep 'A.10\.53\.0\.10' dig.out.test$n.2 > /dev/null && ret=1
+nextpart ns1/named.run > named.run.test$n
+count=$(grep -c ') [0-9][0-9]* NOERROR 0' named.run.test$n)
+test $count -eq 1 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+if $PYTHON -c '
+import dns.version, sys;
+if dns.version.MAJOR > 1: sys.exit(0);
+if dns.version.MAJOR == 1 and dns.version.MINOR >= 16: sys.exit(0);
+sys.exit(1)'
+then
+  n=`expr $n + 1`
+  echo_i "check that TSIG test server is correctly configured ($n)"
+  ret=0
+  pat="; COOKIE: ................................ (good)"
+  key=hmac-sha256:foo:aaaaaaaaaaaa
+  #UDP
+  $DIG $DIGOPTS @10.53.0.10 -y $key +notcp tsig. > dig.out.test$n.1
+  grep "status: NOERROR" dig.out.test$n.1 > /dev/null || ret=1
+  grep "$pat" dig.out.test$n.1 > /dev/null || ret=1
+  grep 'A.10\.53\.0\.9' dig.out.test$n.1 > /dev/null || ret=1
+  grep 'A.10\.53\.0\.10' dig.out.test$n.1 > /dev/null && ret=1
+  grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
+
+  $DIG $DIGOPTS @10.53.0.10 -y $key +notcp tcponly.tsig > dig.out.test$n.2
+  grep "status: NOERROR" dig.out.test$n.2 > /dev/null || ret=1
+  grep "; COOKIE:" dig.out.test$n.2 > /dev/null && ret=1
+  grep 'A.10\.53\.0\.9' dig.out.test$n.2 > /dev/null || ret=1
+  grep 'A.10\.53\.0\.10' dig.out.test$n.2 > /dev/null  || ret=1
+  grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
+
+  $DIG $DIGOPTS @10.53.0.10 -y $key +notcp nocookie.tsig > dig.out.test$n.3
+  grep "status: NOERROR" dig.out.test$n.3 > /dev/null || ret=1
+  grep "; COOKIE:" dig.out.test$n.3 > /dev/null && ret=1
+  grep 'A.10\.53\.0\.9' dig.out.test$n.3 > /dev/null || ret=1
+  grep 'A.10\.53\.0\.10' dig.out.test$n.3 > /dev/null  || ret=1
+  grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
+
+  #TCP
+  $DIG $DIGOPTS @10.53.0.10 -y $key +tcp tsig. > dig.out.test$n.5
+  grep "status: NOERROR" dig.out.test$n.5 > /dev/null || ret=1
+  grep "$pat" dig.out.test$n.5 > /dev/null || ret=1
+  grep 'A.10\.53\.0\.9' dig.out.test$n.5 > /dev/null || ret=1
+  grep 'A.10\.53\.0\.10' dig.out.test$n.5 > /dev/null && ret=1
+  grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
+
+  $DIG $DIGOPTS @10.53.0.10 -y $key +tcp tcponly.tsig > dig.out.test$n.6
+  grep "status: NOERROR" dig.out.test$n.6 > /dev/null || ret=1
+  grep "$pat" dig.out.test$n.6 > /dev/null || ret=1
+  grep 'A.10\.53\.0\.9' dig.out.test$n.6 > /dev/null || ret=1
+  grep 'A.10\.53\.0\.10' dig.out.test$n.6 > /dev/null && ret=1
+  grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
+
+  $DIG $DIGOPTS @10.53.0.10 -y $key +tcp nocookie.tsig > dig.out.test$n.7
+  grep "status: NOERROR" dig.out.test$n.7 > /dev/null || ret=1
+  grep "; COOKIE:" dig.out.test$n.7 > /dev/null && ret=1
+  grep 'A.10\.53\.0\.9' dig.out.test$n.7 > /dev/null || ret=1
+  grep 'A.10\.53\.0\.10' dig.out.test$n.7 > /dev/null && ret=1
+  grep 'TSIG.*NOERROR' dig.out.test$n.1 > /dev/null || ret=1
+
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=`expr $status + $ret`
+
+  n=`expr $n + 1`
+  echo_i "check that missing COOKIE with a valid TSIG signed response does not trigger TCP fallback ($n)"
+  ret=0
+  pat='10\.53\.0\.10 .*\[cookie=................................\] \[ttl'
+  # prime EDNS COOKIE state
+  $DIG $DIGOPTS @10.53.0.1 tsig. > dig.out.test$n.1
+  grep "status: NOERROR" dig.out.test$n.1 > /dev/null || ret=1
+  rndc_dumpdb ns1
+  grep "$pat" ns1/named_dump.db.test$n > /dev/null || ret=1
+  # check the disabled server response
+  nextpart ns1/named.run >/dev/null
+  $DIG $DIGOPTS @10.53.0.1 nocookie.tsig > dig.out.test$n.2
+  grep "status: NOERROR" dig.out.test$n.2 > /dev/null || ret=1
+  grep 'A.10\.53\.0\.9' dig.out.test$n.2 > /dev/null || ret=1
+  grep 'A.10\.53\.0\.10' dig.out.test$n.2 > /dev/null || ret=1
+  nextpart ns1/named.run > named.run.test$n
+  count=$(grep -c ') [0-9][0-9]* NOERROR 0' named.run.test$n)
+  test $count -eq 2 || ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=`expr $status + $ret`
+fi
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -0,0 +1,15 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+rm -f ps.out
+rm -f ns1/named.conf ns1/managed-keys.* ns1/named.run ns1/named.memstats
@@ -10,5 +10,9 @@
 */

 options {
-	geoip-use-ecs yes;
+	query-source address 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
 };
@@ -0,0 +1,35 @@
+#!/bin/sh -e
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+case $(uname) in
+	Linux*)
+		;;
+	*)
+		echo_i "cpu test only runs on Linux"
+		exit 255
+		;;
+esac
+
+# TASKSET will be an empty string if no taskset program was found.
+TASKSET=$(command -v "taskset" || true)
+if ! test -x "$TASKSET" ; then
+	exit 255
+fi
+
+if ! $TASKSET fff0 true > /dev/null 2>&1; then
+        echo_i "taskset failed"
+        exit 255
+fi
@@ -0,0 +1,19 @@
+#!/bin/sh -e
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+$SHELL clean.sh
+
+copy_setports ns1/named.conf.in ns1/named.conf
@@ -0,0 +1,46 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+status=0
+n=0
+
+n=$((n+1))
+echo_i "stop server ($n)"
+ret=0
+$PERL ../stop.pl cpu ns1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "start server with taskset ($n)"
+ret=0
+start_server --noclean --taskset fff0 --restart --port "${PORT}" cpu ns1 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check ps output ($n)"
+ret=0
+ps -T -o pid,psr,time,comm -e > ps.out
+pid=$(cat ns1/named.pid)
+echo_i "pid=$pid"
+psr=$(awk -v pid="$pid" '$1 == pid && $4 == "isc-net-0000" {print $2}' < ps.out)
+echo_i "psr=$psr"
+# The next available cpu relative to the existing affinity mask is 4.
+test "$psr" -eq 4 || ret=1
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1
@@ -0,0 +1,4 @@
+ipv4only.arpa.		3600	IN	SOA	. . 2018112766 7200 3600 604800 3600
+ipv4only.arpa.		3600	IN	NS	.
+ipv4only.arpa.		3600	IN	A	192.0.0.170
+ipv4only.arpa.		3600	IN	A	192.0.0.171
@@ -11,6 +11,12 @@

 // NS1

+include "../../common/rndc.key";
+
+controls {
+        inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
 acl rfc1918 { 10/8; 192.168/16; 172.16/12; };

 options {
@@ -49,4 +55,7 @@ zone "signed" {
 	file "signed.db.signed";
 };

-// include "trusted.conf";
+zone "ipv4only.arpa" {
+	type master;
+	file "ipv4only.arpa.db";
+};
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS1
+
+include "../../common/rndc.key";
+
+controls {
+        inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	allow-recursion { 10.53.0.1; };
+	notify yes;
+	dnssec-validation yes;
+
+	dns64 2001:bbbb::/96 {
+		clients { any; };
+		mapped { !rfc1918; any; };
+		exclude { 2001:eeee::/32; 64:FF9B::/96; ::ffff:0000:0000/96; };
+		suffix ::;
+		recursive-only yes;
+	};
+	dns64 2001:aaaa::/64 {
+		mapped { !rfc1918; any; };
+	};
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
+};
+
+zone "signed" {
+	type primary;
+	file "signed.db.signed";
+};
+
+zone "ipv4only.arpa" {
+	type master;
+	file "ipv4only.arpa.db";
+};
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS1
+
+include "../../common/rndc.key";
+
+controls {
+        inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	allow-recursion { 10.53.0.1; };
+	notify yes;
+	dnssec-validation yes;
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
+};
+
+zone "signed" {
+	type primary;
+	file "signed.db.signed";
+};
+
+zone "ipv4only.arpa" {
+	type master;
+	file "ipv4only.arpa.db";
+};
@@ -11,7 +11,7 @@

 . ../conf.sh

-copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns1/named.conf1.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf

 cd ns1 && $SHELL sign.sh
@@ -1399,5 +1399,54 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+echo_i "checking 'dig +dns64prefix' ($n)"
+$DIG $DIGOPTS +dns64prefix @10.53.0.1 > dig.out.ns1.test$n || ret=1
+grep '^2001:bbbb::/96$' dig.out.ns1.test$n > /dev/null || ret=1
+test $(wc -l < dig.out.ns1.test$n) -eq 1 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+copy_setports ns1/named.conf2.in ns1/named.conf
+rndc_reload ns1 10.53.0.1
+
+echo_i "checking 'dig +dns64prefix' with multiple prefixes ($n)"
+$DIG $DIGOPTS +dns64prefix @10.53.0.1 > dig.out.ns1.test$n || ret=1
+grep '^2001:bbbb::/96$' dig.out.ns1.test$n > /dev/null || ret=1
+grep '2001:aaaa::/64' dig.out.ns1.test$n > /dev/null || ret=1
+test $(wc -l < dig.out.ns1.test$n) -eq 2 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+copy_setports ns1/named.conf3.in ns1/named.conf
+rndc_reload ns1 10.53.0.1
+
+echo_i "checking 'dig +dns64prefix' with no prefixes ($n)"
+$DIG $DIGOPTS +dns64prefix @10.53.0.1 > dig.out.ns1.test$n || ret=1
+test $(wc -l < dig.out.ns1.test$n) -eq 0 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking synthesis of AAAA from builtin ipv4only.arpa ($n)"
+ret=0
+$DIG $DIGOPTS aaaa ipv4only.arpa -b 10.53.0.7 @10.53.0.2 > dig.out.ns2.test$n || ret=1
+grep -i 'ipv4only.arpa.*IN.AAAA.2001:96::c000:aa' dig.out.ns2.test$n >/dev/null || ret=1
+grep -i 'ipv4only.arpa.*IN.AAAA.2001:96::c000:ab' dig.out.ns2.test$n >/dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking reverse of dns64 mapped ipv4only.arpa addresses returns ipv4only.arpa ($n)"
+ret=0
+$DIG $DIGOPTS ptr -x 2001:96::192.0.0.170 -b 10.53.0.7 @10.53.0.2 > dig.out.170.ns2.test$n || ret=1
+$DIG $DIGOPTS ptr -x 2001:96::192.0.0.171 -b 10.53.0.7 @10.53.0.2 > dig.out.171.ns2.test$n || ret=1
+grep "ip6\.arpa\..*PTR.*ipv4only\.arpa\." dig.out.170.ns2.test$n >/dev/null || ret=1
+grep "ip6\.arpa\..*PTR.*ipv4only\.arpa\." dig.out.171.ns2.test$n >/dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -82,6 +82,8 @@ done

 echo "export PORT=$(get_port "$baseport")"
 echo "export TLSPORT=$(get_port)"
+echo "export HTTPPORT=$(get_port)"
+echo "export HTTPSPORT=$(get_port)"
 echo "export EXTRAPORT1=$(get_port)"
 echo "export EXTRAPORT2=$(get_port)"
 echo "export EXTRAPORT3=$(get_port)"
@@ -0,0 +1,14 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+rm -f */named.run
+rm -f */named.conf
+rm -f */named.memstats
@@ -0,0 +1,13 @@
+include $(top_srcdir)/Makefile.top
+
+AM_CPPFLAGS +=			\
+	$(LIBISC_CFLAGS)	\
+	$(LIBDNS_CFLAGS)	\
+	$(LIBNS_CFLAGS)		\
+	$(LIBISCCFG_CFLAGS)
+
+hooks_LTLIBRARIES = test-async.la
+hooksdir = $(abs_builddir)
+
+test_async_la_SOURCES = test-async.c
+test_async_la_LDFLAGS = -avoid-version -module -shared -export-dynamic
@@ -0,0 +1,364 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+/* aliases for the exported symbols */
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <string.h>
+
+#include <isc/buffer.h>
+#include <isc/hash.h>
+#include <isc/ht.h>
+#include <isc/lib.h>
+#include <isc/log.h>
+#include <isc/mem.h>
+#include <isc/netaddr.h>
+#include <isc/result.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#include <dns/result.h>
+
+#include <ns/client.h>
+#include <ns/events.h>
+#include <ns/hooks.h>
+#include <ns/log.h>
+#include <ns/query.h>
+#include <ns/types.h>
+
+#define CHECK(op)                              \
+	do {                                   \
+		result = (op);                 \
+		if (result != ISC_R_SUCCESS) { \
+			goto cleanup;          \
+		}                              \
+	} while (0)
+
+/*
+ * Persistent data for use by this module. This will be associated
+ * with client object address in the hash table, and will remain
+ * accessible until the client object is detached.
+ */
+typedef struct async_instance {
+	ns_plugin_t *module;
+	isc_mem_t *mctx;
+	isc_mempool_t *datapool;
+	isc_ht_t *ht;
+	isc_mutex_t hlock;
+	isc_log_t *lctx;
+} async_instance_t;
+
+typedef struct state {
+	bool async;
+	ns_hook_resevent_t *rev;
+	ns_hookpoint_t hookpoint;
+	isc_result_t origresult;
+} state_t;
+
+/*
+ * Forward declarations of functions referenced in install_hooks().
+ */
+static ns_hookresult_t
+async_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+async_query_done_begin(void *arg, void *cbdata, isc_result_t *resp);
+static ns_hookresult_t
+async_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp);
+
+/*%
+ * Register the functions to be called at each hook point in 'hooktable', using
+ * memory context 'mctx' for allocating copies of stack-allocated structures
+ * passed to ns_hook_add().  Make sure 'inst' will be passed as the 'cbdata'
+ * argument to every callback.
+ */
+static void
+install_hooks(ns_hooktable_t *hooktable, isc_mem_t *mctx,
+	      async_instance_t *inst) {
+	const ns_hook_t async_init = {
+		.action = async_qctx_initialize,
+		.action_data = inst,
+	};
+	const ns_hook_t async_donebegin = {
+		.action = async_query_done_begin,
+		.action_data = inst,
+	};
+	const ns_hook_t async_destroy = {
+		.action = async_qctx_destroy,
+		.action_data = inst,
+	};
+
+	ns_hook_add(hooktable, mctx, NS_QUERY_QCTX_INITIALIZED, &async_init);
+	ns_hook_add(hooktable, mctx, NS_QUERY_DONE_BEGIN, &async_donebegin);
+	ns_hook_add(hooktable, mctx, NS_QUERY_QCTX_DESTROYED, &async_destroy);
+}
+
+static void
+logmsg(const char *fmt, ...) {
+	va_list ap;
+
+	va_start(ap, fmt);
+	isc_log_write(ns_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
+		      ISC_LOG_INFO, fmt, ap);
+	va_end(ap);
+}
+
+/**
+** Mandatory plugin API functions:
+**
+** - plugin_destroy
+** - plugin_register
+** - plugin_version
+** - plugin_check
+**/
+
+/*
+ * Called by ns_plugin_register() to initialize the plugin and
+ * register hook functions into the view hook table.
+ */
+isc_result_t
+plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
+		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
+		void *actx, ns_hooktable_t *hooktable, void **instp) {
+	async_instance_t *inst = NULL;
+	isc_result_t result;
+
+	UNUSED(parameters);
+	UNUSED(cfg);
+	UNUSED(actx);
+
+	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
+		      ISC_LOG_INFO,
+		      "registering 'test-async' module from %s:%lu", cfg_file,
+		      cfg_line);
+
+	inst = isc_mem_get(mctx, sizeof(*inst));
+	*inst = (async_instance_t){ .mctx = NULL };
+	isc_mem_attach(mctx, &inst->mctx);
+
+	isc_mempool_create(mctx, sizeof(state_t), &inst->datapool);
+	CHECK(isc_ht_init(&inst->ht, mctx, 16));
+	isc_mutex_init(&inst->hlock);
+
+	/*
+	 * Set hook points in the view's hooktable.
+	 */
+	install_hooks(hooktable, mctx, inst);
+
+	*instp = inst;
+
+	return (ISC_R_SUCCESS);
+
+cleanup:
+	if (result != ISC_R_SUCCESS && inst != NULL) {
+		plugin_destroy((void **)&inst);
+	}
+
+	return (result);
+}
+
+isc_result_t
+plugin_check(const char *parameters, const void *cfg, const char *cfg_file,
+	     unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
+	     void *actx) {
+	UNUSED(parameters);
+	UNUSED(cfg);
+	UNUSED(cfg_file);
+	UNUSED(cfg_line);
+	UNUSED(mctx);
+	UNUSED(lctx);
+	UNUSED(actx);
+
+	return (ISC_R_SUCCESS);
+}
+
+/*
+ * Called by ns_plugins_free(); frees memory allocated by
+ * the module when it was registered.
+ */
+void
+plugin_destroy(void **instp) {
+	async_instance_t *inst = (async_instance_t *)*instp;
+
+	if (inst->ht != NULL) {
+		isc_ht_destroy(&inst->ht);
+		isc_mutex_destroy(&inst->hlock);
+	}
+	if (inst->datapool != NULL) {
+		isc_mempool_destroy(&inst->datapool);
+	}
+
+	isc_mem_putanddetach(&inst->mctx, inst, sizeof(*inst));
+	*instp = NULL;
+
+	return;
+}
+
+/*
+ * Returns plugin API version for compatibility checks.
+ */
+int
+plugin_version(void) {
+	return (NS_PLUGIN_VERSION);
+}
+
+static state_t *
+client_state_get(const query_ctx_t *qctx, async_instance_t *inst) {
+	state_t *state = NULL;
+	isc_result_t result;
+
+	LOCK(&inst->hlock);
+	result = isc_ht_find(inst->ht, (const unsigned char *)&qctx->client,
+			     sizeof(qctx->client), (void **)&state);
+	UNLOCK(&inst->hlock);
+
+	return (result == ISC_R_SUCCESS ? state : NULL);
+}
+
+static void
+client_state_create(const query_ctx_t *qctx, async_instance_t *inst) {
+	state_t *state = NULL;
+	isc_result_t result;
+
+	state = isc_mempool_get(inst->datapool);
+	if (state == NULL) {
+		return;
+	}
+
+	LOCK(&inst->hlock);
+	result = isc_ht_add(inst->ht, (const unsigned char *)&qctx->client,
+			    sizeof(qctx->client), state);
+	UNLOCK(&inst->hlock);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+}
+
+static void
+client_state_destroy(const query_ctx_t *qctx, async_instance_t *inst) {
+	state_t *state = client_state_get(qctx, inst);
+	isc_result_t result;
+
+	if (state == NULL) {
+		return;
+	}
+
+	LOCK(&inst->hlock);
+	result = isc_ht_delete(inst->ht, (const unsigned char *)&qctx->client,
+			       sizeof(qctx->client));
+	UNLOCK(&inst->hlock);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+	isc_mempool_put(inst->datapool, state);
+}
+
+static ns_hookresult_t
+async_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *)arg;
+	async_instance_t *inst = (async_instance_t *)cbdata;
+	state_t *state = NULL;
+
+	logmsg("qctx init hook");
+	*resp = ISC_R_UNSET;
+
+	state = client_state_get(qctx, inst);
+	if (state == NULL) {
+		client_state_create(qctx, inst);
+	}
+
+	return (NS_HOOK_CONTINUE);
+}
+
+static void
+cancelasync(ns_hookasync_t *hctx) {
+	UNUSED(hctx);
+	logmsg("cancelasync");
+}
+
+static void
+destroyasync(ns_hookasync_t **ctxp) {
+	ns_hookasync_t *ctx = *ctxp;
+
+	logmsg("destroyasync");
+	*ctxp = NULL;
+	isc_mem_putanddetach(&ctx->mctx, ctx, sizeof(*ctx));
+}
+
+static isc_result_t
+doasync(query_ctx_t *qctx, isc_mem_t *mctx, void *arg, isc_task_t *task,
+	isc_taskaction_t action, void *evarg, ns_hookasync_t **ctxp) {
+	ns_hook_resevent_t *rev = (ns_hook_resevent_t *)isc_event_allocate(
+		mctx, task, NS_EVENT_HOOKASYNCDONE, action, evarg,
+		sizeof(*rev));
+	ns_hookasync_t *ctx = isc_mem_get(mctx, sizeof(*ctx));
+	state_t *state = (state_t *)arg;
+
+	logmsg("doasync");
+	*ctx = (ns_hookasync_t){ .mctx = NULL };
+	isc_mem_attach(mctx, &ctx->mctx);
+	ctx->cancel = cancelasync;
+	ctx->destroy = destroyasync;
+
+	rev->hookpoint = state->hookpoint;
+	rev->origresult = state->origresult;
+	qctx->result = DNS_R_NOTIMP;
+	rev->saved_qctx = qctx;
+	rev->ctx = ctx;
+
+	state->rev = rev;
+
+	isc_task_send(task, (isc_event_t **)&rev);
+
+	*ctxp = ctx;
+	return (ISC_R_SUCCESS);
+}
+
+static ns_hookresult_t
+async_query_done_begin(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *)arg;
+	async_instance_t *inst = (async_instance_t *)cbdata;
+	state_t *state = client_state_get(qctx, inst);
+
+	UNUSED(qctx);
+	UNUSED(cbdata);
+	UNUSED(state);
+
+	logmsg("done begin hook");
+	if (state->async) {
+		/* resuming */
+		state->async = false;
+		return (NS_HOOK_CONTINUE);
+	}
+
+	/* initial call */
+	state->async = true;
+	state->hookpoint = NS_QUERY_DONE_BEGIN;
+	state->origresult = *resp;
+	ns_query_hookasync(qctx, doasync, state);
+	return (NS_HOOK_RETURN);
+}
+
+static ns_hookresult_t
+async_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
+	query_ctx_t *qctx = (query_ctx_t *)arg;
+	async_instance_t *inst = (async_instance_t *)cbdata;
+
+	logmsg("qctx destroy hook");
+	*resp = ISC_R_UNSET;
+
+	if (!qctx->detach_client) {
+		return (NS_HOOK_CONTINUE);
+	}
+
+	client_state_destroy(qctx, inst);
+
+	return (NS_HOOK_CONTINUE);
+}
@@ -0,0 +1,19 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL	120
+@		SOA	ns.unsigned.  hostmaster.ns.unsigned. ( 1 3600 1200 604800 60 )
+@		NS	ns
+@               MX      10 mx
+
+ns		A	10.53.0.1
+		AAAA	fd92:7065:b8e:ffff::1
+
+a		A	1.1.1.1
+mx		A	2.2.2.2
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	recursion no;
+	dnssec-validation yes;
+	notify yes;
+	minimal-responses no;
+};
+
+plugin query "../driver/.libs/test-async.so";
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "example.com" {
+	type primary;
+	file "example.db";
+};
@@ -0,0 +1,14 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+copy_setports ns1/named.conf.in ns1/named.conf
@@ -0,0 +1,34 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+status=0
+n=0
+
+rm -f dig.out.*
+
+DIGOPTS="+tcp +noadd +nosea +nostat +nocmd -p ${PORT}"
+RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+
+n=$((n+1))
+echo_i "checking asynchronous hook action resumes correctly ($n)"
+ret=0
+$DIG $DIGOPTS example.com @10.53.0.1 > dig.out.ns1.test$n || ret=1
+# the test-async plugin changes the status of any postiive answer to NOTIMP
+grep -q "status: NOTIMP" dig.out.ns1.test$n || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1
@@ -64,6 +64,20 @@ zone "migrate-nomatch-alglen.kasp" {
 	update-check-ksk yes;
 };

+/* These zones are going insecure. */
+zone "step1.going-insecure.kasp" {
+	type master;
+	file "step1.going-insecure.kasp.db";
+	dnssec-policy "migrate";
+};
+
+zone "step1.going-insecure-dynamic.kasp" {
+	type master;
+	file "step1.going-insecure-dynamic.kasp.db";
+	dnssec-policy "migrate";
+	allow-update { any; };
+};
+
 /* These are alorithm rollover test zones. */
 zone "step1.algorithm-roll.kasp" {
 	type primary;
@@ -57,6 +57,33 @@ zone "migrate-nomatch-alglen.kasp" {
 	dnssec-policy "migrate-nomatch-alglen";
 };

+/* Zones for testing going insecure. */
+zone "step1.going-insecure.kasp" {
+        type master;
+        file "step1.going-insecure.kasp.db";
+        dnssec-policy "none";
+};
+
+zone "step2.going-insecure.kasp" {
+        type master;
+        file "step2.going-insecure.kasp.db";
+        dnssec-policy "none";
+};
+
+zone "step1.going-insecure-dynamic.kasp" {
+        type master;
+        file "step1.going-insecure-dynamic.kasp.db";
+        dnssec-policy "none";
+	allow-update { any; };
+};
+
+zone "step2.going-insecure-dynamic.kasp" {
+        type master;
+        file "step2.going-insecure-dynamic.kasp.db";
+        dnssec-policy "none";
+	allow-update { any; };
+};
+
 /*
 * Zones for testing KSK/ZSK algorithm roll.
 */
@@ -86,6 +86,46 @@ private_type_record $zone 5 "$KSK" >> "$infile"
 private_type_record $zone 5 "$ZSK" >> "$infile"
 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1

+# The child zones (step1, step2) beneath these zones represent the various
+# steps of unsigning a zone.
+for zn in going-insecure.kasp going-insecure-dynamic.kasp
+do
+	# Step 1:
+	# Set up a zone with dnssec-policy that is going insecure.
+	setup step1.$zn
+	echo "$zone" >> zones
+	T="now-10d"
+	ksktimes="-P $T -A $T -P sync $T"
+	zsktimes="-P $T -A $T"
+	KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
+	ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200        $zsktimes $zone 2> keygen.out.$zone.2)
+	cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
+	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
+	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
+	$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+
+	# Step 2:
+	# Set up a zone with dnssec-policy that is going insecure. Don't add
+	# this zone to the zones file, because this zone is no longer expected
+	# to be fully signed.
+	setup step2.$zn
+	# The DS was withdrawn from the parent zone 26 hours ago.
+	Trem="now-26h"
+	ksktimes="-P $T -A $T -P sync $T"
+	zsktimes="-P $T -A $T"
+	KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
+	ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 7200        $zsktimes $zone 2> keygen.out.$zone.2)
+	$SETTIME -s -g $H -k $O $T -r $O $T -d $U $Trem -D ds $Trem "$KSK" > settime.out.$zone.1 2>&1
+	$SETTIME -s -g $H -k $O $T -z $O $T                         "$ZSK" > settime.out.$zone.2 2>&1
+	# Fake lifetime of old algorithm keys.
+	echo "Lifetime: 0" >> "${KSK}.state"
+	echo "Lifetime: 5184000" >> "${ZSK}.state"
+	cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
+	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK" >> "$infile"
+	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK" >> "$infile"
+	$SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
+done
+
 #
 # The zones at algorithm-roll.kasp represent the various steps of a ZSK/KSK
 # algorithm rollover.
@@ -172,12 +172,26 @@ set_server() {
 # Set zone name for testing keys.
 set_zone() {
 	ZONE=$1
+	DYNAMIC="no"
 }
+# By default zones are considered static.
+# When testing dynamic zones, call 'set_dynamic' after 'set_zone'.
+set_dynamic() {
+	DYNAMIC="yes"
+}
+
 # Set policy settings (name $1, number of keys $2, dnskey ttl $3) for testing keys.
 set_policy() {
 	POLICY=$1
 	NUM_KEYS=$2
 	DNSKEY_TTL=$3
+	CDS_DELETE="no"
+}
+# By default policies are considered to be secure.
+# If a zone sets its policy to "none", call 'set_cdsdelete' to tell the system
+# test to expect a CDS and CDNSKEY Delete record.
+set_cdsdelete() {
+	CDS_DELETE="yes"
 }

 # Set key properties for testing keys.
@@ -946,22 +960,18 @@ check_dnssecstatus() {

 	rndccmd $_server dnssec -status $_zone in $_view > rndc.dnssec.status.out.$_zone.$n || log_error "rndc dnssec -status zone ${_zone} failed"

-	if [ "$_policy" = "none" ]; then
-		grep "Zone does not have dnssec-policy" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "bad dnssec status for unsigned zone ${_zone}"
-	else
-		grep "dnssec-policy: ${_policy}" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "bad dnssec status for signed zone ${_zone}"
-		if [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
-			grep "key: $(key_get KEY1 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY1 ID) from dnssec status"
-		fi
-		if [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
-			grep "key: $(key_get KEY2 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY2 ID) from dnssec status"
-		fi
-		if [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
-			grep "key: $(key_get KEY3 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY3 ID) from dnssec status"
-		fi
-		if [ "$(key_get KEY4 EXPECT)" = "yes" ]; then
-			grep "key: $(key_get KEY4 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY4 ID) from dnssec status"
-		fi
+	grep "dnssec-policy: ${_policy}" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "bad dnssec status for signed zone ${_zone}"
+	if [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
+		grep "key: $(key_get KEY1 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY1 ID) from dnssec status"
+	fi
+	if [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
+		grep "key: $(key_get KEY2 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY2 ID) from dnssec status"
+	fi
+	if [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
+		grep "key: $(key_get KEY3 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY3 ID) from dnssec status"
+	fi
+	if [ "$(key_get KEY4 EXPECT)" = "yes" ]; then
+		grep "key: $(key_get KEY4 ID)" rndc.dnssec.status.out.$_zone.$n > /dev/null || log_error "missing key $(key_get KEY4 ID) from dnssec status"
 	fi

 	test "$ret" -eq 0 || echo_i "failed"
@@ -1044,6 +1054,14 @@ check_cds() {
 	dig_with_opts "$ZONE" "@${SERVER}" "CDNSKEY" > "dig.out.$DIR.test$n.cdnskey" || log_error "dig ${ZONE} CDNSKEY failed"
 	grep "status: NOERROR" "dig.out.$DIR.test$n.cdnskey" > /dev/null || log_error "mismatch status in DNS response"

+	if [ "$CDS_DELETE" = "no" ]; then
+		grep "CDS.*0 0 0 00" "dig.out.$DIR.test$n.cds" > /dev/null && log_error "unexpected CDS DELETE record in DNS response"
+		grep "CDNSKEY.*0 3 0 AA==" "dig.out.$DIR.test$n.cdnskey" > /dev/null && log_error "unexpected CDNSKEY DELETE record in DNS response"
+	else
+		grep "CDS.*0 0 0 00" "dig.out.$DIR.test$n.cds" > /dev/null || log_error "missing CDS DELETE record in DNS response"
+		grep "CDNSKEY.*0 3 0 AA==" "dig.out.$DIR.test$n.cdnskey" > /dev/null || log_error "missing CDNSKEY DELETE record in DNS response"
+	fi
+
 	if [ "$(key_get KEY1 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY1 STATE_DS)" = "omnipresent" ]; then
 		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n.cds" || log_error "missing CDS record in response for key $(key_get KEY1 ID)"
 		check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
@@ -1210,7 +1228,13 @@ _loadkeys_on() {

 	nextpart $_dir/named.run > /dev/null
 	rndccmd $_server loadkeys $_zone in $_view > rndc.dnssec.loadkeys.out.$_zone.$n
-	wait_for_log 20 "zone ${_zone}/IN (signed): next key event" $_dir/named.run || return 1
+
+	if [ "${DYNAMIC}" = "yes" ]; then
+		wait_for_log 20 "zone ${_zone}/IN: next key event" $_dir/named.run || return 1
+	else
+		# inline-signing zone adds "(signed)"
+		wait_for_log 20 "zone ${_zone}/IN (signed): next key event" $_dir/named.run || return 1
+	fi
 }

 # Tell named that the DS for the key in given zone has been seen in the
@@ -1228,21 +1252,23 @@ rndc_checkds() {
 	_keycmd=""
 	if [ "${_key}" != "-" ]; then
 		_keyid=$(key_get $_key ID)
-		_keycmd="-key ${_keyid}"
+		_keycmd=" -key ${_keyid}"
 	fi

 	_whencmd=""
 	if [ "${_when}" != "now" ]; then
-		_whencmd="-when ${_when}"
+		_whencmd=" -when ${_when}"
 	fi

 	n=$((n+1))
-	echo_i "calling rndc dnssec -checkds ${_keycmd} ${_whencmd} ${_what} zone ${_zone} ($n)"
+	echo_i "calling rndc dnssec -checkds${_keycmd}${_whencmd} ${_what} zone ${_zone} in ${_view} ($n)"
 	ret=0

-	rndccmd $_server dnssec -checkds $_keycmd $_whencmd $_what $_zone in $_view > rndc.dnssec.checkds.out.$_zone.$n || log_error "rndc dnssec -checkds (${_keycmd} ${_whencmd} ${_what} zone ${_zone} failed"
+	rndccmd $_server dnssec -checkds $_keycmd $_whencmd $_what $_zone in $_view > rndc.dnssec.checkds.out.$_zone.$n || log_error "rndc dnssec -checkds${_keycmd}${_whencmd} ${_what} zone ${_zone} failed"

-	_loadkeys_on $_server $_dir $_zone || log_error "loadkeys zone ${_zone} failed ($n)"
+	if [ "$ret" -eq 0 ]; then
+		 _loadkeys_on $_server $_dir $_zone || log_error "loadkeys zone ${_zone} failed ($n)"
+	fi

 	test "$ret" -eq 0 || echo_i "failed"
 	status=$((status+ret))
@@ -1346,6 +1372,7 @@ status=$((status+ret))
 # Zone: dynamic.kasp
 #
 set_zone "dynamic.kasp"
+set_dynamic
 set_policy "default" "1" "3600"
 set_server "ns3" "10.53.0.3"
 # Key properties, timings and states same as above.
@@ -1378,6 +1405,7 @@ status=$((status+ret))
 # Zone: dynamic-inline-signing.kasp
 #
 set_zone "dynamic-inline-signing.kasp"
+set_dynamic
 set_policy "default" "1" "3600"
 set_server "ns3" "10.53.0.3"
 # Key properties, timings and states same as above.
@@ -2937,7 +2965,12 @@ check_next_key_event() {
 	grep "zone ${ZONE}.*: next key event in .* seconds" "${DIR}/named.run" > "keyevent.out.$ZONE.test$n" || log_error "no next key event for zone ${ZONE}"

 	# Get the latest next key event.
-	_time=$(awk '{print $10}' < "keyevent.out.$ZONE.test$n" | tail -1)
+	if [ "${DYNAMIC}" = "yes" ]; then
+		_time=$(awk '{print $9}' < "keyevent.out.$ZONE.test$n" | tail -1)
+	else
+		# inline-signing zone adds "(signed)"
+		_time=$(awk '{print $10}' < "keyevent.out.$ZONE.test$n" | tail -1)
+	fi

 	# The next key event time must within threshold of the
 	# expected time.
@@ -4452,6 +4485,90 @@ dnssec_verify
 _migratenomatch_alglen_ksk=$(key_get KEY1 ID)
 _migratenomatch_alglen_zsk=$(key_get KEY2 ID)

+#
+# Testing going insecure.
+#
+
+#
+# Zone step1.going-insecure.kasp
+#
+set_zone "step1.going-insecure.kasp"
+set_policy "migrate" "2" "7200"
+set_server "ns6" "10.53.0.6"
+
+# Policy parameters.
+# Lksk:      0
+# Lzsk:      60 days (5184000 seconds)
+# Iret(KSK): DS TTL (1d) + DprpP (1h) + retire-safety (1h)
+# Iret(KSK): 1d2h (93600 seconds)
+# Iret(ZSK): RRSIG TTL (1d) + Dprp (5m) + Dsgn (9d) + retire-safety (1h)
+# Iret(ZSK): 10d1h5m (867900 seconds)
+Lksk=0
+Lzsk=5184000
+IretKSK=93600
+IretZSK=867900
+
+init_migration_insecure() {
+	key_clear        "KEY1"
+	set_keyrole      "KEY1" "ksk"
+	set_keylifetime  "KEY1" "${Lksk}"
+	set_keyalgorithm "KEY1" "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS"
+	set_keysigning   "KEY1" "yes"
+	set_zonesigning  "KEY1" "no"
+
+	set_keystate "KEY1" "GOAL"         "omnipresent"
+	set_keystate "KEY1" "STATE_DNSKEY" "omnipresent"
+	set_keystate "KEY1" "STATE_KRRSIG" "omnipresent"
+	set_keystate "KEY1" "STATE_DS"     "omnipresent"
+
+	key_clear        "KEY2"
+	set_keyrole      "KEY2" "zsk"
+	set_keylifetime  "KEY2" "${Lzsk}"
+	set_keyalgorithm "KEY2" "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS"
+	set_keysigning   "KEY2" "no"
+	set_zonesigning  "KEY2" "yes"
+
+	set_keystate "KEY2" "GOAL"         "omnipresent"
+	set_keystate "KEY2" "STATE_DNSKEY" "omnipresent"
+	set_keystate "KEY2" "STATE_ZRRSIG" "omnipresent"
+
+	key_clear "KEY3"
+	key_clear "KEY4"
+}
+init_migration_insecure
+
+# Various signing policy checks.
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+
+# We have set the timing metadata to now - 10 days (864000 seconds).
+rollover_predecessor_keytimes -864000
+check_keytimes
+check_apex
+check_subdomain
+dnssec_verify
+
+#
+# Zone step1.going-insecure-dynamic.kasp
+#
+
+set_zone "step1.going-insecure-dynamic.kasp"
+set_dynamic
+set_policy "migrate" "2" "7200"
+set_server "ns6" "10.53.0.6"
+init_migration_insecure
+
+# Various signing policy checks.
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+
+# We have set the timing metadata to now - 10 days (864000 seconds).
+rollover_predecessor_keytimes -864000
+check_keytimes
+check_apex
+check_subdomain
+dnssec_verify
+
 # Reconfig dnssec-policy (triggering algorithm roll and other dnssec-policy
 # changes).
 echo_i "reconfig dnssec-policy to trigger algorithm rollover"
@@ -4501,6 +4618,148 @@ wait_for_done_signing() {
 	status=$((status+ret))
 }

+#
+# Testing going insecure.
+#
+
+#
+# Zone: step1.going-insecure.kasp
+#
+set_zone "step1.going-insecure.kasp"
+set_policy "none" "2" "7200"
+set_server "ns6" "10.53.0.6"
+# Expect a CDS/CDNSKEY Delete Record.
+set_cdsdelete
+
+# Key goal states should be HIDDEN.
+init_migration_insecure
+set_keystate "KEY1" "GOAL" "hidden"
+set_keystate "KEY2" "GOAL" "hidden"
+# The DS may be removed if we are going insecure.
+set_keystate "KEY1" "STATE_DS" "unretentive"
+
+# Various signing policy checks.
+check_keys
+wait_for_done_signing
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+
+# Tell named that the DS has been removed.
+rndc_checkds "$SERVER" "$DIR" "KEY1" "now" "withdrawn" "$ZONE"
+wait_for_done_signing
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+
+# Next key event is when the DS becomes HIDDEN. This happens after the
+# parent propagation delay, retire safety delay, and DS TTL:
+# 1h + 1h + 1d = 26h = 93600 seconds.
+check_next_key_event 93600
+
+#
+# Zone: step2.going-insecure.kasp
+#
+set_zone "step2.going-insecure.kasp"
+set_policy "none" "2" "7200"
+set_server "ns6" "10.53.0.6"
+# Expect a CDS/CDNSKEY Delete Record.
+set_cdsdelete
+
+# The DS is long enough removed from the zone to be considered HIDDEN.
+# This means the DNSKEY and the KSK signatures can be removed.
+set_keystate     "KEY1" "STATE_DS"     "hidden"
+set_keystate     "KEY1" "STATE_DNSKEY" "unretentive"
+set_keystate     "KEY1" "STATE_KRRSIG" "unretentive"
+set_keysigning   "KEY1" "no"
+
+set_keystate     "KEY2" "STATE_DNSKEY" "unretentive"
+set_keystate     "KEY2" "STATE_ZRRSIG" "unretentive"
+set_zonesigning  "KEY2" "no"
+
+# Various signing policy checks.
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+
+# Next key event is when the DNSKEY becomes HIDDEN. This happens after the
+# propagation delay, plus DNSKEY TTL:
+# 5m + 2h = 125m =  7500 seconds.
+check_next_key_event 7500
+
+#
+# Zone: step1.going-insecure-dynamic.kasp
+#
+set_zone "step1.going-insecure-dynamic.kasp"
+set_dynamic
+set_policy "none" "2" "7200"
+set_server "ns6" "10.53.0.6"
+# Expect a CDS/CDNSKEY Delete Record.
+set_cdsdelete
+
+# Key goal states should be HIDDEN.
+init_migration_insecure
+set_keystate "KEY1" "GOAL" "hidden"
+set_keystate "KEY2" "GOAL" "hidden"
+# The DS may be removed if we are going insecure.
+set_keystate "KEY1" "STATE_DS" "unretentive"
+
+# Various signing policy checks.
+check_keys
+wait_for_done_signing
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+
+# Tell named that the DS has been removed.
+rndc_checkds "$SERVER" "$DIR" "KEY1" "now" "withdrawn" "$ZONE"
+wait_for_done_signing
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+dnssec_verify
+
+# Next key event is when the DS becomes HIDDEN. This happens after the
+# parent propagation delay, retire safety delay, and DS TTL:
+# 1h + 1h + 1d = 26h = 93600 seconds.
+check_next_key_event 93600
+
+#
+# Zone: step2.going-insecure-dynamic.kasp
+#
+set_zone "step2.going-insecure-dynamic.kasp"
+set_dynamic
+set_policy "none" "2" "7200"
+set_server "ns6" "10.53.0.6"
+# Expect a CDS/CDNSKEY Delete Record.
+set_cdsdelete
+
+# The DS is long enough removed from the zone to be considered HIDDEN.
+# This means the DNSKEY and the KSK signatures can be removed.
+set_keystate     "KEY1" "STATE_DS"     "hidden"
+set_keystate     "KEY1" "STATE_DNSKEY" "unretentive"
+set_keystate     "KEY1" "STATE_KRRSIG" "unretentive"
+set_keysigning   "KEY1" "no"
+
+set_keystate     "KEY2" "STATE_DNSKEY" "unretentive"
+set_keystate     "KEY2" "STATE_ZRRSIG" "unretentive"
+set_zonesigning  "KEY2" "no"
+
+# Various signing policy checks.
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+
+# Next key event is when the DNSKEY becomes HIDDEN. This happens after the
+# propagation delay, plus DNSKEY TTL:
+# 5m + 2h = 125m =  7500 seconds.
+check_next_key_event 7500
+
 #
 # Testing migration.
 #
@@ -27,7 +27,6 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
-	acache-enable yes;
 	send-cookie yes;
 	tcp-advertised-timeout 150;
 };
@@ -462,7 +462,9 @@ grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

-echo_i "reset the root server"
+n=$((n+1))
+echo_i "reset the root server ($n)"
+ret=0
 $SETTIME -D none -R none -K ns1 "$original" > /dev/null
 $SETTIME -D now -K ns1 "$standby1" > /dev/null
 $SETTIME -D now -K ns1 "$standby2" > /dev/null
@@ -470,6 +472,9 @@ $SIGNER -Sg -K ns1 -N unixtime -o . ns1/root.db > /dev/null 2>/dev/null
 copy_setports ns1/named2.conf.in ns1/named.conf
 rm -f ns1/root.db.signed.jnl
 mkeys_reconfig_on 1 || ret=1
+mkeys_reload_on 1 || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

 echo_i "reinitialize trust anchors"
 stop_server --use-rndc --port "${CONTROLPORT}" mkeys ns2
@@ -0,0 +1,19 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+rm -f dig.out.* rndc.signing.*
+rm -f ns*/named.conf ns*/named.memstats ns*/named.run*
+rm -f ns*/*.jnl ns*/*.jbk ns*/managed-keys.bind
+rm -f ns*/K*.private ns*/K*.key ns*/K*.state
+rm -f ns*/dsset-* ns*/*.db ns*/*.db.signed
+
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+dnssec-policy "nsec" {
+	// no need to change configuration: if no 'nsec3param' is set,
+	// NSEC will be used;
+};
+
+dnssec-policy "nsec3" {
+	nsec3param;
+};
+
+dnssec-policy "optout" {
+	nsec3param optout yes;
+};
+
+dnssec-policy "nsec3-other" {
+	nsec3param iterations 11 optout yes salt-length 0;
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+/* This zone starts with NSEC, but will be reconfigured to use NSEC3. */
+zone "nsec-to-nsec3.kasp" {
+	type primary;
+	file "nsec-to-nsec3.kasp.db";
+	dnssec-policy "nsec";
+};
+
+/* This zone uses the default NSEC3 settings. */
+zone "nsec3.kasp" {
+	type primary;
+	file "nsec3.kasp.db";
+	dnssec-policy "nsec3";
+};
+
+/* This zone uses non-default NSEC3 settings. */
+zone "nsec3-other.kasp" {
+	type primary;
+	file "nsec3-other.kasp.db";
+	dnssec-policy "nsec3-other";
+};
+
+/* The zone will be reconfigured to use other NSEC3 settings. */
+zone "nsec3-change.kasp" {
+	type primary;
+	file "nsec3-change.kasp.db";
+	dnssec-policy "nsec3";
+};
+
+/* The zone will be reconfigured to use opt-out. */
+zone "nsec3-to-optout.kasp" {
+	type primary;
+	file "nsec3-to-optout.kasp.db";
+	dnssec-policy "nsec3";
+};
+
+/* The zone will be reconfigured to disable opt-out. */
+zone "nsec3-from-optout.kasp" {
+	type primary;
+	file "nsec3-from-optout.kasp.db";
+	dnssec-policy "optout";
+};
+
+/* The zone starts with NSEC3, but will be reconfigured to use NSEC. */
+zone "nsec3-to-nsec.kasp" {
+	type primary;
+	file "nsec3-to-nsec.kasp.db";
+	dnssec-policy "nsec3";
+};
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+dnssec-policy "nsec" {
+	// no need to change configuration: if no 'nsec3param' is set,
+	// NSEC will be used;
+};
+
+dnssec-policy "nsec3" {
+	nsec3param;
+};
+
+dnssec-policy "optout" {
+	nsec3param optout yes;
+};
+
+dnssec-policy "nsec3-other" {
+	nsec3param iterations 11 optout yes salt-length 0;
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+/* This zone starts with NSEC, but will be reconfigured to use NSEC3. */
+zone "nsec-to-nsec3.kasp" {
+	type primary;
+	file "nsec-to-nsec3.kasp.db";
+	//dnssec-policy "nsec";
+	dnssec-policy "nsec3";
+};
+
+/* This zone uses the default NSEC3 settings. */
+zone "nsec3.kasp" {
+	type primary;
+	file "nsec3.kasp.db";
+	dnssec-policy "nsec3";
+};
+
+/* This zone uses non-default NSEC3 settings. */
+zone "nsec3-other.kasp" {
+	type primary;
+	file "nsec3-other.kasp.db";
+	dnssec-policy "nsec3-other";
+};
+
+/* The zone will be reconfigured to use other NSEC3 settings. */
+zone "nsec3-change.kasp" {
+	type primary;
+	file "nsec3-change.kasp.db";
+	//dnssec-policy "nsec3";
+	dnssec-policy "nsec3-other";
+};
+
+/* The zone will be reconfigured to use opt-out. */
+zone "nsec3-to-optout.kasp" {
+	type primary;
+	file "nsec3-to-optout.kasp.db";
+	//dnssec-policy "nsec3";
+	dnssec-policy "optout";
+};
+
+/* The zone will be reconfigured to disable opt-out. */
+zone "nsec3-from-optout.kasp" {
+	type primary;
+	file "nsec3-from-optout.kasp.db";
+	//dnssec-policy "optout";
+	dnssec-policy "nsec3";
+};
+
+/* The zone starts with NSEC3, but will be reconfigured to use NSEC. */
+zone "nsec3-to-nsec.kasp" {
+	type primary;
+	file "nsec3-to-nsec.kasp.db";
+	//dnssec-policy "nsec3";
+	dnssec-policy "nsec";
+};
--- a/Show More
+++ b/Show More