WIP: Add preliminary DoH client support to dig

This commit contains fixes to unit tests to make them work well on
various platforms (in particular ones shipping old versions of
OpenSSL) and fo different configurations.

It also updates the generated manpage to include DoH configuration
options.

.gitlab-ci.yml

@@ -285,6 +285,7 @@ stages:
          "with-openssl=C:/OpenSSL"
          "with-libxml2=C:/libxml2"
          "with-libuv=C:/libuv"
+         "with-nghttp2=C:/nghttp2"
          "without-python"
          "with-system-tests"
          x64'
@@ -455,9 +456,11 @@ misc:
     - sh util/tabify-changes < CHANGES > CHANGES.tmp
     - diff -urNap CHANGES CHANGES.tmp
     - perl util/check-changes CHANGES
+    - sh util/check-line-length.sh CHANGES
     - test ! -f CHANGES.SE || sh util/tabify-changes < CHANGES.SE > CHANGES.tmp
     - test ! -f CHANGES.SE || diff -urNap CHANGES.SE CHANGES.tmp
     - test ! -f CHANGES.SE || perl util/check-changes master=0 CHANGES.SE
+    - test ! -f CHANGES.SE || sh util/check-line-length.sh CHANGES.SE
     - rm CHANGES.tmp
     - perl -w util/merge_copyrights
     - diff -urNap util/copyrights util/newcopyrights
@@ -1321,10 +1324,10 @@ release:
   )
   test "$(md5sum cov-analysis-linux64.tgz | awk '{ print $1 }')" = "$(cat cov-analysis-linux64.md5)"
   tar --extract --gzip --file=cov-analysis-linux64.tgz
-  test -d cov-analysis-linux64-2019.03
+  test -d cov-analysis-linux64-2020.09
 
 .coverity_build: &coverity_build |
-  cov-analysis-linux64-2019.03/bin/cov-build --dir cov-int sh -c 'make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1'
+  cov-analysis-linux64-2020.09/bin/cov-build --dir cov-int sh -c 'make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1'
   tar --create --gzip --file=cov-int.tar.gz cov-int/
   curl -v https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME \
        --form token=$COVERITY_SCAN_TOKEN \
@@ -1360,7 +1363,7 @@ coverity:
       - $COVERITY_SCAN_PROJECT_NAME
       - $COVERITY_SCAN_TOKEN
   cache:
-    key: cov-analysis-linux64-2019.03
+    key: cov-analysis-linux64-2020.09
     paths:
       - cov-analysis-linux64.md5
       - cov-analysis-linux64.tgz
@@ -1489,8 +1492,6 @@ stress:authoritative:freebsd12:amd64:
   only:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
-  # See: https://gitlab.isc.org/isc-projects/bind9/-/issues/1941
-  allow_failure: true
 
 stress:recursive:freebsd12:amd64:
   <<: *freebsd_12_amd64_image
@@ -1505,41 +1506,6 @@ stress:recursive:freebsd12:amd64:
   only:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
-  # See: https://gitlab.isc.org/isc-projects/bind9/-/issues/1941
-  allow_failure: true
-
-# ABI check
-
-abi-check:
-  <<: *base_image
-  stage: build
-  needs:
-    - job: autoreconf
-      artifacts: true
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
-    BIND_BASELINE_VERSION: v9_17_8
-  script:
-    - *configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} V=1
-    - git clone --branch "${BIND_BASELINE_VERSION}" --depth 1 https://gitlab.isc.org/isc-projects/bind9.git refbind
-    - cd refbind/
-    - autoreconf -fi
-    - *configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} V=1
-    - cd ..
-    - util/api-checker.sh . refbind
-  artifacts:
-    paths:
-      - "*-lib*.html"
-      - "*-lib*.txt"
-      - "abi-*.dump"
-    expire_in: "1 week"
-  only:
-    - main@isc-projects/bind9
-    - /^v9_[1-9][0-9]$/@isc-projects/bind9
 
 gcov:
   <<: *base_image

CHANGES

@@ -1,47 +1,117 @@
+5575.	[func]		Initial support for DNS-over-HTTP(S). BIND now
+			includes DNS-over-HTTP(S) layer built on top of nghttp2.
+			Both encrypted (via TLS) and unencrypted HTTP/2 connections
+			are supported.
+
+5574.	[func]		Incoming zone transfers can now use TLS.
+			Addresses in a "primaries" list take an optional
+			"tls" argument, specifying either a previously
+			configured "tls" block or "ephemeral"; SOA queries
+			and zone transfer requests will then be sent via
+			TLS. [GL #2392]
+
+5573.	[func]		Also return stale data if an error occurred and we are
+			not resuming. Only start the stale-refresh-time window
+			if we timed out. [GL #2434]
+
+5572.	[bug]		Address potential double free in generatexml.
+			[GL #2420]
+
+5571.	[bug]		If a zone had a non-builtin named allow-update acl
+			named failed to start. [GL #2413]
+
+5570.	[bug]		Improve the performance of dnssec-verify by reducing
+			the number of repeated calls to dns_dnssec_keyfromrdata.
+			[GL #2073]
+
+5569.	[bug]		Emit useful error message when 'rndc retransfer' is
+			applied to a zone of inappropriate type. [GL #2342]
+
+5568.	[bug]		Fixed a crash in "dnssec-keyfromlabel" when using ECDSA
+			keys. [GL #2178]
+
+5567.	[bug]		Dig now reports unknown dash options while pre-parsing
+			the options.  This prevents '-multi' instead of
+			'+multi' reporting memory usage before ending option
+			parsing on 'Invalid option: -lti'. [GL #2403]
+
+5566.	[func]		Add "stale-answer-client-timeout" option, which
+			is the amount of time a recursive resolver waits before
+			attempting to answer the query using stale data from
+			cache. [GL #2247]
+
+5565.	[func]		The SONAMEs for BIND 9 libraries now include the current
+			BIND 9 version number, in an effort to tightly couple
+			internal libraries with a specific release. [GL #2387]
+
+5564.	[cleanup]	Refactored the network manager TLSDNS module to use
+			libuv and libssl directly, rather than opening a
+			TLS/TCP socket stack. [GL #2235]
+
+5563.	[cleanup]	Changed several obsolete configuration options to
+			ancient, making them into fatal errors. Also cleaned
+			up the number of clause flags in the configuration
+			parser. [GL #1086]
+
+5562.	[placeholder]
+
+5561.	[bug]		KASP incorrectly set signature validity to the value
+			of the DNSKEY signature validity. This is now fixed.
+			[GL #2383]
+
+5560.	[func]		The default value of "max-stale-ttl" has been changed
+			from 12 hours to 1 day and the default value of
+			"stale-answer-ttl" has been changed from 1 second to
+			30 seconds, following RFC 8767 recommendations.
+			[GL #2248]
+
+	--- 9.17.9 released ---
+
 5559.	[bug]		The --with-maxminddb=PATH form of the build-time option
 			enabling support for libmaxminddb was not working
 			correctly. This has been fixed. [GL #2366]
 
-5558.	[bug]		Asynchronous hook modules could assert due to
-			the fetch handle being detached too late. [GL #2379]
+5558.	[bug]		Asynchronous hook modules could trigger an assertion
+			failure when the fetch handle was detached too late.
+			Thanks to Jinmei Tatuya at Infoblox. [GL #2379]
 
-5557.	[bug]		Prevent rbtdb instances being destroyed by multiple
-			threads at the same time. [GL #2355]
+5557.	[bug]		Prevent RBTDB instances from being destroyed by multiple
+			threads at the same time. [GL #2317]
 
-5556.	[bug]		dnssec-signzone and dnssec-verify where now
-			printing too many newlines between log messages.
-			[GL #2359]
+5556.	[bug]		Further tweak newline printing in dnssec-signzone and
+			dnssec-verify. [GL #2359]
 
 5555.	[placeholder]
 
-5554.	[bug]		dnssec-signzone and dnssec-verify where missing
-			newlines between log messages. [GL #2359]
+5554.	[bug]		dnssec-signzone and dnssec-verify were missing newlines
+			between log messages. [GL #2359]
 
-5553.	[bug]		When reconfiguring named, removing "auto-dnssec"
-			did not actually turn off DNSSEC maintenance.
-			This has been fixed. [GL #2341]
+5553.	[bug]		When reconfiguring named, removing "auto-dnssec" did not
+			turn off DNSSEC maintenance. [GL #2341]
 
-5552.	[func]		When switching to "dnssec-policy none;", named
-			now permits a safe transition to insecure mode
-			and publishes the CDS and CDNSKEY DELETE
-			records, as described in RFC 8078. [GL #1750]
+5552.	[func]		When switching to "dnssec-policy none;", named now
+			permits a safe transition to insecure mode and publishes
+			the CDS and CDNSKEY DELETE records, as described in RFC
+			8078. [GL #1750]
 
-5551.	[bug]		Only assign threads to CPUs in the CPU affinity set.
-			Thanks to Ole Bjørn Hessen. [GL #2245]
+5551.	[bug]		named no longer attempts to assign threads to CPUs
+			outside the CPU affinity set. Thanks to Ole Bjørn
+			Hessen. [GL #2245]
 
-5550.	[func]		Print a warning when falling back to the "increment" SOA
-			serial method. [GL #2058]
+5550.	[func]		dnssec-signzone and named now log a warning when falling
+			back to the "increment" SOA serial method. [GL #2058]
 
-5549.	[protocol]	Serve ipv4only.arpa when dns64 is configured. [GL #385]
+5549.	[protocol]	ipv4only.arpa is now served when DNS64 is configured.
+			[GL #385]
 
 5548.	[placeholder]
 
 5547.	[placeholder]
 
-5546.	[placeholder]
-
 	--- 9.17.8 released ---
 
+5546.	[placeholder]
+
 5545.	[func]		OS support for load-balanced sockets is no longer
 			required to receive incoming queries in multiple netmgr
 			threads. [GL #2137]

COPYRIGHT

@@ -367,3 +367,25 @@ distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
+
+-----------------------------------------------------------------------------
+
+Copyright Joyent, Inc. and other Node contributors. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.

bin/dig/dig.c

@@ -228,6 +228,10 @@ help(void) {
 	       "SERVFAIL)\n"
 	       "                 +[no]header-only    (Send query without a "
 	       "question section)\n"
+	       "                 +[no]https[=###]    (DNS over HTTPS mode) "
+	       "[/]\n"
+	       "                 +[no]https-get      (Use GET instead of "
+	       "default POST method\n"
 	       "                 +[no]identify       (ID responders in short "
 	       "answers)\n"
 #ifdef HAVE_LIBIDN2
@@ -348,6 +352,8 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		}
 		if (query->lookup->tls_mode) {
 			proto = "TLS";
+		} else if (query->lookup->https_mode) {
+			proto = "HTTPS";
 		} else if (query->lookup->tcp_mode) {
 			proto = "TCP";
 		} else {
@@ -1412,8 +1418,39 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		lookup->servfail_stops = state;
 		break;
 	case 'h':
-		FULLCHECK("header-only");
-		lookup->header_only = state;
+		switch (cmd[1]) {
+		case 'e': /* header-only */
+			FULLCHECK("header-only");
+			lookup->header_only = state;
+			break;
+		case 't':
+			FULLCHECK2("https", "https-get");
+			switch (cmd[5]) {
+			case '\0':
+				FULLCHECK("https");
+				lookup->https_mode = state;
+				if (!lookup->tcp_mode_set) {
+					lookup->tcp_mode = state;
+				}
+				if (value == NULL) {
+					lookup->https_path = isc_mem_strdup(
+						mctx, DEFAULT_HTTPS_PATH);
+					break;
+				}
+				lookup->https_path = isc_mem_strdup(mctx,
+								    value);
+				break;
+			case '-':
+				FULLCHECK("https-get");
+				lookup->https_get = true;
+				break;
+			default:
+				goto invalid_option;
+			}
+			break;
+		default:
+			goto invalid_option;
+		}
 		break;
 	case 'i':
 		switch (cmd[1]) {
@@ -2341,16 +2378,20 @@ preparse_args(int argc, char **argv) {
 			continue;
 		}
 		/* Look for dash value option. */
-		if (strpbrk(option, dash_opts) != &option[0] ||
-		    strlen(option) > 1U) {
-			/* Error or value in option. */
+		if (strpbrk(option, dash_opts) != &option[0]) {
+			goto invalid_option;
+		}
+		if (strlen(option) > 1U) {
+			/* value in option. */
 			continue;
 		}
 		/* Dash value is next argument so we need to skip it. */
 		rc--, rv++;
 		/* Handle missing argument */
 		if (rc == 0) {
-			break;
+		invalid_option:
+			fprintf(stderr, "Invalid option: -%s\n", option);
+			usage();
 		}
 	}
 }

bin/dig/dighost.c

@@ -608,97 +608,35 @@ make_empty_lookup(void) {
 
 	INSIST(!free_now);
 
-	looknew = isc_mem_allocate(mctx, sizeof(struct dig_lookup));
-	looknew->pending = true;
-	looknew->textname[0] = 0;
-	looknew->cmdline[0] = 0;
-	looknew->rdtype = dns_rdatatype_a;
-	looknew->qrdtype = dns_rdatatype_a;
-	looknew->rdclass = dns_rdataclass_in;
-	looknew->rdtypeset = false;
-	looknew->rdclassset = false;
-	looknew->sendspace = NULL;
-	looknew->sendmsg = NULL;
-	looknew->name = NULL;
-	looknew->oname = NULL;
-	looknew->xfr_q = NULL;
-	looknew->current_query = NULL;
-	looknew->doing_xfr = false;
-	looknew->ixfr_serial = 0;
-	looknew->trace = false;
-	looknew->trace_root = false;
-	looknew->identify = false;
-	looknew->identify_previous_line = false;
-	looknew->ignore = false;
-	looknew->servfail_stops = true;
-	looknew->besteffort = true;
-	looknew->dns64prefix = false;
-	looknew->dnssec = false;
-	looknew->ednsflags = 0;
-	looknew->opcode = dns_opcode_query;
-	looknew->expire = false;
-	looknew->nsid = false;
-	looknew->tcp_keepalive = false;
-	looknew->padding = 0;
-	looknew->header_only = false;
-	looknew->sendcookie = false;
-	looknew->seenbadcookie = false;
-	looknew->badcookie = true;
-	looknew->multiline = false;
-	looknew->nottl = false;
-	looknew->noclass = false;
-	looknew->onesoa = false;
-	looknew->use_usec = false;
-	looknew->nocrypto = false;
-	looknew->ttlunits = false;
-	looknew->expandaaaa = false;
-	looknew->qr = false;
+	looknew = isc_mem_allocate(mctx, sizeof(*looknew));
+	*looknew = (dig_lookup_t){
+		.pending = true,
+		.rdtype = dns_rdatatype_a,
+		.qrdtype = dns_rdatatype_a,
+		.rdclass = dns_rdataclass_in,
+		.servfail_stops = true,
+		.besteffort = true,
+		.opcode = dns_opcode_query,
+		.badcookie = true,
 #ifdef HAVE_LIBIDN2
-	looknew->idnin = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false;
-	looknew->idnout = looknew->idnin;
-#else  /* ifdef HAVE_LIBIDN2 */
-	looknew->idnin = false;
-	looknew->idnout = false;
+		.idnin = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false,
+		.idnout = looknew->idnin,
 #endif /* HAVE_LIBIDN2 */
-	looknew->udpsize = -1;
-	looknew->edns = -1;
-	looknew->recurse = true;
-	looknew->aaonly = false;
-	looknew->adflag = false;
-	looknew->cdflag = false;
-	looknew->raflag = false;
-	looknew->tcflag = false;
-	looknew->print_unknown_format = false;
-	looknew->zflag = false;
-	looknew->setqid = false;
-	looknew->qid = 0;
-	looknew->ns_search_only = false;
-	looknew->origin = NULL;
-	looknew->tsigctx = NULL;
-	looknew->querysig = NULL;
-	looknew->retries = tries;
-	looknew->nsfound = 0;
-	looknew->tcp_mode = false;
-	looknew->tcp_mode_set = false;
-	looknew->tls_mode = false;
-	looknew->comments = true;
-	looknew->stats = true;
-	looknew->section_question = true;
-	looknew->section_answer = true;
-	looknew->section_authority = true;
-	looknew->section_additional = true;
-	looknew->new_search = false;
-	looknew->done_as_is = false;
-	looknew->need_search = false;
-	looknew->ecs_addr = NULL;
-	looknew->cookie = NULL;
-	looknew->ednsopts = NULL;
-	looknew->ednsoptscnt = 0;
-	looknew->ednsneg = true;
-	looknew->mapped = true;
-	looknew->dscp = -1;
-	looknew->rrcomments = 0;
-	looknew->eoferr = 0;
+		.udpsize = -1,
+		.edns = -1,
+		.recurse = true,
+		.retries = tries,
+		.comments = true,
+		.stats = true,
+		.section_question = true,
+		.section_answer = true,
+		.section_authority = true,
+		.section_additional = true,
+		.ednsneg = true,
+		.mapped = true,
+		.dscp = -1,
+	};
+
 	dns_fixedname_init(&looknew->fdomain);
 	ISC_LINK_INIT(looknew, link);
 	ISC_LIST_INIT(looknew->q);
@@ -787,6 +725,11 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->nsid = lookold->nsid;
 	looknew->tcp_keepalive = lookold->tcp_keepalive;
 	looknew->header_only = lookold->header_only;
+	looknew->https_mode = lookold->https_mode;
+	if (lookold->https_path != NULL) {
+		looknew->https_path = isc_mem_strdup(mctx, lookold->https_path);
+	}
+	looknew->https_get = lookold->https_get;
 	looknew->sendcookie = lookold->sendcookie;
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
@@ -1638,6 +1581,10 @@ _destroy_lookup(dig_lookup_t *lookup) {
 		isc_mem_free(mctx, lookup->ednsopts);
 	}
 
+	if (lookup->https_path) {
+		isc_mem_free(mctx, lookup->https_path);
+	}
+
 	isc_mem_free(mctx, lookup);
 }
 
@@ -2760,7 +2707,17 @@ start_tcp(dig_query_t *query) {
 	 * For TLS connections, we want to override the default
 	 * port number.
 	 */
-	port = port_set ? port : (query->lookup->tls_mode ? 853 : 53);
+	if (!port_set) {
+		if (query->lookup->tls_mode) {
+			port = 853;
+		} else if (query->lookup->https_mode) {
+			port = 443;
+		} else {
+			port = 53;
+		}
+	}
+
+	fprintf(stderr, "query->servname = %s\n", query->servname);
 
 	result = get_address(query->servname, port, &query->sockaddr);
 	if (result != ISC_R_SUCCESS) {
@@ -2828,11 +2785,34 @@ start_tcp(dig_query_t *query) {
 		REQUIRE(query != NULL);
 
 		if (query->lookup->tls_mode) {
+			result = isc_tlsctx_createclient(&query->tlsctx);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			result = isc_nm_tlsdnsconnect(
 				netmgr, (isc_nmiface_t *)&localaddr,
 				(isc_nmiface_t *)&query->sockaddr,
-				tcp_connected, query, local_timeout, 0);
-			check_result(result, "isc_nm_tcpdnsconnect");
+				tcp_connected, query, local_timeout, 0,
+				query->tlsctx);
+			check_result(result, "isc_nm_tlsdnsconnect");
+		} else if (query->lookup->https_mode) {
+			char portbuf[12];
+			char uri[4096] = { 0 };
+			snprintf(portbuf, sizeof(portbuf), "%u",
+				 (uint16_t)port);
+
+			strlcpy(uri, "https://", sizeof(uri));
+			strlcat(uri, query->servname, sizeof(uri));
+			strlcat(uri, ":", sizeof(uri));
+			strlcat(uri, portbuf, sizeof(uri));
+			strlcat(uri, query->lookup->https_path, sizeof(uri));
+
+			result = isc_tlsctx_createclient(&query->tlsctx);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
+			result = isc_nm_httpconnect(
+				netmgr, (isc_nmiface_t *)&localaddr,
+				(isc_nmiface_t *)&query->sockaddr, uri,
+				!query->lookup->https_get, tcp_connected, query,
+				query->tlsctx, local_timeout, 0);
+			check_result(result, "isc_nm_httpconnect");
 		} else {
 			result = isc_nm_tcpdnsconnect(
 				netmgr, (isc_nmiface_t *)&localaddr,
@@ -3180,7 +3160,12 @@ launch_next_query(dig_query_t *query) {
 	isc_nmhandle_settimeout(query->handle, local_timeout);
 
 	query_attach(query, &readquery);
-	isc_nm_read(query->handle, recv_done, readquery);
+	if (query->lookup->https_mode) {
+		isc_nm_httprequest(query->handle, &r, recv_done, readquery);
+		goto cleanup;
+	} else {
+		isc_nm_read(query->handle, recv_done, readquery);
+	}
 
 	if (!query->first_soa_rcvd) {
 		dig_query_t *sendquery = NULL;
@@ -3208,6 +3193,7 @@ launch_next_query(dig_query_t *query) {
 			}
 		}
 	}
+cleanup:
 	lookup_detach(&l);
 	return;
 }
@@ -3240,6 +3226,10 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	LOCK_LOOKUP;
 	lookup_attach(query->lookup, &l);
 
+	if (query->tlsctx != NULL) {
+		isc_tlsctx_free(&query->tlsctx);
+	}
+
 	if (eresult == ISC_R_CANCELED) {
 		debug("in cancel handler");
 		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
@@ -3306,10 +3296,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 
 	launch_next_query(query);
 	query_detach(&query);
-	if (l->tls_mode) {
-		/* FIXME: This is a accounting bug in TLSDNS */
-		isc_nmhandle_detach(&handle);
-	}
 	lookup_detach(&l);
 	UNLOCK_LOOKUP;
 }

bin/dig/dighost.h

@@ -24,6 +24,7 @@
 #include <isc/list.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
+#include <isc/netmgr.h>
 #include <isc/print.h>
 #include <isc/refcount.h>
 #include <isc/sockaddr.h>
@@ -75,6 +76,9 @@
 #define DEFAULT_EDNS_VERSION 0
 #define DEFAULT_EDNS_BUFSIZE 1232
 
+#define DEFAULT_HTTPS_PATH  "/dns-query"
+#define DEFAULT_HTTPS_QUERY "?dns="
+
 /*%
  * Lookup_limit is just a limiter, keeping too many lookups from being
  * created.  It's job is mainly to prevent the program from running away
@@ -167,6 +171,11 @@ struct dig_lookup {
 	int rrcomments;
 	unsigned int eoferr;
 	uint16_t qid;
+	struct {
+		bool https_mode;
+		bool https_get;
+		char *https_path;
+	};
 };
 
 /*% The dig_query structure */
@@ -199,6 +208,7 @@ struct dig_query {
 	uint64_t byte_count;
 	isc_timer_t *timer;
 	uint8_t tries;
+	isc_tlsctx_t *tlsctx;
 };
 
 struct dig_server {

bin/dnssec/dnssec-keyfromlabel.rst

@@ -76,9 +76,9 @@ Options
 ``-E engine``
    This option specifies the cryptographic hardware to use.
 
-   When BIND 9 is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
    built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
    defaults to the path of the PKCS#11 provider library specified via
    ``--with-pkcs11``.

bin/dnssec/dnssec-keygen.rst

@@ -103,9 +103,9 @@ Options
 ``-E engine``
    This option specifies the cryptographic hardware to use, when applicable.
 
-   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
    built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
    defaults to the path of the PKCS#11 provider library specified via
    ``--with-pkcs11``.

bin/dnssec/dnssec-revoke.rst

@@ -59,9 +59,9 @@ Options
 ``-E engine``
    This option specifies the cryptographic hardware to use, when applicable.
 
-   When BIND 9 is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
    built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
    defaults to the path of the PKCS#11 provider library specified via
    ``--with-pkcs11``.

bin/dnssec/dnssec-settime.rst

@@ -102,9 +102,9 @@ Options
 ``-E engine``
    This option specifies the cryptographic hardware to use, when applicable.
 
-   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
    built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
    defaults to the path of the PKCS#11 provider library specified via
    ``--with-pkcs11``.

bin/dnssec/dnssec-signzone.rst

@@ -69,9 +69,9 @@ Options
    This option specifies the hardware to use for cryptographic
    operations, such as a secure key store used for signing, when applicable.
 
-   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
    built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
    defaults to the path of the PKCS#11 provider library specified via
    ``--with-pkcs11``.

bin/dnssec/dnssec-verify.rst

@@ -47,9 +47,9 @@ Options
 ``-E engine``
    This option specifies the cryptographic hardware to use, when applicable.
 
-   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
    built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
    defaults to the path of the PKCS#11 provider library specified via
    ``--with-pkcs11``.

bin/named/Makefile.am

@@ -59,6 +59,7 @@ named_SOURCES =				\
 	server.c			\
 	statschannel.c			\
 	tkeyconf.c			\
+	transportconf.c			\
 	tsigconf.c			\
 	zoneconf.c			\
 	unix/dlz_dlopen_driver.c	\
@@ -77,6 +78,7 @@ named_SOURCES =				\
 	include/named/smf_globals.h	\
 	include/named/statschannel.h	\
 	include/named/tkeyconf.h	\
+	include/named/transportconf.h	\
 	include/named/tsigconf.h	\
 	include/named/types.h		\
 	include/named/zoneconf.h	\

bin/named/config.c

@@ -94,6 +94,8 @@ options {\n\
 #	pid-file \"" NAMED_LOCALSTATEDIR "/run/named/named.pid\"; \n\
 	port 53;\n\
 	tls-port 853;\n\
+	http-port 80;\n\
+	https-port 443;\n\
 	prefetch 2 9;\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
@@ -131,7 +133,6 @@ options {\n\
 #	treat-cr-as-space <obsolete>;\n\
 	trust-anchor-telemetry yes;\n\
 #	use-id-pool <obsolete>;\n\
-#	use-ixfr <obsolete>;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
@@ -141,7 +142,6 @@ options {\n\
 	allow-recursion { localnets; localhost; };\n\
 	allow-recursion-on { any; };\n\
 	allow-update-forwarding {none;};\n\
-#	allow-v6-synthesis <obsolete>;\n\
 	auth-nxdomain false;\n\
 	check-dup-records warn;\n\
 	check-mx warn;\n\
@@ -171,7 +171,7 @@ options {\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
 	max-recursion-queries 100;\n\
-	max-stale-ttl 43200; /* 12 hours */\n\
+	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
 	min-cache-ttl 0; /* 0 seconds */\n\
@@ -196,9 +196,10 @@ options {\n\
 	servfail-ttl 1;\n\
 #	sortlist <none>\n\
 	stale-answer-enable false;\n\
-	stale-refresh-time 30; /* 30 seconds */\n\
-	stale-answer-ttl 1; /* 1 second */\n\
+	stale-answer-client-timeout 1800; /* in milliseconds */\n\
+	stale-answer-ttl 30; /* 30 seconds */\n\
 	stale-cache-enable false;\n\
+	stale-refresh-time 30; /* 30 seconds */\n\
 	synth-from-dnssec no;\n\
 #	topology <none>\n\
 	transfer-format many-answers;\n\
@@ -609,10 +610,76 @@ named_config_getprimariesdef(const cfg_obj_t *cctx, const char *name,
 	return (result);
 }
 
+static isc_result_t
+named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
+		     dns_name_t **namep) {
+	REQUIRE(namep != NULL && *namep == NULL);
+
+	const char *objstr;
+	isc_result_t result;
+	isc_buffer_t b;
+	dns_fixedname_t fname;
+
+	if (!cfg_obj_isstring(obj)) {
+		*namep = NULL;
+		return (ISC_R_SUCCESS);
+	}
+
+	*namep = isc_mem_get(mctx, sizeof(**namep));
+	dns_name_init(*namep, NULL);
+
+	objstr = cfg_obj_asstring(obj);
+	isc_buffer_constinit(&b, objstr, strlen(objstr));
+	isc_buffer_add(&b, strlen(objstr));
+	dns_fixedname_init(&fname);
+	result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
+				   0, NULL);
+	if (result != ISC_R_SUCCESS) {
+		isc_mem_put(mctx, *namep, sizeof(*namep));
+		*namep = NULL;
+		return (result);
+	}
+	dns_name_dup(dns_fixedname_name(&fname), mctx, *namep);
+
+	return (ISC_R_SUCCESS);
+}
+
+#define grow_array(mctx, array, newlen, oldlen)                    \
+	if (newlen >= oldlen) {                                    \
+		size_t newsize = (newlen + 16) * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]);        \
+		void *tmp = isc_mem_get(mctx, newsize);            \
+		memset(tmp, 0, newsize);                           \
+		if (oldlen != 0) {                                 \
+			memmove(tmp, array, oldsize);              \
+			isc_mem_put(mctx, array, oldsize);         \
+		}                                                  \
+		array = tmp;                                       \
+		oldlen = newlen + 16;                              \
+	}
+
+#define shrink_array(mctx, array, newlen, oldlen)           \
+	if (newlen < oldlen) {                              \
+		void *tmp = NULL;                           \
+		size_t newsize = newlen * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]); \
+		if (newlen != 0) {                          \
+			tmp = isc_mem_get(mctx, newsize);   \
+			memset(tmp, 0, newsize);            \
+			memmove(tmp, array, newsize);       \
+		} else {                                    \
+			tmp = NULL;                         \
+		}                                           \
+		isc_mem_put(mctx, array, oldsize);          \
+		array = tmp;                                \
+		oldlen = newlen;                            \
+	}
+
 isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
-	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, i = 0;
+	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, tlscount = 0,
+		 i = 0;
 	uint32_t listcount = 0, l = 0, j;
 	uint32_t stackcount = 0, pushed = 0;
 	isc_result_t result;
@@ -620,12 +687,14 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	const cfg_obj_t *addrlist;
 	const cfg_obj_t *portobj;
 	const cfg_obj_t *dscpobj;
-	in_port_t port;
+	in_port_t port = (in_port_t)0;
+	in_port_t def_port;
+	in_port_t def_tlsport;
 	isc_dscp_t dscp = -1;
-	dns_fixedname_t fname;
 	isc_sockaddr_t *addrs = NULL;
 	isc_dscp_t *dscps = NULL;
 	dns_name_t **keys = NULL;
+	dns_name_t **tlss = NULL;
 	struct {
 		const char *name;
 	} *lists = NULL;
@@ -639,6 +708,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	REQUIRE(ipkl->count == 0);
 	REQUIRE(ipkl->addrs == NULL);
 	REQUIRE(ipkl->keys == NULL);
+	REQUIRE(ipkl->tlss == NULL);
 	REQUIRE(ipkl->dscps == NULL);
 	REQUIRE(ipkl->labels == NULL);
 	REQUIRE(ipkl->allocated == 0);
@@ -646,7 +716,12 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	/*
 	 * Get system defaults.
 	 */
-	result = named_config_getport(config, "port", &port);
+	result = named_config_getport(config, "port", &def_port);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
+	result = named_config_getport(config, "tls-port", &def_tlsport);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -690,33 +765,20 @@ resume:
 	for (; element != NULL; element = cfg_list_next(element)) {
 		const cfg_obj_t *addr;
 		const cfg_obj_t *key;
-		const char *keystr;
-		isc_buffer_t b;
+		const cfg_obj_t *tls;
 
 		addr = cfg_tuple_get(cfg_listelt_value(element),
 				     "primarieselement");
 		key = cfg_tuple_get(cfg_listelt_value(element), "key");
+		tls = cfg_tuple_get(cfg_listelt_value(element), "tls");
 
 		if (!cfg_obj_issockaddr(addr)) {
 			const char *listname = cfg_obj_asstring(addr);
 			isc_result_t tresult;
 
 			/* Grow lists? */
-			if (listcount == l) {
-				void *tmp;
-				uint32_t newlen = listcount + 16;
-				size_t newsize, oldsize;
+			grow_array(mctx, lists, l, listcount);
 
-				newsize = newlen * sizeof(*lists);
-				oldsize = listcount * sizeof(*lists);
-				tmp = isc_mem_get(mctx, newsize);
-				if (listcount != 0) {
-					memmove(tmp, lists, oldsize);
-					isc_mem_put(mctx, lists, oldsize);
-				}
-				lists = tmp;
-				listcount = newlen;
-			}
 			/* Seen? */
 			for (j = 0; j < l; j++) {
 				if (strcasecmp(lists[j].name, listname) == 0) {
@@ -742,21 +804,7 @@ resume:
 			}
 			lists[l++].name = listname;
 			/* Grow stack? */
-			if (stackcount == pushed) {
-				void *tmp;
-				uint32_t newlen = stackcount + 16;
-				size_t newsize, oldsize;
-
-				newsize = newlen * sizeof(*stack);
-				oldsize = stackcount * sizeof(*stack);
-				tmp = isc_mem_get(mctx, newsize);
-				if (stackcount != 0) {
-					memmove(tmp, stack, oldsize);
-					isc_mem_put(mctx, stack, oldsize);
-				}
-				stack = tmp;
-				stackcount = newlen;
-			}
+			grow_array(mctx, stack, pushed, stackcount);
 			/*
 			 * We want to resume processing this list on the
 			 * next element.
@@ -768,68 +816,44 @@ resume:
 			goto newlist;
 		}
 
-		if (i == addrcount) {
-			void *tmp;
-			uint32_t newlen = addrcount + 16;
-			size_t newsize, oldsize;
-
-			newsize = newlen * sizeof(isc_sockaddr_t);
-			oldsize = addrcount * sizeof(isc_sockaddr_t);
-			tmp = isc_mem_get(mctx, newsize);
-			if (addrcount != 0) {
-				memmove(tmp, addrs, oldsize);
-				isc_mem_put(mctx, addrs, oldsize);
-			}
-			addrs = tmp;
-			addrcount = newlen;
-
-			newsize = newlen * sizeof(isc_dscp_t);
-			oldsize = dscpcount * sizeof(isc_dscp_t);
-			tmp = isc_mem_get(mctx, newsize);
-			if (dscpcount != 0) {
-				memmove(tmp, dscps, oldsize);
-				isc_mem_put(mctx, dscps, oldsize);
-			}
-			dscps = tmp;
-			dscpcount = newlen;
-
-			newsize = newlen * sizeof(dns_name_t *);
-			oldsize = keycount * sizeof(dns_name_t *);
-			tmp = isc_mem_get(mctx, newsize);
-			if (keycount != 0) {
-				memmove(tmp, keys, oldsize);
-				isc_mem_put(mctx, keys, oldsize);
-			}
-			keys = tmp;
-			keycount = newlen;
-		}
+		grow_array(mctx, addrs, i, addrcount);
+		grow_array(mctx, dscps, i, dscpcount);
+		grow_array(mctx, keys, i, keycount);
+		grow_array(mctx, tlss, i, tlscount);
 
 		addrs[i] = *cfg_obj_assockaddr(addr);
-		if (isc_sockaddr_getport(&addrs[i]) == 0) {
-			isc_sockaddr_setport(&addrs[i], port);
-		}
 		dscps[i] = cfg_obj_getdscp(addr);
 		if (dscps[i] == -1) {
 			dscps[i] = dscp;
 		}
-		keys[i] = NULL;
-		i++; /* Increment here so that cleanup on error works. */
-		if (!cfg_obj_isstring(key)) {
-			continue;
-		}
-		keys[i - 1] = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(keys[i - 1], NULL);
 
-		keystr = cfg_obj_asstring(key);
-		isc_buffer_constinit(&b, keystr, strlen(keystr));
-		isc_buffer_add(&b, strlen(keystr));
-		dns_fixedname_init(&fname);
-		result = dns_name_fromtext(dns_fixedname_name(&fname), &b,
-					   dns_rootname, 0, NULL);
+		result = named_config_getname(mctx, key, &keys[i]);
 		if (result != ISC_R_SUCCESS) {
+			i++; /* Increment here so that cleanup on error works.
+			      */
 			goto cleanup;
 		}
-		dns_name_dup(dns_fixedname_name(&fname), mctx, keys[i - 1]);
+
+		result = named_config_getname(mctx, tls, &tlss[i]);
+		if (result != ISC_R_SUCCESS) {
+			i++; /* Increment here so that cleanup on error works.
+			      */
+			goto cleanup;
+		}
+
+		/* Set the default port or tls-port */
+		if (port == 0) {
+			if (tlss[i] != NULL) {
+				port = def_tlsport;
+			} else {
+				port = def_port;
+			}
+		}
+
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			isc_sockaddr_setport(&addrs[i], port);
+		}
+		i++;
 	}
 	if (pushed != 0) {
 		pushed--;
@@ -838,61 +862,28 @@ resume:
 		dscp = stack[pushed].dscp;
 		goto resume;
 	}
-	if (i < addrcount) {
-		void *tmp;
-		size_t newsize, oldsize;
 
-		newsize = i * sizeof(isc_sockaddr_t);
-		oldsize = addrcount * sizeof(isc_sockaddr_t);
-		if (i != 0) {
-			tmp = isc_mem_get(mctx, newsize);
-			memmove(tmp, addrs, newsize);
-		} else {
-			tmp = NULL;
-		}
-		isc_mem_put(mctx, addrs, oldsize);
-		addrs = tmp;
-		addrcount = i;
-
-		newsize = i * sizeof(isc_dscp_t);
-		oldsize = dscpcount * sizeof(isc_dscp_t);
-		if (i != 0) {
-			tmp = isc_mem_get(mctx, newsize);
-			memmove(tmp, dscps, newsize);
-		} else {
-			tmp = NULL;
-		}
-		isc_mem_put(mctx, dscps, oldsize);
-		dscps = tmp;
-		dscpcount = i;
-
-		newsize = i * sizeof(dns_name_t *);
-		oldsize = keycount * sizeof(dns_name_t *);
-		if (i != 0) {
-			tmp = isc_mem_get(mctx, newsize);
-			memmove(tmp, keys, newsize);
-		} else {
-			tmp = NULL;
-		}
-		isc_mem_put(mctx, keys, oldsize);
-		keys = tmp;
-		keycount = i;
-	}
+	shrink_array(mctx, addrs, i, addrcount);
+	shrink_array(mctx, dscps, i, dscpcount);
+	shrink_array(mctx, keys, i, keycount);
+	shrink_array(mctx, tlss, i, tlscount);
 
 	if (lists != NULL) {
-		isc_mem_put(mctx, lists, listcount * sizeof(*lists));
+		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
 	}
 	if (stack != NULL) {
-		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
+		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
 	}
 
 	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
+	INSIST(tlscount == addrcount);
 	INSIST(keycount == dscpcount);
 
 	ipkl->addrs = addrs;
 	ipkl->dscps = dscps;
 	ipkl->keys = keys;
+	ipkl->tlss = tlss;
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;
 
@@ -900,10 +891,10 @@ resume:
 
 cleanup:
 	if (addrs != NULL) {
-		isc_mem_put(mctx, addrs, addrcount * sizeof(isc_sockaddr_t));
+		isc_mem_put(mctx, addrs, addrcount * sizeof(addrs[0]));
 	}
 	if (dscps != NULL) {
-		isc_mem_put(mctx, dscps, dscpcount * sizeof(isc_dscp_t));
+		isc_mem_put(mctx, dscps, dscpcount * sizeof(dscps[0]));
 	}
 	if (keys != NULL) {
 		for (j = 0; j < i; j++) {
@@ -913,15 +904,27 @@ cleanup:
 			if (dns_name_dynamic(keys[j])) {
 				dns_name_free(keys[j], mctx);
 			}
-			isc_mem_put(mctx, keys[j], sizeof(dns_name_t));
+			isc_mem_put(mctx, keys[j], sizeof(*keys[j]));
 		}
-		isc_mem_put(mctx, keys, keycount * sizeof(dns_name_t *));
+		isc_mem_put(mctx, keys, keycount * sizeof(keys[0]));
+	}
+	if (tlss != NULL) {
+		for (j = 0; j < i; j++) {
+			if (tlss[j] == NULL) {
+				continue;
+			}
+			if (dns_name_dynamic(tlss[j])) {
+				dns_name_free(tlss[j], mctx);
+			}
+			isc_mem_put(mctx, tlss[j], sizeof(*tlss[j]));
+		}
+		isc_mem_put(mctx, tlss, tlscount * sizeof(tlss[0]));
 	}
 	if (lists != NULL) {
-		isc_mem_put(mctx, lists, listcount * sizeof(*lists));
+		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
 	}
 	if (stack != NULL) {
-		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
+		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
 	}
 	return (result);
 }

bin/named/include/named/globals.h

@@ -64,16 +64,18 @@ EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
 EXTERN isc_socketmgr_t *named_g_socketmgr INIT(NULL);
 EXTERN isc_nm_t *named_g_nm INIT(NULL);
 EXTERN cfg_parser_t *named_g_parser INIT(NULL);
-EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
-EXTERN const char *named_g_version     INIT(PACKAGE_VERSION);
-EXTERN const char *named_g_product     INIT(PACKAGE_NAME);
-EXTERN const char *named_g_description INIT(PACKAGE_DESCRIPTION);
-EXTERN const char *named_g_srcid       INIT(PACKAGE_SRCID);
-EXTERN const char *named_g_configargs  INIT(PACKAGE_CONFIGARGS);
-EXTERN const char *named_g_builder     INIT(PACKAGE_BUILDER);
-EXTERN in_port_t named_g_port	       INIT(0);
-EXTERN in_port_t named_g_tlsport       INIT(0);
-EXTERN isc_dscp_t named_g_dscp	       INIT(-1);
+EXTERN cfg_parser_t *named_g_addparser	  INIT(NULL);
+EXTERN const char *named_g_version	  INIT(PACKAGE_VERSION);
+EXTERN const char *named_g_product	  INIT(PACKAGE_NAME);
+EXTERN const char *named_g_description	  INIT(PACKAGE_DESCRIPTION);
+EXTERN const char *named_g_srcid	  INIT(PACKAGE_SRCID);
+EXTERN const char *named_g_configargs	  INIT(PACKAGE_CONFIGARGS);
+EXTERN const char *named_g_builder	  INIT(PACKAGE_BUILDER);
+EXTERN in_port_t named_g_port		  INIT(0);
+EXTERN in_port_t named_g_tlsport	  INIT(0);
+EXTERN in_port_t named_g_http_secure_port INIT(0);
+EXTERN in_port_t named_g_http_port	  INIT(0);
+EXTERN isc_dscp_t named_g_dscp		  INIT(-1);
 
 EXTERN named_server_t *named_g_server INIT(NULL);
 

bin/named/include/named/transportconf.h

@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file */
+
+#include <isc/lang.h>
+#include <isc/types.h>
+
+#include <dns/transport.h>
+
+#include <isccfg/cfg.h>
+
+ISC_LANG_BEGINDECLS
+
+isc_result_t
+named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
+			    isc_mem_t *mctx, dns_transport_list_t **listp);
+/*%<
+ * Create a list of transport objects (DoT or DoH) and configure them
+ * according to 'key-file', 'cert-file', 'ca-file' or 'hostname'
+ * statements.
+ *
+ *	Requires:
+ *	\li	'config' is not NULL.
+ *	\li	'vconfig' is not NULL.
+ *	\li	'mctx' is not NULL
+ *	\li	'listp' is not NULL, and '*listp' is NULL
+ *
+ */
+
+ISC_LANG_ENDDECLS

bin/named/include/named/zoneconf.h

@@ -44,7 +44,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 
 bool
 named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
-		    const cfg_obj_t *vconfig, const cfg_obj_t *config);
+		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
+		    cfg_aclconfctx_t *actx);
 /*%<
  * If 'zone' can be safely reconfigured according to the configuration
  * data in 'zconfig', return true.  If the configuration data is so
@@ -54,7 +55,8 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 
 bool
 named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
-			 const cfg_obj_t *vconfig, const cfg_obj_t *config);
+			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
+			 cfg_aclconfctx_t *actx);
 /*%<
  * Determine if zone uses inline-signing. This is true if inline-signing
  * is set to yes, or if there is a dnssec-policy on a non-dynamic zone.

bin/named/main.c

@@ -705,7 +705,7 @@ parse_T_opt(char *option) {
 
 static void
 parse_port(char *arg) {
-	enum { DNSPORT, TLSPORT } ptype = DNSPORT;
+	enum { DNSPORT, TLSPORT, HTTP_SECURE_PORT, HTTP_PORT } ptype = DNSPORT;
 	char *value = arg;
 	int port;
 
@@ -714,6 +714,12 @@ parse_port(char *arg) {
 	} else if (strncmp(arg, "tls=", 4) == 0) {
 		value = arg + 4;
 		ptype = TLSPORT;
+	} else if (strncmp(arg, "https=", 6) == 0) {
+		value = arg + 6;
+		ptype = HTTP_SECURE_PORT;
+	} else if (strncmp(arg, "http=", 5) == 0) {
+		value = arg + 6;
+		ptype = HTTP_PORT;
 	}
 
 	port = parse_int(value, "port");
@@ -728,6 +734,12 @@ parse_port(char *arg) {
 	case TLSPORT:
 		named_g_tlsport = port;
 		break;
+	case HTTP_SECURE_PORT:
+		named_g_http_secure_port = port;
+		break;
+	case HTTP_PORT:
+		named_g_http_port = port;
+		break;
 	default:
 		INSIST(0);
 		ISC_UNREACHABLE();

bin/named/named.conf.rst

@@ -86,6 +86,15 @@ DYNDB
   dyndb string quoted_string {
       unspecified-text };
 
+HTTP
+^^^^
+
+::
+
+  http string {
+  	endpoints { quoted_string; ... }; // experimental
+  };
+
 KEY
 ^^^
 
@@ -137,7 +146,8 @@ MASTERS
   masters string [ port integer ] [ dscp
       integer ] { ( primaries | ipv4_address
       [ port integer ] | ipv6_address [ port
-      integer ] ) [ key string ]; ... };
+      integer ] ) [ key string ] [ tls
+      string ]; ... };
 
 OPTIONS
 ^^^^^^^
@@ -158,14 +168,14 @@ OPTIONS
   	allow-update-forwarding { address_match_element; ... };
   	also-notify [ port integer ] [ dscp integer ] { ( primaries |
   	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
+  	    integer ] ) [ key string ] [ tls string ]; ... };
   	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
   	    ] [ dscp integer ];
   	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
   	    * ) ] [ dscp integer ];
   	answer-cookie boolean;
   	attach-cache string;
-  	auth-nxdomain boolean; // default changed
+  	auth-nxdomain boolean;
   	auto-dnssec ( allow | maintain | off );
   	automatic-interface-scan boolean;
   	avoid-v4-udp-ports { portrange; ... };
@@ -176,8 +186,9 @@ OPTIONS
   	catalog-zones { zone string [ default-masters [ port integer ]
   	    [ dscp integer ] { ( primaries | ipv4_address [ port
   	    integer ] | ipv6_address [ port integer ] ) [ key
-  	    string ]; ... } ] [ zone-directory quoted_string ] [
-  	    in-memory boolean ] [ min-update-interval duration ]; ... };
+  	    string ] [ tls string ]; ... } ] [ zone-directory
+  	    quoted_string ] [ in-memory boolean ] [ min-update-interval
+  	    duration ]; ... };
   	check-dup-records ( fail | warn | ignore );
   	check-integrity boolean;
   	check-mx ( fail | warn | ignore );
@@ -262,6 +273,8 @@ OPTIONS
   	glue-cache boolean;// deprecated
   	heartbeat-interval integer;
   	hostname ( quoted_string | none );
+  	http-port integer;
+  	https-port integer;
   	inline-signing boolean;
   	interface-interval duration;
   	ipv4only-contact string;
@@ -273,10 +286,12 @@ OPTIONS
   	key-directory quoted_string;
   	lame-ttl duration;
   	listen-on [ port integer ] [ dscp
-  	    integer ] [ tls string ] {
+  	    integer ] [ tls string ] [ http
+  	    string ] {
   	    address_match_element; ... };
   	listen-on-v6 [ port integer ] [ dscp
-  	    integer ] [ tls string ] {
+  	    integer ] [ tls string ] [ http
+  	    string ] {
   	    address_match_element; ... };
   	lmdb-mapsize sizeval;
   	lock-file ( quoted_string | none );
@@ -403,6 +418,7 @@ OPTIONS
   	sig-validity-interval integer [ integer ];
   	sortlist { address_match_element; ... };
   	stacksize ( default | unlimited | sizeval );
+  	stale-answer-client-timeout ( disabled | off | integer );
   	stale-answer-enable boolean;
   	stale-answer-ttl duration;
   	stale-cache-enable boolean;
@@ -460,7 +476,8 @@ PRIMARIES
   primaries string [ port integer ] [ dscp
       integer ] { ( primaries | ipv4_address
       [ port integer ] | ipv6_address [ port
-      integer ] ) [ key string ]; ... };
+      integer ] ) [ key string ] [ tls
+      string ]; ... };
 
 SERVER
 ^^^^^^
@@ -518,8 +535,13 @@ TLS
 ::
 
   tls string {
+  	ca-file quoted_string;
   	cert-file quoted_string;
+  	ciphers string; // experimental
+  	dh-param quoted_string; // experimental
+  	hostname quoted_string;
   	key-file quoted_string;
+  	protocols sslprotos; // experimental
   };
 
 TRUST-ANCHORS
@@ -562,20 +584,21 @@ VIEW
   	allow-update-forwarding { address_match_element; ... };
   	also-notify [ port integer ] [ dscp integer ] { ( primaries |
   	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
+  	    integer ] ) [ key string ] [ tls string ]; ... };
   	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
   	    ] [ dscp integer ];
   	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
   	    * ) ] [ dscp integer ];
   	attach-cache string;
-  	auth-nxdomain boolean; // default changed
+  	auth-nxdomain boolean;
   	auto-dnssec ( allow | maintain | off );
   	cache-file quoted_string;
   	catalog-zones { zone string [ default-masters [ port integer ]
   	    [ dscp integer ] { ( primaries | ipv4_address [ port
   	    integer ] | ipv6_address [ port integer ] ) [ key
-  	    string ]; ... } ] [ zone-directory quoted_string ] [
-  	    in-memory boolean ] [ min-update-interval duration ]; ... };
+  	    string ] [ tls string ]; ... } ] [ zone-directory
+  	    quoted_string ] [ in-memory boolean ] [ min-update-interval
+  	    duration ]; ... };
   	check-dup-records ( fail | warn | ignore );
   	check-integrity boolean;
   	check-mx ( fail | warn | ignore );
@@ -803,6 +826,7 @@ VIEW
   	sig-signing-type integer;
   	sig-validity-interval integer [ integer ];
   	sortlist { address_match_element; ... };
+  	stale-answer-client-timeout ( disabled | off | integer );
   	stale-answer-enable boolean;
   	stale-answer-ttl duration;
   	stale-cache-enable boolean;
@@ -838,8 +862,8 @@ VIEW
   		allow-update-forwarding { address_match_element; ... };
   		also-notify [ port integer ] [ dscp integer ] { (
   		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ];
-  		    ... };
+  		    ipv6_address [ port integer ] ) [ key string ] [
+  		    tls string ]; ... };
   		alt-transfer-source ( ipv4_address | * ) [ port (
   		    integer | * ) ] [ dscp integer ];
   		alt-transfer-source-v6 ( ipv6_address | * ) [ port (
@@ -879,8 +903,8 @@ VIEW
   		masterfile-style ( full | relative );
   		masters [ port integer ] [ dscp integer ] { (
   		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ];
-  		    ... };
+  		    ipv6_address [ port integer ] ) [ key string ] [
+  		    tls string ]; ... };
   		max-ixfr-ratio ( unlimited | percentage );
   		max-journal-size ( default | unlimited | sizeval );
   		max-records integer;
@@ -903,8 +927,8 @@ VIEW
   		notify-to-soa boolean;
   		primaries [ port integer ] [ dscp integer ] { (
   		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ];
-  		    ... };
+  		    ipv6_address [ port integer ] ) [ key string ] [
+  		    tls string ]; ... };
   		request-expire boolean;
   		request-ixfr boolean;
   		serial-update-method ( date | increment | unixtime );
@@ -949,7 +973,7 @@ ZONE
   	allow-update-forwarding { address_match_element; ... };
   	also-notify [ port integer ] [ dscp integer ] { ( primaries |
   	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
+  	    integer ] ) [ key string ] [ tls string ]; ... };
   	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
   	    ] [ dscp integer ];
   	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
@@ -987,7 +1011,7 @@ ZONE
   	masterfile-style ( full | relative );
   	masters [ port integer ] [ dscp integer ] { ( primaries |
   	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
+  	    integer ] ) [ key string ] [ tls string ]; ... };
   	max-ixfr-ratio ( unlimited | percentage );
   	max-journal-size ( default | unlimited | sizeval );
   	max-records integer;
@@ -1010,7 +1034,7 @@ ZONE
   	notify-to-soa boolean;
   	primaries [ port integer ] [ dscp integer ] { ( primaries |
   	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ]; ... };
+  	    integer ] ) [ key string ] [ tls string ]; ... };
   	request-expire boolean;
   	request-ixfr boolean;
   	serial-update-method ( date | increment | unixtime );

bin/named/named.rst

@@ -72,9 +72,9 @@ Options
    When applicable, this option specifies the hardware to use for cryptographic
    operations, such as a secure key store used for signing.
 
-   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
-   cryptographic accelerator or hardware service module. When BIND is
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``). When BIND is
    built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
    defaults to the path of the PKCS#11 provider library specified via
    ``--with-pkcs11``.
@@ -115,7 +115,11 @@ Options
    ``portnum``; if not not specified, the default is port 53. If
    ``value`` is of the form ``tls=<portnum>``, the server will
    listen for TLS queries on ``portnum``; the default is 853.
-
+   If ``value`` is of the form ``https=<portnum>``, the server will
+   listen for HTTPS queries on ``portnum``; the default is 443.
+   If ``value`` is of the form ``http=<portnum>``, the server will
+   listen for HTTP queries on ``portnum``; the default is 80.
+   
 ``-s``
    This option writes memory usage statistics to ``stdout`` on exit.
 

bin/named/server.c

@@ -101,8 +101,10 @@
 #include <dst/result.h>
 
 #include <isccfg/grammar.h>
+#include <isccfg/httpconf.h>
 #include <isccfg/kaspconf.h>
 #include <isccfg/namedconf.h>
+#include <isccfg/tlsconf.h>
 
 #include <ns/client.h>
 #include <ns/hooks.h>
@@ -123,6 +125,7 @@
 #include <named/server.h>
 #include <named/statschannel.h>
 #include <named/tkeyconf.h>
+#include <named/transportconf.h>
 #include <named/tsigconf.h>
 #include <named/zoneconf.h>
 #ifdef HAVE_LIBSCF
@@ -396,14 +399,24 @@ fatal(named_server_t *server, const char *msg, isc_result_t result);
 static void
 named_server_reload(isc_task_t *task, isc_event_t *event);
 
+static isc_result_t
+ns_listenelt_from_http(isc_cfg_http_obj_t *http, isc_cfg_tls_obj_t *tls,
+		       in_port_t port, isc_mem_t *mctx,
+		       ns_listenelt_t **target);
+
 static isc_result_t
 ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 			cfg_aclconfctx_t *actx, isc_mem_t *mctx,
-			uint16_t family, ns_listenelt_t **target);
+			uint16_t family, isc_cfg_http_storage_t *http_servers,
+			isc_cfg_tls_data_storage_t *tls_storage,
+			ns_listenelt_t **target);
+
 static isc_result_t
 ns_listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
 			 cfg_aclconfctx_t *actx, isc_mem_t *mctx,
-			 uint16_t family, ns_listenlist_t **target);
+			 uint16_t family, isc_cfg_http_storage_t *http_servers,
+			 isc_cfg_tls_data_storage_t *tls_storage,
+			 ns_listenlist_t **target);
 
 static isc_result_t
 configure_forward(const cfg_obj_t *config, dns_view_t *view,
@@ -3988,6 +4001,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	uint32_t max_stale_ttl = 0;
 	uint32_t stale_refresh_time = 0;
 	dns_tsig_keyring_t *ring = NULL;
+	dns_transport_list_t *transports = NULL;
 	dns_view_t *pview = NULL; /* Production view */
 	isc_mem_t *cmctx = NULL, *hmctx = NULL;
 	dns_dispatch_t *dispatch4 = NULL;
@@ -4485,6 +4499,23 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		view->staleanswersok = dns_stale_answer_conf;
 	}
 
+	obj = NULL;
+	result = named_config_get(maps, "stale-answer-client-timeout", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	if (cfg_obj_isstring(obj)) {
+		/*
+		 * The only string values available for this option
+		 * are "disabled" and "off".
+		 * We use (uint32_t) -1 to represent disabled since
+		 * a value of zero means that stale data can be used
+		 * to promptly answer the query, while an attempt to
+		 * refresh the RRset will still be made in background.
+		 */
+		view->staleanswerclienttimeout = (uint32_t)-1;
+	} else {
+		view->staleanswerclienttimeout = cfg_obj_asuint32(obj);
+	}
+
 	obj = NULL;
 	result = named_config_get(maps, "stale-refresh-time", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -4774,6 +4805,27 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	query_timeout = cfg_obj_asuint32(obj);
 	dns_resolver_settimeout(view->resolver, query_timeout);
 
+	/*
+	 * Adjust stale-answer-client-timeout upper bound
+	 * to be resolver-query-timeout - 1s.
+	 * This assignment is safe as dns_resolver_settimeout()
+	 * ensures that resolver->querytimeout value will be in the
+	 * [MINIMUM_QUERY_TIMEOUT, MAXIMUM_QUERY_TIMEOUT] range and
+	 * MINIMUM_QUERY_TIMEOUT is > 1000 (in ms).
+	 */
+	if (view->staleanswerclienttimeout != (uint32_t)-1 &&
+	    view->staleanswerclienttimeout >
+		    (dns_resolver_gettimeout(view->resolver) - 1000))
+	{
+		view->staleanswerclienttimeout =
+			dns_resolver_gettimeout(view->resolver) - 1000;
+		isc_log_write(
+			named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+			"stale-answer-client-timeout adjusted to %" PRIu32,
+			view->staleanswerclienttimeout);
+	}
+
 	/* Specify whether to use 0-TTL for negative response for SOA query */
 	dns_resolver_setzeronosoattl(view->resolver, zero_no_soattl);
 
@@ -4935,6 +4987,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 		}
 	}
 
+	/*
+	 * Configure the view's transports (DoT/DoH)
+	 */
+	CHECK(named_transports_fromconfig(config, vconfig, view->mctx,
+					  &transports));
+	dns_view_settransports(view, transports);
+	dns_transport_list_detach(&transports);
+
 	/*
 	 * Configure the view's TSIG keys.
 	 */
@@ -6540,7 +6600,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	}
 
 	if (zone != NULL &&
-	    !named_zone_reusable(zone, zconfig, vconfig, config)) {
+	    !named_zone_reusable(zone, zconfig, vconfig, config, aclconf))
+	{
 		dns_zone_detach(&zone);
 	}
 
@@ -6620,8 +6681,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 			      strcasecmp(ztypestr, "slave") == 0));
 
 	if (zone_maybe_inline) {
-		inline_signing = named_zone_inlinesigning(zone, zconfig,
-							  vconfig, config);
+		inline_signing = named_zone_inlinesigning(
+			zone, zconfig, vconfig, config, aclconf);
 	}
 	if (inline_signing) {
 		dns_zone_getraw(zone, &raw);
@@ -7455,36 +7516,12 @@ portset_fromconf(isc_portset_t *portset, const cfg_obj_t *ports,
 
 static isc_result_t
 removed(dns_zone_t *zone, void *uap) {
-	const char *type;
-
 	if (dns_zone_getview(zone) != uap) {
 		return (ISC_R_SUCCESS);
 	}
 
-	switch (dns_zone_gettype(zone)) {
-	case dns_zone_master:
-		type = "primary";
-		break;
-	case dns_zone_slave:
-		type = "secondary";
-		break;
-	case dns_zone_mirror:
-		type = "mirror";
-		break;
-	case dns_zone_stub:
-		type = "stub";
-		break;
-	case dns_zone_staticstub:
-		type = "static-stub";
-		break;
-	case dns_zone_redirect:
-		type = "redirect";
-		break;
-	default:
-		type = "other";
-		break;
-	}
-	dns_zone_log(zone, ISC_LOG_INFO, "(%s) removed", type);
+	dns_zone_log(zone, ISC_LOG_INFO, "(%s) removed",
+		     dns_zonetype_name(dns_zone_gettype(zone)));
 	return (ISC_R_SUCCESS);
 }
 
@@ -8480,6 +8517,8 @@ load_configuration(const char *filename, named_server_t *server,
 	unsigned int initial, idle, keepalive, advertised;
 	dns_aclenv_t *env =
 		ns_interfacemgr_getaclenv(named_g_server->interfacemgr);
+	isc_cfg_tls_data_storage_t tls_storage;
+	isc_cfg_http_storage_t http_storage;
 
 	ISC_LIST_INIT(kasplist);
 	ISC_LIST_INIT(viewlist);
@@ -8487,6 +8526,9 @@ load_configuration(const char *filename, named_server_t *server,
 	ISC_LIST_INIT(cachelist);
 	ISC_LIST_INIT(altsecrets);
 
+	cfg_tls_storage_init(named_g_mctx, &tls_storage);
+	cfg_http_storage_init(named_g_mctx, &http_storage);
+
 	/* Create the ACL configuration context */
 	if (named_g_aclconfctx != NULL) {
 		cfg_aclconfctx_detach(&named_g_aclconfctx);
@@ -8548,6 +8590,19 @@ load_configuration(const char *filename, named_server_t *server,
 	maps[i++] = named_g_defaults;
 	maps[i] = NULL;
 
+	obj = NULL;
+	result = named_config_get(maps, "http-port", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	named_g_http_port = (in_port_t)cfg_obj_asuint32(obj);
+
+	obj = NULL;
+	result = named_config_get(maps, "https-port", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	named_g_http_secure_port = (in_port_t)cfg_obj_asuint32(obj);
+
+	CHECK(cfg_tls_storage_load(config, &tls_storage));
+	CHECK(cfg_http_storage_load(config, &http_storage));
+
 	/*
 	 * If bind.keys exists, load it.  If "dnssec-validation auto"
 	 * is turned on, the root key found there will be used as a
@@ -8966,7 +9021,8 @@ load_configuration(const char *filename, named_server_t *server,
 			/* check return code? */
 			(void)ns_listenlist_fromconfig(
 				clistenon, config, named_g_aclconfctx,
-				named_g_mctx, AF_INET, &listenon);
+				named_g_mctx, AF_INET, &http_storage,
+				&tls_storage, &listenon);
 		} else {
 			/*
 			 * Not specified, use default.
@@ -8994,7 +9050,8 @@ load_configuration(const char *filename, named_server_t *server,
 			/* check return code? */
 			(void)ns_listenlist_fromconfig(
 				clistenon, config, named_g_aclconfctx,
-				named_g_mctx, AF_INET6, &listenon);
+				named_g_mctx, AF_INET6, &http_storage,
+				&tls_storage, &listenon);
 		} else {
 			/*
 			 * Not specified, use default.
@@ -9755,6 +9812,9 @@ cleanup:
 		isc_task_endexclusive(server->task);
 	}
 
+	cfg_http_storage_uninit(&http_storage);
+	cfg_tls_storage_uninit(&tls_storage);
+
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
 		      "load_configuration: %s", isc_result_totext(result));
@@ -10754,7 +10814,16 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 	{
 		dns_zone_forcereload(zone);
 	} else {
-		result = ISC_R_NOTFOUND;
+		(void)putstr(text, "retransfer: inappropriate zone type: ");
+		(void)putstr(text, dns_zonetype_name(type));
+		if (type == dns_zone_redirect) {
+			type = dns_zone_getredirecttype(zone);
+			(void)putstr(text, "(");
+			(void)putstr(text, dns_zonetype_name(type));
+			(void)putstr(text, ")");
+		}
+		(void)putnull(text);
+		result = ISC_R_FAILURE;
 	}
 	dns_zone_detach(&zone);
 	return (result);
@@ -10953,7 +11022,9 @@ named_server_togglequerylog(named_server_t *server, isc_lex_t *lex) {
 static isc_result_t
 ns_listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
 			 cfg_aclconfctx_t *actx, isc_mem_t *mctx,
-			 uint16_t family, ns_listenlist_t **target) {
+			 uint16_t family, isc_cfg_http_storage_t *http_servers,
+			 isc_cfg_tls_data_storage_t *tls_storage,
+			 ns_listenlist_t **target) {
 	isc_result_t result;
 	const cfg_listelt_t *element;
 	ns_listenlist_t *dlist = NULL;
@@ -10971,7 +11042,8 @@ ns_listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
 		ns_listenelt_t *delt = NULL;
 		const cfg_obj_t *listener = cfg_listelt_value(element);
 		result = ns_listenelt_fromconfig(listener, config, actx, mctx,
-						 family, &delt);
+						 family, http_servers,
+						 tls_storage, &delt);
 		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
@@ -10992,14 +11064,18 @@ cleanup:
 static isc_result_t
 ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 			cfg_aclconfctx_t *actx, isc_mem_t *mctx,
-			uint16_t family, ns_listenelt_t **target) {
+			uint16_t family, isc_cfg_http_storage_t *http_servers,
+			isc_cfg_tls_data_storage_t *tls_storage,
+			ns_listenelt_t **target) {
 	isc_result_t result;
-	const cfg_obj_t *tlsobj, *portobj, *dscpobj;
-	in_port_t port;
+	const cfg_obj_t *tlsobj, *portobj, *dscpobj, *httpobj;
+	in_port_t port = 0;
 	isc_dscp_t dscp = -1;
 	const char *key = NULL, *cert = NULL;
-	bool tls = false;
+	bool tls = false, http = false;
 	ns_listenelt_t *delt = NULL;
+	isc_cfg_http_obj_t *http_server = NULL;
+	isc_cfg_tls_obj_t *tls_cert = NULL;
 	REQUIRE(target != NULL && *target == NULL);
 
 	/* XXXWPK TODO be more verbose on failures. */
@@ -11008,43 +11084,60 @@ ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 		if (!strcmp(cfg_obj_asstring(tlsobj), "ephemeral")) {
 			tls = true;
 		} else {
-			const cfg_obj_t *tlsconfigs = NULL;
-			const cfg_listelt_t *element;
-			(void)cfg_map_get(config, "tls", &tlsconfigs);
-			for (element = cfg_list_first(tlsconfigs);
-			     element != NULL; element = cfg_list_next(element))
-			{
-				cfg_obj_t *tconfig = cfg_listelt_value(element);
-				const cfg_obj_t *name =
-					cfg_map_getname(tconfig);
-				if (!strcmp(cfg_obj_asstring(name),
-					    cfg_obj_asstring(tlsobj))) {
-					tls = true;
-					const cfg_obj_t *keyo = NULL,
-							*certo = NULL;
-					(void)cfg_map_get(tconfig, "key-file",
-							  &keyo);
-					if (keyo == NULL) {
-						return (ISC_R_FAILURE);
-					}
-					(void)cfg_map_get(tconfig, "cert-file",
-							  &certo);
-					if (certo == NULL) {
-						return (ISC_R_FAILURE);
-					}
-					key = cfg_obj_asstring(keyo);
-					cert = cfg_obj_asstring(certo);
-					break;
-				}
+			tls_cert = cfg_tls_storage_find(
+				cfg_obj_asstring(tlsobj), tls_storage);
+			if (tls_cert != NULL) {
+				tls = true;
+				key = tls_cert->key_file;
+				cert = tls_cert->cert_file;
+				INSIST(key != NULL);
+				INSIST(cert != NULL);
 			}
 		}
 		if (!tls) {
 			return (ISC_R_FAILURE);
 		}
 	}
+	httpobj = cfg_tuple_get(listener, "http");
+	if (httpobj != NULL && cfg_obj_isstring(httpobj)) {
+		if (tls && tls_cert == NULL) {
+			return (ISC_R_FAILURE);
+		}
+		http = true;
+		http_server = cfg_http_find(cfg_obj_asstring(httpobj),
+					    http_servers);
+		if (http_server == NULL) {
+			isc_log_write(
+				named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+				"HTTP(S) server \"%s\" is nowhere to be found",
+				cfg_obj_asstring(httpobj));
+			return (ISC_R_FAILURE);
+		}
+	}
 	portobj = cfg_tuple_get(listener, "port");
 	if (!cfg_obj_isuint32(portobj)) {
-		if (tls) {
+		if (http && tls) {
+			if (named_g_http_secure_port != 0) {
+				port = named_g_http_secure_port;
+			} else {
+				result = named_config_getport(
+					config, "https-port", &port);
+				if (result != ISC_R_SUCCESS) {
+					return (result);
+				}
+			}
+		} else if (http && !tls) {
+			if (named_g_http_port != 0) {
+				port = named_g_port;
+			} else {
+				result = named_config_getport(
+					config, "http-port", &port);
+				if (result != ISC_R_SUCCESS) {
+					return (result);
+				}
+			}
+		} else if (tls) {
 			if (named_g_tlsport != 0) {
 				port = named_g_tlsport;
 			} else {
@@ -11088,8 +11181,14 @@ ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 		dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
 	}
 
-	result = ns_listenelt_create(mctx, port, dscp, NULL, tls, key, cert,
-				     &delt);
+	if (http) {
+		INSIST(http_server != NULL);
+		result = ns_listenelt_from_http(http_server, tls_cert, port,
+						mctx, &delt);
+	} else {
+		result = ns_listenelt_create(mctx, port, dscp, NULL, tls, key,
+					     cert, &delt);
+	}
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -11105,6 +11204,66 @@ ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 	return (ISC_R_SUCCESS);
 }
 
+/*
+ * Create a listen list for HTTP/HTTPS
+ */
+static isc_result_t
+ns_listenelt_from_http(isc_cfg_http_obj_t *http, isc_cfg_tls_obj_t *tls,
+		       in_port_t port, isc_mem_t *mctx,
+		       ns_listenelt_t **target) {
+	isc_result_t result = ISC_R_SUCCESS;
+	ns_listenelt_t *delt = NULL;
+	const char *key = NULL, *cert = NULL;
+	char **http_endpoints = NULL;
+	size_t http_endpoints_number;
+	isc_cfg_http_endpoint_t *ep;
+	size_t i = 0;
+	REQUIRE(target != NULL && *target == NULL);
+
+	if (tls) {
+		INSIST(tls->key_file != NULL);
+		INSIST(tls->cert_file != NULL);
+		key = tls->key_file;
+		cert = tls->cert_file;
+	}
+
+	if (port == 0) {
+		port = tls != NULL ? named_g_http_secure_port
+				   : named_g_http_port;
+	}
+
+	for (ep = ISC_LIST_HEAD(http->endpoints), i = 0; ep != NULL;
+	     ep = ISC_LIST_NEXT(ep, link), i++)
+		;
+
+	INSIST(i > 0);
+
+	http_endpoints_number = i;
+	http_endpoints = isc_mem_allocate(mctx, sizeof(http_endpoints[0]) *
+							http_endpoints_number);
+	for (ep = ISC_LIST_HEAD(http->endpoints), i = 0; ep != NULL;
+	     ep = ISC_LIST_NEXT(ep, link), i++)
+	{
+		http_endpoints[i] = isc_mem_strdup(mctx, ep->path);
+	}
+
+	INSIST(i == http_endpoints_number);
+
+	result = ns_listenelt_create_http(mctx, port, named_g_dscp, NULL, key,
+					  cert, http_endpoints,
+					  http_endpoints_number, &delt);
+
+	if (result != ISC_R_SUCCESS) {
+		if (delt != NULL) {
+			ns_listenelt_destroy(delt);
+		}
+		return result;
+	}
+
+	*target = delt;
+	return (result);
+}
+
 isc_result_t
 named_server_dumpstats(named_server_t *server) {
 	isc_result_t result;
@@ -15123,34 +15282,7 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 		zonetype = dns_zone_gettype(zone);
 	}
 
-	switch (zonetype) {
-	case dns_zone_master:
-		type = "primary";
-		break;
-	case dns_zone_slave:
-		type = "secondary";
-		break;
-	case dns_zone_mirror:
-		type = "mirror";
-		break;
-	case dns_zone_stub:
-		type = "stub";
-		break;
-	case dns_zone_staticstub:
-		type = "staticstub";
-		break;
-	case dns_zone_redirect:
-		type = "redirect";
-		break;
-	case dns_zone_key:
-		type = "key";
-		break;
-	case dns_zone_dlz:
-		type = "dlz";
-		break;
-	default:
-		type = "unknown";
-	}
+	type = dns_zonetype_name(zonetype);
 
 	/* Serial number */
 	result = dns_zone_getserial(mayberaw, &serial);

bin/named/statschannel.c

@@ -2336,12 +2336,12 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	TRY0(xmlTextWriterEndElement(writer)); /* /statistics */
 	TRY0(xmlTextWriterEndDocument(writer));
 
-	xmlFreeTextWriter(writer);
-
 	xmlDocDumpFormatMemoryEnc(doc, buf, buflen, "UTF-8", 0);
 	if (*buf == NULL) {
 		goto cleanup;
 	}
+
+	xmlFreeTextWriter(writer);
 	xmlFreeDoc(doc);
 	return (ISC_R_SUCCESS);
 

bin/named/transportconf.c

@@ -0,0 +1,201 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <inttypes.h>
+
+#include <isc/buffer.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+#include <dns/name.h>
+#include <dns/transport.h>
+
+#include <isccfg/cfg.h>
+
+#include <named/log.h>
+#include <named/transportconf.h>
+
+#define create_name(id, name)                                      \
+	isc_buffer_t namesrc, namebuf;                             \
+	char namedata[DNS_NAME_FORMATSIZE + 1];                    \
+	dns_name_init(name, NULL);                                 \
+	isc_buffer_constinit(&namesrc, id, strlen(id));            \
+	isc_buffer_add(&namesrc, strlen(id));                      \
+	isc_buffer_init(&namebuf, namedata, sizeof(namedata));     \
+	result = (dns_name_fromtext(name, &namesrc, dns_rootname,  \
+				    DNS_NAME_DOWNCASE, &namebuf)); \
+	if (result != ISC_R_SUCCESS) {                             \
+		goto failure;                                      \
+	}
+
+#define parse_transport_option(map, transport, name, setter)      \
+	{                                                         \
+		const cfg_obj_t *obj = NULL;                      \
+		cfg_map_get(map, name, &obj);                     \
+		if (obj != NULL) {                                \
+			setter(transport, cfg_obj_asstring(obj)); \
+		}                                                 \
+	}
+
+static isc_result_t
+add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
+	const cfg_obj_t *doh = NULL;
+	const char *dohid = NULL;
+	isc_result_t result;
+
+	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
+	     element != NULL; element = cfg_list_next(element))
+	{
+		dns_name_t dohname;
+		dns_transport_t *transport;
+
+		doh = cfg_listelt_value(element);
+		dohid = cfg_obj_asstring(cfg_map_getname(doh));
+
+		create_name(dohid, &dohname);
+
+		transport = dns_transport_new(&dohname, DNS_TRANSPORT_DOH,
+					      list);
+
+		parse_transport_option(doh, transport, "key-file",
+				       dns_transport_set_keyfile);
+		parse_transport_option(doh, transport, "cert-file",
+				       dns_transport_set_certfile);
+		parse_transport_option(doh, transport, "ca-file",
+				       dns_transport_set_cafile);
+		parse_transport_option(doh, transport, "hostname",
+				       dns_transport_set_hostname);
+	}
+
+	return (ISC_R_SUCCESS);
+failure:
+	cfg_obj_log(doh, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring DoH '%s': %s", dohid,
+		    isc_result_totext(result));
+
+	return (result);
+}
+
+static isc_result_t
+add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
+	const cfg_obj_t *tls = NULL;
+	const char *tlsid = NULL;
+	isc_result_t result;
+
+	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
+	     element != NULL; element = cfg_list_next(element))
+	{
+		dns_name_t tlsname;
+		dns_transport_t *transport;
+
+		tls = cfg_listelt_value(element);
+		tlsid = cfg_obj_asstring(cfg_map_getname(tls));
+
+		if (!strcmp(tlsid, "ephemeral")) {
+			result = ISC_R_UNEXPECTEDTOKEN;
+			goto failure;
+		}
+
+		create_name(tlsid, &tlsname);
+
+		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
+					      list);
+
+		parse_transport_option(tls, transport, "key-file",
+				       dns_transport_set_keyfile);
+		parse_transport_option(tls, transport, "cert-file",
+				       dns_transport_set_certfile);
+		parse_transport_option(tls, transport, "ca-file",
+				       dns_transport_set_cafile);
+		parse_transport_option(tls, transport, "hostname",
+				       dns_transport_set_hostname);
+	}
+
+	return (ISC_R_SUCCESS);
+failure:
+	cfg_obj_log(tls, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring tls '%s': %s", tlsid,
+		    isc_result_totext(result));
+
+	return (result);
+}
+
+#define CHECK(f)                             \
+	if ((result = f) != ISC_R_SUCCESS) { \
+		goto failure;                \
+	}
+
+static isc_result_t
+transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
+	const cfg_obj_t *obj = NULL;
+	isc_result_t result = ISC_R_SUCCESS;
+
+	if (result == ISC_R_SUCCESS &&
+	    cfg_map_get(config, "tls", &obj) == ISC_R_SUCCESS)
+	{
+		result = add_tls_transports(obj, list);
+		obj = NULL;
+	}
+
+	if (result == ISC_R_SUCCESS &&
+	    cfg_map_get(config, "doh", &obj) == ISC_R_SUCCESS)
+	{
+		result = add_doh_transports(obj, list);
+		obj = NULL;
+	}
+
+	return (result);
+}
+
+static void
+transport_list_add_ephemeral(dns_transport_list_t *list) {
+	isc_result_t result;
+	dns_name_t tlsname;
+
+	create_name("ephemeral", &tlsname);
+
+	(void)dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, list);
+
+	return;
+failure:
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+}
+
+isc_result_t
+named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
+			    isc_mem_t *mctx, dns_transport_list_t **listp) {
+	isc_result_t result;
+	dns_transport_list_t *list = dns_transport_list_new(mctx);
+
+	REQUIRE(listp != NULL && *listp == NULL);
+
+	transport_list_add_ephemeral(list);
+
+	if (config != NULL) {
+		result = transport_list_fromconfig(config, list);
+		if (result != ISC_R_SUCCESS) {
+			goto failure;
+		}
+	}
+
+	if (vconfig != NULL) {
+		config = cfg_tuple_get(vconfig, "options");
+		transport_list_fromconfig(config, list);
+	}
+
+	*listp = list;
+	return (ISC_R_SUCCESS);
+failure:
+	dns_transport_list_detach(&list);
+	return (result);
+}

bin/named/win32/named.vcxproj.filters.in

@@ -59,6 +59,9 @@
     <ClCompile Include="..\tkeyconf.c">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="..\transportconf.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="..\tsigconf.c">
       <Filter>Source Files</Filter>
     </ClCompile>
@@ -111,6 +114,9 @@
     <ClInclude Include="..\include\named\tkeyconf.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="..\include\named\transportconf.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="..\include\named\tsigconf.h">
       <Filter>Header Files</Filter>
     </ClInclude>

bin/named/win32/named.vcxproj.in

@@ -138,6 +138,7 @@ perl -e "print \";\";" >> xsl.c
     <ClCompile Include="..\server.c" />
     <ClCompile Include="..\statschannel.c" />
     <ClCompile Include="..\tkeyconf.c" />
+    <ClCompile Include="..\transportconf.c" />
     <ClCompile Include="..\tsigconf.c" />
     <ClCompile Include="..\xsl.c" />
     <ClCompile Include="..\zoneconf.c" />
@@ -159,6 +160,7 @@ perl -e "print \";\";" &gt;&gt; xsl.c
     <ClInclude Include="..\include\named\server.h" />
     <ClInclude Include="..\include\named\statschannel.h" />
     <ClInclude Include="..\include\named\tkeyconf.h" />
+    <ClInclude Include="..\include\named\transportconf.h" />
     <ClInclude Include="..\include\named\tsigconf.h" />
     <ClInclude Include="..\include\named\types.h" />
     <ClInclude Include="..\xsl_p.h" />

bin/named/zoneconf.c

@@ -176,7 +176,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 
 parse_acl:
 	result = cfg_acl_fromconfig(aclobj, config, named_g_lctx, actx,
-				    dns_zone_getmctx(zone), 0, &acl);
+				    named_g_mctx, 0, &acl);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -1302,13 +1302,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 
 			RETERR(named_config_getipandkeylist(config, obj, mctx,
 							    &ipkl));
-			result = dns_zone_setalsonotifydscpkeys(
-				zone, ipkl.addrs, ipkl.dscps, ipkl.keys,
-				ipkl.count);
+			result = dns_zone_setalsonotify(zone, ipkl.addrs,
+							ipkl.dscps, ipkl.keys,
+							ipkl.tlss, ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
 			RETERR(result);
 		} else {
-			RETERR(dns_zone_setalsonotify(zone, NULL, 0));
+			RETERR(dns_zone_setalsonotify(zone, NULL, NULL, NULL,
+						      NULL, 0));
 		}
 
 		obj = NULL;
@@ -1910,13 +1911,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 
 			RETERR(named_config_getipandkeylist(config, obj, mctx,
 							    &ipkl));
-			result = dns_zone_setprimarieswithkeys(
-				mayberaw, ipkl.addrs, ipkl.keys, ipkl.count);
+			result = dns_zone_setprimaries(mayberaw, ipkl.addrs,
+						       ipkl.keys, ipkl.tlss,
+						       ipkl.count);
 			count = ipkl.count;
 			dns_ipkeylist_clear(mctx, &ipkl);
 			RETERR(result);
 		} else {
-			result = dns_zone_setprimaries(mayberaw, NULL, 0);
+			result = dns_zone_setprimaries(mayberaw, NULL, NULL,
+						       NULL, 0);
 		}
 		RETERR(result);
 
@@ -2068,7 +2071,8 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 
 bool
 named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
-		    const cfg_obj_t *vconfig, const cfg_obj_t *config) {
+		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
+		    cfg_aclconfctx_t *actx) {
 	const cfg_obj_t *zoptions = NULL;
 	const cfg_obj_t *obj = NULL;
 	const char *cfilename;
@@ -2103,7 +2107,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	}
 
 	inline_signing = named_zone_inlinesigning(zone, zconfig, vconfig,
-						  config);
+						  config, actx);
 	if (!inline_signing && has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was inline-signing");
@@ -2141,7 +2145,8 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 
 bool
 named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
-			 const cfg_obj_t *vconfig, const cfg_obj_t *config) {
+			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
+			 cfg_aclconfctx_t *actx) {
 	isc_result_t res;
 	const cfg_obj_t *zoptions = NULL;
 	const cfg_obj_t *voptions = NULL;
@@ -2181,7 +2186,6 @@ named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
 		}
 		if (res == ISC_R_SUCCESS) {
 			dns_acl_t *acl = NULL;
-			cfg_aclconfctx_t *actx = NULL;
 			res = cfg_acl_fromconfig(
 				allowupdate, config, named_g_lctx, actx,
 				dns_zone_getmctx(zone), 0, &acl);
@@ -2209,11 +2213,9 @@ named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	{
 		if (strcmp(cfg_obj_asstring(signing), "none") != 0) {
 			inline_signing = true;
-			dns_zone_log(
-				zone, ISC_LOG_DEBUG(1), "inline-signing: %s",
-				inline_signing
-					? "implicitly through dnssec-policy"
-					: "no");
+			dns_zone_log(zone, ISC_LOG_DEBUG(1),
+				     "inline-signing: "
+				     "implicitly through dnssec-policy");
 		} else {
 			inline_signing = dns_zone_secure_to_insecure(zone,
 								     true);

bin/tests/.gitignore

@@ -8,3 +8,6 @@ dlopen
 keycreate
 keydelete
 gssapi_krb
+/wire_test
+/test_client
+/test_server

bin/tests/Makefile.am

@@ -2,13 +2,33 @@ include $(top_srcdir)/Makefile.top
 
 SUBDIRS = system
 
-noinst_PROGRAMS = wire_test
+noinst_PROGRAMS =	\
+	test_client	\
+	test_server	\
+	wire_test
 
-AM_CPPFLAGS +=			\
+test_client_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(LIBISC_CFLAGS)
+
+test_client_LDADD =		\
+	$(LIBISC_LIBS)		\
+	$(LIBDNS_LIBS)
+
+test_server_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(LIBISC_CFLAGS)
+
+test_server_LDADD =		\
+	$(LIBISC_LIBS)		\
+	$(LIBDNS_LIBS)
+
+wire_test_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)
 
-LDADD =				\
+wire_test_LDADD =		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)
 

bin/tests/named.conf

@@ -26,9 +26,6 @@
 // watch out for ";" -- it's important!
 
 options {
-	additional-from-auth true;
-	additional-from-cache false;
-
 	version "my version string";
 	random-device "/dev/random";
 	directory "/tmp";
@@ -265,8 +262,6 @@ view "test-view" in {
 	sig-validity-interval 45;
 	max-cache-size 100000;
 	allow-query { 10.0.0.30;};
-	additional-from-cache false;
-	additional-from-auth no;
 	match-clients { 10.0.0.1 ; };
 	check-names master warn;
 	check-names slave ignore;
@@ -418,9 +413,6 @@ server 1.2.3.4 {
 	keys { "sample_key" };	// for TSIG; supported by the parser
 					// but not yet implemented in the
 					// rest of the server
-# Now called 'request-ixfr'
-#	support-ixfr yes;      // for IXFR supported by server
-					// if yes, the listed server talks IXFR
 };
 
 logging {

bin/tests/system/Makefile.am

@@ -151,6 +151,7 @@ TESTS +=			\
 	views			\
 	wildcard		\
 	xferquota		\
+	xot			\
 	zonechecks
 
 # eddsa test is broken

bin/tests/system/checkconf/dnssec.1

@@ -9,6 +9,17 @@
  * information regarding copyright ownership.
  */
 
-options {
-	dnssec-enable no;
+view view1 {
+	match-clients { any; };
+	dnssec-validation yes;
+};
+
+view view2 {
+	match-clients { none; };
+	dnssec-validation auto;
+};
+
+view view3 {
+	match-clients { none; };
+	auto-dnssec maintain;
 };

bin/tests/system/checkconf/dnssec.2

@@ -11,15 +11,22 @@
 
 view view1 {
 	match-clients { any; };
-	dnssec-validation yes;
 };
 
 view view2 {
 	match-clients { none; };
-	dnssec-validation auto;
 };
 
 view view3 {
 	match-clients { none; };
-	auto-dnssec maintain;
+	dnssec-validation auto;
+};
+
+view view4 {
+	match-clients { none; };
+};
+
+view view5 {
+	match-clients { none; };
+	auto-dnssec off;
 };

bin/tests/system/checkconf/dnssec.3

@@ -1,32 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-view view1 {
-	match-clients { any; };
-};
-
-view view2 {
-	match-clients { none; };
-};
-
-view view3 {
-	match-clients { none; };
-	dnssec-validation auto;
-};
-
-view view4 {
-	match-clients { none; };
-};
-
-view view5 {
-	match-clients { none; };
-	auto-dnssec off;
-};

bin/tests/system/checkconf/good-doh-global.conf

@@ -9,6 +9,19 @@
  * information regarding copyright ownership.
  */
 
+tls local-tls {
+	key-file "key.pem";
+	cert-file "cert.pem";
+};
+
+http local-http-server {
+	endpoints { "/dns-query"; };
+};
+
 options {
-	dnssec-lookaside . trust-anchor dlv.isc.org;
+	listen-on { 10.53.0.1; };
+	http-port 80;
+	https-port 443;
+	listen-on port 443 tls local-tls http local-http-server { 10.53.0.1; };
+	listen-on port 8080 http local-http-server { 10.53.0.1; };
 };

bin/tests/system/checkconf/good-dot-global.conf

@@ -9,6 +9,11 @@
  * information regarding copyright ownership.
  */
 
+tls local-tls {
+	key-file "key.pem";
+	cert-file "cert.pem";
+};
+
 options {
-	geoip-use-ecs yes;
+	listen-on port 853 tls local-tls { 10.53.0.1; };
 };

bin/tests/system/checkconf/tests.sh

@@ -78,6 +78,24 @@ do
 	status=`expr $status + $ret`
 done
 
+for lmdb in lmdb-*.conf
+do
+	n=`expr $n + 1`
+	ret=0
+
+	$FEATURETEST --with-lmdb
+	if [ $? -eq 0 ]; then
+		echo_i "checking that named-checkconf detects no error in $lmdb ($n)"
+		$CHECKCONF $lmdb > checkconf.out$n 2>&1
+		if [ $? != 0 ]; then echo_i "failed"; ret=1; fi
+	else
+		echo_i "checking that named-checkconf detects error in $lmdb ($n)"
+		$CHECKCONF $lmdb > checkconf.out$n 2>&1
+		if [ $? == 0 ]; then echo_i "failed"; ret=1; fi
+	fi
+	status=`expr $status + $ret`
+done
+
 n=`expr $n + 1`
 echo_i "checking that ancient options report a fatal error ($n)"
 ret=0
@@ -113,14 +131,11 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking named-checkconf dnssec warnings ($n)"
 ret=0
-# dnssec.1: dnssec-enable is obsolete
-$CHECKCONF dnssec.1 > checkconf.out$n.1 2>&1
-grep "'dnssec-enable' is obsolete and should be removed" < checkconf.out$n.1 > /dev/null || ret=1
-# dnssec.2: auto-dnssec warning
-$CHECKCONF dnssec.2 > checkconf.out$n.2 2>&1
+# dnssec.1: auto-dnssec warning
+$CHECKCONF dnssec.1 > checkconf.out$n.2 2>&1
 grep 'auto-dnssec may only be ' < checkconf.out$n.2 > /dev/null || ret=1
-# dnssec.3: should have no warnings
-$CHECKCONF dnssec.3 > checkconf.out$n.3 2>&1
+# dnssec.2: should have no warnings
+$CHECKCONF dnssec.2 > checkconf.out$n.3 2>&1
 grep '.*' < checkconf.out$n.3 > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -403,30 +418,6 @@ diff good.zonelist checkconf.out$n > diff.out$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "check that 'dnssec-lookaside auto;' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-dlv-auto.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "option 'dnssec-lookaside' is obsolete and should be removed" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "check that 'dnssec-lookaside . trust-anchor dlv.isc.org;' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-dlv-dlv.isc.org.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "option 'dnssec-lookaside' is obsolete and should be removed" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "check that 'dnssec-lookaside . trust-anchor dlv.example.com;' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-dlv-dlv.example.com.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "option 'dnssec-lookaside' is obsolete and should be removed" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "check that the 2010 ICANN ROOT KSK without the 2017 ICANN ROOT KSK generates a warning ($n)"
 ret=0
@@ -484,15 +475,6 @@ grep "use of managed-keys is not allowed" checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "check that 'geoip-use-ecs no' generates a warning ($n)"
-ret=0
-$CHECKCONF warn-geoip-use-ecs.conf > checkconf.out$n 2>/dev/null || ret=1
-[ -s checkconf.out$n ] || ret=1
-grep "'geoip-use-ecs' is obsolete" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
-
 n=`expr $n + 1`
 echo_i "checking named-checkconf kasp errors ($n)"
 ret=0

bin/tests/system/checkconf/warn-dlv-auto.conf

@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dnssec-lookaside auto;
-};

bin/tests/system/checkconf/warn-dlv-dlv.example.com.conf

@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dnssec-lookaside . trust-anchor dlv.example.com;
-};

bin/tests/system/checkconf/warn-geoip-use-ecs.conf

@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	geoip-use-ecs no;
-};

bin/tests/system/conf.sh.common

@@ -668,6 +668,8 @@ copy_setports() {
     atsign="@"
     sed -e "s/${atsign}PORT${atsign}/${PORT}/g" \
         -e "s/${atsign}TLSPORT${atsign}/${TLSPORT}/g" \
+		-e "s/${atsign}HTTPPORT${atsign}/${HTTPSPORT}/g" \
+        -e "s/${atsign}HTTPSPORT${atsign}/${HTTPSPORT}/g" \
         -e "s/${atsign}EXTRAPORT1${atsign}/${EXTRAPORT1}/g" \
         -e "s/${atsign}EXTRAPORT2${atsign}/${EXTRAPORT2}/g" \
         -e "s/${atsign}EXTRAPORT3${atsign}/${EXTRAPORT3}/g" \

bin/tests/system/cpu/prereq.sh

@@ -18,7 +18,7 @@ case $(uname) in
 	Linux*)
 		;;
 	*)
-		echo_i "cpu test only runs on Linux, skipping test"
+		echo_i "cpu test only runs on Linux"
 		exit 255
 		;;
 esac
@@ -28,3 +28,8 @@ TASKSET=$(command -v "taskset" || true)
 if ! test -x "$TASKSET" ; then
 	exit 255
 fi
+
+if ! $TASKSET fff0 true > /dev/null 2>&1; then
+        echo_i "taskset failed"
+        exit 255
+fi

bin/tests/system/get_ports.sh

@@ -82,6 +82,8 @@ done
 
 echo "export PORT=$(get_port "$baseport")"
 echo "export TLSPORT=$(get_port)"
+echo "export HTTPPORT=$(get_port)"
+echo "export HTTPSPORT=$(get_port)"
 echo "export EXTRAPORT1=$(get_port)"
 echo "export EXTRAPORT2=$(get_port)"
 echo "export EXTRAPORT3=$(get_port)"

bin/tests/system/keepalive/ns2/named.conf.in

@@ -27,7 +27,6 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
-	acache-enable yes;
 	send-cookie yes;
 	tcp-advertised-timeout 150;
 };

bin/tests/system/nsupdate/ns1/named.conf.in

@@ -23,6 +23,10 @@ options {
 	minimal-responses no;
 };
 
+acl named-acl {
+	any;
+};
+
 key rndc_key {
 	secret "1234abcd8765";
 	algorithm hmac-sha256;
@@ -67,7 +71,7 @@ zone "max-ttl.nil" {
 	file "max-ttl.db";
 	max-zone-ttl 300;
 	check-integrity no;
-	allow-update { any; };
+	allow-update { named-acl; };
 	allow-transfer { any; };
 };
 

bin/tests/system/nsupdate/tests.sh

@@ -795,7 +795,7 @@ fi
 
 n=`expr $n + 1`
 ret=0
-echo_i "check TSIG key algorithms ($n)"
+echo_i "check TSIG key algorithms (nsupdate -k) ($n)"
 for alg in md5 sha1 sha224 sha256 sha384 sha512; do
     $NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
 server 10.53.0.1 ${PORT}
@@ -812,6 +812,26 @@ if [ $ret -ne 0 ]; then
     status=1
 fi
 
+n=`expr $n + 1`
+ret=0
+echo_i "check TSIG key algorithms (nsupdate -y) ($n)"
+for alg in md5 sha1 sha224 sha256 sha384 sha512; do
+    secret=$(sed -n 's/.*secret "\(.*\)";.*/\1/p' ns1/${alg}.key)
+    $NSUPDATE -y "hmac-${alg}:${alg}-key:$secret" <<END > /dev/null || ret=1
+server 10.53.0.1 ${PORT}
+update add ${alg}.keytests.nil. 600 A 10.10.10.50
+send
+END
+done
+sleep 2
+for alg in md5 sha1 sha224 sha256 sha384 sha512; do
+    $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.50 > /dev/null 2>&1 || ret=1
+done
+if [ $ret -ne 0 ]; then
+    echo_i "failed"
+    status=1
+fi
+
 n=`expr $n + 1`
 ret=0
 echo_i "check that ttl is capped by max-ttl ($n)"

bin/tests/system/padding/ns2/named.conf.in

@@ -27,7 +27,6 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
 	recursion yes;
-	acache-enable yes;
 	send-cookie yes;
 	response-padding { !10.53.0.8; any; } block-size 64;
 };

bin/tests/system/rndc/tests.sh

@@ -677,5 +677,16 @@ lines=`cat rndc.out.test$n | wc -l`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "check 'rndc retransfer' of primary error message ($n)"
+ret=0
+$RNDCCMD 10.53.0.2 retransfer nil > rndc.out.test$n 2>&1 && ret=1
+grep "rndc: 'retransfer' failed: failure" rndc.out.test$n > /dev/null || ret=1
+grep "retransfer: inappropriate zone type: primary" rndc.out.test$n > /dev/null || ret=1
+lines=`cat rndc.out.test$n | wc -l`
+[ ${lines:-0} -eq 2 ] || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/rrl/tests.sh

@@ -163,8 +163,7 @@ ckstats () {
 #########
 sec_start
 
-# Tests of referrals to "." must be done before the hints are loaded
-#   or with "additional-from-cache no"
+# Tests of referrals to "." must be done before the hints are loaded.
 burst 5 a1.tld3 +norec
 # basic rate limiting
 burst 3 a1.tld2

bin/tests/system/rsabigexponent/README.md

@@ -0,0 +1,24 @@
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
+
+The `rsabigexponent` test is used to `check max-rsa-exponent-size`.
+
+We only run this test on builds without PKCS#11, as we have control over
+the RSA exponent size with plain OpenSSL. We have not explored how to do
+this with PKCS#11, which would require generating such a key and then
+signing a zone with it. Additionally, even with control of the exponent
+size with PKCS#11, generating a DNSKEY with this property and signing
+such a zone would be slow and undesirable for each test run; instead, we
+use a pregenerated DNSKEY and a saved signed zone.  These are located in
+`rsabigexponent/ns2` and currently use RSASHA1 for the `DNSKEY`
+algorithm; however, that may need to be changed in the future.
+
+To generate the `DNSKEY` used in this test, we used `bigkey.c`, as
+dnssec-keygen is not capable of generating such keys.
+
+Do **not** remove `bigkey.c` as it may be needed to generate a new
+`DNSKEY` for testing purposes.
+
+`bigkey` is used to both test that we are not running under PKCS#11 and
+generate a `DNSKEY` key with a large RSA exponent.

bin/tests/system/run.sh.in

@@ -149,7 +149,7 @@ stop_servers() {
 echostart "S:$systest:$(date_with_args)"
 echoinfo  "T:$systest:1:A"
 echoinfo  "A:$systest:System test $systest"
-echoinfo  "I:$systest:PORTS:${PORT},${TLSPORT},${EXTRAPORT1},${EXTRAPORT2},${EXTRAPORT3},${EXTRAPORT4},${EXTRAPORT5},${EXTRAPORT6},${EXTRAPORT7},${EXTRAPORT8},${CONTROLPORT}"
+echoinfo  "I:$systest:PORTS:${PORT},${TLSPORT},${HTTPPORT},${HTTPSPORT},${EXTRAPORT1},${EXTRAPORT2},${EXTRAPORT3},${EXTRAPORT4},${EXTRAPORT5},${EXTRAPORT6},${EXTRAPORT7},${EXTRAPORT8},${CONTROLPORT}"
 
 $PERL ${srcdir}/testsock.pl -p "$PORT"  || {
     echowarn "I:$systest:Network interface aliases not set up.  Skipping test."

bin/tests/system/serve-stale/ans2/ans.pl

@@ -145,7 +145,7 @@ sub reply_handler {
 	$rcode = "NXDOMAIN";
     }
 
-    # mark the answer as authoritative (by setting the 'aa' flag
+    # mark the answer as authoritative (by setting the 'aa' flag)
     return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
 }
 

bin/tests/system/serve-stale/clean.sh

@@ -15,3 +15,4 @@ rm -f */named.run */named.memstats
 rm -f ns*/managed-keys.bind*
 rm -f ns*/named_dump*
 rm -f ns*/named.stats*
+rm -f ns*/named.run.prev

bin/tests/system/serve-stale/ns1/named1.conf.in

@@ -30,6 +30,7 @@ options {
 	max-stale-ttl 3600;
 	stale-answer-ttl 4;
 	stale-answer-enable yes;
+	stale-answer-client-timeout disabled;
 	stale-cache-enable yes;
 	stale-refresh-time 30;
 	servfail-ttl 0;

bin/tests/system/serve-stale/ns1/named2.conf.in

@@ -30,6 +30,7 @@ options {
 	max-stale-ttl 20;
 	stale-answer-ttl 3;
 	stale-answer-enable yes;
+	stale-answer-client-timeout disabled;
 	stale-cache-enable yes;
 	servfail-ttl 0;
 };

bin/tests/system/serve-stale/ns1/named3.conf.in

@@ -30,6 +30,7 @@ options {
 	max-stale-ttl 20;
 	stale-answer-ttl 3;
 	stale-answer-enable yes;
+	stale-answer-client-timeout disabled;
 	stale-cache-enable yes;
 	stale-refresh-time 0;
 	servfail-ttl 0;

bin/tests/system/serve-stale/ns3/named2.conf.in

@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+
+/*
+ * Test default stale-answer-client-timeout value
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion yes;
+	stale-answer-enable yes;
+	stale-cache-enable yes;
+	stale-answer-ttl 3;
+	stale-refresh-time 0;
+	max-stale-ttl 3600;
+	resolver-query-timeout 10;
+};
+
+zone "." {
+	type secondary;
+	primaries { 10.53.0.1; };
+	file "root.bk";
+};

bin/tests/system/serve-stale/ns3/named3.conf.in

@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+
+/*
+ * Test disable of stale-answer-client-timeout.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion yes;
+	stale-answer-enable yes;
+	stale-cache-enable yes;
+	stale-answer-ttl 3;
+	stale-answer-client-timeout off;
+	stale-refresh-time 0;
+	max-stale-ttl 3600;
+	resolver-query-timeout 10;
+};
+
+zone "." {
+	type hint;
+	file "root.db";
+};

bin/tests/system/serve-stale/ns3/named4.conf.in

@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+
+/*
+ * Test stale-answer-client-timeout 0.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion yes;
+	stale-answer-enable yes;
+	stale-cache-enable yes;
+	stale-answer-ttl 3;
+	stale-answer-client-timeout 0;
+	stale-refresh-time 0;
+	resolver-query-timeout 10;
+	max-stale-ttl 3600;
+};
+
+zone "." {
+	type hint;
+	file "root.db";
+};

bin/tests/system/serve-stale/ns3/named5.conf.in

@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+
+/*
+ * Test stale-answer-client-timeout 0.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion yes;
+	stale-answer-enable yes;
+	stale-cache-enable yes;
+	stale-answer-ttl 3;
+	stale-answer-client-timeout 0;
+	stale-refresh-time 4;
+	resolver-query-timeout 10;
+	max-stale-ttl 3600;
+};
+
+zone "." {
+	type hint;
+	file "root.db";
+};

bin/tests/system/serve-stale/ns3/named6.conf.in

@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+
+/*
+ * Test stale-answer-client-timeout 0.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	dnssec-validation no;
+	recursion yes;
+	stale-answer-enable no;
+	stale-cache-enable yes;
+	stale-answer-ttl 3;
+	stale-answer-client-timeout disabled;
+	stale-refresh-time 4;
+	resolver-query-timeout 10;
+	fetches-per-zone 1 fail;
+	fetches-per-server 1 fail;
+	max-stale-ttl 3600;
+};
+
+zone "." {
+	type hint;
+	file "root.db";
+};

bin/tests/system/serve-stale/ns3/root.db

@@ -0,0 +1,11 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+.           300 NS  ns.nil.
+ns.nil.     300 A   10.53.0.1

bin/tests/system/serve-stale/tests.sh

@@ -15,10 +15,10 @@ RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
 DIG="$DIG +time=11"
 
 max_stale_ttl=$(sed -ne 's,^[[:space:]]*max-stale-ttl \([[:digit:]]*\).*,\1,p' $TOP_SRCDIR/bin/named/config.c)
+stale_answer_ttl=$(sed -ne 's,^[[:space:]]*stale-answer-ttl \([[:digit:]]*\).*,\1,p' $TOP_SRCDIR/bin/named/config.c)
 
 status=0
 n=0
-
 #
 # First test server with serve-stale options set.
 #
@@ -187,7 +187,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 # 2. Disable responses from authoritative server.
 # 3. Sleep for TTL duration so rrset TTL expires (2 sec)
 # 4. Query data.example
-# 5. Check if response come from stale rrset (3 sec TTL)
+# 5. Check if response come from stale rrset (4 sec TTL)
 # 6. Enable responses from authoritative server.
 # 7. Query data.example
 # 8. Check if response come from stale rrset, since the query
@@ -547,8 +547,8 @@ grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
-# keep track of time so we can access these rrset later,
-# when we expect them to become ancient.
+# Keep track of time so we can access these RRset later, when we expect them
+# to become ancient.
 t1=`$PERL -e 'print time()'`
 
 n=$((n+1))
@@ -643,16 +643,16 @@ grep "1 #NXDOMAIN" ns1/named.stats.$n.cachedb > /dev/null || ret=1
 status=$((status+ret))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 
-# retrieve max-stale-ttl value,
+# Retrieve max-stale-ttl value.
 interval_to_ancient=`grep 'max-stale-ttl' ns1/named2.conf.in  | awk '{ print $2 }' | tr -d ';'`
-# we add 2 seconds to it since this is the ttl value of the records being tested.
+# We add 2 seconds to it since this is the ttl value of the records being
+# tested.
 interval_to_ancient=$((interval_to_ancient + 2))
 t2=`$PERL -e 'print time()'`
 elapsed=$((t2 - t1))
 
-# if elapsed time so far is less than max-stale-ttl + 2 seconds,
-# then we sleep enough to ensure that we'll ask for ancient rrsets
-# in the next queries.
+# If elapsed time so far is less than max-stale-ttl + 2 seconds, then we sleep
+# enough to ensure that we'll ask for ancient RRsets in the next queries.
 if [ $elapsed -lt $interval_to_ancient ]; then
     sleep $((interval_to_ancient - elapsed))
 fi
@@ -884,7 +884,7 @@ $DIG -p ${PORT} @10.53.0.1 data.example TXT > dig.out.test$((n+1))
 
 # Step 8.
 n=$((n+1))
-echo_i "check stale data.example comes from authoritative (stale-refresh-time disabled) ($n)"
+echo_i "check data.example comes from authoritative (stale-refresh-time disabled) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
@@ -985,7 +985,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep "_default: off (stale-answer-ttl=1 max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
+grep "_default: off (stale-answer-ttl=$stale_answer_ttl max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1039,8 +1039,8 @@ $RNDCCMD 10.53.0.3 stats > /dev/null 2>&1
 [ -f ns3/named.stats ] || ret=1
 cp ns3/named.stats ns3/named.stats.$n
 # Check first 10 lines of Cache DB statistics. After last queries, we expect
-# one active TXT RRset, one stale TXT, one stale nxrrset TXT, and one
-# stale NXDOMAIN.
+# one active TXT RRset, one stale TXT, one stale nxrrset TXT, and one stale
+# NXDOMAIN.
 grep -A 10 "++ Cache DB RRsets ++" ns3/named.stats.$n > ns3/named.stats.$n.cachedb || ret=1
 grep "1 TXT" ns3/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #TXT" ns3/named.stats.$n.cachedb > /dev/null || ret=1
@@ -1062,7 +1062,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep "_default: on (rndc) (stale-answer-ttl=1 max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
+grep "_default: on (rndc) (stale-answer-ttl=$stale_answer_ttl max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1081,7 +1081,7 @@ echo_i "check data.example (max-stale-ttl default) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-grep "data\.example\..*1.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*30.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1090,7 +1090,7 @@ echo_i "check othertype.example (max-stale-ttl default) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
-grep "example\..*1.*IN.*CAA.*0.*issue" dig.out.test$n > /dev/null || ret=1
+grep "example\..*30.*IN.*CAA.*0.*issue" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1099,7 +1099,7 @@ echo_i "check nodata.example (max-stale-ttl default) ($n)"
 ret=0
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example\..*1.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
+grep "example\..*30.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1108,7 +1108,7 @@ echo_i "check nxdomain.example (max-stale-ttl default) ($n)"
 ret=0
 grep "status: NXDOMAIN" dig.out.test$n > /dev/null || ret=1
 grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
-grep "example\..*1.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
+grep "example\..*30.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1205,7 +1205,7 @@ n=$((n+1))
 echo_i "check 'rndc serve-stale status' ($n)"
 ret=0
 $RNDCCMD 10.53.0.4 serve-stale status > rndc.out.test$n 2>&1 || ret=1
-grep "_default: off (stale-answer-ttl=1 max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
+grep "_default: off (stale-answer-ttl=$stale_answer_ttl max-stale-ttl=$max_stale_ttl stale-refresh-time=30)" rndc.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
 
@@ -1259,8 +1259,8 @@ $RNDCCMD 10.53.0.4 stats > /dev/null 2>&1
 [ -f ns4/named.stats ] || ret=1
 cp ns4/named.stats ns4/named.stats.$n
 # Check first 10 lines of Cache DB statistics. After last queries, we expect
-# one active TXT RRset, one stale TXT, one stale nxrrset TXT, and one
-# stale NXDOMAIN.
+# one active TXT RRset, one stale TXT, one stale nxrrset TXT, and one stale
+# NXDOMAIN.
 grep -A 10 "++ Cache DB RRsets ++" ns4/named.stats.$n > ns4/named.stats.$n.cachedb || ret=1
 grep "1 TXT" ns4/named.stats.$n.cachedb > /dev/null || ret=1
 grep "1 #TXT" ns4/named.stats.$n.cachedb > /dev/null || ret=1
@@ -1281,9 +1281,9 @@ status=$((status+ret))
 echo_i "stop ns4"
 $PERL ../stop.pl --use-rndc --port ${CONTROLPORT} serve-stale ns4
 
-# Load the cache as if it was five minutes (RBTDB_VIRTUAL) older.
-# Since max-stale-ttl defaults to a week, we need to adjust the date by
-# one week and five minutes.
+# Load the cache as if it was five minutes (RBTDB_VIRTUAL) older. Since
+# max-stale-ttl defaults to a week, we need to adjust the date by one week and
+# five minutes.
 LASTWEEK=`TZ=UTC perl -e 'my $now = time();
         my $oneWeekAgo = $now - 604800;
         my $fiveMinutesAgo = $oneWeekAgo - 300;
@@ -1552,5 +1552,562 @@ grep -F "#NXDOMAIN" ns5/named.stats.$n.cachedb > /dev/null && ret=1
 status=$((status+ret))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 
+########################################################
+# Test for stale-answer-client-timeout (default 1.8s). #
+########################################################
+echo_i "test stale-answer-client-timeout (default 1.8)"
+
+n=$((n+1))
+echo_i "updating ns3/named.conf ($n)"
+ret=0
+copy_setports ns3/named2.conf.in ns3/named.conf
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "restart ns3"
+$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} serve-stale ns3
+start_server --noclean --restart --port ${PORT} serve-stale ns3
+
+n=$((n+1))
+echo_i "check 'rndc serve-stale status' ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
+grep '_default: on (stale-answer-ttl=3 max-stale-ttl=3600 stale-refresh-time=0)' rndc.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "enable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt enable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "prime cache data.example (stale-answer-client-timeout)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "prime cache nodata.example (stale-answer-client-timeout)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "disable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt disable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow RRset to become stale.
+sleep 2
+
+# We configured a long value of 30 seconds for resolver-query-timeout.
+# That should give us enough time to receive an stale answer from cache
+# after stale-answer-client-timeout timer of 1.8 sec triggers.
+n=$((n+1))
+echo_i "check stale data.example comes from cache (default stale-answer-client-timeout) ($n)"
+nextpart ns3/named.run > /dev/null
+t1=`$PERL -e 'print time()'`
+$DIG -p ${PORT} +tries=1 +timeout=10  @10.53.0.3 data.example TXT > dig.out.test$n
+t2=`$PERL -e 'print time()'`
+wait_for_log 5 "data.example client timeout, stale answer used" ns3/named.run || ret=1
+ret=0
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+# Default stale-answer-client-timeout is 1.8s, we allow some extra time
+# just in case other tests are taking too much cpu.
+[ $((t2 - t1)) -le 10 ] || { echo_i "query took $((t2 - t1))s to resolve.";  ret=1; }
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "sending queries for tests $((n+1))-$((n+2))..."
+$DIG -p ${PORT} +tries=1 +timeout=3  @10.53.0.3 nodata.example TXT > dig.out.test$((n+1)) &
+$DIG -p ${PORT} +tries=1 +timeout=30  @10.53.0.3 nodata.example TXT > dig.out.test$((n+2))
+wait
+
+# Since nodata.example is cached as NXRRSET and marked as stale at this point,
+# BIND must not return this RRset when stale-answer-client-timeout triggers,
+# instead, it must attempt to refresh the RRset. Since the authoritative
+# server is disabled and we are using resolver-query-timeout value of 10
+# seconds, we expect this query with a timeout of 3 seconds to time out.
+n=$((n+1))
+echo_i "check query for nodata.example times out (default stale-answer-client-timeout) ($n)"
+grep "connection timed out" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# For this query we expect BIND to return stale NXRRSET data for
+# nodata.example after resolver-query-timeout expires.
+n=$((n+1))
+echo_i "check stale nodata.example comes from cache after resolver-query-timeout expires (default stale-answer-client-timeout) ($n)"
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
+grep "example\..*3.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+#############################################
+# Test for stale-answer-client-timeout off. #
+#############################################
+echo_i "test stale-answer-client-timeout (off)"
+
+n=$((n+1))
+echo_i "updating ns3/named.conf ($n)"
+ret=0
+copy_setports ns3/named3.conf.in ns3/named.conf
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "running 'rndc reload' ($n)"
+ret=0
+rndc_reload ns3 10.53.0.3
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Send a query, auth server is disabled, we will enable it after a while in
+# order to receive an answer before resolver-query-timeout expires. Since
+# stale-answer-client-timeout is disabled we must receive an answer from
+# authoritative server.
+echo_i "sending query for test $((n+2))"
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$((n+2)) &
+sleep 3
+
+n=$((n+1))
+echo_i "enable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt enable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Wait until dig is done.
+wait
+
+n=$((n+1))
+echo_i "check data.example comes from authoritative server (stale-answer-client-timeout off) ($n)"
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*[12].*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+#############################################
+# Test for stale-answer-client-timeout 0.   #
+#############################################
+echo_i "test stale-answer-client-timeout (0)"
+
+n=$((n+1))
+echo_i "updating ns3/named.conf ($n)"
+ret=0
+copy_setports ns3/named4.conf.in ns3/named.conf
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "restart ns3"
+$PERL ../stop.pl --use-rndc --port ${CONTROLPORT} serve-stale ns3
+start_server --noclean --restart --port ${PORT} serve-stale ns3
+
+n=$((n+1))
+echo_i "prime cache data.example (stale-answer-client-timeout 0)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "prime cache nodata.example (stale-answer-client-timeout 0)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 nodata.example TXT > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "disable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt disable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow RRset to become stale.
+sleep 2
+
+n=$((n+1))
+ret=0
+echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "enable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt enable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+wait_for_rrset_refresh() {
+	nextpart ns3/named.run | grep 'data.example.*2.*TXT.*"A text record with a 2 second ttl"' > /dev/null && return 0
+	return 1
+}
+
+# This test ensures that after we get stale data due to
+# stale-answer-client-timeout 0, enabling the authoritative server will allow
+# the RRset to be updated.
+n=$((n+1))
+ret=0
+echo_i "check stale data.example was refreshed (stale-answer-client-timeout 0) ($n)"
+retry_quiet 10 wait_for_rrset_refresh || ret=1
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*[12].*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "disable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt disable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "sending queries for tests $((n+1))-$((n+2))..."
+$DIG -p ${PORT} +tries=1 +timeout=3  @10.53.0.3 nodata.example TXT > dig.out.test$((n+1)) &
+$DIG -p ${PORT} +tries=1 +timeout=30  @10.53.0.3 nodata.example TXT > dig.out.test$((n+2))
+wait
+
+# Since nodata.example is cached as NXRRSET and marked as stale at this point,
+# BIND must not prompty return this RRset due to
+# stale-answer-client-timeout == 0, instead, it must attempt to refresh the
+# RRset. Since the authoritative server is disabled and we are using
+# resolver-query-timeout value of 10 seconds, we expect this query with a
+# timeout of 3 seconds to time out.
+n=$((n+1))
+echo_i "check query for nodata.example times out (stale-answer-client-timeout 0) ($n)"
+grep "connection timed out" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# For this query we expect BIND to return stale NXRRSET data for
+# nodata.example after resolver-query-timeout expires.
+n=$((n+1))
+echo_i "check stale nodata.example comes from cache after resolver-query-timeout expires (stale-answer-client-timeout 0) ($n)"
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 0," dig.out.test$n > /dev/null || ret=1
+grep "example\..*3.*IN.*SOA" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+####################################################################
+# Test for stale-answer-client-timeout 0 and stale-refresh-time 4. #
+####################################################################
+echo_i "test stale-answer-client-timeout (0) and stale-refresh-time (4)"
+
+n=$((n+1))
+echo_i "updating ns3/named.conf ($n)"
+ret=0
+copy_setports ns3/named5.conf.in ns3/named.conf
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "running 'rndc reload' ($n)"
+ret=0
+rndc_reload ns3 10.53.0.3
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "flush cache, enable responses from authoritative server ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 flushtree example > rndc.out.test$n.1 2>&1 || ret=1
+$DIG -p ${PORT} @10.53.0.2 txt enable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "prime cache data.example (stale-answer-client-timeout 0, stale-refresh-time 4) ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*2.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow RRset to become stale.
+sleep 2
+
+n=$((n+1))
+echo_i "disable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt disable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+ret=0
+echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "enable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt enable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# This test ensures that after we get stale data due to
+# stale-answer-client-timeout 0, enabling the authoritative server will allow
+# the RRset to be updated.
+n=$((n+1))
+ret=0
+echo_i "check stale data.example was refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+retry_quiet 10 wait_for_rrset_refresh || ret=1
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*[12].*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow RRset to become stale.
+sleep 2
+
+n=$((n+1))
+echo_i "disable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt disable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+ret=0
+echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow stale-refresh-time to be activated.
+n=$((n+1))
+ret=0
+echo_i "wait until resolver query times out, activating stale-refresh-time"
+wait_for_log 15 "data.example resolver failure, stale answer used" ns3/named.run || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+ret=0
+echo_i "check stale data.example comes from cache within stale-refresh-time (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+wait_for_log 5 "data.example query within stale refresh time" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "enable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt enable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"1\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# We give BIND some time to ensure that after we enable authoritative server,
+# this RRset is still not refreshed because it was hit during
+# stale-refresh-time window.
+sleep 1
+
+n=$((n+1))
+ret=0
+echo_i "check stale data.example was not refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+wait_for_log 5 "data.example query within stale refresh time" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# After the refresh-time-window, the RRset will be refreshed.
+sleep 4
+
+n=$((n+1))
+ret=0
+echo_i "check stale data.example comes from cache (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+wait_for_log 5 "data.example stale answer used, an attempt to refresh the RRset" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+ret=0
+echo_i "check stale data.example was refreshed (stale-answer-client-timeout 0 stale-refresh-time 4) ($n)"
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*[12].*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+####################################################################
+# Test if fetch-limits quota is reached, stale data is served.     #
+####################################################################
+echo_i "test stale data with fetch-limits"
+
+n=$((n+1))
+echo_i "updating ns3/named.conf ($n)"
+ret=0
+copy_setports ns3/named6.conf.in ns3/named.conf
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "running 'rndc reload' ($n)"
+ret=0
+rndc_reload ns3 10.53.0.3
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Disable responses from authoritative server.
+n=$((n+1))
+echo_i "disable responses from authoritative server ($n)"
+ret=0
+$DIG -p ${PORT} @10.53.0.2 txt disable  > dig.out.test$n
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "TXT.\"0\"" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Hit the fetch-limits.
+burst() {
+	num=${1}
+	rm -f burst.input.$$
+	while [ $num -gt 0 ]; do
+		num=`expr $num - 1`
+		echo "${num}.data.example A" >> burst.input.$$
+	done
+	$PERL ../ditch.pl -p ${PORT} -s 10.53.0.3 burst.input.$$
+	rm -f burst.input.$$
+}
+
+wait_for_fetchlimits() {
+	burst 20
+	$DIG -p ${PORT} @10.53.0.3 data.example A > dig.out.test$n
+	grep "status: SERVFAIL" dig.out.test$n > /dev/null || return 1
+}
+
+n=$((n+1))
+echo_i "hit fetch limits ($n)"
+ret=0
+retry_quiet 10 wait_for_fetchlimits || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Allow RRset to become stale.
+sleep 2
+
+# Turn on serve-stale.
+n=$((n+1))
+echo_i "running 'rndc serve-stale on' ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 serve-stale on || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "check 'rndc serve-stale status' ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 serve-stale status > rndc.out.test$n 2>&1 || ret=1
+grep '_default: on (rndc) (stale-answer-ttl=3 max-stale-ttl=3600 stale-refresh-time=4)' rndc.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# Expect stale data now.
+n=$((n+1))
+ret=0
+echo_i "check stale data.example comes from cache (fetch-limits) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+wait_for_log 5 "data.example resolver failure, stale answer used" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+# The previous query should not have started the stale-refresh-time window.
+n=$((n+1))
+ret=0
+echo_i "check stale data.example comes from cache again (fetch-limits) ($n)"
+nextpart ns3/named.run > /dev/null
+$DIG -p ${PORT} @10.53.0.3 data.example TXT > dig.out.test$n
+wait_for_log 5 "data.example resolver failure, stale answer used" ns3/named.run || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "ANSWER: 1," dig.out.test$n > /dev/null || ret=1
+grep "data\.example\..*3.*IN.*TXT.*A text record with a 2 second ttl" dig.out.test$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/xot/clean.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+#
+# Clean up after zone transfer tests.
+#
+
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./*/named.run
+rm -f ./*/named.run.prev
+rm -f ./dig.out.*
+rm -f ./*/*.db

bin/tests/system/xot/dig1.good

@@ -0,0 +1,171 @@
+example.		86400	IN	SOA	ns2.example. hostmaster.example. 1397051952 5 5 1814400 3600
+example.		3600	IN	NS	ns2.example.
+a01.example.		3600	IN	A	0.0.0.0
+a02.example.		3600	IN	A	255.255.255.255
+a601.example.		3600	IN	A6	0 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+a601.example.		3600	IN	A6	64 ::ffff:ffff:ffff:ffff foo.
+a601.example.		3600	IN	A6	127 ::1 foo.
+a601.example.		3600	IN	A6	128  .
+aaaa01.example.		3600	IN	AAAA	::1
+aaaa02.example.		3600	IN	AAAA	fd92:7065:b8e:ffff::5
+afsdb01.example.	3600	IN	AFSDB	0 hostname.example.
+afsdb02.example.	3600	IN	AFSDB	65535 .
+amtrelay01.example.	3600	IN	AMTRELAY 0 0 0
+amtrelay02.example.	3600	IN	AMTRELAY 0 1 0
+amtrelay03.example.	3600	IN	AMTRELAY 0 0 1 0.0.0.0
+amtrelay04.example.	3600	IN	AMTRELAY 0 0 2 ::
+amtrelay05.example.	3600	IN	AMTRELAY 0 0 3 example.net.
+amtrelay06.example.	3600	IN	AMTRELAY \# 2 0004
+apl01.example.		3600	IN	APL	!1:10.0.0.1/32 1:10.0.0.0/24
+apl02.example.		3600	IN	APL
+atma01.example.		3600	IN	ATMA	+61200000000
+atma02.example.		3600	IN	ATMA	+61200000000
+atma03.example.		3600	IN	ATMA	1234567890abcdef
+atma04.example.		3600	IN	ATMA	fedcba0987654321
+avc.example.		3600	IN	AVC	"foo:bar"
+caa01.example.		3600	IN	CAA	0 issue "ca.example.net; policy=ev"
+caa02.example.		3600	IN	CAA	128 tbs "Unknown"
+caa03.example.		3600	IN	CAA	128 tbs ""
+cdnskey01.example.	3600	IN	CDNSKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+cds01.example.		3600	IN	CDS	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
+cert01.example.		3600	IN	CERT	65534 65535 PRIVATEOID MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY=
+cname01.example.	3600	IN	CNAME	cname-target.
+cname02.example.	3600	IN	CNAME	cname-target.example.
+cname03.example.	3600	IN	CNAME	.
+csync01.example.	3600	IN	CSYNC	0 0 A NS AAAA
+csync02.example.	3600	IN	CSYNC	0 0
+dhcid01.example.	3600	IN	DHCID	AAIBY2/AuCccgoJbsaxcQc9TUapptP69lOjxfNuVAA2kjEA=
+dhcid02.example.	3600	IN	DHCID	AAEBOSD+XR3Os/0LozeXVqcNc7FwCfQdWL3b/NaiUDlW2No=
+dhcid03.example.	3600	IN	DHCID	AAABxLmlskllE0MVjd57zHcWmEH3pCQ6VytcKD//7es/deY=
+dlv.example.		3600	IN	DLV	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
+dname01.example.	3600	IN	DNAME	dname-target.
+dname02.example.	3600	IN	DNAME	dname-target.example.
+dname03.example.	3600	IN	DNAME	.
+dnskey01.example.	3600	IN	DNSKEY	512 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+doa01.example.		3600	IN	DOA	1234567890 1234567890 1 "image/gif" R0lGODlhKAAZAOMCAGZmZgBmmf///zOZzMz//5nM/zNmmWbM/5nMzMzMzACZ/////////////////////yH5BAEKAA8ALAAAAAAoABkAAATH8IFJK5U2a4337F5ogRkpnoCJrly7PrCKyh8c3HgAhzT35MDbbtO7/IJIHbGiOiaTxVTpSVWWLqNq1UVyapNS1wd3OAxug0LhnCubcVhsxysQnOt4ATpvvzHlFzl1AwODhWeFAgRpen5/UhheAYMFdUB4SFcpGEGGdQeCAqBBLTuSk30EeXd9pEsAbKGxjHqDSE0Sp6ixN4N1BJmbc7lIhmsBich1awPAjkY1SZR8bJWrz382SGqIBQQFQd4IsUTaX+ceuudPEQA7
+doa02.example.		3600	IN	DOA	0 1 2 "" aHR0cHM6Ly93d3cuaXNjLm9yZy8=
+ds01.example.		3600	IN	DS	12892 5 2 26584835CA80C81C91999F31CFAF2A0E89D4FF1C8FAFD0DDB31A85C7 19277C13
+ds01.example.		3600	IN	NS	ns42.example.
+ds02.example.		3600	IN	DS	12892 5 1 7AA4A3F416C2F2391FB7AB0D434F762CD62D1390
+ds02.example.		3600	IN	NS	ns43.example.
+eid01.example.		3600	IN	EID	1289AB
+eui48.example.		3600	IN	EUI48	01-23-45-67-89-ab
+eui64.example.		3600	IN	EUI64	01-23-45-67-89-ab-cd-ef
+gid01.example.		3600	IN	GID	\# 1 03
+gpos01.example.		3600	IN	GPOS	"-22.6882" "116.8652" "250.0"
+gpos02.example.		3600	IN	GPOS	"" "" ""
+hinfo01.example.	3600	IN	HINFO	"Generic PC clone" "NetBSD-1.4"
+hinfo02.example.	3600	IN	HINFO	"PC" "NetBSD"
+hip1.example.		3600	IN	HIP	2 200100107B1A74DF365639CC39F1D578 AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D
+hip2.example.		3600	IN	HIP	2 200100107B1A74DF365639CC39F1D578 AwEAAbdxyhNuSutc5EMzxTs9LBPCIkOFH8cIvM4p9+LrV4e19WzK00+CI6zBCQTdtWsuxKbWIy87UOoJTwkUs7lBu+Upr1gsNrut79ryra+bSRGQb1slImA8YVJyuIDsj7kwzG7jnERNqnWxZ48AWkskmdHaVDP4BcelrTI3rMXdXF5D rvs.example.com.
+ipseckey01.example.	3600	IN	IPSECKEY 10 1 2 192.0.2.38 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
+ipseckey02.example.	3600	IN	IPSECKEY 10 0 2 . AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
+ipseckey03.example.	3600	IN	IPSECKEY 10 1 2 192.0.2.3 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
+ipseckey04.example.	3600	IN	IPSECKEY 10 3 2 mygateway.example.com. AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
+ipseckey05.example.	3600	IN	IPSECKEY 10 2 2 2001:db8:0:8002::2000:1 AQNRU3mG7TVTO2BkR47usntb102uFJtugbo6BSGvgqt4AQ==
+isdn01.example.		3600	IN	ISDN	"isdn-address"
+isdn02.example.		3600	IN	ISDN	"isdn-address" "subaddress"
+isdn03.example.		3600	IN	ISDN	"isdn-address"
+isdn04.example.		3600	IN	ISDN	"isdn-address" "subaddress"
+keydata.example.	3600	IN	TYPE65533 \# 0
+keydata.example.	3600	IN	TYPE65533 \# 6 010203040506
+keydata.example.	3600	IN	TYPE65533 \# 18 010203040506010203040506010203040506
+kx01.example.		3600	IN	KX	10 kdc.example.
+kx02.example.		3600	IN	KX	10 .
+l32.example.		3600	IN	L32	10 1.2.3.4
+l64.example.		3600	IN	L64	10 14:4fff:ff20:ee64
+loc01.example.		3600	IN	LOC	60 9 0.000 N 24 39 0.000 E 10.00m 20m 2000m 20m
+loc02.example.		3600	IN	LOC	60 9 0.000 N 24 39 0.000 E 10.00m 20m 2000m 20m
+lp.example.		3600	IN	LP	10 example.net.
+mb01.example.		3600	IN	MG	madname.example.
+mb02.example.		3600	IN	MG	.
+mg01.example.		3600	IN	MG	mgmname.example.
+mg02.example.		3600	IN	MG	.
+minfo01.example.	3600	IN	MINFO	rmailbx.example. emailbx.example.
+minfo02.example.	3600	IN	MINFO	. .
+mr01.example.		3600	IN	MR	mrname.example.
+mr02.example.		3600	IN	MR	.
+mx01.example.		3600	IN	MX	10 mail.example.
+mx02.example.		3600	IN	MX	10 .
+naptr01.example.	3600	IN	NAPTR	0 0 "" "" "" .
+naptr02.example.	3600	IN	NAPTR	65535 65535 "blurgh" "blorf" "blllbb" foo.
+nid.example.		3600	IN	NID	10 14:4fff:ff20:ee64
+nimloc01.example.	3600	IN	NIMLOC	1289AB
+ninfo01.example.	3600	IN	NINFO	"foo"
+ninfo02.example.	3600	IN	NINFO	"foo" "bar"
+ninfo03.example.	3600	IN	NINFO	"foo"
+ninfo04.example.	3600	IN	NINFO	"foo" "bar"
+ninfo05.example.	3600	IN	NINFO	"foo bar"
+ninfo06.example.	3600	IN	NINFO	"foo bar"
+ninfo07.example.	3600	IN	NINFO	"foo bar"
+ninfo08.example.	3600	IN	NINFO	"foo\010bar"
+ninfo09.example.	3600	IN	NINFO	"foo\010bar"
+ninfo10.example.	3600	IN	NINFO	"foo bar"
+ninfo11.example.	3600	IN	NINFO	"\"foo\""
+ninfo12.example.	3600	IN	NINFO	"\"foo\""
+ninfo13.example.	3600	IN	NINFO	"foo;"
+ninfo14.example.	3600	IN	NINFO	"foo;"
+ninfo15.example.	3600	IN	NINFO	"bar\\;"
+ns2.example.		3600	IN	A	10.53.0.2
+nsap-ptr01.example.	3600	IN	NSAP-PTR foo.
+nsap-ptr01.example.	3600	IN	NSAP-PTR .
+nsap01.example.		3600	IN	NSAP	0x47000580005a0000000001e133ffffff00016100
+nsap02.example.		3600	IN	NSAP	0x47000580005a0000000001e133ffffff00016100
+nsec01.example.		3600	IN	NSEC	a.secure.nil. NS SOA MX LOC RRSIG NSEC DNSKEY
+nsec02.example.		3600	IN	NSEC	. NSAP-PTR NSEC
+nsec03.example.		3600	IN	NSEC	. A
+nsec04.example.		3600	IN	NSEC	. TYPE127
+openpgpkey.example.	3600	IN	OPENPGPKEY AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+ptr01.example.		3600	IN	PTR	example.
+px01.example.		3600	IN	PX	65535 foo. bar.
+px02.example.		3600	IN	PX	65535 . .
+rkey01.example.		3600	IN	RKEY	0 255 1 AQMFD5raczCJHViKtLYhWGz8hMY9UGRuniJDBzC7w0aRyzWZriO6i2od GWWQVucZqKVsENW91IOW4vqudngPZsY3GvQ/xVA8/7pyFj6b7Esga60z yGW6LFe9r8n6paHrlG5ojqf0BaqHT+8=
+rp01.example.		3600	IN	RP	mbox-dname.example. txt-dname.example.
+rp02.example.		3600	IN	RP	. .
+rrsig01.example.	3600	IN	RRSIG	NSEC 1 3 3600 20000102030405 19961211100908 2143 foo.nil. MxFcby9k/yvedMfQgKzhH5er0Mu/vILz45IkskceFGgiWCn/GxHhai6V AuHAoNUz4YoU1tVfSCSqQYn6//11U6Nld80jEeC8aTrO+KKmCaY=
+rt01.example.		3600	IN	RT	0 intermediate-host.example.
+rt02.example.		3600	IN	RT	65535 .
+sink01.example.		3600	IN	SINK	1 0 0
+sink02.example.		3600	IN	SINK	8 0 2 l4ik
+smimea.example.		3600	IN	SMIMEA	1 1 2 92003BA34942DC74152E2F2C408D29ECA5A520E7F2E06BB944F4DCA3 46BAF63C1B177615D466F6C4B71C216A50292BD58C9EBDD2F74E38FE 51FFD48C43326CBC
+spf01.example.		3600	IN	SPF	"v=spf1 -all"
+spf02.example.		3600	IN	SPF	"v=spf1" " -all"
+srv01.example.		3600	IN	SRV	0 0 0 .
+srv02.example.		3600	IN	SRV	65535 65535 65535 old-slow-box.example.
+sshfp01.example.	3600	IN	SSHFP	4 2 C76D8329954DA2835751E371544E963EFDA099080D6C58DD2BFD9A31 6E162C83
+sshfp02.example.	3600	IN	SSHFP	1 2 BF29468C83AC58CCF8C85AB7B3BEB054ECF1E38512B8353AB36471FA 88961DCC
+ta.example.		3600	IN	TA	30795 1 1 310D27F4D82C1FC2400704EA9939FE6E1CEAA3B9
+talink0.example.	3600	IN	TALINK	. talink1.example.
+talink1.example.	3600	IN	TALINK	talink0.example. talink2.example.
+talink2.example.	3600	IN	TALINK	talink2.example. .
+tlsa.example.		3600	IN	TLSA	1 1 2 92003BA34942DC74152E2F2C408D29ECA5A520E7F2E06BB944F4DCA3 46BAF63C1B177615D466F6C4B71C216A50292BD58C9EBDD2F74E38FE 51FFD48C43326CBC
+txt01.example.		3600	IN	TXT	"foo"
+txt02.example.		3600	IN	TXT	"foo" "bar"
+txt03.example.		3600	IN	TXT	"foo"
+txt04.example.		3600	IN	TXT	"foo" "bar"
+txt05.example.		3600	IN	TXT	"foo bar"
+txt06.example.		3600	IN	TXT	"foo bar"
+txt07.example.		3600	IN	TXT	"foo bar"
+txt08.example.		3600	IN	TXT	"foo\010bar"
+txt09.example.		3600	IN	TXT	"foo\010bar"
+txt10.example.		3600	IN	TXT	"foo bar"
+txt11.example.		3600	IN	TXT	"\"foo\""
+txt12.example.		3600	IN	TXT	"\"foo\""
+txt13.example.		3600	IN	TXT	"foo;"
+txt14.example.		3600	IN	TXT	"foo;"
+txt15.example.		3600	IN	TXT	"bar\\;"
+uid01.example.		3600	IN	UID	\# 1 02
+uinfo01.example.	3600	IN	UINFO	\# 1 01
+unspec01.example.	3600	IN	UNSPEC	\# 1 04
+uri01.example.		3600	IN	URI	10 20 "https://www.isc.org/"
+uri02.example.		3600	IN	URI	30 40 "https://www.isc.org/HolyCowThisSureIsAVeryLongURIRecordIDontEvenKnowWhatSomeoneWouldEverWantWithSuchAThingButTheSpecificationRequiresThatWesupportItSoHereWeGoTestingItLaLaLaLaLaLaLaSeriouslyThoughWhyWouldYouEvenConsiderUsingAURIThisLongItSeemsLikeASillyIdeaButEnhWhatAreYouGonnaDo/"
+uri03.example.		3600	IN	URI	30 40 ""
+wks01.example.		3600	IN	WKS	10.0.0.1 6 0 1 2 21 23
+wks02.example.		3600	IN	WKS	10.0.0.1 17 0 1 2 53
+wks03.example.		3600	IN	WKS	10.0.0.2 6 65535
+x2501.example.		3600	IN	X25	"123456789"
+zonemd01.example.	3600	IN	ZONEMD	2019020700 1 0 C220B8A6ED5728A971902F7E3D4FD93ADEEA88B0453C2E8E8C863D46 5AB06CF34EB95B266398C98B59124FA239CB7EEB
+8f1tmio9avcom2k0frp92lgcumak0cad.example. 3600 IN NSEC3	1 0 10 D2CF0294C020CE6C 8FPNS2UCT7FBS643THP2B77PEQ77K6IU A NS SOA MX AAAA RRSIG DNSKEY NSEC3PARAM
+kcd3juae64f9c5csl1kif1htaui7un0g.example. 3600 IN NSEC3	1 0 10 D2CF0294C020CE6C KD5MN2M20340DGO0BL7NTSB8JP4BSC7E
+mr5ukvsk1l37btu4q7b1dfevft4hkqdk.example. 3600 IN NSEC3	1 0 10 D2CF0294C020CE6C MT38J6VG7S0SN5G17MCUF6IQIKFUAJ05 A AAAA RRSIG
+example.		86400	IN	SOA	ns2.example. hostmaster.example. 1397051952 5 5 1814400 3600

bin/tests/system/xot/ns1/named.conf.in

@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	port @PORT@;
+	tls-port @TLSPORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	listen-on tls ephemeral { 10.53.0.1; };
+	recursion no;
+	notify explicit;
+	also-notify { 10.53.0.2 port @PORT@; };
+	statistics-file "named.stats";
+	dnssec-validation yes;
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
+	allow-transfer { any; };
+};

bin/tests/system/xot/ns2/named.conf.in

@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+include "../../common/rndc.key";
+
+controls {
+	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	tls-port @TLSPORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on tls ephemeral { 10.53.0.2; };
+	listen-on-v6 { none; };
+	listen-on tls ephemeral { 10.53.0.2; };
+	recursion no;
+	notify no;
+	ixfr-from-differences yes;
+	check-integrity no;
+	dnssec-validation yes;
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "example" {
+	type secondary;
+	primaries { 10.53.0.1 tls ephemeral; };
+	file "example.db";
+	allow-transfer { any; };
+};

bin/tests/system/xot/setup.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+$SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 >ns1/example.db
+
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf

bin/tests/system/xot/tests.sh

@@ -0,0 +1,50 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+dig_with_opts() {
+	"$DIG" +tls +noadd +nosea +nostat +noquest +nocomm +nocmd -p "${TLSPORT}" "$@"
+}
+
+wait_for_xfer() (
+	dig_with_opts -b 10.53.0.3 @10.53.0.2 example. AXFR > "dig.out.ns2.test$n" || return 1
+	grep "^;" "dig.out.ns2.test$n" > /dev/null && return 1
+	return 0
+)
+
+status=0
+n=0
+
+n=$((n+1))
+echo_i "testing XoT server functionality (using dig) ($n)"
+ret=0
+dig_with_opts example. -b 10.53.0.3 @10.53.0.1 axfr > dig.out.ns1.test$n || ret=1
+grep "^;" dig.out.ns1.test$n | cat_i
+digcomp dig1.good dig.out.ns1.test$n || ret=1
+if test $ret != 0 ; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "testing basic incoming XoT functionality (from secondary) ($n)"
+ret=0
+if retry_quiet 10 wait_for_xfer; then
+	grep "^;" "dig.out.ns2.test$n" | cat_i
+	digcomp dig1.good "dig.out.ns2.test$n" || ret=1
+else
+	echo_i "timed out waiting for zone transfer"
+	ret=1
+fi
+if test $ret != 0 ; then echo_i "failed"; fi
+status=$((status+ret))
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1

bin/tests/test_client.c

@@ -0,0 +1,430 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <fcntl.h>
+#include <getopt.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <signal.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <isc/mem.h>
+#include <isc/netaddr.h>
+#include <isc/netmgr.h>
+#include <isc/os.h>
+#include <isc/sockaddr.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+typedef enum { UDP, TCP, DOT, DOH } protocol_t;
+
+static const char *protocols[] = { "udp", "tcp", "dot", "doh" };
+
+static isc_mem_t *mctx = NULL;
+static isc_nm_t *netmgr = NULL;
+
+static protocol_t protocol;
+static const char *address;
+static const char *port;
+static int family = AF_UNSPEC;
+static isc_sockaddr_t sockaddr_local;
+static isc_sockaddr_t sockaddr_remote;
+static int workers;
+static int timeout;
+static uint8_t messagebuf[2 * 65536];
+static isc_region_t message = { .length = 0, .base = messagebuf };
+static int out = -1;
+
+static isc_result_t
+parse_port(const char *input) {
+	char *endptr = NULL;
+	long val = strtol(input, &endptr, 10);
+
+	if ((*endptr != '\0') || (val <= 0) || (val >= 65536)) {
+		return (ISC_R_BADNUMBER);
+	}
+
+	port = input;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+parse_protocol(const char *input) {
+	for (size_t i = 0; i < ARRAY_SIZE(protocols); i++) {
+		if (!strcasecmp(input, protocols[i])) {
+			protocol = i;
+			return (ISC_R_SUCCESS);
+		}
+	}
+
+	return (ISC_R_BADNUMBER);
+}
+
+static isc_result_t
+parse_address(const char *input) {
+	struct in6_addr in6;
+	struct in_addr in;
+
+	if (inet_pton(AF_INET6, input, &in6) == 1) {
+		family = AF_INET6;
+		address = input;
+		return (ISC_R_SUCCESS);
+	}
+
+	if (inet_pton(AF_INET, input, &in) == 1) {
+		family = AF_INET;
+		address = input;
+		return (ISC_R_SUCCESS);
+	}
+
+	return (ISC_R_BADADDRESSFORM);
+}
+
+static int
+parse_workers(const char *input) {
+	char *endptr = NULL;
+	long val = strtol(input, &endptr, 10);
+
+	if ((*endptr != '\0') || (val <= 0) || (val >= 128)) {
+		return (ISC_R_BADNUMBER);
+	}
+
+	workers = val;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+parse_timeout(const char *input) {
+	char *endptr = NULL;
+	long val = strtol(input, &endptr, 10);
+
+	if ((*endptr != '\0') || (val <= 0) || (val >= 120)) {
+		return (ISC_R_BADNUMBER);
+	}
+
+	timeout = (in_port_t)val * 1000;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+parse_input(const char *input) {
+	int in = -1;
+
+	if (!strcmp(input, "-")) {
+		in = 0;
+	} else {
+		in = open(input, O_RDONLY);
+	}
+	RUNTIME_CHECK(in >= 0);
+
+	message.length = read(in, message.base, sizeof(messagebuf));
+
+	close(in);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+parse_output(const char *input) {
+	if (!strcmp(input, "-")) {
+		out = 1;
+	} else {
+		out = open(input, O_WRONLY | O_CREAT,
+			   S_IRUSR | S_IRGRP | S_IROTH);
+	}
+	RUNTIME_CHECK(out >= 0);
+
+	return (ISC_R_SUCCESS);
+}
+
+static void
+parse_options(int argc, char **argv) {
+	char buf[ISC_NETADDR_FORMATSIZE];
+
+	/* Set defaults */
+	RUNTIME_CHECK(parse_protocol("UDP") == ISC_R_SUCCESS);
+	RUNTIME_CHECK(parse_port("53000") == ISC_R_SUCCESS);
+	RUNTIME_CHECK(parse_address("::0") == ISC_R_SUCCESS);
+	workers = isc_os_ncpus();
+
+	while (true) {
+		int c;
+		int option_index = 0;
+		static struct option long_options[] = {
+			{ "port", required_argument, NULL, 'p' },
+			{ "address", required_argument, NULL, 'a' },
+			{ "protocol", required_argument, NULL, 'P' },
+			{ "workers", required_argument, NULL, 'w' },
+			{ "timeout", required_argument, NULL, 't' },
+			{ "input", required_argument, NULL, 'i' },
+			{ "output", required_argument, NULL, 'o' },
+			{ 0, 0, NULL, 0 }
+		};
+
+		c = getopt_long(argc, argv, "a:p:P:w:t:i:o:", long_options,
+				&option_index);
+		if (c == -1) {
+			break;
+		}
+
+		switch (c) {
+		case 'a':
+			RUNTIME_CHECK(parse_address(optarg) == ISC_R_SUCCESS);
+			break;
+
+		case 'p':
+			RUNTIME_CHECK(parse_port(optarg) == ISC_R_SUCCESS);
+			break;
+
+		case 'P':
+			RUNTIME_CHECK(parse_protocol(optarg) == ISC_R_SUCCESS);
+			break;
+
+		case 'w':
+			RUNTIME_CHECK(parse_workers(optarg) == ISC_R_SUCCESS);
+			break;
+
+		case 't':
+			RUNTIME_CHECK(parse_timeout(optarg) == ISC_R_SUCCESS);
+			break;
+
+		case 'i':
+			RUNTIME_CHECK(parse_input(optarg) == ISC_R_SUCCESS);
+			break;
+
+		case 'o':
+			RUNTIME_CHECK(parse_output(optarg) == ISC_R_SUCCESS);
+			break;
+
+		default:
+			INSIST(0);
+		}
+	}
+
+	INSIST(optind < argc);
+
+	{
+		struct addrinfo hints = {
+			.ai_family = family,
+			.ai_socktype = (protocol == UDP) ? SOCK_DGRAM
+							 : SOCK_STREAM,
+		};
+		struct addrinfo *result = NULL;
+		int r = getaddrinfo(address, NULL, &hints, &result);
+		RUNTIME_CHECK(r == 0);
+
+		for (struct addrinfo *rp = result; rp != NULL; rp = rp->ai_next)
+		{
+			RUNTIME_CHECK(isc_sockaddr_fromsockaddr(&sockaddr_local,
+								rp->ai_addr) ==
+				      ISC_R_SUCCESS);
+		}
+		freeaddrinfo(result);
+	}
+
+	{
+		struct addrinfo hints = {
+			.ai_family = family,
+			.ai_socktype = (protocol == UDP) ? SOCK_DGRAM
+							 : SOCK_STREAM,
+		};
+		struct addrinfo *result = NULL;
+		int r = getaddrinfo(argv[optind], port, &hints, &result);
+		RUNTIME_CHECK(r == 0);
+
+		for (struct addrinfo *rp = result; rp != NULL; rp = rp->ai_next)
+		{
+			RUNTIME_CHECK(isc_sockaddr_fromsockaddr(
+					      &sockaddr_remote, rp->ai_addr) ==
+				      ISC_R_SUCCESS);
+		}
+		freeaddrinfo(result);
+	}
+
+	isc_sockaddr_format(&sockaddr_local, buf, sizeof(buf));
+
+	printf("Will connect from %s://%s", protocols[protocol], buf);
+
+	isc_sockaddr_format(&sockaddr_remote, buf, sizeof(buf));
+
+	printf("to %s, %d workers\n", buf, workers);
+}
+
+static void
+_signal(int sig, void (*handler)(int)) {
+	struct sigaction sa = { .sa_handler = handler };
+
+	RUNTIME_CHECK(sigfillset(&sa.sa_mask) == 0);
+	RUNTIME_CHECK(sigaction(sig, &sa, NULL) >= 0);
+}
+
+static void
+setup(void) {
+	sigset_t sset;
+
+	_signal(SIGPIPE, SIG_IGN);
+	_signal(SIGHUP, SIG_DFL);
+	_signal(SIGTERM, SIG_DFL);
+	_signal(SIGINT, SIG_DFL);
+
+	RUNTIME_CHECK(sigemptyset(&sset) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGHUP) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGINT) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGTERM) == 0);
+	RUNTIME_CHECK(pthread_sigmask(SIG_BLOCK, &sset, NULL) == 0);
+
+	isc_mem_create(&mctx);
+
+	netmgr = isc_nm_start(mctx, workers);
+}
+
+static void
+teardown(void) {
+	if (out > 0) {
+		close(out);
+	}
+
+	isc_nm_destroy(&netmgr);
+	isc_mem_destroy(&mctx);
+}
+
+static void
+yield(void) {
+	sigset_t sset;
+	int sig;
+
+	RUNTIME_CHECK(sigemptyset(&sset) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGHUP) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGINT) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGTERM) == 0);
+	RUNTIME_CHECK(sigwait(&sset, &sig) == 0);
+
+	fprintf(stderr, "Shutting down...\n");
+}
+
+static void
+read_cb(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
+	void *cbarg) {
+	isc_nmhandle_t *readhandle = cbarg;
+
+	REQUIRE(handle != NULL);
+	REQUIRE(eresult == ISC_R_SUCCESS || eresult == ISC_R_CANCELED ||
+		eresult == ISC_R_EOF);
+	REQUIRE(cbarg != NULL);
+
+	fprintf(stderr, "%s(..., %s, ...)\n", __func__,
+		isc_result_totext(eresult));
+
+	if (eresult == ISC_R_SUCCESS) {
+		printf("RECEIVED %u bytes\n", region->length);
+		if (out >= 0) {
+			ssize_t len = write(out, region->base, region->length);
+			close(out);
+			REQUIRE((size_t)len == region->length);
+		}
+	}
+
+	isc_nmhandle_detach(&readhandle);
+	kill(getpid(), SIGTERM);
+}
+
+static void
+send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	REQUIRE(handle != NULL);
+	REQUIRE(eresult == ISC_R_SUCCESS || eresult == ISC_R_CANCELED ||
+		eresult == ISC_R_EOF);
+	REQUIRE(cbarg == NULL);
+}
+
+static void
+connect_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	isc_nmhandle_t *readhandle = NULL;
+
+	REQUIRE(handle != NULL);
+	REQUIRE(eresult == ISC_R_SUCCESS);
+	UNUSED(cbarg);
+
+	if (eresult != ISC_R_SUCCESS) {
+		kill(getpid(), SIGTERM);
+		return;
+	}
+
+	fprintf(stderr, "ECHO_CLIENT:%s\n", __func__);
+
+	isc_nmhandle_attach(handle, &readhandle);
+	isc_nm_read(handle, read_cb, readhandle);
+	isc_nm_send(handle, &message, send_cb, NULL);
+}
+
+static void
+run(void) {
+	isc_result_t result;
+
+	switch (protocol) {
+	case UDP:
+		result = isc_nm_udpconnect(netmgr,
+					   (isc_nmiface_t *)&sockaddr_local,
+					   (isc_nmiface_t *)&sockaddr_remote,
+					   connect_cb, NULL, timeout, 0);
+		break;
+	case TCP:
+		result = isc_nm_tcpdnsconnect(netmgr,
+					      (isc_nmiface_t *)&sockaddr_local,
+					      (isc_nmiface_t *)&sockaddr_remote,
+					      connect_cb, NULL, timeout, 0);
+		break;
+	case DOT: {
+		isc_tlsctx_t *tlsdns_ctx = NULL;
+		isc_tlsctx_createclient(&tlsdns_ctx);
+
+		result = isc_nm_tlsdnsconnect(
+			netmgr, (isc_nmiface_t *)&sockaddr_local,
+			(isc_nmiface_t *)&sockaddr_remote, connect_cb, NULL,
+			timeout, 0, tlsdns_ctx);
+		break;
+	}
+	case DOH:
+		INSIST(0);
+		ISC_UNREACHABLE();
+		break;
+	default:
+		INSIST(0);
+		ISC_UNREACHABLE();
+	}
+	REQUIRE(result == ISC_R_SUCCESS);
+
+	yield();
+
+	isc_nm_closedown(netmgr);
+}
+
+int
+main(int argc, char **argv) {
+	parse_options(argc, argv);
+
+	setup();
+
+	run();
+
+	teardown();
+
+	exit(EXIT_SUCCESS);
+}

bin/tests/test_server.c

@@ -0,0 +1,305 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <getopt.h>
+#include <netinet/in.h>
+#include <signal.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <strings.h>
+
+#include <isc/mem.h>
+#include <isc/netaddr.h>
+#include <isc/netmgr.h>
+#include <isc/os.h>
+#include <isc/sockaddr.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+typedef enum { UDP, TCP, DOT, DOH } protocol_t;
+
+static const char *protocols[] = { "udp", "tcp", "dot", "doh" };
+
+static isc_mem_t *mctx = NULL;
+static isc_nm_t *netmgr = NULL;
+
+static protocol_t protocol;
+static in_port_t port;
+static isc_netaddr_t netaddr;
+static isc_sockaddr_t sockaddr __attribute__((unused));
+static int workers;
+
+static void
+read_cb(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
+	void *cbarg);
+static void
+send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg);
+
+static isc_result_t
+parse_port(const char *input) {
+	char *endptr = NULL;
+	long val = strtol(input, &endptr, 10);
+
+	if ((*endptr != '\0') || (val <= 0) || (val >= 65536)) {
+		return (ISC_R_BADNUMBER);
+	}
+
+	port = (in_port_t)val;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+parse_protocol(const char *input) {
+	for (size_t i = 0; i < ARRAY_SIZE(protocols); i++) {
+		if (!strcasecmp(input, protocols[i])) {
+			protocol = i;
+			return (ISC_R_SUCCESS);
+		}
+	}
+
+	return (ISC_R_BADNUMBER);
+}
+
+static isc_result_t
+parse_address(const char *input) {
+	struct in6_addr in6;
+	struct in_addr in;
+
+	if (inet_pton(AF_INET6, input, &in6) == 1) {
+		isc_netaddr_fromin6(&netaddr, &in6);
+		return (ISC_R_SUCCESS);
+	}
+
+	if (inet_pton(AF_INET, input, &in) == 1) {
+		isc_netaddr_fromin(&netaddr, &in);
+		return (ISC_R_SUCCESS);
+	}
+
+	return (ISC_R_BADADDRESSFORM);
+}
+
+static int
+parse_workers(const char *input) {
+	char *endptr = NULL;
+	long val = strtol(input, &endptr, 10);
+
+	if ((*endptr != '\0') || (val <= 0) || (val >= 128)) {
+		return (ISC_R_BADNUMBER);
+	}
+
+	workers = val;
+
+	return (ISC_R_SUCCESS);
+}
+
+static void
+parse_options(int argc, char **argv) {
+	char buf[ISC_NETADDR_FORMATSIZE];
+
+	/* Set defaults */
+	RUNTIME_CHECK(parse_protocol("UDP") == ISC_R_SUCCESS);
+	RUNTIME_CHECK(parse_port("53000") == ISC_R_SUCCESS);
+	RUNTIME_CHECK(parse_address("::1") == ISC_R_SUCCESS);
+	workers = isc_os_ncpus();
+
+	while (true) {
+		int c;
+		int option_index = 0;
+		static struct option long_options[] = {
+			{ "port", required_argument, NULL, 'p' },
+			{ "address", required_argument, NULL, 'a' },
+			{ "protocol", required_argument, NULL, 'P' },
+			{ "workers", required_argument, NULL, 'w' },
+			{ 0, 0, NULL, 0 }
+		};
+
+		c = getopt_long(argc, argv, "a:p:P:w:", long_options,
+				&option_index);
+		if (c == -1) {
+			break;
+		}
+
+		switch (c) {
+		case 'a':
+			RUNTIME_CHECK(parse_address(optarg) == ISC_R_SUCCESS);
+			break;
+
+		case 'p':
+			RUNTIME_CHECK(parse_port(optarg) == ISC_R_SUCCESS);
+			break;
+
+		case 'P':
+			RUNTIME_CHECK(parse_protocol(optarg) == ISC_R_SUCCESS);
+			break;
+
+		case 'w':
+			RUNTIME_CHECK(parse_workers(optarg) == ISC_R_SUCCESS);
+			break;
+
+		default:
+			INSIST(0);
+		}
+	}
+
+	isc_sockaddr_fromnetaddr(&sockaddr, &netaddr, port);
+
+	isc_sockaddr_format(&sockaddr, buf, sizeof(buf));
+
+	printf("Will listen at %s://%s, %d workers\n", protocols[protocol], buf,
+	       workers);
+}
+
+static void
+_signal(int sig, void (*handler)(int)) {
+	struct sigaction sa = { .sa_handler = handler };
+
+	RUNTIME_CHECK(sigfillset(&sa.sa_mask) == 0);
+	RUNTIME_CHECK(sigaction(sig, &sa, NULL) >= 0);
+}
+
+static void
+setup(void) {
+	sigset_t sset;
+
+	_signal(SIGPIPE, SIG_IGN);
+	_signal(SIGHUP, SIG_DFL);
+	_signal(SIGTERM, SIG_DFL);
+	_signal(SIGINT, SIG_DFL);
+
+	RUNTIME_CHECK(sigemptyset(&sset) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGHUP) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGINT) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGTERM) == 0);
+	RUNTIME_CHECK(pthread_sigmask(SIG_BLOCK, &sset, NULL) == 0);
+
+	isc_mem_create(&mctx);
+
+	netmgr = isc_nm_start(mctx, workers);
+}
+
+static void
+teardown(void) {
+	isc_nm_destroy(&netmgr);
+	isc_mem_destroy(&mctx);
+}
+
+static void
+yield(void) {
+	sigset_t sset;
+	int sig;
+
+	RUNTIME_CHECK(sigemptyset(&sset) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGHUP) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGINT) == 0);
+	RUNTIME_CHECK(sigaddset(&sset, SIGTERM) == 0);
+	RUNTIME_CHECK(sigwait(&sset, &sig) == 0);
+
+	fprintf(stderr, "Shutting down...\n");
+}
+
+static void
+read_cb(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
+	void *cbarg) {
+	isc_region_t *reply = NULL;
+
+	REQUIRE(handle != NULL);
+	REQUIRE(eresult == ISC_R_SUCCESS);
+	UNUSED(cbarg);
+
+	fprintf(stderr, "RECEIVED %u bytes\n", region->length);
+
+	if (region->length >= 12) {
+		/* long enough to be a DNS header, set QR bit */
+		((uint8_t *)region->base)[2] ^= 0x80;
+	}
+
+	reply = isc_mem_get(mctx, sizeof(isc_region_t) + region->length);
+	reply->length = region->length;
+	reply->base = (uint8_t *)reply + sizeof(isc_region_t);
+	memmove(reply->base, region->base, region->length);
+
+	isc_nm_send(handle, reply, send_cb, reply);
+	return;
+}
+
+static void
+send_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	isc_region_t *reply = cbarg;
+
+	REQUIRE(handle != NULL);
+	REQUIRE(eresult == ISC_R_SUCCESS);
+
+	isc_mem_put(mctx, cbarg, sizeof(isc_region_t) + reply->length);
+}
+
+static isc_result_t
+accept_cb(isc_nmhandle_t *handle, isc_result_t eresult, void *cbarg) {
+	REQUIRE(handle != NULL);
+	REQUIRE(eresult == ISC_R_SUCCESS);
+	UNUSED(cbarg);
+
+	return (ISC_R_SUCCESS);
+}
+
+static void
+run(void) {
+	isc_result_t result;
+	isc_nmsocket_t *sock = NULL;
+
+	switch (protocol) {
+	case UDP:
+		result = isc_nm_listenudp(netmgr, (isc_nmiface_t *)&sockaddr,
+					  read_cb, NULL, 0, &sock);
+		break;
+	case TCP:
+		result = isc_nm_listentcpdns(netmgr, (isc_nmiface_t *)&sockaddr,
+					     read_cb, NULL, accept_cb, NULL, 0,
+					     0, NULL, &sock);
+		break;
+	case DOT: {
+		isc_tlsctx_t *tlsdns_ctx = NULL;
+		isc_tlsctx_createserver(NULL, NULL, &tlsdns_ctx);
+
+		result = isc_nm_listentlsdns(netmgr, (isc_nmiface_t *)&sockaddr,
+					     read_cb, NULL, accept_cb, NULL, 0,
+					     0, NULL, tlsdns_ctx, &sock);
+		break;
+	}
+	case DOH:
+		INSIST(0);
+		ISC_UNREACHABLE();
+		break;
+	default:
+		INSIST(0);
+		ISC_UNREACHABLE();
+	}
+	REQUIRE(result == ISC_R_SUCCESS);
+
+	yield();
+
+	isc_nm_stoplistening(sock);
+	isc_nmsocket_close(&sock);
+}
+
+int
+main(int argc, char **argv) {
+	parse_options(argc, argv);
+
+	setup();
+
+	run();
+
+	teardown();
+
+	exit(EXIT_SUCCESS);
+}

bin/win32/BINDInstall/BINDInstallDlg.cpp

@@ -138,7 +138,8 @@ const FileData installFiles[] =
 	{"libdns.dll", FileData::BinDir, FileData::Critical, FALSE, TRUE},
 	{"libirs.dll", FileData::BinDir, FileData::Critical, FALSE, TRUE},
 	{"libeay32.dll", FileData::BinDir, FileData::Critical, FALSE, TRUE},
-	{"libuv.dll", FileData::BinDir, FileData::Critical, FALSE, TRUE},
+	{"nghttp2.dll", FileData::BinDir, FileData::Critical, FALSE, TRUE},
+	{"uv.dll", FileData::BinDir, FileData::Critical, FALSE, TRUE},
 #ifdef HAVE_LIBXML2
 	{"libxml2.dll", FileData::BinDir, FileData::Critical, FALSE, TRUE},
 #endif

config.h.win32

@@ -277,19 +277,19 @@ typedef __int64 off_t;
 @DNS_RDATASET_FIXED@
 
 /* Define if OpenSSL includes Ed25519 support */
-@HAVE_OPENSSL_ED25519@
+#define HAVE_OPENSSL_ED25519 1
 
 /* Define if OpenSSL includes Ed448 support */
-@HAVE_OPENSSL_ED448@
+#define HAVE_OPENSSL_ED448 1
 
 /* Define if your OpenSSL version supports DH functions. */
-@HAVE_DH_GET0_KEY@
+#define HAVE_DH_GET0_KEY 1
 
 /* Define if your OpenSSL version supports ECDSA functions. */
-@HAVE_ECDSA_SIG_GET0@
+#define HAVE_ECDSA_SIG_GET0 1
 
 /* Define if your OpenSSL version supports RSA functions. */
-@HAVE_RSA_SET0_KEY@
+#define HAVE_RSA_SET0_KEY 1
 
 /* define if OpenSSL is used for Public-Key Cryptography */
 @USE_OPENSSL@
@@ -297,9 +297,6 @@ typedef __int64 off_t;
 /* Define if native PKCS#11 is used as cryptographic library provider */
 @USE_PKCS11@
 
-/* HMAC_*() return ints */
-@HMAC_RETURN_INT@
-
 /* Define to 1 if you have the `readline' function. */
 @HAVE_READLINE@
 
@@ -328,34 +325,64 @@ typedef __int64 off_t;
 @WANT_QUERYTRACE@
 
 /* Define to 1 if you have the `CRYPTO_zalloc' function. */
-@HAVE_CRYPTO_ZALLOC@
+#define HAVE_CRYPTO_ZALLOC 1
 
 /* Define to 1 if you have the `EVP_CIPHER_CTX_free' function. */
-@HAVE_EVP_CIPHER_CTX_FREE@
+#define HAVE_EVP_CIPHER_CTX_FREE 1
 
 /* Define to 1 if you have the `EVP_CIPHER_CTX_new' function. */
-@HAVE_EVP_CIPHER_CTX_NEW@
+#define HAVE_EVP_CIPHER_CTX_NEW 1
 
 /* Define to 1 if you have the `EVP_MD_CTX_free' function. */
-@HAVE_EVP_MD_CTX_FREE@
+#define HAVE_EVP_MD_CTX_FREE 1
 
 /* Define to 1 if you have the `EVP_MD_CTX_new' function. */
-@HAVE_EVP_MD_CTX_NEW@
+#define HAVE_EVP_MD_CTX_NEW 1
 
 /* Define to 1 if you have the `EVP_MD_CTX_reset' function. */
-@HAVE_EVP_MD_CTX_RESET@
+#define HAVE_EVP_MD_CTX_RESET 1
 
 /* Define to 1 if you have the `HMAC_CTX_free' function. */
-@HAVE_HMAC_CTX_FREE@
+#define HAVE_HMAC_CTX_FREE 1
 
 /* Define to 1 if you have the `HMAC_CTX_get_md' function. */
-@HAVE_HMAC_CTX_GET_MD@
+#define HAVE_HMAC_CTX_GET_MD 1
 
 /* Define to 1 if you have the `HMAC_CTX_new' function. */
-@HAVE_HMAC_CTX_NEW@
+#define HAVE_HMAC_CTX_NEW 1
 
 /* Define to 1 if you have the `HMAC_CTX_reset' function. */
-@HAVE_HMAC_CTX_RESET@
+#define HAVE_HMAC_CTX_RESET 1
+
+/* Define to 1 if you have the `SSL_read_ex' function. */
+#define HAVE_SSL_READ_EX 1
+
+/* Define to 1 if you have the `SSL_peek_ex' function. */
+#define HAVE_SSL_PEEK_EX 1
+
+/* Define to 1 if you have the `SSL_write_ex' function. */
+#define HAVE_SSL_WRITE_EX 1
+
+/* Define to 1 if you have the `BIO_read_ex' function. */
+#define HAVE_BIO_READ_EX 1
+
+/* Define to 1 if you have the `BIO_write_ex' function. */
+#define HAVE_BIO_WRITE_EX 1
+
+/* Define to 1 if you have the `OPENSSL_init_crypto' function. */
+#define HAVE_OPENSSL_INIT_CRYPTO 1
+
+/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
+#define HAVE_OPENSSL_INIT_SSL 1
+
+/* Define to 1 if you have the `TLS_client_method' function. */
+#define HAVE_TLS_CLIENT_METHOD 1
+
+/* Define to 1 if you have the `TLS_server_method' function. */
+#define HAVE_TLS_SERVER_METHOD 1
+
+/* Define to 1 if you have the `SSL_CTX_up_ref' function. */
+#define SSL_CTX_UP_REF 1
 
 /* Define to 1 if you have the `uv_handle_get_data' function. */
 @HAVE_UV_HANDLE_GET_DATA@

configure.ac

@@ -14,7 +14,7 @@
 #
 m4_define([bind_VERSION_MAJOR], 9)dnl
 m4_define([bind_VERSION_MINOR], 17)dnl
-m4_define([bind_VERSION_PATCH], 8)dnl
+m4_define([bind_VERSION_PATCH], 9)dnl
 m4_define([bind_VERSION_EXTRA], )dnl
 m4_define([bind_DESCRIPTION], [(Development Release)])dnl
 m4_define([bind_SRCID], [m4_esyscmd_s([git rev-parse --short HEAD | cut -b1-7])])dnl
@@ -71,17 +71,6 @@ AS_IF([test "$cross_compiling" = no],
       [AM_MAINTAINER_MODE(m4_ifset([bind_SRCID],[enable],[disable]))],
       [AM_MAINTAINER_MODE([disable])])
 
-# Set the library versions
-# https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
-
-AX_BIND9_LIB_VERSION([bind9])
-AX_BIND9_LIB_VERSION([dns])
-AX_BIND9_LIB_VERSION([irs])
-AX_BIND9_LIB_VERSION([isc])
-AX_BIND9_LIB_VERSION([isccc])
-AX_BIND9_LIB_VERSION([isccfg])
-AX_BIND9_LIB_VERSION([ns])
-
 #
 # Enable system extensions to C and POSIX
 #
@@ -135,7 +124,7 @@ AS_IF([test "$enable_static" != "no" && test "$enable_developer" != "yes"],
 #
 # Set the default CFLAGS and CPPFLAGS
 #
-STD_CFLAGS="-Wall -Wextra -Wwrite-strings -Wcast-qual -Wpointer-arith -Wno-missing-field-initializers -Wformat -Wshadow"
+STD_CFLAGS="-Wall -Wextra -Wwrite-strings -Wpointer-arith -Wno-missing-field-initializers -Wformat -Wshadow"
 
 # These should be always errors
 STD_CFLAGS="$STD_CFLAGS -Werror=implicit-function-declaration -Werror=missing-prototypes -Werror=format-security -Werror=parentheses -Werror=implicit -Werror=strict-prototypes"
@@ -585,6 +574,15 @@ LIBS="$LIBS $LIBUV_LIBS"
 AC_CHECK_FUNCS([uv_handle_get_data uv_handle_set_data uv_import uv_udp_connect uv_translate_sys_error])
 AX_RESTORE_FLAGS([libuv])
 
+# libnghttp2
+AC_MSG_CHECKING([for libnghttp2])
+PKG_CHECK_MODULES([LIBNGHTTP2], [libnghttp2 >= 1.6.0], [],
+		  [AC_MSG_ERROR([libnghttp2 not found])])
+AX_SAVE_FLAGS([libnghttp2])
+
+CFLAGS="$CFLAGS $LIBNGHTTP2_CFLAGS"
+LIBS="$LIBS $LIBNGHTTP2_LIBS"
+
 #
 # flockfile is usually provided by pthreads
 #
@@ -623,11 +621,12 @@ AX_SAVE_FLAGS([openssl])
 CFLAGS="$CFLAGS $OPENSSL_CFLAGS"
 LIBS="$LIBS $OPENSSL_LIBS"
 
-AC_MSG_CHECKING([for OpenSSL >= 1.0.0 or LibreSSL])
+AC_MSG_CHECKING([for OpenSSL >= 1.0.0 or LibreSSL >= 2.7.0])
 AC_COMPILE_IFELSE(
     [AC_LANG_PROGRAM([[#include <openssl/opensslv.h>]],
-		     [[#if !defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER < 0x1000000fL)
-		       #error OpenSSL >= 1.0.0 or LibreSSL required
+		     [[#if (!defined(LIBRESSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER < 0x1000000fL)) || \\
+			   (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x02070000fL))
+		       #error OpenSSL >= 1.0.0 or LibreSSL >= 2.7.0 required
 		       #endif
 		      ]])],
     [AC_MSG_RESULT([yes])],
@@ -637,10 +636,15 @@ AC_COMPILE_IFELSE(
 # Check for functions added in OpenSSL or LibreSSL
 #
 
+AC_CHECK_FUNCS([OPENSSL_init_ssl OPENSSL_init_crypto])
 AC_CHECK_FUNCS([CRYPTO_zalloc])
 AC_CHECK_FUNCS([EVP_CIPHER_CTX_new EVP_CIPHER_CTX_free])
 AC_CHECK_FUNCS([EVP_MD_CTX_new EVP_MD_CTX_free EVP_MD_CTX_reset])
 AC_CHECK_FUNCS([HMAC_CTX_new HMAC_CTX_free HMAC_CTX_reset HMAC_CTX_get_md])
+AC_CHECK_FUNCS([SSL_read_ex SSL_peek_ex SSL_write_ex])
+AC_CHECK_FUNCS([BIO_read_ex BIO_write_ex])
+AC_CHECK_FUNCS([SSL_CTX_up_ref])
+AC_CHECK_FUNCS([SSL_CTX_set_min_proto_version])
 
 #
 # Check for algorithm support in OpenSSL
@@ -706,7 +710,7 @@ AC_CHECK_FUNCS([EVP_aes_128_ecb EVP_aes_192_ecb EVP_aes_256_ecb], [:],
 #
 AC_CHECK_FUNCS([DH_get0_key ECDSA_SIG_get0 RSA_set0_key])
 
-AC_CHECK_FUNCS([TLS_server_method])
+AC_CHECK_FUNCS([TLS_server_method TLS_client_method])
 
 #
 # Check whether FIPS mode is available and whether we should enable it

dangerfile.py

@@ -25,6 +25,9 @@ def added_lines(target_branch, paths):
             added_lines.append(line)
     return added_lines
 
+def lines_containing(lines, string):
+    return [l for l in lines if bytes(string, 'utf-8') in l]
+
 issue_or_mr_id_regex = re.compile(br'\[(GL [#!]|RT #)[0-9]+\]')
 release_notes_regex = re.compile(r'doc/(arm|notes)/notes-.*\.(rst|xml)')
 
@@ -40,33 +43,48 @@ target_branch = danger.gitlab.mr.target_branch
 #
 #     * The subject line starts with "fixup!" or "Apply suggestion".
 #
+#     * The subject line contains a trailing dot.
+#
 #     * There is no empty line between the subject line and the log message.
 #
 # - WARN if any of the following is true for any commit on the MR branch:
 #
-#     * The length of the subject line exceeds 72 characters.
+#     * The length of the subject line for a non-merge commit exceeds 72
+#       characters.
 #
-#     * There is no log message present (i.e. commit only has a subject) and the
-#       subject line does not contain any of the following strings: "fixup! ",
-#       " CHANGES ", " release note".
+#     * There is no log message present (i.e. commit only has a subject) and
+#       the subject line does not contain any of the following strings:
+#       "fixup!", " CHANGES ", " release note".
 #
 #     * Any line of the log message is longer than 72 characters.  This rule is
-#       not evaluated for lines starting with four spaces, which allows long
-#       lines to be included in the commit log message by prefixing them with
-#       four spaces (useful for pasting compiler warnings, static analyzer
-#       messages, log lines, etc.)
+#       not evaluated for:
+#
+#         - lines starting with four spaces, which allows long lines to be
+#           included in the commit log message by prefixing them with four
+#           spaces (useful for pasting compiler warnings, static analyzer
+#           messages, log lines, etc.),
+#
+#         - lines which contain references (i.e. those starting with "[1]",
+#           "[2]", etc.) which allows e.g. long URLs to be included in the
+#           commit log message.
 
+fixup_error_logged = False
 for commit in danger.git.commits:
     message_lines = commit.message.splitlines()
     subject = message_lines[0]
-    if subject.startswith('fixup!') or subject.startswith('Apply suggestion'):
+    if (not fixup_error_logged and
+            (subject.startswith('fixup!') or
+             subject.startswith('Apply suggestion'))):
         fail('Fixup commits are still present in this merge request. '
              'Please squash them before merging.')
-    if len(subject) > 72:
+        fixup_error_logged = True
+    if len(subject) > 72 and not subject.startswith('Merge branch '):
         warn(
             f'Subject line for commit {commit.sha} is too long: '
             f'```{subject}``` ({len(subject)} > 72 characters).'
         )
+    if subject[-1] == '.':
+        fail(f'Trailing dot found in the subject of commit {commit.sha}.')
     if len(message_lines) > 1 and message_lines[1]:
         fail(f'No empty line after subject for commit {commit.sha}.')
     if (len(message_lines) < 3 and
@@ -75,7 +93,9 @@ for commit in danger.git.commits:
             ' release note' not in subject):
         warn(f'Please write a log message for commit {commit.sha}.')
     for line in message_lines[2:]:
-        if len(line) > 72 and not line.startswith('    '):
+        if (len(line) > 72 and
+                not line.startswith('    ') and
+                not re.match(r'\[[0-9]+\]', line)):
             warn(
                 f'Line too long in log message for commit {commit.sha}: '
                 f'```{line}``` ({len(line)} > 72 characters).'
@@ -146,11 +166,14 @@ elif 'LGTM (Merge OK)' not in mr_labels:
 #   the MR did not forget about adding a CHANGES entry.)
 #
 # * The merge request updates the CHANGES file, but it has the "No CHANGES"
-#   label set.  (This attempts to ensure the the "No CHANGES" label is used in
+#   label set.  (This attempts to ensure that the "No CHANGES" label is used in
 #   a sane way.)
 #
-# * The merge request adds a new CHANGES entry that does not contain any
-#   GitLab/RT issue/MR identifiers.
+# * The merge request adds any placeholder entries to the CHANGES file, but it
+#   does not target the "main" branch.
+#
+# * The merge request adds a new CHANGES entry that is not a placeholder and
+#   does not contain any GitLab/RT issue/MR identifiers.
 
 changes_modified = 'CHANGES' in modified_files
 no_changes_label_set = 'No CHANGES' in mr_labels
@@ -162,9 +185,15 @@ if changes_modified and no_changes_label_set:
          'Revert `CHANGES` modifications or unset the *No Changes* label.')
 
 changes_added_lines = added_lines(target_branch, ['CHANGES'])
+placeholders_added = lines_containing(changes_added_lines, '[placeholder]')
 identifiers_found = filter(issue_or_mr_id_regex.search, changes_added_lines)
-if changes_added_lines and not any(identifiers_found):
-    fail('No valid issue/MR identifiers found in added `CHANGES` entries.')
+if changes_added_lines:
+    if placeholders_added:
+        if target_branch != 'main':
+            fail('This MR adds at least one placeholder entry to `CHANGES`. '
+                 'It should be targeting the `main` branch.')
+    elif not any(identifiers_found):
+        fail('No valid issue/MR identifiers found in added `CHANGES` entries.')
 
 ###############################################################################
 # RELEASE NOTES
@@ -179,15 +208,26 @@ if changes_added_lines and not any(identifiers_found):
 #       Notes" label set.  (This ensures that merge requests updating release
 #       notes can be easily found using the "Release Notes" label.)
 #
-# - WARN if this merge request updates release notes, but no GitLab/RT issue/MR
-#   identifiers are found in the lines added to the release notes by this MR.
+# - WARN if any of the following is true:
+#
+#     * This merge request does not update release notes and has the "Customer"
+#       label set.  (Except for trivial changes, all merge requests which may
+#       be of interest to customers should include a release note.)
+#
+#     * This merge request updates release notes, but no GitLab/RT issue/MR
+#       identifiers are found in the lines added to the release notes by this
+#       MR.
 
 release_notes_regex = re.compile(r'doc/(arm|notes)/notes-.*\.(rst|xml)')
 release_notes_changed = list(filter(release_notes_regex.match, modified_files))
 release_notes_label_set = 'Release Notes' in mr_labels
-if not release_notes_changed and release_notes_label_set:
-    fail('This merge request has the *Release Notes* label set. '
-         'Add a release note or unset the *Release Notes* label.')
+if not release_notes_changed:
+    if release_notes_label_set:
+        fail('This merge request has the *Release Notes* label set. '
+             'Add a release note or unset the *Release Notes* label.')
+    elif 'Customer' in mr_labels:
+        warn('This merge request has the *Customer* label set. '
+             'Add a release note unless the changes introduced are trivial.')
 if release_notes_changed and not release_notes_label_set:
     fail('This merge request modifies release notes. '
          'Revert release note modifications or set the *Release Notes* label.')
@@ -197,3 +237,36 @@ if release_notes_changed:
     identifiers_found = filter(issue_or_mr_id_regex.search, notes_added_lines)
     if notes_added_lines and not any(identifiers_found):
         warn('No valid issue/MR identifiers found in added release notes.')
+else:
+    notes_added_lines = []
+
+###############################################################################
+# CVE IDENTIFIERS
+###############################################################################
+#
+# FAIL if the merge request adds a CHANGES entry of type [security] and a CVE
+# identifier is missing from either the added CHANGES entry or the added
+# release note.
+
+if lines_containing(changes_added_lines, '[security]'):
+    if not lines_containing(changes_added_lines, '(CVE-20'):
+        fail('This merge request fixes a security issue. '
+             'Please add a CHANGES entry which includes a CVE identifier.')
+    if not lines_containing(notes_added_lines, 'CVE-20'):
+        fail('This merge request fixes a security issue. '
+             'Please add a release note which includes a CVE identifier.')
+
+###############################################################################
+# PAIRWISE TESTING
+###############################################################################
+#
+# FAIL if the merge request adds any new ./configure switch without an
+# associated annotation used for pairwise testing.
+
+configure_added_lines = added_lines(target_branch, ['configure.ac'])
+switches_added = (lines_containing(configure_added_lines, 'AC_ARG_ENABLE') +
+                  lines_containing(configure_added_lines, 'AC_ARG_WITH'))
+annotations_added = lines_containing(configure_added_lines, '# [pairwise: ')
+if len(switches_added) > len(annotations_added):
+    fail('This merge request adds at least one new `./configure` switch that '
+         'is not annotated for pairwise testing purposes.')

doc/arm/notes.rst

@@ -53,6 +53,7 @@ information about each release, source code, and pre-compiled versions
 for Microsoft Windows operating systems.
 
 .. include:: ../notes/notes-current.rst
+.. include:: ../notes/notes-9.17.9.rst
 .. include:: ../notes/notes-9.17.8.rst
 .. include:: ../notes/notes-9.17.7.rst
 .. include:: ../notes/notes-9.17.6.rst

doc/arm/reference.rst

@@ -30,7 +30,7 @@ file documentation:
         A list of one or more ``ip_addr``, ``ip_prefix``, ``key_id``, or ``acl_name`` elements; see :ref:`address_match_lists`.
 
     ``primaries_list``
-        A named list of one or more ``ip_addr`` with optional ``key_id`` and/or ``ip_port``. A ``primaries_list`` may include other ``primaries_list``.
+        A named list of one or more ``ip_addr`` with optional ``tls_id``, ``key_id`` and/or ``ip_port``. A ``primaries_list`` may include other ``primaries_list``.
 
     ``domain_name``
         A quoted string which is used as a DNS name; for example. ``my.test.domain``.
@@ -66,6 +66,9 @@ file documentation:
     ``key_list``
         A list of one or more ``key_id``, separated by semicolons and ending with a semicolon.
 
+    ``tls_id``
+        A string representing a TLS configuration object, including a key and certificate.
+
     ``number``
         A non-negative 32-bit integer (i.e., a number between 0 and 4294967295, inclusive). Its acceptable value might be further limited by the context in which it is used.
 
@@ -286,6 +289,9 @@ The following statements are supported:
     ``statistics-channels``
         Declares communication channels to get access to ``named`` statistics.
 
+    ``tls``
+        Specifies configuration information for a TLS connection, including a ``key-file``, ``cert-file``, ``ca-file`` and ``hostname``.
+
     ``trust-anchors``
         Defines DNSSEC trust anchors: if used with the ``initial-key`` or ``initial-ds`` keyword, trust anchors are kept up-to-date using :rfc:`5011` trust anchor maintenance; if used with ``static-key`` or ``static-ds``, keys are permanent.
 
@@ -1072,6 +1078,14 @@ default is used.
    the default is the ``named`` working directory.  See :ref:`acl`
    for details about ``geoip`` ACLs.
 
+.. _https_endpoint:
+
+``https-endpoint``
+   This configures an DNS-over-HTTPS service endpoint. It takes a string
+   which specifies the endpoint URL path, and an ``https-server``
+   parameter specifying the server name of an HTTPS listener. (See
+   :ref:`Link title <https_server>`.)
+
 ``key-directory``
    This is the directory where the public and private DNSSEC key files should be
    found when performing a dynamic update of secure zones, if different
@@ -1505,9 +1519,9 @@ default is used.
    treated as ``unlimited``.
 
 ``stale-answer-ttl``
-   This specifies the TTL to be returned on stale answers. The default is 1
-   second. The minimum allowed is also 1 second; a value of 0 is
-   updated silently to 1 second.
+   This specifies the TTL to be returned on stale answers. The default is 30
+   seconds. The minimum allowed is 1 second; a value of 0 is updated silently
+   to 1 second.
 
    For stale answers to be returned, they must be enabled, either in the
    configuration file using ``stale-answer-enable`` or via
@@ -1658,16 +1672,6 @@ Boolean Options
    flush any pending zone writes. The default is
    ``flush-zones-on-shutdown no``.
 
-``geoip-use-ecs``
-   This option was part of an experimental implementation of the EDNS
-   CLIENT-SUBNET for authoritative servers, but is now obsolete.
-
-``ipv4only-enable``
-   Create the IPV4ONLY.ARPA zone as described in RFC 8880.  By
-   default the zone is only created if a DNS64 prefix is configured.
-   Control the SOA contact and server values with ``ipv4only-contact``
-   and  ``ipv4only-server`` respectively.
-
 ``root-key-sentinel``
    If ``yes``, respond to root key sentinel probes as described in
    draft-ietf-dnsop-kskroll-sentinel-08. The default is ``yes``.
@@ -1781,9 +1785,6 @@ Boolean Options
    option in its response, then its contents are logged in the ``nsid``
    category at level ``info``. The default is ``no``.
 
-``request-sit``
-   This experimental option is obsolete.
-
 ``require-server-cookie``
    If ``yes``, require a valid server cookie before sending a full response to a UDP
    request from a cookie-aware client. BADCOOKIE is sent if there is a
@@ -1845,6 +1846,20 @@ Boolean Options
    Information about stale answers is logged under the ``serve-stale``
    log category.
 
+``stale-answer-client-timeout``
+   This option defines the amount of time ``named`` waits before attempting to
+   answer the query with a stale RRset from cache. If a stale answer is found,
+   ``named`` continues the ongoing fetches, attempting to refresh the RRset in
+   cache until the ``resolver-query-timeout`` interval is reached.
+
+   The default value is ``1800`` (in milliseconds) and the maximum value is
+   bounded to ``resolver-query-timeout`` minus one second. A value of ``0``
+   immediately returns a cached RRset if available, and still attempts a refresh
+   of the data in cache.
+
+   The option can be disabled by setting the value to ``off`` or ``disabled``.
+   It also has no effect if ``stale-answer-enable`` is disabled.
+
 ``stale-cache-enable``
    If ``yes``, enable the retaining of "stale" cached answers.  Default ``no``.
 
@@ -1868,9 +1883,6 @@ Boolean Options
    option may further limit the response size as the default for
    ``max-udp-size`` is 1232.
 
-``sit-secret``
-   This experimental option is obsolete.
-
 ``cookie-algorithm``
    This sets the algorithm to be used when generating the server cookie; the options are
    "aes", "sha1", or "sha256". The default is "aes" if supported by
@@ -1924,12 +1936,6 @@ Boolean Options
 
    The default is ``yes``.
 
-``use-ixfr``
-   *This option is obsolete*. To disable IXFR to a
-   particular server or servers, see the information on the
-   ``provide-ixfr`` option in :ref:`server_statement_definition_and_usage`.
-   See also :ref:`incremental_zone_transfers`.
-
 ``provide-ixfr``
    See the description of ``provide-ixfr`` in :ref:`server_statement_definition_and_usage`.
 
@@ -2003,9 +2009,6 @@ Boolean Options
 
    The default setting is ``auto-dnssec off``.
 
-``dnssec-enable``
-   This option is obsolete and has no effect.
-
 .. _dnssec-validation-option:
 
 ``dnssec-validation``
@@ -2369,12 +2372,6 @@ for details on how to specify IP address lists.
    and inherited by zones, this can lead to some zones unintentionally
    forwarding updates.
 
-``allow-v6-synthesis``
-   This option was introduced for the smooth transition from AAAA to A6
-   and from "nibble labels" to binary labels. However, since both A6 and
-   binary labels were then deprecated, this option was also deprecated.
-   It is now ignored with some warning messages.
-
 .. _allow-transfer-access:
 
 ``allow-transfer``
@@ -2447,6 +2444,8 @@ Interfaces
 
 The interfaces and ports that the server answers queries from may be
 specified using the ``listen-on`` and ``listen-on-v6`` options.
+specified using the ``listen-on`` and ``listen-on-v6`` options, as
+well as the ``https-server`` option for HTTPS queries.
 
 ``listen-on`` takes an optional port, an optional TLS configuration
 identifier, and an ``address_match_list`` of IPv4 addresses. (IPv6
@@ -2463,12 +2462,13 @@ Multiple ``listen-on`` statements are allowed. For example:
 
    listen-on { 5.6.7.8; };
    listen-on port 1234 { !1.2.3.4; 1.2/16; };
-   listen-on port 8853 tls example-tls { 4.3.2.1; };
+   listen-on port 8853 tls ephemeral { 4.3.2.1; };
 
 enables the name server to listen for standard DNS queries on port 53 of the
 IP address 5.6.7.8 and on port 1234 of an address on the machine in net 1.2
 that is not 1.2.3.4, and to listen for DNS-over-TLS connections on port
-8853 of the IP address 4.3.2.1.
+8853 of the IP address 4.3.2.1, using an ephemeral TLS key and certificate
+created for the currently running ``named`` process.
 
 If no ``listen-on`` is specified, the server listens for standard DNS
 on port 53 of all IPv4 interfaces.
@@ -2489,14 +2489,24 @@ Multiple ``listen-on-v6`` options can be used. For example:
 enables the name server to listen for standard DNS queries on port 53 of
 any IPv6 addresses and on port 1234 of IPv6 addresses that are not in the
 prefix 2001:db8::/32, and for DNS-over-TLS connections on port 8853 of
-the address 2001:db8::100.
+the address 2001:db8::100, using a TLS key and certificate specified in
+the a ``tls`` statement with the name ``example-tls``.
 
-To instruct the server not to listen on any IPv6 address, use:
+To instruct the server not to listen on any IPv6 addresses, use:
 
 ::
 
    listen-on-v6 { none; };
 
+.. _https_server:
+
+``https-server`` takes a server name, an optional port, a TLS
+configuration identifier, and an ``address_match_list`` of both IPv4 and
+IPv6 addresses.  This sets up an HTTPS responder using the key and
+certificate specified in the referenced ``tls`` statement.  The endpoint
+for incoming HTTPS queries must be specified using the ``https-endpoint``
+option (see :ref:`Link title <https_endpoint>`).
+
 .. _query_address:
 
 Query Address
@@ -2534,6 +2544,14 @@ system default range; otherwise, it uses its own defaults:
    use-v4-udp-ports { range 1024 65535; };
    use-v6-udp-ports { range 1024 65535; };
 
+The defaults of the ``avoid-v4-udp-ports`` and ``avoid-v6-udp-ports``
+options are:
+
+::
+
+   avoid-v4-udp-ports {};
+   avoid-v6-udp-ports {};
+
 .. note:: Make sure the ranges are sufficiently large for security. A
    desirable size depends on several parameters, but we generally recommend
    it contain at least 16384 ports (14 bits of entropy). Note also that the
@@ -2553,38 +2571,14 @@ system default range; otherwise, it uses its own defaults:
    set of ports that can be safely used in the expected operational
    environment.
 
-The defaults of the ``avoid-v4-udp-ports`` and ``avoid-v6-udp-ports``
-options are:
+.. note:: The address specified in the ``query-source`` option is used for both
+   UDP and TCP queries, but the port applies only to UDP queries. TCP
+   queries always use a random unprivileged port.
 
-::
+.. note:: Solaris 2.5.1 and earlier does not support setting the source address
+   for TCP sockets.
 
-   avoid-v4-udp-ports {};
-   avoid-v6-udp-ports {};
-
-.. note:: BIND 9.5.0 introduced the ``use-queryport-pool`` option to support
-   a pool of such random ports, but this option is now obsolete because
-   reusing the same ports in the pool may not be sufficiently secure. For
-   the same reason, it is generally strongly discouraged to specify a
-   particular port for the ``query-source`` or ``query-source-v6`` options;
-   it implicitly disables the use of randomized port numbers.
-
-``use-queryport-pool``
-   This option is obsolete.
-
-``queryport-pool-ports``
-   This option is obsolete.
-
-``queryport-pool-updateinterval``
-   This option is obsolete.
-
-   .. note:: The address specified in the ``query-source`` option is used for both
-      UDP and TCP queries, but the port applies only to UDP queries. TCP
-      queries always use a random unprivileged port.
-
-   .. note:: Solaris 2.5.1 and earlier does not support setting the source address
-      for TCP sockets.
-
-   .. note:: See also ``transfer-source`` and ``notify-source``.
+.. note:: See also ``transfer-source`` and ``notify-source``.
 
 .. _zone_transfers:
 
@@ -3062,9 +3056,6 @@ system.
 Periodic Task Intervals
 ^^^^^^^^^^^^^^^^^^^^^^^
 
-``cleaning-interval``
-   This option is obsolete.
-
 ``heartbeat-interval``
    The server performs zone maintenance tasks for all zones marked
    as ``dialup`` whenever this interval expires. The default is 60
@@ -3334,11 +3325,11 @@ Tuning
 
 ``max-stale-ttl``
    If retaining stale RRsets in cache is enabled, and returning of stale cached
-   answers is also enabled, ``max-stale-ttl`` sets the maximum time
-   for which the server retains records past their normal expiry to
-   return them as stale records, when the servers for those records are
-   not reachable. The default is 12 hours. The minimum allowed is 1
-   second; a value of 0 is updated silently to 1 second.
+   answers is also enabled, ``max-stale-ttl`` sets the maximum time for which
+   the server retains records past their normal expiry to return them as stale
+   records, when the servers for those records are not reachable. The default
+   is 1 day. The minimum allowed is 1 second; a value of 0 is updated silently
+   to 1 second.
 
    For stale answers to be returned, the retaining of them in cache must be
    enabled via the configuration option ``stale-cache-enable``, and returning
@@ -4615,6 +4606,43 @@ socket statistics), http://127.0.0.1:8888/json/v1/mem (memory manager
 statistics), http://127.0.0.1:8888/json/v1/tasks (task manager
 statistics), and http://127.0.0.1:8888/json/v1/traffic (traffic sizes).
 
+.. _tls:
+
+``tls`` Statement Grammar
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. include:: ../misc/tls.grammar.rst
+
+``tls`` Statement Definition and Usage
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The ``tls`` statement is used to configure a TLS connection; this
+configuration can then be referenced by a ``listen-on`` or ``listen-on-v6``
+statement to cause ``named`` to listen for incoming requests via TLS,
+or in the ``primaries`` statement for a zone of type ``secondary`` to
+cause zone transfer requests to be sent via TLS.
+
+``tls`` can only be set at the top level of ``named.conf``.
+
+The following options can be specified in a ``tls`` statement:
+
+  ``key-file``
+    Path to a file containing the private TLS key to be used for
+    the connection.
+
+  ``cert-file``
+    Path to a file containing the TLS certificate to be used for
+    the connection.
+
+  ``ca-file``
+    Path to a file containing trusted TLS certificates.
+
+  ``hostname``
+    The hostname associated with the certificate.
+
+The built-in ``ephemeral`` TLS connection object represents a temporary
+key and certificate created for the current ``named`` session only.
+
 .. _trust_anchors:
 
 ``trust-anchors`` Statement Grammar

doc/man/Makefile.am

@@ -75,6 +75,7 @@ MANPAGES_RST =				\
 
 man_MANS =				\
 	arpaname.1			\
+	ddns-confgen.8			\
 	delv.1				\
 	dig.1				\
 	dnstap-read.1			\

doc/man/arpaname.1in

@@ -43,6 +43,6 @@ BIND 9 Administrator Reference Manual.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/conf.py

@@ -32,7 +32,7 @@
 
 project = u'BIND 9'
 # pylint: disable=redefined-builtin
-copyright = u'2020, Internet Systems Consortium'
+copyright = u'2021, Internet Systems Consortium'
 author = u'Internet Systems Consortium'
 
 # -- General configuration ---------------------------------------------------
@@ -60,6 +60,7 @@ master_doc = 'index'
 # pylint: disable=line-too-long
 man_pages = [
     ('arpaname', 'arpaname', 'translate IP addresses to the corresponding ARPA names', author, 1),
+    ('ddns-confgen', 'ddns-confgen', 'ddns key generation tool', author, 8),
     ('delv', 'delv', 'DNS lookup and validation utility', author, 1),
     ('dig', 'dig', 'DNS lookup utility', author, 1),
     ('dnssec-cds', 'dnssec-cds', 'change DS records for a child zone based on CDS/CDNSKEY', author, 1),

doc/man/ddns-confgen.8in

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "DDNS-CONFGEN" "8" "@RELEASE_DATE@" "@BIND9_VERSION@" "BIND 9"
+.TH "DDNS-CONFGEN" "8" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
 .SH NAME
 ddns-confgen \- ddns key generation tool
 .
@@ -39,61 +39,61 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .sp
 \fBtsig\-keygen\fP and \fBddns\-confgen\fP are invocation methods for a
 utility that generates keys for use in TSIG signing. The resulting keys
-can be used, for example, to secure dynamic DNS updates to a zone or for
+can be used, for example, to secure dynamic DNS updates to a zone, or for
 the \fBrndc\fP command channel.
 .sp
 When run as \fBtsig\-keygen\fP, a domain name can be specified on the
-command line which will be used as the name of the generated key. If no
+command line to be used as the name of the generated key. If no
 name is specified, the default is \fBtsig\-key\fP\&.
 .sp
-When run as \fBddns\-confgen\fP, the generated key is accompanied by
-configuration text and instructions that can be used with \fBnsupdate\fP
+When run as \fBddns\-confgen\fP, the key name can specified using \fB\-k\fP
+parameter and defaults to \fBddns\-key\fP\&. The generated key is accompanied
+by configuration text and instructions that can be used with \fBnsupdate\fP
 and \fBnamed\fP when setting up dynamic DNS, including an example
-\fBupdate\-policy\fP statement. (This usage similar to the \fBrndc\-confgen\fP
-command for setting up command channel security.)
+\fBupdate\-policy\fP statement. (This usage is similar to the \fBrndc\-confgen\fP
+command for setting up command\-channel security.)
 .sp
 Note that \fBnamed\fP itself can configure a local DDNS key for use with
-\fBnsupdate \-l\fP: it does this when a zone is configured with
+\fBnsupdate \-l\fP; it does this when a zone is configured with
 \fBupdate\-policy local;\fP\&. \fBddns\-confgen\fP is only needed when a more
 elaborate configuration is required: for instance, if \fBnsupdate\fP is to
 be used from a remote system.
 .SH OPTIONS
 .INDENT 0.0
 .TP
-\fB\-a\fP algorithm
-Specifies the algorithm to use for the TSIG key. Available choices
-are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and
-hmac\-sha512. The default is hmac\-sha256. Options are
+.B \fB\-a algorithm\fP
+This option specifies the algorithm to use for the TSIG key. Available
+choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384,
+and hmac\-sha512. The default is hmac\-sha256. Options are
 case\-insensitive, and the "hmac\-" prefix may be omitted.
 .TP
-\fB\-h\fP
-Prints a short summary of options and arguments.
+.B \fB\-h\fP
+This option prints a short summary of options and arguments.
 .TP
-\fB\-k\fP keyname
-Specifies the key name of the DDNS authentication key. The default is
-\fBddns\-key\fP when neither the \fB\-s\fP nor \fB\-z\fP option is specified;
-otherwise, the default is \fBddns\-key\fP as a separate label followed
-by the argument of the option, e.g., \fBddns\-key.example.com.\fP The
-key name must have the format of a valid domain name, consisting of
-letters, digits, hyphens and periods.
+.B \fB\-k keyname\fP
+This option specifies the key name of the DDNS authentication key. The
+default is \fBddns\-key\fP when neither the \fB\-s\fP nor \fB\-z\fP option is
+specified; otherwise, the default is \fBddns\-key\fP as a separate label
+followed by the argument of the option, e.g., \fBddns\-key.example.com.\fP
+The key name must have the format of a valid domain name, consisting of
+letters, digits, hyphens, and periods.
 .TP
-\fB\-q\fP
-(\fBddns\-confgen\fP only.) Quiet mode: Print only the key, with no
-explanatory text or usage examples; This is essentially identical to
+.B \fB\-q\fP (\fBddns\-confgen\fP only)
+This option enables quiet mode, which prints only the key, with no
+explanatory text or usage examples. This is essentially identical to
 \fBtsig\-keygen\fP\&.
 .TP
-\fB\-s\fP name
-(\fBddns\-confgen\fP only.) Generate configuration example to allow
-dynamic updates of a single hostname. The example \fBnamed.conf\fP text
-shows how to set an update policy for the specified name using the
-"name" nametype. The default key name is ddns\-key.name. Note that the
-"self" nametype cannot be used, since the name to be updated may
-differ from the key name. This option cannot be used with the \fB\-z\fP
-option.
+.B \fB\-s name\fP (\fBddns\-confgen\fP only)
+This option generates a configuration example to allow dynamic updates
+of a single hostname. The example \fBnamed.conf\fP text shows how to set
+an update policy for the specified name using the "name" nametype. The
+default key name is \fBddns\-key.name\fP\&. Note that the "self" nametype
+cannot be used, since the name to be updated may differ from the key
+name. This option cannot be used with the \fB\-z\fP option.
 .TP
-\fB\-z\fP zone
-(\fBddns\-confgen\fP only.) Generate configuration example to allow
-dynamic updates of a zone: The example \fBnamed.conf\fP text shows how
+.B \fB\-z zone\fP (\fBddns\-confgen\fP only)
+This option generates a configuration example to allow
+dynamic updates of a zone. The example \fBnamed.conf\fP text shows how
 to set an update policy for the specified zone using the "zonesub"
 nametype, allowing updates to all subdomain names within that zone.
 This option cannot be used with the \fB\-s\fP option.
@@ -104,6 +104,6 @@ This option cannot be used with the \fB\-s\fP option.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/delv.1in

@@ -340,6 +340,6 @@ This option prints response data in YAML format.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/dig.1in

@@ -647,6 +647,6 @@ There are probably too many query options.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/dnssec-cds.1in

@@ -224,6 +224,6 @@ Reference Manual, \fI\%RFC 7344\fP\&.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/dnssec-dsfromkey.1in

@@ -144,6 +144,6 @@ A keyfile error may return "file not found," even if the file exists.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/dnssec-importkey.1in

@@ -121,6 +121,6 @@ or the full file name \fBKnnnn.+aaa+iiiii.key\fP, as generated by
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/dnssec-keyfromlabel.1in

@@ -76,9 +76,9 @@ versions, then the NSEC3 version is used; for example,
 .B \fB\-E engine\fP
 This option specifies the cryptographic hardware to use.
 .sp
-When BIND 9 is built with OpenSSL PKCS#11 support, this defaults to the
-string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
-cryptographic accelerator or hardware service module. When BIND is
+When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+engine identifier that drives the cryptographic accelerator or
+hardware service module (usually \fBpkcs11\fP). When BIND is
 built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
 defaults to the path of the PKCS#11 provider library specified via
 \fB\-\-with\-pkcs11\fP\&.
@@ -276,6 +276,6 @@ security reasons, this file does not have general read permission.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/dnssec-keygen.1in

@@ -103,9 +103,9 @@ ECDSAP384SHA384, ED25519, and ED448.
 .B \fB\-E engine\fP
 This option specifies the cryptographic hardware to use, when applicable.
 .sp
-When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
-cryptographic accelerator or hardware service module. When BIND is
+When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+engine identifier that drives the cryptographic accelerator or
+hardware service module (usually \fBpkcs11\fP). When BIND is
 built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
 defaults to the path of the PKCS#11 provider library specified via
 \fB\-\-with\-pkcs11\fP\&.
@@ -320,6 +320,6 @@ To generate a matching key\-signing key, issue the command:
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/dnssec-revoke.1in

@@ -59,9 +59,9 @@ This option prints version information.
 .B \fB\-E engine\fP
 This option specifies the cryptographic hardware to use, when applicable.
 .sp
-When BIND 9 is built with OpenSSL PKCS#11 support, this defaults to the
-string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
-cryptographic accelerator or hardware service module. When BIND is
+When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+engine identifier that drives the cryptographic accelerator or
+hardware service module (usually \fBpkcs11\fP). When BIND is
 built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
 defaults to the path of the PKCS#11 provider library specified via
 \fB\-\-with\-pkcs11\fP\&.
@@ -81,6 +81,6 @@ revoke the key.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/dnssec-settime.1in

@@ -102,9 +102,9 @@ This option sets the debugging level.
 .B \fB\-E engine\fP
 This option specifies the cryptographic hardware to use, when applicable.
 .sp
-When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
-cryptographic accelerator or hardware service module. When BIND is
+When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+engine identifier that drives the cryptographic accelerator or
+hardware service module (usually \fBpkcs11\fP). When BIND is
 built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
 defaults to the path of the PKCS#11 provider library specified via
 \fB\-\-with\-pkcs11\fP\&.
@@ -241,6 +241,6 @@ metadata, use \fBall\fP\&.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/dnssec-signzone.1in

@@ -69,9 +69,9 @@ The resulting file can be included in the original zone file with
 This option specifies the hardware to use for cryptographic
 operations, such as a secure key store used for signing, when applicable.
 .sp
-When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
-cryptographic accelerator or hardware service module. When BIND is
+When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+engine identifier that drives the cryptographic accelerator or
+hardware service module (usually \fBpkcs11\fP). When BIND is
 built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
 defaults to the path of the PKCS#11 provider library specified via
 \fB\-\-with\-pkcs11\fP\&.
@@ -412,6 +412,6 @@ db.example.com.signed
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/dnssec-verify.1in

@@ -47,9 +47,9 @@ This option specifies the DNS class of the zone.
 .B \fB\-E engine\fP
 This option specifies the cryptographic hardware to use, when applicable.
 .sp
-When BIND is built with OpenSSL PKCS#11 support, this defaults to the
-string \fBpkcs11\fP, which identifies an OpenSSL engine that can drive a
-cryptographic accelerator or hardware service module. When BIND is
+When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+engine identifier that drives the cryptographic accelerator or
+hardware service module (usually \fBpkcs11\fP). When BIND is
 built with native PKCS#11 cryptography (\fB\-\-enable\-native\-pkcs11\fP), it
 defaults to the path of the PKCS#11 provider library specified via
 \fB\-\-with\-pkcs11\fP\&.
@@ -108,6 +108,6 @@ This option indicates the file containing the zone to be signed.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/dnstap-read.1in

@@ -62,6 +62,6 @@ This option prints \fBdnstap\fP data in a detailed YAML format.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/filter-aaaa.8in

@@ -105,6 +105,6 @@ BIND 9 Administrator Reference Manual.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/host.1in

@@ -177,6 +177,6 @@ when \fBhost\fP runs.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/mdig.1in

@@ -336,6 +336,6 @@ This flag is off by default.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/named-checkconf.1in

@@ -103,6 +103,6 @@ and 0 otherwise.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/named-checkzone.1in

@@ -213,6 +213,6 @@ Manual.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .

doc/man/named-journalprint.1in

@@ -56,6 +56,6 @@ the resource record in master\-file format.
 .SH AUTHOR
 Internet Systems Consortium
 .SH COPYRIGHT
-2020, Internet Systems Consortium
+2021, Internet Systems Consortium
 .\" Generated by docutils manpage writer.
 .