change ISC__BUFFER macros to inline functions

previously, when ISC_BUFFER_USEINLINE was defined, macros were used to implement isc_buffer primitives (isc_buffer_init(), isc_buffer_region(), etc). these macros were missing the DbC assertions for those primitives, which made it possible for coding errors to go undetected. adding the assertions to the macros caused compiler warnings on some platforms. therefore, this commit converts the ISC__BUFFER macros to static inline functions instead, with assertions included, and eliminates the non-inline implementation from buffer.c. the --enable-buffer-useinline configure option has been removed.
2022-09-12 14:36:47 -07:00
973 changed files with 30328 additions and 38391 deletions
@@ -1,55 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ "v9_16", "v9_18", "main" ]
-  schedule:
-    - cron: '39 8 * * 3'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'cpp' ]
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    - name: Install build dependencies
-      uses: awalsh128/cache-apt-pkgs-action@latest
-      with:
-        packages: libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
-        version: 1.0
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-
-    #   If the Autobuild fails above, remove it and uncomment the following three lines.
-    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
-
-    # - run: |
-    #   echo "Run, Build Application using script"
-    #   ./location_of_script_within_repo/buildscript.sh
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
-      with:
-        category: "/language:${{matrix.language}}"
@@ -8,13 +8,11 @@ variables:
  CCACHE_DIR: "/ccache"

  GIT_DEPTH: 1
-
-  # The following values may be overwritten in GitLab's CI/CD Variables Settings.
  BUILD_PARALLEL_JOBS: 6
-  TEST_PARALLEL_JOBS: 4
+  TEST_PARALLEL_JOBS: 6

  CONFIGURE: ./configure
-  CLANG_VERSION: 15
+  CLANG_VERSION: 14
  CLANG: "clang-${CLANG_VERSION}"
  SCAN_BUILD: "scan-build-${CLANG_VERSION}"
  ASAN_SYMBOLIZER_PATH: "/usr/lib/llvm-${CLANG_VERSION}/bin/llvm-symbolizer"
@@ -25,7 +23,6 @@ variables:
  # Pass run-time flags to AddressSanitizer to get core dumps on error.
  ASAN_OPTIONS: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
  TSAN_OPTIONS_COMMON: "disable_coredump=0 second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan"
-  UBSAN_OPTIONS: "halt_on_error=1:abort_on_error=1:disable_coredump=0"

  TARBALL_EXTENSION: xz

@@ -125,6 +122,10 @@ stages:

 # Debian

+.debian-buster-amd64: &debian_buster_amd64_image
+  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
+  <<: *linux_amd64
+
 .debian-bullseye-amd64: &debian_bullseye_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-bullseye-amd64"
  <<: *linux_amd64
@@ -145,16 +146,20 @@ stages:

 # Fedora

-.fedora-37-amd64: &fedora_37_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-37-amd64"
+.fedora-35-amd64: &fedora_35_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-35-amd64"
  <<: *linux_amd64

-.fedora-37-arm64: &fedora_37_arm64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-37-arm64"
+.fedora-35-arm64: &fedora_35_arm64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-35-arm64"
  <<: *linux_stress_arm64

 # Ubuntu

+.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
+  <<: *linux_amd64
+
 .ubuntu-focal-amd64: &ubuntu_focal_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-focal-amd64"
  <<: *linux_amd64
@@ -180,7 +185,7 @@ stages:
  <<: *libvirt_amd64

 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-7.2-x86_64"
+  image: "openbsd-7.1-x86_64"
  <<: *libvirt_amd64

 ### Job Templates
@@ -233,18 +238,9 @@ stages:
      --with-cmocka
      --with-libxml2
      --with-json-c
-      --enable-leak-detection
      $EXTRA_CONFIGURE
      || (test -s config.log && cat config.log; exit 1)

-# change directory to the workspace before including this
-.find_python: &find_python
-  - PYTHON="$(source bin/tests/system/conf.sh; echo $PYTHON)"
-  - test -x "$PYTHON"
-
-.parse_tsan: &parse_tsan
-    - find -name 'tsan.*' -exec "$PYTHON" util/parse_tsan.py {} \;
-
 .check_readline_setup: &check_readline_setup
    - if [[ -n "${WITHOUT_READLINE}" ]]; then
        ! grep "^#define HAVE_READLINE" config.h;
@@ -276,16 +272,13 @@ stages:
    - *configure
    - *check_readline_setup
    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
-    - test -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && CFLAGS="${CFLAGS} -Werror" make -C "${DIR}"; done
    - test -z "${RUN_MAKE_INSTALL}" || make DESTDIR="${INSTALL_PATH}" install
-    - test -z "${RUN_MAKE_INSTALL}" -o -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && make -C "${DIR}" DESTDIR="${INSTALL_PATH}" install; done
    - test -z "${RUN_MAKE_INSTALL}" || DESTDIR="${INSTALL_PATH}" sh util/check-make-install
    - if [[ "${CFLAGS}" == *"-fsanitize=address"* ]]; then ( ! grep -F AddressSanitizer config.log ); fi
    - test -z "${CROSS_COMPILATION}" || grep -F -A 1 "checking whether we are cross compiling" config.log | grep -q "result.*yes"
    - test -z "${CROSS_COMPILATION}" || file lib/dns/gen | grep -F -q "ELF 64-bit LSB"
    - test -z "${CROSS_COMPILATION}" || ( ! git ls-files -z --others --exclude lib/dns/gen | xargs -0 file | grep "ELF 64-bit LSB" )
    - if test -z "${OUT_OF_TREE_WORKSPACE}" && test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
-    - bin/named/named -V
  needs:
    - job: autoreconf
      artifacts: true
@@ -311,15 +304,11 @@ stages:
    - cd bin/tests/system
    - make -j${TEST_PARALLEL_JOBS:-1} -k check V=1
    - if git rev-parse > /dev/null 2>&1; then ( ! grep "^I:.*:file.*not removed$" *.log ); fi
-    - '( ! grep -F "grep: warning:" *.log )'
  after_script:
-    - test -d bind-* && cd bind-*
-    - REALSOURCEDIR="$PWD"
    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
+    - test -d bind-* && cd bind-*
    - cat bin/tests/system/test-suite.log
-    - *find_python
-    - >
-      "$PYTHON" "$REALSOURCEDIR"/bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
+    - (source bin/tests/system/conf.sh && "${PYTHON}" "${CI_PROJECT_DIR}/bin/tests/convert-trs-to-junit.py" . > "${CI_PROJECT_DIR}/junit.xml")

 .system_test: &system_test_job
  <<: *system_test_common
@@ -341,13 +330,11 @@ stages:
  <<: *system_test_common
  after_script:
    - cat bin/tests/system/test-suite.log
-    - *find_python
-    - *parse_tsan
-    - >
-      "$PYTHON" bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
+    - find bin -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
+    - (source bin/tests/system/conf.sh && "${PYTHON}" "${CI_PROJECT_DIR}/bin/tests/convert-trs-to-junit.py" . > "${CI_PROJECT_DIR}/junit.xml")
  artifacts:
-    untracked: true
    expire_in: "1 day"
+    untracked: true
    when: always
    reports:
      junit: junit.xml
@@ -360,12 +347,9 @@ stages:
  script:
    - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1
  after_script:
-    - test -d bind-* && cd bind-*
-    - REALSOURCEDIR="$PWD"
    - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
-    - *find_python
-    - >
-      "$PYTHON" "$REALSOURCEDIR"/bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
+    - test -d bind-* && cd bind-*
+    - (source bin/tests/system/conf.sh && "${PYTHON}" "${CI_PROJECT_DIR}/bin/tests/convert-trs-to-junit.py" . > "${CI_PROJECT_DIR}/junit.xml")

 .unit_test: &unit_test_job
  <<: *unit_test_common
@@ -386,13 +370,14 @@ stages:
 .unit_test_tsan: &unit_test_tsan_job
  <<: *unit_test_common
  after_script:
-    - *find_python
-    - *parse_tsan
-    - >
-      "$PYTHON" bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
+    - find lib -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
+    - (source bin/tests/system/conf.sh && "${PYTHON}" "${CI_PROJECT_DIR}/bin/tests/convert-trs-to-junit.py" . > "${CI_PROJECT_DIR}/junit.xml")
  artifacts:
-    untracked: true
    expire_in: "1 day"
+    paths:
+      - tests/*/tsan.*
+      - tsan/
+      - junit.xml
    when: always
    reports:
      junit: junit.xml
@@ -446,7 +431,6 @@ misc:
    - test ! -f CHANGES.SE || sh util/check-line-length.sh CHANGES.SE
    - rm CHANGES.tmp
    - sh util/check-categories.sh
-    - sh util/check-gitignore.sh
    - if git grep SYSTEMTESTTOP -- ':!.gitlab-ci.yml'; then echo 'Please use relative paths instead of $SYSTEMTESTTOP.'; exit 1; fi
    - bash util/unused-headers.sh
    - bash util/xmllint-html.sh
@@ -518,12 +502,6 @@ danger:
    variables:
      - $DANGER_GITLAB_API_TOKEN

-checkbashisms:
-  <<: *precheck_job
-  needs: []
-  script:
-    - checkbashisms $(find . -path './.git' -prune -o -type f -exec sh -c 'head -n 1 "{}" | grep -qsF "#!/bin/sh"' \; -print)
-
 tarball-create:
  stage: precheck
  <<: *base_image
@@ -645,7 +623,7 @@ gcc:oraclelinux9:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2 --disable-developer"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *oraclelinux_9_amd64_image
  <<: *build_job

@@ -663,16 +641,41 @@ unit:gcc:oraclelinux9:amd64:
    - job: gcc:oraclelinux9:amd64
      artifacts: true

+# Jobs for regular GCC builds on Debian 10 "buster" (amd64)
+
+gcc:buster:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_buster_amd64_image
+  <<: *build_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+
+system:gcc:buster:amd64:
+  <<: *debian_buster_amd64_image
+  <<: *system_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  needs:
+    - job: gcc:buster:amd64
+      artifacts: true
+
+unit:gcc:buster:amd64:
+  <<: *debian_buster_amd64_image
+  <<: *unit_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  needs:
+    - job: gcc:buster:amd64
+      artifacts: true
+
 # Jobs for regular GCC builds on Debian 11 "bullseye" (amd64)
 # (The second unit test job also executes unstable unit tests.)

 gcc:bullseye:amd64:
  variables:
-    BUILD_CONTRIB: 1
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT}"
-    RUN_MAKE_INSTALL: 1
  <<: *debian_bullseye_amd64_image
  <<: *build_job

@@ -765,50 +768,19 @@ scan-build:
    expire_in: "1 day"
    when: on_failure

-# Jobs for strict OpenSSL 3.x (no deprecated) GCC builds on Debian "sid" (amd64)
-
-gcc:ossl3:sid:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O3 -DOPENSSL_NO_DEPRECATED=1 -DOPENSSL_API_COMPAT=30000"
-    RUN_MAKE_INSTALL: 1
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-
-system:gcc:ossl3:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *system_test_job
-  needs:
-    - job: gcc:ossl3:sid:amd64
-      artifacts: true
-
-unit:gcc:ossl3:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  needs:
-    - job: gcc:ossl3:sid:amd64
-      artifacts: true
-
 # Jobs for regular GCC builds on Debian "sid" (amd64)
 # Also tests configration option: --without-lmdb.

 gcc:sid:amd64:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O3 -DOPENSSL_API_COMPAT=10100"
-    # For the jemalloc ./configure option, see https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
-    EXTRA_CONFIGURE: "--with-libidn2 --without-lmdb --without-jemalloc --disable-leak-detection ${WITH_READLINE}"
+    CFLAGS: "${CFLAGS_COMMON} -O3"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-lmdb ${WITH_READLINE}"
    RUN_MAKE_INSTALL: 1
  <<: *debian_sid_amd64_image
  <<: *build_job

 system:gcc:sid:amd64:
-  # Set up environment variables that allow the "keyfromlabel" system test to be run
-  variables:
-    DEFAULT_OPENSSL_CONF: "/etc/ssl/openssl.cnf"
-    OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
-    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
-    SOFTHSM2_MODULE: "/usr/lib/softhsm/libsofthsm2.so"
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  needs:
@@ -916,13 +888,40 @@ unit:gcc:tumbleweed:amd64:
    - job: gcc:tumbleweed:amd64
      artifacts: true

+# Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
+
+gcc:bionic:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -O2"
+    EXTRA_CONFIGURE: "--disable-dnstap --without-cmocka --without-gssapi"
+  <<: *ubuntu_bionic_amd64_image
+  <<: *build_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+
+system:gcc:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *system_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  needs:
+    - job: gcc:bionic:amd64
+      artifacts: true
+
+unit:gcc:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *unit_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  needs:
+    - job: gcc:bionic:amd64
+      artifacts: true
+
 # Jobs for regular GCC builds on Ubuntu 20.04 Focal Fossa (amd64)

 gcc:focal:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
-    EXTRA_CONFIGURE: "--disable-dnstap --without-cmocka --without-gssapi --with-libidn2"
+    EXTRA_CONFIGURE: "--disable-geoip --with-libidn2"
  <<: *ubuntu_focal_amd64_image
  <<: *build_job

@@ -946,7 +945,7 @@ gcc:jammy:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--disable-geoip --with-libidn2 --disable-doh"
+    EXTRA_CONFIGURE: "--with-libidn2 --disable-doh"
  <<: *ubuntu_jammy_amd64_image
  <<: *build_job

@@ -964,28 +963,28 @@ unit:gcc:jammy:amd64:
    - job: gcc:jammy:amd64
      artifacts: true

-# Jobs for ASAN builds on Fedora 37 (amd64)
+# Jobs for ASAN builds on Fedora 35 (amd64)

 gcc:asan:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined -Wno-error=stringop-overread"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc"
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
  <<: *build_job

 system:gcc:asan:
  variables:
    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:asan
      artifacts: true

 unit:gcc:asan:
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:asan
@@ -1014,7 +1013,7 @@ unit:clang:asan:
    - job: clang:asan
      artifacts: true

-# Jobs for TSAN builds on Fedora 37 (amd64)
+# Jobs for TSAN builds on Fedora 35 (amd64)

 gcc:tsan:
  variables:
@@ -1022,13 +1021,13 @@ gcc:tsan:
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
  <<: *build_job

 system:gcc:tsan:
  variables:
    TSAN_OPTIONS: "${TSAN_OPTIONS_COMMON} external_symbolizer_path=/usr/bin/llvm-symbolizer"
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
  <<: *system_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -1037,7 +1036,7 @@ system:gcc:tsan:
 unit:gcc:tsan:
  variables:
    TSAN_OPTIONS: "${TSAN_OPTIONS_COMMON} external_symbolizer_path=/usr/bin/llvm-symbolizer"
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
  <<: *unit_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -1071,17 +1070,13 @@ unit:clang:tsan:
      artifacts: true

 # Jobs for Clang builds on Debian 11 "bullseye" (amd64)
-# The -Wno-compound-token-split-by-macro option prevents warning when compiling
-# Perl DLZ module with Clang against Perl older than version 5.35.2.

 clang:bullseye:amd64:
  variables:
-    BUILD_CONTRIB: 1
    CC: ${CLANG}
-    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion -Wno-compound-token-split-by-macro"
+    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
-    EXTRA_CONFIGURE: "--without-jemalloc --disable-leak-detection"
-    RUN_MAKE_INSTALL: 1
+    EXTRA_CONFIGURE: "--without-jemalloc"
  <<: *debian_bullseye_amd64_image
  <<: *build_job

@@ -1219,7 +1214,7 @@ release:
  artifacts:
    paths:
      - "*.tar.gz"
-    expire_in: never
+    expire_in: "1 day"

 # Coverity Scan analysis upload

@@ -1286,36 +1281,6 @@ respdiff-short:
  script:
    - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"

-respdiff-short:asan:
-  <<: *respdiff_job
-  <<: *default_triggering_rules
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
-    LDFLAGS: "-fsanitize=address,undefined"
-    EXTRA_CONFIGURE: "--without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
-  script:
-    - bash respdiff.sh -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-  allow_failure: true
-
-respdiff-short:tsan:
-  <<: *respdiff_job
-  <<: *default_triggering_rules
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
-    TSAN_OPTIONS: "${TSAN_OPTIONS_COMMON} external_symbolizer_path=/usr/bin/llvm-symbolizer"
-  script:
-    - bash respdiff.sh -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-  after_script:
-    - *find_python
-    - *parse_tsan
-  allow_failure: true
-
 respdiff-long:
  <<: *respdiff_job
  <<: *api_schedules_tags_triggers_web_triggering_rules
@@ -1326,36 +1291,6 @@ respdiff-long:
  script:
    - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"

-respdiff-long:asan:
-  <<: *respdiff_job
-  <<: *api_schedules_tags_triggers_web_triggering_rules
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
-    LDFLAGS: "-fsanitize=address,undefined"
-    EXTRA_CONFIGURE: "--without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
-  script:
-    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-  allow_failure: true
-
-respdiff-long:tsan:
-  <<: *respdiff_job
-  <<: *api_schedules_tags_triggers_web_triggering_rules
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
-    TSAN_OPTIONS: "${TSAN_OPTIONS_COMMON} external_symbolizer_path=/usr/bin/llvm-symbolizer"
-  script:
-    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-  after_script:
-    - *find_python
-    - *parse_tsan
-  allow_failure: true
-
 respdiff-long-third-party:
  <<: *respdiff_job
  <<: *api_schedules_tags_triggers_web_triggering_rules
@@ -1383,12 +1318,12 @@ respdiff-long-third-party:
      artifacts: true
  artifacts:
    untracked: true
-    expire_in: "1 week"
+    expire_in: "1 day"
    when: always
  timeout: 2h

-stress:authoritative:fedora:37:amd64:
-  <<: *fedora_37_amd64_image
+stress:authoritative:fedora:35:amd64:
+  <<: *fedora_35_amd64_image
  <<: *linux_stress_amd64
  <<: *stress_job
  variables:
@@ -1401,8 +1336,8 @@ stress:authoritative:fedora:37:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:recursive:fedora:37:amd64:
-  <<: *fedora_37_amd64_image
+stress:recursive:fedora:35:amd64:
+  <<: *fedora_35_amd64_image
  <<: *linux_stress_amd64
  <<: *stress_job
  variables:
@@ -1415,8 +1350,8 @@ stress:recursive:fedora:37:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:rpz:fedora:37:amd64:
-  <<: *fedora_37_amd64_image
+stress:rpz:fedora:35:amd64:
+  <<: *fedora_35_amd64_image
  <<: *linux_stress_amd64
  <<: *stress_job
  variables:
@@ -1429,8 +1364,8 @@ stress:rpz:fedora:37:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:authoritative:fedora:37:arm64:
-  <<: *fedora_37_arm64_image
+stress:authoritative:fedora:35:arm64:
+  <<: *fedora_35_arm64_image
  <<: *linux_stress_arm64
  <<: *stress_job
  variables:
@@ -1443,8 +1378,8 @@ stress:authoritative:fedora:37:arm64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:recursive:fedora:37:arm64:
-  <<: *fedora_37_arm64_image
+stress:recursive:fedora:35:arm64:
+  <<: *fedora_35_arm64_image
  <<: *linux_stress_arm64
  <<: *stress_job
  variables:
@@ -1457,8 +1392,8 @@ stress:recursive:fedora:37:arm64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:rpz:fedora:37:arm64:
-  <<: *fedora_37_arm64_image
+stress:rpz:fedora:35:arm64:
+  <<: *fedora_35_arm64_image
  <<: *linux_stress_arm64
  <<: *stress_job
  variables:
@@ -1513,22 +1448,6 @@ stress:rpz:freebsd12:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-# git fsck operates over the whole repository and is sufficient to schedule it
-# only in one branch, preferably "main". GitLab's clone strategy prevents us
-# from using the "bind9" repo clone; we need to clone it ourselves.
-fsck:
-  <<: *base_image
-  stage: postcheck
-  variables:
-    GIT_STRATEGY: none
-  script:
-    - git clone https://gitlab.isc.org/isc-projects/bind9.git bind9-full-clone
-    - cd bind9-full-clone/
-    - git fsck
-  only:
-    - schedules
-  needs: []
-
 gcov:
  <<: *base_image
  <<: *default_triggering_rules
@@ -1544,20 +1463,20 @@ gcov:
    # Help gcovr process the nasty tricks in lib/dns/code.h, where we include C
    # source files from lib/dns/rdata/*/, using an even nastier trick.
    - find lib/dns/rdata/* -name "*.c" -execdir cp -f "{}" ../../ \;
-    # Help gcovr process inline functions in headers by copying all libdns and
-    # libisc headers to lib/{dns,isc,ns}/.
-    - for SRC in dns isc; do for DST in dns isc ns; do cp -f "lib/${SRC}/include/${SRC}"/*.h "lib/${DST}/"; done; done
+    # Help gcovr process inline functions in headers
+    - cp -f lib/isc/include/isc/*.h lib/isc/
+    - cp -f lib/dns/include/dns/*.h lib/dns/
+    - cp -f lib/dns/include/dns/*.h lib/ns/
    - find bin lib -maxdepth 1 -mindepth 1 -type d -exec cp -f lib/isc/include/isc/buffer.h "{}" \;
+    - cp -f lib/isc/include/isc/buffer.h fuzz/
    - cp -f lib/isc/include/isc/buffer.h lib/isc/netmgr/buffer.h
-    - cp -f lib/isc/include/isc/dnsstream.h lib/isc/netmgr/dnsstream.h
-    # Help gcovr find dlz_dbi.c file
-    - for DST in ldap mysql mysqldyn sqlite3 wildcard; do cp contrib/dlz/modules/common/dlz_dbi.c "contrib/dlz/modules/${DST}"; done
+    - cp -f lib/isc/include/isc/hash.h lib/dns/hash.h
    # Generate XML file in the Cobertura XML format suitable for use by GitLab
    # for the purpose of displaying code coverage information in the diff view
    # of a given merge request.
-    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc --exclude-directories fuzz --exclude-directories lib/samples --exclude tests --xml -o coverage.xml
-    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc --exclude-directories fuzz --exclude-directories lib/samples --exclude tests --html-details -o coverage.html
-    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc --exclude-directories fuzz --exclude-directories lib/samples --exclude tests -o coverage.txt
+    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc  --exclude-directories lib/samples --exclude tests --xml -o coverage.xml
+    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc  --exclude-directories lib/samples --exclude tests --html-details -o coverage.html
+    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc  --exclude-directories lib/samples --exclude tests -o coverage.txt
    - tail -n 3 coverage.txt
  artifacts:
    paths:
@@ -1,8 +1,8 @@
 <!--
 If the bug you are reporting is potentially security-related - for example,
 if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please make sure that you make the new issue
-confidential!
+triggered repeatedly - then please do *NOT* report it here, but send an
+email to [security-officer@isc.org](security-officer@isc.org).
 -->

 ### Summary
@@ -3,126 +3,35 @@ THIS ISSUE TEMPLATE IS INTENDED ONLY FOR INTERNAL USE.

 If the bug you are reporting is potentially security-related - for example,
 if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please make sure that you make the new issue
-confidential!
+triggered repeatedly - then please do *NOT* report it here, but send an
+email to [security-officer@isc.org](security-officer@isc.org).
 -->
-| Quick Links              | :link:                               |
-| ------------------------ | ------------------------------------ |
-| Incident Manager:        | @user                                |
-| Deputy Incident Manager: | @user                                |
-| Public Disclosure Date:  | YYYY-MM-DD                           |
-| CVSS Score:              | [0.0][cvss_score]                    |
-| Security Advisory:       | isc-private/printing-press!NNN       |
-| Mattermost Channel:      | [CVE-YYYY-NNNN][mattermost_url]      |
-| Support Ticket:          | [URL]                                |
-| Release Checklist:       | #NNNN                                |
-| Post-mortem Etherpad:    | [postmortem-YYYY-MM][postmortem_url] |

-[cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
-[mattermost_url]:
-[postmortem_url]:
+### CVE-specific actions

-:bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
+  - [ ] Assign a CVE identifier
+  - [ ] Determine CVSS score
+  - [ ] Determine the range of BIND versions affected (including the Subscription Edition)
+  - [ ] Determine whether workarounds for the problem exists
+  - [ ] Create a draft of the security advisory and put the information above in there
+  - [ ] Prepare a detailed description of the problem which should include the following by default:
+      - instructions for reproducing the problem (a system test is good enough)
+      - explanation of code flow which triggers the problem (a system test is *not* good enough)
+  - [ ] Prepare a private merge request containing the following items in separate commits:
+      - a test for the issue (may be moved to a separate merge request for deferred merging)
+      - a fix for the issue
+      - documentation updates (`CHANGES`, release notes, anything else applicable)
+  - [ ] Ensure the merge request from the previous step is reviewed by SWENG staff and has no outstanding discussions
+  - [ ] Ensure the documentation changes introduced by the merge request addressing the problem are reviewed by Support and Marketing staff
+  - [ ] Prepare backports of the merge request addressing the problem for all affected (and still maintained) BIND branches (backporting might affect the issue's scope and/or description)
+  - [ ] Prepare a standalone patch for the last stable release of each affected (and still maintained) BIND branch

-[checklist_explanations]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations
+### Release-specific actions

-### Earlier Than T-5
+  - [ ] Create/update the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
+  - [ ] Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
+  - [ ] Ensure the merge requests containing CVE fixes are merged into `security-*` branches in CVE identifier order

-  - [ ] [:link:][step_deputy]            **(IM)** Pick a Deputy Incident Manager
-  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
-  - [ ] [:link:][step_etherpad]          **(IM)** Create an Etherpad for post-mortem
-  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
-  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
-  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
-  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
-  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
-  - [ ] [:link:][step_earliest]          **(Support)** Prepare and send out "earliest" notifications
-  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
-  - [ ] [:link:][step_reproducer_mr]     **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
-  - [ ] [:link:][step_notify_support]    **(SwEng)** Notify Support when a reproducer is ready
-  - [ ] [:link:][step_code_analysis]     **(SwEng)** Prepare a detailed explanation of the code flow triggering the problem
-  - [ ] [:link:][step_fix_mr]            **(SwEng)** Prepare a private merge request with the fix
-  - [ ] [:link:][step_review_fix]        **(SwEng)** Ensure the merge request with the fix is reviewed and has no outstanding discussions
-  - [ ] [:link:][step_review_docs]       **(Support)** Review the documentation changes introduced by the merge request with the fix
-  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
-  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
-  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] [:link:][step_changes]           **(QA)** (BIND 9 only) Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
-  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
-  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
-  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)
+### Post-disclosure actions

-### At T-5
-
-  - [ ] [:link:][step_send_asn]          **(Support)** Send ASN to eligible customers
-  - [ ] [:link:][step_preannouncement]   **(Support)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
-
-### At T-4
-
-  - [ ] [:link:][step_verify_asn]        **(Support)** Verify that all ASN-eligible customers have received the notification email
-
-### At T-1
-
-  - [ ] [:link:][step_check_customers]   **(Support)** Verify that any new or reinstated customers have received the notification email
-  - [ ] [:link:][step_packager_emails]   **(First IM)** Send notifications to OS packagers
-
-### On the Day of Public Disclosure
-
-  - [ ] [:link:][step_clearance]         **(IM)** Grant Support clearance to proceed with public release
-  - [ ] [:link:][step_publish]           **(Support)** Publish the releases (as outlined in the release checklist)
-  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Update vulnerability matrix in the Knowledge Base
-  - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
-  - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
-  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
-  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
-  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
-  - [ ] [:link:][step_customers]         **(Support)** Inform customers a fix has been released
-
-### After Public Disclosure
-
-  - [ ] [:link:][step_postmortem]        **(First IM)** Organize post-mortem meeting and make sure it happens
-  - [ ] [:link:][step_tickets]           **(Support)** Close support tickets
-  - [ ] [:link:][step_regression]        **(QA)** Merge a regression test reproducing the bug into all affected (and still maintained) branches
-
-[step_deputy]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
-[step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
-[step_etherpad]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-an-etherpad-for-post-mortem
-[step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
-[step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
-[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
-[step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
-[step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
-[step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
-[step_earliest]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-and-send-out-earliest-notifications
-[step_advisory_mr]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
-[step_reproducer_mr]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
-[step_notify_support]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
-[step_code_analysis]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-detailed-explanation-of-the-code-flow-triggering-the-problem
-[step_fix_mr]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-with-the-fix
-[step_review_fix]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-the-merge-request-with-the-fix-is-reviewed-and-has-no-outstanding-discussions
-[step_review_docs]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#review-the-documentation-changes-introduced-by-the-merge-request-with-the-fix
-[step_backports]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-backports-of-the-merge-request-addressing-the-problem-for-all-affected-and-still-maintained-branches-of-a-given-product
-[step_finish_advisory]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#finish-preparing-the-security-advisory
-[step_meta_issue]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-or-update-the-private-issue-containing-links-to-fixes-reproducers-for-all-cves-fixed-in-a-given-release-cycle
-[step_changes]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-reserve-a-block-of-changes-placeholders-once-the-complete-set-of-vulnerabilities-fixed-in-a-given-release-cycle-is-determined
-[step_merge_fixes]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
-[step_patches]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
-[step_asn_releases]:      https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
-[step_send_asn]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-asn-to-eligible-customers
-[step_preannouncement]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
-[step_verify_asn]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-all-asn-eligible-customers-have-received-the-notification-email
-[step_check_customers]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-any-new-or-reinstated-customers-have-received-the-notification-email
-[step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
-[step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-support-clearance-to-proceed-with-public-release
-[step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
-[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-vulnerability-matrix-in-the-knowledge-base
-[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
-[step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
-[step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
-[step_merge_advisory]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
-[step_embargo_end]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
-[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-customers-a-fix-has-been-released
-[step_postmortem]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#organize-post-mortem-meeting-and-make-sure-it-happens
-[step_tickets]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#close-support-tickets
-[step_regression]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches
+  - [ ] Merge a regression test reproducing the bug into all affected (and still maintained) BIND branches
@@ -52,17 +52,15 @@

 - [ ] ***(QA)*** Check that the formatting is correct for HTML and PDF versions of release notes.
 - [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
- - [ ] ***(QA)*** Verify GitLab CI results for the tags created and sign off on the releases to be published.
+ - [ ] ***(QA)*** Verify GitLab CI results for the tags created and prepare a QA report for the releases to be published.
 - [ ] ***(QA)*** Update GitLab settings for all maintained branches to allow merging to them again.
 - [ ] ***(QA)*** Prepare and merge MRs resetting the release notes and updating the version string for each maintained branch.
 - [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is over.
 - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums.
- - [ ] ***(Signers)*** Ensure that the contents of tarballs and tags are identical.
 - [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
 - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again.
 - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
 - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages.
- - [ ] ***(QA)*** Prepare the `patches/` subdirectory for each security release (if applicable).
 - [ ] ***(QA)*** Notify Support that the releases have been prepared.
 - [ ] ***(Support)*** Send out ASNs (if applicable).

@@ -88,8 +86,7 @@
 - [ ] ***(QA)*** Merge published release tags (non-linearly) back into the their relevant development/maintenance branches.
 - [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
 - [ ] ***(QA)*** Sanitize confidential issues which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
- - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Black, PyLint, Sphinx) by modifying the relevant `Dockerfile`.
- - [ ] ***(QA)*** Run a pipeline to rebuild all [images](https://gitlab.isc.org/isc-projects/images) used in GitLab CI.
+ - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.

 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
 [^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.
@@ -0,0 +1,35 @@
+extraction:
+  cpp:
+    prepare:
+      packages:
+      - "libxml2-dev"
+      - "libjson-c-dev"
+      - "libssl-dev"
+      - "zlib1g-dev"
+      - "libcmocka-dev"
+      - "pkg-config"
+      - "libcap2-dev"
+      - "libedit-dev"
+      - "libidn2-dev"
+      - "libmaxminddb-dev"
+      - "libuv1-dev"
+      - "libnghttp2-dev"
+    configure:
+      command:
+      - "autoreconf -fi"
+      - "CFLAGS=\"-Og -g\" ./configure --enable-developer"
+path_classifiers:
+  test:
+    - "lib/*/tests/"
+    - "bin/tests/"
+  docs:
+    - "**/*.xml"
+    - "**/*.docbook"
+    - "**/*.html"
+    - "**/*.1"
+    - "**/*.5"
+    - "**/*.8"
+queries:
+  - exclude: fuzz/
+  - exclude: "bin/tests/system/*/ans*/*.py"
+  - exclude: cpp/use-of-goto
@@ -42,11 +42,6 @@ Files: **/*.after*
       bin/tests/system/formerr/nametoolong
       bin/tests/system/formerr/noquestions
       bin/tests/system/formerr/twoquestions
-       bin/tests/system/forward/CA/CA.cfg
-       bin/tests/system/forward/CA/README
-       bin/tests/system/forward/CA/index.txt
-       bin/tests/system/forward/CA/index.txt.attr
-       bin/tests/system/forward/CA/serial
       bin/tests/system/journal/ns1/managed-keys.bind.in
       bin/tests/system/journal/ns1/managed-keys.bind.jnl.in
       bin/tests/system/journal/ns2/managed-keys.bind.in
@@ -54,11 +49,6 @@ Files: **/*.after*
       bin/tests/system/keepalive/expected
       bin/tests/system/legacy/ns6/edns512.db.signed
       bin/tests/system/legacy/ns7/edns512-notcp.db.signed
-       bin/tests/system/nsupdate/CA/CA.cfg
-       bin/tests/system/nsupdate/CA/README
-       bin/tests/system/nsupdate/CA/index.txt
-       bin/tests/system/nsupdate/CA/index.txt.attr
-       bin/tests/system/nsupdate/CA/serial
       bin/tests/system/nsupdate/commandlist
       bin/tests/system/nsupdate/verylarge.in
       bin/tests/system/org.isc.bind.system.plist
@@ -157,7 +147,6 @@ Files: **/.clang-format
       .clang-format
       .clang-format.headers
       .dir-locals.el
-       .git-blame-ignore-revs
       .gitattributes
       .gitignore
       .gitlab-ci.yml
@@ -51,4 +51,3 @@ Anay Panvalkar
 colleen
 Robert Edmonds
 João Damas
-Artem Boldariev (Артем Болдарєв)
@@ -1,464 +1,3 @@
-	--- 9.19.10 released ---
-
-6083.	[bug]		Fix DNSRPS-enabled builds as they were inadvertently
-			broken by changes 5949 and 6042. [GL #3827]
-
-6082.	[test]		fuzz/dns_message_checksig leaked memory when shutting
-			down. [GL #3828]
-
-6081.	[bug]		Handle primary server address lookup failures in
-			nsupdate more gracefully. [GL #3830]
-
-6080.	[bug]		'named -V' leaked memory. [GL #3829]
-
-6079.	[bug]		Force set the DS state after a 'rdnc dnssec -checkds'
-			command. [GL #3822]
-
-6078.	[func]		Cleanup the memory statistic counters to a bare
-			minumum - InUse with Malloced as alias. [GL #3718]
-
-6077.	[func]		Implement query forwarding to DoT-enabled upstream
-			servers. [GL #3726]
-
-6076.	[bug]		Handle OS errors when creating UDP and TCP sockets
-			more gracefully. [GL #3800]
-
-6075.	[bug]		Add missing node lock when setting node->wild in
-			add_wildcard_magic. [GL #3799]
-
-6074.	[func]		Refactor the isc_nm_xfr_allowed() function to return
-			isc_result_t instead of boolean. [GL #3808]
-
-6073.	[bug]		Set RD=1 on DS requests to parental-agents. [GL #3783]
-
-6072.	[bug]		Avoid the OpenSSL lock contention when initializing
-			Message Digest Contexts by using explicit algorithm
-			fetching, initializing static contexts for every
-			supported algorithms, and initializing the new context
-			by copying the static copy. [GL #3795]
-
-6071.	[func]		The use of "port" when configuring query-source,
-			transfer-source, notify-source and parental-source
-			addresses has been deprecated, along with the
-			use-v[46]-udp-ports and avoid-v[46]-udp-ports
-			options. A warning will be logged when these
-			options are used. In a future release, they
-			will be removed. [GL #3781]
-
-6070.	[func]		DSCP parsing has now been fully removed, and
-			configuration of DSCP values in named.conf is a
-			configuration error. [GL #3789]
-
-6069.	[bug]		Detach from the view in zone_shutdown() to
-			release the memory held by the dead view
-			early. [GL #3801]
-
-6068.	[bug]		Downloading a zone via TLS from a server which does
-			not negotiate "dot" ALPN token could crash BIND
-			on shutdown. That has been fixed. [GL #3767]
-
-	--- 9.19.9 released ---
-
-6067.	[security]	Fix serve-stale crash when recursive clients soft quota
-			is reached. (CVE-2022-3924) [GL #3619]
-
-6066.	[security]	Handle RRSIG lookups when serve-stale is active.
-			(CVE-2022-3736) [GL #3622]
-
-6065.	[placeholder]
-
-6064.	[security]	An UPDATE message flood could cause named to exhaust all
-			available memory. This flaw was addressed by adding a
-			new "update-quota" statement that controls the number of
-			simultaneous UPDATE messages that can be processed or
-			forwarded. The default is 100. A stats counter has been
-			added to record events when the update quota is
-			exceeded, and the XML and JSON statistics version
-			numbers have been updated. (CVE-2022-3094) [GL #3523]
-
-6063.	[cleanup]	The RSA and ECDSA parts of the DNSSEC has been
-			refactored for a better OpenSSL 3.x integration and
-			preliminary PKCS#11 support via for OpenSSL Providers
-			has been added. [GL #3785]
-
-6062.	[func]		The DSCP implementation, which has been
-			nonfunctional for some time, is now marked as
-			obsolete and the implementation has been removed.
-			Configuring DSCP values in named.conf has no
-			effect, and a warning will be logged that
-			the feature should no longer be used. [GL #3773]
-
-6061.	[bug]		Fix unexpected "Prohibited" extended DNS error
-			on allow-recursion. [GL #3743]
-
-6060.	[bug]		Fix a use-after-free bug in dns_zonemgr_releasezone()
-			by detaching from the zone manager outside of the write
-			lock. [GL #3768]
-
-6059.	[bug]		In some serve stale scenarios, like when following an
-			expired CNAME record, named could return SERVFAIL if the
-			previous request wasn't successful. Consider non-stale
-			data when in serve-stale mode. [GL #3678]
-
-6058.	[bug]		Prevent named from crashing when "rndc delzone"
-			attempts to delete a zone added by a catalog zone.
-			[GL #3745]
-
-6057.	[bug]		Fix shutdown and error path bugs in the rpz unit.
-			[GL #3735]
-
-6056.	[bug]		Fix a race in adb.c:clean_namehooks(), so that an ADB
-			entry does not expire without holding the entries lock.
-			[GL #3754]
-
-6055.	[cleanup]	Remove setting alternate transfer sources, make options
-			alt-transfer-source, alt-transfer-transfer-source-v6,
-			and use-alt-transfer-source ancient. [GL #3714]
-
-6054.	[func]		Refactor remote servers (primaries, parental-agents)
-			in zone.c. Store common code in new source files
-			remote.c and remote.h. Introduce a new way to set the
-			source address and port. [GL !7110]
-
-6053.	[bug]		Fix an ADB quota management bug in resolver. [GL #3752]
-
-6052.	[func]		Replace DNS over TCP and DNS over TLS transports
-			code with a new, unified transport implementation.
-			[GL #3374]
-
-6051.	[bug]		Improve thread safety in the dns_dispatch unit.
-			[GL #3178] [GL #3636]
-
-6050.	[bug]		Changes to the RPZ response-policy min-update-interval
-			and add-soa options now take effect as expected when
-			named is reconfigured. [GL #3740]
-
-6049.	[bug]		Exclude ABD hashtables from the ADB memory
-			overmem checks and don't clean ADB names
-			and ADB entries used in the last 10 seconds
-			(ADB_CACHE_MINIMUM). [GL #3739]
-
-6048.	[bug]		Fix a log message error in dns_catz_update_from_db(),
-			where serials with values of 2^31 or larger were logged
-			incorrectly as negative numbers. [GL #3742]
-
-6047.	[bug]		Try the next server instead of trying the same
-			server again on an outgoing query timeout.
-			[GL #3637]
-
-6046.	[bug]		TLS session resumption might lead to handshake
-			failures when client certificates are used for
-			authentication (Mutual TLS).  This has been fixed.
-			[GL #3725]
-
-6045.	[cleanup]	The list of supported DNSSEC algorithms changed log
-			level from "warning" to "notice" to match named's other
-			startup messages. [GL !7217]
-
-6044.	[bug]		There was an "RSASHA236" typo in a log message.
-			[GL !7206]
-
-	--- 9.19.8 released ---
-
-6043.	[bug]		The key file IO locks objects would never get
-			deleted from the hashtable due to off-by-one error.
-			[GL #3727]
-
-6042.	[bug]		ANY responses could sometimes have the wrong TTL.
-			[GL #3613]
-
-6041.	[func]		Set the RLIMIT_NOFILE to rlim_max returned from
-			getrlimit() instead of trying to guess the maximum
-			allowed value. [GL #3676]
-
-6040.	[bug]		Speed up the named shutdown time by explicitly
-			canceling all recursing ns_client objects for
-			each ns_clientmgr. [GL #3183]
-
-6039.	[bug]		Removing a catalog zone from catalog-zones without
-			also removing the referenced zone could leave a
-			dangling pointer. [GL #3683]
-
-6038.	[placeholder]
-
-6037.	[func]		Reject zones which have DS records not at delegation
-			points. [GL #3697]
-
-6036.	[bug]		nslookup and host were not honoring the selected port
-			in TCP mode. [GL #3721]
-
-6035.	[bug]		Refactor the dns_resolver unit to store the fetch
-			contexts and zone counter directly in the hash
-			tables without buckets and implement effective
-			cleaning of both objects. [GL #3709]
-
-6034.	[func]		Deprecate alt-transfer-source, alt-transfer-source-v6
-			and use-alt-transfer-source. [GL #3694]
-
-6033.	[func]		Log messages related to serve-stale now include the RR
-			type involved. [GL !7145]
-
-6032.	[bug]		After change 5995, zone transfers were using a small
-			compression context that only had space for the first
-			few dozen names in each message. They now use a large
-			compression context with enough space for every name.
-			[GL #3706]
-
-6031.	[bug]		Move the "final reference detached" log message
-			from dns_zone unit to the DEBUG(1) log level.
-			[GL #3707]
-
-6030.	[bug]		Refactor the ADB to use a global LRU queue, store
-			the ADB names and ADB entries directly in the hash
-			tables instead of buckets, and properly clean the
-			ADB names and entries when not in use. [GL #3239]
-			[GL #3238] [GL #2615] [GL #2078] [GL #2437]
-			[GL #3312] [GL #2441]
-
-6029.	[cleanup]	Remove the unused external cache cleaning mechanism
-			as RBTDB has its own internal cache cleaning
-			mechanism and we don't support any other database
-			implementations. [GL #3639]
-
-6028.	[performance]	Build-time code generation of DNS RRtype switches
-			is now much faster. [GL !7121]
-
-6027.	[bug]		Fix assertion failure in isc_http API used by
-			statschannel if the read callback would be called
-			on HTTP request that has been already closed.
-			[GL #3693]
-
-6026.	[cleanup]	Deduplicate time unit conversion factors.
-			[GL !7033]
-
-6025.	[bug]		Copy TLS identifier when setting up primaries for
-			catalog member zones. [GL #3638]
-
-6024.	[func]		Deprecate 'auto-dnssec'. [GL #3667]
-
-6023.	[func]		Remove dynamic update DNSSEC management feature.
-			[GL #3686]
-
-6022.	[performance]	The decompression implementation in dns_name_fromwire()
-			is now smaller and faster. [GL #3655]
-
-6021.	[bug]		Use the current domain name when checking answers from
-			a dual-stack-server. [GL #3607]
-
-6020.	[bug]		Ensure 'named-checkconf -z' respects the check-wildcard
-			option when loading a zone.  [GL #1905]
-
-6019.	[func]		Deprecate `coresize`, `datasize`, `files`, and
-			`stacksize` named.conf options. [GL #3676]
-
-6018.	[cleanup]	Remove the --with-tuning configure option.
-			[GL #3664]
-
-6017.	[bug]		The view's zone table was not locked when it should
-			have been leading to race conditions when external
-			extensions that manipulate the zone table where in
-			use. [GL #3468]
-
-6016.	[func]		Change NSEC3PARAM TTL to match the SOA MINIMUM.
-			[GL #3570]
-
-6015.	[bug]		Some browsers (Firefox) send more than 10 HTTP
-			headers.  Bump the number of allowed HTTP headers
-			to 100. [GL #3670]
-
-6014.	[func]		Add isc_hashmap API implementation that implements
-			Robin Hood hashing.  The API requires the keys to
-			be stored with the stored value.  [GL !6790]
-
-	--- 9.19.7 released ---
-
-6013.	[bug]		Fix a crash that could happen when you change
-			a dnssec-policy zone with NSEC3 to start using
-			inline-signing. [GL #3591]
-
-6012.	[placeholder]
-
-6011.	[func]		Refactor the privilege setting part of named_os unit
-			to make libcap on Linux mandatory and use setreuid
-			and setregid if available. [GL #3583]
-
-6010.	[func]		Make the initial interface scan happen before
-			dropping the privileges.  This requires exiting
-			exclusive mode before scanning the interfaces
-			and re-entering it again when we are done.  This
-			is because starting the listening on interfaces
-			requires the loopmgr to be running and not paused.
-			[GL #3583]
-
-6009.	[bug]		Don't trust a placeholder KEYDATA from the managed-keys
-			zone by adding it into secroots. [GL #2895]
-
-6008.	[bug]		Fixed a race condition that could cause a crash
-			in dns_zone_synckeyzone(). [GL #3617]
-
-6007.	[cleanup]	Don't enforce the jemalloc use on NetBSD. [GL #3634]
-
-6006.	[cleanup]	The zone dumping was using isc_task API to launch
-			the zonedump on the offloaded threadpool.  Remove
-			the task and launch the offloaded work directly.
-			[GL #3628]
-
-6005.	[func]		The zone loading has been moved to the offload
-			threadpool instead of doing incremental repeated
-			tasks, so zone loading scheduling is now driven
-			by the operating system scheduler rather than fixed
-			(100) quantum. [GL #3625]
-
-6004.	[func]		Add check-svcb to control the checking of additional
-			constraints on SVBC records.  This change impacts on
-			named, named-checkconf, named-checkzone,
-			named-compilezone and nsupdate. [GL #3576]
-
-6003.	[bug]		Fix an inheritance bug when setting the port on
-			remote servers in configuration. [GL #3627]
-
-6002.	[bug]		Fix a resolver prefetch bug when the record's TTL value
-			is equal to the configured prefetch eligibility value,
-			but the record was erroneously not treated as eligible
-			for prefetching. [GL #3603]
-
-6001.	[bug]		Always call dns_adb_endudpfetch() after calling
-			dns_adb_beginudpfetch() for UDP queries in resolver.c,
-			in order to adjust back the quota. [GL #3598]
-
-6000.	[bug]		Fix a startup issue on Solaris systems with many
-			(reportedly > 510) CPUs. Thanks to Stacey Marshall from
-			Oracle for deep investigation of the problem. [GL #3563]
-
-5999.	[bug]		rpz-ip rules could be ineffective in some scenarios
-			with CD=1 queries. [GL #3247]
-
-5998.	[placeholder]
-
-5997.	[cleanup]	Less ceremonial UNEXPECTED_ERROR() and FATAL_ERROR()
-			reporting macros. [GL !6914]
-
-5996.	[bug]		Fix a couple of bugs in cfg_print_duration(), which
-			could result in generating incomplete duration values
-			when printing the configuration using named-checkconf.
-			[GL !6880]
-
-5995.	[performance]	A new algorithm for DNS name compression based on a
-			hash set of message offsets. Name compression is now
-			more complete as well as being generally faster, and
-			the implementation is less complicated and requires
-			much less memory. [GL !6517]
-
-5994.	[func]		Refactor the isc_httpd implementation used in the
-			statistics channel. [GL !6879]
-
-5993.	[cleanup]	Store dns_name_t attributes as boolean members of
-			the structure. Remove DNS_NAMEATTR_* macros.
-			Fix latent attribute handling bug in RBT. [GL !6902]
-
-	--- 9.19.6 released ---
-
-5992.	[func]		Introduce the new isc_mem_*x() APIs that takes extra
-			flags as the last argument.  Currently ISC_MEM_ZERO
-			and ISC_MEM_ALIGN(n) flags have been implemented that
-			clears the memory to avoid the isc_mem_get()/memset()
-			pattern and make aligned allocation which replaces the
-			previous isc_mem_*_aligned() calls. [GL !6398]
-
-5991.	[protocol]	Add support for parsing and validating "dohpath" to
-			SVCB. [GL #3544]
-
-5990.	[test]		fuzz/dns_message_checksig now creates the key directory
-			it uses when testing in /tmp at run time. [GL #3569]
-
-5989.	[func]		Implement support for DDNS update forwarding using DoT
-			to TLS-enabled primary servers. [GL #3512]
-
-5988.	[bug]		Some out of memory conditions in opensslrsa_link.c
-			could lead to memory leaks. [GL #3551]
-
-5987.	[func]		Provide custom isc_mem based allocators for libuv,
-			OpenSSL and libxml2 libraries that support replacing
-			the internal allocators. [GL #3559]
-
-5986.	[func]		Make the memory context debugging options local to
-			the memory context and make it immutable for the memory
-			context lifetime. [GL #3559]
-
-5985.	[func]		Bump the minimal libuv version to 1.34.0. [GL #3567]
-
-5984.	[func]		'named -V' now reports the list of supported
-			DNSSEC/DS/HMAC algorithms and the supported TKEY modes.
-			[GL #3541]
-
-5983.	[bug]		Changing just the TSIG key names for primaries in
-			catalog zones' member zones was not effective.
-			[GL #3557]
-
-5982.	[func]		Extend dig to allow requests to be signed using SIG(0)
-			as well as providing a mechanism to specify the signing
-			time. [GL !5923]
-
-5981.	[test]		Add dns_message_checksig fuzzer to check messages
-			signed using TSIG or SIG(0). [GL !5923]
-
-5980.	[func]		The internal isc_entropy API provider has been
-			changed from OpenSSL RAND_bytes() to uv_random()
-			to use system provided entropy. [GL !6803]
-
-5979.	[func]		Implement DoT support for nsupdate. [GL #1781]
-
-5978.	[port]		The ability to use pkcs11 via engine_pkcs11 has been
-			restored, by only using deprecated APIs in
-			OpenSSL 3.0.0. BIND needs to be compiled with
-			'-DOPENSSL_API_COMPAT=10100' specified in the CFLAGS
-			at compile time. [GL !6711]
-
-5977.	[bug]		named could incorrectly return non-truncated, glueless
-			referrals for responses whose size was close to the UDP
-			packet size limit. [GL #1967]
-
-5976.	[cleanup]	isc_timer_t objects are now created, started and
-			destroyed in a particular loop, and timer callbacks
-			run in that loop. isc_timer_stop() can still be called
-			from any loop; when run from a different loop than
-			the one associated with the timer, the request will
-			be recorded in atomic variable and the timer will
-			be stopped on the next callback call. [GL #3202]
-
-5975.	[func]		Implement TLS transport support for dns_request and
-			dns_dispatch. [GL #3529]
-
-5974.	[bug]		Fix an assertion failure in dispatch caused by
-			extra read callback call. [GL #3545]
-
-5973.	[bug]		Fixed a possible invalid detach in UPDATE
-			processing. [GL #3522]
-
-5972.	[bug]		Gracefully handle when the statschannel HTTP connection
-			gets cancelled during sending data back to the client.
-			[GL #3542]
-
-5971.	[func]		Add libsystemd sd_notify() support. [GL #1176]
-
-5970.	[func]		Log the reason why a query was refused. [GL !6669]
-
-5969.	[bug]		DNSSEC signing statistics failed to identify the
-			algorithm involved.  The key names have been changed
-			to be the algorithm number followed by "+" followed
-			by the key id (e.g. "8+54274"). [GL #3525]
-
-5968.	[cleanup]	Remove 'resolve' binary from tests. [GL !6733]
-
-5967.	[cleanup]	Flagged the obsolete "random-device" option as
-			ancient; it is now an error to configure it. [GL #3399]
-
-5966.	[func]		You can now specify if a server must return a DNS
-			COOKIE before accepting the response over UDP.
-			[GL #2295]
-
-			server <prefix> { require-cookie <yes_or_no>; };
-
 5965.	[cleanup]	Move the duplicated ASCII case conversion tables to
 			isc_ascii where they can be shared, and replace the
 			various hot-path tolower() loops with calls to new
@@ -471,32 +10,17 @@
 5963.	[bug]		Ensure struct named_server is properly initialized.
 			[GL #6531]

-	--- 9.19.5 released ---
-
-5962.	[security]	Fix memory leak in EdDSA verify processing.
-			(CVE-2022-38178) [GL #3487]
+5962.	[placeholder]

 5961.	[placeholder]

-5960.	[security]	Fix serve-stale crash that could happen when
-			stale-answer-client-timeout was set to 0 and there was
-			a stale CNAME in the cache for an incoming query.
-			(CVE-2022-3080) [GL #3517]
+5960.	[placeholder]

-5959.	[security]	Fix memory leaks in the DH code when using OpenSSL 3.0.0
-			and later versions. The openssldh_compare(),
-			openssldh_paramcompare(), and openssldh_todns()
-			functions were affected. (CVE-2022-2906) [GL #3491]
+5959.	[placeholder]

-5958.	[security]	When an HTTP connection was reused to get
-			statistics from the stats channel, and zlib
-			compression was in use, each successive
-			response sent larger and larger blocks of memory,
-			potentially reading past the end of the allocated
-			buffer. (CVE-2022-2881) [GL #3493]
+5958.	[placeholder]

-5957.	[security]	Prevent excessive resource use while processing large
-			delegations. (CVE-2022-2795) [GL #3394]
+5957.	[placeholder]

 5956.	[func]		Make RRL code treat all QNAMEs that are subject to
 			wildcard processing within a given zone as the same
@@ -1013,9 +537,7 @@
 			when the resent query's result was SERVFAIL. [GL #3020]

 5830.	[func]		Implement incremental resizing of isc_ht hash tables to
-			perform the rehashing gradually. The catalog zone
-			implementation has been optimized to work with hundreds
-			of thousands of member zones. [GL #3212] [GL #3744]
+			perform the rehashing gradually. [GL #3212]

 5829.	[func]		Refactor and simplify isc_timer API in preparation
 			for further refactoring on top of network manager
@@ -1,4 +1,4 @@
-Copyright (C) 1996-2023  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2022  Internet Systems Consortium, Inc. ("ISC")

 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -2,7 +2,6 @@ SPHINX_V = $(SPHINX_V_@AM_V@)
 SPHINX_V_ = $(SPHINX_V_@AM_DEFAULT_V@)
 SPHINX_V_0 = -q
 SPHINX_V_1 = -n
-SPHINX_W = -W

 AM_V_SPHINX = $(AM_V_SPHINX_@AM_V@)
 AM_V_SPHINX_ = $(AM_V_SPHINX_@AM_DEFAULT_V@)
@@ -21,7 +20,7 @@ SESSION_KEY = .. |session_key| replace:: ``$(runstatedir)/session.key``
 export RST_EPILOG = $(RNDC_CONF)$(LF)$(RNDC_KEY)$(LF)$(NAMED_CONF)$(LF)$(BIND_KEYS)$(LF)$(NAMED_PID)$(LF)$(SESSION_KEY)

 common_SPHINXOPTS =			\
-	$(SPHINX_W)			\
+	-W				\
 	-c $(srcdir)			\
 	-a				\
 	$(SPHINX_V)
@@ -26,4 +26,3 @@ Some of these settings are:
 | `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
 | `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
 | `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
-| `-DOPENSSL_API_COMPAT=10100` | Build using the deprecated OpenSSL APIs so that the `engine` API is available when building with OpenSSL 3.0.0 for PKCS#11 support     |
@@ -125,7 +125,7 @@ including your patch as an attachment, preferably generated by
 ### <a name="build"/> Building BIND 9

 For information about building BIND 9, see the
-["Building BIND 9"](doc/arm/build.inc.rst) section in the BIND 9
+["Building BIND 9"](doc/arm/build.rst) section in the BIND 9
 Administrator Reference Manual.

 ### <a name="testing"/> Automated testing
@@ -94,7 +94,7 @@ dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
 #if CHECK_SIBLING
 			     DNS_ZONEOPT_CHECKSIBLING |
 #endif /* if CHECK_SIBLING */
-			     DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
+			     DNS_ZONEOPT_CHECKWILDCARD |
 			     DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;

 /*
@@ -205,8 +205,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -408,8 +407,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -495,8 +493,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -401,28 +401,6 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		zone_options |= DNS_ZONEOPT_CHECKSPF;
 	}

-	obj = NULL;
-	if (get_maps(maps, "check-svcb", &obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			zone_options |= DNS_ZONEOPT_CHECKSVCB;
-		} else {
-			zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
-		}
-	} else {
-		zone_options |= DNS_ZONEOPT_CHECKSVCB;
-	}
-
-	obj = NULL;
-	if (get_maps(maps, "check-wildcard", &obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
-		} else {
-			zone_options &= ~DNS_ZONEOPT_CHECKWILDCARD;
-		}
-	} else {
-		zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
-	}
-
 	obj = NULL;
 	if (get_checknames(maps, &obj)) {
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
@@ -165,8 +165,8 @@ main(int argc, char **argv) {
 	isc_commandline_errprint = false;

 	while ((c = isc_commandline_parse(argc, argv,
-					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
-					  "DF:M:S:T:W:")) != EOF)
+					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:DF:"
+					  "M:S:T:W:")) != EOF)
 	{
 		switch (c) {
 		case 'c':
@@ -361,18 +361,6 @@ main(int argc, char **argv) {
 			workdir = isc_commandline_argument;
 			break;

-		case 'C':
-			if (ARGCMP("check-svcb:fail")) {
-				zone_options |= DNS_ZONEOPT_CHECKSVCB;
-			} else if (ARGCMP("check-svcb:ignore")) {
-				zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
-			} else {
-				fprintf(stderr, "invalid argument to -C: %s\n",
-					isc_commandline_argument);
-				exit(1);
-			}
-			break;
-
 		case 'D':
 			dumpzone++;
 			break;
@@ -483,8 +471,7 @@ main(int argc, char **argv) {
 			outputformat = dns_masterformat_raw;
 			rawversion = strtol(outputformatstr + 4, &end, 10);
 			if (end == outputformatstr + 4 || *end != '\0' ||
-			    rawversion > 1U)
-			{
+			    rawversion > 1U) {
 				fprintf(stderr, "unknown raw format version\n");
 				exit(1);
 			}
@@ -523,8 +510,7 @@ main(int argc, char **argv) {
 	}

 	if (argc - isc_commandline_index < 1 ||
-	    argc - isc_commandline_index > 2)
-	{
+	    argc - isc_commandline_index > 2) {
 		usage();
 	}

@@ -23,7 +23,7 @@ named-checkzone - zone file validation tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -68,15 +68,6 @@ Options

   This option specifies the class of the zone. If not specified, ``IN`` is assumed.

-.. option:: -C mode
-
-   This option controls check mode on zone files when loading.
-   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
-
-   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
-   records and ``check-svcb:ignore`` disables these checks.  The
-   default is ``check-svcb:fail``.
-
 .. option:: -i mode

   This option performs post-load zone integrity checks. Possible modes are
@@ -23,7 +23,7 @@ named-compilezone - zone file converting tool
 Synopsis
 ~~~~~~~~

-:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -70,15 +70,6 @@ Options

   This option specifies the class of the zone. If not specified, ``IN`` is assumed.

-.. option:: -C mode
-
-   This option controls check mode on zone files when loading.
-   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
-
-   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
-   records and ``check-svcb:ignore`` disables these checks.  The
-   default is ``check-svcb:fail``.
-
 .. option:: -i mode

   This option performs post-load zone integrity checks. Possible modes are
@@ -34,6 +34,29 @@

 #include "util.h"

+/*%
+ * Convert algorithm type to string.
+ */
+const char *
+alg_totext(dns_secalg_t alg) {
+	switch (alg) {
+	case DST_ALG_HMACMD5:
+		return ("hmac-md5");
+	case DST_ALG_HMACSHA1:
+		return ("hmac-sha1");
+	case DST_ALG_HMACSHA224:
+		return ("hmac-sha224");
+	case DST_ALG_HMACSHA256:
+		return ("hmac-sha256");
+	case DST_ALG_HMACSHA384:
+		return ("hmac-sha384");
+	case DST_ALG_HMACSHA512:
+		return ("hmac-sha512");
+	default:
+		return ("(unknown)");
+	}
+}
+
 /*%
 * Convert string to algorithm type.
 */
@@ -152,7 +175,7 @@ void
 write_key_file(const char *keyfile, const char *user, const char *keyname,
 	       isc_buffer_t *secret, dns_secalg_t alg) {
 	isc_result_t result;
-	const char *algname = dst_hmac_algorithm_totext(alg);
+	const char *algname = alg_totext(alg);
 	FILE *fd = NULL;

 	DO("create keyfile", isc_file_safecreate(keyfile, &fd));
@@ -222,7 +222,7 @@ main(int argc, char **argv) {
 	if (keysize < 0) {
 		keysize = alg_bits(alg);
 	}
-	algname = dst_hmac_algorithm_totext(alg);
+	algname = alg_totext(alg);

 	isc_mem_create(&mctx);
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
@@ -127,8 +127,7 @@ main(int argc, char **argv) {
 	isc_commandline_errprint = false;

 	while ((ch = isc_commandline_parse(argc, argv, "a:hk:Mmr:qs:y:z:")) !=
-	       -1)
-	{
+	       -1) {
 		switch (ch) {
 		case 'a':
 			algname = isc_commandline_argument;
@@ -209,7 +208,7 @@ main(int argc, char **argv) {
 	}

 	/* Use canonical algorithm name */
-	algname = dst_hmac_algorithm_totext(alg);
+	algname = alg_totext(alg);

 	isc_mem_create(&mctx);

@@ -41,7 +41,6 @@
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/timer.h>
-#include <isc/tls.h>
 #include <isc/util.h>

 #include <dns/byaddr.h>
@@ -86,9 +85,6 @@ static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;

-/* TLS */
-static isc_tlsctx_cache_t *tlsctx_client_cache = NULL;
-
 /* Configurables */
 static char *server = NULL;
 static const char *port = "53";
@@ -468,8 +464,7 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner) {
 			     result = dns_rdataset_next(rdataset))
 			{
 				if ((rdataset->attributes &
-				     DNS_RDATASETATTR_NEGATIVE) != 0)
-				{
+				     DNS_RDATASETATTR_NEGATIVE) != 0) {
 					continue;
 				}

@@ -493,8 +488,7 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner) {
 		} else {
 			dns_indent_t indent = { "  ", 2 };
 			if (!yaml && (rdataset->attributes &
-				      DNS_RDATASETATTR_NEGATIVE) != 0)
-			{
+				      DNS_RDATASETATTR_NEGATIVE) != 0) {
 				isc_buffer_putstr(&target, "; ");
 			}
 			result = dns_master_rdatasettotext(
@@ -790,8 +784,7 @@ load_keys(const cfg_obj_t *keys, dns_client_t *client) {
 		keylist = cfg_listelt_value(elt);

 		for (elt2 = cfg_list_first(keylist); elt2 != NULL;
-		     elt2 = cfg_list_next(elt2))
-		{
+		     elt2 = cfg_list_next(elt2)) {
 			key = cfg_listelt_value(elt2);
 			CHECK(key_fromconfig(key, client));
 		}
@@ -950,16 +943,14 @@ addserver(dns_client_t *client) {
 		result = ISC_R_SUCCESS;
 		for (cur = res; cur != NULL; cur = cur->ai_next) {
 			if (cur->ai_family != AF_INET &&
-			    cur->ai_family != AF_INET6)
-			{
+			    cur->ai_family != AF_INET6) {
 				continue;
 			}
 			sa = isc_mem_get(mctx, sizeof(*sa));
-			*sa = (isc_sockaddr_t){
-				.length = (unsigned int)cur->ai_addrlen,
-			};
+			memset(sa, 0, sizeof(*sa));
 			ISC_LINK_INIT(sa, link);
 			memmove(&sa->type, cur->ai_addr, cur->ai_addrlen);
+			sa->length = (unsigned int)cur->ai_addrlen;
 			ISC_LIST_APPEND(servers, sa, link);
 		}
 		freeaddrinfo(res);
@@ -1452,8 +1443,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				warn("extra query type");
 			}
 			if (rdtype == dns_rdatatype_ixfr ||
-			    rdtype == dns_rdatatype_axfr)
-			{
+			    rdtype == dns_rdatatype_axfr) {
 				fatal("Transfer not supported");
 			}
 			qtype = rdtype;
@@ -1532,8 +1522,7 @@ preparse_args(int argc, char **argv) {

 		/* Look for dash value option. */
 		if (strpbrk(option, dash_opts) != &option[0] ||
-		    strlen(option) > 1U)
-		{
+		    strlen(option) > 1U) {
 			/* Error or value in option. */
 			continue;
 		}
@@ -1571,15 +1560,13 @@ parse_args(int argc, char **argv) {
 		} else if (argv[0][0] == '-') {
 			if (argc <= 1) {
 				if (dash_option(&argv[0][1], NULL,
-						&open_type_class))
-				{
+						&open_type_class)) {
 					argc--;
 					argv++;
 				}
 			} else {
 				if (dash_option(&argv[0][1], argv[1],
-						&open_type_class))
-				{
+						&open_type_class)) {
 					argc--;
 					argv++;
 				}
@@ -1598,8 +1585,7 @@ parse_args(int argc, char **argv) {
 						warn("extra query type");
 					}
 					if (rdtype == dns_rdatatype_ixfr ||
-					    rdtype == dns_rdatatype_axfr)
-					{
+					    rdtype == dns_rdatatype_axfr) {
 						fatal("Transfer not supported");
 					}
 					qtype = rdtype;
@@ -1839,10 +1825,8 @@ main(int argc, char *argv[]) {
 	setup_logging(stderr);

 	/* Create client */
-	isc_tlsctx_cache_create(mctx, &tlsctx_client_cache);
-	result = dns_client_create(mctx, loopmgr, taskmgr, netmgr, 0,
-				   tlsctx_client_cache, &client, srcaddr4,
-				   srcaddr6);
+	result = dns_client_create(mctx, loopmgr, taskmgr, netmgr, 0, &client,
+				   srcaddr4, srcaddr6);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
 			 isc_result_totext(result));
@@ -1875,9 +1859,6 @@ cleanup:
 	if (style != NULL) {
 		dns_master_styledestroy(&style, mctx);
 	}
-	if (tlsctx_client_cache != NULL) {
-		isc_tlsctx_cache_detach(&tlsctx_client_cache);
-	}

 	isc_log_destroy(&lctx);

@@ -6,8 +6,7 @@ AM_CPPFLAGS +=			\
 	$(LIBISCCFG_CFLAGS)	\
 	$(LIBIRS_CFLAGS)	\
 	$(LIBBIND9_CFLAGS)	\
-	$(LIBIDN2_CFLAGS)	\
-	$(LIBUV_CFLAGS)
+	$(LIBIDN2_CFLAGS)

 LDADD +=			\
 	libdighost.la		\
@@ -206,6 +206,9 @@ help(void) {
 	       "from ipv4only.arpa)\n"
 	       "                 +[no]dnssec         (Request DNSSEC records)\n"
 	       "                 +domain=###         (Set default domainname)\n"
+	       "                 +[no]dscp[=###]     (Set the DSCP value to "
+	       "### "
+	       "[0..63])\n"
 	       "                 +[no]edns[=###]     (Set EDNS version) [0]\n"
 	       "                 +ednsflags=###      (Set EDNS flag bits)\n"
 	       "                 +[no]ednsnegotiation (Set EDNS version "
@@ -577,7 +580,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 static bool
 isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
-	static unsigned char local_ndata[] = { "\005local" };
+	static unsigned char local_ndata[] = { "\005local\0" };
 	static unsigned char local_offsets[] = { 0, 6 };
 	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata,
 							local_offsets);
@@ -690,8 +693,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		flags |= DNS_MESSAGETEXTFLAG_NOCOMMENTS;
 	}
 	if (query->lookup->onesoa &&
-	    query->lookup->rdtype == dns_rdatatype_axfr)
-	{
+	    query->lookup->rdtype == dns_rdatatype_axfr) {
 		flags |= (query->msg_count == 0) ? DNS_MESSAGETEXTFLAG_ONESOA
 						 : DNS_MESSAGETEXTFLAG_OMITSOA;
 	}
@@ -1388,6 +1390,22 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			}
 			strlcpy(domainopt, value, sizeof(domainopt));
 			break;
+		case 's': /* dscp */
+			FULLCHECK("dscp");
+			if (!state) {
+				lookup->dscp = -1;
+				break;
+			}
+			if (value == NULL) {
+				goto need_value;
+			}
+			result = parse_uint(&num, value, 0x3f, "DSCP");
+			if (result != ISC_R_SUCCESS) {
+				warn("Couldn't parse DSCP value");
+				goto exit_or_usage;
+			}
+			lookup->dscp = num;
+			break;
 		default:
 			goto invalid_option;
 		}
@@ -1504,31 +1522,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		}
 		break;
 	case 'f': /* fail */
-		switch (cmd[1]) {
-		case 'a':
-			FULLCHECK("fail");
-			lookup->servfail_stops = state;
-			break;
-		case 'u':
-			FULLCHECK("fuzztime");
-			lookup->fuzzing = state;
-			if (lookup->fuzzing) {
-				if (value == NULL) {
-					lookup->fuzztime = 0x622acce1;
-					break;
-				}
-				result = parse_uint(&num, value, 0xffffffff,
-						    "fuzztime");
-				if (result != ISC_R_SUCCESS) {
-					warn("Couldn't parse fuzztime");
-					goto exit_or_usage;
-				}
-				lookup->fuzztime = num;
-			}
-			break;
-		default:
-			goto invalid_option;
-		}
+		FULLCHECK("fail");
+		lookup->servfail_stops = state;
 		break;
 	case 'h':
 		switch (cmd[1]) {
@@ -1776,8 +1771,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			}
 			for (num = 0;
 			     num < sizeof(opcodetext) / sizeof(opcodetext[0]);
-			     num++)
-			{
+			     num++) {
 				if (strcasecmp(opcodetext[num], value) == 0) {
 					break;
 				}
@@ -1990,8 +1984,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			}
 			if (!state) {
 				if (lookup->ecs_addr != NULL) {
-					isc_mem_put(mctx, lookup->ecs_addr,
-						    sizeof(*lookup->ecs_addr));
+					isc_mem_free(mctx, lookup->ecs_addr);
 					lookup->ecs_addr = NULL;
 				}
 				break;
@@ -2000,8 +1993,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				lookup->edns = DEFAULT_EDNS_VERSION;
 			}
 			if (lookup->ecs_addr != NULL) {
-				isc_mem_put(mctx, lookup->ecs_addr,
-					    sizeof(*lookup->ecs_addr));
+				isc_mem_free(mctx, lookup->ecs_addr);
 				lookup->ecs_addr = NULL;
 			}
 			result = parse_netprefix(&lookup->ecs_addr, value);
@@ -2055,8 +2047,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			switch (cmd[2]) {
 			case 's':
 				if (!plus_tls_options(cmd, value, state,
-						      lookup))
-				{
+						      lookup)) {
 					goto invalid_option;
 				}
 				break;
@@ -2397,8 +2388,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			result = dns_rdatatype_fromtext(
 				&rdtype, (isc_textregion_t *)&tr);
 			if (result == ISC_R_SUCCESS &&
-			    rdtype == dns_rdatatype_ixfr)
-			{
+			    rdtype == dns_rdatatype_ixfr) {
 				result = DNS_R_UNKNOWN;
 			}
 		}
@@ -2471,8 +2461,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		*need_clone = true;
 		if (get_reverse(textname, sizeof(textname), value, false) ==
-		    ISC_R_SUCCESS)
-		{
+		    ISC_R_SUCCESS) {
 			strlcpy((*lookup)->textname, textname,
 				sizeof((*lookup)->textname));
 			debug("looking up %s", (*lookup)->textname);
@@ -2654,8 +2643,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 		}
 		if (batchfp != NULL) {
 			while (fgets(batchline, sizeof(batchline), batchfp) !=
-			       0)
-			{
+			       0) {
 				debug("config line %s", batchline);
 				bargc = split_batchline(batchline, bargv, 62,
 							".digrc argv");
@@ -2747,8 +2735,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 						&rdtype,
 						(isc_textregion_t *)&tr);
 					if (result == ISC_R_SUCCESS &&
-					    rdtype == dns_rdatatype_ixfr)
-					{
+					    rdtype == dns_rdatatype_ixfr) {
 						fprintf(stderr, ";; Warning, "
 								"ixfr requires "
 								"a "
@@ -2788,8 +2775,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 						lookup->rdtype = rdtype;
 						lookup->rdtypeset = true;
 						if (rdtype ==
-						    dns_rdatatype_axfr)
-						{
+						    dns_rdatatype_axfr) {
 							lookup->section_question =
 								plusquest;
 							lookup->comments =
@@ -2797,8 +2783,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 						}
 						if (rdtype ==
 							    dns_rdatatype_any &&
-						    !lookup->tcp_mode_set)
-						{
+						    !lookup->tcp_mode_set) {
 							lookup->tcp_mode = true;
 						}
 						lookup->ixfr_serial = false;
@@ -132,14 +132,12 @@ Options

 .. option:: -k keyfile

-   This option tells :program:`dig` to sign queries using TSIG or
-   SIG(0) using a key read from the given file. Key files can be
-   generated using :iscman:`tsig-keygen`. When using TSIG authentication
-   with :program:`dig`, the name server that is queried needs to
-   know the key and algorithm that is being used. In BIND, this is
-   done by providing appropriate ``key`` and ``server`` statements
-   in :iscman:`named.conf` for TSIG and by looking up the KEY record
-   in zone data for SIG(0).
+   This option tells :iscman:`named` to sign queries using TSIG using a key read from the given file. Key
+   files can be generated using :iscman:`tsig-keygen`. When using TSIG
+   authentication with :program:`dig`, the name server that is queried needs to
+   know the key and algorithm that is being used. In BIND, this is done
+   by providing appropriate ``key`` and ``server`` statements in
+   :iscman:`named.conf`.

 .. option:: -m

@@ -347,6 +345,12 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   enables search list processing as if the :option:`+search` option were
   given.

+.. option:: +dscp=value
+
+   This option sets the DSCP code point to be used when sending the query. Valid DSCP
+   code points are in the range [0...63]. By default no code point is
+   explicitly set.
+
 .. option:: +edns[=#], +noedns

   This option specifies the EDNS version to query with. Valid values are 0 to 255.
@@ -382,14 +386,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   to not try the next server, which is the reverse of normal stub
   resolver behavior.

-.. option:: +fuzztime[=value], +nofuzztime
-
-   This option allows the signing time to be specified when generating
-   signed messages.  If a value is specified it is the seconds since
-   00:00:00 January 1, 1970 UTC ignoring leap seconds.  If no value
-   is specified 1646972129 (Fri 11 Mar 2022 04:15:29 UTC) is used.
-   The default is ``+nofuzztime`` and the current time is used.
-
 .. option:: +header-only, +noheader-only

   This option sends a query with a DNS header without a question section. The
@@ -612,11 +608,10 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to

 .. option:: +tcp, +notcp

-   This option indicates whether to use TCP when querying name
-   servers.  The default behavior is to use UDP unless a type ``any``
-   or ``ixfr=N`` query is requested, in which case the default is
-   TCP. AXFR queries always use TCP. To prevent retry over TCP when
-   TC=1 is returned from a UDP query, use ``+ignore``.
+   This option indicates whether to use TCP when querying name servers.
+   The default behavior is to use UDP unless a type ``any`` or ``ixfr=N``
+   query is requested, in which case the default is TCP. AXFR queries
+   always use TCP.

 .. option:: +timeout=T

@@ -742,7 +737,7 @@ shows how :program:`dig` can be used from the command line to make three
 lookups: an ANY query for ``www.isc.org``, a reverse lookup of 127.0.0.1,
 and a query for the NS records of ``isc.org``. A global query option of
 :option:`+qr` is applied, so that :program:`dig` shows the initial query it made for
-each lookup. The final query has a local query option of :option:`+noqr` which
+each lookup. The final query has a local query option of :option:`+qr` which
 means that :program:`dig` does not print the initial query when it looks up the
 NS records for ``isc.org``.

@@ -54,11 +54,8 @@
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/timer.h>
-#include <isc/tls.h>
 #include <isc/types.h>
 #include <isc/util.h>
-#include <isc/uv.h>
-#include <isc/xml.h>

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
@@ -146,7 +143,6 @@ const dns_name_t *hmacname = NULL;
 unsigned int digestbits = 0;
 isc_buffer_t *namebuf = NULL;
 dns_tsigkey_t *tsigkey = NULL;
-dst_key_t *sig0key = NULL;
 bool validated = true;
 bool debugging = false;
 bool debugtiming = false;
@@ -478,8 +474,7 @@ get_server_list(irs_resconf_t *resconf) {
 	debug("get_server_list()");
 	servers = irs_resconf_getnameservers(resconf);
 	for (sa = ISC_LIST_HEAD(*servers); sa != NULL;
-	     sa = ISC_LIST_NEXT(sa, link))
-	{
+	     sa = ISC_LIST_NEXT(sa, link)) {
 		int pf = isc_sockaddr_pf(sa);
 		isc_netaddr_t na;
 		isc_result_t result;
@@ -622,6 +617,7 @@ make_empty_lookup(void) {
 		.section_authority = true,
 		.section_additional = true,
 		.ednsneg = true,
+		.dscp = -1,
 	};

 	dns_fixedname_init(&looknew->fdomain);
@@ -629,7 +625,7 @@ make_empty_lookup(void) {
 	ISC_LIST_INIT(looknew->q);
 	ISC_LIST_INIT(looknew->my_server_list);

-	isc_tlsctx_cache_create(mctx, &looknew->tls_ctx_cache);
+	looknew->tls_ctx_cache = isc_tlsctx_cache_new(mctx);

 	isc_refcount_init(&looknew->references, 1);

@@ -796,15 +792,13 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->tsigctx = NULL;
 	looknew->need_search = lookold->need_search;
 	looknew->done_as_is = lookold->done_as_is;
+	looknew->dscp = lookold->dscp;
 	looknew->rrcomments = lookold->rrcomments;
-	looknew->fuzzing = lookold->fuzzing;
-	looknew->fuzztime = lookold->fuzztime;

 	if (lookold->ecs_addr != NULL) {
-		looknew->ecs_addr = isc_mem_get(mctx,
-						sizeof(*looknew->ecs_addr));
-		memmove(looknew->ecs_addr, lookold->ecs_addr,
-			sizeof(*looknew->ecs_addr));
+		size_t len = sizeof(isc_sockaddr_t);
+		looknew->ecs_addr = isc_mem_allocate(mctx, len);
+		memmove(looknew->ecs_addr, lookold->ecs_addr, len);
 	}

 	dns_name_copy(dns_fixedname_name(&lookold->fdomain),
@@ -963,8 +957,8 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 		fatal("invalid prefix '%s'\n", value);
 	}

-	sa = isc_mem_get(mctx, sizeof(*sa));
-	*sa = (isc_sockaddr_t){ .length = 0 };
+	sa = isc_mem_allocate(mctx, sizeof(*sa));
+	memset(sa, 0, sizeof(*sa));

 	if (strcmp(buf, "0") == 0) {
 		sa->type.sa.sa_family = AF_UNSPEC;
@@ -1147,10 +1141,6 @@ setup_file_key(void) {

 	debug("setup_file_key()");

-	if (sig0key != NULL) {
-		dst_key_free(&sig0key);
-	}
-
 	/* Try reading the key from a K* pair */
 	result = dst_key_fromnamedfile(
 		keyfile, NULL, DST_TYPE_PRIVATE | DST_TYPE_KEY, mctx, &dstkey);
@@ -1188,20 +1178,18 @@ setup_file_key(void) {
 	case DST_ALG_HMACSHA512:
 		hmacname = DNS_TSIG_HMACSHA512_NAME;
 		break;
+	default:
+		printf(";; Couldn't create key %s: bad algorithm\n",
+		       keynametext);
+		goto failure;
 	}
-
-	if (hmacname != NULL) {
-		result = dns_tsigkey_createfromkey(
-			dst_key_name(dstkey), hmacname, dstkey, false, NULL, 0,
-			0, mctx, NULL, &tsigkey);
-		if (result != ISC_R_SUCCESS) {
-			printf(";; Couldn't create key %s: %s\n", keynametext,
-			       isc_result_totext(result));
-			goto failure;
-		}
-	} else {
-		dst_key_attach(dstkey, &sig0key);
-		dst_key_free(&dstkey);
+	result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmacname,
+					   dstkey, false, NULL, 0, 0, mctx,
+					   NULL, &tsigkey);
+	if (result != ISC_R_SUCCESS) {
+		printf(";; Couldn't create key %s: %s\n", keynametext,
+		       isc_result_totext(result));
+		goto failure;
 	}
 failure:
 	if (dstkey != NULL) {
@@ -1605,7 +1593,7 @@ _destroy_lookup(dig_lookup_t *lookup) {
 	}

 	if (lookup->ecs_addr != NULL) {
-		isc_mem_put(mctx, lookup->ecs_addr, sizeof(*lookup->ecs_addr));
+		isc_mem_free(mctx, lookup->ecs_addr);
 	}

 	if (lookup->ednsopts != NULL) {
@@ -1918,8 +1906,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 			dns_rdata_ns_t ns;

 			if (query->lookup->trace_root &&
-			    query->lookup->nsfound >= MXSERV)
-			{
+			    query->lookup->nsfound >= MXSERV) {
 				break;
 			}

@@ -1940,8 +1927,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				cancel_lookup(query->lookup);
 				lookup->doing_xfr = false;
 				if (!lookup->trace_root &&
-				    section == DNS_SECTION_ANSWER)
-				{
+				    section == DNS_SECTION_ANSWER) {
 					lookup->trace = false;
 				} else {
 					lookup->trace = query->lookup->trace;
@@ -2439,20 +2425,12 @@ setup_lookup(dig_lookup_t *lookup) {
 		debug("initializing keys");
 		result = dns_message_settsigkey(lookup->sendmsg, tsigkey);
 		check_result(result, "dns_message_settsigkey");
-	} else if (sig0key != NULL) {
-		debug("initializing keys");
-		result = dns_message_setsig0key(lookup->sendmsg, sig0key);
-		check_result(result, "dns_message_setsig0key");
-	}
-
-	if (lookup->fuzzing) {
-		lookup->sendmsg->fuzzing = true;
-		lookup->sendmsg->fuzztime = lookup->fuzztime;
 	}

 	lookup->sendspace = isc_mem_get(mctx, COMMSIZE);

-	dns_compress_init(&cctx, mctx, 0);
+	result = dns_compress_init(&cctx, mctx);
+	check_result(result, "dns_compress_init");

 	debug("starting to render the message");
 	isc_buffer_init(&lookup->renderbuf, lookup->sendspace, COMMSIZE);
@@ -2564,8 +2542,7 @@ setup_lookup(dig_lookup_t *lookup) {
 					addr[addrl - 1] &= ~0U
 							   << (8 - (plen % 8));
 				}
-				isc_buffer_putmem(&b, addr,
-						  (unsigned int)addrl);
+				isc_buffer_putmem(&b, addr, (unsigned)addrl);
 			}

 			opts[i].value = (uint8_t *)ecsbuf;
@@ -2781,8 +2758,7 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
 		      query->lookup);
 		query->canceled = true;
 		if (query->readhandle != NULL &&
-		    !isc_nm_is_http_handle(query->readhandle))
-		{
+		    !isc_nm_is_http_handle(query->readhandle)) {
 			isc_nm_cancelread(query->readhandle);
 		}
 		query_detach(&query);
@@ -2858,8 +2834,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 		}

 		if (query->lookup->tls_key_file_set &&
-		    query->lookup->tls_cert_file_set)
-		{
+		    query->lookup->tls_cert_file_set) {
 			result = isc_tlsctx_load_certificate(
 				ctx, query->lookup->tls_key_file,
 				query->lookup->tls_cert_file);
@@ -2878,9 +2853,9 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 		}
 #endif /* HAVE_LIBNGHTTP2 */

-		isc_tlsctx_client_session_cache_create(
-			mctx, ctx, ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE,
-			&sess_cache);
+		sess_cache = isc_tlsctx_client_session_cache_new(
+			mctx, ctx,
+			ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE);

 		result = isc_tlsctx_cache_add(
 			query->lookup->tls_ctx_cache, tlsctxname, transport,
@@ -2951,8 +2926,7 @@ start_tcp(dig_query_t *query) {
 		if (tls_mode) {
 			port = 853;
 		} else if (query->lookup->https_mode &&
-			   !query->lookup->http_plain)
-		{
+			   !query->lookup->http_plain) {
 			port = 443;
 		} else if (query->lookup->https_mode) {
 			port = 80;
@@ -3035,9 +3009,9 @@ start_tcp(dig_query_t *query) {
 		if (tlsctx == NULL) {
 			goto failure_tls;
 		}
-		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
-					tcp_connected, connectquery,
-					local_timeout, tlsctx, sess_cache);
+		isc_nm_tlsdnsconnect(netmgr, &localaddr, &query->sockaddr,
+				     tcp_connected, connectquery, local_timeout,
+				     tlsctx, sess_cache);
 #if HAVE_LIBNGHTTP2
 	} else if (query->lookup->https_mode) {
 		char uri[4096] = { 0 };
@@ -3060,11 +3034,13 @@ start_tcp(dig_query_t *query) {
 				   local_timeout);
 #endif
 	} else {
-		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
-					tcp_connected, connectquery,
-					local_timeout, NULL, NULL);
+		isc_nm_tcpdnsconnect(netmgr, &localaddr, &query->sockaddr,
+				     tcp_connected, connectquery,
+				     local_timeout);
 	}

+	/* XXX: set DSCP */
+
 	return;

 failure_tls:
@@ -3450,22 +3426,20 @@ launch_next_query(dig_query_t *query) {

 	xfr = query->lookup->rdtype == dns_rdatatype_ixfr ||
 	      query->lookup->rdtype == dns_rdatatype_axfr;
-	if (xfr &&
-	    isc_nm_socket_type(query->handle) == isc_nm_streamdnssocket &&
-	    query->lookup->tls_mode)
+	if (xfr && isc_nm_socket_type(query->handle) == isc_nm_tlsdnssocket &&
+	    !isc_nm_xfr_allowed(query->handle))
 	{
-		isc_result_t result = isc_nm_xfr_checkperm(query->handle);
-		if (result != ISC_R_SUCCESS) {
-			dighost_error("zone transfers over the established TLS "
-				      "connection are not allowed: %s",
-				      isc_result_totext(result));
-			isc_refcount_decrement0(&recvcount);
-			isc_nmhandle_detach(&query->readhandle);
-			cancel_lookup(l);
-			lookup_detach(&l);
-			clear_current_lookup();
-			return;
-		}
+		dighost_error("zone transfers over the "
+			      "established TLS connection are not allowed");
+		dighost_error("as the "
+			      "connection does not meet the requirements "
+			      "enforced by the RFC 9103");
+		isc_refcount_decrement0(&recvcount);
+		isc_nmhandle_detach(&query->readhandle);
+		cancel_lookup(l);
+		lookup_detach(&l);
+		clear_current_lookup();
+		return;
 	}

 	query_attach(query, &readquery);
@@ -3697,15 +3671,13 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 				 * it's an SOA
 				 */
 				if ((!query->first_soa_rcvd) &&
-				    (rdata.type != dns_rdatatype_soa))
-				{
+				    (rdata.type != dns_rdatatype_soa)) {
 					puts("; Transfer failed.  "
 					     "Didn't start with SOA answer.");
 					return (true);
 				}
 				if ((!query->second_rr_rcvd) &&
-				    (rdata.type != dns_rdatatype_soa))
-				{
+				    (rdata.type != dns_rdatatype_soa)) {
 					query->second_rr_rcvd = true;
 					query->second_rr_serial = 0;
 					debug("got the second rr as nonsoa");
@@ -4271,8 +4243,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	}

 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 && !l->ignore &&
-	    !l->tcp_mode)
-	{
+	    !l->tcp_mode) {
 		if (l->cookie == NULL && l->sendcookie && msg->opt != NULL) {
 			process_opt(l, msg);
 		}
@@ -4404,8 +4375,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,

 	if (!l->doing_xfr || l->xfr_q == query) {
 		if (msg->rcode == dns_rcode_nxdomain &&
-		    (l->origin != NULL || l->need_search))
-		{
+		    (l->origin != NULL || l->need_search)) {
 			if (!next_origin(l) || showsearch) {
 				dighost_printmessage(query, &b, msg, true);
 				dighost_received(isc_buffer_usedlength(&b),
@@ -4639,8 +4609,7 @@ cancel_all(void) {
 			      current_lookup);
 			q->canceled = true;
 			if (q->readhandle != NULL &&
-			    !isc_nm_is_http_handle(q->readhandle))
-			{
+			    !isc_nm_is_http_handle(q->readhandle)) {
 				isc_nm_cancelread(q->readhandle);
 			}
 			query_detach(&q);
@@ -4684,17 +4653,10 @@ destroy_libs(void) {
 	clear_searchlist();

 	if (tsigkey != NULL) {
-		debug("freeing TSIG key %p", tsigkey);
+		debug("freeing key %p", tsigkey);
 		dns_tsigkey_detach(&tsigkey);
 	}
-
-	if (sig0key != NULL) {
-		debug("freeing SIG(0) key %p", sig0key);
-		dst_key_free(&sig0key);
-	}
-
 	if (namebuf != NULL) {
-		debug("freeing key %p", tsigkey);
 		isc_buffer_free(&namebuf);
 	}

@@ -4713,20 +4675,12 @@ destroy_libs(void) {
 	}

 	isc_managers_destroy(&mctx, &loopmgr, &netmgr, &taskmgr);
-
-#if ENABLE_LEAK_DETECTION
-	isc__tls_setdestroycheck(true);
-	isc__uv_setdestroycheck(true);
-	isc__xml_setdestroycheck(true);
-#endif
-
-	isc_mem_checkdestroyed(stderr);
 }

 #ifdef HAVE_LIBIDN2

 static isc_result_t
-idn_filter(isc_buffer_t *buffer, unsigned int start) {
+idn_filter(isc_buffer_t *buffer, unsigned start) {
 	char src[MXNAME];
 	char *dst = NULL;
 	size_t srclen, dstlen;
@@ -108,11 +108,10 @@ struct dig_lookup {
 	isc_refcount_t references;
 	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		expire, fuzzing, header_only, identify, /*%< Append an "on
-							   server <foo>" message
-							 */
-		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
-					   message, with newline and tab */
+		expire, header_only, identify, /*%< Append an "on server <foo>"
+						  message */
+		identify_previous_line,	       /*% Prepend a "Nameserver <foo>:"
+						  message, with newline and tab */
 		idnin, idnout, ignore, multiline, need_search, new_search,
 		noclass, nocrypto, nottl, ns_search_only, /*%< dig +nssearch,
 							     host -C */
@@ -167,6 +166,7 @@ struct dig_lookup {
 	char *cookie;
 	dns_ednsopt_t *ednsopts;
 	unsigned int ednsoptscnt;
+	isc_dscp_t dscp;
 	unsigned int ednsflags;
 	dns_opcode_t opcode;
 	int rrcomments;
@@ -188,7 +188,6 @@ struct dig_lookup {
 		char *tls_key_file;
 		isc_tlsctx_cache_t *tls_ctx_cache;
 	};
-	isc_stdtime_t fuzztime;
 };

 /*% The dig_query structure */
@@ -533,8 +533,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	}

 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_AUTHORITY]) &&
-	    !short_form)
-	{
+	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
 				      true, query);
@@ -543,8 +542,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ADDITIONAL]) &&
-	    !short_form)
-	{
+	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_ADDITIONAL, "ADDITIONAL",
 				      true, query);
@@ -592,12 +590,10 @@ pre_parse_args(int argc, char **argv) {
 			{
 				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
 			} else if (strcasecmp("record",
-					      isc_commandline_argument) == 0)
-			{
+					      isc_commandline_argument) == 0) {
 				isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
 			} else if (strcasecmp("usage",
-					      isc_commandline_argument) == 0)
-			{
+					      isc_commandline_argument) == 0) {
 				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 			}
 			break;
@@ -708,8 +704,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 't':
 			if (strncasecmp(isc_commandline_argument, "ixfr=", 5) ==
-			    0)
-			{
+			    0) {
 				rdtype = dns_rdatatype_ixfr;
 				/* XXXMPA add error checking */
 				serial = strtoul(isc_commandline_argument + 5,
@@ -728,8 +723,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 				      isc_commandline_argument);
 			}
 			if (!lookup->rdtypeset ||
-			    lookup->rdtype != dns_rdatatype_axfr)
-			{
+			    lookup->rdtype != dns_rdatatype_axfr) {
 				lookup->rdtype = rdtype;
 			}
 			lookup->rdtypeset = true;
@@ -773,8 +767,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			FALLTHROUGH;
 		case 'a':
 			if (!lookup->rdtypeset ||
-			    lookup->rdtype != dns_rdatatype_axfr)
-			{
+			    lookup->rdtype != dns_rdatatype_axfr) {
 				lookup->rdtype = dns_rdatatype_any;
 			}
 			list_type = dns_rdatatype_any;
@@ -848,7 +841,6 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 'p':
 			port = atoi(isc_commandline_argument);
-			port_set = true;
 			break;
 		}
 	}
@@ -569,7 +569,6 @@ set_port(const char *value) {
 	isc_result_t result = parse_uint(&n, value, 65535, "port");
 	if (result == ISC_R_SUCCESS) {
 		port = (uint16_t)n;
-		port_set = true;
 	}
 }

@@ -519,7 +519,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,

 	nkey = dns_rdataset_count(keyset);

-	keytable = isc_mem_getx(mctx, sizeof(keytable[0]) * nkey, ISC_MEM_ZERO);
+	keytable = isc_mem_get(mctx, sizeof(keyinfo_t) * nkey);

 	for (result = dns_rdataset_first(keyset), i = 0;
 	     result == ISC_R_SUCCESS; result = dns_rdataset_next(keyset), i++)
@@ -575,7 +575,7 @@ free_keytable(keyinfo_t **keytable_p) {
 		}
 	}

-	isc_mem_put(mctx, keytable, sizeof(keytable[0]) * nkey);
+	isc_mem_put(mctx, keytable, sizeof(keyinfo_t) * nkey);
 }

 /*
@@ -594,7 +594,8 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	dns_secalg_t *algo;
 	int i;

-	algo = isc_mem_getx(mctx, nkey * sizeof(algo[0]), ISC_MEM_ZERO);
+	algo = isc_mem_get(mctx, nkey);
+	memset(algo, 0, nkey);

 	for (result = dns_rdataset_first(sigset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(sigset))
@@ -635,8 +636,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 						   NULL);

 			if (result != ISC_R_SUCCESS &&
-			    result != DNS_R_FROMWILDCARD)
-			{
+			    result != DNS_R_FROMWILDCARD) {
 				vbprintf(1,
 					 "skip RRSIG by key %d:"
 					 " verification failed: %s\n",
@@ -677,7 +677,7 @@ signed_loose(dns_secalg_t *algo) {
 			ok = true;
 		}
 	}
-	isc_mem_put(mctx, algo, nkey * sizeof(algo[0]));
+	isc_mem_put(mctx, algo, nkey);
 	return (ok);
 }

@@ -1085,8 +1085,7 @@ main(int argc, char *argv[]) {
 			 * optional, so that it works just like sed(1).
 			 */
 			if (isc_commandline_argument ==
-			    argv[isc_commandline_index - 1])
-			{
+			    argv[isc_commandline_index - 1]) {
 				isc_commandline_index--;
 				inplace = "";
 			} else {
@@ -1178,8 +1177,7 @@ main(int argc, char *argv[]) {
 		fatal("missing RRSIG CDNSKEY records for %s", namestr);
 	}
 	if (dns_rdataset_isassociated(&cds_set) &&
-	    !dns_rdataset_isassociated(&cds_sig))
-	{
+	    !dns_rdataset_isassociated(&cds_sig)) {
 		fatal("missing RRSIG CDS records for %s", namestr);
 	}

@@ -1202,8 +1200,7 @@ main(int argc, char *argv[]) {
 	if (dns_rdataset_isassociated(&cdnskey_set)) {
 		vbprintf(1, "verify CDNSKEY signature(s)\n");
 		if (!signed_loose(matching_sigs(old_key_tbl, &cdnskey_set,
-						&cdnskey_sig)))
-		{
+						&cdnskey_sig))) {
 			fatal("could not validate child CDNSKEY RRset for %s",
 			      namestr);
 		}
@@ -1211,8 +1208,7 @@ main(int argc, char *argv[]) {
 	if (dns_rdataset_isassociated(&cds_set)) {
 		vbprintf(1, "verify CDS signature(s)\n");
 		if (!signed_loose(
-			    matching_sigs(old_key_tbl, &cds_set, &cds_sig)))
-		{
+			    matching_sigs(old_key_tbl, &cds_set, &cds_sig))) {
 			fatal("could not validate child CDS RRset for %s",
 			      namestr);
 		}
@@ -314,7 +314,7 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {

 static void
 emits(bool showall, bool cds, dns_rdata_t *rdata) {
-	unsigned int i, n;
+	unsigned i, n;

 	n = sizeof(dtype) / sizeof(dtype[0]);
 	for (i = 0; i < n; i++) {
@@ -559,8 +559,7 @@ main(int argc, char **argv) {
 		flags |= DNS_KEYOWNER_ZONE;
 	} else if ((options & DST_TYPE_KEY) != 0) { /* KEY */
 		if (strcasecmp(nametype, "host") == 0 ||
-		    strcasecmp(nametype, "entity") == 0)
-		{
+		    strcasecmp(nametype, "entity") == 0) {
 			flags |= DNS_KEYOWNER_ENTITY;
 		} else if (strcasecmp(nametype, "user") == 0) {
 			flags |= DNS_KEYOWNER_USER;
@@ -587,8 +586,7 @@ main(int argc, char **argv) {
 	if (protocol == -1) {
 		protocol = DNS_KEYPROTO_DNSSEC;
 	} else if ((options & DST_TYPE_KEY) == 0 &&
-		   protocol != DNS_KEYPROTO_DNSSEC)
-	{
+		   protocol != DNS_KEYPROTO_DNSSEC) {
 		fatal("invalid DNSKEY protocol: %d", protocol);
 	}

@@ -254,8 +254,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 		kasp = NULL;
 		if (strcmp(cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			   name) != 0)
-		{
+			   name) != 0) {
 			continue;
 		}

@@ -392,8 +391,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {

 		if (!ctx->oldstyle && ctx->prepub > 0) {
 			if (ctx->setpub && ctx->setact &&
-			    (ctx->activate - ctx->prepub) < ctx->publish)
-			{
+			    (ctx->activate - ctx->prepub) < ctx->publish) {
 				fatal("Activation and publication dates "
 				      "are closer together than the\n\t"
 				      "prepublication interval.");
@@ -729,8 +727,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {

 			if (ctx->setdel) {
 				if (ctx->setinact &&
-				    ctx->deltime < ctx->inactive)
-				{
+				    ctx->deltime < ctx->inactive) {
 					fprintf(stderr,
 						"%s: warning: Key is "
 						"scheduled to be deleted "
@@ -984,8 +981,7 @@ main(int argc, char **argv) {
 			ctx.protocol = strtol(isc_commandline_argument, &endp,
 					      10);
 			if (*endp != '\0' || ctx.protocol < 0 ||
-			    ctx.protocol > 255)
-			{
+			    ctx.protocol > 255) {
 				fatal("-p must be followed by a number "
 				      "[0..255]");
 			}
@@ -1001,8 +997,7 @@ main(int argc, char **argv) {
 			ctx.signatory = strtol(isc_commandline_argument, &endp,
 					       10);
 			if (*endp != '\0' || ctx.signatory < 0 ||
-			    ctx.signatory > 15)
-			{
+			    ctx.signatory > 15) {
 				fatal("-s must be followed by a number "
 				      "[0..15]");
 			}
@@ -136,8 +136,7 @@ main(int argc, char **argv) {
 	}

 	if (argc < isc_commandline_index + 1 ||
-	    argv[isc_commandline_index] == NULL)
-	{
+	    argv[isc_commandline_index] == NULL) {
 		fatal("The key file name was not specified");
 	}
 	if (argc > isc_commandline_index + 1) {
@@ -544,8 +544,7 @@ main(int argc, char **argv) {
 	}

 	if (argc < isc_commandline_index + 1 ||
-	    argv[isc_commandline_index] == NULL)
-	{
+	    argv[isc_commandline_index] == NULL) {
 		fatal("The key file name was not specified");
 	}
 	if (argc > isc_commandline_index + 1) {
@@ -553,8 +552,7 @@ main(int argc, char **argv) {
 	}

 	if ((setgoal || setds || setdnskey || setkrrsig || setzrrsig) &&
-	    !write_state)
-	{
+	    !write_state) {
 		fatal("Options -g, -d, -k, -r and -z require -s to be set");
 	}

@@ -117,6 +117,13 @@ static int nsec_datatype = dns_rdatatype_nsec;
 #define SOA_SERIAL_UNIXTIME  2
 #define SOA_SERIAL_DATE	     3

+typedef struct signer_event sevent_t;
+struct signer_event {
+	ISC_EVENT_COMMON(sevent_t);
+	dns_fixedname_t *fname;
+	dns_dbnode_t *node;
+};
+
 static dns_dnsseckeylist_t keylist;
 static unsigned int keycount = 0;
 static isc_rwlock_t keylist_lock;
@@ -152,7 +159,8 @@ static dns_iterations_t nsec3iter = 0U;
 static unsigned char saltbuf[255];
 static unsigned char *gsalt = saltbuf;
 static size_t salt_length = 0;
-static unsigned int nloops = 0;
+static isc_task_t *write_task = NULL;
+static unsigned int ntasks = 0;
 static atomic_bool shuttingdown;
 static atomic_bool finished;
 static bool nokeys = false;
@@ -184,6 +192,9 @@ static bool no_max_check = false;
 		UNLOCK(&statslock); \
 	}

+static void
+sign(isc_task_t *task, isc_event_t *event);
+
 /*%
 * Store a copy of 'name' in 'fzonecut' and return a pointer to that copy.
 */
@@ -204,13 +215,20 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 	isc_buffer_t *buffer = NULL;
 	isc_region_t r;
 	isc_result_t result;
-	unsigned int bufsize = 4096;
+	unsigned bufsize = 4096;

-	if (!output_dnssec_only) {
+	if (outputformat != dns_masterformat_text) {
 		return;
 	}

-	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &iter);
+	if (!output_dnssec_only) {
+		result = dns_master_dumpnodetostream(mctx, gdb, gversion, node,
+						     name, masterstyle, outfp);
+		check_result(result, "dns_master_dumpnodetostream");
+		return;
+	}
+
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &iter);
 	check_result(result, "dns_db_allrdatasets");

 	dns_rdataset_init(&rds);
@@ -257,17 +275,6 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 	dns_rdatasetiter_destroy(&iter);
 }

-static void
-lock_and_dumpnode(dns_name_t *name, dns_dbnode_t *node) {
-	if (!output_dnssec_only) {
-		return;
-	}
-
-	LOCK(&namelock);
-	dumpnode(name, node);
-	UNLOCK(&namelock);
-}
-
 /*%
 * Sign the given RRset with given key, and add the signature record to the
 * given tuple.
@@ -358,8 +365,7 @@ keythatsigned_unlocked(dns_rdata_rrsig_t *rrsig) {
 	dns_dnsseckey_t *key;

 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	     key = ISC_LIST_NEXT(key, link)) {
 		if (rrsig->keyid == dst_key_id(key->key) &&
 		    rrsig->algorithm == dst_key_alg(key->key) &&
 		    dns_name_equal(&rrsig->signer, dst_key_name(key->key)))
@@ -559,8 +565,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 				 "invalid validity period\n",
 				 sigstr);
 		} else if (key == NULL && !future &&
-			   expecttofindkey(&rrsig.signer))
-		{
+			   expecttofindkey(&rrsig.signer)) {
 			/* rrsig is dropped and not replaced */
 			vbprintf(2,
 				 "\trrsig by %s dropped - "
@@ -571,8 +576,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			vbprintf(2, "\trrsig by %s %s - dnskey not found\n",
 				 keep ? "retained" : "dropped", sigstr);
 		} else if (!dns_dnssec_keyactive(key->key, now) &&
-			   remove_inactkeysigs)
-		{
+			   remove_inactkeysigs) {
 			keep = false;
 			vbprintf(2, "\trrsig by %s dropped - key inactive\n",
 				 sigstr);
@@ -673,8 +677,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	}

 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	     key = ISC_LIST_NEXT(key, link)) {
 		if (nowsignedby[key->index]) {
 			continue;
 		}
@@ -696,8 +699,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			     curr = ISC_LIST_NEXT(curr, link))
 			{
 				if (dst_key_alg(key->key) !=
-				    dst_key_alg(curr->key))
-				{
+				    dst_key_alg(curr->key)) {
 					continue;
 				}
 				if (REVOKE(curr->key)) {
@@ -708,8 +710,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 				}
 			}
 			if (isksk(key) || !have_ksk ||
-			    (iszsk(key) && !keyset_kskonly))
-			{
+			    (iszsk(key) && !keyset_kskonly)) {
 				signwithkey(name, set, key->key, ttl, add,
 					    "signing with dnskey");
 			}
@@ -750,8 +751,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 							     DST_NUM_SUCCESSOR,
 							     &suc);
 					if (ret != ISC_R_SUCCESS ||
-					    dst_key_id(key->key) != suc)
-					{
+					    dst_key_id(key->key) != suc) {
 						continue;
 					}

@@ -1186,7 +1186,7 @@ signname(dns_dbnode_t *node, dns_name_t *name) {
 	dns_diff_init(mctx, &del);
 	dns_diff_init(mctx, &add);
 	rdsiter = NULL;
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	result = dns_rdatasetiter_first(rdsiter);
 	while (result == ISC_R_SUCCESS) {
@@ -1204,8 +1204,7 @@ signname(dns_dbnode_t *node, dns_name_t *name) {
 		 */
 		if (isdelegation) {
 			if (rdataset.type != nsec_datatype &&
-			    rdataset.type != dns_rdatatype_ds)
-			{
+			    rdataset.type != dns_rdatatype_ds) {
 				goto skip;
 			}
 		} else if (rdataset.type == dns_rdatatype_ds) {
@@ -1260,7 +1259,7 @@ active_node(dns_dbnode_t *node) {
 	bool found;

 	dns_rdataset_init(&rdataset);
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	result = dns_rdatasetiter_first(rdsiter);
 	while (result == ISC_R_SUCCESS) {
@@ -1306,8 +1305,7 @@ active_node(dns_dbnode_t *node) {
 		/*
 		 * Delete RRSIGs for types that no longer exist.
 		 */
-		result = dns_db_allrdatasets(gdb, node, gversion, 0, 0,
-					     &rdsiter2);
+		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter2);
 		check_result(result, "dns_db_allrdatasets()");
 		for (result = dns_rdatasetiter_first(rdsiter);
 		     result == ISC_R_SUCCESS;
@@ -1355,8 +1353,7 @@ active_node(dns_dbnode_t *node) {
 				check_result(result, "dns_db_deleterdataset("
 						     "rrsig)");
 			} else if (result != ISC_R_NOMORE &&
-				   result != ISC_R_SUCCESS)
-			{
+				   result != ISC_R_SUCCESS) {
 				fatal("rdataset iteration failed: %s",
 				      isc_result_totext(result));
 			}
@@ -1437,8 +1434,7 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {
 	old_serial = dns_soa_getserial(&rdata);

 	if (method == dns_updatemethod_date ||
-	    method == dns_updatemethod_unixtime)
-	{
+	    method == dns_updatemethod_unixtime) {
 		new_serial = dns_update_soaserial(old_serial, method, &used);
 	} else if (serial != 0 || method == dns_updatemethod_none) {
 		/* Set SOA serial to the value provided. */
@@ -1495,6 +1491,47 @@ cleanup:
 	return (result);
 }

+/*%
+ * Delete any RRSIG records at a node.
+ */
+static void
+cleannode(dns_db_t *db, dns_dbversion_t *dbversion, dns_dbnode_t *node) {
+	dns_rdatasetiter_t *rdsiter = NULL;
+	dns_rdataset_t set;
+	isc_result_t result, dresult;
+
+	if (outputformat != dns_masterformat_text || !disable_zone_check) {
+		return;
+	}
+
+	dns_rdataset_init(&set);
+	result = dns_db_allrdatasets(db, node, dbversion, 0, &rdsiter);
+	check_result(result, "dns_db_allrdatasets");
+	result = dns_rdatasetiter_first(rdsiter);
+	while (result == ISC_R_SUCCESS) {
+		bool destroy = false;
+		dns_rdatatype_t covers = 0;
+		dns_rdatasetiter_current(rdsiter, &set);
+		if (set.type == dns_rdatatype_rrsig) {
+			covers = set.covers;
+			destroy = true;
+		}
+		dns_rdataset_disassociate(&set);
+		result = dns_rdatasetiter_next(rdsiter);
+		if (destroy) {
+			dresult = dns_db_deleterdataset(db, node, dbversion,
+							dns_rdatatype_rrsig,
+							covers);
+			check_result(dresult, "dns_db_deleterdataset");
+		}
+	}
+	if (result != ISC_R_NOMORE) {
+		fatal("rdataset iteration failed: %s",
+		      isc_result_totext(result));
+	}
+	dns_rdatasetiter_destroy(&rdsiter);
+}
+
 /*%
 * Set up the iterator and global state before starting the tasks.
 */
@@ -1533,7 +1570,10 @@ signapex(void) {
 	result = dns_dbiterator_current(gdbiter, &node, name);
 	check_dns_dbiterator_current(result);
 	signname(node, name);
+	LOCK(&namelock);
 	dumpnode(name, node);
+	UNLOCK(&namelock);
+	cleannode(gdb, gversion, node);
 	dns_db_detachnode(gdb, &node);
 	result = dns_dbiterator_first(gdbiter);
 	if (result == ISC_R_NOMORE) {
@@ -1544,22 +1584,16 @@ signapex(void) {
 	}
 }

-static void
-abortwork(void *arg) {
-	UNUSED(arg);
-
-	atomic_store(&shuttingdown, true);
-}
-
 /*%
 * Assigns a node to a worker thread.  This is protected by the main task's
 * lock.
 */
 static void
-assignwork(void *arg) {
-	dns_fixedname_t fname;
+assignwork(isc_task_t *task) {
+	dns_fixedname_t *fname = NULL;
 	dns_name_t *name = NULL;
 	dns_dbnode_t *node = NULL;
+	sevent_t *sevent = NULL;
 	dns_rdataset_t nsec;
 	bool found;
 	isc_result_t result;
@@ -1567,8 +1601,6 @@ assignwork(void *arg) {
 	static dns_fixedname_t fzonecut;   /* Protected by namelock. */
 	static unsigned int ended = 0;	   /* Protected by namelock. */

-	UNUSED(arg);
-
 	if (atomic_load(&shuttingdown)) {
 		return;
 	}
@@ -1576,14 +1608,15 @@ assignwork(void *arg) {
 	LOCK(&namelock);
 	if (atomic_load(&finished)) {
 		ended++;
-		if (ended == nloops) {
+		if (ended == ntasks) {
+			isc_task_detach(&write_task);
 			isc_loopmgr_shutdown(loopmgr);
 		}
-		UNLOCK(&namelock);
-		return;
+		goto unlock;
 	}

-	name = dns_fixedname_initname(&fname);
+	fname = isc_mem_get(mctx, sizeof(dns_fixedname_t));
+	name = dns_fixedname_initname(fname);
 	node = NULL;
 	found = false;
 	while (!found) {
@@ -1618,12 +1651,10 @@ assignwork(void *arg) {
 			     !dns_name_issubdomain(name, zonecut)))
 			{
 				if (is_delegation(gdb, gversion, gorigin, name,
-						  node, NULL))
-				{
+						  node, NULL)) {
 					zonecut = savezonecut(&fzonecut, name);
 					if (!OPTOUT(nsec3flags) ||
-					    secure(name, node))
-					{
+					    secure(name, node)) {
 						found = true;
 					}
 				} else if (has_dname(gdb, gversion, node)) {
@@ -1652,24 +1683,93 @@ assignwork(void *arg) {
 	}
 	if (!found) {
 		ended++;
-		if (ended == nloops) {
+		if (ended == ntasks) {
+			isc_task_detach(&write_task);
 			isc_loopmgr_shutdown(loopmgr);
 		}
-		UNLOCK(&namelock);
-		return;
+		isc_mem_put(mctx, fname, sizeof(dns_fixedname_t));
+		goto unlock;
+	}
+	sevent = (sevent_t *)isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,
+						sign, NULL, sizeof(sevent_t));
+
+	sevent->node = node;
+	sevent->fname = fname;
+	isc_task_send(task, ISC_EVENT_PTR(&sevent));
+unlock:
+	UNLOCK(&namelock);
+}
+
+/*%
+ * Start a worker task
+ */
+static void
+startworker(void *arg) {
+	isc_task_t **tasks = (isc_task_t **)arg;
+	isc_result_t result;
+	int tid;
+
+	REQUIRE(tasks != NULL);
+
+	tid = isc_tid();
+	result = isc_task_create(taskmgr, &tasks[tid], tid);
+	if (result != ISC_R_SUCCESS) {
+		fatal("failed to create task: %s", isc_result_totext(result));
 	}

+	assignwork(tasks[tid]);
+}
+
+/*%
+ * Finish a worker task
+ */
+static void
+workerdone(void *arg) {
+	isc_task_t **tasks = (isc_task_t **)arg;
+
+	isc_task_detach(&tasks[isc_tid()]);
+}
+
+/*%
+ * Write a node to the output file, and restart the worker task.
+ */
+static void
+writenode(isc_task_t *task, isc_event_t *event) {
+	sevent_t *sevent = (sevent_t *)event;
+
+	LOCK(&namelock);
+	dumpnode(dns_fixedname_name(sevent->fname), sevent->node);
 	UNLOCK(&namelock);
+	cleannode(gdb, gversion, sevent->node);
+	dns_db_detachnode(gdb, &sevent->node);
+	isc_mem_put(mctx, sevent->fname, sizeof(dns_fixedname_t));
+	assignwork(task);
+	isc_event_free(&event);
+}

-	signname(node, dns_fixedname_name(&fname));
+/*%
+ *  Sign a database node.
+ */
+static void
+sign(isc_task_t *task, isc_event_t *event) {
+	dns_fixedname_t *fname;
+	dns_dbnode_t *node;
+	sevent_t *sevent, *wevent;

-	/*%
-	 * Write a node to the output file, and restart the worker task.
-	 */
-	lock_and_dumpnode(dns_fixedname_name(&fname), node);
-	dns_db_detachnode(gdb, &node);
+	UNUSED(task);

-	isc_job_run(loopmgr, assignwork, NULL);
+	sevent = (sevent_t *)event;
+	node = sevent->node;
+	fname = sevent->fname;
+	isc_event_free(&event);
+
+	signname(node, dns_fixedname_name(fname));
+	wevent = (sevent_t *)isc_event_allocate(mctx, write_task,
+						SIGNER_EVENT_WRITE, writenode,
+						NULL, sizeof(sevent_t));
+	wevent->node = node;
+	wevent->fname = fname;
+	isc_task_send(write_task, ISC_EVENT_PTR(&wevent));
 }

 /*%
@@ -1725,7 +1825,7 @@ remove_records(dns_dbnode_t *node, dns_rdatatype_t which, bool checknsec) {
 	/*
 	 * Delete any records of the given type at the apex.
 	 */
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	for (result = dns_rdatasetiter_first(rdsiter); result == ISC_R_SUCCESS;
 	     result = dns_rdatasetiter_next(rdsiter))
@@ -1736,14 +1836,12 @@ remove_records(dns_dbnode_t *node, dns_rdatatype_t which, bool checknsec) {
 		dns_rdataset_disassociate(&rdataset);
 		if (type == which || covers == which) {
 			if (which == dns_rdatatype_nsec && checknsec &&
-			    !update_chain)
-			{
+			    !update_chain) {
 				fatal("Zone contains NSEC records.  Use -u "
 				      "to update to NSEC3.");
 			}
 			if (which == dns_rdatatype_nsec3param && checknsec &&
-			    !update_chain)
-			{
+			    !update_chain) {
 				fatal("Zone contains NSEC3 chains.  Use -u "
 				      "to update to NSEC.");
 			}
@@ -1768,7 +1866,7 @@ remove_sigs(dns_dbnode_t *node, bool delegation, dns_rdatatype_t which) {
 	dns_rdataset_t rdataset;

 	dns_rdataset_init(&rdataset);
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	for (result = dns_rdatasetiter_first(rdsiter); result == ISC_R_SUCCESS;
 	     result = dns_rdatasetiter_next(rdsiter))
@@ -1832,8 +1930,7 @@ nsecify(void) {
 	{
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		result = dns_db_allrdatasets(gdb, node, gversion, 0, 0,
-					     &rdsiter);
+		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 		check_result(result, "dns_db_allrdatasets()");
 		for (result = dns_rdatasetiter_first(rdsiter);
 		     result == ISC_R_SUCCESS;
@@ -2188,8 +2285,7 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 			count2++;
 			dns_rdataset_current(&tmprdataset, &rdata2);
 			if (count1 < count2 &&
-			    dns_rdata_casecompare(&rdata1, &rdata2) == 0)
-			{
+			    dns_rdata_casecompare(&rdata1, &rdata2) == 0) {
 				vbprintf(2, "removing duplicate at %s/%s\n",
 					 namestr, typestr);
 				result = dns_difftuple_create(
@@ -2244,8 +2340,7 @@ cleanup_zone(void) {
 	{
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		result = dns_db_allrdatasets(gdb, node, gversion, 0, 0,
-					     &rdsiter);
+		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 		check_result(result, "dns_db_allrdatasets()");
 		for (result = dns_rdatasetiter_first(rdsiter);
 		     result == ISC_R_SUCCESS;
@@ -2357,16 +2452,14 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 				continue;
 			}
 			if (is_delegation(gdb, gversion, gorigin, nextname,
-					  nextnode, &nsttl))
-			{
+					  nextnode, &nsttl)) {
 				zonecut = savezonecut(&fzonecut, nextname);
 				remove_sigs(nextnode, true, 0);
 				if (generateds) {
 					add_ds(nextname, nextnode, nsttl);
 				}
 				if (OPTOUT(nsec3flags) &&
-				    !secure(nextname, nextnode))
-				{
+				    !secure(nextname, nextnode)) {
 					dns_db_detachnode(gdb, &nextnode);
 					result = dns_dbiterator_next(dbiter);
 					continue;
@@ -2500,12 +2593,10 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 				continue;
 			}
 			if (is_delegation(gdb, gversion, gorigin, nextname,
-					  nextnode, NULL))
-			{
+					  nextnode, NULL)) {
 				zonecut = savezonecut(&fzonecut, nextname);
 				if (OPTOUT(nsec3flags) &&
-				    !secure(nextname, nextnode))
-				{
+				    !secure(nextname, nextnode)) {
 					dns_db_detachnode(gdb, &nextnode);
 					result = dns_dbiterator_next(dbiter);
 					continue;
@@ -2683,8 +2774,7 @@ loadexplicitkeys(char *keyfiles[], int n, bool setksk) {

 		/* Skip any duplicates */
 		for (key = ISC_LIST_HEAD(keylist); key != NULL;
-		     key = ISC_LIST_NEXT(key, link))
-		{
+		     key = ISC_LIST_NEXT(key, link)) {
 			if (dst_key_id(key->key) == dst_key_id(newkey) &&
 			    dst_key_alg(key->key) == dst_key_alg(newkey))
 			{
@@ -3025,8 +3115,7 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	name = gorigin;

 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	     key = ISC_LIST_NEXT(key, link)) {
 		if (REVOKE(key->key)) {
 			continue;
 		}
@@ -3278,6 +3367,7 @@ main(int argc, char *argv[]) {
 	bool free_output = false;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
+	isc_task_t **tasks = NULL;
 	hashlist_t hashlist;
 	bool make_keyset = false;
 	bool set_salt = false;
@@ -3484,8 +3574,8 @@ main(int argc, char *argv[]) {

 		case 'n':
 			endp = NULL;
-			nloops = strtol(isc_commandline_argument, &endp, 0);
-			if (*endp != '\0' || nloops > INT32_MAX) {
+			ntasks = strtol(isc_commandline_argument, &endp, 0);
+			if (*endp != '\0' || ntasks > INT32_MAX) {
 				fatal("number of cpus must be numeric");
 			}
 			break;
@@ -3626,10 +3716,10 @@ main(int argc, char *argv[]) {
 		cycle = (endtime - starttime) / 4;
 	}

-	if (nloops == 0) {
-		nloops = isc_os_ncpus();
+	if (ntasks == 0) {
+		ntasks = isc_os_ncpus();
 	}
-	vbprintf(4, "using %d cpus\n", nloops);
+	vbprintf(4, "using %d cpus\n", ntasks);

 	rdclass = strtoclass(classname);

@@ -3637,7 +3727,9 @@ main(int argc, char *argv[]) {
 		directory = ".";
 	}

-	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr, &taskmgr);
+	isc_managers_create(&mctx, ntasks, &loopmgr, &netmgr, &taskmgr);
+
+	isc_task_create(taskmgr, &write_task, 0);

 	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS) {
@@ -3699,8 +3791,7 @@ main(int argc, char *argv[]) {
 			outputformat = dns_masterformat_raw;
 			rawversion = strtol(outputformatstr + 4, &end, 10);
 			if (end == outputformatstr + 4 || *end != '\0' ||
-			    rawversion > 1U)
-			{
+			    rawversion > 1U) {
 				fprintf(stderr, "unknown raw format version\n");
 				exit(1);
 			}
@@ -3809,8 +3900,7 @@ main(int argc, char *argv[]) {

 	/* Now enumerate the key list */
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	     key = ISC_LIST_NEXT(key, link)) {
 		key->index = keycount++;
 	}

@@ -3943,14 +4033,21 @@ main(int argc, char *argv[]) {
 		 * There is more work to do.  Spread it out over multiple
 		 * processors if possible.
 		 */
-		isc_loopmgr_setup(loopmgr, assignwork, NULL);
-		isc_loopmgr_teardown(loopmgr, abortwork, NULL);
+		tasks = isc_mem_get(mctx, ntasks * sizeof(isc_task_t *));
+		memset(tasks, 0, ntasks * sizeof(isc_task_t *));
+
+		isc_loopmgr_setup(loopmgr, startworker, tasks);
+		isc_loopmgr_teardown(loopmgr, workerdone, tasks);
+
 		isc_loopmgr_run(loopmgr);

 		if (!atomic_load(&finished)) {
 			fatal("process aborted by user");
 		}
+
+		isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
 	}
+	atomic_store(&shuttingdown, true);
 	postsign();
 	TIME_NOW(&sign_finish);

@@ -3967,7 +4064,7 @@ main(int argc, char *argv[]) {
 		}
 	}

-	if (!output_dnssec_only) {
+	if (outputformat != dns_masterformat_text) {
 		dns_masterrawheader_t header;
 		dns_master_initrawheader(&header);
 		if (rawversion == 0U) {
@@ -3979,7 +4076,7 @@ main(int argc, char *argv[]) {
 		result = dns_master_dumptostream(mctx, gdb, gversion,
 						 masterstyle, outputformat,
 						 &header, outfp);
-		check_result(result, "dns_master_dumptostream");
+		check_result(result, "dns_master_dumptostream3");
 	}

 	if (!output_stdout) {
@@ -315,8 +315,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	 */
 	n = strspn(str, "0123456789");
 	if ((n == 8u || n == 14u) &&
-	    (str[n] == '\0' || str[n] == '-' || str[n] == '+'))
-	{
+	    (str[n] == '\0' || str[n] == '-' || str[n] == '+')) {
 		char timestr[15];

 		strlcpy(timestr, str, sizeof(timestr));
@@ -332,8 +331,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 		base = val;
 		str += n;
 	} else if (n == 10u &&
-		   (str[n] == '\0' || str[n] == '-' || str[n] == '+'))
-	{
+		   (str[n] == '\0' || str[n] == '-' || str[n] == '+')) {
 		base = strtoll(str, &endp, 0);
 		str += 10;
 	} else if (strncmp(str, "now", 3) == 0) {
@@ -408,7 +406,7 @@ cmp_dtype(const void *ap, const void *bp) {

 void
 add_dtype(unsigned int dt) {
-	unsigned int i, n;
+	unsigned i, n;

 	/* ensure there is space for a zero terminator */
 	n = sizeof(dtype) / sizeof(dtype[0]) - 1;
@@ -14,7 +14,6 @@ AM_CPPFLAGS +=				\
 	$(MAXMINDDB_CFLAGS)		\
 	$(DNSTAP_CFLAGS)		\
 	$(LIBUV_CFLAGS)			\
-	$(LIBSYSTEMD_CFLAGS)		\
 	$(ZLIB_CFLAGS)

 if HAVE_JSON_C
@@ -110,7 +109,7 @@ named_LDADD =					\
 	$(MAXMINDDB_LIBS)			\
 	$(DNSTAP_LIBS)				\
 	$(LIBUV_LIBS)				\
-	$(LIBSYSTEMD_LIBS)			\
+	$(LIBXML2_LIBS)				\
 	$(ZLIB_LIBS)

 if HAVE_JSON_C
@@ -122,8 +121,3 @@ if HAVE_LIBNGHTTP2
 named_LDADD +=					\
 	$(LIBNGHTTP2_LIBS)
 endif HAVE_LIBNGHTTP2
-
-if HAVE_LIBXML2
-named_LDADD +=					\
-	$(LIBXML2_LIBS)
-endif HAVE_LIBXML2
@@ -15,7 +15,7 @@
  <xsl:output method="html" indent="yes" version="4.0"/>
  <!-- the version number **below** must match version in bin/named/statschannel.c -->
  <!-- don't forget to update "/xml/v<STATS_XML_VERSION_MAJOR>" in the HTTP endpoints listed below -->
-  <xsl:template match="statistics[@version=&quot;3.14&quot;]">
+  <xsl:template match="statistics[@version=&quot;3.12&quot;]">
    <html>
      <head>
        <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
@@ -1039,7 +1039,12 @@
              <th>ID</th>
              <th>Name</th>
              <th>References</th>
+              <th>TotalUse</th>
              <th>InUse</th>
+              <th>MaxUse</th>
+              <th>Malloced</th>
+              <th>MaxMalloced</th>
+              <th>BlockSize</th>
              <th>Pools</th>
              <th>HiWater</th>
              <th>LoWater</th>
@@ -1062,9 +1067,24 @@
                <td>
                  <xsl:value-of select="references"/>
                </td>
+                <td>
+                  <xsl:value-of select="total"/>
+                </td>
                <td>
                  <xsl:value-of select="inuse"/>
                </td>
+                <td>
+                  <xsl:value-of select="maxinuse"/>
+                </td>
+                <td>
+                  <xsl:value-of select="malloced"/>
+                </td>
+                <td>
+                  <xsl:value-of select="maxmalloced"/>
+                </td>
+                <td>
+                  <xsl:value-of select="blocksize"/>
+                </td>
                <td>
                  <xsl:value-of select="pools"/>
                </td>
@@ -302,8 +302,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name,
 	 * Reverse of 192.0.0.170 or 192.0.0.171 maps to ipv4only.arpa.
 	 */
 	if ((v[0] == 170 || v[0] == 171) && v[1] == 0 && v[2] == 0 &&
-	    v[3] == 192)
-	{
+	    v[3] == 192) {
 		return (dns_sdb_putrdata(lookup, dns_rdatatype_ptr, 3600,
 					 ipv4only, sizeof(ipv4only)));
 	}
@@ -50,12 +50,16 @@ options {\n\
 	answer-cookie true;\n\
 	automatic-interface-scan yes;\n\
 	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
-#	blackhole {none;};\n\
-	cookie-algorithm siphash24;\n\
+#	blackhole {none;};\n"
+			    "	cookie-algorithm siphash24;\n"
+			    "	coresize default;\n\
+	datasize default;\n"
+			    "\
 #	directory <none>\n\
 	dnssec-policy \"none\";\n\
 	dump-file \"named_dump.db\";\n\
-	edns-udp-size 1232;\n"
+	edns-udp-size 1232;\n\
+	files unlimited;\n"
 #if defined(HAVE_GEOIP2)
 			    "\
 	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
@@ -111,6 +115,7 @@ options {\n\
 	session-keyalg hmac-sha256;\n\
 #	session-keyfile \"" NAMED_LOCALSTATEDIR "/run/named/session.key\";\n\
 	session-keyname local-ddns;\n\
+	stacksize default;\n\
 	startup-notify-rate 20;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
@@ -131,7 +136,6 @@ options {\n\
 	trust-anchor-telemetry yes;\n\
 	udp-receive-buffer 0;\n\
 	udp-send-buffer 0;\n\
-	update-quota 100;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
@@ -148,7 +152,6 @@ options {\n\
 	check-names response ignore;\n\
 	check-names secondary warn;\n\
 	check-spf warn;\n\
-	check-svcb yes;\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-validation " VALIDATION_DEFAULT "; \n"
@@ -209,6 +212,8 @@ options {\n\
 	allow-query-on {any;};\n\
 	allow-transfer {any;};\n\
 #	also-notify <none>\n\
+	alt-transfer-source *;\n\
+	alt-transfer-source-v6 *;\n\
 	check-integrity yes;\n\
 	check-mx-cname warn;\n\
 	check-sibling yes;\n\
@@ -217,6 +222,7 @@ options {\n\
 	dialup no;\n\
 	dnssec-dnskey-kskonly yes;\n\
 	dnssec-loadkeys-interval 60;\n\
+	dnssec-secure-to-insecure no;\n\
 	dnssec-update-mode maintain;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
@@ -388,8 +394,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 	for (i = 0; maps[i] != NULL; i++) {
 		checknames = NULL;
 		if (cfg_map_get(maps[i], "check-names", &checknames) ==
-		    ISC_R_SUCCESS)
-		{
+		    ISC_R_SUCCESS) {
 			/*
 			 * Zone map entry is not a list.
 			 */
@@ -405,8 +410,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],

 				for (size_t j = 0; names[j] != NULL; j++) {
 					if (strcasecmp(cfg_obj_asstring(type),
-						       names[j]) == 0)
-					{
+						       names[j]) == 0) {
 						*obj = cfg_tuple_get(value,
 								     "mode");
 						return (ISC_R_SUCCESS);
@@ -479,8 +483,7 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	if (strcasecmp(str, "primary") == 0 || strcasecmp(str, "master") == 0) {
 		ztype = dns_zone_primary;
 	} else if (strcasecmp(str, "secondary") == 0 ||
-		   strcasecmp(str, "slave") == 0)
-	{
+		   strcasecmp(str, "slave") == 0) {
 		ztype = dns_zone_secondary;
 	} else if (strcasecmp(str, "mirror") == 0) {
 		ztype = dns_zone_mirror;
@@ -496,6 +499,109 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	return (ztype);
 }

+isc_result_t
+named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
+		       in_port_t defport, isc_mem_t *mctx,
+		       isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
+		       uint32_t *countp) {
+	int count, i = 0;
+	const cfg_obj_t *addrlist;
+	const cfg_obj_t *portobj, *dscpobj;
+	const cfg_listelt_t *element;
+	isc_sockaddr_t *addrs;
+	in_port_t port;
+	isc_dscp_t dscp = -1, *dscps = NULL;
+	isc_result_t result;
+
+	INSIST(addrsp != NULL && *addrsp == NULL);
+	INSIST(dscpsp == NULL || *dscpsp == NULL);
+	INSIST(countp != NULL);
+
+	addrlist = cfg_tuple_get(list, "addresses");
+	count = named_config_listcount(addrlist);
+
+	portobj = cfg_tuple_get(list, "port");
+	if (cfg_obj_isuint32(portobj)) {
+		uint32_t val = cfg_obj_asuint32(portobj);
+		if (val > UINT16_MAX) {
+			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
+				    "port '%u' out of range", val);
+			return (ISC_R_RANGE);
+		}
+		port = (in_port_t)val;
+	} else if (defport != 0) {
+		port = defport;
+	} else {
+		result = named_config_getport(config, "port", &port);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+
+	if (dscpsp != NULL) {
+		dscpobj = cfg_tuple_get(list, "dscp");
+		if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
+			if (cfg_obj_asuint32(dscpobj) > 63) {
+				cfg_obj_log(dscpobj, named_g_lctx,
+					    ISC_LOG_ERROR,
+					    "dscp value '%u' is out of range",
+					    cfg_obj_asuint32(dscpobj));
+				return (ISC_R_RANGE);
+			}
+			dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
+		}
+
+		dscps = isc_mem_get(mctx, count * sizeof(isc_dscp_t));
+	}
+
+	addrs = isc_mem_get(mctx, count * sizeof(isc_sockaddr_t));
+
+	for (element = cfg_list_first(addrlist); element != NULL;
+	     element = cfg_list_next(element), i++)
+	{
+		const cfg_obj_t *addr;
+		INSIST(i < count);
+		addr = cfg_listelt_value(element);
+		addrs[i] = *cfg_obj_assockaddr(addr);
+		if (dscpsp != NULL) {
+			isc_dscp_t innerdscp;
+			innerdscp = cfg_obj_getdscp(addr);
+			if (innerdscp == -1) {
+				innerdscp = dscp;
+			}
+			dscps[i] = innerdscp;
+		}
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			isc_sockaddr_setport(&addrs[i], port);
+		}
+	}
+	INSIST(i == count);
+
+	*addrsp = addrs;
+	*countp = count;
+
+	if (dscpsp != NULL) {
+		*dscpsp = dscps;
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+void
+named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
+		       isc_dscp_t **dscpsp, uint32_t count) {
+	INSIST(addrsp != NULL && *addrsp != NULL);
+	INSIST(dscpsp == NULL || *dscpsp != NULL);
+
+	isc_mem_put(mctx, *addrsp, count * sizeof(isc_sockaddr_t));
+	*addrsp = NULL;
+
+	if (dscpsp != NULL) {
+		isc_mem_put(mctx, *dscpsp, count * sizeof(isc_dscp_t));
+		*dscpsp = NULL;
+	}
+}
+
 static isc_result_t
 getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 	      const cfg_obj_t **ret) {
@@ -515,8 +621,7 @@ getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 	while (elt != NULL) {
 		obj = cfg_listelt_value(elt);
 		if (strcasecmp(cfg_obj_asstring(cfg_tuple_get(obj, "name")),
-			       name) == 0)
-		{
+			       name) == 0) {
 			*ret = obj;
 			return (ISC_R_SUCCESS);
 		}
@@ -576,58 +681,65 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	return (ISC_R_SUCCESS);
 }

-#define grow_array(mctx, array, newlen, oldlen)                       \
-	if (newlen >= oldlen) {                                       \
-		size_t newsize = (newlen + 16) * sizeof(array[0]);    \
-		size_t oldsize = oldlen * sizeof(array[0]);           \
-		array = isc_mem_regetx(mctx, array, oldsize, newsize, \
-				       ISC_MEM_ZERO);                 \
-		oldlen = newlen + 16;                                 \
+#define grow_array(mctx, array, newlen, oldlen)                    \
+	if (newlen >= oldlen) {                                    \
+		size_t newsize = (newlen + 16) * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]);        \
+		void *tmp = isc_mem_get(mctx, newsize);            \
+		memset(tmp, 0, newsize);                           \
+		if (oldlen != 0) {                                 \
+			memmove(tmp, array, oldsize);              \
+			isc_mem_put(mctx, array, oldsize);         \
+		}                                                  \
+		array = tmp;                                       \
+		oldlen = newlen + 16;                              \
 	}

-#define shrink_array(mctx, array, newlen, oldlen)                     \
-	if (newlen < oldlen) {                                        \
-		size_t newsize = newlen * sizeof(array[0]);           \
-		size_t oldsize = oldlen * sizeof(array[0]);           \
-		array = isc_mem_regetx(mctx, array, oldsize, newsize, \
-				       ISC_MEM_ZERO);                 \
-		oldlen = newlen;                                      \
+#define shrink_array(mctx, array, newlen, oldlen)           \
+	if (newlen < oldlen) {                              \
+		void *tmp = NULL;                           \
+		size_t newsize = newlen * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]); \
+		if (newlen != 0) {                          \
+			tmp = isc_mem_get(mctx, newsize);   \
+			memset(tmp, 0, newsize);            \
+			memmove(tmp, array, newsize);       \
+		} else {                                    \
+			tmp = NULL;                         \
+		}                                           \
+		isc_mem_put(mctx, array, oldsize);          \
+		array = tmp;                                \
+		oldlen = newlen;                            \
 	}

 isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
 			     const cfg_obj_t *list, isc_mem_t *mctx,
 			     dns_ipkeylist_t *ipkl) {
-	uint32_t addrcount = 0, srccount = 0;
-	uint32_t keycount = 0, tlscount = 0;
-	uint32_t listcount = 0, l = 0, i = 0;
+	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, tlscount = 0,
+		 i = 0;
+	uint32_t listcount = 0, l = 0, j;
 	uint32_t stackcount = 0, pushed = 0;
 	isc_result_t result;
 	const cfg_listelt_t *element;
 	const cfg_obj_t *addrlist;
 	const cfg_obj_t *portobj;
-	const cfg_obj_t *src4obj;
-	const cfg_obj_t *src6obj;
+	const cfg_obj_t *dscpobj;
 	in_port_t port = (in_port_t)0;
 	in_port_t def_port;
 	in_port_t def_tlsport;
-	isc_sockaddr_t src4;
-	isc_sockaddr_t src6;
+	isc_dscp_t dscp = -1;
 	isc_sockaddr_t *addrs = NULL;
-	isc_sockaddr_t *sources = NULL;
+	isc_dscp_t *dscps = NULL;
 	dns_name_t **keys = NULL;
 	dns_name_t **tlss = NULL;
 	struct {
 		const char *name;
-		in_port_t port;
-		isc_sockaddr_t *src4s;
-		isc_sockaddr_t *src6s;
 	} *lists = NULL;
 	struct {
 		const cfg_listelt_t *element;
 		in_port_t port;
-		isc_sockaddr_t src4;
-		isc_sockaddr_t src6;
+		isc_dscp_t dscp;
 	} *stack = NULL;

 	REQUIRE(ipkl != NULL);
@@ -635,6 +747,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
 	REQUIRE(ipkl->addrs == NULL);
 	REQUIRE(ipkl->keys == NULL);
 	REQUIRE(ipkl->tlss == NULL);
+	REQUIRE(ipkl->dscps == NULL);
 	REQUIRE(ipkl->labels == NULL);
 	REQUIRE(ipkl->allocated == 0);

@@ -651,11 +764,15 @@ named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
 		goto cleanup;
 	}

+	result = named_config_getdscp(config, &dscp);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
 newlist:
 	addrlist = cfg_tuple_get(list, "addresses");
 	portobj = cfg_tuple_get(list, "port");
-	src4obj = cfg_tuple_get(list, "source");
-	src6obj = cfg_tuple_get(list, "source-v6");
+	dscpobj = cfg_tuple_get(list, "dscp");

 	if (cfg_obj_isuint32(portobj)) {
 		uint32_t val = cfg_obj_asuint32(portobj);
@@ -668,16 +785,15 @@ newlist:
 		port = (in_port_t)val;
 	}

-	if (src4obj != NULL && cfg_obj_issockaddr(src4obj)) {
-		src4 = *cfg_obj_assockaddr(src4obj);
-	} else {
-		isc_sockaddr_any(&src4);
-	}
-
-	if (src6obj != NULL && cfg_obj_issockaddr(src6obj)) {
-		src6 = *cfg_obj_assockaddr(src6obj);
-	} else {
-		isc_sockaddr_any6(&src6);
+	if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
+		if (cfg_obj_asuint32(dscpobj) > 63) {
+			cfg_obj_log(dscpobj, named_g_lctx, ISC_LOG_ERROR,
+				    "dscp value '%u' is out of range",
+				    cfg_obj_asuint32(dscpobj));
+			result = ISC_R_RANGE;
+			goto cleanup;
+		}
+		dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
 	}

 	result = ISC_R_NOMEMORY;
@@ -697,7 +813,6 @@ resume:
 		if (!cfg_obj_issockaddr(addr)) {
 			const char *listname = cfg_obj_asstring(addr);
 			isc_result_t tresult;
-			uint32_t j;

 			/* Grow lists? */
 			grow_array(mctx, lists, l, listcount);
@@ -734,18 +849,21 @@ resume:
 			 */
 			stack[pushed].element = cfg_list_next(element);
 			stack[pushed].port = port;
-			stack[pushed].src4 = src4;
-			stack[pushed].src6 = src6;
+			stack[pushed].dscp = dscp;
 			pushed++;
 			goto newlist;
 		}

 		grow_array(mctx, addrs, i, addrcount);
+		grow_array(mctx, dscps, i, dscpcount);
 		grow_array(mctx, keys, i, keycount);
 		grow_array(mctx, tlss, i, tlscount);
-		grow_array(mctx, sources, i, srccount);

 		addrs[i] = *cfg_obj_assockaddr(addr);
+		dscps[i] = cfg_obj_getdscp(addr);
+		if (dscps[i] == -1) {
+			dscps[i] = dscp;
+		}

 		result = named_config_getname(mctx, key, &keys[i]);
 		if (result != ISC_R_SUCCESS) {
@@ -761,51 +879,32 @@ resume:
 			goto cleanup;
 		}

-		/* If the port is unset, take it from one of the upper levels */
-		if (isc_sockaddr_getport(&addrs[i]) == 0) {
-			in_port_t addr_port = port;
-
-			/* If unset, use the default port or tls-port */
-			if (addr_port == 0) {
-				if (tlss[i] != NULL) {
-					addr_port = def_tlsport;
-				} else {
-					addr_port = def_port;
-				}
+		/* Set the default port or tls-port */
+		if (port == 0) {
+			if (tlss[i] != NULL) {
+				port = def_tlsport;
+			} else {
+				port = def_port;
 			}
-
-			isc_sockaddr_setport(&addrs[i], addr_port);
 		}

-		switch (isc_sockaddr_pf(&addrs[i])) {
-		case PF_INET:
-			sources[i] = src4;
-			break;
-		case PF_INET6:
-			sources[i] = src6;
-			break;
-		default:
-			i++; /* Increment here so that cleanup on error works.
-			      */
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			isc_sockaddr_setport(&addrs[i], port);
 		}
-
 		i++;
 	}
 	if (pushed != 0) {
 		pushed--;
 		element = stack[pushed].element;
 		port = stack[pushed].port;
-		src4 = stack[pushed].src4;
-		src6 = stack[pushed].src6;
+		dscp = stack[pushed].dscp;
 		goto resume;
 	}

 	shrink_array(mctx, addrs, i, addrcount);
+	shrink_array(mctx, dscps, i, dscpcount);
 	shrink_array(mctx, keys, i, keycount);
 	shrink_array(mctx, tlss, i, tlscount);
-	shrink_array(mctx, sources, i, srccount);

 	if (lists != NULL) {
 		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
@@ -814,14 +913,15 @@ resume:
 		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
 	}

+	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
 	INSIST(tlscount == addrcount);
-	INSIST(srccount == addrcount);
+	INSIST(keycount == dscpcount);

 	ipkl->addrs = addrs;
+	ipkl->dscps = dscps;
 	ipkl->keys = keys;
 	ipkl->tlss = tlss;
-	ipkl->sources = sources;
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;

@@ -831,8 +931,11 @@ cleanup:
 	if (addrs != NULL) {
 		isc_mem_put(mctx, addrs, addrcount * sizeof(addrs[0]));
 	}
+	if (dscps != NULL) {
+		isc_mem_put(mctx, dscps, dscpcount * sizeof(dscps[0]));
+	}
 	if (keys != NULL) {
-		for (size_t j = 0; j < i; j++) {
+		for (j = 0; j < i; j++) {
 			if (keys[j] == NULL) {
 				continue;
 			}
@@ -844,7 +947,7 @@ cleanup:
 		isc_mem_put(mctx, keys, keycount * sizeof(keys[0]));
 	}
 	if (tlss != NULL) {
-		for (size_t j = 0; j < i; j++) {
+		for (j = 0; j < i; j++) {
 			if (tlss[j] == NULL) {
 				continue;
 			}
@@ -855,9 +958,6 @@ cleanup:
 		}
 		isc_mem_put(mctx, tlss, tlscount * sizeof(tlss[0]));
 	}
-	if (sources != NULL) {
-		isc_mem_put(mctx, sources, srccount * sizeof(sources[0]));
-	}
 	if (lists != NULL) {
 		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
 	}
@@ -896,6 +996,32 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	return (ISC_R_SUCCESS);
 }

+isc_result_t
+named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp) {
+	const cfg_obj_t *options = NULL;
+	const cfg_obj_t *dscpobj = NULL;
+	isc_result_t result;
+
+	(void)cfg_map_get(config, "options", &options);
+	if (options == NULL) {
+		return (ISC_R_SUCCESS);
+	}
+
+	result = cfg_map_get(options, "dscp", &dscpobj);
+	if (result != ISC_R_SUCCESS || dscpobj == NULL) {
+		*dscpp = -1;
+		return (ISC_R_SUCCESS);
+	}
+	if (cfg_obj_asuint32(dscpobj) >= 64) {
+		cfg_obj_log(dscpobj, named_g_lctx, ISC_LOG_ERROR,
+			    "dscp '%u' out of range",
+			    cfg_obj_asuint32(dscpobj));
+		return (ISC_R_RANGE);
+	}
+	*dscpp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
+	return (ISC_R_SUCCESS);
+}
+
 struct keyalgorithms {
 	const char *str;
 	enum {
@@ -97,7 +97,10 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		return (result);
 	}

-	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
+	result = isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}

 	isc_buffer_init(&src, cmdline, strlen(cmdline));
 	isc_buffer_add(&src, strlen(cmdline));
@@ -469,8 +469,7 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {

 	if (isccc_cc_lookupuint32(conn->ctrl, "_tim", &sent) == ISC_R_SUCCESS) {
 		if ((sent + CLOCKSKEW) < conn->now ||
-		    (sent - CLOCKSKEW) > conn->now)
-		{
+		    (sent - CLOCKSKEW) > conn->now) {
 			log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
 			goto cleanup;
 		}
@@ -917,8 +916,7 @@ get_key_info(const cfg_obj_t *config, const cfg_obj_t *control,
 	control_keylist = cfg_tuple_get(control, "keys");

 	if (!cfg_obj_isvoid(control_keylist) &&
-	    cfg_list_first(control_keylist) != NULL)
-	{
+	    cfg_list_first(control_keylist) != NULL) {
 		result = cfg_map_get(config, "key", &global_keylist);

 		if (result == ISC_R_SUCCESS) {
@@ -225,11 +225,12 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],

 	isc_mem_create(&mctx);
 	cd = isc_mem_get(mctx, sizeof(*cd));
-	*cd = (dlopen_data_t){
-		.mctx = mctx,
-		.dl_path = isc_mem_strdup(mctx, argv[1]),
-		.dlzname = isc_mem_strdup(mctx, dlzname),
-	};
+	memset(cd, 0, sizeof(*cd));
+
+	cd->mctx = mctx;
+
+	cd->dl_path = isc_mem_strdup(cd->mctx, argv[1]);
+	cd->dlzname = isc_mem_strdup(cd->mctx, dlzname);

 	/* Initialize the lock */
 	isc_mutex_init(&cd->lock);
@@ -531,7 +532,8 @@ dlz_dlopen_init(isc_mem_t *mctx) {
 				  mctx, &dlz_dlopen);

 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR("dns_sdlzregister() failed: %s",
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "dns_sdlzregister() failed: %s",
 				 isc_result_totext(result));
 		result = ISC_R_UNEXPECTED;
 	}
@@ -52,6 +52,16 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 dns_zonetype_t
 named_config_getzonetype(const cfg_obj_t *zonetypeobj);

+isc_result_t
+named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
+		       in_port_t defport, isc_mem_t *mctx,
+		       isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
+		       uint32_t *countp);
+
+void
+named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
+		       isc_dscp_t **dscpsp, uint32_t count);
+
 isc_result_t
 named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			   const char *name, const cfg_obj_t **ret);
@@ -71,3 +81,6 @@ named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
 isc_result_t
 named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
 			      unsigned int *typep, uint16_t *digestbits);
+
+isc_result_t
+named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp);
@@ -77,6 +77,7 @@ EXTERN in_port_t named_g_port	       INIT(0);
 EXTERN in_port_t named_g_tlsport       INIT(0);
 EXTERN in_port_t named_g_httpsport     INIT(0);
 EXTERN in_port_t named_g_httpport      INIT(0);
+EXTERN isc_dscp_t named_g_dscp	       INIT(-1);

 EXTERN in_port_t named_g_http_listener_clients INIT(0);
 EXTERN in_port_t named_g_http_streams_per_conn INIT(0);
@@ -105,6 +106,14 @@ EXTERN dns_name_t			    named_g_sessionkeyname;
 EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);

+/*
+ * Initial resource limits.
+ */
+EXTERN isc_resourcevalue_t named_g_initstacksize INIT(0);
+EXTERN isc_resourcevalue_t named_g_initdatasize	 INIT(0);
+EXTERN isc_resourcevalue_t named_g_initcoresize	 INIT(0);
+EXTERN isc_resourcevalue_t named_g_initopenfiles INIT(0);
+
 /*
 * Misc.
 */
@@ -308,6 +308,12 @@ named_server_rekey(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 isc_result_t
 named_server_dumprecursing(named_server_t *server);

+/*%
+ * Maintain a list of dispatches that require reserved ports.
+ */
+void
+named_add_reserved_dispatch(named_server_t *server, const isc_sockaddr_t *addr);
+
 /*%
 * Enable or disable dnssec validation.
 */
@@ -60,7 +60,6 @@ named_log_init(bool safe) {
 	 * Setup a logging context.
 	 */
 	isc_mem_create(&log_mctx);
-	isc_mem_setname(log_mctx, "named_log");
 	isc_log_create(log_mctx, &named_g_lctx, &lcfg);
 	isc_mem_detach(&log_mctx);

@@ -202,8 +201,7 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 	isc_result_t result;

 	if (sslkeylogfile_path == NULL ||
-	    strcmp(sslkeylogfile_path, "config") == 0)
-	{
+	    strcmp(sslkeylogfile_path, "config") == 0) {
 		return;
 	}

@@ -35,6 +35,7 @@
 #include <isc/netmgr.h>
 #include <isc/os.h>
 #include <isc/print.h>
+#include <isc/resource.h>
 #include <isc/result.h>
 #include <isc/signal.h>
 #include <isc/stdio.h>
@@ -43,7 +44,6 @@
 #include <isc/timer.h>
 #include <isc/util.h>
 #include <isc/uv.h>
-#include <isc/xml.h>

 #include <dns/dispatch.h>
 #include <dns/dyndb.h>
@@ -110,6 +110,7 @@
 #define BACKTRACE_MAXFRAME 128
 #endif /* ifndef BACKTRACE_MAXFRAME */

+extern int isc_dscp_check_value;
 extern unsigned int dns_zone_mkey_hour;
 extern unsigned int dns_zone_mkey_day;
 extern unsigned int dns_zone_mkey_month;
@@ -239,12 +240,12 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 }

 noreturn static void
-library_fatal_error(const char *file, int line, const char *func,
-		    const char *format, va_list args) ISC_FORMAT_PRINTF(3, 0);
+library_fatal_error(const char *file, int line, const char *format,
+		    va_list args) ISC_FORMAT_PRINTF(3, 0);

 static void
-library_fatal_error(const char *file, int line, const char *func,
-		    const char *format, va_list args) {
+library_fatal_error(const char *file, int line, const char *format,
+		    va_list args) {
 	/*
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */
@@ -258,7 +259,7 @@ library_fatal_error(const char *file, int line, const char *func,

 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
-			      "%s:%d:%s(): fatal error: ", file, line, func);
+			      "%s:%d: fatal error:", file, line);
 		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
 			       args);
@@ -266,7 +267,7 @@ library_fatal_error(const char *file, int line, const char *func,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "exiting (due to fatal error in library)");
 	} else {
-		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		fprintf(stderr, "%s:%d: fatal error: ", file, line);
 		vfprintf(stderr, format, args);
 		fprintf(stderr, "\n");
 		fflush(stderr);
@@ -279,13 +280,12 @@ library_fatal_error(const char *file, int line, const char *func,
 }

 static void
-library_unexpected_error(const char *file, int line, const char *func,
-			 const char *format, va_list args)
-	ISC_FORMAT_PRINTF(3, 0);
+library_unexpected_error(const char *file, int line, const char *format,
+			 va_list args) ISC_FORMAT_PRINTF(3, 0);

 static void
-library_unexpected_error(const char *file, int line, const char *func,
-			 const char *format, va_list args) {
+library_unexpected_error(const char *file, int line, const char *format,
+			 va_list args) {
 	/*
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */
@@ -293,13 +293,12 @@ library_unexpected_error(const char *file, int line, const char *func,
 	if (named_g_lctx != NULL) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR,
-			      "%s:%d:%s(): unexpected error: ", file, line,
-			      func);
+			      "%s:%d: unexpected error:", file, line);
 		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			       NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR, format,
 			       args);
 	} else {
-		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		fprintf(stderr, "%s:%d: fatal error: ", file, line);
 		vfprintf(stderr, format, args);
 		fprintf(stderr, "\n");
 		fflush(stderr);
@@ -438,8 +437,7 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 		arglen = (int)(end - arg);
 		for (def = defs; def->name != NULL; def++) {
 			if (arglen == (int)strlen(def->name) &&
-			    memcmp(arg, def->name, arglen) == 0)
-			{
+			    memcmp(arg, def->name, arglen) == 0) {
 				if (def->value == 0) {
 					clear = true;
 				}
@@ -464,106 +462,11 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 	}
 }

-static void
-list_dnssec_algorithms(isc_buffer_t *b) {
-	for (dst_algorithm_t i = DST_ALG_UNKNOWN; i < DST_MAX_ALGS; i++) {
-		if (i == DST_ALG_DH || i == DST_ALG_GSSAPI ||
-		    (i >= DST_ALG_HMAC_FIRST && i <= DST_ALG_HMAC_LAST))
-		{
-			continue;
-		}
-		if (dst_algorithm_supported(i)) {
-			isc_buffer_putstr(b, " ");
-			(void)dns_secalg_totext(i, b);
-		}
-	}
-}
-
-static void
-list_ds_algorithms(isc_buffer_t *b) {
-	for (size_t i = 0; i < 256; i++) {
-		if (dst_ds_digest_supported(i)) {
-			isc_buffer_putstr(b, " ");
-			(void)dns_dsdigest_totext(i, b);
-		}
-	}
-}
-
-static void
-list_hmac_algorithms(isc_buffer_t *b) {
-	isc_buffer_t sb = *b;
-	for (dst_algorithm_t i = DST_ALG_HMAC_FIRST; i <= DST_ALG_HMAC_LAST;
-	     i++)
-	{
-		if (dst_algorithm_supported(i)) {
-			isc_buffer_putstr(b, " ");
-			isc_buffer_putstr(b, dst_hmac_algorithm_totext(i));
-		}
-	}
-	for (unsigned char *s = isc_buffer_used(&sb); s != isc_buffer_used(b);
-	     s++)
-	{
-		*s = toupper(*s);
-	}
-}
-
-static void
-logit(isc_buffer_t *b) {
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "%.*s",
-		      (int)isc_buffer_usedlength(b),
-		      (char *)isc_buffer_base(b));
-}
-
-static void
-printit(isc_buffer_t *b) {
-	printf("%.*s\n", (int)isc_buffer_usedlength(b),
-	       (char *)isc_buffer_base(b));
-}
-
-static void
-format_supported_algorithms(void (*emit)(isc_buffer_t *b)) {
-	isc_buffer_t b;
-	char buf[512];
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_putstr(&b, "DNSSEC algorithms:");
-	list_dnssec_algorithms(&b);
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_putstr(&b, "DS algorithms:");
-	list_ds_algorithms(&b);
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_putstr(&b, "HMAC algorithms:");
-	list_hmac_algorithms(&b);
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_printf(&b, "TKEY mode 2 support (Diffie-Hellman): %s",
-			  (dst_algorithm_supported(DST_ALG_DH) &&
-			   dst_algorithm_supported(DST_ALG_HMACMD5))
-				  ? "yes"
-				  : "non");
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_printf(&b, "TKEY mode 3 support (GSS-API): %s",
-			  dst_algorithm_supported(DST_ALG_GSSAPI) ? "yes"
-								  : "no");
-	(*emit)(&b);
-}
-
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
-	isc_mem_t *mctx = NULL;
-	isc_result_t result;
-	isc_buffer_t b;
-	char buf[512];
 #if defined(HAVE_GEOIP2)
+	isc_mem_t *mctx = NULL;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *config = NULL;
 	const cfg_obj_t *defaults = NULL, *obj = NULL;
@@ -635,19 +538,7 @@ printversion(bool verbose) {
 	printf("compiled with protobuf-c version: %s\n", PROTOBUF_C_VERSION);
 	printf("linked to protobuf-c version: %s\n", protobuf_c_version());
 #endif /* if defined(HAVE_DNSTAP) */
-	printf("threads support is enabled\n");
-
-	isc_mem_create(&mctx);
-	result = dst_lib_init(mctx, named_g_engine);
-	if (result == ISC_R_SUCCESS) {
-		isc_buffer_init(&b, buf, sizeof(buf));
-		format_supported_algorithms(printit);
-		printf("\n");
-		dst_lib_destroy();
-	} else {
-		printf("DST initialization failure: %s\n",
-		       isc_result_totext(result));
-	}
+	printf("threads support is enabled\n\n");

 	/*
 	 * The default rndc.conf and rndc.key paths are in the same
@@ -673,6 +564,7 @@ printversion(bool verbose) {
 	printf("  named lock file:      %s\n", named_g_defaultlockfile);
 #if defined(HAVE_GEOIP2)
 #define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
+	isc_mem_create(&mctx);
 	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
 	RTC(named_config_parsedefaults(parser, &config));
 	RTC(cfg_map_get(config, "options", &defaults));
@@ -716,9 +608,13 @@ parse_T_opt(char *option) {
 	/*
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
+	 * dscp=x:     check that dscp values are as
+	 * 	       expected and assert otherwise.
 	 */
 	if (!strcmp(option, "dropedns")) {
 		dropedns = true;
+	} else if (!strncmp(option, "dscp=", 5)) {
+		isc_dscp_check_value = atoi(option + 5);
 	} else if (!strcmp(option, "ednsformerr")) {
 		ednsformerr = true;
 	} else if (!strcmp(option, "ednsnotimp")) {
@@ -1038,6 +934,7 @@ create_managers(void) {
 static void
 setup(void) {
 	isc_result_t result;
+	isc_resourcevalue_t old_openfiles;
 	ns_server_t *sctx;
 #ifdef HAVE_LIBSCF
 	char *instance = NULL;
@@ -1210,11 +1107,39 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");

+	/*
+	 * Get the initial resource limits.
+	 */
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_stacksize,
+					    &named_g_initstacksize) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_datasize,
+					    &named_g_initdatasize) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_coresize,
+					    &named_g_initcoresize) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles) ==
+		      ISC_R_SUCCESS);
+
 	/*
 	 * System resources cannot effectively be tuned on some systems.
 	 * Raise the limit in such cases for safety.
 	 */
+	old_openfiles = named_g_initopenfiles;
 	named_os_adjustnofile();
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles) ==
+		      ISC_R_SUCCESS);
+	if (old_openfiles != named_g_initopenfiles) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+			      "adjusted limit on open files from "
+			      "%" PRIu64 " to "
+			      "%" PRIu64,
+			      old_openfiles, named_g_initopenfiles);
+	}

 	/*
 	 * If the named configuration filename is relative, prepend the current
@@ -1268,12 +1193,6 @@ setup(void) {
 	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;

-	/*
-	 * Report supported algorithms now that dst_lib_init() has
-	 * been called via named_server_create().
-	 */
-	format_supported_algorithms(logit);
-
 	/*
 	 * Modify server context according to command line options
 	 */
@@ -1377,7 +1296,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {

 	if ((h = scf_handle_create(SCF_VERSION)) == NULL) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_handle_create() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_handle_create() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		return (ISC_R_FAILURE);
@@ -1385,7 +1305,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {

 	if (scf_handle_bind(h) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_handle_bind() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_handle_bind() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1394,7 +1315,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {

 	if ((namelen = scf_myname(h, NULL, 0)) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_myname() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_myname() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1402,7 +1324,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 	}

 	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
-		UNEXPECTED_ERROR("named_smf_get_instance memory "
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "named_smf_get_instance memory "
 				 "allocation failed: %s",
 				 isc_result_totext(ISC_R_NOMEMORY));
 		scf_handle_destroy(h);
@@ -1411,7 +1334,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {

 	if (scf_myname(h, instance, namelen + 1) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_myname() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_myname() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1438,6 +1362,10 @@ main(int argc, char *argv[]) {
 	(void)ProfilerStart(NULL);
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */

+#ifdef HAVE_LIBXML2
+	xmlInitParser();
+#endif /* HAVE_LIBXML2 */
+
 	/*
 	 * Technically, this call is superfluous because on startup of the main
 	 * program, the portable "C" locale is selected by default.  This
@@ -1504,7 +1432,6 @@ main(int argc, char *argv[]) {

 	setup();
 	isc_mem_setname(named_g_mctx, "main");
-	INSIST(named_g_server != NULL);

 	/*
 	 * Start things running
@@ -1518,7 +1445,8 @@ main(int argc, char *argv[]) {
 		result = named_smf_get_instance(&instance, 1, named_g_mctx);
 		if (result == ISC_R_SUCCESS && instance != NULL) {
 			if (smf_disable_instance(instance, 0) != 0) {
-				UNEXPECTED_ERROR("smf_disable_instance() "
+				UNEXPECTED_ERROR(__FILE__, __LINE__,
+						 "smf_disable_instance() "
 						 "failed for %s : %s",
 						 instance,
 						 scf_strerror(scf_error()));
@@ -1547,13 +1475,6 @@ main(int argc, char *argv[]) {

 	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr,
 			     &named_g_taskmgr);
-
-#if ENABLE_LEAK_DETECTION
-	isc__tls_setdestroycheck(true);
-	isc__uv_setdestroycheck(true);
-	isc__xml_setdestroycheck(true);
-#endif
-
 	isc_mem_checkdestroyed(stderr);

 	named_main_setmemstats(NULL);
@@ -1562,6 +1483,10 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

+#ifdef HAVE_LIBXML2
+	xmlCleanupParser();
+#endif /* HAVE_LIBXML2 */
+
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */
@@ -203,8 +203,7 @@ Options

 .. option:: -V

-   This option reports the version number, build options, supported
-   cryptographics algorithms, and exits.
+   This option reports the version number and build options, and exits.

 .. option:: -X lock-file

@@ -14,7 +14,6 @@
 /*! \file */
 #include <stdarg.h>
 #include <stdbool.h>
-#include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/types.h> /* dev_t FreeBSD 2.1 */
 #ifdef HAVE_UNAME
@@ -38,13 +37,13 @@
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/print.h>
+#include <isc/resource.h>
 #include <isc/result.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
 #include <isc/util.h>

 #include <named/globals.h>
-#include <named/log.h>
 #include <named/main.h>
 #include <named/os.h>
 #ifdef HAVE_LIBSCF
@@ -64,7 +63,7 @@ static struct passwd *runas_pw = NULL;
 static bool done_setuid = false;
 static int dfd[2] = { -1, -1 };

-#if HAVE_LIBCAP
+#ifdef HAVE_SYS_CAPABILITY_H

 static bool non_root = false;
 static bool non_root_caps = false;
@@ -250,137 +249,7 @@ linux_keepcaps(void) {
 	}
 }

-#endif /* HAVE_LIBCAP */
-
-/*
- * First define compatibility shims if {set,get}res{uid,gid} are not available
- */
-
-#if !HAVE_GETRESGID
-static int
-getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid) {
-	*rgid = -1;
-	*egid = getegid();
-	*sgid = -1;
-
-	return (0);
-}
-#endif /* !HAVE_GETRESGID */
-
-#if !HAVE_SETRESGID
-static int
-setresgid(gid_t rgid, gid_t egid, gid_t sgid) {
-	REQUIRE(rgid == (gid_t)-1);
-	REQUIRE(sgid == (gid_t)-1);
-
-#if HAVE_SETREGID
-	return (setregid(rgid, egid));
-#else  /* HAVE_SETREGID */
-	return (setegid(egid));
-#endif /* HAVE_SETREGID */
-}
-#endif /* !HAVE_SETRESGID */
-
-#if !HAVE_GETRESUID
-static int
-getresuid(uid_t *ruid, uid_t *euid, uid_t *suid) {
-	*ruid = -1;
-	*euid = geteuid();
-	*suid = -1;
-
-	return (0);
-}
-#endif /* !HAVE_GETRESUID */
-
-#if !HAVE_SETRESUID
-static int
-setresuid(uid_t ruid, uid_t euid, uid_t suid) {
-	REQUIRE(ruid == (uid_t)-1);
-	REQUIRE(suid == (uid_t)-1);
-
-#if HAVE_SETREGID
-	return (setregid(ruid, euid));
-#else  /* HAVE_SETREGID */
-	return (setegid(euid));
-#endif /* HAVE_SETREGID */
-}
-#endif /* !HAVE_SETRESUID */
-
-static int
-set_effective_gid(gid_t gid) {
-	gid_t oldgid;
-
-	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (oldgid == gid) {
-		return (0);
-	}
-
-	if (setresgid(-1, gid, -1) == -1) {
-		return (-1);
-	}
-
-	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (oldgid != gid) {
-		return (-1);
-	}
-
-	return (0);
-}
-
-static int
-set_effective_uid(uid_t uid) {
-	uid_t olduid;
-
-	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (olduid == uid) {
-		return (0);
-	}
-
-	if (setresuid(-1, uid, -1) == -1) {
-		return (-1);
-	}
-
-	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (olduid != uid) {
-		return (-1);
-	}
-
-	/* Success */
-	return (0);
-}
-
-static void
-setperms(uid_t uid, gid_t gid) {
-	char strbuf[ISC_STRERRORSIZE];
-
-	/*
-	 * Drop the gid privilege first, because in some cases the gid privilege
-	 * cannot be dropped after the uid privilege has been dropped.
-	 */
-	if (set_effective_gid(gid) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		named_main_earlywarning("unable to set effective gid to %d: %s",
-					gid, strbuf);
-	}
-
-	if (set_effective_uid(uid) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		named_main_earlywarning("unable to set effective uid to %d: %s",
-					uid, strbuf);
-	}
-}
+#endif /* HAVE_SYS_CAPABILITY_H */

 static void
 setup_syslog(const char *progname) {
@@ -396,9 +265,9 @@ setup_syslog(const char *progname) {
 void
 named_os_init(const char *progname) {
 	setup_syslog(progname);
-#if HAVE_LIBCAP
+#ifdef HAVE_SYS_CAPABILITY_H
 	linux_initialprivs();
-#endif /* HAVE_LIBCAP */
+#endif /* ifdef HAVE_SYS_CAPABILITY_H */
 #ifdef SIGXFSZ
 	signal(SIGXFSZ, SIG_IGN);
 #endif /* ifdef SIGXFSZ */
@@ -591,7 +460,7 @@ named_os_changeuser(void) {
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}

-#if HAVE_LIBCAP
+#if defined(HAVE_SYS_CAPABILITY_H)
 	/*
 	 * Restore the ability of named to drop core after the setuid()
 	 * call has disabled it.
@@ -603,7 +472,7 @@ named_os_changeuser(void) {
 	}

 	linux_minprivs();
-#endif /* HAVE_LIBCAP */
+#endif /* if defined(HAVE_SYS_CAPABILITY_H) */
 }

 uid_t
@@ -616,56 +485,30 @@ ns_os_uid(void) {

 void
 named_os_adjustnofile(void) {
-	int r;
-	struct rlimit rl;
-	rlim_t rlim_old;
-	char strbuf[ISC_STRERRORSIZE];
+#if defined(__linux__)
+	isc_result_t result;
+	isc_resourcevalue_t newvalue;

-	r = getrlimit(RLIMIT_NOFILE, &rl);
-	if (r != 0) {
-		goto fail;
+	/*
+	 * Linux: max number of open files specified by one thread doesn't seem
+	 * to apply to other threads on Linux.
+	 */
+	newvalue = ISC_RESOURCE_UNLIMITED;
+
+	result = isc_resource_setlimit(isc_resource_openfiles, newvalue);
+	if (result != ISC_R_SUCCESS) {
+		named_main_earlywarning("couldn't adjust limit on open files");
 	}
-
-	rlim_old = rl.rlim_cur;
-
-	if (rl.rlim_cur == rl.rlim_max) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-			      "the limit on open files is already at the "
-			      "maximum allowed value: "
-			      "%" PRIu64,
-			      (uint64_t)rl.rlim_max);
-		return;
-	}
-
-	rl.rlim_cur = rl.rlim_max;
-	r = setrlimit(RLIMIT_NOFILE, &rl);
-	if (r != 0) {
-		goto fail;
-	}
-
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "adjusted limit on open files from "
-		      "%" PRIu64 " to "
-		      "%" PRIu64,
-		      (uint64_t)rlim_old, (uint64_t)rl.rlim_cur);
-	return;
-
-fail:
-	strerror_r(errno, strbuf, sizeof(strbuf));
-	named_main_earlywarning("adjusting limit on open files failed: %s",
-				strbuf);
-	return;
+#endif /* if defined(__linux__) */
 }

 void
 named_os_minprivs(void) {
-#if HAVE_LIBCAP
+#if defined(HAVE_SYS_CAPABILITY_H)
 	linux_keepcaps();
 	named_os_changeuser();
 	linux_minprivs();
-#endif /* HAVE_LIBCAP */
+#endif /* if defined(HAVE_SYS_CAPABILITY_H) */
 }

 static int
@@ -785,6 +628,56 @@ error:
 	return (-1);
 }

+#if !HAVE_SYS_CAPABILITY_H
+static void
+setperms(uid_t uid, gid_t gid) {
+#if defined(HAVE_SETEGID) || defined(HAVE_SETRESGID)
+	char strbuf[ISC_STRERRORSIZE];
+#endif /* if defined(HAVE_SETEGID) || defined(HAVE_SETRESGID) */
+#if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID)
+	gid_t oldgid, tmpg;
+#endif /* if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID) */
+#if !defined(HAVE_SETEUID) && defined(HAVE_SETRESUID)
+	uid_t olduid, tmpu;
+#endif /* if !defined(HAVE_SETEUID) && defined(HAVE_SETRESUID) */
+#if defined(HAVE_SETEGID)
+	if (getegid() != gid && setegid(gid) == -1) {
+		strerror_r(errno, strbuf, sizeof(strbuf));
+		named_main_earlywarning("unable to set effective "
+					"gid to %ld: %s",
+					(long)gid, strbuf);
+	}
+#elif defined(HAVE_SETRESGID)
+	if (getresgid(&tmpg, &oldgid, &tmpg) == -1 || oldgid != gid) {
+		if (setresgid(-1, gid, -1) == -1) {
+			strerror_r(errno, strbuf, sizeof(strbuf));
+			named_main_earlywarning("unable to set effective "
+						"gid to %d: %s",
+						gid, strbuf);
+		}
+	}
+#endif /* if defined(HAVE_SETEGID) */
+
+#if defined(HAVE_SETEUID)
+	if (geteuid() != uid && seteuid(uid) == -1) {
+		strerror_r(errno, strbuf, sizeof(strbuf));
+		named_main_earlywarning("unable to set effective "
+					"uid to %ld: %s",
+					(long)uid, strbuf);
+	}
+#elif defined(HAVE_SETRESUID)
+	if (getresuid(&tmpu, &olduid, &tmpu) == -1 || olduid != uid) {
+		if (setresuid(-1, uid, -1) == -1) {
+			strerror_r(errno, strbuf, sizeof(strbuf));
+			named_main_earlywarning("unable to set effective "
+						"uid to %d: %s",
+						uid, strbuf);
+		}
+	}
+#endif /* if defined(HAVE_SETEUID) */
+}
+#endif /* !HAVE_SYS_CAPABILITY_H */
+
 FILE *
 named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	char strbuf[ISC_STRERRORSIZE], *f;
@@ -810,17 +703,19 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	if (switch_user && runas_pw != NULL) {
 		uid_t olduid = getuid();
 		gid_t oldgid = getgid();
-
-		/*
-		 * Set UID/GID to the one we'll be running with
-		 * eventually.
-		 */
+#if HAVE_SYS_CAPABILITY_H
+		REQUIRE(olduid == runas_pw->pw_uid);
+		REQUIRE(oldgid == runas_pw->pw_gid);
+#else /* HAVE_SYS_CAPABILITY_H */
+		/* Set UID/GID to the one we'll be running with eventually */
 		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
-
+#endif
 		fd = safe_open(filename, mode, false);

+#if !HAVE_SYS_CAPABILITY_H
 		/* Restore UID/GID to previous uid/gid */
 		setperms(olduid, oldgid);
+#endif

 		if (fd == -1) {
 			fd = safe_open(filename, mode, false);
@@ -56,11 +56,11 @@
 #include "xsl_p.h"

 #define STATS_XML_VERSION_MAJOR "3"
-#define STATS_XML_VERSION_MINOR "14"
+#define STATS_XML_VERSION_MINOR "12"
 #define STATS_XML_VERSION	STATS_XML_VERSION_MAJOR "." STATS_XML_VERSION_MINOR

 #define STATS_JSON_VERSION_MAJOR "1"
-#define STATS_JSON_VERSION_MINOR "8"
+#define STATS_JSON_VERSION_MINOR "6"
 #define STATS_JSON_VERSION	 STATS_JSON_VERSION_MAJOR "." STATS_JSON_VERSION_MINOR

 #define CHECK(m)                               \
@@ -352,7 +352,6 @@ init_desc(void) {
 	SET_NSSTATDESC(reclimitdropped,
 		       "queries dropped due to recursive client limit",
 		       "RecLimitDropped");
-	SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");

 	INSIST(i == ns_statscounter_max);

@@ -1465,8 +1464,7 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 #endif /* ifdef HAVE_JSON_C */

 	if ((DNS_RDATASTATSTYPE_ATTR(type) &
-	     DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) == 0)
-	{
+	     DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) == 0) {
 		dns_rdatatype_format(DNS_RDATASTATSTYPE_BASE(type), typebuf,
 				     sizeof(typebuf));
 		typestr = typebuf;
@@ -1538,8 +1536,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 #endif /* ifdef HAVE_JSON_C */

 	if ((DNS_RDATASTATSTYPE_ATTR(type) &
-	     DNS_RDATASTATSTYPE_ATTR_NXDOMAIN) != 0)
-	{
+	     DNS_RDATASTATSTYPE_ATTR_NXDOMAIN) != 0) {
 		typestr = "NXDOMAIN";
 	} else if ((DNS_RDATASTATSTYPE_ATTR(type) &
 		    DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) != 0)
@@ -1716,7 +1713,7 @@ cleanup:

 #if defined(EXTENDED_STATS)
 static void
-dnssecsignstat_dump(uint32_t kval, uint64_t val, void *arg) {
+dnssecsignstat_dump(dns_keytag_t tag, uint64_t val, void *arg) {
 	FILE *fp;
 	char tagbuf[64];
 	stats_dumparg_t *dumparg = arg;
@@ -1728,11 +1725,7 @@ dnssecsignstat_dump(uint32_t kval, uint64_t val, void *arg) {
 	json_object *zoneobj, *obj;
 #endif /* ifdef HAVE_JSON_C */

-	/*
-	 * kval is '(algorithm << 16) | keyid'.
-	 */
-	snprintf(tagbuf, sizeof(tagbuf), "%u+%u", (kval >> 16) & 0xff,
-		 kval & 0xffff);
+	snprintf(tagbuf, sizeof(tagbuf), "%u", tag);

 	switch (dumparg->type) {
 	case isc_statsformat_file:
@@ -2246,8 +2239,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	view = ISC_LIST_HEAD(server->viewlist);
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "views"));
 	while (view != NULL &&
-	       ((flags & (STATS_XML_SERVER | STATS_XML_ZONES)) != 0))
-	{
+	       ((flags & (STATS_XML_SERVER | STATS_XML_ZONES)) != 0)) {
 		isc_stats_t *istats = NULL;
 		dns_stats_t *dstats = NULL;

@@ -2258,8 +2250,8 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		if ((flags & STATS_XML_ZONES) != 0) {
 			TRY0(xmlTextWriterStartElement(writer,
 						       ISC_XMLCHAR "zones"));
-			CHECK(dns_zt_apply(view->zonetable, isc_rwlocktype_read,
-					   true, NULL, zone_xmlrender, writer));
+			CHECK(dns_zt_apply(view->zonetable, true, NULL,
+					   zone_xmlrender, writer));
 			TRY0(xmlTextWriterEndElement(writer)); /* /zones */
 		}

@@ -2380,14 +2372,20 @@ wrap_xmlfree(isc_buffer_t *buffer, void *arg) {
 }

 static isc_result_t
-render_xml(uint32_t flags, void *arg, unsigned int *retcode,
-	   const char **retmsg, const char **mimetype, isc_buffer_t *b,
-	   isc_httpdfree_t **freecb, void **freecb_args) {
+render_xml(uint32_t flags, const char *url, isc_httpdurl_t *urlinfo,
+	   const char *querystring, const char *headers, void *arg,
+	   unsigned int *retcode, const char **retmsg, const char **mimetype,
+	   isc_buffer_t *b, isc_httpdfree_t **freecb, void **freecb_args) {
 	unsigned char *msg = NULL;
 	int msglen;
 	named_server_t *server = arg;
 	isc_result_t result;

+	UNUSED(url);
+	UNUSED(urlinfo);
+	UNUSED(headers);
+	UNUSED(querystring);
+
 	result = generatexml(server, flags, &msglen, &msg);

 	if (result == ISC_R_SUCCESS) {
@@ -2408,91 +2406,91 @@ render_xml(uint32_t flags, void *arg, unsigned int *retcode,
 }

 static isc_result_t
-render_xml_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-	       void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_all(const char *url, isc_httpdurl_t *urlinfo,
+	       const char *querystring, const char *headers, void *arg,
+	       unsigned int *retcode, const char **retmsg,
 	       const char **mimetype, isc_buffer_t *b, isc_httpdfree_t **freecb,
 	       void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_ALL, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }

 static isc_result_t
-render_xml_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		  void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_status(const char *url, isc_httpdurl_t *urlinfo,
+		  const char *querystring, const char *headers, void *arg,
+		  unsigned int *retcode, const char **retmsg,
 		  const char **mimetype, isc_buffer_t *b,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_STATUS, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }

 static isc_result_t
-render_xml_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		  void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_server(const char *url, isc_httpdurl_t *urlinfo,
+		  const char *querystring, const char *headers, void *arg,
+		  unsigned int *retcode, const char **retmsg,
 		  const char **mimetype, isc_buffer_t *b,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_SERVER, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }

 static isc_result_t
-render_xml_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		 void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_zones(const char *url, isc_httpdurl_t *urlinfo,
+		 const char *querystring, const char *headers, void *arg,
+		 unsigned int *retcode, const char **retmsg,
 		 const char **mimetype, isc_buffer_t *b,
 		 isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_ZONES, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }

 static isc_result_t
-render_xml_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-	       void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_net(const char *url, isc_httpdurl_t *urlinfo,
+	       const char *querystring, const char *headers, void *arg,
+	       unsigned int *retcode, const char **retmsg,
 	       const char **mimetype, isc_buffer_t *b, isc_httpdfree_t **freecb,
 	       void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_NET, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }

 static isc_result_t
-render_xml_tasks(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		 void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_tasks(const char *url, isc_httpdurl_t *urlinfo,
+		 const char *querystring, const char *headers, void *arg,
+		 unsigned int *retcode, const char **retmsg,
 		 const char **mimetype, isc_buffer_t *b,
 		 isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_TASKS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_TASKS, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }

 static isc_result_t
-render_xml_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-	       void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_mem(const char *url, isc_httpdurl_t *urlinfo,
+	       const char *querystring, const char *headers, void *arg,
+	       unsigned int *retcode, const char **retmsg,
 	       const char **mimetype, isc_buffer_t *b, isc_httpdfree_t **freecb,
 	       void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_MEM, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }

 static isc_result_t
-render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		   void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_traffic(const char *url, isc_httpdurl_t *urlinfo,
+		   const char *querystring, const char *headers, void *arg,
+		   unsigned int *retcode, const char **retmsg,
 		   const char **mimetype, isc_buffer_t *b,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_TRAFFIC, url, urlinfo, querystring,
+			   headers, arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }

 #endif /* HAVE_LIBXML2 */
@@ -2733,8 +2731,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 			}

 			if (json_object_get_object(refresh_counters)->count !=
-			    0)
-			{
+			    0) {
 				json_object_object_add(zoneobj,
 						       "dnssec-refresh",
 						       refresh_counters);
@@ -2990,9 +2987,8 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 			CHECKMEM(za);

 			if ((flags & STATS_JSON_ZONES) != 0) {
-				CHECK(dns_zt_apply(view->zonetable,
-						   isc_rwlocktype_read, true,
-						   NULL, zone_jsonrender, za));
+				CHECK(dns_zt_apply(view->zonetable, true, NULL,
+						   zone_jsonrender, za));
 			}

 			if (json_object_array_length(za) != 0) {
@@ -3320,9 +3316,10 @@ cleanup:
 }

 static isc_result_t
-render_json(uint32_t flags, void *arg, unsigned int *retcode,
-	    const char **retmsg, const char **mimetype, isc_buffer_t *b,
-	    isc_httpdfree_t **freecb, void **freecb_args) {
+render_json(uint32_t flags, const char *url, isc_httpdurl_t *urlinfo,
+	    const char *querystring, const char *headers, void *arg,
+	    unsigned int *retcode, const char **retmsg, const char **mimetype,
+	    isc_buffer_t *b, isc_httpdfree_t **freecb, void **freecb_args) {
 	isc_result_t result;
 	json_object *bindstats = NULL;
 	named_server_t *server = arg;
@@ -3330,6 +3327,11 @@ render_json(uint32_t flags, void *arg, unsigned int *retcode,
 	size_t msglen = 0;
 	char *p;

+	UNUSED(url);
+	UNUSED(urlinfo);
+	UNUSED(headers);
+	UNUSED(querystring);
+
 	result = generatejson(server, &msglen, &msg, &bindstats, flags);
 	if (result == ISC_R_SUCCESS) {
 		*retcode = 200;
@@ -3350,139 +3352,156 @@ render_json(uint32_t flags, void *arg, unsigned int *retcode,
 }

 static isc_result_t
-render_json_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		void *arg, unsigned int *retcode, const char **retmsg,
+render_json_all(const char *url, isc_httpdurl_t *urlinfo,
+		const char *querystring, const char *headers, void *arg,
+		unsigned int *retcode, const char **retmsg,
 		const char **mimetype, isc_buffer_t *b,
 		isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return (render_json(STATS_JSON_ALL, url, urlinfo, querystring, headers,
+			    arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }

 static isc_result_t
-render_json_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		   void *arg, unsigned int *retcode, const char **retmsg,
+render_json_status(const char *url, isc_httpdurl_t *urlinfo,
+		   const char *querystring, const char *headers, void *arg,
+		   unsigned int *retcode, const char **retmsg,
 		   const char **mimetype, isc_buffer_t *b,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return (render_json(STATS_JSON_STATUS, url, urlinfo, querystring,
+			    headers, arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }

 static isc_result_t
-render_json_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		   void *arg, unsigned int *retcode, const char **retmsg,
+render_json_server(const char *url, isc_httpdurl_t *urlinfo,
+		   const char *querystring, const char *headers, void *arg,
+		   unsigned int *retcode, const char **retmsg,
 		   const char **mimetype, isc_buffer_t *b,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return (render_json(STATS_JSON_SERVER, url, urlinfo, querystring,
+			    headers, arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }

 static isc_result_t
-render_json_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		  void *arg, unsigned int *retcode, const char **retmsg,
+render_json_zones(const char *url, isc_httpdurl_t *urlinfo,
+		  const char *querystring, const char *headers, void *arg,
+		  unsigned int *retcode, const char **retmsg,
 		  const char **mimetype, isc_buffer_t *b,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return (render_json(STATS_JSON_ZONES, url, urlinfo, querystring,
+			    headers, arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }

 static isc_result_t
-render_json_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		void *arg, unsigned int *retcode, const char **retmsg,
+render_json_mem(const char *url, isc_httpdurl_t *urlinfo,
+		const char *querystring, const char *headers, void *arg,
+		unsigned int *retcode, const char **retmsg,
 		const char **mimetype, isc_buffer_t *b,
 		isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return (render_json(STATS_JSON_MEM, url, urlinfo, querystring, headers,
+			    arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }

 static isc_result_t
-render_json_tasks(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		  void *arg, unsigned int *retcode, const char **retmsg,
+render_json_tasks(const char *url, isc_httpdurl_t *urlinfo,
+		  const char *querystring, const char *headers, void *arg,
+		  unsigned int *retcode, const char **retmsg,
 		  const char **mimetype, isc_buffer_t *b,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_TASKS, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return (render_json(STATS_JSON_TASKS, url, urlinfo, querystring,
+			    headers, arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }

 static isc_result_t
-render_json_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		void *arg, unsigned int *retcode, const char **retmsg,
+render_json_net(const char *url, isc_httpdurl_t *urlinfo,
+		const char *querystring, const char *headers, void *arg,
+		unsigned int *retcode, const char **retmsg,
 		const char **mimetype, isc_buffer_t *b,
 		isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return (render_json(STATS_JSON_NET, url, urlinfo, querystring, headers,
+			    arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }

 static isc_result_t
-render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		    void *arg, unsigned int *retcode, const char **retmsg,
+render_json_traffic(const char *url, isc_httpdurl_t *urlinfo,
+		    const char *querystring, const char *headers, void *arg,
+		    unsigned int *retcode, const char **retmsg,
 		    const char **mimetype, isc_buffer_t *b,
 		    isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return (render_json(STATS_JSON_TRAFFIC, url, urlinfo, querystring,
+			    headers, arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }

 #endif /* HAVE_JSON_C */

 static isc_result_t
-render_xsl(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo, void *args,
-	   unsigned int *retcode, const char **retmsg, const char **mimetype,
-	   isc_buffer_t *b, isc_httpdfree_t **freecb, void **freecb_args) {
+render_xsl(const char *url, isc_httpdurl_t *urlinfo, const char *querystring,
+	   const char *headers, void *args, unsigned int *retcode,
+	   const char **retmsg, const char **mimetype, isc_buffer_t *b,
+	   isc_httpdfree_t **freecb, void **freecb_args) {
 	isc_result_t result;
-	char *p = NULL;
+	char *_headers = NULL;
+	char *p;

-	UNUSED(httpd);
+	UNUSED(url);
+	UNUSED(querystring);
 	UNUSED(args);

 	*freecb = NULL;
 	*freecb_args = NULL;
 	*mimetype = "text/xslt+xml";

-	if (isc_httpdurl_isstatic(urlinfo)) {
-		time_t t1, t2;
-		const isc_time_t *when;
-		const isc_time_t *loadtime;
+	if (urlinfo->isstatic) {
+		isc_time_t when;
+		char *line, *saveptr;
+		const char *if_modified_since = "If-Modified-Since: ";
+		_headers = strdup(headers);

-		when = isc_httpd_if_modified_since(httpd);
-
-		if (isc_time_isepoch(when)) {
+		if (_headers == NULL) {
 			goto send;
 		}

-		result = isc_time_secondsastimet(when, &t1);
-		if (result != ISC_R_SUCCESS) {
-			goto send;
+		saveptr = NULL;
+		for (line = strtok_r(_headers, "\n", &saveptr); line;
+		     line = strtok_r(NULL, "\n", &saveptr))
+		{
+			if (strncasecmp(line, if_modified_since,
+					strlen(if_modified_since)) == 0) {
+				time_t t1, t2;
+				line += strlen(if_modified_since);
+				result = isc_time_parsehttptimestamp(line,
+								     &when);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}
+
+				result = isc_time_secondsastimet(&when, &t1);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}
+
+				result = isc_time_secondsastimet(
+					&urlinfo->loadtime, &t2);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}
+
+				if (t1 < t2) {
+					goto send;
+				}
+
+				*retcode = 304;
+				*retmsg = "Not modified";
+				goto end;
+			}
 		}
-
-		loadtime = isc_httpdurl_loadtime(urlinfo);
-
-		result = isc_time_secondsastimet(loadtime, &t2);
-		if (result != ISC_R_SUCCESS) {
-			goto send;
-		}
-
-		if (t1 < t2) {
-			goto send;
-		}
-
-		*retcode = 304;
-		*retmsg = "Not modified";
-		goto end;
 	}

 send:
@@ -3492,6 +3511,7 @@ send:
 	isc_buffer_reinit(b, p, strlen(xslmsg));
 	isc_buffer_add(b, strlen(xslmsg));
 end:
+	free(_headers);
 	return (ISC_R_SUCCESS);
 }

@@ -3732,7 +3752,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	const cfg_listelt_t *element, *element2;
 	char socktext[ISC_SOCKADDR_FORMATSIZE];

-	isc_once_do(&once, init_desc);
+	RUNTIME_CHECK(isc_once_do(&once, init_desc) == ISC_R_SUCCESS);

 	ISC_LIST_INIT(new_listeners);

@@ -3889,7 +3909,7 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 	uint64_t sockstat_values[isc_sockstatscounter_max];
 	uint64_t gluecachestats_values[dns_gluecachestatscounter_max];

-	isc_once_do(&once, init_desc);
+	RUNTIME_CHECK(isc_once_do(&once, init_desc) == ISC_R_SUCCESS);

 	/* Set common fields */
 	dumparg.type = isc_statsformat_file;
@@ -59,8 +59,7 @@
 				const cfg_listelt_t *proto = NULL;                \
 				INSIST(obj != NULL);                              \
 				for (proto = cfg_list_first(obj); proto != 0;     \
-				     proto = cfg_list_next(proto))                \
-				{                                                 \
+				     proto = cfg_list_next(proto)) {              \
 					const cfg_obj_t *tls_proto_obj =          \
 						cfg_listelt_value(proto);         \
 					const char *tls_sver =                    \
@@ -84,8 +84,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
 		 */
 		algstr = cfg_obj_asstring(algobj);
 		if (named_config_getkeyalgorithm(algstr, &alg, &bits) !=
-		    ISC_R_SUCCESS)
-		{
+		    ISC_R_SUCCESS) {
 			cfg_obj_log(algobj, named_g_lctx, ISC_LOG_ERROR,
 				    "key '%s': has a "
 				    "unsupported algorithm '%s'",
@@ -251,8 +251,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		str = cfg_obj_asstring(matchtype);
 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
 		if (mtype == dns_ssumatchtype_subdomain &&
-		    strcasecmp(str, "zonesub") == 0)
-		{
+		    strcasecmp(str, "zonesub") == 0) {
 			usezone = true;
 		}

@@ -314,8 +313,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				r.length = bracket - str;
 				max = strtoul(bracket + 1, &end, 10);
 				if (max > 0xffff || end[0] != /*(*/ ')' ||
-				    end[1] != 0)
-				{
+				    end[1] != 0) {
 					cfg_obj_log(identity, named_g_lctx,
 						    ISC_LOG_ERROR,
 						    "'%s' is not a valid count",
@@ -456,8 +454,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 * there's nothing to do anymore.
 	 */
 	if (ISC_LIST_EMPTY(rdatalist_a->rdata) &&
-	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata))
-	{
+	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata)) {
 		return (ISC_R_SUCCESS);
 	}

@@ -891,6 +888,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	int i;
 	int32_t journal_size;
 	bool multi;
+	bool alt;
+	dns_view_t *view = NULL;
 	dns_kasp_t *kasp = NULL;
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
@@ -905,6 +904,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	int seconds;
 	dns_ttl_t maxttl = 0; /* unlimited */
 	dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
+	isc_dscp_t dscp;

 	i = 0;
 	if (zconfig != NULL) {
@@ -1012,8 +1012,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	 * will be needing a master file.
 	 */
 	if (ztype == dns_zone_primary && cpval == default_dbtype &&
-	    filename == NULL)
-	{
+	    filename == NULL) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "zone '%s': 'file' not specified", zname);
@@ -1265,7 +1264,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 			RETERR(named_config_getipandkeylist(config, "primaries",
 							    obj, mctx, &ipkl));
-			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.sources,
+			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.dscps,
 					       ipkl.keys, ipkl.tlss,
 					       ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
@@ -1277,21 +1276,49 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "parental-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setparentalsrc4dscp(zone, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "parental-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setparentalsrc6dscp(zone, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setnotifysrc4dscp(zone, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setnotifysrc6dscp(zone, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "notify-to-soa", &obj);
@@ -1331,7 +1358,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				journal_size = -1;
 			}
 		} else {
-			uint64_t value = cfg_obj_asuint64(obj);
+			isc_resourcevalue_t value;
+			value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
 				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 					    "'max-journal-size "
@@ -1444,12 +1472,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check);

-		obj = NULL;
-		result = named_config_get(maps, "check-svcb", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSVCB,
-				   cfg_obj_asboolean(obj));
-
 		obj = NULL;
 		result = named_config_get(maps, "zero-no-soa-ttl", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1476,7 +1498,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				journal_size = -1;
 			}
 		} else {
-			uint64_t value = cfg_obj_asuint64(obj);
+			isc_resourcevalue_t value;
+			value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
 				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 					    "'max-journal-size "
@@ -1691,11 +1714,11 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_init(&ipkl);
 			RETERR(named_config_getipandkeylist(
 				config, "parental-agents", obj, mctx, &ipkl));
-			dns_zone_setparentals(zone, ipkl.addrs, ipkl.sources,
-					      ipkl.keys, ipkl.tlss, ipkl.count);
+			dns_zone_setparentals(zone, ipkl.addrs, ipkl.keys,
+					      ipkl.tlss, ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
 		} else {
-			dns_zone_setparentals(zone, NULL, NULL, NULL, NULL, 0);
+			dns_zone_setparentals(zone, NULL, NULL, NULL, 0);
 		}
 	}

@@ -1784,6 +1807,13 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME,
 				   ignore);

+		obj = NULL;
+		result = named_config_get(maps, "dnssec-secure-to-insecure",
+					  &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		dns_zone_setoption(mayberaw, DNS_ZONEOPT_SECURETOINSECURE,
+				   cfg_obj_asboolean(obj));
+
 		obj = NULL;
 		result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
 		if (result == ISC_R_SUCCESS) {
@@ -1859,14 +1889,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 			RETERR(named_config_getipandkeylist(config, "primaries",
 							    obj, mctx, &ipkl));
-			dns_zone_setprimaries(mayberaw, ipkl.addrs,
-					      ipkl.sources, ipkl.keys,
+			dns_zone_setprimaries(mayberaw, ipkl.addrs, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
 			count = ipkl.count;
 			dns_ipkeylist_clear(mctx, &ipkl);
 		} else {
-			dns_zone_setprimaries(mayberaw, NULL, NULL, NULL, NULL,
-					      0);
+			dns_zone_setprimaries(mayberaw, NULL, NULL, NULL, 0);
 		}

 		multi = false;
@@ -1913,12 +1941,67 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setxfrsource4(mayberaw,
 					      cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setxfrsource4dscp(mayberaw, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = named_config_get(maps, "transfer-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setxfrsource6(mayberaw,
 					      cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setxfrsource6dscp(mayberaw, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));
+
+		obj = NULL;
+		result = named_config_get(maps, "alt-transfer-source", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		RETERR(dns_zone_setaltxfrsource4(mayberaw,
+						 cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setaltxfrsource4dscp(mayberaw, dscp));
+
+		obj = NULL;
+		result = named_config_get(maps, "alt-transfer-source-v6", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		RETERR(dns_zone_setaltxfrsource6(mayberaw,
+						 cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setaltxfrsource6dscp(mayberaw, dscp));
+
+		obj = NULL;
+		(void)named_config_get(maps, "use-alt-transfer-source", &obj);
+		if (obj == NULL) {
+			/*
+			 * Default off when views are in use otherwise
+			 * on for BIND 8 compatibility.
+			 */
+			view = dns_zone_getview(zone);
+			if (view != NULL && strcmp(view->name, "_default") == 0)
+			{
+				alt = true;
+			} else {
+				alt = false;
+			}
+		} else {
+			alt = cfg_obj_asboolean(obj);
+		}
+		dns_zone_setoption(mayberaw, DNS_ZONEOPT_USEALTXFRSRC, alt);

 		obj = NULL;
 		(void)named_config_get(maps, "try-tcp-refresh", &obj);
@@ -46,7 +46,6 @@
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/task.h>
-#include <isc/tls.h>
 #include <isc/types.h>
 #include <isc/util.h>

@@ -69,7 +68,6 @@
 #include <dns/rdatatype.h>
 #include <dns/request.h>
 #include <dns/tkey.h>
-#include <dns/transport.h>
 #include <dns/tsig.h>

 #include <dst/dst.h>
@@ -122,7 +120,6 @@ static bool memdebugging = false;
 static bool have_ipv4 = false;
 static bool have_ipv6 = false;
 static bool is_dst_up = false;
-static bool use_tls = false;
 static bool usevc = false;
 static bool usegsstsig = false;
 static bool use_win2k_gsstsig = false;
@@ -150,14 +147,6 @@ static dns_tsigkey_t *tsigkey = NULL;
 static dst_key_t *sig0key = NULL;
 static isc_sockaddr_t *servers = NULL;
 static isc_sockaddr_t *primary_servers = NULL;
-static dns_transport_list_t *transport_list = NULL;
-static dns_transport_t *transport = NULL;
-static isc_tlsctx_cache_t *tls_ctx_cache = NULL;
-static char *tls_hostname = NULL;
-static char *tls_client_key_file = NULL;
-static char *tls_client_cert_file = NULL;
-static char *tls_ca_file = NULL;
-static bool tls_always_verify_remote = true;
 static bool default_servers = true;
 static int ns_inuse = 0;
 static int primary_inuse = 0;
@@ -186,7 +175,6 @@ static dns_message_t *answer = NULL;
 static uint32_t default_ttl = 0;
 static bool default_ttl_set = false;
 static bool checknames = true;
-static bool checksvcb = true;
 static const char *resolvconf = RESOLV_CONF;

 bool done = false;
@@ -805,19 +793,6 @@ set_source_ports(dns_dispatchmgr_t *manager) {
 	isc_portset_destroy(gmctx, &v6portset);
 }

-static isc_result_t
-create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
-	isc_buffer_t namesrc, namebuf;
-
-	dns_name_init(name, NULL);
-	isc_buffer_constinit(&namesrc, str, strlen(str));
-	isc_buffer_add(&namesrc, strlen(str));
-	isc_buffer_init(&namebuf, namedata, len);
-
-	return (dns_name_fromtext(name, &namesrc, dns_rootname,
-				  DNS_NAME_DOWNCASE, &namebuf));
-}
-
 static void
 setup_system(void) {
 	isc_result_t result;
@@ -825,8 +800,6 @@ setup_system(void) {
 	isc_sockaddrlist_t *nslist;
 	isc_logconfig_t *logconfig = NULL;
 	irs_resconf_t *resconf = NULL;
-	dns_name_t tlsname;
-	char namedata[DNS_NAME_FORMATSIZE + 1];

 	ddebug("setup_system()");

@@ -889,8 +862,7 @@ setup_system(void) {
 		 */
 		ns_total = 0;
 		for (sa = ISC_LIST_HEAD(*nslist); sa != NULL;
-		     sa = ISC_LIST_NEXT(sa, link))
-		{
+		     sa = ISC_LIST_NEXT(sa, link)) {
 			switch (sa->type.sa.sa_family) {
 			case AF_INET:
 				if (have_ipv4) {
@@ -912,8 +884,7 @@ setup_system(void) {

 		i = 0;
 		for (sa = ISC_LIST_HEAD(*nslist); sa != NULL;
-		     sa = ISC_LIST_NEXT(sa, link))
-		{
+		     sa = ISC_LIST_NEXT(sa, link)) {
 			switch (sa->type.sa.sa_family) {
 			case AF_INET:
 				if (have_ipv4) {
@@ -965,31 +936,6 @@ setup_system(void) {
 						&dispatchv4);
 		check_result(result, "dns_dispatch_createudp (v4)");
 	}
-	transport_list = dns_transport_list_new(gmctx);
-
-	isc_tlsctx_cache_create(gmctx, &tls_ctx_cache);
-
-	if (tls_client_key_file == NULL) {
-		result = create_name("tls-non-auth-client", namedata,
-				     sizeof(namedata), &tlsname);
-		check_result(result, "create_name (tls-non-auth-client)");
-		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
-					      transport_list);
-		dns_transport_set_tlsname(transport, "tls-non-auth-client");
-	} else {
-		result = create_name("tls-auth-client", namedata,
-				     sizeof(namedata), &tlsname);
-		check_result(result, "create_name (tls-auth-client)");
-		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
-					      transport_list);
-		dns_transport_set_tlsname(transport, "tls-auth-client");
-		dns_transport_set_keyfile(transport, tls_client_key_file);
-		dns_transport_set_certfile(transport, tls_client_cert_file);
-	}
-	dns_transport_set_cafile(transport, tls_ca_file);
-	dns_transport_set_remote_hostname(transport, tls_hostname);
-	dns_transport_set_always_verify_remote(transport,
-					       tls_always_verify_remote);

 	result = dns_requestmgr_create(gmctx, taskmgr, dispatchmgr, dispatchv4,
 				       dispatchv6, &requestmgr);
@@ -1026,7 +972,7 @@ get_addresses(char *host, in_port_t port, isc_sockaddr_t *sockaddr,
 	return (count);
 }

-#define PARSE_ARGS_FMT "46A:C:dDE:ghH:iK:lL:MoOk:p:Pr:R:St:Tu:vVy:"
+#define PARSE_ARGS_FMT "46C:dDghilL:Mok:p:Pr:R:t:Tu:vVy:"

 static void
 pre_parse_args(int argc, char **argv) {
@@ -1069,9 +1015,7 @@ pre_parse_args(int argc, char **argv) {
 			fprintf(stderr, "usage: nsupdate [-CdDi] [-L level] "
 					"[-l] [-g | -o | -y keyname:secret "
 					"| -k keyfile] [-p port] "
-					"[ -S [-K tlskeyfile] [-E tlscertfile] "
-					"[-A tlscafile] [-H tlshostname] "
-					"[-O] ] [-v] [-V] [-P] [-T] [-4 | -6] "
+					"[-v] [-V] [-P] [-T] [-4 | -6] "
 					"[filename]\n");
 			exit(1);

@@ -1143,11 +1087,6 @@ parse_args(int argc, char **argv) {
 				fatal("can't find IPv6 networking");
 			}
 			break;
-		case 'A':
-			use_tls = true;
-			usevc = true;
-			tls_ca_file = isc_commandline_argument;
-			break;
 		case 'C':
 			resolvconf = isc_commandline_argument;
 			break;
@@ -1158,27 +1097,12 @@ parse_args(int argc, char **argv) {
 			debugging = true;
 			ddebugging = true;
 			break;
-		case 'E':
-			use_tls = true;
-			usevc = true;
-			tls_client_cert_file = isc_commandline_argument;
-			break;
-		case 'H':
-			use_tls = true;
-			usevc = true;
-			tls_hostname = isc_commandline_argument;
-			break;
 		case 'M':
 			break;
 		case 'i':
 			force_interactive = true;
 			interactive = true;
 			break;
-		case 'K':
-			use_tls = true;
-			usevc = true;
-			tls_client_key_file = isc_commandline_argument;
-			break;
 		case 'l':
 			local_only = true;
 			break;
@@ -1211,11 +1135,6 @@ parse_args(int argc, char **argv) {
 			usegsstsig = true;
 			use_win2k_gsstsig = true;
 			break;
-		case 'O':
-			use_tls = true;
-			usevc = true;
-			tls_always_verify_remote = false;
-			break;
 		case 'p':
 			result = isc_parse_uint16(&dnsport,
 						  isc_commandline_argument, 10);
@@ -1227,10 +1146,6 @@ parse_args(int argc, char **argv) {
 				exit(1);
 			}
 			break;
-		case 'S':
-			use_tls = true;
-			usevc = true;
-			break;
 		case 't':
 			result = isc_parse_uint32(&timeout,
 						  isc_commandline_argument, 10);
@@ -1296,25 +1211,6 @@ parse_args(int argc, char **argv) {
 	}
 #endif /* HAVE_GSSAPI */

-	if (use_tls) {
-		if ((tls_client_key_file == NULL) !=
-		    (tls_client_cert_file == NULL))
-		{
-			fprintf(stderr,
-				"%s: cannot specify the -K option without"
-				"the -E option, and vice versa.\n",
-				argv[0]);
-			exit(1);
-		}
-		if (tls_ca_file != NULL && tls_always_verify_remote == false) {
-			fprintf(stderr,
-				"%s: cannot specify the -A option in "
-				"conjuction with the -O option.\n",
-				argv[0]);
-			exit(1);
-		}
-	}
-
 	if (argv[isc_commandline_index] != NULL) {
 		if (strcmp(argv[isc_commandline_index], "-") == 0) {
 			input = stdin;
@@ -1381,7 +1277,8 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,

 	if (*cmdline != 0) {
 		dns_rdatacallbacks_init(&callbacks);
-		isc_lex_create(gmctx, strlen(cmdline), &lex);
+		result = isc_lex_create(gmctx, strlen(cmdline), &lex);
+		check_result(result, "isc_lex_create");
 		isc_buffer_init(&source, cmdline, strlen(cmdline));
 		isc_buffer_add(&source, strlen(cmdline));
 		result = isc_lex_openbuffer(lex, &source);
@@ -1597,8 +1494,9 @@ evaluate_server(char *cmdline) {

 	ns_alloc = MAX_SERVERADDRS;
 	ns_inuse = 0;
-	servers = isc_mem_getx(gmctx, ns_alloc * sizeof(isc_sockaddr_t),
-			       ISC_MEM_ZERO);
+	servers = isc_mem_get(gmctx, ns_alloc * sizeof(isc_sockaddr_t));
+
+	memset(servers, 0, ns_alloc * sizeof(isc_sockaddr_t));
 	ns_total = get_addresses(server, (in_port_t)port, servers, ns_alloc);
 	if (ns_total == 0) {
 		return (STATUS_SYNTAX);
@@ -2004,8 +1902,7 @@ parseclass:
 		dns_name_t *bad;

 		if (!dns_rdata_checkowner(name, rdata->rdclass, rdata->type,
-					  true))
-		{
+					  true)) {
 			char namebuf[DNS_NAME_FORMATSIZE];

 			dns_name_format(name, namebuf, sizeof(namebuf));
@@ -2025,15 +1922,6 @@ parseclass:
 		}
 	}

-	if (!isdelete && checksvcb && rdata->type == dns_rdatatype_svcb) {
-		result = dns_rdata_checksvcb(name, rdata);
-		if (result != ISC_R_SUCCESS) {
-			fprintf(stderr, "check-svcb failed: %s\n",
-				isc_result_totext(result));
-			goto failure;
-		}
-	}
-
 	if (!isdelete && rdata->type == dns_rdatatype_nsec3param) {
 		dns_rdata_nsec3param_t nsec3param;

@@ -2120,32 +2008,6 @@ evaluate_checknames(char *cmdline) {
 	return (STATUS_MORE);
 }

-static uint16_t
-evaluate_checksvcb(char *cmdline) {
-	char *word;
-
-	ddebug("evaluate_checksvcb()");
-	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (word == NULL || *word == 0) {
-		fprintf(stderr, "could not read check-svcb directive\n");
-		return (STATUS_SYNTAX);
-	}
-	if (strcasecmp(word, "yes") == 0 || strcasecmp(word, "true") == 0 ||
-	    strcasecmp(word, "on") == 0)
-	{
-		checksvcb = true;
-	} else if (strcasecmp(word, "no") == 0 ||
-		   strcasecmp(word, "false") == 0 ||
-		   strcasecmp(word, "off") == 0)
-	{
-		checksvcb = false;
-	} else {
-		fprintf(stderr, "incorrect check-svcb directive: %s\n", word);
-		return (STATUS_SYNTAX);
-	}
-	return (STATUS_MORE);
-}
-
 static void
 setzone(dns_name_t *zonename) {
 	isc_result_t result;
@@ -2302,15 +2164,9 @@ do_next_command(char *cmdline) {
 		return (evaluate_realm(cmdline));
 	}
 	if (strcasecmp(word, "check-names") == 0 ||
-	    strcasecmp(word, "checknames") == 0)
-	{
+	    strcasecmp(word, "checknames") == 0) {
 		return (evaluate_checknames(cmdline));
 	}
-	if (strcasecmp(word, "check-svcb") == 0 ||
-	    strcasecmp(word, "checksvcb") == 0)
-	{
-		return (evaluate_checksvcb(cmdline));
-	}
 	if (strcasecmp(word, "gsstsig") == 0) {
 #if HAVE_GSSAPI
 		usegsstsig = true;
@@ -2592,10 +2448,8 @@ static void
 send_update(dns_name_t *zone, isc_sockaddr_t *primary) {
 	isc_result_t result;
 	dns_request_t *request = NULL;
+	unsigned int options = DNS_REQUESTOPT_CASE;
 	isc_sockaddr_t *srcaddr;
-	unsigned int options = DNS_REQUESTOPT_CASE | DNS_REQUESTOPT_LARGE;
-	dns_transport_t *req_transport = NULL;
-	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;

 	ddebug("send_update()");

@@ -2603,12 +2457,7 @@ send_update(dns_name_t *zone, isc_sockaddr_t *primary) {

 	if (usevc) {
 		options |= DNS_REQUESTOPT_TCP;
-		if (use_tls) {
-			req_transport = transport;
-			req_tls_ctx_cache = tls_ctx_cache;
-		}
 	}
-
 	if (tsigkey == NULL && sig0key != NULL) {
 		result = dns_message_setsig0key(updatemsg, sig0key);
 		check_result(result, "dns_message_setsig0key");
@@ -2628,14 +2477,14 @@ send_update(dns_name_t *zone, isc_sockaddr_t *primary) {

 	/* Windows doesn't like the tsig name to be compressed. */
 	if (updatemsg->tsigname) {
-		updatemsg->tsigname->attributes.nocompress = true;
+		updatemsg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
 	}

-	result = dns_request_create(
-		requestmgr, updatemsg, srcaddr, primary, req_transport,
-		req_tls_ctx_cache, options, tsigkey, timeout, udp_timeout,
-		udp_retries, global_task, update_completed, NULL, &request);
-	check_result(result, "dns_request_create");
+	result = dns_request_createvia(requestmgr, updatemsg, srcaddr, primary,
+				       -1, options, tsigkey, timeout,
+				       udp_timeout, udp_retries, global_task,
+				       update_completed, NULL, &request);
+	check_result(result, "dns_request_createvia");

 	if (debugging) {
 		show_message(stdout, updatemsg, "Outgoing update query:");
@@ -2725,10 +2574,6 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	result = dns_request_getresponse(request, rcvmsg,
 					 DNS_MESSAGEPARSE_PRESERVEORDER);
 	if (result == DNS_R_TSIGERRORSET && servers != NULL) {
-		unsigned int options = DNS_REQUESTOPT_CASE;
-		dns_transport_t *req_transport = NULL;
-		isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
-
 		dns_message_detach(&rcvmsg);
 		ddebug("Destroying request [%p]", request);
 		dns_request_destroy(&request);
@@ -2738,26 +2583,17 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		dns_message_renderreset(soaquery);
 		ddebug("retrying soa request without TSIG");

-		if (usevc) {
-			options |= DNS_REQUESTOPT_TCP;
-			if (!default_servers && use_tls) {
-				req_transport = transport;
-				req_tls_ctx_cache = tls_ctx_cache;
-			}
-		}
-
 		if (isc_sockaddr_pf(addr) == AF_INET6) {
 			srcaddr = localaddr6;
 		} else {
 			srcaddr = localaddr4;
 		}

-		result = dns_request_create(requestmgr, soaquery, srcaddr, addr,
-					    req_transport, req_tls_ctx_cache,
-					    options, NULL, FIND_TIMEOUT * 20,
-					    FIND_TIMEOUT, 3, global_task,
-					    recvsoa, reqinfo, &request);
-		check_result(result, "dns_request_create");
+		result = dns_request_createvia(
+			requestmgr, soaquery, srcaddr, addr, -1, 0, NULL,
+			FIND_TIMEOUT * 20, FIND_TIMEOUT, 3, global_task,
+			recvsoa, reqinfo, &request);
+		check_result(result, "dns_request_createvia");
 		requests++;
 		return;
 	}
@@ -2784,8 +2620,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	}

 	if (rcvmsg->rcode != dns_rcode_noerror &&
-	    rcvmsg->rcode != dns_rcode_nxdomain)
-	{
+	    rcvmsg->rcode != dns_rcode_nxdomain) {
 		fatal("response to SOA query was unsuccessful");
 	}

@@ -2797,8 +2632,8 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		dns_request_destroy(&request);
 		dns_message_detach(&soaquery);
 		ddebug("Out of recvsoa");
-		seenerror = true;
 		done_update();
+		seenerror = true;
 		return;
 	}

@@ -2899,18 +2734,13 @@ lookforsoa:
 		}
 		primary_alloc = MAX_SERVERADDRS;
 		size = primary_alloc * sizeof(isc_sockaddr_t);
-		primary_servers = isc_mem_getx(gmctx, size, ISC_MEM_ZERO);
+		primary_servers = isc_mem_get(gmctx, size);
+
+		memset(primary_servers, 0, size);
 		primary_total = get_addresses(serverstr, dnsport,
 					      primary_servers, primary_alloc);
 		if (primary_total == 0) {
-			seenerror = true;
-			dns_rdata_freestruct(&soa);
-			dns_message_detach(&soaquery);
-			dns_request_destroy(&request);
-			dns_message_detach(&rcvmsg);
-			ddebug("Out of recvsoa");
-			done_update();
-			return;
+			exit(1);
 		}
 		primary_inuse = 0;
 	} else {
@@ -2967,17 +2797,6 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	isc_result_t result;
 	nsu_requestinfo_t *reqinfo;
 	isc_sockaddr_t *srcaddr;
-	unsigned int options = DNS_REQUESTOPT_CASE;
-	dns_transport_t *req_transport = NULL;
-	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
-
-	if (usevc) {
-		options |= DNS_REQUESTOPT_TCP;
-		if (!default_servers && use_tls) {
-			req_transport = transport;
-			req_tls_ctx_cache = tls_ctx_cache;
-		}
-	}

 	reqinfo = isc_mem_get(gmctx, sizeof(nsu_requestinfo_t));
 	reqinfo->msg = msg;
@@ -2989,12 +2808,11 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		srcaddr = localaddr4;
 	}

-	result = dns_request_create(requestmgr, msg, srcaddr, destaddr,
-				    req_transport, req_tls_ctx_cache, options,
-				    default_servers ? NULL : tsigkey,
-				    FIND_TIMEOUT * 20, FIND_TIMEOUT, 3,
-				    global_task, recvsoa, reqinfo, request);
-	check_result(result, "dns_request_create");
+	result = dns_request_createvia(requestmgr, msg, srcaddr, destaddr, -1,
+				       0, default_servers ? NULL : tsigkey,
+				       FIND_TIMEOUT * 20, FIND_TIMEOUT, 3,
+				       global_task, recvsoa, reqinfo, request);
+	check_result(result, "dns_request_createvia");
 	requests++;
 }

@@ -3135,7 +2953,7 @@ start_gssrequest(dns_name_t *primary) {
 	}

 	/* Windows doesn't recognize name compression in the key name. */
-	keyname->attributes.nocompress = true;
+	keyname->attributes |= DNS_NAMEATTR_NOCOMPRESS;

 	rmsg = NULL;
 	dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &rmsg);
@@ -3173,15 +2991,8 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		dns_request_t **request, gss_ctx_id_t context) {
 	isc_result_t result;
 	nsu_gssinfo_t *reqinfo;
+	unsigned int options = 0;
 	isc_sockaddr_t *srcaddr;
-	unsigned int options = DNS_REQUESTOPT_CASE | DNS_REQUESTOPT_TCP;
-	dns_transport_t *req_transport = NULL;
-	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
-
-	if (!default_servers && use_tls) {
-		req_transport = transport;
-		req_tls_ctx_cache = tls_ctx_cache;
-	}

 	debug("send_gssrequest");
 	REQUIRE(destaddr != NULL);
@@ -3191,17 +3002,19 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	reqinfo->addr = destaddr;
 	reqinfo->context = context;

+	options |= DNS_REQUESTOPT_TCP;
+
 	if (isc_sockaddr_pf(destaddr) == AF_INET6) {
 		srcaddr = localaddr6;
 	} else {
 		srcaddr = localaddr4;
 	}

-	result = dns_request_create(requestmgr, msg, srcaddr, destaddr,
-				    req_transport, req_tls_ctx_cache, options,
-				    tsigkey, FIND_TIMEOUT * 20, FIND_TIMEOUT, 3,
-				    global_task, recvgss, reqinfo, request);
-	check_result(result, "dns_request_create");
+	result = dns_request_createvia(requestmgr, msg, srcaddr, destaddr, -1,
+				       options, tsigkey, FIND_TIMEOUT * 20,
+				       FIND_TIMEOUT, 3, global_task, recvgss,
+				       reqinfo, request);
+	check_result(result, "dns_request_createvia");
 	if (debugging) {
 		show_message(stdout, msg, "Outgoing update query:");
 	}
@@ -3298,8 +3111,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 	}

 	if (rcvmsg->rcode != dns_rcode_noerror &&
-	    rcvmsg->rcode != dns_rcode_nxdomain)
-	{
+	    rcvmsg->rcode != dns_rcode_nxdomain) {
 		fatal("response to GSS-TSIG query was unsuccessful");
 	}

@@ -3459,14 +3271,6 @@ static void
 cleanup(void) {
 	ddebug("cleanup()");

-	if (tls_ctx_cache != NULL) {
-		isc_tlsctx_cache_detach(&tls_ctx_cache);
-	}
-
-	if (transport_list != NULL) {
-		dns_transport_list_detach(&transport_list);
-	}
-
 	LOCK(&answer_lock);
 	if (answer != NULL) {
 		dns_message_detach(&answer);
@@ -19,7 +19,7 @@ nsupdate - dynamic DNS update utility
 Synopsis
 ~~~~~~~~

-:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [ [**-S**] [**-K** tlskeyfile] [**-E** tlscertfile] [**-A** tlscafile] [**-H** tlshostname] [-O] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]
+:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]

 Description
 ~~~~~~~~~~~
@@ -71,15 +71,6 @@ Options

   This option sets use of IPv6 only.

-.. option:: -A tlscafile
-
-   This option specifies the file of the certificate authorities (CA) certificates
-   (in PEM format) in order to verify the remote server TLS certificate when
-   using DNS-over-TLS (DoT), to achieve Strict or Mutual TLS. When used, it will
-   override the certificates from the global certificates store, which are
-   otherwise used by default when :option:`-S` is enabled. This option can not
-   be used in conjuction with :option:`-O`, and it implies :option:`-S`.
-
 .. option:: -C

   Overrides the default `resolv.conf` file. This is only intended for testing.
@@ -93,23 +84,10 @@ Options

   This option sets extra debug mode.

-.. option:: -E tlscertfile
-
-   This option sets the certificate(s) file for authentication for the
-   DNS-over-TLS (DoT) transport to the remote server. The certificate
-   chain file is expected to be in PEM format. This option implies :option:`-S`,
-   and can only be used with :option:`-K`.
-
 .. option:: -g

   This option enables standard GSS-TSIG mode.

-.. option:: -H tlshostname
-
-   This option makes :program:`nsupdate` use the provided hostname during remote
-   server TLS certificate verification. Otherwise, the DNS server name
-   is used. This option implies :option:`-S`.
-
 .. option:: -i

   This option forces interactive mode, even when standard input is not a terminal.
@@ -126,13 +104,6 @@ Options
   key used to authenticate Dynamic DNS update requests. In this case,
   the key specified is not an HMAC-MD5 key.

-.. option:: -K tlskeyfile
-
-   This option sets the key file for authenticated encryption for the
-   DNS-over-TLS (DoT) transport with the remote server. The private key file is
-   expected to be in PEM format. This option implies :option:`-S`, and can only
-   be used with :option:`-E`.
-
 .. option:: -l

   This option sets local-host only mode, which sets the server address to localhost
@@ -152,14 +123,6 @@ Options
   This option enables a non-standards-compliant variant of GSS-TSIG
   used by Windows 2000.

-.. option:: -O
-
-   This option enables Opportunistic TLS. When used, the remote peer's TLS
-   certificate will not be verified. This option should be used for debugging
-   purposes only, and it is not recommended to use it in production. This
-   option can not be used in conjuction with :option:`-A`, and it implies
-   :option:`-S`.
-
 .. option:: -p port

   This option sets the port to use for connections to a name server. The default is
@@ -175,15 +138,6 @@ Options
   This option sets the number of UDP retries. The default is 3. If zero, only one update
   request is made.

-.. option:: -S
-
-   This option indicates whether to use DNS-over-TLS (DoT) when querying
-   name servers specified by ``server servername port`` syntax in the input
-   file, and the primary server discovered through a SOA request. When the
-   :option:`-K` and :option:`-E` options are used, then the specified TLS
-   client certificate and private key pair are used for authentication
-   (Mutual TLS). This option implies :option:`-v`.
-
 .. option:: -t timeout

   This option sets the maximum time an update request can take before it is aborted. The
@@ -262,8 +216,6 @@ The command formats and their meanings are as follows:
   update requests are sent. If no port number is specified, the default
   DNS port number of 53 is used.

-   .. note:: This command has no effect when GSS-TSIG is in use.
-
 ``local address port``
   This command sends all dynamic update requests using the local ``address``. When
   no local statement is provided, :program:`nsupdate` sends updates using
@@ -310,12 +262,6 @@ The command formats and their meanings are as follows:
   By default check-names processing is on. If check-names processing
   fails, the record is not added to the UPDATE message.

-``check-svbc [boolean]``
-   This command turns on or off check-svcb processing on records to be added.
-   Check-svcb has no effect on prerequisites or records to be deleted.
-   By default check-svcb processing is on. If check-svcb processing
-   fails, the record is not added to the UPDATE message.
-
 ``prereq nxdomain domain-name``
   This command requires that no resource record of any type exist with the name
   ``domain-name``.
@@ -339,7 +339,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");

 	inst = isc_mem_get(mctx, sizeof(*inst));
-	*inst = (filter_instance_t){ 0 };
+	memset(inst, 0, sizeof(*inst));
 	isc_mem_attach(mctx, &inst->mctx);

 	if (parameters != NULL) {
@@ -619,8 +619,7 @@ process_section(const section_filter_t *filter) {
 		}

 		if (section == DNS_SECTION_ANSWER ||
-		    section == DNS_SECTION_AUTHORITY)
-		{
+		    section == DNS_SECTION_AUTHORITY) {
 			message->flags &= ~DNS_MESSAGEFLAG_AD;
 		}
 	}
@@ -670,8 +669,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		result = ns_client_checkaclsilent(qctx->client, NULL,
 						  inst->a_acl, true);
 		if (result == ISC_R_SUCCESS && inst->v4_a != NONE &&
-		    is_v4_client(qctx->client))
-		{
+		    is_v4_client(qctx->client)) {
 			client_state->mode = inst->v4_a;
 		} else if (result == ISC_R_SUCCESS && inst->v6_a != NONE &&
 			   is_v6_client(qctx->client))
@@ -342,8 +342,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");

 	inst = isc_mem_get(mctx, sizeof(*inst));
-	*inst = (filter_instance_t){ 0 };
-
+	memset(inst, 0, sizeof(*inst));
 	isc_mem_attach(mctx, &inst->mctx);

 	if (parameters != NULL) {
@@ -623,8 +622,7 @@ process_section(const section_filter_t *filter) {
 		}

 		if (section == DNS_SECTION_ANSWER ||
-		    section == DNS_SECTION_AUTHORITY)
-		{
+		    section == DNS_SECTION_AUTHORITY) {
 			message->flags &= ~DNS_MESSAGEFLAG_AD;
 		}
 	}
@@ -688,8 +688,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 		(void)cfg_map_get(config, "server", &servers);
 		if (servers != NULL) {
 			for (elt = cfg_list_first(servers); elt != NULL;
-			     elt = cfg_list_next(elt))
-			{
+			     elt = cfg_list_next(elt)) {
 				const char *name = NULL;
 				server = cfg_listelt_value(elt);
 				name = cfg_obj_asstring(
@@ -726,8 +725,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 	} else {
 		DO("get config key list", cfg_map_get(config, "key", &keys));
 		for (elt = cfg_list_first(keys); elt != NULL;
-		     elt = cfg_list_next(elt))
-		{
+		     elt = cfg_list_next(elt)) {
 			const char *name = NULL;

 			key = cfg_listelt_value(elt);
@@ -937,13 +935,11 @@ main(int argc, char **argv) {
 			break;
 		case 'b':
 			if (inet_pton(AF_INET, isc_commandline_argument, &in) ==
-			    1)
-			{
+			    1) {
 				isc_sockaddr_fromin(&local4, &in, 0);
 				local4set = true;
 			} else if (inet_pton(AF_INET6, isc_commandline_argument,
-					     &in6) == 1)
-			{
+					     &in6) == 1) {
 				isc_sockaddr_fromin6(&local6, &in6, 0);
 				local6set = true;
 			}
@@ -1,7 +1,5 @@
 include $(top_srcdir)/Makefile.top

-EXTRA_DIST = convert-trs-to-junit.py
-
 SUBDIRS = system

 noinst_PROGRAMS =	\
@@ -1,6 +1,5 @@
 .cache
 .hypothesis
-.mypy_cache
 __pycache__
 dig.out*
 rndc.out*
@@ -23,6 +23,7 @@ check_PROGRAMS =		\
 	feature-test		\
 	makejournal		\
 	pipelined/pipequeries	\
+	resolve			\
 	rndc/gencheck		\
 	rpz/dnsrps		\
 	tkey/keycreate		\
@@ -48,6 +49,14 @@ pipelined_pipequeries_LDADD =	\
 	$(LDADD)		\
 	$(LIBDNS_LIBS)

+resolve_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(LIBISC_CFLAGS)	\
+	$(LIBDNS_CFLAGS)	\
+	$(LIBIRS_CFLAGS)
+
+resolve_LDADD = $(LIBISC_LIBS) $(LIBIRS_LIBS) $(LIBDNS_LIBS)
+
 tkey_keycreate_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
 	$(LIBDNS_CFLAGS)
@@ -96,17 +105,16 @@ TESTS +=			\
 	checknames		\
 	checkzone		\
 	database		\
-	dialup			\
 	dlzexternal		\
 	dns64			\
+	dscp			\
 	dsdigest		\
-	dupsigs			\
 	dyndb			\
 	ecdsa			\
 	eddsa			\
 	ednscompliance		\
 	emptyzones		\
-	enginepkcs11		\
+	engine_pkcs11		\
 	filter-aaaa		\
 	formerr			\
 	geoip2			\
@@ -116,7 +124,6 @@ TESTS +=			\
 	inline			\
 	integrity		\
 	hooks			\
-	host			\
 	journal			\
 	keepalive		\
 	keyfromlabel		\
@@ -163,6 +170,12 @@ TESTS +=			\
 	xferquota		\
 	zonechecks

+# The "stress" test is not run by default since it creates enough
+# load on the machine to make it unusable to other users.
+# The "dialup", "delzone", and "dupsigs" tests are also not run by
+# default because they take a very long time to complete.
+# TESTS += delzone dialup dupsigs stress
+
 if HAVE_LMDB
 TESTS += nzd2nzf
 endif # HAVE_LMDB
@@ -175,7 +188,6 @@ TESTS +=		\
 	nsupdate	\
 	resolver	\
 	statistics	\
-	stress		\
 	upforwd		\
 	zero

@@ -45,7 +45,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-if $FEATURETEST --with-lmdb; then
+if [ -n "$NZD" ]; then
    echo_i "checking that existing NZF file was renamed after migration ($n)"
    [ -e ns2/3bf305731dd26307.nzf~ ] || ret=1
    n=`expr $n + 1`
@@ -124,7 +124,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-if ! $FEATURETEST --with-lmdb; then
+if [ -z "$NZD" ]; then
    echo_i "verifying no comments in NZF file ($n)"
    ret=0
    hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
@@ -143,7 +143,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-if $FEATURETEST --with-lmdb; then
+if [ -n "$NZD" ]; then
    echo_i "checking zone is present in NZD ($n)"
    ret=0
    $NZD2NZF ns2/_default.nzd | grep previous.example > /dev/null || ret=1
@@ -169,14 +169,14 @@ check_nzd2nzf() (
 	! grep previous.example nzd2nzf.out.$n > /dev/null
 )

-if $FEATURETEST --with-lmdb; then
+if [ -n "$NZD" ]; then
    echo_i "checking zone was deleted from NZD ($n)"
    retry_quiet 10 check_nzd2nzf || ret=1
    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
 fi

-if ! $FEATURETEST --with-lmdb; then
+if [ -z "$NZD" ]; then
    echo_i "checking NZF file now has comment ($n)"
    ret=0
    hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
@@ -512,7 +512,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-if ! $FEATURETEST --with-lmdb; then
+if [ -z "$NZD" ]; then
    echo_i "checking new NZF file has comment ($n)"
    ret=0
    hcount=`grep "^# New zone file for view: external" ns2/external.nzf | wc -l`
@@ -522,7 +522,7 @@ if ! $FEATURETEST --with-lmdb; then
    status=`expr $status + $ret`
 fi

-if $FEATURETEST --with-lmdb; then
+if [ -n "$NZD" ]; then
    echo_i "verifying added.example in external view created an external.nzd DB ($n)"
    ret=0
    [ -e ns2/external.nzd ] || ret=1
@@ -548,7 +548,7 @@ status=`expr $status + $ret`

 echo_i "checking rndc showzone with newly added zone ($n)"
 _check_rndc_showzone_newly_added() (
-	if ! $FEATURETEST --with-lmdb; then
+	if [ -z "$NZD" ]; then
 		expected='zone "added.example" in external { type primary; file "added.db"; };'
 	else
 		expected='zone "added.example" { type primary; file "added.db"; };'
@@ -655,7 +655,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-if $FEATURETEST --with-lmdb; then
+if [ -n "$NZD" ]; then
    echo_i "checking NZD file was created in new-zones-directory ($n)"
    expect=ns2/new-zones/directory.nzd
 else
@@ -725,8 +725,8 @@ $RNDCCMD 10.53.0.3 addzone '"test\".baz"' '{ type primary; check-names ignore; f
 $RNDCCMD 10.53.0.3 addzone '"test\\.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 addzone '"test\032.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 addzone '"test\010.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
-stop_server ns3
-start_server --noclean --restart --port ${PORT} ns3 || ret=1
+stop_server addzone ns3
+start_server --noclean --restart --port ${PORT} addzone ns3 || ret=1
 retry_quiet 10 _check_version_bind || ret=1
 $DIG $DIGOPTS @10.53.0.3 SOA  "test4.baz" > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
@@ -95,7 +95,6 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
-nextpart ns2/named.run | grep 'recursion not enabled for view' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -637,13 +636,11 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "test $n: default allow-recursion configuration"
 ret=0
-nextpart ns3/named.run > /dev/null
 $DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a > dig.out.ns3.1.$n
 grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 a.normal.example a > dig.out.ns3.2.$n
 grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1
-nextpart ns3/named.run | grep 'allow-recursion did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -656,7 +653,6 @@ grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 ns . > dig.out.ns3.2.$n
 grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1
-nextpart ns3/named.run | grep 'allow-recursion did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -675,7 +671,6 @@ grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.0.3 b.normal.example a > dig.out.ns3.2.$n
 grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
 grep 'ANSWER: 0' dig.out.ns3.2.$n > /dev/null || ret=1
-nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -702,7 +697,6 @@ $DIG -p ${PORT} @10.53.1.2 d.normal.example a > dig.out.ns3.4.$n
 grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.4.$n > /dev/null || ret=1
-nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -729,7 +723,6 @@ $DIG -p ${PORT} @10.53.1.2 f.normal.example a > dig.out.ns3.4.$n
 grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.4.$n > /dev/null || ret=1
-nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -59,8 +59,11 @@ rm -f ns3/optout.example.db
 rm -f ns3/optout.nsec3.example.db
 rm -f ns3/optout.optout.example.db
 rm -f ns3/prepub.example.db
+rm -f ns3/prepub.example.db.in
 rm -f ns3/reconf.example.db
 rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
+rm -f ns3/secure-to-insecure.example.db
+rm -f ns3/secure-to-insecure2.example.db
 rm -f ns3/secure.example.db
 rm -f ns3/secure.nsec3.example.db
 rm -f ns3/secure.optout.example.db
@@ -16,8 +16,9 @@
 # Have the child generate subdomain keys and pass DS sets to us.
 ( cd ../ns3 && $SHELL keygen.sh )

-for subdomain in secure nsec3 optout rsasha256 rsasha512 \
-		 nsec3-to-nsec oldsigs dname-at-apex-nsec3
+for subdomain in secure nsec3 autonsec3 optout rsasha256 rsasha512 \
+		 nsec3-to-nsec oldsigs sync dname-at-apex-nsec3 cds-delete \
+		 cdnskey-delete
 do
 	cp ../ns3/dsset-$subdomain.example. .
 done
@@ -192,11 +192,31 @@ $KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM $zone > kg.out 2>&1 || dumpit kg.out
 $SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > s.out || dumpit s.out

+#
+# secure-to-insecure transition test zone; used to test removal of
+# keys via nsupdate
+#
+setup secure-to-insecure.example
+$KEYGEN -a $DEFAULT_ALGORITHM -q -fk $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -q $zone > kg.out 2>&1 || dumpit kg.out
+$SIGNER -S -o $zone -f $zonefile $infile > s.out || dumpit s.out
+
+#
+# another secure-to-insecure transition test zone; used to test
+# removal of keys on schedule.
+#
+setup secure-to-insecure2.example
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+echo $ksk > ../del1.key
+zsk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
+echo $zsk > ../del2.key
+$SIGNER -S -3 beef -o $zone -f $zonefile $infile > s.out || dumpit s.out
+
 #
 # Introducing a pre-published key test.
 #
 setup prepub.example
-infile="prepub.example.db.in"
+infile="secure-to-insecure2.example.db.in"
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
 $SIGNER -S -3 beef -o $zone -f $zonefile $infile > s.out || dumpit s.out
@@ -170,6 +170,21 @@ zone "nsec3-to-nsec.example" {
 	auto-dnssec maintain;
 };

+zone "secure-to-insecure.example" {
+	type primary;
+	file "secure-to-insecure.example.db";
+	allow-update { any; };
+	dnssec-secure-to-insecure yes;
+};
+
+zone "secure-to-insecure2.example" {
+	type primary;
+	file "secure-to-insecure2.example.db";
+	allow-update { any; };
+	auto-dnssec maintain;
+	dnssec-secure-to-insecure yes;
+};
+
 zone "oldsigs.example" {
 	type primary;
 	file "oldsigs.example.db";
@@ -267,6 +267,80 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+echo_i "checking NSEC->NSEC3 conversion prerequisites ($n)"
+ret=0
+# these commands should result in an empty file:
+$DIG $DIGOPTS +noall +answer nsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.1.test$n || ret=1
+grep "NSEC3PARAM" dig.out.ns3.1.test$n > /dev/null && ret=1
+$DIG $DIGOPTS +noall +answer autonsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
+grep "NSEC3PARAM" dig.out.ns3.2.test$n > /dev/null && ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking NSEC3->NSEC conversion prerequisites ($n)"
+ret=0
+$DIG $DIGOPTS +noall +answer nsec3-to-nsec.example. nsec3param @10.53.0.3 > dig.out.ns3.test$n || ret=1
+grep "NSEC3PARAM" dig.out.ns3.test$n > /dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "converting zones from nsec to nsec3"
+$NSUPDATE > /dev/null 2>&1 <<END	|| status=1
+server 10.53.0.3 ${PORT}
+zone nsec3.nsec3.example.
+update add nsec3.nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
+send
+zone optout.nsec3.example.
+update add optout.nsec3.example. 3600 NSEC3PARAM 1 1 10 BEEF
+send
+zone nsec3.example.
+update add nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
+send
+zone autonsec3.example.
+update add autonsec3.example. 3600 NSEC3PARAM 1 0 20 DEAF
+send
+zone nsec3.optout.example.
+update add nsec3.optout.example. 3600 NSEC3PARAM 1 0 10 BEEF
+send
+zone optout.optout.example.
+update add optout.optout.example. 3600 NSEC3PARAM 1 1 10 BEEF
+send
+zone optout.example.
+update add optout.example. 3600 NSEC3PARAM 1 1 10 BEEF
+send
+END
+
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+    # try to convert nsec-only.example; this should fail due to
+    # non-NSEC3 compatible keys
+    echo_i "preset nsec3param in unsigned zone via nsupdate ($n)"
+    $NSUPDATE > nsupdate.out 2>&1 <<END
+server 10.53.0.3 ${PORT}
+zone nsec-only.example.
+update add nsec-only.example. 3600 NSEC3PARAM 1 0 10 BEEF
+send
+END
+fi
+
+echo_i "checking for nsec3param in unsigned zone ($n)"
+ret=0
+$DIG $DIGOPTS +noall +answer autonsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.test$n || ret=1
+grep "NSEC3PARAM" dig.out.ns3.test$n > /dev/null && ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking for nsec3param signing record ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 signing -list autonsec3.example. > signing.out.test$n 2>&1
+grep "Pending NSEC3 chain 1 0 20 DEAF" signing.out.test$n > /dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "resetting nsec3param via rndc signing ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 signing -clear all autonsec3.example. > /dev/null 2>&1
@@ -285,22 +359,6 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

-echo_i "setting nsec3param via rndc signing ($n)"
-ret=0
-$RNDCCMD 10.53.0.3 signing -nsec3param 1 1 10 beef optout.example. 2>&1
-for i in 0 1 2 3 4 5 6 7 8 9; do
-	ret=0
-	$DIG $DIGOPTS @10.53.0.3 nsec3param optout.example > dig.out.ns3.test$n
-	# Note that the Opt-Out flag is not used in NSEC3PARAM and is set to zero.
-	grep "NSEC3PARAM.*1.*0.*10.*BEEF" dig.out.ns3.test$n > /dev/null || ret=1
-	[ $ret -eq 0 ] && break
-	echo_i "waiting ... ($i)"
-	sleep 2
-done
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 echo_i "signing preset nsec3 zone"
 zsk=$(cat autozsk.key)
 ksk=$(cat autoksk.key)
@@ -311,6 +369,17 @@ $SETTIME -K ns3 -P now -A now $ksk > settime.out.test$n.ksk || ret=1
 echo_i "waiting for changes to take effect"
 sleep 3

+echo_i "converting zone from nsec3 to nsec"
+$NSUPDATE > /dev/null 2>&1 << END	|| status=1
+server 10.53.0.3 ${PORT}
+zone nsec3-to-nsec.example.
+update delete nsec3-to-nsec.example. NSEC3PARAM
+send
+END
+
+echo_i "waiting for change to take effect"
+sleep 3
+
 missing=$(keyfile_to_key_id "$(cat noksk-ksk.key)")
 echo_i "checking that expired RRSIGs from missing KSK $missing are not deleted ($n)"
 ret=0
@@ -423,6 +492,51 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+echo_i "checking NSEC->NSEC3 conversion failed with NSEC-only key ($n)"
+ret=0
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+    grep "failed: REFUSED" nsupdate.out > /dev/null || ret=1
+else
+    echo_i "skip: RSASHA1 not supported"
+fi
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking NSEC3->NSEC conversion succeeded ($n)"
+ret=0
+# this command should result in an empty file:
+$DIG $DIGOPTS +noall +answer nsec3-to-nsec.example. nsec3param @10.53.0.3 > dig.out.ns3.nx.test$n || ret=1
+grep "NSEC3PARAM" dig.out.ns3.nx.test$n > /dev/null && ret=1
+$DIG $DIGOPTS +noauth q.nsec3-to-nsec.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+$DIG $DIGOPTS +noauth q.nsec3-to-nsec.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
+digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking NSEC3->NSEC conversion with 'rndc signing -nsec3param none' ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 signing -nsec3param none autonsec3.example. > /dev/null 2>&1
+# this command should result in an empty file:
+no_nsec3param() (
+ $DIG $DIGOPTS +noall +answer autonsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.nx.test$n || return 1
+ grep "NSEC3PARAM" dig.out.ns3.nx.test$n > /dev/null && return 1
+ return 0
+)
+retry_quiet 10 no_nsec3param || ret=1
+$DIG $DIGOPTS +noauth q.autonsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+$DIG $DIGOPTS +noauth q.autonsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
+digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "checking TTLs of imported DNSKEYs (no default) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +noall +answer dnskey ttl1.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
@@ -922,11 +1036,79 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

+echo_i "checking secure-to-insecure transition, nsupdate ($n)"
+ret=0
+$NSUPDATE > /dev/null 2>&1 <<END	|| status=1
+server 10.53.0.3 ${PORT}
+zone secure-to-insecure.example
+update delete secure-to-insecure.example dnskey
+send
+END
+for i in 0 1 2 3 4 5 6 7 8 9; do
+	ret=0
+	$DIG $DIGOPTS axfr secure-to-insecure.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
+	egrep '(RRSIG|DNSKEY|NSEC)' dig.out.ns3.test$n > /dev/null && ret=1
+	[ $ret -eq 0 ] && break
+	echo_i "waiting ... ($i)"
+	sleep 2
+done
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking secure-to-insecure transition, scheduled ($n)"
+ret=0
+file="ns3/$(cat del1.key).key"
+$SETTIME -I now -D now $file > settime.out.test$n.1 || ret=1
+file="ns3/$(cat del2.key).key"
+$SETTIME -I now -D now $file > settime.out.test$n.2 || ret=1
+($RNDCCMD 10.53.0.3 sign secure-to-insecure2.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+for i in 0 1 2 3 4 5 6 7 8 9; do
+	ret=0
+	$DIG $DIGOPTS axfr secure-to-insecure2.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
+	egrep '(RRSIG|DNSKEY|NSEC3)' dig.out.ns3.test$n > /dev/null && ret=1
+	[ $ret -eq 0 ] && break
+	echo_i "waiting ... ($i)"
+	sleep 2
+done
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking jitter in a newly signed NSEC3 zone ($n)"
+ret=0
+# Use DNS UPDATE to add an NSEC3PARAM record into the zone.
+$NSUPDATE > nsupdate.out.test$n 2>&1 <<END || ret=1
+server 10.53.0.3 ${PORT}
+zone jitter.nsec3.example.
+update add jitter.nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
+send
+END
+[ $ret != 0 ] && echo_i "error: dynamic update add NSEC3PARAM failed"
+# Create DNSSEC keys in the zone directory.
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -K ns3 jitter.nsec3.example > /dev/null
+# Trigger zone signing.
+($RNDCCMD 10.53.0.3 sign jitter.nsec3.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+# Wait until zone has been signed.
+check_if_nsec3param_exists() {
+	$DIG $DIGOPTS NSEC3PARAM jitter.nsec3.example @10.53.0.3 > dig.out.ns3.1.test$n || return 1
+	grep -q "^jitter\.nsec3\.example\..*NSEC3PARAM" dig.out.ns3.1.test$n || return 1
+}
+retry_quiet 40 check_if_nsec3param_exists || {
+	echo_i "error: NSEC3PARAM not present yet"
+	ret=1
+}
+$DIG $DIGOPTS AXFR jitter.nsec3.example @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
+# Check jitter distribution.
+checkjitter dig.out.ns3.2.test$n || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "checking that serial number and RRSIGs are both updated (rt21045) ($n)"
 ret=0
-$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-oldserial=$(cat dig.out.ns3.test$n | awk '$0 !~ /SOA/ {print $3}')
-oldinception=$(cat dig.out.ns3.test$n | awk '/SOA/ {print $6}' | sort -u)
+oldserial=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '$0 !~ /SOA/ {print $3}')
+oldinception=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '/SOA/ {print $6}' | sort -u)

 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q -K ns3 -P 0 -A +6d -I +38d -D +45d prepub.example > /dev/null

@@ -935,12 +1117,12 @@ newserial=$oldserial
 try=0
 while [ $oldserial -eq $newserial -a $try -lt 42 ]
 do
-	$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 > dig.out.ns3.test$n.2
-	newserial=$(cat dig.out.ns3.test$n.2 | awk '$0 !~ /SOA/ {print $3}')
+	newserial=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 |
+		 awk '$0 !~ /SOA/ {print $3}')
 	sleep 1
 	try=$((try + 1))
 done
-newinception=$(cat dig.out.ns3.test$n.2 | awk '/SOA/ {print $6}' | sort -u)
+newinception=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '/SOA/ {print $6}' | sort -u)
 #echo "$oldserial : $newserial"
 #echo "$oldinception : $newinception"

@@ -997,6 +1179,7 @@ status=$((status + ret))

 echo_i "checking that signing records have been marked as complete ($n)"
 ret=0
+checkprivate . 10.53.0.1 || ret=1
 checkprivate bar 10.53.0.2 || ret=1
 checkprivate example 10.53.0.2 0 type65280 || ret=1 # sig-signing-type 65280
 checkprivate private.secure.example 10.53.0.3 2 || ret=1 # pre-signed
@@ -1018,6 +1201,8 @@ checkprivate rsasha512.example 10.53.0.3 || ret=1
 checkprivate secure.example 10.53.0.3 || ret=1
 checkprivate secure.nsec3.example 10.53.0.3 || ret=1
 checkprivate secure.optout.example 10.53.0.3 || ret=1
+checkprivate secure-to-insecure2.example 10.53.0.3 2|| ret=1 # automatically removed
+checkprivate secure-to-insecure.example 10.53.0.3 2 || ret=1 # automatically removed
 checkprivate ttl1.example 10.53.0.3 || ret=1
 checkprivate ttl2.example 10.53.0.3 || ret=1
 checkprivate ttl3.example 10.53.0.3 || ret=1
@@ -1025,11 +1210,8 @@ checkprivate ttl4.example 10.53.0.3 || ret=1
 n=$((n + 1))
 status=$((status + ret))

-echo_i "forcing full sign ($n)"
-ret=0
+echo_i "forcing full sign"
 ($RNDCCMD 10.53.0.1 sign . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi

 echo_i "waiting for change to take effect"
 sleep 5
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -160,7 +158,7 @@ sleep 1
 grep "zone serial (0) unchanged." ns1/named.run > /dev/null && ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi

-HOST_NAME=`$FEATURETEST --gethostname`
+HOSTNAME=`$FEATURETEST --gethostname`
 BIND_VERSION_STRING=$($NAMED -V | head -1)
 BIND_VERSION=$($NAMED -V | sed -ne 's/^BIND \([^ ]*\).*/\1/p')

@@ -168,14 +166,14 @@ n=`expr $n + 1`
 ret=0
 echo_i "Checking that default version works for rndc ($n)"
 $RNDCCMD 10.53.0.1 status > rndc.status.ns1.$n 2>&1
-grep -F "version: $BIND_VERSION_STRING" rndc.status.ns1.$n > /dev/null || ret=1
+fgrep "version: $BIND_VERSION_STRING" rndc.status.ns1.$n > /dev/null || ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi

 n=`expr $n + 1`
 ret=0
 echo_i "Checking that custom version works for rndc ($n)"
 $RNDCCMD 10.53.0.3 status > rndc.status.ns3.$n 2>&1
-grep -F "version: $BIND_VERSION_STRING (this is a test of version)" rndc.status.ns3.$n > /dev/null || ret=1
+fgrep "version: $BIND_VERSION_STRING (this is a test of version)" rndc.status.ns3.$n > /dev/null || ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi

 n=`expr $n + 1`
@@ -196,7 +194,7 @@ n=`expr $n + 1`
 ret=0
 echo_i "Checking that default hostname works for query ($n)"
 $DIG $DIGOPTS +short hostname.bind txt ch @10.53.0.1 > dig.out.ns1.$n
-grep "^\"$HOST_NAME\"$" dig.out.ns1.$n > /dev/null || ret=1
+grep "^\"$HOSTNAME\"$" dig.out.ns1.$n > /dev/null || ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi

 n=`expr $n + 1`
@@ -218,14 +216,14 @@ n=`expr $n + 1`
 ret=0
 echo_i "Checking that server-id hostname works for query ($n)"
 $DIG $DIGOPTS +short id.server txt ch @10.53.0.2 > dig.out.ns2.$n
-grep "^\"$HOST_NAME\"$" dig.out.ns2.$n > /dev/null || ret=1
+grep "^\"$HOSTNAME\"$" dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi

 n=`expr $n + 1`
 ret=0
 echo_i "Checking that server-id hostname works for EDNS name server ID request ($n)"
 $DIG $DIGOPTS +norec +nsid foo @10.53.0.2 > dig.out.ns2.$n
-grep "^; NSID: .* (\"$HOST_NAME\")$" dig.out.ns2.$n > /dev/null || ret=1
+grep "^; NSID: .* (\"$HOSTNAME\")$" dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi

 n=`expr $n + 1`
@@ -108,7 +108,7 @@ echo_i "reset and check that records are correctly cached initially ($n)"
 ret=0
 load_cache
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | egrep '(TXT|ANY)' | wc -l`
 [ $nrecords -eq 18 ] || { ret=1; echo_i "found $nrecords records expected 18"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -202,7 +202,7 @@ n=`expr $n + 1`
 echo_i "check the number of cached records remaining ($n)"
 ret=0
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -v '^;' | grep -E '(TXT|ANY)' | wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -v '^;' | egrep '(TXT|ANY)' | wc -l`
 [ $nrecords -eq 17 ] || { ret=1; echo_i "found $nrecords records expected 17"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -220,7 +220,7 @@ n=`expr $n + 1`
 echo_i "check the number of cached records remaining ($n)"
 ret=0
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | egrep '(TXT|ANY)' | wc -l`
 [ $nrecords -eq 1 ] || { ret=1; echo_i "found $nrecords records expected 1"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -234,6 +234,7 @@ mv ns2/named_dump.db.test$n ns2/named_dump.db.test$n.a
 sed -n '/plain success\/timeout/,/Unassociated entries/p' \
 	ns2/named_dump.db.test$n.a > sed.out.$n.a
 grep 'plain success/timeout' sed.out.$n.a > /dev/null 2>&1 || ret=1
+grep 'Unassociated entries' sed.out.$n.a > /dev/null 2>&1 || ret=1
 grep 'ns.flushtest.example' sed.out.$n.a > /dev/null 2>&1 || ret=1
 $RNDC $RNDCOPTS flushtree flushtest.example || ret=1
 dump_cache
@@ -241,6 +242,7 @@ mv ns2/named_dump.db.test$n ns2/named_dump.db.test$n.b
 sed -n '/plain success\/timeout/,/Unassociated entries/p' \
 	ns2/named_dump.db.test$n.b > sed.out.$n.b
 grep 'plain success/timeout' sed.out.$n.b > /dev/null 2>&1 || ret=1
+grep 'Unassociated entries' sed.out.$n.b > /dev/null 2>&1 || ret=1
 grep 'ns.flushtest.example' sed.out.$n.b > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -13,24 +11,21 @@

 rm -f dig.out.*
 rm -f ns*/*.jnl
-rm -f ns*/*.mkeys
-rm -f ns*/*.nzd ns*/*.nzd-lock
 rm -f ns*/*.nzf
-rm -f ns*/managed-keys.bind*
-rm -f ns*/named.conf
+rm -f ns*/*.mkeys
 rm -f ns*/named.lock
 rm -f ns*/named.memstats
+rm -f ns*/named.conf
 rm -f ns*/named.run
 rm -f ns*/named.run.prev
 rm -f ns1/*dom*example.db
-rm -f ns1/tls1.example.db
 rm -f ns2/__catz__*db
 rm -f ns2/catalog-bad*.db
 rm -f ns2/named.conf.tmp
 rm -f ns3/dom2.example.db ns3/dom13.example.db ns3/dom14.example.db ns3/dom17.example.db ns3/dom18.example.db
-rm -f ns4/__catz__*db
-rm -f ns[123]/catalog[1234].example.db
-rm -f ns[14]/catalog-tls.example.db
 rm -f nsupdate.out.*
-rm -f wait_for_message.*
+rm -f ns[123]/catalog[1234].example.db
 rm -rf ns2/zonedir
+rm -f ns*/*.nzd ns*/*.nzd-lock
+rm -f ns*/managed-keys.bind*
+rm -f wait_for_message.*
@@ -22,12 +22,10 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	port @PORT@;
-	tls-port @TLSPORT@;
 	allow-new-zones yes;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on port @EXTRAPORT1@ { 10.53.0.1; };
-	listen-on tls ephemeral { 10.53.0.1; };
 	listen-on-v6 { none; };
 	notify no;
 	notify-delay 0;
@@ -107,16 +105,6 @@ view "default" {
 		also-notify { 10.53.0.2; };
 		notify explicit;
 	};
-
-	# A catalog zone that requires TLS to be used
-	zone "catalog-tls.example" {
-		type primary;
-		file "catalog-tls.example.db";
-		allow-transfer transport tls { key tsig_key; };
-		allow-update { any; };
-		also-notify { 10.53.0.4; };
-		notify explicit;
-	};
 };

 view "ch" ch {
@@ -137,8 +125,3 @@ key tsig_key. {
 	secret "LSAnCU+Z";
 	algorithm @DEFAULT_HMAC@;
 };
-
-key next_key. {
-	secret "LaAnCU+Z";
-	algorithm @DEFAULT_HMAC@;
-};
@@ -177,8 +177,3 @@ key tsig_key. {
 	secret "LSAnCU+Z";
 	algorithm @DEFAULT_HMAC@;
 };
-
-key next_key. {
-	secret "LaAnCU+Z";
-	algorithm @DEFAULT_HMAC@;
-};
@@ -9,6 +9,6 @@
 ; See the COPYRIGHT file distributed with this work for additional
 ; information regarding copyright ownership.

-@ 3600 SOA . . 2670950424 86400 3600 86400 3600
+@ 3600 SOA . . 1 86400 3600 86400 3600
@ 3600 IN NS invalid.
 version IN TXT "1"
@@ -1,55 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-include "../../common/rndc.key";
-
-controls {
-	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-options {
-	query-source address 10.53.0.4;
-	notify-source 10.53.0.4;
-	transfer-source 10.53.0.4;
-	port @PORT@;
-	tls-port @TLSPORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.4; };
-	listen-on-v6 { fd92:7065:b8e:ffff::4; };
-	notify no;
-	notify-delay 0;
-	recursion no;
-	serial-query-rate 100;
-
-	catalog-zones {
-		zone "catalog-tls.example"
-			min-update-interval 1s
-			default-primaries { 10.53.0.1 key tsig_key tls ephemeral; };
-	};
-};
-
-zone "catalog-tls.example" {
-	type secondary;
-	file "catalog-tls.example.db";
-	primaries { 10.53.0.1 key tsig_key tls ephemeral; };
-};
-
-key tsig_key. {
-	secret "LSAnCU+Z";
-	algorithm @DEFAULT_HMAC@;
-};
-
-key next_key. {
-	secret "LaAnCU+Z";
-	algorithm @DEFAULT_HMAC@;
-};
@@ -18,12 +18,10 @@ $SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named1.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
-copy_setports ns4/named.conf.in ns4/named.conf

 cp -f ns1/catalog.example.db.in ns1/catalog1.example.db
 cp -f ns3/catalog.example.db.in ns3/catalog2.example.db
 cp -f ns1/catalog.example.db.in ns1/catalog3.example.db
 cp -f ns1/catalog.example.db.in ns1/catalog4.example.db
-cp -f ns1/catalog.example.db.in ns1/catalog-tls.example.db

 mkdir -p ns2/zonedir
@@ -382,7 +382,6 @@ status=$((status+ret))
 n=$((n+1))
 echo_i "waiting for secondary to sync up ($n)"
 ret=0
-wait_for_message ns2/named.run "catz: updating catalog zone 'catalog2.example' with serial 2670950425" &&
 wait_for_message ns2/named.run "catz: adding zone 'dom2.example' from catalog 'catalog1.example'" &&
 wait_for_message ns2/named.run "catz: adding zone 'dom3.example' from catalog 'catalog1.example'" &&
 wait_for_message ns2/named.run "catz: adding zone 'dom4.example' from catalog 'catalog2.example'" &&
@@ -1230,56 +1229,6 @@ wait_for_soa @10.53.0.2 dom9.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

-n=$((n+1))
-echo_i "change TSIG key name on primary ($n)"
-ret=0
-rndccmd 10.53.0.1 modzone dom9.example. in default '{type primary; notify yes; file "dom9.example.db"; allow-transfer { key next_key; }; };' || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "update TSIG key name in catalog zone ($n)"
-ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update del label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
-    update add label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "next_key"
-    send
-END
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
-ret=0
-wait_for_message ns2/named.run  "catz: modifying zone 'dom9.example' from catalog 'catalog1.example'" || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "update zone contents and reload ($n)"
-ret=0
-echo "@ 3600 IN SOA . . 2 3600 3600 3600 3600" > ns1/dom9.example.db
-echo "@ IN NS ns2" >> ns1/dom9.example.db
-echo "ns2 IN A 10.53.0.2" >> ns1/dom9.example.db
-rndccmd 10.53.0.1 reload dom9.example. || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "wait for primary to update zone ($n)"
-ret=0
-wait_for_a @10.53.0.1 ns2.dom9.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "wait for secondary to update zone ($n)"
-ret=0
-wait_for_a @10.53.0.2 ns2.dom9.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
 n=$((n+1))
 echo_i "deleting domain dom9.example. from catalog1 zone ($n)"
 ret=0
@@ -1287,7 +1236,7 @@ $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
    server 10.53.0.1 ${PORT}
    update delete f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN PTR dom9.example.
    update delete label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN A 10.53.0.1
-    update delete label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "next_key"
+    update delete label1.primaries.ext.f0f989bc71c5c8ca3a1eb9c9ab5246521907e3af.zones.catalog1.example. 3600 IN TXT "tsig_key"
    send
 END
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
@@ -1903,130 +1852,6 @@ wait_for_no_soa @10.53.0.2 dom13.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

-##########################################################################
-echo_i "Testing recreation of a manually deleted zone after a reload"
-n=$((n+1))
-echo_i "checking that dom16.example. is not served by primary ($n)"
-ret=0
-wait_for_no_soa @10.53.0.1 dom16.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "Adding a domain dom16.example. to primary ns1 via RNDC ($n)"
-ret=0
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom16.example.db
-echo "@ IN NS invalid." >> ns1/dom16.example.db
-echo "@ IN A 192.0.2.1" >> ns1/dom16.example.db
-rndccmd 10.53.0.1 addzone dom16.example. in default '{type primary; file "dom16.example.db";};' || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "checking that dom16.example. is now served by primary ns1 ($n)"
-ret=0
-wait_for_soa @10.53.0.1 dom16.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-nextpart ns2/named.run >/dev/null
-
-n=$((n+1))
-echo_i "Adding domain dom16.example. to catalog1 zone with ns1 as primary ($n)"
-ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update add efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN PTR dom16.example.
-    update add masters.efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN A 10.53.0.1
-    send
-END
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
-ret=0
-wait_for_message ns2/named.run  "catz: adding zone 'dom16.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run  "transfer of 'dom16.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-nextpart ns2/named.run >/dev/null
-
-n=$((n+1))
-echo_i "checking that dom16.example. is served by secondary and that it's the one from ns1 ($n)"
-ret=0
-wait_for_a @10.53.0.2 dom16.example. dig.out.test$n || ret=1
-grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-nextpart ns2/named.run >/dev/null
-
-echo_i "Deleting dom16.example. from secondary ns2 via RNDC ($n)"
-ret=0
-rndccmd 10.53.0.2 delzone dom16.example. in default >/dev/null 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "checking that dom16.example. is no longer served by secondary ($n)"
-ret=0
-wait_for_no_soa @10.53.0.2 dom16.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-nextpart ns2/named.run >/dev/null
-
-echo_i "Reloading secondary ns2 via RNDC ($n)"
-ret=0
-rndccmd 10.53.0.2 reload >/dev/null 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
-ret=0
-wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "checking that dom16.example. is served by secondary and that it's the one from ns1 ($n)"
-ret=0
-wait_for_a @10.53.0.2 dom16.example. dig.out.test$n || ret=1
-grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-nextpart ns2/named.run >/dev/null
-
-n=$((n+1))
-echo_i "Deleting domain dom16.example. from catalog1 ($n)"
-ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update delete efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN PTR dom16.example.
-    update delete masters.efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN A 10.53.0.1
-    send
-END
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
-ret=0
-wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "checking that dom16.example. is no longer served by secondary ($n)"
-ret=0
-wait_for_no_soa @10.53.0.2 dom16.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
 ##########################################################################
 echo_i "Testing having a regular zone and a zone in catalog zone of the same name"
 n=$((n+1))
@@ -2233,6 +2058,130 @@ wait_for_soa @10.53.0.2 dom15.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

+##########################################################################
+echo_i "Testing recreation of a manually deleted zone after a reload"
+n=$((n+1))
+echo_i "checking that dom16.example. is not served by primary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.1 dom16.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "Adding a domain dom16.example. to primary ns1 via RNDC ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom16.example.db
+echo "@ IN NS invalid." >> ns1/dom16.example.db
+echo "@ IN A 192.0.2.1" >> ns1/dom16.example.db
+rndccmd 10.53.0.1 addzone dom16.example. in default '{type primary; file "dom16.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom16.example. is now served by primary ns1 ($n)"
+ret=0
+wait_for_soa @10.53.0.1 dom16.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "Adding domain dom16.example. to catalog1 zone with ns1 as primary ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN PTR dom16.example.
+    update add masters.efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN A 10.53.0.1
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: adding zone 'dom16.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run  "transfer of 'dom16.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "checking that dom16.example. is served by secondary and that it's the one from ns1 ($n)"
+ret=0
+wait_for_a @10.53.0.2 dom16.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+echo_i "Deleting dom16.example. from secondary ns2 via RNDC ($n)"
+ret=0
+rndccmd 10.53.0.2 delzone dom16.example. in default >/dev/null 2>&1 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom16.example. is no longer served by secondary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom16.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+echo_i "Reloading secondary ns2 via RNDC ($n)"
+ret=0
+rndccmd 10.53.0.2 reload >/dev/null 2>&1 || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom16.example. is served by secondary and that it's the one from ns1 ($n)"
+ret=0
+wait_for_a @10.53.0.2 dom16.example. dig.out.test$n || ret=1
+grep "192.0.2.1" dig.out.test$n > /dev/null || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+nextpart ns2/named.run >/dev/null
+
+n=$((n+1))
+echo_i "Deleting domain dom16.example. from catalog1 ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update delete efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN PTR dom16.example.
+    update delete masters.efe725d0cf430ffb113b9bcf59266f066a21216b.zones.catalog1.example. 3600 IN A 10.53.0.1
+    send
+END
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "waiting for secondary to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: update_from_db: new zone merged" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
+n=$((n+1))
+echo_i "checking that dom16.example. is no longer served by secondary ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 dom16.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))
+
 ##########################################################################
 echo_i "Testing custom properties version '1' and version '2' syntaxes"
 n=$((n+1))
@@ -2516,94 +2465,5 @@ rndccmd 10.53.0.2 reconfig || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

-#########################################################################
-
-nextpart ns2/named.run >/dev/null
-
-n=$((n+1))
-echo_i "Adding a dom19.example. to primary via RNDC ($n)"
-ret=0
-# enough initial content for IXFR response when TXT record is added below
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom19.example.db
-echo "@ 3600 IN NS invalid." >> ns1/dom19.example.db
-echo "foo 3600 IN TXT some content here" >> ns1/dom19.example.db
-echo "bar 3600 IN TXT some content here" >> ns1/dom19.example.db
-echo "xxx 3600 IN TXT some content here" >> ns1/dom19.example.db
-echo "yyy 3600 IN TXT some content here" >> ns1/dom19.example.db
-rndccmd 10.53.0.1 addzone dom19.example. in default '{ type primary; file "dom19.example.db"; allow-transfer { key tsig_key; }; allow-update { any; }; notify explicit; also-notify { 10.53.0.2; }; };' || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "add an entry to the restored catalog zone ($n)"
-ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update add 09da0a318e5333a9a7f6c14c385d69f6933e8b72.zones.catalog1.example. 3600 IN PTR dom19.example.
-    update add label1.primaries.ext.09da0a318e5333a9a7f6c14c385d69f6933e8b72.zones.catalog1.example. 3600 IN A 10.53.0.1
-    update add label1.primaries.ext.09da0a318e5333a9a7f6c14c385d69f6933e8b72.zones.catalog1.example. 3600 IN TXT "tsig_key"
-    send
-END
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
-ret=0
-wait_for_message ns2/named.run "catz: adding zone 'dom19.example' from catalog 'catalog1.example'" &&
-wait_for_message ns2/named.run "transfer of 'dom19.example/IN/default' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-##########################################################################
-n=$((n+1))
-echo_i "Adding a domain tls1.example. to primary via RNDC ($n)"
-ret=0
-# enough initial content for IXFR response when TXT record is added below
-echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/tls1.example.db
-echo "@ 3600 IN NS invalid." >> ns1/tls1.example.db
-echo "foo 3600 IN TXT some content here" >> ns1/tls1.example.db
-echo "bar 3600 IN TXT some content here" >> ns1/tls1.example.db
-echo "xxx 3600 IN TXT some content here" >> ns1/tls1.example.db
-echo "yyy 3600 IN TXT some content here" >> ns1/tls1.example.db
-rndccmd 10.53.0.1 addzone tls1.example. in default '{ type primary; file "tls1.example.db"; allow-transfer transport tls { key tsig_key; }; allow-update { any; }; notify explicit; also-notify { 10.53.0.4; }; };' || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "checking that tls1.example. is now served by primary ($n)"
-ret=0
-wait_for_soa @10.53.0.1 tls1.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-nextpart ns4/named.run >/dev/null
-
-n=$((n+1))
-echo_i "Adding domain tls1.example. to catalog-tls zone ($n)"
-ret=0
-$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-    server 10.53.0.1 ${PORT}
-    update add 1ba056ba375209a66a2c9a0617b1df714b998112.zones.catalog-tls.example. 3600 IN PTR tls1.example.
-    send
-END
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "waiting for secondary to sync up ($n)"
-ret=0
-wait_for_message ns4/named.run "catz: adding zone 'tls1.example' from catalog 'catalog-tls.example'" &&
-wait_for_message ns4/named.run "transfer of 'tls1.example/IN' from 10.53.0.1#${TLSPORT}: Transfer status: success" || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
-n=$((n+1))
-echo_i "checking that tls1.example. is served by secondary ($n)"
-ret=0
-wait_for_soa @10.53.0.4 tls1.example. dig.out.test$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
-status=$((status+ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -37,7 +37,7 @@ id2=$id2
 EOF

 tac() {
-	$PERL -e 'print reverse <>'
+	$PERL -e 'print reverse <>' "$@"
 }

 convert() {
@@ -42,7 +42,7 @@ testcase() {

 check_stderr() {
 	if [ -n "${err:=}" ]; then
-		grep -E "$err" err.$n >/dev/null && return 0
+		egrep "$err" err.$n >/dev/null && return 0
 		echo_d "stderr did not match '$err'"
 	else
 		[ -s err.$n ] || return 0
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-tls test-tls {
-	protocols { TLSv1.2; };
-	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
-	prefer-server-ciphers yes;
-};
-
-# Bad: trying to use a TLS profile that has not been specified (another-tls).
-zone "example" {
-	type forward;
-	forward only;
-	forwarders port 5300 tls test-tls { 10.53.0.1; 10.53.0.2 port 5301 tls another-tls; };
-};
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-tls test-tls {
-	protocols { TLSv1.2; };
-	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
-	prefer-server-ciphers yes;
-};
-
-# Bad: trying to use a TLS profile that has not been specified (another-tls).
-zone "example" {
-	type forward;
-	forward only;
-	forwarders port 5300 tls another-tls { 10.53.0.1; 10.53.0.2 port 5301 tls test-tls; };
-};
@@ -1,16 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-        random-device "/dev/urandom";
-};
@@ -1,18 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-zone "check-wildcard" {
-  type primary;
-  file "check-wildcard.db";
-  check-wildcard no;
-};
@@ -11,18 +11,9 @@
 * information regarding copyright ownership.
 */

-server 1.2.3.4 {
-	query-source 10.10.10.10 port 5353;
-};
-
 options {
 	dnssec-validation yes;
 	max-zone-ttl 600;
-
-	use-v4-udp-ports { range 1024 65535; };
-	use-v6-udp-ports { range 1024 65535; };
-	avoid-v4-udp-ports { range 1 1023; };
-	avoid-v6-udp-ports { range 1 1023; };
 };

 trusted-keys {
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0.  If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-tls test-tls {
-	protocols { TLSv1.2; };
-	ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384";
-	prefer-server-ciphers yes;
-};
-
-tls another-tls {
-	protocols { TLSv1.2; };
-	session-tickets no;
-};
-
-zone "example" {
-	type forward;
-	forward only;
-	forwarders port 5300 tls test-tls { 10.53.0.1; 10.53.0.2 port 5301 tls another-tls; };
-};
@@ -30,7 +30,6 @@ server 0.0.0.0 {
 	request-expire no;
 	request-ixfr no;
 	request-nsid no;
-	require-cookie no;
 	send-cookie no;
 	tcp-keepalive no;
 	tcp-only no;
@@ -53,7 +52,6 @@ server :: {
 	request-expire no;
 	request-ixfr no;
 	request-nsid no;
-	require-cookie no;
 	send-cookie no;
 	tcp-keepalive no;
 	tcp-only no;
@@ -45,18 +45,22 @@ options {
 	blackhole {
 		10.0.0.0/8;
 	};
+	coresize 1073741824;
+	datasize 104857600;
 	directory ".";
+	dscp 41;
 	dump-file "named_dumpdb";
+	files 1000;
 	heartbeat-interval 30;
 	hostname none;
 	interface-interval 30;
 	listen-on port 90 {
 		"any";
 	};
-	listen-on port 100 {
+	listen-on port 100 dscp 33 {
 		127.0.0.1/32;
 	};
-	listen-on-v6 port 53 {
+	listen-on-v6 port 53 dscp 57 {
 		"none";
 	};
 	match-mapped-addresses yes;
@@ -68,7 +72,6 @@ options {
 	recursive-clients 3000;
 	serial-query-rate 100;
 	server-id none;
-	update-quota 200;
 	check-names primary warn;
 	check-names secondary ignore;
 	max-cache-size 20000000000000;
@@ -79,12 +82,12 @@ options {
 	};
 	dnssec-policy "test";
 	max-ixfr-ratio 90%;
-	transfer-source 0.0.0.0;
+	transfer-source 0.0.0.0 dscp 63;
 	zone-statistics none;
 };
-parental-agents "parents" port 5353 source 10.10.10.10 port 5354 source-v6 2001:db8::10 port 5355 {
+parental-agents "parents" {
 	10.10.10.11;
-	2001:db8::11;
+	10.10.10.12;
 };
 view "first" {
 	match-clients {
@@ -95,7 +98,7 @@ view "first" {
 		file "xxx";
 		update-policy local;
 		max-ixfr-ratio 20%;
-		notify-source 10.10.10.10 port 53;
+		notify-source 10.10.10.10 port 53 dscp 55;
 	};
 	zone "clone" {
 		type primary;
@@ -119,8 +122,8 @@ view "second" {
 	zone "example2" {
 		type static-stub;
 		forward only;
-		forwarders tls "ephemeral" {
-			10.53.0.4 port 8053 tls "ephemeral";
+		forwarders {
+			10.53.0.4;
 		};
 		zone-statistics no;
 	};
@@ -186,7 +189,7 @@ view "fourth" {
 			1.2.3.5;
 		};
 		dnssec-policy "test";
-		parental-source 10.10.10.10 port 53;
+		parental-source 10.10.10.10 port 53 dscp 55;
 	};
 	zone "dnssec-default" {
 		type primary;
@@ -20,6 +20,7 @@ zone "nsec3.net" {
 	auto-dnssec maintain;
 	dnskey-sig-validity 3600;
 	dnssec-dnskey-kskonly yes;
+	dnssec-secure-to-insecure yes;
 	dnssec-update-mode maintain;
 	inline-signing no;
 	sig-validity-interval 3600;
@@ -13,4 +13,13 @@

 options {
 	port 999999;
+	dscp 222;
+	listen-on port 100 dscp 444 {
+		127.0.0.1/32;
+	};
+};
+
+zone "example" {
+	type primary;
+	file "example.db";
 };
@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -22,7 +20,7 @@ n=`expr $n + 1`
 echo_i "checking that named-checkconf handles a known good config ($n)"
 ret=0
 $CHECKCONF good.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -33,7 +31,7 @@ awk 'BEGIN { ok = 0; } /cut here/ { ok = 1; getline } ok == 1 { print }' good.co
 $CHECKCONF -p good.conf.raw  > checkconf.out$n || ret=1
 grep -v '^good.conf.raw:' < checkconf.out$n > good.conf.out 2>&1 || ret=1
 cmp good.conf.raw good.conf.out || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -45,7 +43,7 @@ grep 'secret "????????????????"' good.conf.raw > /dev/null 2>&1 && ret=1
 $CHECKCONF -p -x good.conf.raw > checkconf.out$n || ret=1
 grep -v '^good.conf.raw:' < checkconf.out$n > good.conf.out 2>&1 || ret=1
 grep 'secret "????????????????"' good.conf.out > /dev/null 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 for bad in bad-*.conf
@@ -54,7 +52,7 @@ do
    echo_i "checking that named-checkconf detects error in $bad ($n)"
    ret=0
    $CHECKCONF $bad > checkconf.out$n 2>&1
-    if [ $? -ne 1 ]; then ret=1; fi
+    if [ $? != 1 ]; then ret=1; fi
    grep "^$bad:[0-9]*: " < checkconf.out$n > /dev/null || ret=1
    case $bad in
    bad-update-policy[123].conf)
@@ -70,7 +68,7 @@ do
 	grep "$pat" < checkconf.out$n > /dev/null || ret=1
 	;;
    esac
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    if [ $ret != 0 ]; then echo_i "failed"; fi
    status=`expr $status + $ret`
 done

@@ -87,7 +85,7 @@ do
 		esac
 	fi
 	$CHECKCONF $good > checkconf.out$n 2>&1
-	if [ $? -ne 0 ]; then echo_i "failed"; ret=1; fi
+	if [ $? != 0 ]; then echo_i "failed"; ret=1; fi
 	status=`expr $status + $ret`
 done

@@ -100,11 +98,11 @@ do
 	if [ $? -eq 0 ]; then
 		echo_i "checking that named-checkconf detects no error in $lmdb ($n)"
 		$CHECKCONF $lmdb > checkconf.out$n 2>&1
-		if [ $? -ne 0 ]; then echo_i "failed"; ret=1; fi
+		if [ $? != 0 ]; then echo_i "failed"; ret=1; fi
 	else
 		echo_i "checking that named-checkconf detects error in $lmdb ($n)"
 		$CHECKCONF $lmdb > checkconf.out$n 2>&1
-		if [ $? -eq 0 ]; then echo_i "failed"; ret=1; fi
+		if [ $? == 0 ]; then echo_i "failed"; ret=1; fi
 	fi
 	status=`expr $status + $ret`
 done
@@ -114,7 +112,7 @@ echo_i "checking that ancient options report a fatal error ($n)"
 ret=0
 $CHECKCONF ancient.conf > ancient.out 2>&1 && ret=1
 grep "no longer exists" ancient.out > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -122,14 +120,14 @@ echo_i "checking that named-checkconf -z catches missing hint file ($n)"
 ret=0
 $CHECKCONF -z hint-nofile.conf > hint-nofile.out 2>&1 && ret=1
 grep "could not configure root hints from 'nonexistent.db': file not found" hint-nofile.out > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf catches range errors ($n)"
 ret=0
 $CHECKCONF range.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -138,23 +136,18 @@ ret=0
 $CHECKCONF notify.conf > checkconf.out$n 2>&1
 warnings=`grep "'notify' is disabled" < checkconf.out$n | wc -l`
 [ $warnings -eq 3 ] || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking named-checkconf dnssec warnings ($n)"
 ret=0
 # dnssec.1: auto-dnssec warning
-$CHECKCONF dnssec.1 > checkconf.out$n.1 2>&1
-grep 'auto-dnssec may only be ' < checkconf.out$n.1 > /dev/null || ret=1
-# dnssec.2: should have no warnings (other than deprecation warning)
-$CHECKCONF dnssec.2 > checkconf.out$n.2 2>&1
-grep "option 'auto-dnssec' is deprecated" < checkconf.out$n.2 > /dev/null || ret=1
-lines=$(wc -l < "checkconf.out$n.2")
-if [ $lines != 1 ]; then ret=1; fi
-# dnssec.3: should have specific deprecation warning
-$CHECKCONF dnssec.3 > checkconf.out$n.3 2>&1
-grep "'auto-dnssec' option is deprecated and will be removed in BIND 9\.19" < checkconf.out$n.3 > /dev/null || ret=1
+$CHECKCONF dnssec.1 > checkconf.out$n.2 2>&1
+grep 'auto-dnssec may only be ' < checkconf.out$n.2 > /dev/null || ret=1
+# dnssec.2: should have no warnings
+$CHECKCONF dnssec.2 > checkconf.out$n.3 2>&1
+grep '.*' < checkconf.out$n.3 > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -165,17 +158,12 @@ $CHECKCONF deprecated.conf > checkconf.out$n.1 2>&1
 grep "option 'managed-keys' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 grep "option 'trusted-keys' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
 grep "option 'max-zone-ttl' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
-grep "option 'use-v4-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
-grep "option 'use-v6-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
-grep "option 'avoid-v4-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
-grep "option 'avoid-v6-udp-ports' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
-grep "token 'port' is deprecated" < checkconf.out$n.1 > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 # set -i to ignore deprecate warnings
 $CHECKCONF -i deprecated.conf > checkconf.out$n.2 2>&1
 grep '.*' < checkconf.out$n.2 > /dev/null && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -183,12 +171,12 @@ echo_i "checking named-checkconf servestale warnings ($n)"
 ret=0
 $CHECKCONF servestale.stale-refresh-time.0.conf > checkconf.out$n.1 2>&1
 grep "'stale-refresh-time' should either be 0 or otherwise 30 seconds or higher" < checkconf.out$n.1 > /dev/null && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 ret=0
 $CHECKCONF servestale.stale-refresh-time.29.conf > checkconf.out$n.1 2>&1
 grep "'stale-refresh-time' should either be 0 or otherwise 30 seconds or higher" < checkconf.out$n.1 > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -228,7 +216,7 @@ EOF
    $CHECKCONF badzero.conf > checkconf.out$n.4 2>&1
    [ $? -eq 1 ] || { echo_i "zone $field failed" ; ret=1; }
 done
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -243,7 +231,7 @@ l=`grep "dnssec-loadkeys-interval.*requires inline" < checkconf.out$n.2 | wc -l`
 $CHECKCONF bad-dnssec.conf > checkconf.out$n.3 2>&1
 l=`grep "update-check-ksk.*requires inline" < checkconf.out$n.3 | wc -l`
 [ $l -eq 1 ] || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -257,7 +245,7 @@ l=`grep "missing 'file' entry" < checkconf.out$n.2 | wc -l`
 $CHECKCONF inline-bad.conf > checkconf.out$n.3 2>&1
 l=`grep "missing 'file' entry" < checkconf.out$n.3 | wc -l`
 [ $l -eq 1 ] || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -265,7 +253,7 @@ echo_i "checking named-checkconf DLZ warnings ($n)"
 ret=0
 $CHECKCONF dlz-bad.conf > checkconf.out$n 2>&1
 grep "'dlz' and 'database'" < checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -285,7 +273,7 @@ $CHECKCONF warn-keydir.conf > checkconf.out$n.3 2>&1
 l=`grep "key-directory" < checkconf.out$n.3 | wc -l`
 [ $l -eq 0 ] || ret=1
 rm -rf test.keydir
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z catches conflicting ttl with max-ttl ($n)"
@@ -294,56 +282,56 @@ $CHECKCONF -z max-ttl.conf > check.out 2>&1
 grep 'TTL 900 exceeds configured max-zone-ttl 600' check.out > /dev/null 2>&1 || ret=1
 grep 'TTL 900 exceeds configured max-zone-ttl 600' check.out > /dev/null 2>&1 || ret=1
 grep 'TTL 900 exceeds configured max-zone-ttl 600' check.out > /dev/null 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z catches invalid max-ttl ($n)"
 ret=0
 $CHECKCONF -z max-ttl-bad.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z skips zone check with alternate databases ($n)"
 ret=0
 $CHECKCONF -z altdb.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z skips zone check with DLZ ($n)"
 ret=0
 $CHECKCONF -z altdlz.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z fails on view with ANY class ($n)"
 ret=0
 $CHECKCONF -z view-class-any1.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z fails on view with CLASS255 class ($n)"
 ret=0
 $CHECKCONF -z view-class-any2.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z passes on view with IN class ($n)"
 ret=0
 $CHECKCONF -z view-class-in1.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z passes on view with CLASS1 class ($n)"
 ret=0
 $CHECKCONF -z view-class-in2.conf > checkconf.out$n 2>&1 || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -352,7 +340,7 @@ ret=0
 $CHECKCONF -z check-names-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "near '_underscore': bad name (check-names)" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-names/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -361,7 +349,7 @@ ret=0
 $CHECKCONF -z check-mx-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "near '10.0.0.1': MX is an address" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -370,7 +358,7 @@ ret=0
 $CHECKCONF -z check-dup-records-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "has semantically identical records" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-dup-records/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -379,7 +367,7 @@ ret=0
 $CHECKCONF -z check-mx-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "failed: MX is an address" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -388,7 +376,7 @@ ret=0
 $CHECKCONF -z check-mx-cname-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "MX.* is a CNAME (illegal)" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx-cname/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -397,7 +385,7 @@ ret=0
 $CHECKCONF -z check-srv-cname-fail.conf > checkconf.out$n 2>&1 && ret=1
 grep "SRV.* is a CNAME (illegal)" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx-cname/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -405,7 +393,7 @@ echo_i "check that named-checkconf -p properly print a port range ($n)"
 ret=0
 $CHECKCONF -p portrange-good.conf > checkconf.out$n 2>&1 || ret=1
 grep "range 8610 8614;" < checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -413,14 +401,14 @@ echo_i "check that named-checkconf -z handles in-view ($n)"
 ret=0
 $CHECKCONF -z in-view-good.conf > checkconf.out$n 2>&1 || ret=1
 grep "zone shared.example/IN: loaded serial" < checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "check that named-checkconf -z returns error when a later view is okay ($n)"
 ret=0
 $CHECKCONF -z check-missing-zone.conf > checkconf.out$n 2>&1 && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -428,20 +416,19 @@ echo_i "check that named-checkconf prints max-cache-size <percentage> correctly
 ret=0
 $CHECKCONF -p max-cache-size-good.conf > checkconf.out$n 2>&1 || ret=1
 grep "max-cache-size 60%;" < checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "check that named-checkconf -l prints out the zone list ($n)"
 ret=0
 $CHECKCONF -l good.conf |
-grep -v "is deprecated" |
 grep -v "is not implemented" |
 grep -v "is not recommended" |
 grep -v "no longer exists" |
 grep -v "is obsolete" > checkconf.out$n || ret=1
 diff good.zonelist checkconf.out$n > diff.out$n || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -450,7 +437,7 @@ ret=0
 $CHECKCONF check-root-ksk-2010.conf > checkconf.out$n 2>/dev/null || ret=1
 [ -s checkconf.out$n ] || ret=1
 grep "key without the updated" < checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -458,7 +445,7 @@ echo_i "check that the 2010 ICANN ROOT KSK with the 2017 ICANN ROOT KSK does not
 ret=0
 $CHECKCONF check-root-ksk-both.conf > checkconf.out$n 2>/dev/null || ret=1
 [ -s checkconf.out$n ] && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -466,7 +453,7 @@ echo_i "check that the 2017 ICANN ROOT KSK alone does not generate a warning ($n
 ret=0
 $CHECKCONF check-root-ksk-2017.conf > checkconf.out$n 2>/dev/null || ret=1
 [ -s checkconf.out$n ] && ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -474,7 +461,7 @@ echo_i "check that a static root key generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-static-key.conf > checkconf.out$n 2>/dev/null || ret=1
 grep "static entry for the root zone WILL FAIL" checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -482,7 +469,7 @@ echo_i "check that a static root DS trust anchor generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-static-ds.conf > checkconf.out$n 2>/dev/null || ret=1
 grep "static entry for the root zone WILL FAIL" checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -490,7 +477,7 @@ echo_i "check that a trusted-keys entry for root generates a warning ($n)"
 ret=0
 $CHECKCONF check-root-trusted-key.conf > checkconf.out$n 2>/dev/null || ret=1
 grep "trusted-keys entry for the root zone WILL FAIL" checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -498,21 +485,22 @@ echo_i "check that using trust-anchors and managed-keys generates an error ($n)"
 ret=0
 $CHECKCONF check-mixed-keys.conf > checkconf.out$n 2>/dev/null && ret=1
 grep "use of managed-keys is not allowed" checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking named-checkconf kasp errors ($n)"
 ret=0
 $CHECKCONF kasp-and-other-dnssec-options.conf > checkconf.out$n 2>&1 && ret=1
-grep "'inline-signing yes;' must also be configured explicitly for zones using dnssec-policy without a configured 'allow-update' or 'update-policy'" < checkconf.out$n > /dev/null || ret=1
+grep "'dnssec-policy;' requires dynamic DNS or inline-signing to be configured for the zone" < checkconf.out$n > /dev/null || ret=1
 grep "'auto-dnssec maintain;' cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
 grep "dnskey-sig-validity: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
 grep "dnssec-dnskey-kskonly: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-secure-to-insecure: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
 grep "dnssec-update-mode: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
 grep "sig-validity-interval: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
 grep "update-check-ksk: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -521,8 +509,8 @@ ret=0
 $CHECKCONF kasp-bad-nsec3-iter.conf > checkconf.out$n 2>&1 && ret=1
 grep "dnssec-policy: nsec3 iterations value 151 out of range" < checkconf.out$n > /dev/null || ret=1
 lines=$(wc -l < "checkconf.out$n")
-if [ $lines -ne 3 ]; then ret=1; fi
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $lines != 3 ]; then ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -530,7 +518,7 @@ echo_i "checking named-checkconf kasp nsec3 algorithm errors ($n)"
 ret=0
 $CHECKCONF kasp-bad-nsec3-alg.conf > checkconf.out$n 2>&1 && ret=1
 grep "dnssec-policy: cannot use nsec3 with algorithm 'RSASHA1'" < checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -538,7 +526,7 @@ echo_i "checking named-checkconf kasp key errors ($n)"
 ret=0
 $CHECKCONF kasp-bad-keylen.conf > checkconf.out$n 2>&1 && ret=1
 grep "dnssec-policy: key with algorithm rsasha1 has invalid key length 511" < checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -548,8 +536,8 @@ $CHECKCONF kasp-bad-signatures-refresh.conf > checkconf.out$n 2>&1 && ret=1
 grep "dnssec-policy: policy 'bad-sigrefresh' signatures-refresh must be at most 90% of the signatures-validity" < checkconf.out$n > /dev/null || ret=1
 grep "dnssec-policy: policy 'bad-sigrefresh-dnskey' signatures-refresh must be at most 90% of the signatures-validity-dnskey" < checkconf.out$n > /dev/null || ret=1
 lines=$(wc -l < "checkconf.out$n")
-if [ $lines -ne 2 ]; then ret=1; fi
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $lines != 2 ]; then ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -557,8 +545,8 @@ echo_i "checking named-checkconf kasp key lifetime errors ($n)"
 ret=0
 $CHECKCONF kasp-bad-lifetime.conf > checkconf.out$n 2>&1 && ret=1
 lines=$(grep "dnssec-policy: key lifetime is shorter than the time it takes to do a rollover" < checkconf.out$n | wc -l) || ret=1
-if [ $lines -ne 3 ]; then ret=1; fi
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $lines != 3 ]; then ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -566,7 +554,7 @@ echo_i "checking named-checkconf kasp predefined key length ($n)"
 ret=0
 $CHECKCONF kasp-ignore-keylen.conf > checkconf.out$n 2>&1 || ret=1
 grep "dnssec-policy: key algorithm ecdsa256 has predefined length; ignoring length value 2048" < checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -579,15 +567,15 @@ grep "dnssec-policy: algorithm 13 has multiple keys with KSK role" < checkconf.o
 grep "dnssec-policy: algorithm 13 has multiple keys with ZSK role" < checkconf.out$n > /dev/null || ret=1
 grep "dnssec-policy: key lifetime is shorter than 30 days" < checkconf.out$n > /dev/null || ret=1
 lines=$(wc -l < "checkconf.out$n")
-if [ $lines -ne 5 ]; then ret=1; fi
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $lines != 5 ]; then ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "check that a good 'kasp' configuration is accepted ($n)"
 ret=0
 $CHECKCONF good-kasp.conf > checkconf.out$n 2>/dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -597,7 +585,7 @@ awk 'BEGIN { ok = 0; } /cut here/ { ok = 1; getline } ok == 1 { print }' good-ka
 [ -s good-kasp.conf.in ] || ret=1
 $CHECKCONF -p good-kasp.conf.in | grep -v '^good-kasp.conf.in:' > good-kasp.conf.out 2>&1 || ret=1
 cmp good-kasp.conf.in good-kasp.conf.out || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -605,7 +593,7 @@ echo_i "check that max-ixfr-ratio 100% generates a warning ($n)"
 ret=0
 $CHECKCONF warn-maxratio1.conf > checkconf.out$n 2>/dev/null || ret=1
 grep "exceeds 100%" < checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
@@ -617,22 +605,6 @@ $CHECKCONF warn-notify-source.conf > checkconf.out$n 2>/dev/null || ret=1
 grep "not recommended" < checkconf.out$n > /dev/null || ret=1
 $CHECKCONF warn-parental-source.conf > checkconf.out$n 2>/dev/null || ret=1
 grep "not recommended" < checkconf.out$n > /dev/null || ret=1
-if [ $ret -ne 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "check that 'check-wildcard no;' succeeds as configured ($n)"
-ret=0
-$CHECKCONF -z check-wildcard-no.conf > checkconf.out$n 2>&1 || ret=1
-grep -F "warning: ownername 'foo.*.check-wildcard' contains an non-terminal wildcard" checkconf.out$n > /dev/null && ret=1
-if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "check that 'check-wildcard yes;' warns as configured ($n)"
-ret=0
-$CHECKCONF -z check-wildcard.conf > checkconf.out$n 2>&1 || ret=1
-grep -F "warning: ownername 'foo.*.check-wildcard' contains an non-terminal wildcard" checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

@@ -21,7 +21,6 @@ rm -f ns*/dsset-*
 rm -f ns*/*.db ns*/*.jnl ns*/*.jbk ns*/*.db.signed ns*/*.db.infile
 rm -f ns*/keygen.out.* ns*/settime.out.* ns*/signer.out.*
 rm -f ns*/managed-keys.bind*
-rm -f ns*/trusted.conf
 rm -f ns*/*.mkeys
 rm -f ns*/zones
 rm -f *.checkds.out
@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-.			IN SOA	gson.nominum.com. a.root.servers.nil. (
-				2000042100	; serial
-				600		; refresh
-				600		; retry
-				1200		; expire
-				600		; minimum
-				)
-.			NS	a.root-servers.nil.
-a.root-servers.nil.	A	10.53.0.1
-
-checkds.		NS	ns2.checkds.
-ns2.checkds.		A	10.53.0.2
--- a/Show More
+++ b/Show More