change ISC__BUFFER macros to inline functions

previously, when ISC_BUFFER_USEINLINE was defined, macros were
used to implement isc_buffer primitives (isc_buffer_init(),
isc_buffer_region(), etc). these macros were missing the DbC
assertions for those primitives, which made it possible for
coding errors to go undetected.

adding the assertions to the macros caused compiler warnings on
some platforms. therefore, this commit converts the ISC__BUFFER
macros to static inline functions instead, with assertions included,
and eliminates the non-inline implementation from buffer.c.

the --enable-buffer-useinline configure option has been removed.

.github/workflows/codeql.yml

@@ -1,55 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ "v9_16", "v9_18", "main" ]
-  schedule:
-    - cron: '39 8 * * 3'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'cpp' ]
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    - name: Install build dependencies
-      uses: awalsh128/cache-apt-pkgs-action@latest
-      with:
-        packages: libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
-        version: 1.0
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-
-    #   If the Autobuild fails above, remove it and uncomment the following three lines.
-    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
-
-    # - run: |
-    #   echo "Run, Build Application using script"
-    #   ./location_of_script_within_repo/buildscript.sh
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
-      with:
-        category: "/language:${{matrix.language}}"

.github/workflows/sonarcloud.yml

@@ -1,50 +0,0 @@
-name: SonarCloud
-
-on:
-  push:
-    branches: [ "v9_16", "v9_18", "main" ]
-  schedule:
-    - cron: '39 8 * * 3'
-
-jobs:
-  build:
-    name: Build and analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'cpp' ]
-
-    env:
-      BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    - name: Install build dependencies
-      uses: awalsh128/cache-apt-pkgs-action@latest
-      with:
-        packages: libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
-        version: 1.0
-
-    - name: Install sonar-scanner and build-wrapper
-      uses: SonarSource/sonarcloud-github-c-cpp@v1
-
-    - name: Run build-wrapper
-      run: |
-        autoreconf -fi
-        ./configure
-        build-wrapper-linux-x86-64 --out-dir ${{ env.BUILD_WRAPPER_OUT_DIR }} make clean all
-
-    - name: Run sonar-scanner
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-      run: |
-        sonar-scanner --define sonar.cfamily.build-wrapper-output="${{ env.BUILD_WRAPPER_OUT_DIR }}"

.gitlab-ci.yml

@@ -8,13 +8,11 @@ variables:
   CCACHE_DIR: "/ccache"
 
   GIT_DEPTH: 1
-
-  # The following values may be overwritten in GitLab's CI/CD Variables Settings.
   BUILD_PARALLEL_JOBS: 6
-  TEST_PARALLEL_JOBS: 4
+  TEST_PARALLEL_JOBS: 6
 
   CONFIGURE: ./configure
-  CLANG_VERSION: 15
+  CLANG_VERSION: 14
   CLANG: "clang-${CLANG_VERSION}"
   SCAN_BUILD: "scan-build-${CLANG_VERSION}"
   ASAN_SYMBOLIZER_PATH: "/usr/lib/llvm-${CLANG_VERSION}/bin/llvm-symbolizer"
@@ -25,7 +23,6 @@ variables:
   # Pass run-time flags to AddressSanitizer to get core dumps on error.
   ASAN_OPTIONS: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
   TSAN_OPTIONS_COMMON: "disable_coredump=0 second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan"
-  UBSAN_OPTIONS: "halt_on_error=1:abort_on_error=1:disable_coredump=0"
 
   TARBALL_EXTENSION: xz
 
@@ -105,12 +102,16 @@ stages:
 
 # Alpine Linux
 
-.alpine-3.17-amd64: &alpine_3_17_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.17-amd64"
+.alpine-3.16-amd64: &alpine_3_16_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.16-amd64"
   <<: *linux_amd64
 
 # Oracle Linux
 
+.oraclelinux-7-amd64: &oraclelinux_7_amd64_image
+  image: "$CI_REGISTRY_IMAGE:oraclelinux-7-amd64"
+  <<: *linux_amd64
+
 .oraclelinux-8-amd64: &oraclelinux_8_amd64_image
   image: "$CI_REGISTRY_IMAGE:oraclelinux-8-amd64"
   <<: *linux_amd64
@@ -121,6 +122,10 @@ stages:
 
 # Debian
 
+.debian-buster-amd64: &debian_buster_amd64_image
+  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
+  <<: *linux_amd64
+
 .debian-bullseye-amd64: &debian_bullseye_amd64_image
   image: "$CI_REGISTRY_IMAGE:debian-bullseye-amd64"
   <<: *linux_amd64
@@ -141,16 +146,20 @@ stages:
 
 # Fedora
 
-.fedora-37-amd64: &fedora_37_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-37-amd64"
+.fedora-35-amd64: &fedora_35_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-35-amd64"
   <<: *linux_amd64
 
-.fedora-37-arm64: &fedora_37_arm64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-37-arm64"
+.fedora-35-arm64: &fedora_35_arm64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-35-arm64"
   <<: *linux_stress_arm64
 
 # Ubuntu
 
+.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
+  <<: *linux_amd64
+
 .ubuntu-focal-amd64: &ubuntu_focal_amd64_image
   image: "$CI_REGISTRY_IMAGE:ubuntu-focal-amd64"
   <<: *linux_amd64
@@ -168,7 +177,7 @@ stages:
 ### QCOW2 Image Templates
 
 .freebsd-12-amd64: &freebsd_12_amd64_image
-  image: "freebsd-12.4-x86_64"
+  image: "freebsd-12.3-x86_64"
   <<: *libvirt_amd64
 
 .freebsd-13-amd64: &freebsd_13_amd64_image
@@ -176,7 +185,7 @@ stages:
   <<: *libvirt_amd64
 
 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-7.2-x86_64"
+  image: "openbsd-7.1-x86_64"
   <<: *libvirt_amd64
 
 ### Job Templates
@@ -229,18 +238,9 @@ stages:
       --with-cmocka
       --with-libxml2
       --with-json-c
-      --enable-leak-detection
       $EXTRA_CONFIGURE
       || (test -s config.log && cat config.log; exit 1)
 
-# change directory to the workspace before including this
-.find_python: &find_python
-  - PYTHON="$(source bin/tests/system/conf.sh; echo $PYTHON)"
-  - test -x "$PYTHON"
-
-.parse_tsan: &parse_tsan
-    - find -name 'tsan.*' -exec "$PYTHON" util/parse_tsan.py {} \;
-
 .check_readline_setup: &check_readline_setup
     - if [[ -n "${WITHOUT_READLINE}" ]]; then
         ! grep "^#define HAVE_READLINE" config.h;
@@ -272,16 +272,13 @@ stages:
     - *configure
     - *check_readline_setup
     - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
-    - test -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && CFLAGS="${CFLAGS} -Werror" make -C "${DIR}"; done
     - test -z "${RUN_MAKE_INSTALL}" || make DESTDIR="${INSTALL_PATH}" install
-    - test -z "${RUN_MAKE_INSTALL}" -o -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && make -C "${DIR}" DESTDIR="${INSTALL_PATH}" install; done
     - test -z "${RUN_MAKE_INSTALL}" || DESTDIR="${INSTALL_PATH}" sh util/check-make-install
     - if [[ "${CFLAGS}" == *"-fsanitize=address"* ]]; then ( ! grep -F AddressSanitizer config.log ); fi
     - test -z "${CROSS_COMPILATION}" || grep -F -A 1 "checking whether we are cross compiling" config.log | grep -q "result.*yes"
     - test -z "${CROSS_COMPILATION}" || file lib/dns/gen | grep -F -q "ELF 64-bit LSB"
     - test -z "${CROSS_COMPILATION}" || ( ! git ls-files -z --others --exclude lib/dns/gen | xargs -0 file | grep "ELF 64-bit LSB" )
     - if test -z "${OUT_OF_TREE_WORKSPACE}" && test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
-    - bin/named/named -V
   needs:
     - job: autoreconf
       artifacts: true
@@ -307,15 +304,11 @@ stages:
     - cd bin/tests/system
     - make -j${TEST_PARALLEL_JOBS:-1} -k check V=1
     - if git rev-parse > /dev/null 2>&1; then ( ! grep "^I:.*:file.*not removed$" *.log ); fi
-    - '( ! grep -F "grep: warning:" *.log )'
   after_script:
-    - test -d bind-* && cd bind-*
-    - REALSOURCEDIR="$PWD"
     - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
+    - test -d bind-* && cd bind-*
     - cat bin/tests/system/test-suite.log
-    - *find_python
-    - >
-      "$PYTHON" "$REALSOURCEDIR"/bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
+    - (source bin/tests/system/conf.sh && "${PYTHON}" "${CI_PROJECT_DIR}/bin/tests/convert-trs-to-junit.py" . > "${CI_PROJECT_DIR}/junit.xml")
 
 .system_test: &system_test_job
   <<: *system_test_common
@@ -337,13 +330,11 @@ stages:
   <<: *system_test_common
   after_script:
     - cat bin/tests/system/test-suite.log
-    - *find_python
-    - *parse_tsan
-    - >
-      "$PYTHON" bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
+    - find bin -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
+    - (source bin/tests/system/conf.sh && "${PYTHON}" "${CI_PROJECT_DIR}/bin/tests/convert-trs-to-junit.py" . > "${CI_PROJECT_DIR}/junit.xml")
   artifacts:
-    untracked: true
     expire_in: "1 day"
+    untracked: true
     when: always
     reports:
       junit: junit.xml
@@ -356,12 +347,9 @@ stages:
   script:
     - make -j${TEST_PARALLEL_JOBS:-1} -k unit V=1
   after_script:
-    - test -d bind-* && cd bind-*
-    - REALSOURCEDIR="$PWD"
     - test -n "${OUT_OF_TREE_WORKSPACE}" && cd "${OUT_OF_TREE_WORKSPACE}"
-    - *find_python
-    - >
-      "$PYTHON" "$REALSOURCEDIR"/bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
+    - test -d bind-* && cd bind-*
+    - (source bin/tests/system/conf.sh && "${PYTHON}" "${CI_PROJECT_DIR}/bin/tests/convert-trs-to-junit.py" . > "${CI_PROJECT_DIR}/junit.xml")
 
 .unit_test: &unit_test_job
   <<: *unit_test_common
@@ -382,13 +370,14 @@ stages:
 .unit_test_tsan: &unit_test_tsan_job
   <<: *unit_test_common
   after_script:
-    - *find_python
-    - *parse_tsan
-    - >
-      "$PYTHON" bin/tests/convert-trs-to-junit.py . > "$CI_PROJECT_DIR"/junit.xml
+    - find lib -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
+    - (source bin/tests/system/conf.sh && "${PYTHON}" "${CI_PROJECT_DIR}/bin/tests/convert-trs-to-junit.py" . > "${CI_PROJECT_DIR}/junit.xml")
   artifacts:
-    untracked: true
     expire_in: "1 day"
+    paths:
+      - tests/*/tsan.*
+      - tsan/
+      - junit.xml
     when: always
     reports:
       junit: junit.xml
@@ -442,7 +431,6 @@ misc:
     - test ! -f CHANGES.SE || sh util/check-line-length.sh CHANGES.SE
     - rm CHANGES.tmp
     - sh util/check-categories.sh
-    - sh util/check-gitignore.sh
     - if git grep SYSTEMTESTTOP -- ':!.gitlab-ci.yml'; then echo 'Please use relative paths instead of $SYSTEMTESTTOP.'; exit 1; fi
     - bash util/unused-headers.sh
     - bash util/xmllint-html.sh
@@ -514,12 +502,6 @@ danger:
     variables:
       - $DANGER_GITLAB_API_TOKEN
 
-checkbashisms:
-  <<: *precheck_job
-  needs: []
-  script:
-    - checkbashisms $(find . -path './.git' -prune -o -type f -exec sh -c 'head -n 1 "{}" | grep -qsF "#!/bin/sh"' \; -print)
-
 tarball-create:
   stage: precheck
   <<: *base_image
@@ -563,28 +545,52 @@ docs:tarball:
     - job: tarball-create
       artifacts: true
 
-# Jobs for regular GCC builds on Alpine Linux 3.17 (amd64)
+# Jobs for regular GCC builds on Alpine Linux 3.16 (amd64)
 
-gcc:alpine3.17:amd64:
+gcc:alpine3.16:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "${WITHOUT_READLINE}"
-  <<: *alpine_3_17_amd64_image
+  <<: *alpine_3_16_amd64_image
   <<: *build_job
 
-system:gcc:alpine3.17:amd64:
-  <<: *alpine_3_17_amd64_image
+system:gcc:alpine3.16:amd64:
+  <<: *alpine_3_16_amd64_image
   <<: *system_test_job
   needs:
-    - job: gcc:alpine3.17:amd64
+    - job: gcc:alpine3.16:amd64
       artifacts: true
 
-unit:gcc:alpine3.17:amd64:
-  <<: *alpine_3_17_amd64_image
+unit:gcc:alpine3.16:amd64:
+  <<: *alpine_3_16_amd64_image
   <<: *unit_test_job
   needs:
-    - job: gcc:alpine3.17:amd64
+    - job: gcc:alpine3.16:amd64
+      artifacts: true
+
+# Jobs for regular GCC builds on Oracle Linux 7 (amd64)
+
+gcc:oraclelinux7:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *oraclelinux_7_amd64_image
+  <<: *build_job
+
+system:gcc:oraclelinux7:amd64:
+  <<: *oraclelinux_7_amd64_image
+  <<: *system_test_job
+  needs:
+    - job: gcc:oraclelinux7:amd64
+      artifacts: true
+
+unit:gcc:oraclelinux7:amd64:
+  <<: *oraclelinux_7_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: gcc:oraclelinux7:amd64
       artifacts: true
 
 # Jobs for regular GCC builds on Oracle Linux 8 (amd64)
@@ -617,7 +623,7 @@ gcc:oraclelinux9:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2 --disable-developer"
+    EXTRA_CONFIGURE: "--with-libidn2"
   <<: *oraclelinux_9_amd64_image
   <<: *build_job
 
@@ -635,19 +641,31 @@ unit:gcc:oraclelinux9:amd64:
     - job: gcc:oraclelinux9:amd64
       artifacts: true
 
-gcc:tarball:nosphinx:
+# Jobs for regular GCC builds on Debian 10 "buster" (amd64)
+
+gcc:buster:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2 --disable-developer"
-    RUN_MAKE_INSTALL: 1
-  <<: *oraclelinux_9_amd64_image
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_buster_amd64_image
   <<: *build_job
-  before_script:
-    - (! command -v sphinx-build >/dev/null)
-    - *unpack_release_tarball
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+
+system:gcc:buster:amd64:
+  <<: *debian_buster_amd64_image
+  <<: *system_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
   needs:
-    - job: tarball-create
+    - job: gcc:buster:amd64
+      artifacts: true
+
+unit:gcc:buster:amd64:
+  <<: *debian_buster_amd64_image
+  <<: *unit_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  needs:
+    - job: gcc:buster:amd64
       artifacts: true
 
 # Jobs for regular GCC builds on Debian 11 "bullseye" (amd64)
@@ -655,11 +673,9 @@ gcc:tarball:nosphinx:
 
 gcc:bullseye:amd64:
   variables:
-    BUILD_CONTRIB: 1
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
     EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT}"
-    RUN_MAKE_INSTALL: 1
   <<: *debian_bullseye_amd64_image
   <<: *build_job
 
@@ -752,50 +768,19 @@ scan-build:
     expire_in: "1 day"
     when: on_failure
 
-# Jobs for strict OpenSSL 3.x (no deprecated) GCC builds on Debian "sid" (amd64)
-
-gcc:ossl3:sid:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O3 -DOPENSSL_NO_DEPRECATED=1 -DOPENSSL_API_COMPAT=30000"
-    RUN_MAKE_INSTALL: 1
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-
-system:gcc:ossl3:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *system_test_job
-  needs:
-    - job: gcc:ossl3:sid:amd64
-      artifacts: true
-
-unit:gcc:ossl3:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  needs:
-    - job: gcc:ossl3:sid:amd64
-      artifacts: true
-
 # Jobs for regular GCC builds on Debian "sid" (amd64)
 # Also tests configration option: --without-lmdb.
 
 gcc:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O3 -DOPENSSL_API_COMPAT=10100"
-    # For the jemalloc ./configure option, see https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
-    EXTRA_CONFIGURE: "--with-libidn2 --without-lmdb --without-jemalloc --disable-leak-detection ${WITH_READLINE}"
+    CFLAGS: "${CFLAGS_COMMON} -O3"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-lmdb ${WITH_READLINE}"
     RUN_MAKE_INSTALL: 1
   <<: *debian_sid_amd64_image
   <<: *build_job
 
 system:gcc:sid:amd64:
-  # Set up environment variables that allow the "keyfromlabel" system test to be run
-  variables:
-    DEFAULT_OPENSSL_CONF: "/etc/ssl/openssl.cnf"
-    OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
-    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
-    SOFTHSM2_MODULE: "/usr/lib/softhsm/libsofthsm2.so"
   <<: *debian_sid_amd64_image
   <<: *system_test_job
   needs:
@@ -885,15 +870,7 @@ gcc:tumbleweed:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -DDEBUG"
-    # NOTE: Testing DNSRPS-enabled builds currently requires an
-    # operating system with glibc 2.34+.  This requirement will go away
-    # once the DNSRPS dynamic loading code gets reworked to use libuv's
-    # dlopen() API.
-    #
-    # NOTE: This does *not* enable testing of the DNSRPS feature itself.
-    # Doing that requires a DNSRPS provider library to be present on the
-    # test host.
-    EXTRA_CONFIGURE: "--enable-dnsrps --enable-dnsrps-dl --with-libidn2 ${WITH_READLINE_READLINE}"
+    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_READLINE}"
   <<: *tumbleweed_latest_amd64_image
   <<: *build_job
 
@@ -911,13 +888,40 @@ unit:gcc:tumbleweed:amd64:
     - job: gcc:tumbleweed:amd64
       artifacts: true
 
+# Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
+
+gcc:bionic:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -O2"
+    EXTRA_CONFIGURE: "--disable-dnstap --without-cmocka --without-gssapi"
+  <<: *ubuntu_bionic_amd64_image
+  <<: *build_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+
+system:gcc:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *system_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  needs:
+    - job: gcc:bionic:amd64
+      artifacts: true
+
+unit:gcc:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *unit_test_job
+  <<: *api_schedules_tags_triggers_web_triggering_rules
+  needs:
+    - job: gcc:bionic:amd64
+      artifacts: true
+
 # Jobs for regular GCC builds on Ubuntu 20.04 Focal Fossa (amd64)
 
 gcc:focal:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -Og"
-    EXTRA_CONFIGURE: "--disable-dnstap --without-cmocka --without-gssapi --with-libidn2"
+    EXTRA_CONFIGURE: "--disable-geoip --with-libidn2"
   <<: *ubuntu_focal_amd64_image
   <<: *build_job
 
@@ -941,7 +945,7 @@ gcc:jammy:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--disable-geoip --with-libidn2 --disable-doh"
+    EXTRA_CONFIGURE: "--with-libidn2 --disable-doh"
   <<: *ubuntu_jammy_amd64_image
   <<: *build_job
 
@@ -959,28 +963,28 @@ unit:gcc:jammy:amd64:
     - job: gcc:jammy:amd64
       artifacts: true
 
-# Jobs for ASAN builds on Fedora 37 (amd64)
+# Jobs for ASAN builds on Fedora 35 (amd64)
 
 gcc:asan:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined -Wno-error=stringop-overread"
     LDFLAGS: "-fsanitize=address,undefined"
     EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc"
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
   <<: *build_job
 
 system:gcc:asan:
   variables:
     LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
   <<: *system_test_job
   needs:
     - job: gcc:asan
       artifacts: true
 
 unit:gcc:asan:
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
   <<: *unit_test_job
   needs:
     - job: gcc:asan
@@ -1009,7 +1013,7 @@ unit:clang:asan:
     - job: clang:asan
       artifacts: true
 
-# Jobs for TSAN builds on Fedora 37 (amd64)
+# Jobs for TSAN builds on Fedora 35 (amd64)
 
 gcc:tsan:
   variables:
@@ -1017,13 +1021,13 @@ gcc:tsan:
     CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
     LDFLAGS: "-fsanitize=thread"
     EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
   <<: *build_job
 
 system:gcc:tsan:
   variables:
     TSAN_OPTIONS: "${TSAN_OPTIONS_COMMON} external_symbolizer_path=/usr/bin/llvm-symbolizer"
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
   <<: *system_test_tsan_job
   needs:
     - job: gcc:tsan
@@ -1032,7 +1036,7 @@ system:gcc:tsan:
 unit:gcc:tsan:
   variables:
     TSAN_OPTIONS: "${TSAN_OPTIONS_COMMON} external_symbolizer_path=/usr/bin/llvm-symbolizer"
-  <<: *fedora_37_amd64_image
+  <<: *fedora_35_amd64_image
   <<: *unit_test_tsan_job
   needs:
     - job: gcc:tsan
@@ -1066,17 +1070,13 @@ unit:clang:tsan:
       artifacts: true
 
 # Jobs for Clang builds on Debian 11 "bullseye" (amd64)
-# The -Wno-compound-token-split-by-macro option prevents warning when compiling
-# Perl DLZ module with Clang against Perl older than version 5.35.2.
 
 clang:bullseye:amd64:
   variables:
-    BUILD_CONTRIB: 1
     CC: ${CLANG}
-    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion -Wno-compound-token-split-by-macro"
+    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
     # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
-    EXTRA_CONFIGURE: "--without-jemalloc --disable-leak-detection"
-    RUN_MAKE_INSTALL: 1
+    EXTRA_CONFIGURE: "--without-jemalloc"
   <<: *debian_bullseye_amd64_image
   <<: *build_job
 
@@ -1115,6 +1115,7 @@ system:clang:freebsd12:amd64:
   <<: *system_test_job
   variables:
     USER: gitlab-runner
+    TEST_PARALLEL_JOBS: 4
   needs:
     - job: clang:freebsd12:amd64
       artifacts: true
@@ -1141,6 +1142,7 @@ system:clang:freebsd13:amd64:
   <<: *system_test_job
   variables:
     USER: gitlab-runner
+    TEST_PARALLEL_JOBS: 4
   needs:
     - job: clang:freebsd13:amd64
       artifacts: true
@@ -1171,7 +1173,6 @@ system:clang:openbsd:amd64:
   needs:
     - job: clang:openbsd:amd64
       artifacts: true
-  allow_failure: true
 
 unit:clang:openbsd:amd64:
   <<: *openbsd_amd64_image
@@ -1213,7 +1214,7 @@ release:
   artifacts:
     paths:
       - "*.tar.gz"
-    expire_in: never
+    expire_in: "1 day"
 
 # Coverity Scan analysis upload
 
@@ -1280,36 +1281,6 @@ respdiff-short:
   script:
     - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
 
-respdiff-short:asan:
-  <<: *respdiff_job
-  <<: *default_triggering_rules
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
-    LDFLAGS: "-fsanitize=address,undefined"
-    EXTRA_CONFIGURE: "--without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
-  script:
-    - bash respdiff.sh -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-  allow_failure: true
-
-respdiff-short:tsan:
-  <<: *respdiff_job
-  <<: *default_triggering_rules
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
-    TSAN_OPTIONS: "${TSAN_OPTIONS_COMMON} external_symbolizer_path=/usr/bin/llvm-symbolizer"
-  script:
-    - bash respdiff.sh -s named -q "${PWD}/10k_a.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-  after_script:
-    - *find_python
-    - *parse_tsan
-  allow_failure: true
-
 respdiff-long:
   <<: *respdiff_job
   <<: *api_schedules_tags_triggers_web_triggering_rules
@@ -1320,36 +1291,6 @@ respdiff-long:
   script:
     - bash respdiff.sh -m /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
 
-respdiff-long:asan:
-  <<: *respdiff_job
-  <<: *api_schedules_tags_triggers_web_triggering_rules
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
-    LDFLAGS: "-fsanitize=address,undefined"
-    EXTRA_CONFIGURE: "--without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
-  script:
-    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-  allow_failure: true
-
-respdiff-long:tsan:
-  <<: *respdiff_job
-  <<: *api_schedules_tags_triggers_web_triggering_rules
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc"
-    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
-    TSAN_OPTIONS: "${TSAN_OPTIONS_COMMON} external_symbolizer_path=/usr/bin/llvm-symbolizer"
-  script:
-    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
-  after_script:
-    - *find_python
-    - *parse_tsan
-  allow_failure: true
-
 respdiff-long-third-party:
   <<: *respdiff_job
   <<: *api_schedules_tags_triggers_web_triggering_rules
@@ -1377,12 +1318,12 @@ respdiff-long-third-party:
       artifacts: true
   artifacts:
     untracked: true
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: always
   timeout: 2h
 
-stress:authoritative:fedora:37:amd64:
-  <<: *fedora_37_amd64_image
+stress:authoritative:fedora:35:amd64:
+  <<: *fedora_35_amd64_image
   <<: *linux_stress_amd64
   <<: *stress_job
   variables:
@@ -1395,8 +1336,8 @@ stress:authoritative:fedora:37:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
-stress:recursive:fedora:37:amd64:
-  <<: *fedora_37_amd64_image
+stress:recursive:fedora:35:amd64:
+  <<: *fedora_35_amd64_image
   <<: *linux_stress_amd64
   <<: *stress_job
   variables:
@@ -1409,8 +1350,8 @@ stress:recursive:fedora:37:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
-stress:rpz:fedora:37:amd64:
-  <<: *fedora_37_amd64_image
+stress:rpz:fedora:35:amd64:
+  <<: *fedora_35_amd64_image
   <<: *linux_stress_amd64
   <<: *stress_job
   variables:
@@ -1423,8 +1364,8 @@ stress:rpz:fedora:37:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
-stress:authoritative:fedora:37:arm64:
-  <<: *fedora_37_arm64_image
+stress:authoritative:fedora:35:arm64:
+  <<: *fedora_35_arm64_image
   <<: *linux_stress_arm64
   <<: *stress_job
   variables:
@@ -1437,8 +1378,8 @@ stress:authoritative:fedora:37:arm64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
 
-stress:recursive:fedora:37:arm64:
-  <<: *fedora_37_arm64_image
+stress:recursive:fedora:35:arm64:
+  <<: *fedora_35_arm64_image
   <<: *linux_stress_arm64
   <<: *stress_job
   variables:
@@ -1451,8 +1392,8 @@ stress:recursive:fedora:37:arm64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)
 
-stress:rpz:fedora:37:arm64:
-  <<: *fedora_37_arm64_image
+stress:rpz:fedora:35:arm64:
+  <<: *fedora_35_arm64_image
   <<: *linux_stress_arm64
   <<: *stress_job
   variables:
@@ -1507,22 +1448,6 @@ stress:rpz:freebsd12:amd64:
     variables:
       - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
 
-# git fsck operates over the whole repository and is sufficient to schedule it
-# only in one branch, preferably "main". GitLab's clone strategy prevents us
-# from using the "bind9" repo clone; we need to clone it ourselves.
-fsck:
-  <<: *base_image
-  stage: postcheck
-  variables:
-    GIT_STRATEGY: none
-  script:
-    - git clone https://gitlab.isc.org/isc-projects/bind9.git bind9-full-clone
-    - cd bind9-full-clone/
-    - git fsck
-  only:
-    - schedules
-  needs: []
-
 gcov:
   <<: *base_image
   <<: *default_triggering_rules
@@ -1538,22 +1463,21 @@ gcov:
     # Help gcovr process the nasty tricks in lib/dns/code.h, where we include C
     # source files from lib/dns/rdata/*/, using an even nastier trick.
     - find lib/dns/rdata/* -name "*.c" -execdir cp -f "{}" ../../ \;
-    # Help gcovr process inline functions in headers by copying all libdns and
-    # libisc headers to lib/{dns,isc,ns}/.
-    - for SRC in dns isc; do for DST in dns isc ns; do cp -f "lib/${SRC}/include/${SRC}"/*.h "lib/${DST}/"; done; done
+    # Help gcovr process inline functions in headers
+    - cp -f lib/isc/include/isc/*.h lib/isc/
+    - cp -f lib/dns/include/dns/*.h lib/dns/
+    - cp -f lib/dns/include/dns/*.h lib/ns/
     - find bin lib -maxdepth 1 -mindepth 1 -type d -exec cp -f lib/isc/include/isc/buffer.h "{}" \;
+    - cp -f lib/isc/include/isc/buffer.h fuzz/
     - cp -f lib/isc/include/isc/buffer.h lib/isc/netmgr/buffer.h
-    - cp -f lib/isc/include/isc/dnsstream.h lib/isc/netmgr/dnsstream.h
-    # Help gcovr find dlz_dbi.c file
-    - for DST in ldap mysql mysqldyn sqlite3 wildcard; do cp contrib/dlz/modules/common/dlz_dbi.c "contrib/dlz/modules/${DST}"; done
+    - cp -f lib/isc/include/isc/hash.h lib/dns/hash.h
     # Generate XML file in the Cobertura XML format suitable for use by GitLab
     # for the purpose of displaying code coverage information in the diff view
     # of a given merge request.
-    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc --exclude-directories fuzz --exclude-directories lib/samples --exclude tests --xml -o coverage.xml
-    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc --exclude-directories fuzz --exclude-directories lib/samples --exclude tests --html-details -o coverage.html
-    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc --exclude-directories fuzz --exclude-directories lib/samples --exclude tests -o coverage.txt
+    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc  --exclude-directories lib/samples --exclude tests --xml -o coverage.xml
+    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc  --exclude-directories lib/samples --exclude tests --html-details -o coverage.html
+    - gcovr --root . --exclude-directories bin/tests --exclude-directories doc  --exclude-directories lib/samples --exclude tests -o coverage.txt
     - tail -n 3 coverage.txt
-  coverage: /^TOTAL.*\s+(\d+\%)$/
   artifacts:
     paths:
       - coverage*.html

.gitlab/issue_templates/Bug.md

@@ -1,8 +1,8 @@
 <!--
 If the bug you are reporting is potentially security-related - for example,
 if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please make sure that you make the new issue
-confidential!
+triggered repeatedly - then please do *NOT* report it here, but send an
+email to [security-officer@isc.org](security-officer@isc.org).
 -->
 
 ### Summary

.gitlab/issue_templates/CVE.md

@@ -3,126 +3,35 @@ THIS ISSUE TEMPLATE IS INTENDED ONLY FOR INTERNAL USE.
 
 If the bug you are reporting is potentially security-related - for example,
 if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please make sure that you make the new issue
-confidential!
+triggered repeatedly - then please do *NOT* report it here, but send an
+email to [security-officer@isc.org](security-officer@isc.org).
 -->
-| Quick Links              | :link:                               |
-| ------------------------ | ------------------------------------ |
-| Incident Manager:        | @user                                |
-| Deputy Incident Manager: | @user                                |
-| Public Disclosure Date:  | YYYY-MM-DD                           |
-| CVSS Score:              | [0.0][cvss_score]                    |
-| Security Advisory:       | isc-private/printing-press!NNN       |
-| Mattermost Channel:      | [CVE-YYYY-NNNN][mattermost_url]      |
-| Support Ticket:          | [URL]                                |
-| Release Checklist:       | #NNNN                                |
-| Post-mortem Etherpad:    | [postmortem-YYYY-MM][postmortem_url] |
 
-[cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
-[mattermost_url]:
-[postmortem_url]:
+### CVE-specific actions
 
-:bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
+  - [ ] Assign a CVE identifier
+  - [ ] Determine CVSS score
+  - [ ] Determine the range of BIND versions affected (including the Subscription Edition)
+  - [ ] Determine whether workarounds for the problem exists
+  - [ ] Create a draft of the security advisory and put the information above in there
+  - [ ] Prepare a detailed description of the problem which should include the following by default:
+      - instructions for reproducing the problem (a system test is good enough)
+      - explanation of code flow which triggers the problem (a system test is *not* good enough)
+  - [ ] Prepare a private merge request containing the following items in separate commits:
+      - a test for the issue (may be moved to a separate merge request for deferred merging)
+      - a fix for the issue
+      - documentation updates (`CHANGES`, release notes, anything else applicable)
+  - [ ] Ensure the merge request from the previous step is reviewed by SWENG staff and has no outstanding discussions
+  - [ ] Ensure the documentation changes introduced by the merge request addressing the problem are reviewed by Support and Marketing staff
+  - [ ] Prepare backports of the merge request addressing the problem for all affected (and still maintained) BIND branches (backporting might affect the issue's scope and/or description)
+  - [ ] Prepare a standalone patch for the last stable release of each affected (and still maintained) BIND branch
 
-[checklist_explanations]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations
+### Release-specific actions
 
-### Earlier Than T-5
+  - [ ] Create/update the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
+  - [ ] Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
+  - [ ] Ensure the merge requests containing CVE fixes are merged into `security-*` branches in CVE identifier order
 
-  - [ ] [:link:][step_deputy]            **(IM)** Pick a Deputy Incident Manager
-  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
-  - [ ] [:link:][step_etherpad]          **(IM)** Create an Etherpad for post-mortem
-  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
-  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
-  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
-  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
-  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
-  - [ ] [:link:][step_earliest]          **(Support)** Prepare and send out "earliest" notifications
-  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
-  - [ ] [:link:][step_reproducer_mr]     **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
-  - [ ] [:link:][step_notify_support]    **(SwEng)** Notify Support when a reproducer is ready
-  - [ ] [:link:][step_code_analysis]     **(SwEng)** Prepare a detailed explanation of the code flow triggering the problem
-  - [ ] [:link:][step_fix_mr]            **(SwEng)** Prepare a private merge request with the fix
-  - [ ] [:link:][step_review_fix]        **(SwEng)** Ensure the merge request with the fix is reviewed and has no outstanding discussions
-  - [ ] [:link:][step_review_docs]       **(Support)** Review the documentation changes introduced by the merge request with the fix
-  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
-  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
-  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] [:link:][step_changes]           **(QA)** (BIND 9 only) Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
-  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
-  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
-  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)
+### Post-disclosure actions
 
-### At T-5
-
-  - [ ] [:link:][step_send_asn]          **(Support)** Send ASN to eligible customers
-  - [ ] [:link:][step_preannouncement]   **(Support)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
-
-### At T-4
-
-  - [ ] [:link:][step_verify_asn]        **(Support)** Verify that all ASN-eligible customers have received the notification email
-
-### At T-1
-
-  - [ ] [:link:][step_check_customers]   **(Support)** Verify that any new or reinstated customers have received the notification email
-  - [ ] [:link:][step_packager_emails]   **(First IM)** Send notifications to OS packagers
-
-### On the Day of Public Disclosure
-
-  - [ ] [:link:][step_clearance]         **(IM)** Grant Support clearance to proceed with public release
-  - [ ] [:link:][step_publish]           **(Support)** Publish the releases (as outlined in the release checklist)
-  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Update vulnerability matrix in the Knowledge Base
-  - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
-  - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
-  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
-  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
-  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
-  - [ ] [:link:][step_customers]         **(Support)** Inform customers a fix has been released
-
-### After Public Disclosure
-
-  - [ ] [:link:][step_postmortem]        **(First IM)** Organize post-mortem meeting and make sure it happens
-  - [ ] [:link:][step_tickets]           **(Support)** Close support tickets
-  - [ ] [:link:][step_regression]        **(QA)** Merge a regression test reproducing the bug into all affected (and still maintained) branches
-
-[step_deputy]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
-[step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
-[step_etherpad]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-an-etherpad-for-post-mortem
-[step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
-[step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
-[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
-[step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
-[step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
-[step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
-[step_earliest]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-and-send-out-earliest-notifications
-[step_advisory_mr]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
-[step_reproducer_mr]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
-[step_notify_support]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
-[step_code_analysis]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-detailed-explanation-of-the-code-flow-triggering-the-problem
-[step_fix_mr]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-with-the-fix
-[step_review_fix]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-the-merge-request-with-the-fix-is-reviewed-and-has-no-outstanding-discussions
-[step_review_docs]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#review-the-documentation-changes-introduced-by-the-merge-request-with-the-fix
-[step_backports]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-backports-of-the-merge-request-addressing-the-problem-for-all-affected-and-still-maintained-branches-of-a-given-product
-[step_finish_advisory]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#finish-preparing-the-security-advisory
-[step_meta_issue]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-or-update-the-private-issue-containing-links-to-fixes-reproducers-for-all-cves-fixed-in-a-given-release-cycle
-[step_changes]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-reserve-a-block-of-changes-placeholders-once-the-complete-set-of-vulnerabilities-fixed-in-a-given-release-cycle-is-determined
-[step_merge_fixes]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
-[step_patches]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
-[step_asn_releases]:      https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
-[step_send_asn]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-asn-to-eligible-customers
-[step_preannouncement]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
-[step_verify_asn]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-all-asn-eligible-customers-have-received-the-notification-email
-[step_check_customers]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#verify-that-any-new-or-reinstated-customers-have-received-the-notification-email
-[step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
-[step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-support-clearance-to-proceed-with-public-release
-[step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
-[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-vulnerability-matrix-in-the-knowledge-base
-[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
-[step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
-[step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
-[step_merge_advisory]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
-[step_embargo_end]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
-[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-customers-a-fix-has-been-released
-[step_postmortem]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#organize-post-mortem-meeting-and-make-sure-it-happens
-[step_tickets]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#close-support-tickets
-[step_regression]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches
+  - [ ] Merge a regression test reproducing the bug into all affected (and still maintained) BIND branches

.gitlab/issue_templates/Release.md

@@ -36,6 +36,7 @@
  - [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
  - [ ] ***(QA)*** Ensure that there are no outstanding merge requests in the private repository[^1] (Subscription Edition only).
  - [ ] ***(QA)*** Ensure all merge requests marked for backporting have been indeed backported.
+ - [ ] ***(QA)*** Update GitLab settings for all maintained branches to disallow merging to them.
  - [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is in effect.
 
 ### Before the Tagging Deadline
@@ -45,24 +46,21 @@
  - [ ] ***(QA)*** Add a release marker to `CHANGES.SE` (Subscription Edition only).
  - [ ] ***(QA)*** Update BIND 9 version in `configure.ac` (9.18+) or `version` (9.16).
  - [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org` (9.16).
- - [ ] ***(QA)*** Update GitLab settings for all maintained branches to disallow merging to them.
  - [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9_x_y`).
 
 ### Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
 
  - [ ] ***(QA)*** Check that the formatting is correct for HTML and PDF versions of release notes.
  - [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
- - [ ] ***(QA)*** Verify GitLab CI results for the tags created and sign off on the releases to be published.
+ - [ ] ***(QA)*** Verify GitLab CI results for the tags created and prepare a QA report for the releases to be published.
  - [ ] ***(QA)*** Update GitLab settings for all maintained branches to allow merging to them again.
  - [ ] ***(QA)*** Prepare and merge MRs resetting the release notes and updating the version string for each maintained branch.
  - [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is over.
  - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums.
- - [ ] ***(Signers)*** Ensure that the contents of tarballs and tags are identical.
  - [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
  - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again.
  - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
  - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages.
- - [ ] ***(QA)*** Prepare the `patches/` subdirectory for each security release (if applicable).
  - [ ] ***(QA)*** Notify Support that the releases have been prepared.
  - [ ] ***(Support)*** Send out ASNs (if applicable).
 
@@ -88,9 +86,7 @@
  - [ ] ***(QA)*** Merge published release tags (non-linearly) back into the their relevant development/maintenance branches.
  - [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
  - [ ] ***(QA)*** Sanitize confidential issues which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
- - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Black, PyLint, Sphinx) by modifying the relevant `Dockerfile`.
- - [ ] ***(QA)*** Run a pipeline to rebuild all [images](https://gitlab.isc.org/isc-projects/images) used in GitLab CI.
- - [ ] ***(QA)*** Update [`metadata.json`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/metadata.json) with the upcoming release information.
+ - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.
 
 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
 [^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.

.lgtm.yml

@@ -0,0 +1,35 @@
+extraction:
+  cpp:
+    prepare:
+      packages:
+      - "libxml2-dev"
+      - "libjson-c-dev"
+      - "libssl-dev"
+      - "zlib1g-dev"
+      - "libcmocka-dev"
+      - "pkg-config"
+      - "libcap2-dev"
+      - "libedit-dev"
+      - "libidn2-dev"
+      - "libmaxminddb-dev"
+      - "libuv1-dev"
+      - "libnghttp2-dev"
+    configure:
+      command:
+      - "autoreconf -fi"
+      - "CFLAGS=\"-Og -g\" ./configure --enable-developer"
+path_classifiers:
+  test:
+    - "lib/*/tests/"
+    - "bin/tests/"
+  docs:
+    - "**/*.xml"
+    - "**/*.docbook"
+    - "**/*.html"
+    - "**/*.1"
+    - "**/*.5"
+    - "**/*.8"
+queries:
+  - exclude: fuzz/
+  - exclude: "bin/tests/system/*/ans*/*.py"
+  - exclude: cpp/use-of-goto

.reuse/dep5

@@ -42,11 +42,6 @@ Files: **/*.after*
        bin/tests/system/formerr/nametoolong
        bin/tests/system/formerr/noquestions
        bin/tests/system/formerr/twoquestions
-       bin/tests/system/forward/CA/CA.cfg
-       bin/tests/system/forward/CA/README
-       bin/tests/system/forward/CA/index.txt
-       bin/tests/system/forward/CA/index.txt.attr
-       bin/tests/system/forward/CA/serial
        bin/tests/system/journal/ns1/managed-keys.bind.in
        bin/tests/system/journal/ns1/managed-keys.bind.jnl.in
        bin/tests/system/journal/ns2/managed-keys.bind.in
@@ -54,11 +49,6 @@ Files: **/*.after*
        bin/tests/system/keepalive/expected
        bin/tests/system/legacy/ns6/edns512.db.signed
        bin/tests/system/legacy/ns7/edns512-notcp.db.signed
-       bin/tests/system/nsupdate/CA/CA.cfg
-       bin/tests/system/nsupdate/CA/README
-       bin/tests/system/nsupdate/CA/index.txt
-       bin/tests/system/nsupdate/CA/index.txt.attr
-       bin/tests/system/nsupdate/CA/serial
        bin/tests/system/nsupdate/commandlist
        bin/tests/system/nsupdate/verylarge.in
        bin/tests/system/org.isc.bind.system.plist
@@ -157,7 +147,6 @@ Files: **/.clang-format
        .clang-format
        .clang-format.headers
        .dir-locals.el
-       .git-blame-ignore-revs
        .gitattributes
        .gitignore
        .gitlab-ci.yml
@@ -168,7 +157,6 @@ Files: **/.clang-format
        doc/misc/options
        doc/misc/rndc.grammar
        tsan-suppressions.txt
-       sonar-project.properties
 Copyright: Internet Systems Consortium, Inc. ("ISC")
 License: CC0-1.0
 

AUTHORS

@@ -51,4 +51,3 @@ Anay Panvalkar
 colleen
 Robert Edmonds
 João Damas
-Artem Boldariev (Артем Болдарєв)

CHANGES

@@ -1,598 +1,3 @@
-	--- 9.19.11 released ---
-
-6120.	[bug]		Use two pairs of dns_db_t and dns_dbversion_t in a
-			catalog zone structure to avoid a race between the
-			dns__catz_update_cb() and dns_catz_dbupdate_callback()
-			functions. [GL #3907]
-
-6119.	[bug]		Make sure to revert the reconfigured zones to the
-			previous version of the view, when the new view
-			reconfiguration fails during the configuration of
-			one of the configured zones. [GL #3911]
-
-6118.	[func]		Add 'cds-digest-types' configuration option. Also allow
-			dnssec-signzone to create multple CDS records.
-			[GL #3837]
-
-6117.	[func]		Add a qp-trie data structure. This is a foundation for
-			our plan to replace, in stages, BIND's red-black tree.
-			The qp-trie has lock-free multithreaded reads, using
-			QSBR for safe memory reclamation. [GL !7130]
-
-6116.	[placeholder]
-
-6115.	[bug]		Unregister db update notify callback before detaching
-			from the previous db inside the catz update notify
-			callback. [GL #3777]
-
-6114.	[func]		Run the catalog zone update process on the offload
-			threads. [GL #3881]
-
-6113.	[func]		Add shutdown signaling for catalog zones. [GL !7571]
-
-6112.	[func]		Add reference count tracing for dns_catz_zone_t and
-			dns_catz_zones_t. [GL !7570]
-
-6111.	[cleanup]	Move irs_resconf into libdns, and remove the
-			now empty libirs. [GL !7463]
-
-6110.	[cleanup]	Refactor the dns_xfrin module to use dns_dispatch
-			to set up TCP connections and send and receive
-			messages. [GL #3886]
-
-6109.	[func]		Infrastructure for QSBR, asynchronous safe memory
-			reclamation for lock-free data structures. [GL !7471]
-
-6108.	[func]		Support for simple lock-free singly-linked stacks.
-			[GL !7470]
-
-6107.	[cleanup]	Remove the dns_sdb API and rewrite the named
-			builtin databases to implement dns_db directly.
-			[GL #3882]
-
-6106.	[cleanup]	Move bind9_getaddresses() to isc_getaddresses()
-			and remove the now empty libbind9. [GL !7462]
-
-6105.	[bug]		Detach 'rpzs' and 'catzs' from the previous view in
-			configure_rpz() and configure_catz(), respectively,
-			just after attaching it to the new view. [GL #3880]
-
-6104.	[cleanup]	Move libbind9's configuration checking code into
-			libisccfg alongside the other configuration code.
-			[GL !7461]
-
-6103.	[func]		All uses of the isc_task and isc_event APIs have
-			been refactored to use isc_loop instead, and the
-			original APIs have been removed. [GL #3797]
-
-6102.	[cleanup]	Several nugatory headers have been removed from libisc.
-			[GL !7464]
-
-6101.	[port]		Clarify the portability dodge needed for `strerror_r()`
-			[GL !7465]
-
-6100.	[cleanup]	Deprecate <isc/deprecated.h>, because obsolete
-			functions are now deleted instead of marked with
-			an attribute. [GL !7466]
-
-6099.	[performance]	Change the internal read-write lock to modified C-RW-WP
-			algorithm that is more reader-writer fair and has better
-			performance for our workloads. [GL #1609]
-
-6098.	[test]		Don't test HMAC-MD5 when not supported by libcrypto.
-			[GL #3871]
-
-6097.	[port]		Improve support for yield / pause instructions in spin
-			loops on AArch64 platforms. [GL !7469]
-
-6096.	[bug]		Fix RPZ reference counting error on shutdown in
-			dns__rpz_timer_cb(). [GL #3866]
-
-6095.	[test]		Test various 'islands of trust' configurations when
-			using managed keys. [GL #3662]
-
-6094.	[bug]		Building against (or running with) libuv versions
-			1.35.0 and 1.36.0 is now a fatal error.  The rules for
-			mixing and matching compile-time and run-time libuv
-			versions have been tightened for libuv versions between
-			1.35.0 and 1.40.0. [GL #3840]
-
-6093.	[performance]	Reduce the size of each rdataset header object
-			by 16 bytes. [GL !7505]
-
-6092.	[bug]		dnssec-cds failed to cleanup properly. [GL #3831]
-
-6091.	[cleanup]	Drop RHEL 7 and clones support. [GL #3729]
-
-6090.	[bug]		Fix a bug in resolver's resume_dslookup() function by
-			making sure that dns_resolver_createfetch() is called
-			with valid parameters, as required by the function.
-			[GL #3839]
-
-6089.	[bug]		Source ports configured for query-source,
-			transfer-source, etc, were being ignored. (This
-			feature is deprecated, but it is not yet removed,
-			so the bug still needed fixing.) [GL #3790]
-
-6088.	[cleanup]	/etc/bind.keys is no longer needed and has been
-			removed from the distribution. named and delv can
-			still load keys from a file for testing purposes,
-			but they no longer do so by default. [GL #3850]
-
-6087.	[cleanup]	Remove support for the `DNS_NAME_DOWNCASE` option to
-			the various dns_*_fromwire() functions. It has long
-			been unused and is unsupported since change 6022.
-			[GL !7467]
-
-6086.	[cleanup]	Remove some remnants of bitstring labels. [GL !7196]
-
-6085.	[func]		Add isc_time_monotonic() to simplify time measurements.
-			[GL !7468]
-
-6084.	[bug]		When BIND was built without jemalloc, the allocator flag
-			ISC_MEM_ZERO could return non-zero memory. [GL #3845]
-
-	--- 9.19.10 released ---
-
-6083.	[bug]		Fix DNSRPS-enabled builds as they were inadvertently
-			broken by changes 5949 and 6042. [GL #3827]
-
-6082.	[test]		fuzz/dns_message_checksig leaked memory when shutting
-			down. [GL #3828]
-
-6081.	[bug]		Handle primary server address lookup failures in
-			nsupdate more gracefully. [GL #3830]
-
-6080.	[bug]		'named -V' leaked memory. [GL #3829]
-
-6079.	[bug]		Force set the DS state after a 'rdnc dnssec -checkds'
-			command. [GL #3822]
-
-6078.	[func]		Cleanup the memory statistic counters to a bare
-			minumum - InUse with Malloced as alias. [GL #3718]
-
-6077.	[func]		Implement query forwarding to DoT-enabled upstream
-			servers. [GL #3726]
-
-6076.	[bug]		Handle OS errors when creating UDP and TCP sockets
-			more gracefully. [GL #3800]
-
-6075.	[bug]		Add missing node lock when setting node->wild in
-			add_wildcard_magic. [GL #3799]
-
-6074.	[func]		Refactor the isc_nm_xfr_allowed() function to return
-			isc_result_t instead of boolean. [GL #3808]
-
-6073.	[bug]		Set RD=1 on DS requests to parental-agents. [GL #3783]
-
-6072.	[bug]		Avoid the OpenSSL lock contention when initializing
-			Message Digest Contexts by using explicit algorithm
-			fetching, initializing static contexts for every
-			supported algorithms, and initializing the new context
-			by copying the static copy. [GL #3795]
-
-6071.	[func]		The use of "port" when configuring query-source,
-			transfer-source, notify-source and parental-source
-			addresses has been deprecated, along with the
-			use-v[46]-udp-ports and avoid-v[46]-udp-ports
-			options. A warning will be logged when these
-			options are used. In a future release, they
-			will be removed. [GL #3781]
-
-6070.	[func]		DSCP parsing has now been fully removed, and
-			configuration of DSCP values in named.conf is a
-			configuration error. [GL #3789]
-
-6069.	[bug]		Detach from the view in zone_shutdown() to
-			release the memory held by the dead view
-			early. [GL #3801]
-
-6068.	[bug]		Downloading a zone via TLS from a server which does
-			not negotiate "dot" ALPN token could crash BIND
-			on shutdown. That has been fixed. [GL #3767]
-
-	--- 9.19.9 released ---
-
-6067.	[security]	Fix serve-stale crash when recursive clients soft quota
-			is reached. (CVE-2022-3924) [GL #3619]
-
-6066.	[security]	Handle RRSIG lookups when serve-stale is active.
-			(CVE-2022-3736) [GL #3622]
-
-6065.	[placeholder]
-
-6064.	[security]	An UPDATE message flood could cause named to exhaust all
-			available memory. This flaw was addressed by adding a
-			new "update-quota" statement that controls the number of
-			simultaneous UPDATE messages that can be processed or
-			forwarded. The default is 100. A stats counter has been
-			added to record events when the update quota is
-			exceeded, and the XML and JSON statistics version
-			numbers have been updated. (CVE-2022-3094) [GL #3523]
-
-6063.	[cleanup]	The RSA and ECDSA parts of the DNSSEC has been
-			refactored for a better OpenSSL 3.x integration and
-			preliminary PKCS#11 support via for OpenSSL Providers
-			has been added. [GL #3785]
-
-6062.	[func]		The DSCP implementation, which has been
-			nonfunctional for some time, is now marked as
-			obsolete and the implementation has been removed.
-			Configuring DSCP values in named.conf has no
-			effect, and a warning will be logged that
-			the feature should no longer be used. [GL #3773]
-
-6061.	[bug]		Fix unexpected "Prohibited" extended DNS error
-			on allow-recursion. [GL #3743]
-
-6060.	[bug]		Fix a use-after-free bug in dns_zonemgr_releasezone()
-			by detaching from the zone manager outside of the write
-			lock. [GL #3768]
-
-6059.	[bug]		In some serve stale scenarios, like when following an
-			expired CNAME record, named could return SERVFAIL if the
-			previous request wasn't successful. Consider non-stale
-			data when in serve-stale mode. [GL #3678]
-
-6058.	[bug]		Prevent named from crashing when "rndc delzone"
-			attempts to delete a zone added by a catalog zone.
-			[GL #3745]
-
-6057.	[bug]		Fix shutdown and error path bugs in the rpz unit.
-			[GL #3735]
-
-6056.	[bug]		Fix a race in adb.c:clean_namehooks(), so that an ADB
-			entry does not expire without holding the entries lock.
-			[GL #3754]
-
-6055.	[cleanup]	Remove setting alternate transfer sources, make options
-			alt-transfer-source, alt-transfer-transfer-source-v6,
-			and use-alt-transfer-source ancient. [GL #3714]
-
-6054.	[func]		Refactor remote servers (primaries, parental-agents)
-			in zone.c. Store common code in new source files
-			remote.c and remote.h. Introduce a new way to set the
-			source address and port. [GL !7110]
-
-6053.	[bug]		Fix an ADB quota management bug in resolver. [GL #3752]
-
-6052.	[func]		Replace DNS over TCP and DNS over TLS transports
-			code with a new, unified transport implementation.
-			[GL #3374]
-
-6051.	[bug]		Improve thread safety in the dns_dispatch unit.
-			[GL #3178] [GL #3636]
-
-6050.	[bug]		Changes to the RPZ response-policy min-update-interval
-			and add-soa options now take effect as expected when
-			named is reconfigured. [GL #3740]
-
-6049.	[bug]		Exclude ABD hashtables from the ADB memory
-			overmem checks and don't clean ADB names
-			and ADB entries used in the last 10 seconds
-			(ADB_CACHE_MINIMUM). [GL #3739]
-
-6048.	[bug]		Fix a log message error in dns_catz_update_from_db(),
-			where serials with values of 2^31 or larger were logged
-			incorrectly as negative numbers. [GL #3742]
-
-6047.	[bug]		Try the next server instead of trying the same
-			server again on an outgoing query timeout.
-			[GL #3637]
-
-6046.	[bug]		TLS session resumption might lead to handshake
-			failures when client certificates are used for
-			authentication (Mutual TLS).  This has been fixed.
-			[GL #3725]
-
-6045.	[cleanup]	The list of supported DNSSEC algorithms changed log
-			level from "warning" to "notice" to match named's other
-			startup messages. [GL !7217]
-
-6044.	[bug]		There was an "RSASHA236" typo in a log message.
-			[GL !7206]
-
-	--- 9.19.8 released ---
-
-6043.	[bug]		The key file IO locks objects would never get
-			deleted from the hashtable due to off-by-one error.
-			[GL #3727]
-
-6042.	[bug]		ANY responses could sometimes have the wrong TTL.
-			[GL #3613]
-
-6041.	[func]		Set the RLIMIT_NOFILE to rlim_max returned from
-			getrlimit() instead of trying to guess the maximum
-			allowed value. [GL #3676]
-
-6040.	[bug]		Speed up the named shutdown time by explicitly
-			canceling all recursing ns_client objects for
-			each ns_clientmgr. [GL #3183]
-
-6039.	[bug]		Removing a catalog zone from catalog-zones without
-			also removing the referenced zone could leave a
-			dangling pointer. [GL #3683]
-
-6038.	[placeholder]
-
-6037.	[func]		Reject zones which have DS records not at delegation
-			points. [GL #3697]
-
-6036.	[bug]		nslookup and host were not honoring the selected port
-			in TCP mode. [GL #3721]
-
-6035.	[bug]		Refactor the dns_resolver unit to store the fetch
-			contexts and zone counter directly in the hash
-			tables without buckets and implement effective
-			cleaning of both objects. [GL #3709]
-
-6034.	[func]		Deprecate alt-transfer-source, alt-transfer-source-v6
-			and use-alt-transfer-source. [GL #3694]
-
-6033.	[func]		Log messages related to serve-stale now include the RR
-			type involved. [GL !7145]
-
-6032.	[bug]		After change 5995, zone transfers were using a small
-			compression context that only had space for the first
-			few dozen names in each message. They now use a large
-			compression context with enough space for every name.
-			[GL #3706]
-
-6031.	[bug]		Move the "final reference detached" log message
-			from dns_zone unit to the DEBUG(1) log level.
-			[GL #3707]
-
-6030.	[bug]		Refactor the ADB to use a global LRU queue, store
-			the ADB names and ADB entries directly in the hash
-			tables instead of buckets, and properly clean the
-			ADB names and entries when not in use. [GL #3239]
-			[GL #3238] [GL #2615] [GL #2078] [GL #2437]
-			[GL #3312] [GL #2441]
-
-6029.	[cleanup]	Remove the unused external cache cleaning mechanism
-			as RBTDB has its own internal cache cleaning
-			mechanism and we don't support any other database
-			implementations. [GL #3639]
-
-6028.	[performance]	Build-time code generation of DNS RRtype switches
-			is now much faster. [GL !7121]
-
-6027.	[bug]		Fix assertion failure in isc_http API used by
-			statschannel if the read callback would be called
-			on HTTP request that has been already closed.
-			[GL #3693]
-
-6026.	[cleanup]	Deduplicate time unit conversion factors.
-			[GL !7033]
-
-6025.	[bug]		Copy TLS identifier when setting up primaries for
-			catalog member zones. [GL #3638]
-
-6024.	[func]		Deprecate 'auto-dnssec'. [GL #3667]
-
-6023.	[func]		Remove dynamic update DNSSEC management feature.
-			[GL #3686]
-
-6022.	[performance]	The decompression implementation in dns_name_fromwire()
-			is now smaller and faster. [GL #3655]
-
-6021.	[bug]		Use the current domain name when checking answers from
-			a dual-stack-server. [GL #3607]
-
-6020.	[bug]		Ensure 'named-checkconf -z' respects the check-wildcard
-			option when loading a zone.  [GL #1905]
-
-6019.	[func]		Deprecate `coresize`, `datasize`, `files`, and
-			`stacksize` named.conf options. [GL #3676]
-
-6018.	[cleanup]	Remove the --with-tuning configure option.
-			[GL #3664]
-
-6017.	[bug]		The view's zone table was not locked when it should
-			have been leading to race conditions when external
-			extensions that manipulate the zone table where in
-			use. [GL #3468]
-
-6016.	[func]		Change NSEC3PARAM TTL to match the SOA MINIMUM.
-			[GL #3570]
-
-6015.	[bug]		Some browsers (Firefox) send more than 10 HTTP
-			headers.  Bump the number of allowed HTTP headers
-			to 100. [GL #3670]
-
-6014.	[func]		Add isc_hashmap API implementation that implements
-			Robin Hood hashing.  The API requires the keys to
-			be stored with the stored value.  [GL !6790]
-
-	--- 9.19.7 released ---
-
-6013.	[bug]		Fix a crash that could happen when you change
-			a dnssec-policy zone with NSEC3 to start using
-			inline-signing. [GL #3591]
-
-6012.	[placeholder]
-
-6011.	[func]		Refactor the privilege setting part of named_os unit
-			to make libcap on Linux mandatory and use setreuid
-			and setregid if available. [GL #3583]
-
-6010.	[func]		Make the initial interface scan happen before
-			dropping the privileges.  This requires exiting
-			exclusive mode before scanning the interfaces
-			and re-entering it again when we are done.  This
-			is because starting the listening on interfaces
-			requires the loopmgr to be running and not paused.
-			[GL #3583]
-
-6009.	[bug]		Don't trust a placeholder KEYDATA from the managed-keys
-			zone by adding it into secroots. [GL #2895]
-
-6008.	[bug]		Fixed a race condition that could cause a crash
-			in dns_zone_synckeyzone(). [GL #3617]
-
-6007.	[cleanup]	Don't enforce the jemalloc use on NetBSD. [GL #3634]
-
-6006.	[cleanup]	The zone dumping was using isc_task API to launch
-			the zonedump on the offloaded threadpool.  Remove
-			the task and launch the offloaded work directly.
-			[GL #3628]
-
-6005.	[func]		The zone loading has been moved to the offload
-			threadpool instead of doing incremental repeated
-			tasks, so zone loading scheduling is now driven
-			by the operating system scheduler rather than fixed
-			(100) quantum. [GL #3625]
-
-6004.	[func]		Add check-svcb to control the checking of additional
-			constraints on SVBC records.  This change impacts on
-			named, named-checkconf, named-checkzone,
-			named-compilezone and nsupdate. [GL #3576]
-
-6003.	[bug]		Fix an inheritance bug when setting the port on
-			remote servers in configuration. [GL #3627]
-
-6002.	[bug]		Fix a resolver prefetch bug when the record's TTL value
-			is equal to the configured prefetch eligibility value,
-			but the record was erroneously not treated as eligible
-			for prefetching. [GL #3603]
-
-6001.	[bug]		Always call dns_adb_endudpfetch() after calling
-			dns_adb_beginudpfetch() for UDP queries in resolver.c,
-			in order to adjust back the quota. [GL #3598]
-
-6000.	[bug]		Fix a startup issue on Solaris systems with many
-			(reportedly > 510) CPUs. Thanks to Stacey Marshall from
-			Oracle for deep investigation of the problem. [GL #3563]
-
-5999.	[bug]		rpz-ip rules could be ineffective in some scenarios
-			with CD=1 queries. [GL #3247]
-
-5998.	[placeholder]
-
-5997.	[cleanup]	Less ceremonial UNEXPECTED_ERROR() and FATAL_ERROR()
-			reporting macros. [GL !6914]
-
-5996.	[bug]		Fix a couple of bugs in cfg_print_duration(), which
-			could result in generating incomplete duration values
-			when printing the configuration using named-checkconf.
-			[GL !6880]
-
-5995.	[performance]	A new algorithm for DNS name compression based on a
-			hash set of message offsets. Name compression is now
-			more complete as well as being generally faster, and
-			the implementation is less complicated and requires
-			much less memory. [GL !6517]
-
-5994.	[func]		Refactor the isc_httpd implementation used in the
-			statistics channel. [GL !6879]
-
-5993.	[cleanup]	Store dns_name_t attributes as boolean members of
-			the structure. Remove DNS_NAMEATTR_* macros.
-			Fix latent attribute handling bug in RBT. [GL !6902]
-
-	--- 9.19.6 released ---
-
-5992.	[func]		Introduce the new isc_mem_*x() APIs that takes extra
-			flags as the last argument.  Currently ISC_MEM_ZERO
-			and ISC_MEM_ALIGN(n) flags have been implemented that
-			clears the memory to avoid the isc_mem_get()/memset()
-			pattern and make aligned allocation which replaces the
-			previous isc_mem_*_aligned() calls. [GL !6398]
-
-5991.	[protocol]	Add support for parsing and validating "dohpath" to
-			SVCB. [GL #3544]
-
-5990.	[test]		fuzz/dns_message_checksig now creates the key directory
-			it uses when testing in /tmp at run time. [GL #3569]
-
-5989.	[func]		Implement support for DDNS update forwarding using DoT
-			to TLS-enabled primary servers. [GL #3512]
-
-5988.	[bug]		Some out of memory conditions in opensslrsa_link.c
-			could lead to memory leaks. [GL #3551]
-
-5987.	[func]		Provide custom isc_mem based allocators for libuv,
-			OpenSSL and libxml2 libraries that support replacing
-			the internal allocators. [GL #3559]
-
-5986.	[func]		Make the memory context debugging options local to
-			the memory context and make it immutable for the memory
-			context lifetime. [GL #3559]
-
-5985.	[func]		Bump the minimal libuv version to 1.34.0. [GL #3567]
-
-5984.	[func]		'named -V' now reports the list of supported
-			DNSSEC/DS/HMAC algorithms and the supported TKEY modes.
-			[GL #3541]
-
-5983.	[bug]		Changing just the TSIG key names for primaries in
-			catalog zones' member zones was not effective.
-			[GL #3557]
-
-5982.	[func]		Extend dig to allow requests to be signed using SIG(0)
-			as well as providing a mechanism to specify the signing
-			time. [GL !5923]
-
-5981.	[test]		Add dns_message_checksig fuzzer to check messages
-			signed using TSIG or SIG(0). [GL !5923]
-
-5980.	[func]		The internal isc_entropy API provider has been
-			changed from OpenSSL RAND_bytes() to uv_random()
-			to use system provided entropy. [GL !6803]
-
-5979.	[func]		Implement DoT support for nsupdate. [GL #1781]
-
-5978.	[port]		The ability to use pkcs11 via engine_pkcs11 has been
-			restored, by only using deprecated APIs in
-			OpenSSL 3.0.0. BIND needs to be compiled with
-			'-DOPENSSL_API_COMPAT=10100' specified in the CFLAGS
-			at compile time. [GL !6711]
-
-5977.	[bug]		named could incorrectly return non-truncated, glueless
-			referrals for responses whose size was close to the UDP
-			packet size limit. [GL #1967]
-
-5976.	[cleanup]	isc_timer_t objects are now created, started and
-			destroyed in a particular loop, and timer callbacks
-			run in that loop. isc_timer_stop() can still be called
-			from any loop; when run from a different loop than
-			the one associated with the timer, the request will
-			be recorded in atomic variable and the timer will
-			be stopped on the next callback call. [GL #3202]
-
-5975.	[func]		Implement TLS transport support for dns_request and
-			dns_dispatch. [GL #3529]
-
-5974.	[bug]		Fix an assertion failure in dispatch caused by
-			extra read callback call. [GL #3545]
-
-5973.	[bug]		Fixed a possible invalid detach in UPDATE
-			processing. [GL #3522]
-
-5972.	[bug]		Gracefully handle when the statschannel HTTP connection
-			gets cancelled during sending data back to the client.
-			[GL #3542]
-
-5971.	[func]		Add libsystemd sd_notify() support. [GL #1176]
-
-5970.	[func]		Log the reason why a query was refused. [GL !6669]
-
-5969.	[bug]		DNSSEC signing statistics failed to identify the
-			algorithm involved.  The key names have been changed
-			to be the algorithm number followed by "+" followed
-			by the key id (e.g. "8+54274"). [GL #3525]
-
-5968.	[cleanup]	Remove 'resolve' binary from tests. [GL !6733]
-
-5967.	[cleanup]	Flagged the obsolete "random-device" option as
-			ancient; it is now an error to configure it. [GL #3399]
-
-5966.	[func]		You can now specify if a server must return a DNS
-			COOKIE before accepting the response over UDP.
-			[GL #2295]
-
-			server <prefix> { require-cookie <yes_or_no>; };
-
 5965.	[cleanup]	Move the duplicated ASCII case conversion tables to
 			isc_ascii where they can be shared, and replace the
 			various hot-path tolower() loops with calls to new
@@ -605,32 +10,17 @@
 5963.	[bug]		Ensure struct named_server is properly initialized.
 			[GL #6531]
 
-	--- 9.19.5 released ---
-
-5962.	[security]	Fix memory leak in EdDSA verify processing.
-			(CVE-2022-38178) [GL #3487]
+5962.	[placeholder]
 
 5961.	[placeholder]
 
-5960.	[security]	Fix serve-stale crash that could happen when
-			stale-answer-client-timeout was set to 0 and there was
-			a stale CNAME in the cache for an incoming query.
-			(CVE-2022-3080) [GL #3517]
+5960.	[placeholder]
 
-5959.	[security]	Fix memory leaks in the DH code when using OpenSSL 3.0.0
-			and later versions. The openssldh_compare(),
-			openssldh_paramcompare(), and openssldh_todns()
-			functions were affected. (CVE-2022-2906) [GL #3491]
+5959.	[placeholder]
 
-5958.	[security]	When an HTTP connection was reused to get
-			statistics from the stats channel, and zlib
-			compression was in use, each successive
-			response sent larger and larger blocks of memory,
-			potentially reading past the end of the allocated
-			buffer. (CVE-2022-2881) [GL #3493]
+5958.	[placeholder]
 
-5957.	[security]	Prevent excessive resource use while processing large
-			delegations. (CVE-2022-2795) [GL #3394]
+5957.	[placeholder]
 
 5956.	[func]		Make RRL code treat all QNAMEs that are subject to
 			wildcard processing within a given zone as the same
@@ -1147,9 +537,7 @@
 			when the resent query's result was SERVFAIL. [GL #3020]
 
 5830.	[func]		Implement incremental resizing of isc_ht hash tables to
-			perform the rehashing gradually. The catalog zone
-			implementation has been optimized to work with hundreds
-			of thousands of member zones. [GL #3212] [GL #3744]
+			perform the rehashing gradually. [GL #3212]
 
 5829.	[func]		Refactor and simplify isc_timer API in preparation
 			for further refactoring on top of network manager

COPYRIGHT

@@ -1,4 +1,4 @@
-Copyright (C) 1996-2023  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2022  Internet Systems Consortium, Inc. ("ISC")
 
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this

Makefile.am

@@ -1,25 +1,22 @@
 include $(top_srcdir)/Makefile.top
 
-SUBDIRS = . lib doc
+SUBDIRS = . lib doc bin fuzz
 
-# build libtest before fuzz/* and bin/tests
 if HAVE_CMOCKA
 SUBDIRS += tests
 endif HAVE_CMOCKA
 
-# run fuzz tests before system tests
-SUBDIRS += fuzz bin
-
 BUILT_SOURCES = bind.keys.h
 CLEANFILES = bind.keys.h
 
 bind.keys.h: bind.keys Makefile
 	${PERL} ${top_srcdir}/util/bindkeys.pl ${top_srcdir}/bind.keys > $@
 
+dist_sysconf_DATA = bind.keys
+
 .PHONY: doc
 
 EXTRA_DIST =			\
-	bind.keys		\
 	util/bindkeys.pl	\
 	contrib			\
 	CHANGES			\

Makefile.docs

@@ -2,7 +2,6 @@ SPHINX_V = $(SPHINX_V_@AM_V@)
 SPHINX_V_ = $(SPHINX_V_@AM_DEFAULT_V@)
 SPHINX_V_0 = -q
 SPHINX_V_1 = -n
-SPHINX_W = -W
 
 AM_V_SPHINX = $(AM_V_SPHINX_@AM_V@)
 AM_V_SPHINX_ = $(AM_V_SPHINX_@AM_DEFAULT_V@)
@@ -14,13 +13,14 @@ LF = \n
 RNDC_CONF = .. |rndc_conf| replace:: ``$(sysconfdir)/rndc.conf``
 RNDC_KEY = .. |rndc_key| replace:: ``$(sysconfdir)/rndc.key``
 NAMED_CONF = .. |named_conf| replace:: ``$(sysconfdir)/named.conf``
+BIND_KEYS = .. |bind_keys| replace:: ``$(sysconfdir)/bind.keys``
 NAMED_PID = .. |named_pid| replace:: ``$(runstatedir)/named.pid``
 SESSION_KEY = .. |session_key| replace:: ``$(runstatedir)/session.key``
 
 export RST_EPILOG = $(RNDC_CONF)$(LF)$(RNDC_KEY)$(LF)$(NAMED_CONF)$(LF)$(BIND_KEYS)$(LF)$(NAMED_PID)$(LF)$(SESSION_KEY)
 
 common_SPHINXOPTS =			\
-	$(SPHINX_W)			\
+	-W				\
 	-c $(srcdir)			\
 	-a				\
 	$(SPHINX_V)

Makefile.top

@@ -40,6 +40,12 @@ LIBNS_CFLAGS = \
 LIBNS_LIBS = \
 	$(top_builddir)/lib/ns/libns.la
 
+LIBIRS_CFLAGS = \
+	-I$(top_srcdir)/lib/irs/include
+
+LIBIRS_LIBS = \
+	$(top_builddir)/lib/irs/libirs.la
+
 LIBISCCFG_CFLAGS = \
 	-I$(top_srcdir)/lib/isccfg/include
 
@@ -51,3 +57,9 @@ LIBISCCC_CFLAGS = \
 
 LIBISCCC_LIBS = \
 	$(top_builddir)/lib/isccc/libisccc.la
+
+LIBBIND9_CFLAGS = \
+	-I$(top_srcdir)/lib/bind9/include
+
+LIBBIND9_LIBS = \
+	$(top_builddir)/lib/bind9/libbind9.la

OPTIONS.md

@@ -26,4 +26,3 @@ Some of these settings are:
 | `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
 | `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
 | `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
-| `-DOPENSSL_API_COMPAT=10100` | Build using the deprecated OpenSSL APIs so that the `engine` API is available when building with OpenSSL 3.0.0 for PKCS#11 support     |

README.md

@@ -125,7 +125,7 @@ including your patch as an attachment, preferably generated by
 ### <a name="build"/> Building BIND 9
 
 For information about building BIND 9, see the
-["Building BIND 9"](doc/arm/build.inc.rst) section in the BIND 9
+["Building BIND 9"](doc/arm/build.rst) section in the BIND 9
 Administrator Reference Manual.
 
 ### <a name="testing"/> Automated testing

bin/check/Makefile.am

@@ -4,7 +4,8 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBNS_CFLAGS)		\
-	$(LIBISCCFG_CFLAGS)
+	$(LIBISCCFG_CFLAGS)	\
+	$(LIBBIND9_CFLAGS)
 
 AM_CPPFLAGS +=			\
 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
@@ -20,7 +21,8 @@ LDADD +=			\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBNS_LIBS)		\
-	$(LIBISCCFG_LIBS)
+	$(LIBISCCFG_LIBS)	\
+	$(LIBBIND9_LIBS)
 
 bin_PROGRAMS = named-checkconf named-checkzone
 

bin/check/check-tool.c

@@ -14,7 +14,6 @@
 /*! \file */
 
 #include <inttypes.h>
-#include <netdb.h>
 #include <stdbool.h>
 #include <stdio.h>
 
@@ -22,6 +21,8 @@
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/net.h>
+#include <isc/netdb.h>
+#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/stdio.h>
@@ -93,7 +94,7 @@ dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
 #if CHECK_SIBLING
 			     DNS_ZONEOPT_CHECKSIBLING |
 #endif /* if CHECK_SIBLING */
-			     DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
+			     DNS_ZONEOPT_CHECKWILDCARD |
 			     DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;
 
 /*
@@ -204,8 +205,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -407,8 +407,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -494,8 +493,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&

bin/check/named-checkconf.c

@@ -24,6 +24,7 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -36,10 +37,11 @@
 #include <dns/rootns.h>
 #include <dns/zone.h>
 
-#include <isccfg/check.h>
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
 
+#include <bind9/check.h>
+
 #include "check-tool.h"
 
 static const char *program = "named-checkconf";
@@ -399,28 +401,6 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		zone_options |= DNS_ZONEOPT_CHECKSPF;
 	}
 
-	obj = NULL;
-	if (get_maps(maps, "check-svcb", &obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			zone_options |= DNS_ZONEOPT_CHECKSVCB;
-		} else {
-			zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
-		}
-	} else {
-		zone_options |= DNS_ZONEOPT_CHECKSVCB;
-	}
-
-	obj = NULL;
-	if (get_maps(maps, "check-wildcard", &obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
-		} else {
-			zone_options &= ~DNS_ZONEOPT_CHECKWILDCARD;
-		}
-	} else {
-		zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
-	}
-
 	obj = NULL;
 	if (get_checknames(maps, &obj)) {
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
@@ -733,7 +713,7 @@ main(int argc, char **argv) {
 		exit(1);
 	}
 
-	result = isccfg_check_namedconf(config, loadplugins, logc, mctx);
+	result = bind9_check_namedconf(config, loadplugins, logc, mctx);
 	if (result != ISC_R_SUCCESS) {
 		exit_status = 1;
 	}

bin/check/named-checkconf.rst

@@ -32,11 +32,10 @@ errors. If no file is specified,
 |named_conf| is read by default.
 
 Note: files that :iscman:`named` reads in separate parser contexts, such as
-``rndc.conf`` or ``rndc.key``, are not automatically read by
-:program:`named-checkconf`.  Configuration errors in these files may cause
-:iscman:`named` to fail to run, even if :program:`named-checkconf` was
-successful.  However, :program:`named-checkconf` can be run on these files
-explicitly.
+``rndc.key`` and ``bind.keys``, are not automatically read by
+:program:`named-checkconf`. Configuration errors in these files may cause
+:iscman:`named` to fail to run, even if :program:`named-checkconf` was successful.
+However, :program:`named-checkconf` can be run on these files explicitly.
 
 Options
 ~~~~~~~

bin/check/named-checkzone.c

@@ -24,8 +24,10 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 
@@ -163,8 +165,8 @@ main(int argc, char **argv) {
 	isc_commandline_errprint = false;
 
 	while ((c = isc_commandline_parse(argc, argv,
-					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
-					  "DF:M:S:T:W:")) != EOF)
+					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:DF:"
+					  "M:S:T:W:")) != EOF)
 	{
 		switch (c) {
 		case 'c':
@@ -359,18 +361,6 @@ main(int argc, char **argv) {
 			workdir = isc_commandline_argument;
 			break;
 
-		case 'C':
-			if (ARGCMP("check-svcb:fail")) {
-				zone_options |= DNS_ZONEOPT_CHECKSVCB;
-			} else if (ARGCMP("check-svcb:ignore")) {
-				zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
-			} else {
-				fprintf(stderr, "invalid argument to -C: %s\n",
-					isc_commandline_argument);
-				exit(1);
-			}
-			break;
-
 		case 'D':
 			dumpzone++;
 			break;
@@ -481,8 +471,7 @@ main(int argc, char **argv) {
 			outputformat = dns_masterformat_raw;
 			rawversion = strtol(outputformatstr + 4, &end, 10);
 			if (end == outputformatstr + 4 || *end != '\0' ||
-			    rawversion > 1U)
-			{
+			    rawversion > 1U) {
 				fprintf(stderr, "unknown raw format version\n");
 				exit(1);
 			}
@@ -521,8 +510,7 @@ main(int argc, char **argv) {
 	}
 
 	if (argc - isc_commandline_index < 1 ||
-	    argc - isc_commandline_index > 2)
-	{
+	    argc - isc_commandline_index > 2) {
 		usage();
 	}
 

bin/check/named-checkzone.rst

@@ -23,7 +23,7 @@ named-checkzone - zone file validation tool
 Synopsis
 ~~~~~~~~
 
-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
 
 Description
 ~~~~~~~~~~~
@@ -68,15 +68,6 @@ Options
 
    This option specifies the class of the zone. If not specified, ``IN`` is assumed.
 
-.. option:: -C mode
-
-   This option controls check mode on zone files when loading.
-   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
-
-   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
-   records and ``check-svcb:ignore`` disables these checks.  The
-   default is ``check-svcb:fail``.
-
 .. option:: -i mode
 
    This option performs post-load zone integrity checks. Possible modes are

bin/check/named-compilezone.rst

@@ -23,7 +23,7 @@ named-compilezone - zone file converting tool
 Synopsis
 ~~~~~~~~
 
-:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
 
 Description
 ~~~~~~~~~~~
@@ -70,15 +70,6 @@ Options
 
    This option specifies the class of the zone. If not specified, ``IN`` is assumed.
 
-.. option:: -C mode
-
-   This option controls check mode on zone files when loading.
-   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
-
-   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
-   records and ``check-svcb:ignore`` disables these checks.  The
-   default is ``check-svcb:fail``.
-
 .. option:: -i mode
 
    This option performs post-load zone integrity checks. Possible modes are
@@ -229,5 +220,5 @@ and 0 otherwise.
 See Also
 ~~~~~~~~
 
-:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-checkzone(8) <named-checkzone>`, :rfc:`1035`,
+:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-checkzone(8) <named-checkzone>`, `:rfc:`1035`,
 BIND 9 Administrator Reference Manual.

bin/confgen/keygen.c

@@ -21,6 +21,7 @@
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 
@@ -33,6 +34,29 @@
 
 #include "util.h"
 
+/*%
+ * Convert algorithm type to string.
+ */
+const char *
+alg_totext(dns_secalg_t alg) {
+	switch (alg) {
+	case DST_ALG_HMACMD5:
+		return ("hmac-md5");
+	case DST_ALG_HMACSHA1:
+		return ("hmac-sha1");
+	case DST_ALG_HMACSHA224:
+		return ("hmac-sha224");
+	case DST_ALG_HMACSHA256:
+		return ("hmac-sha256");
+	case DST_ALG_HMACSHA384:
+		return ("hmac-sha384");
+	case DST_ALG_HMACSHA512:
+		return ("hmac-sha512");
+	default:
+		return ("(unknown)");
+	}
+}
+
 /*%
  * Convert string to algorithm type.
  */
@@ -151,7 +175,7 @@ void
 write_key_file(const char *keyfile, const char *user, const char *keyname,
 	       isc_buffer_t *secret, dns_secalg_t alg) {
 	isc_result_t result;
-	const char *algname = dst_hmac_algorithm_totext(alg);
+	const char *algname = alg_totext(alg);
 	FILE *fd = NULL;
 
 	DO("create keyfile", isc_file_safecreate(keyfile, &fd));

bin/confgen/rndc-confgen.c

@@ -34,6 +34,7 @@
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/net.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -221,7 +222,7 @@ main(int argc, char **argv) {
 	if (keysize < 0) {
 		keysize = alg_bits(alg);
 	}
-	algname = dst_hmac_algorithm_totext(alg);
+	algname = alg_totext(alg);
 
 	isc_mem_create(&mctx);
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));

bin/confgen/tsig-keygen.c

@@ -30,6 +30,7 @@
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/net.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -126,8 +127,7 @@ main(int argc, char **argv) {
 	isc_commandline_errprint = false;
 
 	while ((ch = isc_commandline_parse(argc, argv, "a:hk:Mmr:qs:y:z:")) !=
-	       -1)
-	{
+	       -1) {
 		switch (ch) {
 		case 'a':
 			algname = isc_commandline_argument;
@@ -208,7 +208,7 @@ main(int argc, char **argv) {
 	}
 
 	/* Use canonical algorithm name */
-	algname = dst_hmac_algorithm_totext(alg);
+	algname = alg_totext(alg);
 
 	isc_mem_create(&mctx);
 

bin/confgen/util.c

@@ -19,6 +19,8 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#include <isc/print.h>
+
 extern bool verbose;
 extern const char *progname;
 

bin/delv/Makefile.am

@@ -4,7 +4,8 @@ AM_CPPFLAGS +=				\
 	-I$(top_builddir)/include	\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
-	$(LIBISCCFG_CFLAGS)
+	$(LIBISCCFG_CFLAGS)		\
+	$(LIBIRS_CFLAGS)
 
 AM_CPPFLAGS +=				\
 	-DSYSCONFDIR=\"${sysconfdir}\"
@@ -13,8 +14,8 @@ bin_PROGRAMS = delv
 
 delv_SOURCES =				\
 	delv.c
-
 delv_LDADD =				\
 	$(LIBISC_LIBS)			\
 	$(LIBDNS_LIBS)			\
-	$(LIBISCCFG_LIBS)
+	$(LIBISCCFG_LIBS)		\
+	$(LIBIRS_LIBS)

bin/delv/delv.c

@@ -35,11 +35,12 @@
 #include <isc/mem.h>
 #include <isc/netmgr.h>
 #include <isc/parseint.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/timer.h>
-#include <isc/tls.h>
 #include <isc/util.h>
 
 #include <dns/byaddr.h>
@@ -82,9 +83,7 @@ static isc_log_t *lctx = NULL;
 /* Managers */
 static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
-
-/* TLS */
-static isc_tlsctx_cache_t *tlsctx_client_cache = NULL;
+static isc_taskmgr_t *taskmgr = NULL;
 
 /* Configurables */
 static char *server = NULL;
@@ -122,7 +121,7 @@ static dns_name_t *anchor_name = NULL;
 static dns_master_style_t *style = NULL;
 static dns_fixedname_t qfn;
 
-/* Default trust anchors */
+/* Default bind.keys contents */
 static char anchortext[] = TRUST_ANCHORS;
 
 /*
@@ -465,8 +464,7 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner) {
 			     result = dns_rdataset_next(rdataset))
 			{
 				if ((rdataset->attributes &
-				     DNS_RDATASETATTR_NEGATIVE) != 0)
-				{
+				     DNS_RDATASETATTR_NEGATIVE) != 0) {
 					continue;
 				}
 
@@ -490,8 +488,7 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner) {
 		} else {
 			dns_indent_t indent = { "  ", 2 };
 			if (!yaml && (rdataset->attributes &
-				      DNS_RDATASETATTR_NEGATIVE) != 0)
-			{
+				      DNS_RDATASETATTR_NEGATIVE) != 0) {
 				isc_buffer_putstr(&target, "; ");
 			}
 			result = dns_master_rdatasettotext(
@@ -787,8 +784,7 @@ load_keys(const cfg_obj_t *keys, dns_client_t *client) {
 		keylist = cfg_listelt_value(elt);
 
 		for (elt2 = cfg_list_first(keylist); elt2 != NULL;
-		     elt2 = cfg_list_next(elt2))
-		{
+		     elt2 = cfg_list_next(elt2)) {
 			key = cfg_listelt_value(elt2);
 			CHECK(key_fromconfig(key, client));
 		}
@@ -809,11 +805,16 @@ setup_dnsseckeys(dns_client_t *client) {
 	const cfg_obj_t *managed_keys = NULL;
 	const cfg_obj_t *trust_anchors = NULL;
 	cfg_obj_t *bindkeys = NULL;
+	const char *filename = anchorfile;
 
 	if (!root_validation) {
 		return (ISC_R_SUCCESS);
 	}
 
+	if (filename == NULL) {
+		filename = SYSCONFDIR "/bind.keys";
+	}
+
 	if (trust_anchor == NULL) {
 		trust_anchor = isc_mem_strdup(mctx, ".");
 	}
@@ -824,17 +825,22 @@ setup_dnsseckeys(dns_client_t *client) {
 
 	CHECK(cfg_parser_create(mctx, dns_lctx, &parser));
 
-	if (anchorfile != NULL) {
-		if (access(anchorfile, R_OK) != 0) {
+	if (access(filename, R_OK) != 0) {
+		if (anchorfile != NULL) {
 			fatal("Unable to read key file '%s'", anchorfile);
 		}
-
-		result = cfg_parse_file(parser, anchorfile, &cfg_type_bindkeys,
+	} else {
+		result = cfg_parse_file(parser, filename, &cfg_type_bindkeys,
 					&bindkeys);
 		if (result != ISC_R_SUCCESS) {
-			fatal("Unable to load keys from '%s'", anchorfile);
+			if (anchorfile != NULL) {
+				fatal("Unable to load keys from '%s'",
+				      anchorfile);
+			}
 		}
-	} else {
+	}
+
+	if (bindkeys == NULL) {
 		isc_buffer_t b;
 
 		isc_buffer_init(&b, anchortext, sizeof(anchortext) - 1);
@@ -937,16 +943,14 @@ addserver(dns_client_t *client) {
 		result = ISC_R_SUCCESS;
 		for (cur = res; cur != NULL; cur = cur->ai_next) {
 			if (cur->ai_family != AF_INET &&
-			    cur->ai_family != AF_INET6)
-			{
+			    cur->ai_family != AF_INET6) {
 				continue;
 			}
 			sa = isc_mem_get(mctx, sizeof(*sa));
-			*sa = (isc_sockaddr_t){
-				.length = (unsigned int)cur->ai_addrlen,
-			};
+			memset(sa, 0, sizeof(*sa));
 			ISC_LINK_INIT(sa, link);
 			memmove(&sa->type, cur->ai_addr, cur->ai_addrlen);
+			sa->length = (unsigned int)cur->ai_addrlen;
 			ISC_LIST_APPEND(servers, sa, link);
 		}
 		freeaddrinfo(res);
@@ -1439,8 +1443,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				warn("extra query type");
 			}
 			if (rdtype == dns_rdatatype_ixfr ||
-			    rdtype == dns_rdatatype_axfr)
-			{
+			    rdtype == dns_rdatatype_axfr) {
 				fatal("Transfer not supported");
 			}
 			qtype = rdtype;
@@ -1519,8 +1522,7 @@ preparse_args(int argc, char **argv) {
 
 		/* Look for dash value option. */
 		if (strpbrk(option, dash_opts) != &option[0] ||
-		    strlen(option) > 1U)
-		{
+		    strlen(option) > 1U) {
 			/* Error or value in option. */
 			continue;
 		}
@@ -1558,15 +1560,13 @@ parse_args(int argc, char **argv) {
 		} else if (argv[0][0] == '-') {
 			if (argc <= 1) {
 				if (dash_option(&argv[0][1], NULL,
-						&open_type_class))
-				{
+						&open_type_class)) {
 					argc--;
 					argv++;
 				}
 			} else {
 				if (dash_option(&argv[0][1], argv[1],
-						&open_type_class))
-				{
+						&open_type_class)) {
 					argc--;
 					argv++;
 				}
@@ -1585,8 +1585,7 @@ parse_args(int argc, char **argv) {
 						warn("extra query type");
 					}
 					if (rdtype == dns_rdatatype_ixfr ||
-					    rdtype == dns_rdatatype_axfr)
-					{
+					    rdtype == dns_rdatatype_axfr) {
 						fatal("Transfer not supported");
 					}
 					qtype = rdtype;
@@ -1675,9 +1674,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		/* This is a valid IPv6 address. */
 		dns_fixedname_t fname;
 		dns_name_t *name;
+		unsigned int options = 0;
 
 		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname(&addr, name);
+		result = dns_byaddr_createptrname(&addr, options, name);
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
@@ -1811,7 +1811,7 @@ main(int argc, char *argv[]) {
 	argc--;
 	argv++;
 
-	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
+	isc_managers_create(&mctx, 1, &loopmgr, &netmgr, &taskmgr);
 
 	result = dst_lib_init(mctx, NULL);
 	if (result != ISC_R_SUCCESS) {
@@ -1825,10 +1825,8 @@ main(int argc, char *argv[]) {
 	setup_logging(stderr);
 
 	/* Create client */
-	isc_tlsctx_cache_create(mctx, &tlsctx_client_cache);
-	result = dns_client_create(mctx, loopmgr, netmgr, 0,
-				   tlsctx_client_cache, &client, srcaddr4,
-				   srcaddr6);
+	result = dns_client_create(mctx, loopmgr, taskmgr, netmgr, 0, &client,
+				   srcaddr4, srcaddr6);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
 			 isc_result_totext(result));
@@ -1861,15 +1859,12 @@ cleanup:
 	if (style != NULL) {
 		dns_master_styledestroy(&style, mctx);
 	}
-	if (tlsctx_client_cache != NULL) {
-		isc_tlsctx_cache_detach(&tlsctx_client_cache);
-	}
 
 	isc_log_destroy(&lctx);
 
 	dst_lib_destroy();
 
-	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr, &taskmgr);
 
 	return (0);
 }

bin/delv/delv.rst

@@ -102,21 +102,20 @@ Options
 
 .. option:: -a anchor-file
 
-   This option specifies a file from which to read an alternate
-   DNSSEC root zone trust anchor.
+   This option specifies a file from which to read DNSSEC trust anchors. The default
+   is |bind_keys|, which is included with BIND 9 and contains one
+   or more trust anchors for the root zone (".").
 
-   By default, keys that do not match the root zone name (`.`) are
-   ignored. If an alternate key name is desired, it can be
-   specified using the :option:`+root` option.
+   Keys that do not match the root zone name are ignored. An alternate
+   key name can be specified using the :option:`+root` option.
 
-   Note: When reading trust anchors, :program:`delv` treats
-   ``trust-anchors``, ``initial-key``, and ``static-key`` identically. That
-   is, for a managed key, it is the *initial* key that is trusted;
-   :rfc:`5011` key management is not supported. :program:`delv` does not
-   consult the managed-keys database maintained by :iscman:`named`. This
-   means that if the default key built in to :program:`delv` is revoked,
-   :program:`delv` must be updated to a newer version in order to continue
-   validating.
+   Note: When reading the trust anchor file, :program:`delv` treats ``trust-anchors``,
+   ``initial-key``, and ``static-key`` identically. That is, for a managed key,
+   it is the *initial* key that is trusted; :rfc:`5011` key management is not
+   supported. :program:`delv` does not consult the managed-keys database maintained by
+   :iscman:`named`, which means that if either of the keys in |bind_keys| is
+   revoked and rolled over, |bind_keys| must be updated to
+   use DNSSEC validation in :program:`delv`.
 
 .. option:: -b address
 
@@ -355,6 +354,8 @@ assign values to options like the timeout interval. They have the form
 Files
 ~~~~~
 
+|bind_keys|
+
 ``/etc/resolv.conf``
 
 See Also

bin/dig/Makefile.am

@@ -4,14 +4,17 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
-	$(LIBIDN2_CFLAGS)	\
-	$(LIBUV_CFLAGS)
+	$(LIBIRS_CFLAGS)	\
+	$(LIBBIND9_CFLAGS)	\
+	$(LIBIDN2_CFLAGS)
 
 LDADD +=			\
 	libdighost.la		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCFG_LIBS)	\
+	$(LIBIRS_LIBS)		\
+	$(LIBBIND9_LIBS)	\
 	$(LIBIDN2_LIBS)
 
 noinst_LTLIBRARIES = libdighost.la

bin/dig/dig.c

@@ -24,8 +24,10 @@
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/time.h>
 #include <isc/util.h>
 
@@ -204,6 +206,9 @@ help(void) {
 	       "from ipv4only.arpa)\n"
 	       "                 +[no]dnssec         (Request DNSSEC records)\n"
 	       "                 +domain=###         (Set default domainname)\n"
+	       "                 +[no]dscp[=###]     (Set the DSCP value to "
+	       "### "
+	       "[0..63])\n"
 	       "                 +[no]edns[=###]     (Set EDNS version) [0]\n"
 	       "                 +ednsflags=###      (Set EDNS flag bits)\n"
 	       "                 +[no]ednsnegotiation (Set EDNS version "
@@ -575,7 +580,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 static bool
 isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
-	static unsigned char local_ndata[] = { "\005local" };
+	static unsigned char local_ndata[] = { "\005local\0" };
 	static unsigned char local_offsets[] = { 0, 6 };
 	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata,
 							local_offsets);
@@ -688,8 +693,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		flags |= DNS_MESSAGETEXTFLAG_NOCOMMENTS;
 	}
 	if (query->lookup->onesoa &&
-	    query->lookup->rdtype == dns_rdatatype_axfr)
-	{
+	    query->lookup->rdtype == dns_rdatatype_axfr) {
 		flags |= (query->msg_count == 0) ? DNS_MESSAGETEXTFLAG_ONESOA
 						 : DNS_MESSAGETEXTFLAG_OMITSOA;
 	}
@@ -1386,6 +1390,22 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			}
 			strlcpy(domainopt, value, sizeof(domainopt));
 			break;
+		case 's': /* dscp */
+			FULLCHECK("dscp");
+			if (!state) {
+				lookup->dscp = -1;
+				break;
+			}
+			if (value == NULL) {
+				goto need_value;
+			}
+			result = parse_uint(&num, value, 0x3f, "DSCP");
+			if (result != ISC_R_SUCCESS) {
+				warn("Couldn't parse DSCP value");
+				goto exit_or_usage;
+			}
+			lookup->dscp = num;
+			break;
 		default:
 			goto invalid_option;
 		}
@@ -1502,31 +1522,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		}
 		break;
 	case 'f': /* fail */
-		switch (cmd[1]) {
-		case 'a':
-			FULLCHECK("fail");
-			lookup->servfail_stops = state;
-			break;
-		case 'u':
-			FULLCHECK("fuzztime");
-			lookup->fuzzing = state;
-			if (lookup->fuzzing) {
-				if (value == NULL) {
-					lookup->fuzztime = 0x622acce1;
-					break;
-				}
-				result = parse_uint(&num, value, 0xffffffff,
-						    "fuzztime");
-				if (result != ISC_R_SUCCESS) {
-					warn("Couldn't parse fuzztime");
-					goto exit_or_usage;
-				}
-				lookup->fuzztime = num;
-			}
-			break;
-		default:
-			goto invalid_option;
-		}
+		FULLCHECK("fail");
+		lookup->servfail_stops = state;
 		break;
 	case 'h':
 		switch (cmd[1]) {
@@ -1774,8 +1771,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			}
 			for (num = 0;
 			     num < sizeof(opcodetext) / sizeof(opcodetext[0]);
-			     num++)
-			{
+			     num++) {
 				if (strcasecmp(opcodetext[num], value) == 0) {
 					break;
 				}
@@ -1988,8 +1984,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			}
 			if (!state) {
 				if (lookup->ecs_addr != NULL) {
-					isc_mem_put(mctx, lookup->ecs_addr,
-						    sizeof(*lookup->ecs_addr));
+					isc_mem_free(mctx, lookup->ecs_addr);
 					lookup->ecs_addr = NULL;
 				}
 				break;
@@ -1998,8 +1993,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				lookup->edns = DEFAULT_EDNS_VERSION;
 			}
 			if (lookup->ecs_addr != NULL) {
-				isc_mem_put(mctx, lookup->ecs_addr,
-					    sizeof(*lookup->ecs_addr));
+				isc_mem_free(mctx, lookup->ecs_addr);
 				lookup->ecs_addr = NULL;
 			}
 			result = parse_netprefix(&lookup->ecs_addr, value);
@@ -2053,8 +2047,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			switch (cmd[2]) {
 			case 's':
 				if (!plus_tls_options(cmd, value, state,
-						      lookup))
-				{
+						      lookup)) {
 					goto invalid_option;
 				}
 				break;
@@ -2194,7 +2187,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 
 #if !TARGET_OS_IPHONE
 exit_or_usage:
-	cleanup_openssl_refs();
 	digexit();
 #endif /* if !TARGET_OS_IPHONE */
 }
@@ -2396,8 +2388,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			result = dns_rdatatype_fromtext(
 				&rdtype, (isc_textregion_t *)&tr);
 			if (result == ISC_R_SUCCESS &&
-			    rdtype == dns_rdatatype_ixfr)
-			{
+			    rdtype == dns_rdatatype_ixfr) {
 				result = DNS_R_UNKNOWN;
 			}
 		}
@@ -2470,8 +2461,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		*need_clone = true;
 		if (get_reverse(textname, sizeof(textname), value, false) ==
-		    ISC_R_SUCCESS)
-		{
+		    ISC_R_SUCCESS) {
 			strlcpy((*lookup)->textname, textname,
 				sizeof((*lookup)->textname));
 			debug("looking up %s", (*lookup)->textname);
@@ -2653,8 +2643,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 		}
 		if (batchfp != NULL) {
 			while (fgets(batchline, sizeof(batchline), batchfp) !=
-			       0)
-			{
+			       0) {
 				debug("config line %s", batchline);
 				bargc = split_batchline(batchline, bargv, 62,
 							".digrc argv");
@@ -2746,8 +2735,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 						&rdtype,
 						(isc_textregion_t *)&tr);
 					if (result == ISC_R_SUCCESS &&
-					    rdtype == dns_rdatatype_ixfr)
-					{
+					    rdtype == dns_rdatatype_ixfr) {
 						fprintf(stderr, ";; Warning, "
 								"ixfr requires "
 								"a "
@@ -2787,8 +2775,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 						lookup->rdtype = rdtype;
 						lookup->rdtypeset = true;
 						if (rdtype ==
-						    dns_rdatatype_axfr)
-						{
+						    dns_rdatatype_axfr) {
 							lookup->section_question =
 								plusquest;
 							lookup->comments =
@@ -2796,8 +2783,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 						}
 						if (rdtype ==
 							    dns_rdatatype_any &&
-						    !lookup->tcp_mode_set)
-						{
+						    !lookup->tcp_mode_set) {
 							lookup->tcp_mode = true;
 						}
 						lookup->ixfr_serial = false;
@@ -3044,6 +3030,11 @@ dig_startup(void) {
 	isc_loopmgr_run(loopmgr);
 }
 
+void
+dig_query_start(void) {
+	start_lookup();
+}
+
 void
 dig_shutdown(void) {
 	destroy_lookup(default_lookup);

bin/dig/dig.rst

@@ -132,14 +132,12 @@ Options
 
 .. option:: -k keyfile
 
-   This option tells :program:`dig` to sign queries using TSIG or
-   SIG(0) using a key read from the given file. Key files can be
-   generated using :iscman:`tsig-keygen`. When using TSIG authentication
-   with :program:`dig`, the name server that is queried needs to
-   know the key and algorithm that is being used. In BIND, this is
-   done by providing appropriate ``key`` and ``server`` statements
-   in :iscman:`named.conf` for TSIG and by looking up the KEY record
-   in zone data for SIG(0).
+   This option tells :iscman:`named` to sign queries using TSIG using a key read from the given file. Key
+   files can be generated using :iscman:`tsig-keygen`. When using TSIG
+   authentication with :program:`dig`, the name server that is queried needs to
+   know the key and algorithm that is being used. In BIND, this is done
+   by providing appropriate ``key`` and ``server`` statements in
+   :iscman:`named.conf`.
 
 .. option:: -m
 
@@ -347,6 +345,12 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    enables search list processing as if the :option:`+search` option were
    given.
 
+.. option:: +dscp=value
+
+   This option sets the DSCP code point to be used when sending the query. Valid DSCP
+   code points are in the range [0...63]. By default no code point is
+   explicitly set.
+
 .. option:: +edns[=#], +noedns
 
    This option specifies the EDNS version to query with. Valid values are 0 to 255.
@@ -382,14 +386,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    to not try the next server, which is the reverse of normal stub
    resolver behavior.
 
-.. option:: +fuzztime[=value], +nofuzztime
-
-   This option allows the signing time to be specified when generating
-   signed messages.  If a value is specified it is the seconds since
-   00:00:00 January 1, 1970 UTC ignoring leap seconds.  If no value
-   is specified 1646972129 (Fri 11 Mar 2022 04:15:29 UTC) is used.
-   The default is ``+nofuzztime`` and the current time is used.
-
 .. option:: +header-only, +noheader-only
 
    This option sends a query with a DNS header without a question section. The
@@ -612,11 +608,10 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
 
 .. option:: +tcp, +notcp
 
-   This option indicates whether to use TCP when querying name
-   servers.  The default behavior is to use UDP unless a type ``any``
-   or ``ixfr=N`` query is requested, in which case the default is
-   TCP. AXFR queries always use TCP. To prevent retry over TCP when
-   TC=1 is returned from a UDP query, use ``+ignore``.
+   This option indicates whether to use TCP when querying name servers.
+   The default behavior is to use UDP unless a type ``any`` or ``ixfr=N``
+   query is requested, in which case the default is TCP. AXFR queries
+   always use TCP.
 
 .. option:: +timeout=T
 
@@ -742,7 +737,7 @@ shows how :program:`dig` can be used from the command line to make three
 lookups: an ANY query for ``www.isc.org``, a reverse lookup of 127.0.0.1,
 and a query for the NS records of ``isc.org``. A global query option of
 :option:`+qr` is applied, so that :program:`dig` shows the initial query it made for
-each lookup. The final query has a local query option of :option:`+noqr` which
+each lookup. The final query has a local query option of :option:`+qr` which
 means that :program:`dig` does not print the initial query when it looks up the
 NS records for ``isc.org``.
 

bin/dig/dighost.c

@@ -25,7 +25,6 @@
 #include <inttypes.h>
 #include <limits.h>
 #include <locale.h>
-#include <netdb.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <string.h>
@@ -37,27 +36,26 @@
 
 #include <isc/base64.h>
 #include <isc/file.h>
-#include <isc/getaddresses.h>
 #include <isc/hex.h>
 #include <isc/lang.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/netaddr.h>
+#include <isc/netdb.h>
 #include <isc/nonce.h>
 #include <isc/parseint.h>
+#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/safe.h>
 #include <isc/serial.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/timer.h>
-#include <isc/tls.h>
 #include <isc/types.h>
 #include <isc/util.h>
-#include <isc/uv.h>
-#include <isc/xml.h>
 
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
@@ -80,6 +78,8 @@
 
 #include <irs/resconf.h>
 
+#include <bind9/getaddresses.h>
+
 #include "dighost.h"
 
 #define systemlocale(l) (void)setlocale(l, "")
@@ -102,6 +102,7 @@ unsigned int extrabytes;
 isc_mem_t *mctx = NULL;
 isc_log_t *lctx = NULL;
 isc_nm_t *netmgr = NULL;
+isc_taskmgr_t *taskmgr = NULL;
 isc_loopmgr_t *loopmgr = NULL;
 isc_loop_t *mainloop = NULL;
 isc_sockaddr_t localaddr;
@@ -142,7 +143,6 @@ const dns_name_t *hmacname = NULL;
 unsigned int digestbits = 0;
 isc_buffer_t *namebuf = NULL;
 dns_tsigkey_t *tsigkey = NULL;
-dst_key_t *sig0key = NULL;
 bool validated = true;
 bool debugging = false;
 bool debugtiming = false;
@@ -324,9 +324,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		/* This is a valid IPv6 address. */
 		dns_fixedname_t fname;
 		dns_name_t *name;
+		unsigned int options = 0;
 
 		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname(&addr, name);
+		result = dns_byaddr_createptrname(&addr, options, name);
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
@@ -473,8 +474,7 @@ get_server_list(irs_resconf_t *resconf) {
 	debug("get_server_list()");
 	servers = irs_resconf_getnameservers(resconf);
 	for (sa = ISC_LIST_HEAD(*servers); sa != NULL;
-	     sa = ISC_LIST_NEXT(sa, link))
-	{
+	     sa = ISC_LIST_NEXT(sa, link)) {
 		int pf = isc_sockaddr_pf(sa);
 		isc_netaddr_t na;
 		isc_result_t result;
@@ -533,7 +533,8 @@ set_nameserver(char *opt) {
 	}
 
 	isc_loopmgr_blocking(loopmgr);
-	result = isc_getaddresses(opt, 0, sockaddrs, DIG_MAX_ADDRESSES, &count);
+	result = bind9_getaddresses(opt, 0, sockaddrs, DIG_MAX_ADDRESSES,
+				    &count);
 	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
 		fatal("couldn't get address for '%s': %s", opt,
@@ -616,6 +617,7 @@ make_empty_lookup(void) {
 		.section_authority = true,
 		.section_additional = true,
 		.ednsneg = true,
+		.dscp = -1,
 	};
 
 	dns_fixedname_init(&looknew->fdomain);
@@ -623,7 +625,7 @@ make_empty_lookup(void) {
 	ISC_LIST_INIT(looknew->q);
 	ISC_LIST_INIT(looknew->my_server_list);
 
-	isc_tlsctx_cache_create(mctx, &looknew->tls_ctx_cache);
+	looknew->tls_ctx_cache = isc_tlsctx_cache_new(mctx);
 
 	isc_refcount_init(&looknew->references, 1);
 
@@ -790,15 +792,13 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->tsigctx = NULL;
 	looknew->need_search = lookold->need_search;
 	looknew->done_as_is = lookold->done_as_is;
+	looknew->dscp = lookold->dscp;
 	looknew->rrcomments = lookold->rrcomments;
-	looknew->fuzzing = lookold->fuzzing;
-	looknew->fuzztime = lookold->fuzztime;
 
 	if (lookold->ecs_addr != NULL) {
-		looknew->ecs_addr = isc_mem_get(mctx,
-						sizeof(*looknew->ecs_addr));
-		memmove(looknew->ecs_addr, lookold->ecs_addr,
-			sizeof(*looknew->ecs_addr));
+		size_t len = sizeof(isc_sockaddr_t);
+		looknew->ecs_addr = isc_mem_allocate(mctx, len);
+		memmove(looknew->ecs_addr, lookold->ecs_addr, len);
 	}
 
 	dns_name_copy(dns_fixedname_name(&lookold->fdomain),
@@ -957,8 +957,8 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 		fatal("invalid prefix '%s'\n", value);
 	}
 
-	sa = isc_mem_get(mctx, sizeof(*sa));
-	*sa = (isc_sockaddr_t){ .length = 0 };
+	sa = isc_mem_allocate(mctx, sizeof(*sa));
+	memset(sa, 0, sizeof(*sa));
 
 	if (strcmp(buf, "0") == 0) {
 		sa->type.sa.sa_family = AF_UNSPEC;
@@ -1141,10 +1141,6 @@ setup_file_key(void) {
 
 	debug("setup_file_key()");
 
-	if (sig0key != NULL) {
-		dst_key_free(&sig0key);
-	}
-
 	/* Try reading the key from a K* pair */
 	result = dst_key_fromnamedfile(
 		keyfile, NULL, DST_TYPE_PRIVATE | DST_TYPE_KEY, mctx, &dstkey);
@@ -1182,20 +1178,18 @@ setup_file_key(void) {
 	case DST_ALG_HMACSHA512:
 		hmacname = DNS_TSIG_HMACSHA512_NAME;
 		break;
+	default:
+		printf(";; Couldn't create key %s: bad algorithm\n",
+		       keynametext);
+		goto failure;
 	}
-
-	if (hmacname != NULL) {
-		result = dns_tsigkey_createfromkey(
-			dst_key_name(dstkey), hmacname, dstkey, false, NULL, 0,
-			0, mctx, NULL, &tsigkey);
-		if (result != ISC_R_SUCCESS) {
-			printf(";; Couldn't create key %s: %s\n", keynametext,
-			       isc_result_totext(result));
-			goto failure;
-		}
-	} else {
-		dst_key_attach(dstkey, &sig0key);
-		dst_key_free(&dstkey);
+	result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmacname,
+					   dstkey, false, NULL, 0, 0, mctx,
+					   NULL, &tsigkey);
+	if (result != ISC_R_SUCCESS) {
+		printf(";; Couldn't create key %s: %s\n", keynametext,
+		       isc_result_totext(result));
+		goto failure;
 	}
 failure:
 	if (dstkey != NULL) {
@@ -1365,7 +1359,7 @@ setup_libs(void) {
 		fatal("can't find either v4 or v6 networking");
 	}
 
-	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
+	isc_managers_create(&mctx, 1, &loopmgr, &netmgr, &taskmgr);
 
 	isc_log_create(mctx, &lctx, &logconfig);
 	isc_log_setcontext(lctx);
@@ -1599,7 +1593,7 @@ _destroy_lookup(dig_lookup_t *lookup) {
 	}
 
 	if (lookup->ecs_addr != NULL) {
-		isc_mem_put(mctx, lookup->ecs_addr, sizeof(*lookup->ecs_addr));
+		isc_mem_free(mctx, lookup->ecs_addr);
 	}
 
 	if (lookup->ednsopts != NULL) {
@@ -1912,8 +1906,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 			dns_rdata_ns_t ns;
 
 			if (query->lookup->trace_root &&
-			    query->lookup->nsfound >= MXSERV)
-			{
+			    query->lookup->nsfound >= MXSERV) {
 				break;
 			}
 
@@ -1934,8 +1927,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				cancel_lookup(query->lookup);
 				lookup->doing_xfr = false;
 				if (!lookup->trace_root &&
-				    section == DNS_SECTION_ANSWER)
-				{
+				    section == DNS_SECTION_ANSWER) {
 					lookup->trace = false;
 				} else {
 					lookup->trace = query->lookup->trace;
@@ -2330,7 +2322,6 @@ setup_lookup(dig_lookup_t *lookup) {
 				clear_current_lookup();
 				return (false);
 #else  /* if TARGET_OS_IPHONE */
-				cleanup_openssl_refs();
 				digexit();
 #endif /* if TARGET_OS_IPHONE */
 			}
@@ -2434,20 +2425,12 @@ setup_lookup(dig_lookup_t *lookup) {
 		debug("initializing keys");
 		result = dns_message_settsigkey(lookup->sendmsg, tsigkey);
 		check_result(result, "dns_message_settsigkey");
-	} else if (sig0key != NULL) {
-		debug("initializing keys");
-		result = dns_message_setsig0key(lookup->sendmsg, sig0key);
-		check_result(result, "dns_message_setsig0key");
-	}
-
-	if (lookup->fuzzing) {
-		lookup->sendmsg->fuzzing = true;
-		lookup->sendmsg->fuzztime = lookup->fuzztime;
 	}
 
 	lookup->sendspace = isc_mem_get(mctx, COMMSIZE);
 
-	dns_compress_init(&cctx, mctx, 0);
+	result = dns_compress_init(&cctx, mctx);
+	check_result(result, "dns_compress_init");
 
 	debug("starting to render the message");
 	isc_buffer_init(&lookup->renderbuf, lookup->sendspace, COMMSIZE);
@@ -2559,8 +2542,7 @@ setup_lookup(dig_lookup_t *lookup) {
 					addr[addrl - 1] &= ~0U
 							   << (8 - (plen % 8));
 				}
-				isc_buffer_putmem(&b, addr,
-						  (unsigned int)addrl);
+				isc_buffer_putmem(&b, addr, (unsigned)addrl);
 			}
 
 			opts[i].value = (uint8_t *)ecsbuf;
@@ -2776,8 +2758,7 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
 		      query->lookup);
 		query->canceled = true;
 		if (query->readhandle != NULL &&
-		    !isc_nm_is_http_handle(query->readhandle))
-		{
+		    !isc_nm_is_http_handle(query->readhandle)) {
 			isc_nm_cancelread(query->readhandle);
 		}
 		query_detach(&query);
@@ -2853,8 +2834,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 		}
 
 		if (query->lookup->tls_key_file_set &&
-		    query->lookup->tls_cert_file_set)
-		{
+		    query->lookup->tls_cert_file_set) {
 			result = isc_tlsctx_load_certificate(
 				ctx, query->lookup->tls_key_file,
 				query->lookup->tls_cert_file);
@@ -2873,9 +2853,9 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 		}
 #endif /* HAVE_LIBNGHTTP2 */
 
-		isc_tlsctx_client_session_cache_create(
-			mctx, ctx, ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE,
-			&sess_cache);
+		sess_cache = isc_tlsctx_client_session_cache_new(
+			mctx, ctx,
+			ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE);
 
 		result = isc_tlsctx_cache_add(
 			query->lookup->tls_ctx_cache, tlsctxname, transport,
@@ -2946,8 +2926,7 @@ start_tcp(dig_query_t *query) {
 		if (tls_mode) {
 			port = 853;
 		} else if (query->lookup->https_mode &&
-			   !query->lookup->http_plain)
-		{
+			   !query->lookup->http_plain) {
 			port = 443;
 		} else if (query->lookup->https_mode) {
 			port = 80;
@@ -3030,9 +3009,9 @@ start_tcp(dig_query_t *query) {
 		if (tlsctx == NULL) {
 			goto failure_tls;
 		}
-		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
-					tcp_connected, connectquery,
-					local_timeout, tlsctx, sess_cache);
+		isc_nm_tlsdnsconnect(netmgr, &localaddr, &query->sockaddr,
+				     tcp_connected, connectquery, local_timeout,
+				     tlsctx, sess_cache);
 #if HAVE_LIBNGHTTP2
 	} else if (query->lookup->https_mode) {
 		char uri[4096] = { 0 };
@@ -3055,11 +3034,13 @@ start_tcp(dig_query_t *query) {
 				   local_timeout);
 #endif
 	} else {
-		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
-					tcp_connected, connectquery,
-					local_timeout, NULL, NULL);
+		isc_nm_tcpdnsconnect(netmgr, &localaddr, &query->sockaddr,
+				     tcp_connected, connectquery,
+				     local_timeout);
 	}
 
+	/* XXX: set DSCP */
+
 	return;
 
 failure_tls:
@@ -3445,22 +3426,20 @@ launch_next_query(dig_query_t *query) {
 
 	xfr = query->lookup->rdtype == dns_rdatatype_ixfr ||
 	      query->lookup->rdtype == dns_rdatatype_axfr;
-	if (xfr &&
-	    isc_nm_socket_type(query->handle) == isc_nm_streamdnssocket &&
-	    query->lookup->tls_mode)
+	if (xfr && isc_nm_socket_type(query->handle) == isc_nm_tlsdnssocket &&
+	    !isc_nm_xfr_allowed(query->handle))
 	{
-		isc_result_t result = isc_nm_xfr_checkperm(query->handle);
-		if (result != ISC_R_SUCCESS) {
-			dighost_error("zone transfers over the established TLS "
-				      "connection are not allowed: %s",
-				      isc_result_totext(result));
-			isc_refcount_decrement0(&recvcount);
-			isc_nmhandle_detach(&query->readhandle);
-			cancel_lookup(l);
-			lookup_detach(&l);
-			clear_current_lookup();
-			return;
-		}
+		dighost_error("zone transfers over the "
+			      "established TLS connection are not allowed");
+		dighost_error("as the "
+			      "connection does not meet the requirements "
+			      "enforced by the RFC 9103");
+		isc_refcount_decrement0(&recvcount);
+		isc_nmhandle_detach(&query->readhandle);
+		cancel_lookup(l);
+		lookup_detach(&l);
+		clear_current_lookup();
+		return;
 	}
 
 	query_attach(query, &readquery);
@@ -3692,15 +3671,13 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 				 * it's an SOA
 				 */
 				if ((!query->first_soa_rcvd) &&
-				    (rdata.type != dns_rdatatype_soa))
-				{
+				    (rdata.type != dns_rdatatype_soa)) {
 					puts("; Transfer failed.  "
 					     "Didn't start with SOA answer.");
 					return (true);
 				}
 				if ((!query->second_rr_rcvd) &&
-				    (rdata.type != dns_rdatatype_soa))
-				{
+				    (rdata.type != dns_rdatatype_soa)) {
 					query->second_rr_rcvd = true;
 					query->second_rr_serial = 0;
 					debug("got the second rr as nonsoa");
@@ -4266,8 +4243,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	}
 
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 && !l->ignore &&
-	    !l->tcp_mode)
-	{
+	    !l->tcp_mode) {
 		if (l->cookie == NULL && l->sendcookie && msg->opt != NULL) {
 			process_opt(l, msg);
 		}
@@ -4399,8 +4375,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 
 	if (!l->doing_xfr || l->xfr_q == query) {
 		if (msg->rcode == dns_rcode_nxdomain &&
-		    (l->origin != NULL || l->need_search))
-		{
+		    (l->origin != NULL || l->need_search)) {
 			if (!next_origin(l) || showsearch) {
 				dighost_printmessage(query, &b, msg, true);
 				dighost_received(isc_buffer_usedlength(&b),
@@ -4526,7 +4501,7 @@ get_address(char *host, in_port_t myport, isc_sockaddr_t *sockaddr) {
 	isc_result_t result;
 
 	isc_loopmgr_blocking(loopmgr);
-	result = isc_getaddresses(host, myport, sockaddr, 1, &count);
+	result = bind9_getaddresses(host, myport, sockaddr, 1, &count);
 	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
@@ -4547,8 +4522,8 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 	char tmp[ISC_NETADDR_FORMATSIZE];
 
 	isc_loopmgr_blocking(loopmgr);
-	result = isc_getaddresses(host, 0, sockaddrs, DIG_MAX_ADDRESSES,
-				  &count);
+	result = bind9_getaddresses(host, 0, sockaddrs, DIG_MAX_ADDRESSES,
+				    &count);
 	isc_loopmgr_nonblocking(loopmgr);
 	if (resultp != NULL) {
 		*resultp = result;
@@ -4634,8 +4609,7 @@ cancel_all(void) {
 			      current_lookup);
 			q->canceled = true;
 			if (q->readhandle != NULL &&
-			    !isc_nm_is_http_handle(q->readhandle))
-			{
+			    !isc_nm_is_http_handle(q->readhandle)) {
 				isc_nm_cancelread(q->readhandle);
 			}
 			query_detach(&q);
@@ -4657,25 +4631,6 @@ cancel_all(void) {
 	}
 }
 
-void
-cleanup_openssl_refs(void) {
-	if (tsigkey != NULL) {
-		debug("freeing TSIG key %p", tsigkey);
-		dns_tsigkey_detach(&tsigkey);
-	}
-
-	if (sig0key != NULL) {
-		debug("freeing SIG(0) key %p", sig0key);
-		dst_key_free(&sig0key);
-	}
-
-	if (is_dst_up) {
-		debug("destroy DST lib");
-		dst_lib_destroy();
-		is_dst_up = false;
-	}
-}
-
 /*%
  * Destroy all of the libs we are using, and get everything ready for a
  * clean shutdown.
@@ -4697,13 +4652,20 @@ destroy_libs(void) {
 
 	clear_searchlist();
 
-	cleanup_openssl_refs();
-
-	if (namebuf != NULL) {
+	if (tsigkey != NULL) {
 		debug("freeing key %p", tsigkey);
+		dns_tsigkey_detach(&tsigkey);
+	}
+	if (namebuf != NULL) {
 		isc_buffer_free(&namebuf);
 	}
 
+	if (is_dst_up) {
+		debug("destroy DST lib");
+		dst_lib_destroy();
+		is_dst_up = false;
+	}
+
 	debug("Removing log context");
 	isc_log_destroy(&lctx);
 
@@ -4712,21 +4674,13 @@ destroy_libs(void) {
 		isc_mem_stats(mctx, stderr);
 	}
 
-	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
-
-#if ENABLE_LEAK_DETECTION
-	isc__tls_setdestroycheck(true);
-	isc__uv_setdestroycheck(true);
-	isc__xml_setdestroycheck(true);
-#endif
-
-	isc_mem_checkdestroyed(stderr);
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr, &taskmgr);
 }
 
 #ifdef HAVE_LIBIDN2
 
 static isc_result_t
-idn_filter(isc_buffer_t *buffer, unsigned int start) {
+idn_filter(isc_buffer_t *buffer, unsigned start) {
 	char src[MXNAME];
 	char *dst = NULL;
 	size_t srclen, dstlen;

bin/dig/dighost.h

@@ -27,6 +27,7 @@
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
+#include <isc/print.h>
 #include <isc/refcount.h>
 #include <isc/sockaddr.h>
 #include <isc/time.h>
@@ -107,11 +108,10 @@ struct dig_lookup {
 	isc_refcount_t references;
 	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		expire, fuzzing, header_only, identify, /*%< Append an "on
-							   server <foo>" message
-							 */
-		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
-					   message, with newline and tab */
+		expire, header_only, identify, /*%< Append an "on server <foo>"
+						  message */
+		identify_previous_line,	       /*% Prepend a "Nameserver <foo>:"
+						  message, with newline and tab */
 		idnin, idnout, ignore, multiline, need_search, new_search,
 		noclass, nocrypto, nottl, ns_search_only, /*%< dig +nssearch,
 							     host -C */
@@ -166,6 +166,7 @@ struct dig_lookup {
 	char *cookie;
 	dns_ednsopt_t *ednsopts;
 	unsigned int ednsoptscnt;
+	isc_dscp_t dscp;
 	unsigned int ednsflags;
 	dns_opcode_t opcode;
 	int rrcomments;
@@ -187,7 +188,6 @@ struct dig_lookup {
 		char *tls_key_file;
 		isc_tlsctx_cache_t *tls_ctx_cache;
 	};
-	isc_stdtime_t fuzztime;
 };
 
 /*% The dig_query structure */
@@ -263,6 +263,7 @@ extern const dns_name_t *hmacname;
 extern unsigned int digestbits;
 extern dns_tsigkey_t *tsigkey;
 extern bool validated;
+extern isc_taskmgr_t *taskmgr;
 extern isc_loopmgr_t *loopmgr;
 extern isc_loop_t *mainloop;
 extern bool free_now;
@@ -295,9 +296,6 @@ warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 noreturn void
 digexit(void);
 
-void
-cleanup_openssl_refs(void);
-
 void
 debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
@@ -445,6 +443,12 @@ dig_query_setup(bool, bool, int argc, char **argv);
 void
 dig_startup(void);
 
+/*%
+ * Initiates the next lookup cycle
+ */
+void
+dig_query_start(void);
+
 /*%
  * Activate/deactivate IDN filtering of output.
  */

bin/dig/host.c

@@ -23,7 +23,9 @@
 #include <isc/commandline.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
+#include <isc/print.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/util.h>
 
 #include <dns/byaddr.h>
@@ -531,8 +533,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	}
 
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_AUTHORITY]) &&
-	    !short_form)
-	{
+	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
 				      true, query);
@@ -541,8 +542,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ADDITIONAL]) &&
-	    !short_form)
-	{
+	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_ADDITIONAL, "ADDITIONAL",
 				      true, query);
@@ -590,12 +590,10 @@ pre_parse_args(int argc, char **argv) {
 			{
 				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
 			} else if (strcasecmp("record",
-					      isc_commandline_argument) == 0)
-			{
+					      isc_commandline_argument) == 0) {
 				isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
 			} else if (strcasecmp("usage",
-					      isc_commandline_argument) == 0)
-			{
+					      isc_commandline_argument) == 0) {
 				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 			}
 			break;
@@ -706,8 +704,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 't':
 			if (strncasecmp(isc_commandline_argument, "ixfr=", 5) ==
-			    0)
-			{
+			    0) {
 				rdtype = dns_rdatatype_ixfr;
 				/* XXXMPA add error checking */
 				serial = strtoul(isc_commandline_argument + 5,
@@ -726,8 +723,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 				      isc_commandline_argument);
 			}
 			if (!lookup->rdtypeset ||
-			    lookup->rdtype != dns_rdatatype_axfr)
-			{
+			    lookup->rdtype != dns_rdatatype_axfr) {
 				lookup->rdtype = rdtype;
 			}
 			lookup->rdtypeset = true;
@@ -771,8 +767,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			FALLTHROUGH;
 		case 'a':
 			if (!lookup->rdtypeset ||
-			    lookup->rdtype != dns_rdatatype_axfr)
-			{
+			    lookup->rdtype != dns_rdatatype_axfr) {
 				lookup->rdtype = dns_rdatatype_any;
 			}
 			list_type = dns_rdatatype_any;
@@ -846,7 +841,6 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 'p':
 			port = atoi(isc_commandline_argument);
-			port_set = true;
 			break;
 		}
 	}

bin/dig/nslookup.c

@@ -20,11 +20,14 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/condition.h>
+#include <isc/event.h>
 #include <isc/job.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
+#include <isc/print.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/util.h>
 #include <isc/work.h>
 
@@ -566,7 +569,6 @@ set_port(const char *value) {
 	isc_result_t result = parse_uint(&n, value, 65535, "port");
 	if (result == ISC_R_SUCCESS) {
 		port = (uint16_t)n;
-		port_set = true;
 	}
 }
 

bin/dnssec/dnssec-cds.c

@@ -30,6 +30,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/serial.h>
 #include <isc/string.h>
@@ -124,29 +125,15 @@ typedef isc_result_t
 ds_maker_func_t(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
 		dns_rdata_t *crdata);
 
-static dns_rdataset_t cdnskey_set = DNS_RDATASET_INIT;
-static dns_rdataset_t cdnskey_sig = DNS_RDATASET_INIT;
-static dns_rdataset_t cds_set = DNS_RDATASET_INIT;
-static dns_rdataset_t cds_sig = DNS_RDATASET_INIT;
-static dns_rdataset_t dnskey_set = DNS_RDATASET_INIT;
-static dns_rdataset_t dnskey_sig = DNS_RDATASET_INIT;
-static dns_rdataset_t old_ds_set = DNS_RDATASET_INIT;
-static dns_rdataset_t new_ds_set = DNS_RDATASET_INIT;
+static dns_rdataset_t cdnskey_set, cdnskey_sig;
+static dns_rdataset_t cds_set, cds_sig;
+static dns_rdataset_t dnskey_set, dnskey_sig;
+static dns_rdataset_t old_ds_set, new_ds_set;
 
-static keyinfo_t *old_key_tbl = NULL, *new_key_tbl = NULL;
+static keyinfo_t *old_key_tbl, *new_key_tbl;
 
 isc_buffer_t *new_ds_buf = NULL; /* backing store for new_ds_set */
 
-static dns_db_t *child_db = NULL;
-static dns_dbnode_t *child_node = NULL;
-static dns_db_t *parent_db = NULL;
-static dns_dbnode_t *parent_node = NULL;
-static dns_db_t *update_db = NULL;
-static dns_dbnode_t *update_node = NULL;
-static dns_dbversion_t *update_version = NULL;
-static bool cleanup_dst = false;
-static bool print_mem_stats = false;
-
 static void
 verbose_time(int level, const char *msg, isc_stdtime_t time) {
 	isc_result_t result;
@@ -264,27 +251,21 @@ load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 }
 
 static void
-free_db(dns_db_t **dbp, dns_dbnode_t **nodep, dns_dbversion_t **versionp) {
-	if (*dbp != NULL) {
-		if (*nodep != NULL) {
-			dns_db_detachnode(*dbp, nodep);
-		}
-		if (versionp != NULL && *versionp != NULL) {
-			dns_db_closeversion(*dbp, versionp, false);
-		}
-		dns_db_detach(dbp);
-	}
+free_db(dns_db_t **dbp, dns_dbnode_t **nodep) {
+	dns_db_detachnode(*dbp, nodep);
+	dns_db_detach(dbp);
 }
 
 static void
 load_child_sets(const char *file) {
-	load_db(file, &child_db, &child_node);
-	findset(child_db, child_node, dns_rdatatype_dnskey, &dnskey_set,
-		&dnskey_sig);
-	findset(child_db, child_node, dns_rdatatype_cdnskey, &cdnskey_set,
-		&cdnskey_sig);
-	findset(child_db, child_node, dns_rdatatype_cds, &cds_set, &cds_sig);
-	free_db(&child_db, &child_node, NULL);
+	dns_db_t *db = NULL;
+	dns_dbnode_t *node = NULL;
+
+	load_db(file, &db, &node);
+	findset(db, node, dns_rdatatype_dnskey, &dnskey_set, &dnskey_sig);
+	findset(db, node, dns_rdatatype_cdnskey, &cdnskey_set, &cdnskey_sig);
+	findset(db, node, dns_rdatatype_cds, &cds_set, &cds_sig);
+	free_db(&db, &node);
 }
 
 static void
@@ -333,6 +314,8 @@ get_dsset_name(char *filename, size_t size, const char *path,
 static void
 load_parent_set(const char *path) {
 	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbnode_t *node = NULL;
 	isc_time_t modtime;
 	char filename[PATH_MAX + 1];
 
@@ -351,15 +334,15 @@ load_parent_set(const char *path) {
 	}
 	verbose_time(1, "child records must not be signed before", notbefore);
 
-	load_db(filename, &parent_db, &parent_node);
-	findset(parent_db, parent_node, dns_rdatatype_ds, &old_ds_set, NULL);
+	load_db(filename, &db, &node);
+	findset(db, node, dns_rdatatype_ds, &old_ds_set, NULL);
 
 	if (!dns_rdataset_isassociated(&old_ds_set)) {
 		fatal("could not find DS records for %s in %s", namestr,
 		      filename);
 	}
 
-	free_db(&parent_db, &parent_node, NULL);
+	free_db(&db, &node);
 }
 
 #define MAX_CDS_RDATA_TEXT_SIZE DNS_RDATA_MAXLENGTH * 2
@@ -384,18 +367,17 @@ formatset(dns_rdataset_t *rdataset) {
 
 	isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
 	result = dns_master_rdatasettotext(name, rdataset, style, NULL, buf);
-	dns_master_styledestroy(&style, mctx);
 
 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
 		result = ISC_R_NOSPACE;
 	}
 
-	if (result != ISC_R_SUCCESS) {
-		isc_buffer_free(&buf);
-		check_result(result, "dns_rdataset_totext()");
-	}
+	check_result(result, "dns_rdataset_totext()");
 
 	isc_buffer_putuint8(buf, 0);
+
+	dns_master_styledestroy(&style, mctx);
+
 	return (buf);
 }
 
@@ -438,7 +420,6 @@ write_parent_set(const char *path, const char *inplace, bool nsupdate,
 
 	result = isc_file_openunique(tmpname, &fp);
 	if (result != ISC_R_SUCCESS) {
-		isc_buffer_free(&buf);
 		fatal("open %s: %s", tmpname, isc_result_totext(result));
 	}
 	fprintf(fp, "%s", (char *)r.base);
@@ -533,22 +514,23 @@ static keyinfo_t *
 match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		   strictness_t strictness) {
 	isc_result_t result;
-	keyinfo_t *keytable, *ki;
+	keyinfo_t *keytable;
 	int i;
 
 	nkey = dns_rdataset_count(keyset);
 
-	keytable = isc_mem_getx(mctx, sizeof(keytable[0]) * nkey, ISC_MEM_ZERO);
+	keytable = isc_mem_get(mctx, sizeof(keyinfo_t) * nkey);
 
-	for (result = dns_rdataset_first(keyset), i = 0, ki = keytable;
-	     result == ISC_R_SUCCESS;
-	     result = dns_rdataset_next(keyset), i++, ki++)
+	for (result = dns_rdataset_first(keyset), i = 0;
+	     result == ISC_R_SUCCESS; result = dns_rdataset_next(keyset), i++)
 	{
+		keyinfo_t *ki;
 		dns_rdata_dnskey_t dnskey;
 		dns_rdata_t *keyrdata;
 		isc_region_t r;
 
 		INSIST(i < nkey);
+		ki = &keytable[i];
 		keyrdata = &ki->rdata;
 
 		dns_rdata_init(keyrdata);
@@ -586,15 +568,14 @@ free_keytable(keyinfo_t **keytable_p) {
 	keyinfo_t *ki;
 	int i;
 
-	REQUIRE(keytable != NULL);
-
-	for (i = 0, ki = keytable; i < nkey; i++, ki++) {
+	for (i = 0; i < nkey; i++) {
+		ki = &keytable[i];
 		if (ki->dst != NULL) {
 			dst_key_free(&ki->dst);
 		}
 	}
 
-	isc_mem_put(mctx, keytable, sizeof(keytable[0]) * nkey);
+	isc_mem_put(mctx, keytable, sizeof(keyinfo_t) * nkey);
 }
 
 /*
@@ -613,9 +594,8 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	dns_secalg_t *algo;
 	int i;
 
-	REQUIRE(keytbl != NULL);
-
-	algo = isc_mem_getx(mctx, nkey * sizeof(algo[0]), ISC_MEM_ZERO);
+	algo = isc_mem_get(mctx, nkey);
+	memset(algo, 0, nkey);
 
 	for (result = dns_rdataset_first(sigset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(sigset))
@@ -656,8 +636,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 						   NULL);
 
 			if (result != ISC_R_SUCCESS &&
-			    result != DNS_R_FROMWILDCARD)
-			{
+			    result != DNS_R_FROMWILDCARD) {
 				vbprintf(1,
 					 "skip RRSIG by key %d:"
 					 " verification failed: %s\n",
@@ -698,7 +677,7 @@ signed_loose(dns_secalg_t *algo) {
 			ok = true;
 		}
 	}
-	isc_mem_put(mctx, algo, nkey * sizeof(algo[0]));
+	isc_mem_put(mctx, algo, nkey);
 	return (ok);
 }
 
@@ -819,7 +798,6 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 			isc_mem_put(mctx, ds, sizeof(*ds));
 			return (result);
 		default:
-			isc_mem_put(mctx, ds, sizeof(*ds));
 			check_result(result, "ds_from_rdata()");
 		}
 	}
@@ -977,27 +955,32 @@ static void
 update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 	    dns_rdataset_t *delset) {
 	isc_result_t result;
+	dns_db_t *db;
+	dns_dbnode_t *node;
+	dns_dbversion_t *ver;
 	dns_rdataset_t diffset;
 	uint32_t save;
 
+	db = NULL;
 	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
-			       NULL, &update_db);
+			       NULL, &db);
 	check_result(result, "dns_db_create()");
 
-	result = dns_db_newversion(update_db, &update_version);
+	ver = NULL;
+	result = dns_db_newversion(db, &ver);
 	check_result(result, "dns_db_newversion()");
 
-	result = dns_db_findnode(update_db, name, true, &update_node);
+	node = NULL;
+	result = dns_db_findnode(db, name, true, &node);
 	check_result(result, "dns_db_findnode()");
 
 	dns_rdataset_init(&diffset);
 
-	result = dns_db_addrdataset(update_db, update_node, update_version, 0,
-				    addset, DNS_DBADD_MERGE, NULL);
+	result = dns_db_addrdataset(db, node, ver, 0, addset, DNS_DBADD_MERGE,
+				    NULL);
 	check_result(result, "dns_db_addrdataset()");
 
-	result = dns_db_subtractrdataset(update_db, update_node, update_version,
-					 delset, 0, &diffset);
+	result = dns_db_subtractrdataset(db, node, ver, delset, 0, &diffset);
 	if (result == DNS_R_UNCHANGED) {
 		save = addset->ttl;
 		addset->ttl = ttl;
@@ -1010,7 +993,9 @@ update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 		dns_rdataset_disassociate(&diffset);
 	}
 
-	free_db(&update_db, &update_node, &update_version);
+	dns_db_detachnode(db, &node);
+	dns_db_closeversion(db, &ver, false);
+	dns_db_detach(&db);
 }
 
 static void
@@ -1060,32 +1045,6 @@ usage(void) {
 	exit(1);
 }
 
-static void
-cleanup(void) {
-	free_db(&child_db, &child_node, NULL);
-	free_db(&parent_db, &parent_node, NULL);
-	free_db(&update_db, &update_node, &update_version);
-	if (old_key_tbl != NULL) {
-		free_keytable(&old_key_tbl);
-	}
-	if (new_key_tbl != NULL) {
-		free_keytable(&new_key_tbl);
-	}
-	free_all_sets();
-	if (lctx != NULL) {
-		cleanup_logging(&lctx);
-	}
-	if (cleanup_dst) {
-		dst_lib_destroy();
-	}
-	if (mctx != NULL) {
-		if (print_mem_stats && verbose > 10) {
-			isc_mem_stats(mctx, stdout);
-		}
-		isc_mem_destroy(&mctx);
-	}
-}
-
 int
 main(int argc, char *argv[]) {
 	const char *child_path = NULL;
@@ -1098,8 +1057,6 @@ main(int argc, char *argv[]) {
 	int ch;
 	char *endp;
 
-	setfatalcallback(cleanup);
-
 	isc_mem_create(&mctx);
 
 	isc_commandline_errprint = false;
@@ -1128,8 +1085,7 @@ main(int argc, char *argv[]) {
 			 * optional, so that it works just like sed(1).
 			 */
 			if (isc_commandline_argument ==
-			    argv[isc_commandline_index - 1])
-			{
+			    argv[isc_commandline_index - 1]) {
 				isc_commandline_index--;
 				inplace = "";
 			} else {
@@ -1186,7 +1142,6 @@ main(int argc, char *argv[]) {
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 	}
-	cleanup_dst = true;
 
 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1222,8 +1177,7 @@ main(int argc, char *argv[]) {
 		fatal("missing RRSIG CDNSKEY records for %s", namestr);
 	}
 	if (dns_rdataset_isassociated(&cds_set) &&
-	    !dns_rdataset_isassociated(&cds_sig))
-	{
+	    !dns_rdataset_isassociated(&cds_sig)) {
 		fatal("missing RRSIG CDS records for %s", namestr);
 	}
 
@@ -1246,8 +1200,7 @@ main(int argc, char *argv[]) {
 	if (dns_rdataset_isassociated(&cdnskey_set)) {
 		vbprintf(1, "verify CDNSKEY signature(s)\n");
 		if (!signed_loose(matching_sigs(old_key_tbl, &cdnskey_set,
-						&cdnskey_sig)))
-		{
+						&cdnskey_sig))) {
 			fatal("could not validate child CDNSKEY RRset for %s",
 			      namestr);
 		}
@@ -1255,8 +1208,7 @@ main(int argc, char *argv[]) {
 	if (dns_rdataset_isassociated(&cds_set)) {
 		vbprintf(1, "verify CDS signature(s)\n");
 		if (!signed_loose(
-			    matching_sigs(old_key_tbl, &cds_set, &cds_sig)))
-		{
+			    matching_sigs(old_key_tbl, &cds_set, &cds_sig))) {
 			fatal("could not validate child CDS RRset for %s",
 			      namestr);
 		}
@@ -1286,7 +1238,7 @@ main(int argc, char *argv[]) {
 		vbprintf(1, "%s has neither CDS nor CDNSKEY records\n",
 			 namestr);
 		write_parent_set(ds_path, inplace, nsupdate, &old_ds_set);
-		goto cleanup;
+		exit(0);
 	}
 
 	/*
@@ -1352,8 +1304,13 @@ main(int argc, char *argv[]) {
 
 	write_parent_set(ds_path, inplace, nsupdate, &new_ds_set);
 
-cleanup:
-	print_mem_stats = true;
-	cleanup();
+	free_all_sets();
+	cleanup_logging(&lctx);
+	dst_lib_destroy();
+	if (verbose > 10) {
+		isc_mem_stats(mctx, stdout);
+	}
+	isc_mem_destroy(&mctx);
+
 	exit(0);
 }

bin/dnssec/dnssec-dsfromkey.c

@@ -23,6 +23,7 @@
 #include <isc/dir.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -313,7 +314,7 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
 
 static void
 emits(bool showall, bool cds, dns_rdata_t *rdata) {
-	unsigned int i, n;
+	unsigned i, n;
 
 	n = sizeof(dtype) / sizeof(dtype[0]);
 	for (i = 0; i < n; i++) {

bin/dnssec/dnssec-importkey.c

@@ -21,6 +21,7 @@
 #include <isc/commandline.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>

bin/dnssec/dnssec-keyfromlabel.c

@@ -22,6 +22,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -558,8 +559,7 @@ main(int argc, char **argv) {
 		flags |= DNS_KEYOWNER_ZONE;
 	} else if ((options & DST_TYPE_KEY) != 0) { /* KEY */
 		if (strcasecmp(nametype, "host") == 0 ||
-		    strcasecmp(nametype, "entity") == 0)
-		{
+		    strcasecmp(nametype, "entity") == 0) {
 			flags |= DNS_KEYOWNER_ENTITY;
 		} else if (strcasecmp(nametype, "user") == 0) {
 			flags |= DNS_KEYOWNER_USER;
@@ -586,8 +586,7 @@ main(int argc, char **argv) {
 	if (protocol == -1) {
 		protocol = DNS_KEYPROTO_DNSSEC;
 	} else if ((options & DST_TYPE_KEY) == 0 &&
-		   protocol != DNS_KEYPROTO_DNSSEC)
-	{
+		   protocol != DNS_KEYPROTO_DNSSEC) {
 		fatal("invalid DNSKEY protocol: %d", protocol);
 	}
 

bin/dnssec/dnssec-keygen.c

@@ -37,6 +37,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -253,8 +254,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 		kasp = NULL;
 		if (strcmp(cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			   name) != 0)
-		{
+			   name) != 0) {
 			continue;
 		}
 
@@ -391,8 +391,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 
 		if (!ctx->oldstyle && ctx->prepub > 0) {
 			if (ctx->setpub && ctx->setact &&
-			    (ctx->activate - ctx->prepub) < ctx->publish)
-			{
+			    (ctx->activate - ctx->prepub) < ctx->publish) {
 				fatal("Activation and publication dates "
 				      "are closer together than the\n\t"
 				      "prepublication interval.");
@@ -728,8 +727,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 
 			if (ctx->setdel) {
 				if (ctx->setinact &&
-				    ctx->deltime < ctx->inactive)
-				{
+				    ctx->deltime < ctx->inactive) {
 					fprintf(stderr,
 						"%s: warning: Key is "
 						"scheduled to be deleted "
@@ -983,8 +981,7 @@ main(int argc, char **argv) {
 			ctx.protocol = strtol(isc_commandline_argument, &endp,
 					      10);
 			if (*endp != '\0' || ctx.protocol < 0 ||
-			    ctx.protocol > 255)
-			{
+			    ctx.protocol > 255) {
 				fatal("-p must be followed by a number "
 				      "[0..255]");
 			}
@@ -1000,8 +997,7 @@ main(int argc, char **argv) {
 			ctx.signatory = strtol(isc_commandline_argument, &endp,
 					       10);
 			if (*endp != '\0' || ctx.signatory < 0 ||
-			    ctx.signatory > 15)
-			{
+			    ctx.signatory > 15) {
 				fatal("-s must be followed by a number "
 				      "[0..15]");
 			}

bin/dnssec/dnssec-revoke.c

@@ -24,6 +24,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -135,8 +136,7 @@ main(int argc, char **argv) {
 	}
 
 	if (argc < isc_commandline_index + 1 ||
-	    argv[isc_commandline_index] == NULL)
-	{
+	    argv[isc_commandline_index] == NULL) {
 		fatal("The key file name was not specified");
 	}
 	if (argc > isc_commandline_index + 1) {

bin/dnssec/dnssec-settime.c

@@ -26,6 +26,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -543,8 +544,7 @@ main(int argc, char **argv) {
 	}
 
 	if (argc < isc_commandline_index + 1 ||
-	    argv[isc_commandline_index] == NULL)
-	{
+	    argv[isc_commandline_index] == NULL) {
 		fatal("The key file name was not specified");
 	}
 	if (argc > isc_commandline_index + 1) {
@@ -552,8 +552,7 @@ main(int argc, char **argv) {
 	}
 
 	if ((setgoal || setds || setdnskey || setkrrsig || setzrrsig) &&
-	    !write_state)
-	{
+	    !write_state) {
 		fatal("Options -g, -d, -k, -r and -z require -s to be set");
 	}
 

bin/dnssec/dnssec-signzone.c

@@ -38,6 +38,7 @@
 #include <isc/base32.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
+#include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
@@ -48,6 +49,7 @@
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
+#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/rwlock.h>
@@ -55,6 +57,7 @@
 #include <isc/serial.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/tid.h>
 #include <isc/time.h>
 #include <isc/util.h>
@@ -65,7 +68,6 @@
 #include <dns/dnssec.h>
 #include <dns/ds.h>
 #include <dns/fixedname.h>
-#include <dns/kasp.h>
 #include <dns/keyvalues.h>
 #include <dns/log.h>
 #include <dns/master.h>
@@ -115,6 +117,13 @@ static int nsec_datatype = dns_rdatatype_nsec;
 #define SOA_SERIAL_UNIXTIME  2
 #define SOA_SERIAL_DATE	     3
 
+typedef struct signer_event sevent_t;
+struct signer_event {
+	ISC_EVENT_COMMON(sevent_t);
+	dns_fixedname_t *fname;
+	dns_dbnode_t *node;
+};
+
 static dns_dnsseckeylist_t keylist;
 static unsigned int keycount = 0;
 static isc_rwlock_t keylist_lock;
@@ -139,6 +148,7 @@ static const char *directory = NULL, *dsdir = NULL;
 static isc_mutex_t namelock, statslock;
 static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
+static isc_taskmgr_t *taskmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
 static dns_dbversion_t *gversion; /* The database version */
 static dns_dbiterator_t *gdbiter; /* The database iterator */
@@ -149,7 +159,8 @@ static dns_iterations_t nsec3iter = 0U;
 static unsigned char saltbuf[255];
 static unsigned char *gsalt = saltbuf;
 static size_t salt_length = 0;
-static unsigned int nloops = 0;
+static isc_task_t *write_task = NULL;
+static unsigned int ntasks = 0;
 static atomic_bool shuttingdown;
 static atomic_bool finished;
 static bool nokeys = false;
@@ -173,7 +184,6 @@ static bool output_stdout = false;
 static bool set_maxttl = false;
 static dns_ttl_t maxttl = 0;
 static bool no_max_check = false;
-static const char *sync_records = "cdnskey,cds:sha-256";
 
 #define INCSTAT(counter)            \
 	if (printstats) {           \
@@ -182,6 +192,9 @@ static const char *sync_records = "cdnskey,cds:sha-256";
 		UNLOCK(&statslock); \
 	}
 
+static void
+sign(isc_task_t *task, isc_event_t *event);
+
 /*%
  * Store a copy of 'name' in 'fzonecut' and return a pointer to that copy.
  */
@@ -202,13 +215,20 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 	isc_buffer_t *buffer = NULL;
 	isc_region_t r;
 	isc_result_t result;
-	unsigned int bufsize = 4096;
+	unsigned bufsize = 4096;
 
-	if (!output_dnssec_only) {
+	if (outputformat != dns_masterformat_text) {
 		return;
 	}
 
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &iter);
+	if (!output_dnssec_only) {
+		result = dns_master_dumpnodetostream(mctx, gdb, gversion, node,
+						     name, masterstyle, outfp);
+		check_result(result, "dns_master_dumpnodetostream");
+		return;
+	}
+
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &iter);
 	check_result(result, "dns_db_allrdatasets");
 
 	dns_rdataset_init(&rds);
@@ -255,17 +275,6 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 	dns_rdatasetiter_destroy(&iter);
 }
 
-static void
-lock_and_dumpnode(dns_name_t *name, dns_dbnode_t *node) {
-	if (!output_dnssec_only) {
-		return;
-	}
-
-	LOCK(&namelock);
-	dumpnode(name, node);
-	UNLOCK(&namelock);
-}
-
 /*%
  * Sign the given RRset with given key, and add the signature record to the
  * given tuple.
@@ -356,8 +365,7 @@ keythatsigned_unlocked(dns_rdata_rrsig_t *rrsig) {
 	dns_dnsseckey_t *key;
 
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	     key = ISC_LIST_NEXT(key, link)) {
 		if (rrsig->keyid == dst_key_id(key->key) &&
 		    rrsig->algorithm == dst_key_alg(key->key) &&
 		    dns_name_equal(&rrsig->signer, dst_key_name(key->key)))
@@ -557,8 +565,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 				 "invalid validity period\n",
 				 sigstr);
 		} else if (key == NULL && !future &&
-			   expecttofindkey(&rrsig.signer))
-		{
+			   expecttofindkey(&rrsig.signer)) {
 			/* rrsig is dropped and not replaced */
 			vbprintf(2,
 				 "\trrsig by %s dropped - "
@@ -569,8 +576,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			vbprintf(2, "\trrsig by %s %s - dnskey not found\n",
 				 keep ? "retained" : "dropped", sigstr);
 		} else if (!dns_dnssec_keyactive(key->key, now) &&
-			   remove_inactkeysigs)
-		{
+			   remove_inactkeysigs) {
 			keep = false;
 			vbprintf(2, "\trrsig by %s dropped - key inactive\n",
 				 sigstr);
@@ -671,8 +677,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	}
 
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	     key = ISC_LIST_NEXT(key, link)) {
 		if (nowsignedby[key->index]) {
 			continue;
 		}
@@ -694,8 +699,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			     curr = ISC_LIST_NEXT(curr, link))
 			{
 				if (dst_key_alg(key->key) !=
-				    dst_key_alg(curr->key))
-				{
+				    dst_key_alg(curr->key)) {
 					continue;
 				}
 				if (REVOKE(curr->key)) {
@@ -706,8 +710,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 				}
 			}
 			if (isksk(key) || !have_ksk ||
-			    (iszsk(key) && !keyset_kskonly))
-			{
+			    (iszsk(key) && !keyset_kskonly)) {
 				signwithkey(name, set, key->key, ttl, add,
 					    "signing with dnskey");
 			}
@@ -748,8 +751,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 							     DST_NUM_SUCCESSOR,
 							     &suc);
 					if (ret != ISC_R_SUCCESS ||
-					    dst_key_id(key->key) != suc)
-					{
+					    dst_key_id(key->key) != suc) {
 						continue;
 					}
 
@@ -1184,7 +1186,7 @@ signname(dns_dbnode_t *node, dns_name_t *name) {
 	dns_diff_init(mctx, &del);
 	dns_diff_init(mctx, &add);
 	rdsiter = NULL;
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	result = dns_rdatasetiter_first(rdsiter);
 	while (result == ISC_R_SUCCESS) {
@@ -1202,8 +1204,7 @@ signname(dns_dbnode_t *node, dns_name_t *name) {
 		 */
 		if (isdelegation) {
 			if (rdataset.type != nsec_datatype &&
-			    rdataset.type != dns_rdatatype_ds)
-			{
+			    rdataset.type != dns_rdatatype_ds) {
 				goto skip;
 			}
 		} else if (rdataset.type == dns_rdatatype_ds) {
@@ -1258,7 +1259,7 @@ active_node(dns_dbnode_t *node) {
 	bool found;
 
 	dns_rdataset_init(&rdataset);
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	result = dns_rdatasetiter_first(rdsiter);
 	while (result == ISC_R_SUCCESS) {
@@ -1304,8 +1305,7 @@ active_node(dns_dbnode_t *node) {
 		/*
 		 * Delete RRSIGs for types that no longer exist.
 		 */
-		result = dns_db_allrdatasets(gdb, node, gversion, 0, 0,
-					     &rdsiter2);
+		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter2);
 		check_result(result, "dns_db_allrdatasets()");
 		for (result = dns_rdatasetiter_first(rdsiter);
 		     result == ISC_R_SUCCESS;
@@ -1353,8 +1353,7 @@ active_node(dns_dbnode_t *node) {
 				check_result(result, "dns_db_deleterdataset("
 						     "rrsig)");
 			} else if (result != ISC_R_NOMORE &&
-				   result != ISC_R_SUCCESS)
-			{
+				   result != ISC_R_SUCCESS) {
 				fatal("rdataset iteration failed: %s",
 				      isc_result_totext(result));
 			}
@@ -1435,8 +1434,7 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {
 	old_serial = dns_soa_getserial(&rdata);
 
 	if (method == dns_updatemethod_date ||
-	    method == dns_updatemethod_unixtime)
-	{
+	    method == dns_updatemethod_unixtime) {
 		new_serial = dns_update_soaserial(old_serial, method, &used);
 	} else if (serial != 0 || method == dns_updatemethod_none) {
 		/* Set SOA serial to the value provided. */
@@ -1493,6 +1491,47 @@ cleanup:
 	return (result);
 }
 
+/*%
+ * Delete any RRSIG records at a node.
+ */
+static void
+cleannode(dns_db_t *db, dns_dbversion_t *dbversion, dns_dbnode_t *node) {
+	dns_rdatasetiter_t *rdsiter = NULL;
+	dns_rdataset_t set;
+	isc_result_t result, dresult;
+
+	if (outputformat != dns_masterformat_text || !disable_zone_check) {
+		return;
+	}
+
+	dns_rdataset_init(&set);
+	result = dns_db_allrdatasets(db, node, dbversion, 0, &rdsiter);
+	check_result(result, "dns_db_allrdatasets");
+	result = dns_rdatasetiter_first(rdsiter);
+	while (result == ISC_R_SUCCESS) {
+		bool destroy = false;
+		dns_rdatatype_t covers = 0;
+		dns_rdatasetiter_current(rdsiter, &set);
+		if (set.type == dns_rdatatype_rrsig) {
+			covers = set.covers;
+			destroy = true;
+		}
+		dns_rdataset_disassociate(&set);
+		result = dns_rdatasetiter_next(rdsiter);
+		if (destroy) {
+			dresult = dns_db_deleterdataset(db, node, dbversion,
+							dns_rdatatype_rrsig,
+							covers);
+			check_result(dresult, "dns_db_deleterdataset");
+		}
+	}
+	if (result != ISC_R_NOMORE) {
+		fatal("rdataset iteration failed: %s",
+		      isc_result_totext(result));
+	}
+	dns_rdatasetiter_destroy(&rdsiter);
+}
+
 /*%
  * Set up the iterator and global state before starting the tasks.
  */
@@ -1531,7 +1570,10 @@ signapex(void) {
 	result = dns_dbiterator_current(gdbiter, &node, name);
 	check_dns_dbiterator_current(result);
 	signname(node, name);
+	LOCK(&namelock);
 	dumpnode(name, node);
+	UNLOCK(&namelock);
+	cleannode(gdb, gversion, node);
 	dns_db_detachnode(gdb, &node);
 	result = dns_dbiterator_first(gdbiter);
 	if (result == ISC_R_NOMORE) {
@@ -1542,22 +1584,16 @@ signapex(void) {
 	}
 }
 
-static void
-abortwork(void *arg) {
-	UNUSED(arg);
-
-	atomic_store(&shuttingdown, true);
-}
-
 /*%
  * Assigns a node to a worker thread.  This is protected by the main task's
  * lock.
  */
 static void
-assignwork(void *arg) {
-	dns_fixedname_t fname;
+assignwork(isc_task_t *task) {
+	dns_fixedname_t *fname = NULL;
 	dns_name_t *name = NULL;
 	dns_dbnode_t *node = NULL;
+	sevent_t *sevent = NULL;
 	dns_rdataset_t nsec;
 	bool found;
 	isc_result_t result;
@@ -1565,8 +1601,6 @@ assignwork(void *arg) {
 	static dns_fixedname_t fzonecut;   /* Protected by namelock. */
 	static unsigned int ended = 0;	   /* Protected by namelock. */
 
-	UNUSED(arg);
-
 	if (atomic_load(&shuttingdown)) {
 		return;
 	}
@@ -1574,14 +1608,15 @@ assignwork(void *arg) {
 	LOCK(&namelock);
 	if (atomic_load(&finished)) {
 		ended++;
-		if (ended == nloops) {
+		if (ended == ntasks) {
+			isc_task_detach(&write_task);
 			isc_loopmgr_shutdown(loopmgr);
 		}
-		UNLOCK(&namelock);
-		return;
+		goto unlock;
 	}
 
-	name = dns_fixedname_initname(&fname);
+	fname = isc_mem_get(mctx, sizeof(dns_fixedname_t));
+	name = dns_fixedname_initname(fname);
 	node = NULL;
 	found = false;
 	while (!found) {
@@ -1616,12 +1651,10 @@ assignwork(void *arg) {
 			     !dns_name_issubdomain(name, zonecut)))
 			{
 				if (is_delegation(gdb, gversion, gorigin, name,
-						  node, NULL))
-				{
+						  node, NULL)) {
 					zonecut = savezonecut(&fzonecut, name);
 					if (!OPTOUT(nsec3flags) ||
-					    secure(name, node))
-					{
+					    secure(name, node)) {
 						found = true;
 					}
 				} else if (has_dname(gdb, gversion, node)) {
@@ -1650,24 +1683,93 @@ assignwork(void *arg) {
 	}
 	if (!found) {
 		ended++;
-		if (ended == nloops) {
+		if (ended == ntasks) {
+			isc_task_detach(&write_task);
 			isc_loopmgr_shutdown(loopmgr);
 		}
-		UNLOCK(&namelock);
-		return;
+		isc_mem_put(mctx, fname, sizeof(dns_fixedname_t));
+		goto unlock;
+	}
+	sevent = (sevent_t *)isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,
+						sign, NULL, sizeof(sevent_t));
+
+	sevent->node = node;
+	sevent->fname = fname;
+	isc_task_send(task, ISC_EVENT_PTR(&sevent));
+unlock:
+	UNLOCK(&namelock);
+}
+
+/*%
+ * Start a worker task
+ */
+static void
+startworker(void *arg) {
+	isc_task_t **tasks = (isc_task_t **)arg;
+	isc_result_t result;
+	int tid;
+
+	REQUIRE(tasks != NULL);
+
+	tid = isc_tid();
+	result = isc_task_create(taskmgr, &tasks[tid], tid);
+	if (result != ISC_R_SUCCESS) {
+		fatal("failed to create task: %s", isc_result_totext(result));
 	}
 
+	assignwork(tasks[tid]);
+}
+
+/*%
+ * Finish a worker task
+ */
+static void
+workerdone(void *arg) {
+	isc_task_t **tasks = (isc_task_t **)arg;
+
+	isc_task_detach(&tasks[isc_tid()]);
+}
+
+/*%
+ * Write a node to the output file, and restart the worker task.
+ */
+static void
+writenode(isc_task_t *task, isc_event_t *event) {
+	sevent_t *sevent = (sevent_t *)event;
+
+	LOCK(&namelock);
+	dumpnode(dns_fixedname_name(sevent->fname), sevent->node);
 	UNLOCK(&namelock);
+	cleannode(gdb, gversion, sevent->node);
+	dns_db_detachnode(gdb, &sevent->node);
+	isc_mem_put(mctx, sevent->fname, sizeof(dns_fixedname_t));
+	assignwork(task);
+	isc_event_free(&event);
+}
 
-	signname(node, dns_fixedname_name(&fname));
+/*%
+ *  Sign a database node.
+ */
+static void
+sign(isc_task_t *task, isc_event_t *event) {
+	dns_fixedname_t *fname;
+	dns_dbnode_t *node;
+	sevent_t *sevent, *wevent;
 
-	/*%
-	 * Write a node to the output file, and restart the worker task.
-	 */
-	lock_and_dumpnode(dns_fixedname_name(&fname), node);
-	dns_db_detachnode(gdb, &node);
+	UNUSED(task);
 
-	isc_job_run(loopmgr, assignwork, NULL);
+	sevent = (sevent_t *)event;
+	node = sevent->node;
+	fname = sevent->fname;
+	isc_event_free(&event);
+
+	signname(node, dns_fixedname_name(fname));
+	wevent = (sevent_t *)isc_event_allocate(mctx, write_task,
+						SIGNER_EVENT_WRITE, writenode,
+						NULL, sizeof(sevent_t));
+	wevent->node = node;
+	wevent->fname = fname;
+	isc_task_send(write_task, ISC_EVENT_PTR(&wevent));
 }
 
 /*%
@@ -1723,7 +1825,7 @@ remove_records(dns_dbnode_t *node, dns_rdatatype_t which, bool checknsec) {
 	/*
 	 * Delete any records of the given type at the apex.
 	 */
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	for (result = dns_rdatasetiter_first(rdsiter); result == ISC_R_SUCCESS;
 	     result = dns_rdatasetiter_next(rdsiter))
@@ -1734,14 +1836,12 @@ remove_records(dns_dbnode_t *node, dns_rdatatype_t which, bool checknsec) {
 		dns_rdataset_disassociate(&rdataset);
 		if (type == which || covers == which) {
 			if (which == dns_rdatatype_nsec && checknsec &&
-			    !update_chain)
-			{
+			    !update_chain) {
 				fatal("Zone contains NSEC records.  Use -u "
 				      "to update to NSEC3.");
 			}
 			if (which == dns_rdatatype_nsec3param && checknsec &&
-			    !update_chain)
-			{
+			    !update_chain) {
 				fatal("Zone contains NSEC3 chains.  Use -u "
 				      "to update to NSEC.");
 			}
@@ -1766,7 +1866,7 @@ remove_sigs(dns_dbnode_t *node, bool delegation, dns_rdatatype_t which) {
 	dns_rdataset_t rdataset;
 
 	dns_rdataset_init(&rdataset);
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, 0, &rdsiter);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets()");
 	for (result = dns_rdatasetiter_first(rdsiter); result == ISC_R_SUCCESS;
 	     result = dns_rdatasetiter_next(rdsiter))
@@ -1830,8 +1930,7 @@ nsecify(void) {
 	{
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		result = dns_db_allrdatasets(gdb, node, gversion, 0, 0,
-					     &rdsiter);
+		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 		check_result(result, "dns_db_allrdatasets()");
 		for (result = dns_rdatasetiter_first(rdsiter);
 		     result == ISC_R_SUCCESS;
@@ -2186,8 +2285,7 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 			count2++;
 			dns_rdataset_current(&tmprdataset, &rdata2);
 			if (count1 < count2 &&
-			    dns_rdata_casecompare(&rdata1, &rdata2) == 0)
-			{
+			    dns_rdata_casecompare(&rdata1, &rdata2) == 0) {
 				vbprintf(2, "removing duplicate at %s/%s\n",
 					 namestr, typestr);
 				result = dns_difftuple_create(
@@ -2242,8 +2340,7 @@ cleanup_zone(void) {
 	{
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		result = dns_db_allrdatasets(gdb, node, gversion, 0, 0,
-					     &rdsiter);
+		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
 		check_result(result, "dns_db_allrdatasets()");
 		for (result = dns_rdatasetiter_first(rdsiter);
 		     result == ISC_R_SUCCESS;
@@ -2355,16 +2452,14 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 				continue;
 			}
 			if (is_delegation(gdb, gversion, gorigin, nextname,
-					  nextnode, &nsttl))
-			{
+					  nextnode, &nsttl)) {
 				zonecut = savezonecut(&fzonecut, nextname);
 				remove_sigs(nextnode, true, 0);
 				if (generateds) {
 					add_ds(nextname, nextnode, nsttl);
 				}
 				if (OPTOUT(nsec3flags) &&
-				    !secure(nextname, nextnode))
-				{
+				    !secure(nextname, nextnode)) {
 					dns_db_detachnode(gdb, &nextnode);
 					result = dns_dbiterator_next(dbiter);
 					continue;
@@ -2498,12 +2593,10 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 				continue;
 			}
 			if (is_delegation(gdb, gversion, gorigin, nextname,
-					  nextnode, NULL))
-			{
+					  nextnode, NULL)) {
 				zonecut = savezonecut(&fzonecut, nextname);
 				if (OPTOUT(nsec3flags) &&
-				    !secure(nextname, nextnode))
-				{
+				    !secure(nextname, nextnode)) {
 					dns_db_detachnode(gdb, &nextnode);
 					result = dns_dbiterator_next(dbiter);
 					continue;
@@ -2681,8 +2774,7 @@ loadexplicitkeys(char *keyfiles[], int n, bool setksk) {
 
 		/* Skip any duplicates */
 		for (key = ISC_LIST_HEAD(keylist); key != NULL;
-		     key = ISC_LIST_NEXT(key, link))
-		{
+		     key = ISC_LIST_NEXT(key, link)) {
 			if (dst_key_id(key->key) == dst_key_id(newkey) &&
 			    dst_key_alg(key->key) == dst_key_alg(newkey))
 			{
@@ -2733,51 +2825,6 @@ clear_keylist(dns_dnsseckeylist_t *list) {
 	}
 }
 
-static void
-add_digest(char *str, size_t dlen, dns_kasp_digestlist_t *digests,
-	   bool *cdnskey) {
-	isc_result_t result;
-	isc_textregion_t r;
-	dns_dsdigest_t alg;
-	dns_kasp_digest_t *digest;
-
-	if (dlen == 7 && strncmp(str, "cdnskey", dlen) == 0) {
-		*cdnskey = true;
-		return;
-	}
-
-	if (dlen < 5 || strncmp(str, "cds:", 4) != 0) {
-		fatal("digest must specify cds:algorithm ('%.*s')", (int)dlen,
-		      str);
-	}
-
-	r.base = str + 4;
-	r.length = dlen - 4;
-	result = dns_dsdigest_fromtext(&alg, &r);
-	if (result == DNS_R_UNKNOWN) {
-		fatal("bad digest '%.*s'", (int)dlen, str);
-	} else if (result != ISC_R_SUCCESS) {
-		fatal("bad digest '%.*s': %s", (int)dlen, str,
-		      isc_result_totext(result));
-	} else if (!dst_ds_digest_supported(alg)) {
-		fatal("unsupported digest '%.*s'", (int)dlen, str);
-	}
-
-	/* Suppress duplicates */
-	for (dns_kasp_digest_t *d = ISC_LIST_HEAD(*digests); d != NULL;
-	     d = ISC_LIST_NEXT(d, link))
-	{
-		if (d->digest == alg) {
-			return;
-		}
-	}
-
-	digest = isc_mem_get(mctx, sizeof(*digest));
-	digest->digest = alg;
-	ISC_LINK_INIT(digest, link);
-	ISC_LIST_APPEND(*digests, digest, link);
-}
-
 static void
 build_final_keylist(void) {
 	isc_result_t result;
@@ -2787,39 +2834,14 @@ build_final_keylist(void) {
 	dns_dnsseckeylist_t rmkeys, matchkeys;
 	char name[DNS_NAME_FORMATSIZE];
 	dns_rdataset_t cdsset, cdnskeyset, soaset;
-	dns_kasp_digestlist_t digests;
-	dns_kasp_digest_t *d, *d_next;
-	bool cdnskey = false;
 
 	ISC_LIST_INIT(rmkeys);
 	ISC_LIST_INIT(matchkeys);
-	ISC_LIST_INIT(digests);
 
 	dns_rdataset_init(&soaset);
 	dns_rdataset_init(&cdsset);
 	dns_rdataset_init(&cdnskeyset);
 
-	if (strlen(sync_records) > 0) {
-		const char delim = ',';
-		char *digest;
-		char *s;
-		size_t dlen;
-
-		DE_CONST(sync_records, digest);
-	next_digest:
-		s = strchr(digest, delim);
-		if (s == NULL) {
-			dlen = strlen(digest);
-			add_digest(digest, dlen, &digests, &cdnskey);
-			goto findkeys;
-		}
-		dlen = s - digest;
-		add_digest(digest, dlen, &digests, &cdnskey);
-		digest = s + 1;
-		goto next_digest;
-	}
-
-findkeys:
 	/*
 	 * Find keys that match this zone in the key repository.
 	 */
@@ -2861,9 +2883,8 @@ findkeys:
 	/*
 	 * Update keylist with sync records.
 	 */
-
 	dns_dnssec_syncupdate(&keylist, &rmkeys, &cdsset, &cdnskeyset, now,
-			      &digests, cdnskey, keyttl, &diff, mctx);
+			      keyttl, &diff, mctx);
 
 	dns_name_format(gorigin, name, sizeof(name));
 
@@ -2887,13 +2908,6 @@ findkeys:
 
 	clear_keylist(&rmkeys);
 	clear_keylist(&matchkeys);
-
-	for (d = ISC_LIST_HEAD(digests); d != NULL; d = d_next) {
-		d_next = ISC_LIST_NEXT(d, link);
-		ISC_LIST_UNLINK(digests, d, link);
-		isc_mem_put(mctx, d, sizeof(*d));
-	}
-	INSIST(ISC_LIST_EMPTY(digests));
 }
 
 static void
@@ -3101,8 +3115,7 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	name = gorigin;
 
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	     key = ISC_LIST_NEXT(key, link)) {
 		if (REVOKE(key->key)) {
 			continue;
 		}
@@ -3224,8 +3237,6 @@ usage(void) {
 	fprintf(stderr, "\t-g:\t");
 	fprintf(stderr, "update DS records based on child zones' "
 			"dsset-* files\n");
-	fprintf(stderr, "\t-G sync-records:\t");
-	fprintf(stderr, "what CDNSKEY and CDS to publish\n");
 	fprintf(stderr, "\t-s [YYYYMMDDHHMMSS|+offset]:\n");
 	fprintf(stderr, "\t\tRRSIG start time "
 			"- absolute|offset (now - 1 hour)\n");
@@ -3356,6 +3367,7 @@ main(int argc, char *argv[]) {
 	bool free_output = false;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
+	isc_task_t **tasks = NULL;
 	hashlist_t hashlist;
 	bool make_keyset = false;
 	bool set_salt = false;
@@ -3367,8 +3379,8 @@ main(int argc, char *argv[]) {
 	atomic_init(&finished, false);
 
 	/* Unused letters: Bb G J q Yy (and F is reserved). */
-#define CMDLINE_FLAGS                                                          \
-	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
+#define CMDLINE_FLAGS                                                        \
+	"3:AaCc:Dd:E:e:f:FghH:i:I:j:J:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
 	"VX:xzZ:"
 
 	/*
@@ -3474,10 +3486,6 @@ main(int argc, char *argv[]) {
 			generateds = true;
 			break;
 
-		case 'G':
-			sync_records = isc_commandline_argument;
-			break;
-
 		case 'H':
 			set_iter = true;
 			/* too-many is NOT DOCUMENTED */
@@ -3566,8 +3574,8 @@ main(int argc, char *argv[]) {
 
 		case 'n':
 			endp = NULL;
-			nloops = strtol(isc_commandline_argument, &endp, 0);
-			if (*endp != '\0' || nloops > INT32_MAX) {
+			ntasks = strtol(isc_commandline_argument, &endp, 0);
+			if (*endp != '\0' || ntasks > INT32_MAX) {
 				fatal("number of cpus must be numeric");
 			}
 			break;
@@ -3708,10 +3716,10 @@ main(int argc, char *argv[]) {
 		cycle = (endtime - starttime) / 4;
 	}
 
-	if (nloops == 0) {
-		nloops = isc_os_ncpus();
+	if (ntasks == 0) {
+		ntasks = isc_os_ncpus();
 	}
-	vbprintf(4, "using %d cpus\n", nloops);
+	vbprintf(4, "using %d cpus\n", ntasks);
 
 	rdclass = strtoclass(classname);
 
@@ -3719,7 +3727,9 @@ main(int argc, char *argv[]) {
 		directory = ".";
 	}
 
-	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);
+	isc_managers_create(&mctx, ntasks, &loopmgr, &netmgr, &taskmgr);
+
+	isc_task_create(taskmgr, &write_task, 0);
 
 	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS) {
@@ -3781,8 +3791,7 @@ main(int argc, char *argv[]) {
 			outputformat = dns_masterformat_raw;
 			rawversion = strtol(outputformatstr + 4, &end, 10);
 			if (end == outputformatstr + 4 || *end != '\0' ||
-			    rawversion > 1U)
-			{
+			    rawversion > 1U) {
 				fprintf(stderr, "unknown raw format version\n");
 				exit(1);
 			}
@@ -3860,7 +3869,7 @@ main(int argc, char *argv[]) {
 	 * of keys rather early.
 	 */
 	ISC_LIST_INIT(keylist);
-	isc_rwlock_init(&keylist_lock);
+	isc_rwlock_init(&keylist_lock, 0, 0);
 
 	/*
 	 * Fill keylist with:
@@ -3891,8 +3900,7 @@ main(int argc, char *argv[]) {
 
 	/* Now enumerate the key list */
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	     key = ISC_LIST_NEXT(key, link)) {
 		key->index = keycount++;
 	}
 
@@ -3995,7 +4003,11 @@ main(int argc, char *argv[]) {
 		result = isc_file_mktemplate(output, tempfile, tempfilelen);
 		check_result(result, "isc_file_mktemplate");
 
-		result = isc_file_openunique(tempfile, &outfp);
+		if (outputformat == dns_masterformat_text) {
+			result = isc_file_openunique(tempfile, &outfp);
+		} else {
+			result = isc_file_bopenunique(tempfile, &outfp);
+		}
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to open temporary output file: %s",
 			      isc_result_totext(result));
@@ -4021,14 +4033,21 @@ main(int argc, char *argv[]) {
 		 * There is more work to do.  Spread it out over multiple
 		 * processors if possible.
 		 */
-		isc_loopmgr_setup(loopmgr, assignwork, NULL);
-		isc_loopmgr_teardown(loopmgr, abortwork, NULL);
+		tasks = isc_mem_get(mctx, ntasks * sizeof(isc_task_t *));
+		memset(tasks, 0, ntasks * sizeof(isc_task_t *));
+
+		isc_loopmgr_setup(loopmgr, startworker, tasks);
+		isc_loopmgr_teardown(loopmgr, workerdone, tasks);
+
 		isc_loopmgr_run(loopmgr);
 
 		if (!atomic_load(&finished)) {
 			fatal("process aborted by user");
 		}
+
+		isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
 	}
+	atomic_store(&shuttingdown, true);
 	postsign();
 	TIME_NOW(&sign_finish);
 
@@ -4045,7 +4064,7 @@ main(int argc, char *argv[]) {
 		}
 	}
 
-	if (!output_dnssec_only) {
+	if (outputformat != dns_masterformat_text) {
 		dns_masterrawheader_t header;
 		dns_master_initrawheader(&header);
 		if (rawversion == 0U) {
@@ -4057,7 +4076,7 @@ main(int argc, char *argv[]) {
 		result = dns_master_dumptostream(mctx, gdb, gversion,
 						 masterstyle, outputformat,
 						 &header, outfp);
-		check_result(result, "dns_master_dumptostream");
+		check_result(result, "dns_master_dumptostream3");
 	}
 
 	if (!output_stdout) {
@@ -4104,7 +4123,7 @@ main(int argc, char *argv[]) {
 		isc_mem_stats(mctx, stdout);
 	}
 
-	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr, &taskmgr);
 
 	if (printstats) {
 		TIME_NOW(&timer_finish);

bin/dnssec/dnssec-signzone.rst

@@ -21,7 +21,7 @@ dnssec-signzone - DNSSEC zone signing tool
 Synopsis
 ~~~~~~~~
 
-:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
+:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-g**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
 
 Description
 ~~~~~~~~~~~
@@ -76,13 +76,6 @@ Options
    This option indicates that DS records for child zones should be generated from a ``dsset-`` or ``keyset-``
    file. Existing DS records are removed.
 
-.. option:: -G sync-records
-
-   This option indicates which CDS and CDNSKEY records should be generated. ``sync-records`` is a
-   comma-separated string with the following allowed items: ``cdnskey``, and ``cds:<digest-type>``,
-   where ``digest-type`` is an allowed algorithm such as SHA-256 (2), or SHA-384 (4).
-   Only works in combination with smart signing (``-S``).
-
 .. option:: -K directory
 
    This option specifies the directory to search for DNSSEC keys. If not

bin/dnssec/dnssec-verify.c

@@ -20,12 +20,14 @@
 #include <isc/attributes.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
+#include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
+#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/rwlock.h>

bin/dnssec/dnssectool.c

@@ -29,6 +29,7 @@
 #include <isc/heap.h>
 #include <isc/list.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -314,8 +315,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	 */
 	n = strspn(str, "0123456789");
 	if ((n == 8u || n == 14u) &&
-	    (str[n] == '\0' || str[n] == '-' || str[n] == '+'))
-	{
+	    (str[n] == '\0' || str[n] == '-' || str[n] == '+')) {
 		char timestr[15];
 
 		strlcpy(timestr, str, sizeof(timestr));
@@ -331,8 +331,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 		base = val;
 		str += n;
 	} else if (n == 10u &&
-		   (str[n] == '\0' || str[n] == '-' || str[n] == '+'))
-	{
+		   (str[n] == '\0' || str[n] == '-' || str[n] == '+')) {
 		base = strtoll(str, &endp, 0);
 		str += 10;
 	} else if (strncmp(str, "now", 3) == 0) {
@@ -407,7 +406,7 @@ cmp_dtype(const void *ap, const void *bp) {
 
 void
 add_dtype(unsigned int dt) {
-	unsigned int i, n;
+	unsigned i, n;
 
 	/* ensure there is space for a zero terminator */
 	n = sizeof(dtype) / sizeof(dtype[0]) - 1;

bin/named/Makefile.am

@@ -7,13 +7,13 @@ AM_CPPFLAGS +=				\
 	$(LIBNS_CFLAGS)			\
 	$(LIBISCCC_CFLAGS)		\
 	$(LIBISCCFG_CFLAGS)		\
+	$(LIBBIND9_CFLAGS)		\
 	$(OPENSSL_CFLAGS)		\
 	$(LIBCAP_CFLAGS)		\
 	$(LMDB_CFLAGS)			\
 	$(MAXMINDDB_CFLAGS)		\
 	$(DNSTAP_CFLAGS)		\
 	$(LIBUV_CFLAGS)			\
-	$(LIBSYSTEMD_CFLAGS)		\
 	$(ZLIB_CFLAGS)
 
 if HAVE_JSON_C
@@ -102,13 +102,14 @@ named_LDADD =					\
 	$(LIBNS_LIBS)				\
 	$(LIBISCCC_LIBS)			\
 	$(LIBISCCFG_LIBS)			\
+	$(LIBBIND9_LIBS)			\
 	$(OPENSSL_LIBS)				\
 	$(LIBCAP_LIBS)				\
 	$(LMDB_LIBS)				\
 	$(MAXMINDDB_LIBS)			\
 	$(DNSTAP_LIBS)				\
 	$(LIBUV_LIBS)				\
-	$(LIBSYSTEMD_LIBS)			\
+	$(LIBXML2_LIBS)				\
 	$(ZLIB_LIBS)
 
 if HAVE_JSON_C
@@ -120,8 +121,3 @@ if HAVE_LIBNGHTTP2
 named_LDADD +=					\
 	$(LIBNGHTTP2_LIBS)
 endif HAVE_LIBNGHTTP2
-
-if HAVE_LIBXML2
-named_LDADD +=					\
-	$(LIBXML2_LIBS)
-endif HAVE_LIBXML2

bin/named/bind9.xsl

@@ -15,7 +15,7 @@
   <xsl:output method="html" indent="yes" version="4.0"/>
   <!-- the version number **below** must match version in bin/named/statschannel.c -->
   <!-- don't forget to update "/xml/v<STATS_XML_VERSION_MAJOR>" in the HTTP endpoints listed below -->
-  <xsl:template match="statistics[@version=&quot;3.14&quot;]">
+  <xsl:template match="statistics[@version=&quot;3.12&quot;]">
     <html>
       <head>
         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
@@ -156,6 +156,29 @@
       background-color: #99ddff;
      }
 
+     table.tasks {
+      border: 1px solid grey;
+      width: 500px;
+     }
+     table.tasks th {
+      text-align: center;
+      border: 1px solid grey;
+      width: 150px;
+     }
+     table.tasks td {
+      text-align: right;
+      font-family: monospace;
+     }
+     table.tasks td:nth-child(2) {
+      text-align: center;
+     }
+     table.tasks td:nth-child(4) {
+      text-align: center;
+     }
+     table.tasks tr:hover{
+      background-color: #99ddff;
+     }
+
      table.netstat {
       border: 1px solid grey;
       width: 500px;
@@ -304,6 +327,7 @@
 	<a href="/xml/v3/server">Server</a>,
 	<a href="/xml/v3/zones">Zones</a>,
 	<a href="/xml/v3/net">Network</a>,
+	<a href="/xml/v3/tasks">Tasks</a>,
 	<a href="/xml/v3/mem">Memory</a> and
 	<a href="/xml/v3/traffic">Traffic Size</a></p>
         <hr/>
@@ -907,6 +931,85 @@
             </xsl:for-each>
           </xsl:for-each>
         </xsl:if>
+        <xsl:if test="taskmgr/thread-model/type">
+          <h2>Task Manager Configuration</h2>
+          <table class="counters">
+            <tr>
+              <th class="even">Thread-Model</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/type"/>
+              </td>
+            </tr>
+            <tr class="odd">
+              <th>Worker Threads</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/worker-threads"/>
+              </td>
+            </tr>
+            <tr class="even">
+              <th>Default Quantum</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/default-quantum"/>
+              </td>
+            </tr>
+            <tr class="odd">
+              <th>Tasks Running</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/tasks-running"/>
+              </td>
+            </tr>
+            <tr class="even">
+              <th>Tasks Ready</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/tasks-ready"/>
+              </td>
+            </tr>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="taskmgr/tasks/task">
+          <h2>Tasks</h2>
+          <table class="tasks">
+            <tr>
+              <th>ID</th>
+              <th>Name</th>
+              <th>References</th>
+              <th>State</th>
+              <th>Quantum</th>
+              <th>Events</th>
+            </tr>
+            <xsl:for-each select="taskmgr/tasks/task">
+              <xsl:sort select="name"/>
+              <xsl:variable name="css-class14">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class14}">
+                <td>
+                  <xsl:value-of select="id"/>
+                </td>
+                <td>
+                  <xsl:value-of select="name"/>
+                </td>
+                <td>
+                  <xsl:value-of select="references"/>
+                </td>
+                <td>
+                  <xsl:value-of select="state"/>
+                </td>
+                <td>
+                  <xsl:value-of select="quantum"/>
+                </td>
+                <td>
+                  <xsl:value-of select="events"/>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+          <br/>
+        </xsl:if>
         <xsl:if test="memory/summary">
           <h2>Memory Usage Summary</h2>
           <table class="counters">
@@ -936,7 +1039,12 @@
               <th>ID</th>
               <th>Name</th>
               <th>References</th>
+              <th>TotalUse</th>
               <th>InUse</th>
+              <th>MaxUse</th>
+              <th>Malloced</th>
+              <th>MaxMalloced</th>
+              <th>BlockSize</th>
               <th>Pools</th>
               <th>HiWater</th>
               <th>LoWater</th>
@@ -959,9 +1067,24 @@
                 <td>
                   <xsl:value-of select="references"/>
                 </td>
+                <td>
+                  <xsl:value-of select="total"/>
+                </td>
                 <td>
                   <xsl:value-of select="inuse"/>
                 </td>
+                <td>
+                  <xsl:value-of select="maxinuse"/>
+                </td>
+                <td>
+                  <xsl:value-of select="malloced"/>
+                </td>
+                <td>
+                  <xsl:value-of select="maxmalloced"/>
+                </td>
+                <td>
+                  <xsl:value-of select="blocksize"/>
+                </td>
                 <td>
                   <xsl:value-of select="pools"/>
                 </td>

bin/named/config.c

@@ -49,12 +49,17 @@ static char defaultconf[] = "\
 options {\n\
 	answer-cookie true;\n\
 	automatic-interface-scan yes;\n\
-#	blackhole {none;};\n\
-	cookie-algorithm siphash24;\n\
+	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
+#	blackhole {none;};\n"
+			    "	cookie-algorithm siphash24;\n"
+			    "	coresize default;\n\
+	datasize default;\n"
+			    "\
 #	directory <none>\n\
 	dnssec-policy \"none\";\n\
 	dump-file \"named_dump.db\";\n\
-	edns-udp-size 1232;\n"
+	edns-udp-size 1232;\n\
+	files unlimited;\n"
 #if defined(HAVE_GEOIP2)
 			    "\
 	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
@@ -100,6 +105,7 @@ options {\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
+	reserved-sockets 512;\n\
 	resolver-query-timeout 10;\n\
 	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
@@ -109,6 +115,7 @@ options {\n\
 	session-keyalg hmac-sha256;\n\
 #	session-keyfile \"" NAMED_LOCALSTATEDIR "/run/named/session.key\";\n\
 	session-keyname local-ddns;\n\
+	stacksize default;\n\
 	startup-notify-rate 20;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
@@ -129,7 +136,6 @@ options {\n\
 	trust-anchor-telemetry yes;\n\
 	udp-receive-buffer 0;\n\
 	udp-send-buffer 0;\n\
-	update-quota 100;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
@@ -146,7 +152,6 @@ options {\n\
 	check-names response ignore;\n\
 	check-names secondary warn;\n\
 	check-spf warn;\n\
-	check-svcb yes;\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-validation " VALIDATION_DEFAULT "; \n"
@@ -207,6 +212,8 @@ options {\n\
 	allow-query-on {any;};\n\
 	allow-transfer {any;};\n\
 #	also-notify <none>\n\
+	alt-transfer-source *;\n\
+	alt-transfer-source-v6 *;\n\
 	check-integrity yes;\n\
 	check-mx-cname warn;\n\
 	check-sibling yes;\n\
@@ -215,6 +222,7 @@ options {\n\
 	dialup no;\n\
 	dnssec-dnskey-kskonly yes;\n\
 	dnssec-loadkeys-interval 60;\n\
+	dnssec-secure-to-insecure no;\n\
 	dnssec-update-mode maintain;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
@@ -294,7 +302,6 @@ dnssec-policy \"default\" {\n\
 		csk key-directory lifetime unlimited algorithm 13;\n\
 	};\n\
 \n\
-	cds-digest-types { 2; };\n\
 	dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
 	publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
 	retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
@@ -387,8 +394,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 	for (i = 0; maps[i] != NULL; i++) {
 		checknames = NULL;
 		if (cfg_map_get(maps[i], "check-names", &checknames) ==
-		    ISC_R_SUCCESS)
-		{
+		    ISC_R_SUCCESS) {
 			/*
 			 * Zone map entry is not a list.
 			 */
@@ -404,8 +410,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 
 				for (size_t j = 0; names[j] != NULL; j++) {
 					if (strcasecmp(cfg_obj_asstring(type),
-						       names[j]) == 0)
-					{
+						       names[j]) == 0) {
 						*obj = cfg_tuple_get(value,
 								     "mode");
 						return (ISC_R_SUCCESS);
@@ -478,8 +483,7 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	if (strcasecmp(str, "primary") == 0 || strcasecmp(str, "master") == 0) {
 		ztype = dns_zone_primary;
 	} else if (strcasecmp(str, "secondary") == 0 ||
-		   strcasecmp(str, "slave") == 0)
-	{
+		   strcasecmp(str, "slave") == 0) {
 		ztype = dns_zone_secondary;
 	} else if (strcasecmp(str, "mirror") == 0) {
 		ztype = dns_zone_mirror;
@@ -495,6 +499,109 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	return (ztype);
 }
 
+isc_result_t
+named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
+		       in_port_t defport, isc_mem_t *mctx,
+		       isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
+		       uint32_t *countp) {
+	int count, i = 0;
+	const cfg_obj_t *addrlist;
+	const cfg_obj_t *portobj, *dscpobj;
+	const cfg_listelt_t *element;
+	isc_sockaddr_t *addrs;
+	in_port_t port;
+	isc_dscp_t dscp = -1, *dscps = NULL;
+	isc_result_t result;
+
+	INSIST(addrsp != NULL && *addrsp == NULL);
+	INSIST(dscpsp == NULL || *dscpsp == NULL);
+	INSIST(countp != NULL);
+
+	addrlist = cfg_tuple_get(list, "addresses");
+	count = named_config_listcount(addrlist);
+
+	portobj = cfg_tuple_get(list, "port");
+	if (cfg_obj_isuint32(portobj)) {
+		uint32_t val = cfg_obj_asuint32(portobj);
+		if (val > UINT16_MAX) {
+			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
+				    "port '%u' out of range", val);
+			return (ISC_R_RANGE);
+		}
+		port = (in_port_t)val;
+	} else if (defport != 0) {
+		port = defport;
+	} else {
+		result = named_config_getport(config, "port", &port);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+
+	if (dscpsp != NULL) {
+		dscpobj = cfg_tuple_get(list, "dscp");
+		if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
+			if (cfg_obj_asuint32(dscpobj) > 63) {
+				cfg_obj_log(dscpobj, named_g_lctx,
+					    ISC_LOG_ERROR,
+					    "dscp value '%u' is out of range",
+					    cfg_obj_asuint32(dscpobj));
+				return (ISC_R_RANGE);
+			}
+			dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
+		}
+
+		dscps = isc_mem_get(mctx, count * sizeof(isc_dscp_t));
+	}
+
+	addrs = isc_mem_get(mctx, count * sizeof(isc_sockaddr_t));
+
+	for (element = cfg_list_first(addrlist); element != NULL;
+	     element = cfg_list_next(element), i++)
+	{
+		const cfg_obj_t *addr;
+		INSIST(i < count);
+		addr = cfg_listelt_value(element);
+		addrs[i] = *cfg_obj_assockaddr(addr);
+		if (dscpsp != NULL) {
+			isc_dscp_t innerdscp;
+			innerdscp = cfg_obj_getdscp(addr);
+			if (innerdscp == -1) {
+				innerdscp = dscp;
+			}
+			dscps[i] = innerdscp;
+		}
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			isc_sockaddr_setport(&addrs[i], port);
+		}
+	}
+	INSIST(i == count);
+
+	*addrsp = addrs;
+	*countp = count;
+
+	if (dscpsp != NULL) {
+		*dscpsp = dscps;
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+void
+named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
+		       isc_dscp_t **dscpsp, uint32_t count) {
+	INSIST(addrsp != NULL && *addrsp != NULL);
+	INSIST(dscpsp == NULL || *dscpsp != NULL);
+
+	isc_mem_put(mctx, *addrsp, count * sizeof(isc_sockaddr_t));
+	*addrsp = NULL;
+
+	if (dscpsp != NULL) {
+		isc_mem_put(mctx, *dscpsp, count * sizeof(isc_dscp_t));
+		*dscpsp = NULL;
+	}
+}
+
 static isc_result_t
 getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 	      const cfg_obj_t **ret) {
@@ -514,8 +621,7 @@ getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 	while (elt != NULL) {
 		obj = cfg_listelt_value(elt);
 		if (strcasecmp(cfg_obj_asstring(cfg_tuple_get(obj, "name")),
-			       name) == 0)
-		{
+			       name) == 0) {
 			*ret = obj;
 			return (ISC_R_SUCCESS);
 		}
@@ -575,58 +681,65 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	return (ISC_R_SUCCESS);
 }
 
-#define grow_array(mctx, array, newlen, oldlen)                       \
-	if (newlen >= oldlen) {                                       \
-		size_t newsize = (newlen + 16) * sizeof(array[0]);    \
-		size_t oldsize = oldlen * sizeof(array[0]);           \
-		array = isc_mem_regetx(mctx, array, oldsize, newsize, \
-				       ISC_MEM_ZERO);                 \
-		oldlen = newlen + 16;                                 \
+#define grow_array(mctx, array, newlen, oldlen)                    \
+	if (newlen >= oldlen) {                                    \
+		size_t newsize = (newlen + 16) * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]);        \
+		void *tmp = isc_mem_get(mctx, newsize);            \
+		memset(tmp, 0, newsize);                           \
+		if (oldlen != 0) {                                 \
+			memmove(tmp, array, oldsize);              \
+			isc_mem_put(mctx, array, oldsize);         \
+		}                                                  \
+		array = tmp;                                       \
+		oldlen = newlen + 16;                              \
 	}
 
-#define shrink_array(mctx, array, newlen, oldlen)                     \
-	if (newlen < oldlen) {                                        \
-		size_t newsize = newlen * sizeof(array[0]);           \
-		size_t oldsize = oldlen * sizeof(array[0]);           \
-		array = isc_mem_regetx(mctx, array, oldsize, newsize, \
-				       ISC_MEM_ZERO);                 \
-		oldlen = newlen;                                      \
+#define shrink_array(mctx, array, newlen, oldlen)           \
+	if (newlen < oldlen) {                              \
+		void *tmp = NULL;                           \
+		size_t newsize = newlen * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]); \
+		if (newlen != 0) {                          \
+			tmp = isc_mem_get(mctx, newsize);   \
+			memset(tmp, 0, newsize);            \
+			memmove(tmp, array, newsize);       \
+		} else {                                    \
+			tmp = NULL;                         \
+		}                                           \
+		isc_mem_put(mctx, array, oldsize);          \
+		array = tmp;                                \
+		oldlen = newlen;                            \
 	}
 
 isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
 			     const cfg_obj_t *list, isc_mem_t *mctx,
 			     dns_ipkeylist_t *ipkl) {
-	uint32_t addrcount = 0, srccount = 0;
-	uint32_t keycount = 0, tlscount = 0;
-	uint32_t listcount = 0, l = 0, i = 0;
+	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, tlscount = 0,
+		 i = 0;
+	uint32_t listcount = 0, l = 0, j;
 	uint32_t stackcount = 0, pushed = 0;
 	isc_result_t result;
 	const cfg_listelt_t *element;
 	const cfg_obj_t *addrlist;
 	const cfg_obj_t *portobj;
-	const cfg_obj_t *src4obj;
-	const cfg_obj_t *src6obj;
+	const cfg_obj_t *dscpobj;
 	in_port_t port = (in_port_t)0;
 	in_port_t def_port;
 	in_port_t def_tlsport;
-	isc_sockaddr_t src4;
-	isc_sockaddr_t src6;
+	isc_dscp_t dscp = -1;
 	isc_sockaddr_t *addrs = NULL;
-	isc_sockaddr_t *sources = NULL;
+	isc_dscp_t *dscps = NULL;
 	dns_name_t **keys = NULL;
 	dns_name_t **tlss = NULL;
 	struct {
 		const char *name;
-		in_port_t port;
-		isc_sockaddr_t *src4s;
-		isc_sockaddr_t *src6s;
 	} *lists = NULL;
 	struct {
 		const cfg_listelt_t *element;
 		in_port_t port;
-		isc_sockaddr_t src4;
-		isc_sockaddr_t src6;
+		isc_dscp_t dscp;
 	} *stack = NULL;
 
 	REQUIRE(ipkl != NULL);
@@ -634,6 +747,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
 	REQUIRE(ipkl->addrs == NULL);
 	REQUIRE(ipkl->keys == NULL);
 	REQUIRE(ipkl->tlss == NULL);
+	REQUIRE(ipkl->dscps == NULL);
 	REQUIRE(ipkl->labels == NULL);
 	REQUIRE(ipkl->allocated == 0);
 
@@ -650,11 +764,15 @@ named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
 		goto cleanup;
 	}
 
+	result = named_config_getdscp(config, &dscp);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
 newlist:
 	addrlist = cfg_tuple_get(list, "addresses");
 	portobj = cfg_tuple_get(list, "port");
-	src4obj = cfg_tuple_get(list, "source");
-	src6obj = cfg_tuple_get(list, "source-v6");
+	dscpobj = cfg_tuple_get(list, "dscp");
 
 	if (cfg_obj_isuint32(portobj)) {
 		uint32_t val = cfg_obj_asuint32(portobj);
@@ -667,16 +785,15 @@ newlist:
 		port = (in_port_t)val;
 	}
 
-	if (src4obj != NULL && cfg_obj_issockaddr(src4obj)) {
-		src4 = *cfg_obj_assockaddr(src4obj);
-	} else {
-		isc_sockaddr_any(&src4);
-	}
-
-	if (src6obj != NULL && cfg_obj_issockaddr(src6obj)) {
-		src6 = *cfg_obj_assockaddr(src6obj);
-	} else {
-		isc_sockaddr_any6(&src6);
+	if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
+		if (cfg_obj_asuint32(dscpobj) > 63) {
+			cfg_obj_log(dscpobj, named_g_lctx, ISC_LOG_ERROR,
+				    "dscp value '%u' is out of range",
+				    cfg_obj_asuint32(dscpobj));
+			result = ISC_R_RANGE;
+			goto cleanup;
+		}
+		dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
 	}
 
 	result = ISC_R_NOMEMORY;
@@ -696,7 +813,6 @@ resume:
 		if (!cfg_obj_issockaddr(addr)) {
 			const char *listname = cfg_obj_asstring(addr);
 			isc_result_t tresult;
-			uint32_t j;
 
 			/* Grow lists? */
 			grow_array(mctx, lists, l, listcount);
@@ -733,18 +849,21 @@ resume:
 			 */
 			stack[pushed].element = cfg_list_next(element);
 			stack[pushed].port = port;
-			stack[pushed].src4 = src4;
-			stack[pushed].src6 = src6;
+			stack[pushed].dscp = dscp;
 			pushed++;
 			goto newlist;
 		}
 
 		grow_array(mctx, addrs, i, addrcount);
+		grow_array(mctx, dscps, i, dscpcount);
 		grow_array(mctx, keys, i, keycount);
 		grow_array(mctx, tlss, i, tlscount);
-		grow_array(mctx, sources, i, srccount);
 
 		addrs[i] = *cfg_obj_assockaddr(addr);
+		dscps[i] = cfg_obj_getdscp(addr);
+		if (dscps[i] == -1) {
+			dscps[i] = dscp;
+		}
 
 		result = named_config_getname(mctx, key, &keys[i]);
 		if (result != ISC_R_SUCCESS) {
@@ -760,51 +879,32 @@ resume:
 			goto cleanup;
 		}
 
-		/* If the port is unset, take it from one of the upper levels */
-		if (isc_sockaddr_getport(&addrs[i]) == 0) {
-			in_port_t addr_port = port;
-
-			/* If unset, use the default port or tls-port */
-			if (addr_port == 0) {
-				if (tlss[i] != NULL) {
-					addr_port = def_tlsport;
-				} else {
-					addr_port = def_port;
-				}
+		/* Set the default port or tls-port */
+		if (port == 0) {
+			if (tlss[i] != NULL) {
+				port = def_tlsport;
+			} else {
+				port = def_port;
 			}
-
-			isc_sockaddr_setport(&addrs[i], addr_port);
 		}
 
-		switch (isc_sockaddr_pf(&addrs[i])) {
-		case PF_INET:
-			sources[i] = src4;
-			break;
-		case PF_INET6:
-			sources[i] = src6;
-			break;
-		default:
-			i++; /* Increment here so that cleanup on error works.
-			      */
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			isc_sockaddr_setport(&addrs[i], port);
 		}
-
 		i++;
 	}
 	if (pushed != 0) {
 		pushed--;
 		element = stack[pushed].element;
 		port = stack[pushed].port;
-		src4 = stack[pushed].src4;
-		src6 = stack[pushed].src6;
+		dscp = stack[pushed].dscp;
 		goto resume;
 	}
 
 	shrink_array(mctx, addrs, i, addrcount);
+	shrink_array(mctx, dscps, i, dscpcount);
 	shrink_array(mctx, keys, i, keycount);
 	shrink_array(mctx, tlss, i, tlscount);
-	shrink_array(mctx, sources, i, srccount);
 
 	if (lists != NULL) {
 		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
@@ -813,14 +913,15 @@ resume:
 		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
 	}
 
+	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
 	INSIST(tlscount == addrcount);
-	INSIST(srccount == addrcount);
+	INSIST(keycount == dscpcount);
 
 	ipkl->addrs = addrs;
+	ipkl->dscps = dscps;
 	ipkl->keys = keys;
 	ipkl->tlss = tlss;
-	ipkl->sources = sources;
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;
 
@@ -830,8 +931,11 @@ cleanup:
 	if (addrs != NULL) {
 		isc_mem_put(mctx, addrs, addrcount * sizeof(addrs[0]));
 	}
+	if (dscps != NULL) {
+		isc_mem_put(mctx, dscps, dscpcount * sizeof(dscps[0]));
+	}
 	if (keys != NULL) {
-		for (size_t j = 0; j < i; j++) {
+		for (j = 0; j < i; j++) {
 			if (keys[j] == NULL) {
 				continue;
 			}
@@ -843,7 +947,7 @@ cleanup:
 		isc_mem_put(mctx, keys, keycount * sizeof(keys[0]));
 	}
 	if (tlss != NULL) {
-		for (size_t j = 0; j < i; j++) {
+		for (j = 0; j < i; j++) {
 			if (tlss[j] == NULL) {
 				continue;
 			}
@@ -854,9 +958,6 @@ cleanup:
 		}
 		isc_mem_put(mctx, tlss, tlscount * sizeof(tlss[0]));
 	}
-	if (sources != NULL) {
-		isc_mem_put(mctx, sources, srccount * sizeof(sources[0]));
-	}
 	if (lists != NULL) {
 		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
 	}
@@ -895,6 +996,32 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp) {
+	const cfg_obj_t *options = NULL;
+	const cfg_obj_t *dscpobj = NULL;
+	isc_result_t result;
+
+	(void)cfg_map_get(config, "options", &options);
+	if (options == NULL) {
+		return (ISC_R_SUCCESS);
+	}
+
+	result = cfg_map_get(options, "dscp", &dscpobj);
+	if (result != ISC_R_SUCCESS || dscpobj == NULL) {
+		*dscpp = -1;
+		return (ISC_R_SUCCESS);
+	}
+	if (cfg_obj_asuint32(dscpobj) >= 64) {
+		cfg_obj_log(dscpobj, named_g_lctx, ISC_LOG_ERROR,
+			    "dscp '%u' out of range",
+			    cfg_obj_asuint32(dscpobj));
+		return (ISC_R_RANGE);
+	}
+	*dscpp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
+	return (ISC_R_SUCCESS);
+}
+
 struct keyalgorithms {
 	const char *str;
 	enum {

bin/named/control.c

@@ -15,6 +15,7 @@
 
 #include <stdbool.h>
 
+#include <isc/event.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -96,7 +97,10 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		return (result);
 	}
 
-	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
+	result = isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
 
 	isc_buffer_init(&src, cmdline, strlen(cmdline));
 	isc_buffer_add(&src, strlen(cmdline));

bin/named/controlconf.c

@@ -16,9 +16,9 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
-#include <isc/async.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
+#include <isc/event.h>
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -30,18 +30,21 @@
 #include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/util.h>
 
 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
+#include <isccc/events.h>
 #include <isccc/sexpr.h>
 #include <isccc/symtab.h>
 #include <isccc/util.h>
 
-#include <isccfg/check.h>
 #include <isccfg/namedconf.h>
 
+#include <bind9/check.h>
+
 #include <named/config.h>
 #include <named/control.h>
 #include <named/log.h>
@@ -372,19 +375,24 @@ cleanup:
 }
 
 static void
-control_command(void *arg) {
-	controlconnection_t *conn = (controlconnection_t *)arg;
+control_command(isc_task_t *task, isc_event_t *event) {
+	controlconnection_t *conn = event->ev_arg;
 	controllistener_t *listener = conn->listener;
 
+	UNUSED(task);
+
 	if (atomic_load_acquire(&listener->controls->shuttingdown)) {
 		conn_cleanup(conn);
 		isc_nmhandle_detach(&conn->cmdhandle);
-		return;
+		goto done;
 	}
 
 	conn->result = named_control_docommand(conn->request,
 					       listener->readonly, &conn->text);
 	control_respond(conn->cmdhandle, conn);
+
+done:
+	isc_event_free(&event);
 }
 
 static void
@@ -392,6 +400,7 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	controlconnection_t *conn = (controlconnection_t *)arg;
 	controllistener_t *listener = conn->listener;
 	controlkey_t *key = NULL;
+	isc_event_t *event = NULL;
 	isccc_time_t sent;
 	isccc_time_t exp;
 	uint32_t nonce;
@@ -460,8 +469,7 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 
 	if (isccc_cc_lookupuint32(conn->ctrl, "_tim", &sent) == ISC_R_SUCCESS) {
 		if ((sent + CLOCKSKEW) < conn->now ||
-		    (sent - CLOCKSKEW) > conn->now)
-		{
+		    (sent - CLOCKSKEW) > conn->now) {
 			log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
 			goto cleanup;
 		}
@@ -526,7 +534,9 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	 * Trigger the command.
 	 */
 
-	isc_async_run(named_g_mainloop, control_command, conn);
+	event = isc_event_allocate(listener->mctx, conn, NAMED_EVENT_COMMAND,
+				   control_command, conn, sizeof(isc_event_t));
+	isc_task_send(named_g_server->task, &event);
 
 	return;
 
@@ -838,7 +848,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		CHECK(ISC_R_NOMEMORY);
 	}
 
-	CHECK(isccfg_check_key(key, named_g_lctx));
+	CHECK(bind9_check_key(key, named_g_lctx));
 
 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
@@ -906,8 +916,7 @@ get_key_info(const cfg_obj_t *config, const cfg_obj_t *control,
 	control_keylist = cfg_tuple_get(control, "keys");
 
 	if (!cfg_obj_isvoid(control_keylist) &&
-	    cfg_list_first(control_keylist) != NULL)
-	{
+	    cfg_list_first(control_keylist) != NULL) {
 		result = cfg_map_get(config, "key", &global_keylist);
 
 		if (result == ISC_R_SUCCESS) {

bin/named/dlz_dlopen_driver.c

@@ -18,6 +18,7 @@
 #include <string.h>
 
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/util.h>
 #include <isc/uv.h>
@@ -224,11 +225,12 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 
 	isc_mem_create(&mctx);
 	cd = isc_mem_get(mctx, sizeof(*cd));
-	*cd = (dlopen_data_t){
-		.mctx = mctx,
-		.dl_path = isc_mem_strdup(mctx, argv[1]),
-		.dlzname = isc_mem_strdup(mctx, dlzname),
-	};
+	memset(cd, 0, sizeof(*cd));
+
+	cd->mctx = mctx;
+
+	cd->dl_path = isc_mem_strdup(cd->mctx, argv[1]);
+	cd->dlzname = isc_mem_strdup(cd->mctx, dlzname);
 
 	/* Initialize the lock */
 	isc_mutex_init(&cd->lock);
@@ -530,7 +532,8 @@ dlz_dlopen_init(isc_mem_t *mctx) {
 				  mctx, &dlz_dlopen);
 
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR("dns_sdlzregister() failed: %s",
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "dns_sdlzregister() failed: %s",
 				 isc_result_totext(result));
 		result = ISC_R_UNEXPECTED;
 	}

bin/named/geoip.c

@@ -18,6 +18,7 @@
 #endif /* if defined(HAVE_GEOIP2) */
 
 #include <isc/dir.h>
+#include <isc/print.h>
 #include <isc/string.h>
 #include <isc/util.h>
 

bin/named/include/named/builtin.h

@@ -15,19 +15,8 @@
 
 /*! \file */
 
-#include <inttypes.h>
-
-#include <isc/lang.h>
 #include <isc/types.h>
 
-#include <dns/clientinfo.h>
-#include <dns/types.h>
-
-/***
- *** Functions
- ***/
-
-/* Initialization functions for builtin zone databases */
 isc_result_t
 named_builtin_init(void);
 

bin/named/include/named/config.h

@@ -52,6 +52,16 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 dns_zonetype_t
 named_config_getzonetype(const cfg_obj_t *zonetypeobj);
 
+isc_result_t
+named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
+		       in_port_t defport, isc_mem_t *mctx,
+		       isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
+		       uint32_t *countp);
+
+void
+named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
+		       isc_dscp_t **dscpsp, uint32_t count);
+
 isc_result_t
 named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			   const char *name, const cfg_obj_t **ret);
@@ -71,3 +81,6 @@ named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
 isc_result_t
 named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
 			      unsigned int *typep, uint16_t *digestbits);
+
+isc_result_t
+named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp);

bin/named/include/named/globals.h

@@ -50,6 +50,7 @@
 EXTERN isc_mem_t *named_g_mctx		      INIT(NULL);
 EXTERN unsigned int named_g_cpus	      INIT(0);
 EXTERN unsigned int named_g_udpdisp	      INIT(0);
+EXTERN isc_taskmgr_t *named_g_taskmgr	      INIT(NULL);
 EXTERN isc_loop_t *named_g_mainloop	      INIT(NULL);
 EXTERN isc_loopmgr_t *named_g_loopmgr	      INIT(NULL);
 EXTERN dns_dispatchmgr_t *named_g_dispatchmgr INIT(NULL);
@@ -76,6 +77,7 @@ EXTERN in_port_t named_g_port	       INIT(0);
 EXTERN in_port_t named_g_tlsport       INIT(0);
 EXTERN in_port_t named_g_httpsport     INIT(0);
 EXTERN in_port_t named_g_httpport      INIT(0);
+EXTERN isc_dscp_t named_g_dscp	       INIT(-1);
 
 EXTERN in_port_t named_g_http_listener_clients INIT(0);
 EXTERN in_port_t named_g_http_streams_per_conn INIT(0);
@@ -96,7 +98,7 @@ EXTERN unsigned int named_g_debuglevel	     INIT(0);
 EXTERN cfg_obj_t *named_g_config	   INIT(NULL);
 EXTERN const cfg_obj_t *named_g_defaults   INIT(NULL);
 EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
-EXTERN const char *named_g_defaultbindkeys INIT(NULL);
+EXTERN const char *named_g_defaultbindkeys INIT(NAMED_SYSCONFDIR "/bind.keys");
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");
 
 EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
@@ -104,6 +106,14 @@ EXTERN dns_name_t			    named_g_sessionkeyname;
 EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);
 
+/*
+ * Initial resource limits.
+ */
+EXTERN isc_resourcevalue_t named_g_initstacksize INIT(0);
+EXTERN isc_resourcevalue_t named_g_initdatasize	 INIT(0);
+EXTERN isc_resourcevalue_t named_g_initcoresize	 INIT(0);
+EXTERN isc_resourcevalue_t named_g_initopenfiles INIT(0);
+
 /*
  * Misc.
  */

bin/named/include/named/os.h

@@ -62,6 +62,9 @@ named_os_issingleton(const char *filename);
 void
 named_os_shutdown(void);
 
+isc_result_t
+named_os_gethostname(char *buf, size_t len);
+
 void
 named_os_shutdownmsg(char *command, isc_buffer_t *text);
 

bin/named/include/named/server.h

@@ -38,6 +38,14 @@
 
 #include <named/types.h>
 
+#define NAMED_EVENTCLASS     ISC_EVENTCLASS(0x4E43)
+#define NAMED_EVENT_RELOAD   (NAMED_EVENTCLASS + 0)
+#define NAMED_EVENT_DELZONE  (NAMED_EVENTCLASS + 1)
+#define NAMED_EVENT_COMMAND  (NAMED_EVENTCLASS + 2)
+#define NAMED_EVENT_TATSEND  (NAMED_EVENTCLASS + 3)
+#define NAMED_EVENT_RUN	     (NAMED_EVENTCLASS + 4)
+#define NAMED_EVENT_SHUTDOWN (NAMED_EVENTCLASS + 5)
+
 /*%
  * Name server state.  Better here than in lots of separate global variables.
  */
@@ -47,6 +55,8 @@ struct named_server {
 
 	ns_server_t *sctx;
 
+	isc_task_t *task;
+
 	char *statsfile;    /*%< Statistics file name */
 	char *dumpfile;	    /*%< Dump file name */
 	char *secrootsfile; /*%< Secroots file name */
@@ -129,6 +139,12 @@ named_server_destroy(named_server_t **serverp);
  * Destroy a server object, freeing its memory.
  */
 
+void
+named_server_shutdown(named_server_t *server);
+/*%<
+ * Initiate the server shutdown.
+ */
+
 void
 named_server_reloadwanted(void *arg, int signum);
 /*%<
@@ -292,6 +308,12 @@ named_server_rekey(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 isc_result_t
 named_server_dumprecursing(named_server_t *server);
 
+/*%
+ * Maintain a list of dispatches that require reserved ports.
+ */
+void
+named_add_reserved_dispatch(named_server_t *server, const isc_sockaddr_t *addr);
+
 /*%
  * Enable or disable dnssec validation.
  */

bin/named/log.c

@@ -60,7 +60,6 @@ named_log_init(bool safe) {
 	 * Setup a logging context.
 	 */
 	isc_mem_create(&log_mctx);
-	isc_mem_setname(log_mctx, "named_log");
 	isc_log_create(log_mctx, &named_g_lctx, &lcfg);
 	isc_mem_detach(&log_mctx);
 
@@ -202,8 +201,7 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 	isc_result_t result;
 
 	if (sslkeylogfile_path == NULL ||
-	    strcmp(sslkeylogfile_path, "config") == 0)
-	{
+	    strcmp(sslkeylogfile_path, "config") == 0) {
 		return;
 	}
 

bin/named/logconf.c

@@ -17,6 +17,8 @@
 #include <stdbool.h>
 
 #include <isc/file.h>
+#include <isc/offset.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
@@ -144,14 +146,14 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 		const cfg_obj_t *suffixobj = cfg_tuple_get(fileobj, "suffix");
 		int32_t versions = ISC_LOG_ROLLNEVER;
 		isc_log_rollsuffix_t suffix = isc_log_rollsuffix_increment;
-		off_t size = 0;
+		isc_offset_t size = 0;
 		uint64_t maxoffset;
 
 		/*
-		 * off_t is a signed integer type, so the maximum
+		 * isc_offset_t is a signed integer type, so the maximum
 		 * value is all 1s except for the MSB.
 		 */
-		switch (sizeof(off_t)) {
+		switch (sizeof(isc_offset_t)) {
 		case 4:
 			maxoffset = 0x7fffffffULL;
 			break;
@@ -176,7 +178,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 		if (sizeobj != NULL && cfg_obj_isuint64(sizeobj) &&
 		    cfg_obj_asuint64(sizeobj) < maxoffset)
 		{
-			size = (off_t)cfg_obj_asuint64(sizeobj);
+			size = (isc_offset_t)cfg_obj_asuint64(sizeobj);
 		}
 		if (suffixobj != NULL && cfg_obj_isstring(suffixobj) &&
 		    strcasecmp(cfg_obj_asstring(suffixobj), "timestamp") == 0)

bin/named/main.c

@@ -34,14 +34,16 @@
 #include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
+#include <isc/print.h>
+#include <isc/resource.h>
 #include <isc/result.h>
 #include <isc/signal.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 #include <isc/uv.h>
-#include <isc/xml.h>
 
 #include <dns/dispatch.h>
 #include <dns/dyndb.h>
@@ -108,6 +110,7 @@
 #define BACKTRACE_MAXFRAME 128
 #endif /* ifndef BACKTRACE_MAXFRAME */
 
+extern int isc_dscp_check_value;
 extern unsigned int dns_zone_mkey_hour;
 extern unsigned int dns_zone_mkey_day;
 extern unsigned int dns_zone_mkey_month;
@@ -237,12 +240,12 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 }
 
 noreturn static void
-library_fatal_error(const char *file, int line, const char *func,
-		    const char *format, va_list args) ISC_FORMAT_PRINTF(3, 0);
+library_fatal_error(const char *file, int line, const char *format,
+		    va_list args) ISC_FORMAT_PRINTF(3, 0);
 
 static void
-library_fatal_error(const char *file, int line, const char *func,
-		    const char *format, va_list args) {
+library_fatal_error(const char *file, int line, const char *format,
+		    va_list args) {
 	/*
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */
@@ -256,7 +259,7 @@ library_fatal_error(const char *file, int line, const char *func,
 
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
-			      "%s:%d:%s(): fatal error: ", file, line, func);
+			      "%s:%d: fatal error:", file, line);
 		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
 			       args);
@@ -264,7 +267,7 @@ library_fatal_error(const char *file, int line, const char *func,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "exiting (due to fatal error in library)");
 	} else {
-		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		fprintf(stderr, "%s:%d: fatal error: ", file, line);
 		vfprintf(stderr, format, args);
 		fprintf(stderr, "\n");
 		fflush(stderr);
@@ -277,13 +280,12 @@ library_fatal_error(const char *file, int line, const char *func,
 }
 
 static void
-library_unexpected_error(const char *file, int line, const char *func,
-			 const char *format, va_list args)
-	ISC_FORMAT_PRINTF(3, 0);
+library_unexpected_error(const char *file, int line, const char *format,
+			 va_list args) ISC_FORMAT_PRINTF(3, 0);
 
 static void
-library_unexpected_error(const char *file, int line, const char *func,
-			 const char *format, va_list args) {
+library_unexpected_error(const char *file, int line, const char *format,
+			 va_list args) {
 	/*
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */
@@ -291,13 +293,12 @@ library_unexpected_error(const char *file, int line, const char *func,
 	if (named_g_lctx != NULL) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR,
-			      "%s:%d:%s(): unexpected error: ", file, line,
-			      func);
+			      "%s:%d: unexpected error:", file, line);
 		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			       NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR, format,
 			       args);
 	} else {
-		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		fprintf(stderr, "%s:%d: fatal error: ", file, line);
 		vfprintf(stderr, format, args);
 		fprintf(stderr, "\n");
 		fflush(stderr);
@@ -436,8 +437,7 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 		arglen = (int)(end - arg);
 		for (def = defs; def->name != NULL; def++) {
 			if (arglen == (int)strlen(def->name) &&
-			    memcmp(arg, def->name, arglen) == 0)
-			{
+			    memcmp(arg, def->name, arglen) == 0) {
 				if (def->value == 0) {
 					clear = true;
 				}
@@ -462,106 +462,11 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 	}
 }
 
-static void
-list_dnssec_algorithms(isc_buffer_t *b) {
-	for (dst_algorithm_t i = DST_ALG_UNKNOWN; i < DST_MAX_ALGS; i++) {
-		if (i == DST_ALG_DH || i == DST_ALG_GSSAPI ||
-		    (i >= DST_ALG_HMAC_FIRST && i <= DST_ALG_HMAC_LAST))
-		{
-			continue;
-		}
-		if (dst_algorithm_supported(i)) {
-			isc_buffer_putstr(b, " ");
-			(void)dns_secalg_totext(i, b);
-		}
-	}
-}
-
-static void
-list_ds_algorithms(isc_buffer_t *b) {
-	for (size_t i = 0; i < 256; i++) {
-		if (dst_ds_digest_supported(i)) {
-			isc_buffer_putstr(b, " ");
-			(void)dns_dsdigest_totext(i, b);
-		}
-	}
-}
-
-static void
-list_hmac_algorithms(isc_buffer_t *b) {
-	isc_buffer_t sb = *b;
-	for (dst_algorithm_t i = DST_ALG_HMAC_FIRST; i <= DST_ALG_HMAC_LAST;
-	     i++)
-	{
-		if (dst_algorithm_supported(i)) {
-			isc_buffer_putstr(b, " ");
-			isc_buffer_putstr(b, dst_hmac_algorithm_totext(i));
-		}
-	}
-	for (unsigned char *s = isc_buffer_used(&sb); s != isc_buffer_used(b);
-	     s++)
-	{
-		*s = toupper(*s);
-	}
-}
-
-static void
-logit(isc_buffer_t *b) {
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "%.*s",
-		      (int)isc_buffer_usedlength(b),
-		      (char *)isc_buffer_base(b));
-}
-
-static void
-printit(isc_buffer_t *b) {
-	printf("%.*s\n", (int)isc_buffer_usedlength(b),
-	       (char *)isc_buffer_base(b));
-}
-
-static void
-format_supported_algorithms(void (*emit)(isc_buffer_t *b)) {
-	isc_buffer_t b;
-	char buf[512];
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_putstr(&b, "DNSSEC algorithms:");
-	list_dnssec_algorithms(&b);
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_putstr(&b, "DS algorithms:");
-	list_ds_algorithms(&b);
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_putstr(&b, "HMAC algorithms:");
-	list_hmac_algorithms(&b);
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_printf(&b, "TKEY mode 2 support (Diffie-Hellman): %s",
-			  (dst_algorithm_supported(DST_ALG_DH) &&
-			   dst_algorithm_supported(DST_ALG_HMACMD5))
-				  ? "yes"
-				  : "non");
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_printf(&b, "TKEY mode 3 support (GSS-API): %s",
-			  dst_algorithm_supported(DST_ALG_GSSAPI) ? "yes"
-								  : "no");
-	(*emit)(&b);
-}
-
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
-	isc_mem_t *mctx = NULL;
-	isc_result_t result;
-	isc_buffer_t b;
-	char buf[512];
 #if defined(HAVE_GEOIP2)
+	isc_mem_t *mctx = NULL;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *config = NULL;
 	const cfg_obj_t *defaults = NULL, *obj = NULL;
@@ -633,19 +538,7 @@ printversion(bool verbose) {
 	printf("compiled with protobuf-c version: %s\n", PROTOBUF_C_VERSION);
 	printf("linked to protobuf-c version: %s\n", protobuf_c_version());
 #endif /* if defined(HAVE_DNSTAP) */
-	printf("threads support is enabled\n");
-
-	isc_mem_create(&mctx);
-	result = dst_lib_init(mctx, named_g_engine);
-	if (result == ISC_R_SUCCESS) {
-		isc_buffer_init(&b, buf, sizeof(buf));
-		format_supported_algorithms(printit);
-		printf("\n");
-		dst_lib_destroy();
-	} else {
-		printf("DST initialization failure: %s\n",
-		       isc_result_totext(result));
-	}
+	printf("threads support is enabled\n\n");
 
 	/*
 	 * The default rndc.conf and rndc.key paths are in the same
@@ -665,11 +558,13 @@ printversion(bool verbose) {
 	printf("default paths:\n");
 	printf("  named configuration:  %s\n", named_g_conffile);
 	printf("  rndc configuration:   %s\n", rndcconf);
+	printf("  DNSSEC root key:      %s\n", named_g_defaultbindkeys);
 	printf("  nsupdate session key: %s\n", named_g_defaultsessionkeyfile);
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
 	printf("  named lock file:      %s\n", named_g_defaultlockfile);
 #if defined(HAVE_GEOIP2)
 #define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
+	isc_mem_create(&mctx);
 	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
 	RTC(named_config_parsedefaults(parser, &config));
 	RTC(cfg_map_get(config, "options", &defaults));
@@ -713,9 +608,13 @@ parse_T_opt(char *option) {
 	/*
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
+	 * dscp=x:     check that dscp values are as
+	 * 	       expected and assert otherwise.
 	 */
 	if (!strcmp(option, "dropedns")) {
 		dropedns = true;
+	} else if (!strncmp(option, "dscp=", 5)) {
+		isc_dscp_check_value = atoi(option + 5);
 	} else if (!strcmp(option, "ednsformerr")) {
 		ednsformerr = true;
 	} else if (!strcmp(option, "ednsnotimp")) {
@@ -1025,7 +924,7 @@ create_managers(void) {
 		      named_g_udpdisp == 1 ? "" : "s");
 
 	isc_managers_create(&named_g_mctx, named_g_cpus, &named_g_loopmgr,
-			    &named_g_netmgr);
+			    &named_g_netmgr, &named_g_taskmgr);
 
 	isc_nm_maxudp(named_g_netmgr, maxudp);
 
@@ -1035,6 +934,7 @@ create_managers(void) {
 static void
 setup(void) {
 	isc_result_t result;
+	isc_resourcevalue_t old_openfiles;
 	ns_server_t *sctx;
 #ifdef HAVE_LIBSCF
 	char *instance = NULL;
@@ -1163,13 +1063,6 @@ setup(void) {
 		      "linked to OpenSSL version: %s",
 		      SSLeay_version(SSLEAY_VERSION));
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libuv version: %d.%d.%d", UV_VERSION_MAJOR,
-		      UV_VERSION_MINOR, UV_VERSION_PATCH);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libuv version: %s", uv_version_string());
 #ifdef HAVE_LIBXML2
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1214,11 +1107,39 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
 
+	/*
+	 * Get the initial resource limits.
+	 */
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_stacksize,
+					    &named_g_initstacksize) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_datasize,
+					    &named_g_initdatasize) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_coresize,
+					    &named_g_initcoresize) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles) ==
+		      ISC_R_SUCCESS);
+
 	/*
 	 * System resources cannot effectively be tuned on some systems.
 	 * Raise the limit in such cases for safety.
 	 */
+	old_openfiles = named_g_initopenfiles;
 	named_os_adjustnofile();
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles) ==
+		      ISC_R_SUCCESS);
+	if (old_openfiles != named_g_initopenfiles) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+			      "adjusted limit on open files from "
+			      "%" PRIu64 " to "
+			      "%" PRIu64,
+			      old_openfiles, named_g_initopenfiles);
+	}
 
 	/*
 	 * If the named configuration filename is relative, prepend the current
@@ -1272,12 +1193,6 @@ setup(void) {
 	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;
 
-	/*
-	 * Report supported algorithms now that dst_lib_init() has
-	 * been called via named_server_create().
-	 */
-	format_supported_algorithms(logit);
-
 	/*
 	 * Modify server context according to command line options
 	 */
@@ -1381,7 +1296,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if ((h = scf_handle_create(SCF_VERSION)) == NULL) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_handle_create() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_handle_create() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		return (ISC_R_FAILURE);
@@ -1389,7 +1305,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if (scf_handle_bind(h) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_handle_bind() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_handle_bind() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1398,7 +1315,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if ((namelen = scf_myname(h, NULL, 0)) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_myname() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_myname() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1406,7 +1324,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 	}
 
 	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
-		UNEXPECTED_ERROR("named_smf_get_instance memory "
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "named_smf_get_instance memory "
 				 "allocation failed: %s",
 				 isc_result_totext(ISC_R_NOMEMORY));
 		scf_handle_destroy(h);
@@ -1415,7 +1334,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if (scf_myname(h, instance, namelen + 1) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_myname() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_myname() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1442,6 +1362,10 @@ main(int argc, char *argv[]) {
 	(void)ProfilerStart(NULL);
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */
 
+#ifdef HAVE_LIBXML2
+	xmlInitParser();
+#endif /* HAVE_LIBXML2 */
+
 	/*
 	 * Technically, this call is superfluous because on startup of the main
 	 * program, the portable "C" locale is selected by default.  This
@@ -1508,7 +1432,6 @@ main(int argc, char *argv[]) {
 
 	setup();
 	isc_mem_setname(named_g_mctx, "main");
-	INSIST(named_g_server != NULL);
 
 	/*
 	 * Start things running
@@ -1522,7 +1445,8 @@ main(int argc, char *argv[]) {
 		result = named_smf_get_instance(&instance, 1, named_g_mctx);
 		if (result == ISC_R_SUCCESS && instance != NULL) {
 			if (smf_disable_instance(instance, 0) != 0) {
-				UNEXPECTED_ERROR("smf_disable_instance() "
+				UNEXPECTED_ERROR(__FILE__, __LINE__,
+						 "smf_disable_instance() "
 						 "failed for %s : %s",
 						 instance,
 						 scf_strerror(scf_error()));
@@ -1549,14 +1473,8 @@ main(int argc, char *argv[]) {
 		}
 	}
 
-	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr);
-
-#if ENABLE_LEAK_DETECTION
-	isc__tls_setdestroycheck(true);
-	isc__uv_setdestroycheck(true);
-	isc__xml_setdestroycheck(true);
-#endif
-
+	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr,
+			     &named_g_taskmgr);
 	isc_mem_checkdestroyed(stderr);
 
 	named_main_setmemstats(NULL);
@@ -1565,6 +1483,10 @@ main(int argc, char *argv[]) {
 
 	named_os_shutdown();
 
+#ifdef HAVE_LIBXML2
+	xmlCleanupParser();
+#endif /* HAVE_LIBXML2 */
+
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */

bin/named/named.rst

@@ -143,6 +143,22 @@ Options
       This option is mainly of interest to BIND 9 developers and may be
       removed or changed in a future release.
 
+.. option:: -S #max-socks
+
+   This option is deprecated and no longer has any function.
+
+.. warning::
+
+      This option should be unnecessary for the vast majority of users.
+      The use of this option could even be harmful, because the specified
+      value may exceed the limitation of the underlying system API. It
+      is therefore set only when the default configuration causes
+      exhaustion of file descriptors and the operational environment is
+      known to support the specified number of sockets. Note also that
+      the actual maximum number is normally slightly fewer than the
+      specified value, because :program:`named` reserves some file descriptors
+      for its internal use.
+
 .. option:: -t directory
 
    This option tells :program:`named` to chroot to ``directory`` after processing the command-line arguments, but
@@ -187,8 +203,7 @@ Options
 
 .. option:: -V
 
-   This option reports the version number, build options, supported
-   cryptographics algorithms, and exits.
+   This option reports the version number and build options, and exits.
 
 .. option:: -X lock-file
 

bin/named/os.c

@@ -14,7 +14,6 @@
 /*! \file */
 #include <stdarg.h>
 #include <stdbool.h>
-#include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/types.h> /* dev_t FreeBSD 2.1 */
 #ifdef HAVE_UNAME
@@ -37,13 +36,14 @@
 
 #include <isc/buffer.h>
 #include <isc/file.h>
+#include <isc/print.h>
+#include <isc/resource.h>
 #include <isc/result.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 #include <named/globals.h>
-#include <named/log.h>
 #include <named/main.h>
 #include <named/os.h>
 #ifdef HAVE_LIBSCF
@@ -63,7 +63,7 @@ static struct passwd *runas_pw = NULL;
 static bool done_setuid = false;
 static int dfd[2] = { -1, -1 };
 
-#if HAVE_LIBCAP
+#ifdef HAVE_SYS_CAPABILITY_H
 
 static bool non_root = false;
 static bool non_root_caps = false;
@@ -249,137 +249,7 @@ linux_keepcaps(void) {
 	}
 }
 
-#endif /* HAVE_LIBCAP */
-
-/*
- * First define compatibility shims if {set,get}res{uid,gid} are not available
- */
-
-#if !HAVE_GETRESGID
-static int
-getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid) {
-	*rgid = -1;
-	*egid = getegid();
-	*sgid = -1;
-
-	return (0);
-}
-#endif /* !HAVE_GETRESGID */
-
-#if !HAVE_SETRESGID
-static int
-setresgid(gid_t rgid, gid_t egid, gid_t sgid) {
-	REQUIRE(rgid == (gid_t)-1);
-	REQUIRE(sgid == (gid_t)-1);
-
-#if HAVE_SETREGID
-	return (setregid(rgid, egid));
-#else  /* HAVE_SETREGID */
-	return (setegid(egid));
-#endif /* HAVE_SETREGID */
-}
-#endif /* !HAVE_SETRESGID */
-
-#if !HAVE_GETRESUID
-static int
-getresuid(uid_t *ruid, uid_t *euid, uid_t *suid) {
-	*ruid = -1;
-	*euid = geteuid();
-	*suid = -1;
-
-	return (0);
-}
-#endif /* !HAVE_GETRESUID */
-
-#if !HAVE_SETRESUID
-static int
-setresuid(uid_t ruid, uid_t euid, uid_t suid) {
-	REQUIRE(ruid == (uid_t)-1);
-	REQUIRE(suid == (uid_t)-1);
-
-#if HAVE_SETREGID
-	return (setregid(ruid, euid));
-#else  /* HAVE_SETREGID */
-	return (setegid(euid));
-#endif /* HAVE_SETREGID */
-}
-#endif /* !HAVE_SETRESUID */
-
-static int
-set_effective_gid(gid_t gid) {
-	gid_t oldgid;
-
-	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (oldgid == gid) {
-		return (0);
-	}
-
-	if (setresgid(-1, gid, -1) == -1) {
-		return (-1);
-	}
-
-	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (oldgid != gid) {
-		return (-1);
-	}
-
-	return (0);
-}
-
-static int
-set_effective_uid(uid_t uid) {
-	uid_t olduid;
-
-	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (olduid == uid) {
-		return (0);
-	}
-
-	if (setresuid(-1, uid, -1) == -1) {
-		return (-1);
-	}
-
-	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (olduid != uid) {
-		return (-1);
-	}
-
-	/* Success */
-	return (0);
-}
-
-static void
-setperms(uid_t uid, gid_t gid) {
-	char strbuf[ISC_STRERRORSIZE];
-
-	/*
-	 * Drop the gid privilege first, because in some cases the gid privilege
-	 * cannot be dropped after the uid privilege has been dropped.
-	 */
-	if (set_effective_gid(gid) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		named_main_earlywarning("unable to set effective gid to %d: %s",
-					gid, strbuf);
-	}
-
-	if (set_effective_uid(uid) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		named_main_earlywarning("unable to set effective uid to %d: %s",
-					uid, strbuf);
-	}
-}
+#endif /* HAVE_SYS_CAPABILITY_H */
 
 static void
 setup_syslog(const char *progname) {
@@ -395,9 +265,9 @@ setup_syslog(const char *progname) {
 void
 named_os_init(const char *progname) {
 	setup_syslog(progname);
-#if HAVE_LIBCAP
+#ifdef HAVE_SYS_CAPABILITY_H
 	linux_initialprivs();
-#endif /* HAVE_LIBCAP */
+#endif /* ifdef HAVE_SYS_CAPABILITY_H */
 #ifdef SIGXFSZ
 	signal(SIGXFSZ, SIG_IGN);
 #endif /* ifdef SIGXFSZ */
@@ -590,7 +460,7 @@ named_os_changeuser(void) {
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}
 
-#if HAVE_LIBCAP
+#if defined(HAVE_SYS_CAPABILITY_H)
 	/*
 	 * Restore the ability of named to drop core after the setuid()
 	 * call has disabled it.
@@ -602,7 +472,7 @@ named_os_changeuser(void) {
 	}
 
 	linux_minprivs();
-#endif /* HAVE_LIBCAP */
+#endif /* if defined(HAVE_SYS_CAPABILITY_H) */
 }
 
 uid_t
@@ -615,56 +485,30 @@ ns_os_uid(void) {
 
 void
 named_os_adjustnofile(void) {
-	int r;
-	struct rlimit rl;
-	rlim_t rlim_old;
-	char strbuf[ISC_STRERRORSIZE];
+#if defined(__linux__)
+	isc_result_t result;
+	isc_resourcevalue_t newvalue;
 
-	r = getrlimit(RLIMIT_NOFILE, &rl);
-	if (r != 0) {
-		goto fail;
+	/*
+	 * Linux: max number of open files specified by one thread doesn't seem
+	 * to apply to other threads on Linux.
+	 */
+	newvalue = ISC_RESOURCE_UNLIMITED;
+
+	result = isc_resource_setlimit(isc_resource_openfiles, newvalue);
+	if (result != ISC_R_SUCCESS) {
+		named_main_earlywarning("couldn't adjust limit on open files");
 	}
-
-	rlim_old = rl.rlim_cur;
-
-	if (rl.rlim_cur == rl.rlim_max) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-			      "the limit on open files is already at the "
-			      "maximum allowed value: "
-			      "%" PRIu64,
-			      (uint64_t)rl.rlim_max);
-		return;
-	}
-
-	rl.rlim_cur = rl.rlim_max;
-	r = setrlimit(RLIMIT_NOFILE, &rl);
-	if (r != 0) {
-		goto fail;
-	}
-
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "adjusted limit on open files from "
-		      "%" PRIu64 " to "
-		      "%" PRIu64,
-		      (uint64_t)rlim_old, (uint64_t)rl.rlim_cur);
-	return;
-
-fail:
-	strerror_r(errno, strbuf, sizeof(strbuf));
-	named_main_earlywarning("adjusting limit on open files failed: %s",
-				strbuf);
-	return;
+#endif /* if defined(__linux__) */
 }
 
 void
 named_os_minprivs(void) {
-#if HAVE_LIBCAP
+#if defined(HAVE_SYS_CAPABILITY_H)
 	linux_keepcaps();
 	named_os_changeuser();
 	linux_minprivs();
-#endif /* HAVE_LIBCAP */
+#endif /* if defined(HAVE_SYS_CAPABILITY_H) */
 }
 
 static int
@@ -784,6 +628,56 @@ error:
 	return (-1);
 }
 
+#if !HAVE_SYS_CAPABILITY_H
+static void
+setperms(uid_t uid, gid_t gid) {
+#if defined(HAVE_SETEGID) || defined(HAVE_SETRESGID)
+	char strbuf[ISC_STRERRORSIZE];
+#endif /* if defined(HAVE_SETEGID) || defined(HAVE_SETRESGID) */
+#if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID)
+	gid_t oldgid, tmpg;
+#endif /* if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID) */
+#if !defined(HAVE_SETEUID) && defined(HAVE_SETRESUID)
+	uid_t olduid, tmpu;
+#endif /* if !defined(HAVE_SETEUID) && defined(HAVE_SETRESUID) */
+#if defined(HAVE_SETEGID)
+	if (getegid() != gid && setegid(gid) == -1) {
+		strerror_r(errno, strbuf, sizeof(strbuf));
+		named_main_earlywarning("unable to set effective "
+					"gid to %ld: %s",
+					(long)gid, strbuf);
+	}
+#elif defined(HAVE_SETRESGID)
+	if (getresgid(&tmpg, &oldgid, &tmpg) == -1 || oldgid != gid) {
+		if (setresgid(-1, gid, -1) == -1) {
+			strerror_r(errno, strbuf, sizeof(strbuf));
+			named_main_earlywarning("unable to set effective "
+						"gid to %d: %s",
+						gid, strbuf);
+		}
+	}
+#endif /* if defined(HAVE_SETEGID) */
+
+#if defined(HAVE_SETEUID)
+	if (geteuid() != uid && seteuid(uid) == -1) {
+		strerror_r(errno, strbuf, sizeof(strbuf));
+		named_main_earlywarning("unable to set effective "
+					"uid to %ld: %s",
+					(long)uid, strbuf);
+	}
+#elif defined(HAVE_SETRESUID)
+	if (getresuid(&tmpu, &olduid, &tmpu) == -1 || olduid != uid) {
+		if (setresuid(-1, uid, -1) == -1) {
+			strerror_r(errno, strbuf, sizeof(strbuf));
+			named_main_earlywarning("unable to set effective "
+						"uid to %d: %s",
+						uid, strbuf);
+		}
+	}
+#endif /* if defined(HAVE_SETEUID) */
+}
+#endif /* !HAVE_SYS_CAPABILITY_H */
+
 FILE *
 named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	char strbuf[ISC_STRERRORSIZE], *f;
@@ -809,17 +703,19 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	if (switch_user && runas_pw != NULL) {
 		uid_t olduid = getuid();
 		gid_t oldgid = getgid();
-
-		/*
-		 * Set UID/GID to the one we'll be running with
-		 * eventually.
-		 */
+#if HAVE_SYS_CAPABILITY_H
+		REQUIRE(olduid == runas_pw->pw_uid);
+		REQUIRE(oldgid == runas_pw->pw_gid);
+#else /* HAVE_SYS_CAPABILITY_H */
+		/* Set UID/GID to the one we'll be running with eventually */
 		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
-
+#endif
 		fd = safe_open(filename, mode, false);
 
+#if !HAVE_SYS_CAPABILITY_H
 		/* Restore UID/GID to previous uid/gid */
 		setperms(olduid, oldgid);
+#endif
 
 		if (fd == -1) {
 			fd = safe_open(filename, mode, false);
@@ -971,6 +867,14 @@ named_os_shutdown(void) {
 	cleanup_lockfile();
 }
 
+isc_result_t
+named_os_gethostname(char *buf, size_t len) {
+	int n;
+
+	n = gethostname(buf, len);
+	return ((n == 0) ? ISC_R_SUCCESS : ISC_R_FAILURE);
+}
+
 void
 named_os_shutdownmsg(char *command, isc_buffer_t *text) {
 	char *last, *ptr;

bin/named/statschannel.c

@@ -20,6 +20,7 @@
 #include <isc/httpd.h>
 #include <isc/mem.h>
 #include <isc/once.h>
+#include <isc/print.h>
 #include <isc/stats.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -55,11 +56,11 @@
 #include "xsl_p.h"
 
 #define STATS_XML_VERSION_MAJOR "3"
-#define STATS_XML_VERSION_MINOR "14"
+#define STATS_XML_VERSION_MINOR "12"
 #define STATS_XML_VERSION	STATS_XML_VERSION_MAJOR "." STATS_XML_VERSION_MINOR
 
 #define STATS_JSON_VERSION_MAJOR "1"
-#define STATS_JSON_VERSION_MINOR "8"
+#define STATS_JSON_VERSION_MINOR "6"
 #define STATS_JSON_VERSION	 STATS_JSON_VERSION_MAJOR "." STATS_JSON_VERSION_MINOR
 
 #define CHECK(m)                               \
@@ -77,12 +78,13 @@ struct named_statschannel {
 	isc_mem_t *mctx;
 
 	/*
-	 * Locked by channel lock
+	 * Locked by channel lock: can be referenced and modified by both
+	 * the server task and the channel task.
 	 */
 	isc_mutex_t lock;
 	dns_acl_t *acl;
 
-	/* Locked by main loop. */
+	/* Locked by server task */
 	ISC_LINK(struct named_statschannel) link;
 };
 
@@ -350,7 +352,6 @@ init_desc(void) {
 	SET_NSSTATDESC(reclimitdropped,
 		       "queries dropped due to recursive client limit",
 		       "RecLimitDropped");
-	SET_NSSTATDESC(updatequota, "Update quota exceeded", "UpdateQuota");
 
 	INSIST(i == ns_statscounter_max);
 
@@ -1463,8 +1464,7 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 #endif /* ifdef HAVE_JSON_C */
 
 	if ((DNS_RDATASTATSTYPE_ATTR(type) &
-	     DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) == 0)
-	{
+	     DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) == 0) {
 		dns_rdatatype_format(DNS_RDATASTATSTYPE_BASE(type), typebuf,
 				     sizeof(typebuf));
 		typestr = typebuf;
@@ -1536,8 +1536,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 #endif /* ifdef HAVE_JSON_C */
 
 	if ((DNS_RDATASTATSTYPE_ATTR(type) &
-	     DNS_RDATASTATSTYPE_ATTR_NXDOMAIN) != 0)
-	{
+	     DNS_RDATASTATSTYPE_ATTR_NXDOMAIN) != 0) {
 		typestr = "NXDOMAIN";
 	} else if ((DNS_RDATASTATSTYPE_ATTR(type) &
 		    DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) != 0)
@@ -1714,7 +1713,7 @@ cleanup:
 
 #if defined(EXTENDED_STATS)
 static void
-dnssecsignstat_dump(uint32_t kval, uint64_t val, void *arg) {
+dnssecsignstat_dump(dns_keytag_t tag, uint64_t val, void *arg) {
 	FILE *fp;
 	char tagbuf[64];
 	stats_dumparg_t *dumparg = arg;
@@ -1726,11 +1725,7 @@ dnssecsignstat_dump(uint32_t kval, uint64_t val, void *arg) {
 	json_object *zoneobj, *obj;
 #endif /* ifdef HAVE_JSON_C */
 
-	/*
-	 * kval is '(algorithm << 16) | keyid'.
-	 */
-	snprintf(tagbuf, sizeof(tagbuf), "%u+%u", (kval >> 16) & 0xff,
-		 kval & 0xffff);
+	snprintf(tagbuf, sizeof(tagbuf), "%u", tag);
 
 	switch (dumparg->type) {
 	case isc_statsformat_file:
@@ -1777,6 +1772,7 @@ cleanup:
 #define STATS_XML_STATUS  0x00 /* display only common statistics */
 #define STATS_XML_SERVER  0x01
 #define STATS_XML_ZONES	  0x02
+#define STATS_XML_TASKS	  0x04
 #define STATS_XML_NET	  0x08
 #define STATS_XML_MEM	  0x10
 #define STATS_XML_TRAFFIC 0x20
@@ -2243,8 +2239,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	view = ISC_LIST_HEAD(server->viewlist);
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "views"));
 	while (view != NULL &&
-	       ((flags & (STATS_XML_SERVER | STATS_XML_ZONES)) != 0))
-	{
+	       ((flags & (STATS_XML_SERVER | STATS_XML_ZONES)) != 0)) {
 		isc_stats_t *istats = NULL;
 		dns_stats_t *dstats = NULL;
 
@@ -2255,8 +2250,8 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 		if ((flags & STATS_XML_ZONES) != 0) {
 			TRY0(xmlTextWriterStartElement(writer,
 						       ISC_XMLCHAR "zones"));
-			CHECK(dns_zt_apply(view->zonetable, isc_rwlocktype_read,
-					   true, NULL, zone_xmlrender, writer));
+			CHECK(dns_zt_apply(view->zonetable, true, NULL,
+					   zone_xmlrender, writer));
 			TRY0(xmlTextWriterEndElement(writer)); /* /zones */
 		}
 
@@ -2332,6 +2327,12 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	}
 	TRY0(xmlTextWriterEndElement(writer)); /* /views */
 
+	if ((flags & STATS_XML_TASKS) != 0) {
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "taskmgr"));
+		TRY0(isc_taskmgr_renderxml(named_g_taskmgr, writer));
+		TRY0(xmlTextWriterEndElement(writer)); /* /taskmgr */
+	}
+
 	if ((flags & STATS_XML_MEM) != 0) {
 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "memory"));
 		TRY0(isc_mem_renderxml(writer));
@@ -2371,14 +2372,20 @@ wrap_xmlfree(isc_buffer_t *buffer, void *arg) {
 }
 
 static isc_result_t
-render_xml(uint32_t flags, void *arg, unsigned int *retcode,
-	   const char **retmsg, const char **mimetype, isc_buffer_t *b,
-	   isc_httpdfree_t **freecb, void **freecb_args) {
+render_xml(uint32_t flags, const char *url, isc_httpdurl_t *urlinfo,
+	   const char *querystring, const char *headers, void *arg,
+	   unsigned int *retcode, const char **retmsg, const char **mimetype,
+	   isc_buffer_t *b, isc_httpdfree_t **freecb, void **freecb_args) {
 	unsigned char *msg = NULL;
 	int msglen;
 	named_server_t *server = arg;
 	isc_result_t result;
 
+	UNUSED(url);
+	UNUSED(urlinfo);
+	UNUSED(headers);
+	UNUSED(querystring);
+
 	result = generatexml(server, flags, &msglen, &msg);
 
 	if (result == ISC_R_SUCCESS) {
@@ -2399,80 +2406,91 @@ render_xml(uint32_t flags, void *arg, unsigned int *retcode,
 }
 
 static isc_result_t
-render_xml_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-	       void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_all(const char *url, isc_httpdurl_t *urlinfo,
+	       const char *querystring, const char *headers, void *arg,
+	       unsigned int *retcode, const char **retmsg,
 	       const char **mimetype, isc_buffer_t *b, isc_httpdfree_t **freecb,
 	       void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_ALL, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }
 
 static isc_result_t
-render_xml_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		  void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_status(const char *url, isc_httpdurl_t *urlinfo,
+		  const char *querystring, const char *headers, void *arg,
+		  unsigned int *retcode, const char **retmsg,
 		  const char **mimetype, isc_buffer_t *b,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_STATUS, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }
 
 static isc_result_t
-render_xml_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		  void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_server(const char *url, isc_httpdurl_t *urlinfo,
+		  const char *querystring, const char *headers, void *arg,
+		  unsigned int *retcode, const char **retmsg,
 		  const char **mimetype, isc_buffer_t *b,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_SERVER, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }
 
 static isc_result_t
-render_xml_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		 void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_zones(const char *url, isc_httpdurl_t *urlinfo,
+		 const char *querystring, const char *headers, void *arg,
+		 unsigned int *retcode, const char **retmsg,
 		 const char **mimetype, isc_buffer_t *b,
 		 isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_ZONES, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }
 
 static isc_result_t
-render_xml_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-	       void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_net(const char *url, isc_httpdurl_t *urlinfo,
+	       const char *querystring, const char *headers, void *arg,
+	       unsigned int *retcode, const char **retmsg,
 	       const char **mimetype, isc_buffer_t *b, isc_httpdfree_t **freecb,
 	       void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_NET, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }
 
 static isc_result_t
-render_xml_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-	       void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_tasks(const char *url, isc_httpdurl_t *urlinfo,
+		 const char *querystring, const char *headers, void *arg,
+		 unsigned int *retcode, const char **retmsg,
+		 const char **mimetype, isc_buffer_t *b,
+		 isc_httpdfree_t **freecb, void **freecb_args) {
+	return (render_xml(STATS_XML_TASKS, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
+}
+
+static isc_result_t
+render_xml_mem(const char *url, isc_httpdurl_t *urlinfo,
+	       const char *querystring, const char *headers, void *arg,
+	       unsigned int *retcode, const char **retmsg,
 	       const char **mimetype, isc_buffer_t *b, isc_httpdfree_t **freecb,
 	       void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_MEM, url, urlinfo, querystring, headers,
+			   arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }
 
 static isc_result_t
-render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		   void *arg, unsigned int *retcode, const char **retmsg,
+render_xml_traffic(const char *url, isc_httpdurl_t *urlinfo,
+		   const char *querystring, const char *headers, void *arg,
+		   unsigned int *retcode, const char **retmsg,
 		   const char **mimetype, isc_buffer_t *b,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return (render_xml(STATS_XML_TRAFFIC, url, urlinfo, querystring,
+			   headers, arg, retcode, retmsg, mimetype, b, freecb,
+			   freecb_args));
 }
 
 #endif /* HAVE_LIBXML2 */
@@ -2484,6 +2502,7 @@ render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 #define STATS_JSON_STATUS  0x00 /* display only common statistics */
 #define STATS_JSON_SERVER  0x01
 #define STATS_JSON_ZONES   0x02
+#define STATS_JSON_TASKS   0x04
 #define STATS_JSON_NET	   0x08
 #define STATS_JSON_MEM	   0x10
 #define STATS_JSON_TRAFFIC 0x20
@@ -2712,8 +2731,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 			}
 
 			if (json_object_get_object(refresh_counters)->count !=
-			    0)
-			{
+			    0) {
 				json_object_object_add(zoneobj,
 						       "dnssec-refresh",
 						       refresh_counters);
@@ -2969,9 +2987,8 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 			CHECKMEM(za);
 
 			if ((flags & STATS_JSON_ZONES) != 0) {
-				CHECK(dns_zt_apply(view->zonetable,
-						   isc_rwlocktype_read, true,
-						   NULL, zone_jsonrender, za));
+				CHECK(dns_zt_apply(view->zonetable, true, NULL,
+						   zone_jsonrender, za));
 			}
 
 			if (json_object_array_length(za) != 0) {
@@ -3118,6 +3135,19 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 		}
 	}
 
+	if ((flags & STATS_JSON_TASKS) != 0) {
+		json_object *tasks = json_object_new_object();
+		CHECKMEM(tasks);
+
+		result = isc_taskmgr_renderjson(named_g_taskmgr, tasks);
+		if (result != ISC_R_SUCCESS) {
+			json_object_put(tasks);
+			goto cleanup;
+		}
+
+		json_object_object_add(bindstats, "taskmgr", tasks);
+	}
+
 	if ((flags & STATS_JSON_MEM) != 0) {
 		json_object *memory = json_object_new_object();
 		CHECKMEM(memory);
@@ -3286,9 +3316,10 @@ cleanup:
 }
 
 static isc_result_t
-render_json(uint32_t flags, void *arg, unsigned int *retcode,
-	    const char **retmsg, const char **mimetype, isc_buffer_t *b,
-	    isc_httpdfree_t **freecb, void **freecb_args) {
+render_json(uint32_t flags, const char *url, isc_httpdurl_t *urlinfo,
+	    const char *querystring, const char *headers, void *arg,
+	    unsigned int *retcode, const char **retmsg, const char **mimetype,
+	    isc_buffer_t *b, isc_httpdfree_t **freecb, void **freecb_args) {
 	isc_result_t result;
 	json_object *bindstats = NULL;
 	named_server_t *server = arg;
@@ -3296,6 +3327,11 @@ render_json(uint32_t flags, void *arg, unsigned int *retcode,
 	size_t msglen = 0;
 	char *p;
 
+	UNUSED(url);
+	UNUSED(urlinfo);
+	UNUSED(headers);
+	UNUSED(querystring);
+
 	result = generatejson(server, &msglen, &msg, &bindstats, flags);
 	if (result == ISC_R_SUCCESS) {
 		*retcode = 200;
@@ -3316,128 +3352,156 @@ render_json(uint32_t flags, void *arg, unsigned int *retcode,
 }
 
 static isc_result_t
-render_json_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		void *arg, unsigned int *retcode, const char **retmsg,
+render_json_all(const char *url, isc_httpdurl_t *urlinfo,
+		const char *querystring, const char *headers, void *arg,
+		unsigned int *retcode, const char **retmsg,
 		const char **mimetype, isc_buffer_t *b,
 		isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return (render_json(STATS_JSON_ALL, url, urlinfo, querystring, headers,
+			    arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }
 
 static isc_result_t
-render_json_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		   void *arg, unsigned int *retcode, const char **retmsg,
+render_json_status(const char *url, isc_httpdurl_t *urlinfo,
+		   const char *querystring, const char *headers, void *arg,
+		   unsigned int *retcode, const char **retmsg,
 		   const char **mimetype, isc_buffer_t *b,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return (render_json(STATS_JSON_STATUS, url, urlinfo, querystring,
+			    headers, arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }
 
 static isc_result_t
-render_json_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		   void *arg, unsigned int *retcode, const char **retmsg,
+render_json_server(const char *url, isc_httpdurl_t *urlinfo,
+		   const char *querystring, const char *headers, void *arg,
+		   unsigned int *retcode, const char **retmsg,
 		   const char **mimetype, isc_buffer_t *b,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return (render_json(STATS_JSON_SERVER, url, urlinfo, querystring,
+			    headers, arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }
 
 static isc_result_t
-render_json_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		  void *arg, unsigned int *retcode, const char **retmsg,
+render_json_zones(const char *url, isc_httpdurl_t *urlinfo,
+		  const char *querystring, const char *headers, void *arg,
+		  unsigned int *retcode, const char **retmsg,
 		  const char **mimetype, isc_buffer_t *b,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return (render_json(STATS_JSON_ZONES, url, urlinfo, querystring,
+			    headers, arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }
 
 static isc_result_t
-render_json_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		void *arg, unsigned int *retcode, const char **retmsg,
+render_json_mem(const char *url, isc_httpdurl_t *urlinfo,
+		const char *querystring, const char *headers, void *arg,
+		unsigned int *retcode, const char **retmsg,
 		const char **mimetype, isc_buffer_t *b,
 		isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return (render_json(STATS_JSON_MEM, url, urlinfo, querystring, headers,
+			    arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }
 
 static isc_result_t
-render_json_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		void *arg, unsigned int *retcode, const char **retmsg,
+render_json_tasks(const char *url, isc_httpdurl_t *urlinfo,
+		  const char *querystring, const char *headers, void *arg,
+		  unsigned int *retcode, const char **retmsg,
+		  const char **mimetype, isc_buffer_t *b,
+		  isc_httpdfree_t **freecb, void **freecb_args) {
+	return (render_json(STATS_JSON_TASKS, url, urlinfo, querystring,
+			    headers, arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
+}
+
+static isc_result_t
+render_json_net(const char *url, isc_httpdurl_t *urlinfo,
+		const char *querystring, const char *headers, void *arg,
+		unsigned int *retcode, const char **retmsg,
 		const char **mimetype, isc_buffer_t *b,
 		isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return (render_json(STATS_JSON_NET, url, urlinfo, querystring, headers,
+			    arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }
 
 static isc_result_t
-render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
-		    void *arg, unsigned int *retcode, const char **retmsg,
+render_json_traffic(const char *url, isc_httpdurl_t *urlinfo,
+		    const char *querystring, const char *headers, void *arg,
+		    unsigned int *retcode, const char **retmsg,
 		    const char **mimetype, isc_buffer_t *b,
 		    isc_httpdfree_t **freecb, void **freecb_args) {
-	UNUSED(httpd);
-	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return (render_json(STATS_JSON_TRAFFIC, url, urlinfo, querystring,
+			    headers, arg, retcode, retmsg, mimetype, b, freecb,
+			    freecb_args));
 }
 
 #endif /* HAVE_JSON_C */
 
 static isc_result_t
-render_xsl(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo, void *args,
-	   unsigned int *retcode, const char **retmsg, const char **mimetype,
-	   isc_buffer_t *b, isc_httpdfree_t **freecb, void **freecb_args) {
+render_xsl(const char *url, isc_httpdurl_t *urlinfo, const char *querystring,
+	   const char *headers, void *args, unsigned int *retcode,
+	   const char **retmsg, const char **mimetype, isc_buffer_t *b,
+	   isc_httpdfree_t **freecb, void **freecb_args) {
 	isc_result_t result;
-	char *p = NULL;
+	char *_headers = NULL;
+	char *p;
 
-	UNUSED(httpd);
+	UNUSED(url);
+	UNUSED(querystring);
 	UNUSED(args);
 
 	*freecb = NULL;
 	*freecb_args = NULL;
 	*mimetype = "text/xslt+xml";
 
-	if (isc_httpdurl_isstatic(urlinfo)) {
-		time_t t1, t2;
-		const isc_time_t *when;
-		const isc_time_t *loadtime;
+	if (urlinfo->isstatic) {
+		isc_time_t when;
+		char *line, *saveptr;
+		const char *if_modified_since = "If-Modified-Since: ";
+		_headers = strdup(headers);
 
-		when = isc_httpd_if_modified_since(httpd);
-
-		if (isc_time_isepoch(when)) {
+		if (_headers == NULL) {
 			goto send;
 		}
 
-		result = isc_time_secondsastimet(when, &t1);
-		if (result != ISC_R_SUCCESS) {
-			goto send;
+		saveptr = NULL;
+		for (line = strtok_r(_headers, "\n", &saveptr); line;
+		     line = strtok_r(NULL, "\n", &saveptr))
+		{
+			if (strncasecmp(line, if_modified_since,
+					strlen(if_modified_since)) == 0) {
+				time_t t1, t2;
+				line += strlen(if_modified_since);
+				result = isc_time_parsehttptimestamp(line,
+								     &when);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}
+
+				result = isc_time_secondsastimet(&when, &t1);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}
+
+				result = isc_time_secondsastimet(
+					&urlinfo->loadtime, &t2);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}
+
+				if (t1 < t2) {
+					goto send;
+				}
+
+				*retcode = 304;
+				*retmsg = "Not modified";
+				goto end;
+			}
 		}
-
-		loadtime = isc_httpdurl_loadtime(urlinfo);
-
-		result = isc_time_secondsastimet(loadtime, &t2);
-		if (result != ISC_R_SUCCESS) {
-			goto send;
-		}
-
-		if (t1 < t2) {
-			goto send;
-		}
-
-		*retcode = 304;
-		*retmsg = "Not modified";
-		goto end;
 	}
 
 send:
@@ -3447,6 +3511,7 @@ send:
 	isc_buffer_reinit(b, p, strlen(xslmsg));
 	isc_buffer_add(b, strlen(xslmsg));
 end:
+	free(_headers);
 	return (ISC_R_SUCCESS);
 }
 
@@ -3567,6 +3632,9 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_httpdmgr_addurl(listener->httpdmgr,
 			    "/xml/v" STATS_XML_VERSION_MAJOR "/net", false,
 			    render_xml_net, server);
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/xml/v" STATS_XML_VERSION_MAJOR "/tasks", false,
+			    render_xml_tasks, server);
 	isc_httpdmgr_addurl(listener->httpdmgr,
 			    "/xml/v" STATS_XML_VERSION_MAJOR "/mem", false,
 			    render_xml_mem, server);
@@ -3589,6 +3657,9 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_httpdmgr_addurl(listener->httpdmgr,
 			    "/json/v" STATS_JSON_VERSION_MAJOR "/zones", false,
 			    render_json_zones, server);
+	isc_httpdmgr_addurl(listener->httpdmgr,
+			    "/json/v" STATS_JSON_VERSION_MAJOR "/tasks", false,
+			    render_json_tasks, server);
 	isc_httpdmgr_addurl(listener->httpdmgr,
 			    "/json/v" STATS_JSON_VERSION_MAJOR "/net", false,
 			    render_json_net, server);
@@ -3681,7 +3752,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	const cfg_listelt_t *element, *element2;
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 
-	isc_once_do(&once, init_desc);
+	RUNTIME_CHECK(isc_once_do(&once, init_desc) == ISC_R_SUCCESS);
 
 	ISC_LIST_INIT(new_listeners);
 
@@ -3838,7 +3909,7 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 	uint64_t sockstat_values[isc_sockstatscounter_max];
 	uint64_t gluecachestats_values[dns_gluecachestatscounter_max];
 
-	isc_once_do(&once, init_desc);
+	RUNTIME_CHECK(isc_once_do(&once, init_desc) == ISC_R_SUCCESS);
 
 	/* Set common fields */
 	dumparg.type = isc_statsformat_file;

bin/named/transportconf.c

@@ -59,8 +59,7 @@
 				const cfg_listelt_t *proto = NULL;                \
 				INSIST(obj != NULL);                              \
 				for (proto = cfg_list_first(obj); proto != 0;     \
-				     proto = cfg_list_next(proto))                \
-				{                                                 \
+				     proto = cfg_list_next(proto)) {              \
 					const cfg_obj_t *tls_proto_obj =          \
 						cfg_listelt_value(proto);         \
 					const char *tls_sver =                    \

bin/named/tsigconf.c

@@ -84,8 +84,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
 		 */
 		algstr = cfg_obj_asstring(algobj);
 		if (named_config_getkeyalgorithm(algstr, &alg, &bits) !=
-		    ISC_R_SUCCESS)
-		{
+		    ISC_R_SUCCESS) {
 			cfg_obj_log(algobj, named_g_lctx, ISC_LOG_ERROR,
 				    "key '%s': has a "
 				    "unsupported algorithm '%s'",

bin/named/zoneconf.c

@@ -17,6 +17,7 @@
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/stats.h>
 #include <isc/string.h>
@@ -250,8 +251,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		str = cfg_obj_asstring(matchtype);
 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
 		if (mtype == dns_ssumatchtype_subdomain &&
-		    strcasecmp(str, "zonesub") == 0)
-		{
+		    strcasecmp(str, "zonesub") == 0) {
 			usezone = true;
 		}
 
@@ -313,8 +313,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				r.length = bracket - str;
 				max = strtoul(bracket + 1, &end, 10);
 				if (max > 0xffff || end[0] != /*(*/ ')' ||
-				    end[1] != 0)
-				{
+				    end[1] != 0) {
 					cfg_obj_log(identity, named_g_lctx,
 						    ISC_LOG_ERROR,
 						    "'%s' is not a valid count",
@@ -455,8 +454,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 * there's nothing to do anymore.
 	 */
 	if (ISC_LIST_EMPTY(rdatalist_a->rdata) &&
-	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata))
-	{
+	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata)) {
 		return (ISC_R_SUCCESS);
 	}
 
@@ -890,6 +888,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	int i;
 	int32_t journal_size;
 	bool multi;
+	bool alt;
+	dns_view_t *view = NULL;
 	dns_kasp_t *kasp = NULL;
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
@@ -904,6 +904,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	int seconds;
 	dns_ttl_t maxttl = 0; /* unlimited */
 	dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
+	isc_dscp_t dscp;
 
 	i = 0;
 	if (zconfig != NULL) {
@@ -927,8 +928,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	maps[i] = NULL;
 
 	if (vconfig != NULL) {
-		CHECK(named_config_getclass(cfg_tuple_get(vconfig, "class"),
-					    dns_rdataclass_in, &vclass));
+		RETERR(named_config_getclass(cfg_tuple_get(vconfig, "class"),
+					     dns_rdataclass_in, &vclass));
 	} else {
 		vclass = dns_rdataclass_in;
 	}
@@ -939,8 +940,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 
 	zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
 
-	CHECK(named_config_getclass(cfg_tuple_get(zconfig, "class"), vclass,
-				    &zclass));
+	RETERR(named_config_getclass(cfg_tuple_get(zconfig, "class"), vclass,
+				     &zclass));
 	dns_zone_setclass(zone, zclass);
 	if (raw != NULL) {
 		dns_zone_setclass(raw, zclass);
@@ -960,7 +961,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
 	}
 	if (cpval == NULL) {
-		CHECK(ISC_R_NOMEMORY);
+		return (ISC_R_NOMEMORY);
 	}
 
 	obj = NULL;
@@ -975,7 +976,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				      "zone '%s': both 'database' and 'dlz' "
 				      "specified",
 				      zname);
-			CHECK(ISC_R_FAILURE);
+			return (ISC_R_FAILURE);
 		}
 
 		len = strlen(dlzname) + 5;
@@ -986,7 +987,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	result = strtoargv(mctx, cpval, &dbargc, &dbargv);
 	if (result != ISC_R_SUCCESS && cpval != default_dbtype) {
 		isc_mem_free(mctx, cpval);
-		CHECK(result);
+		return (result);
 	}
 
 	/*
@@ -1011,12 +1012,11 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	 * will be needing a master file.
 	 */
 	if (ztype == dns_zone_primary && cpval == default_dbtype &&
-	    filename == NULL)
-	{
+	    filename == NULL) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "zone '%s': 'file' not specified", zname);
-		CHECK(ISC_R_FAILURE);
+		return (ISC_R_FAILURE);
 	}
 
 	if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) {
@@ -1049,7 +1049,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				    "can only be used with "
 				    "'masterfile-format text'",
 				    zname);
-			CHECK(ISC_R_FAILURE);
+			return (ISC_R_FAILURE);
 		}
 
 		if (strcasecmp(masterstylestr, "full") == 0) {
@@ -1074,45 +1074,47 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
 		char *signedname;
 
-		CHECK(dns_zone_setfile(raw, filename, masterformat,
-				       masterstyle));
+		RETERR(dns_zone_setfile(raw, filename, masterformat,
+					masterstyle));
 		signedname = isc_mem_get(mctx, signedlen);
 
 		(void)snprintf(signedname, signedlen, "%s" SIGNED, filename);
 		result = dns_zone_setfile(zone, signedname,
 					  dns_masterformat_raw, NULL);
 		isc_mem_put(mctx, signedname, signedlen);
-		CHECK(result);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
 	} else {
-		CHECK(dns_zone_setfile(zone, filename, masterformat,
-				       masterstyle));
+		RETERR(dns_zone_setfile(zone, filename, masterformat,
+					masterstyle));
 	}
 
 	obj = NULL;
 	result = cfg_map_get(zoptions, "journal", &obj);
 	if (result == ISC_R_SUCCESS) {
-		CHECK(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj)));
+		RETERR(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj)));
 	}
 
 	/*
 	 * Notify messages are processed by the raw zone if it exists.
 	 */
 	if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) {
-		CHECK(configure_zone_acl(zconfig, vconfig, config, allow_notify,
-					 ac, mayberaw, dns_zone_setnotifyacl,
-					 dns_zone_clearnotifyacl));
+		RETERR(configure_zone_acl(
+			zconfig, vconfig, config, allow_notify, ac, mayberaw,
+			dns_zone_setnotifyacl, dns_zone_clearnotifyacl));
 	}
 
 	/*
 	 * XXXAG This probably does not make sense for stubs.
 	 */
-	CHECK(configure_zone_acl(zconfig, vconfig, config, allow_query, ac,
-				 zone, dns_zone_setqueryacl,
-				 dns_zone_clearqueryacl));
+	RETERR(configure_zone_acl(zconfig, vconfig, config, allow_query, ac,
+				  zone, dns_zone_setqueryacl,
+				  dns_zone_clearqueryacl));
 
-	CHECK(configure_zone_acl(zconfig, vconfig, config, allow_query_on, ac,
-				 zone, dns_zone_setqueryonacl,
-				 dns_zone_clearqueryonacl));
+	RETERR(configure_zone_acl(zconfig, vconfig, config, allow_query_on, ac,
+				  zone, dns_zone_setqueryonacl,
+				  dns_zone_clearqueryonacl));
 
 	obj = NULL;
 	result = named_config_get(maps, "dialup", &obj);
@@ -1169,10 +1171,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	rcvquerystats = NULL;
 	dnssecsignstats = NULL;
 	if (statlevel == dns_zonestat_full) {
-		CHECK(isc_stats_create(mctx, &zoneqrystats,
-				       ns_statscounter_max));
-		CHECK(dns_rdatatypestats_create(mctx, &rcvquerystats));
-		CHECK(dns_dnssecsignstats_create(mctx, &dnssecsignstats));
+		RETERR(isc_stats_create(mctx, &zoneqrystats,
+					ns_statscounter_max));
+		RETERR(dns_rdatatypestats_create(mctx, &rcvquerystats));
+		RETERR(dns_dnssecsignstats_create(mctx, &dnssecsignstats));
 	}
 	dns_zone_setrequeststats(zone, zoneqrystats);
 	dns_zone_setrcvquerystats(zone, rcvquerystats);
@@ -1198,12 +1200,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype != dns_zone_stub && ztype != dns_zone_staticstub &&
 	    ztype != dns_zone_redirect)
 	{
-		/* Make a reference to the default policy. */
-		result = dns_kasplist_find(kasplist, "default", &kasp);
-		INSIST(result == ISC_R_SUCCESS && kasp != NULL);
-		dns_zone_setdefaultkasp(zone, kasp);
-		dns_kasp_detach(&kasp);
-
 		obj = NULL;
 		result = named_config_get(maps, "dnssec-policy", &obj);
 		if (result == ISC_R_SUCCESS) {
@@ -1217,7 +1213,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 						ISC_LOG_ERROR,
 						"dnssec-policy '%s' not found ",
 						kaspname);
-					CHECK(result);
+					RETERR(result);
 				}
 				dns_zone_setkasp(zone, kasp);
 				use_kasp = true;
@@ -1266,9 +1262,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
 
-			CHECK(named_config_getipandkeylist(config, "primaries",
-							   obj, mctx, &ipkl));
-			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.sources,
+			RETERR(named_config_getipandkeylist(config, "primaries",
+							    obj, mctx, &ipkl));
+			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.dscps,
 					       ipkl.keys, ipkl.tlss,
 					       ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
@@ -1279,22 +1275,50 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "parental-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));
+		RETERR(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setparentalsrc4dscp(zone, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));
 
 		obj = NULL;
 		result = named_config_get(maps, "parental-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));
+		RETERR(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setparentalsrc6dscp(zone, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));
 
 		obj = NULL;
 		result = named_config_get(maps, "notify-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
+		RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setnotifysrc4dscp(zone, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));
 
 		obj = NULL;
 		result = named_config_get(maps, "notify-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
+		RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setnotifysrc6dscp(zone, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));
 
 		obj = NULL;
 		result = named_config_get(maps, "notify-to-soa", &obj);
@@ -1304,7 +1328,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 
 		dns_zone_setisself(zone, isself, named_g_server->interfacemgr);
 
-		CHECK(configure_zone_acl(
+		RETERR(configure_zone_acl(
 			zconfig, vconfig, config, allow_transfer, ac, zone,
 			dns_zone_setxfracl, dns_zone_clearxfracl));
 
@@ -1334,14 +1358,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				journal_size = -1;
 			}
 		} else {
-			uint64_t value = cfg_obj_asuint64(obj);
+			isc_resourcevalue_t value;
+			value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
 				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
 					    value);
-				CHECK(ISC_R_RANGE);
+				RETERR(ISC_R_RANGE);
 			}
 			journal_size = (uint32_t)value;
 		}
@@ -1447,12 +1472,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check);
 
-		obj = NULL;
-		result = named_config_get(maps, "check-svcb", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSVCB,
-				   cfg_obj_asboolean(obj));
-
 		obj = NULL;
 		result = named_config_get(maps, "zero-no-soa-ttl", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1479,14 +1498,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				journal_size = -1;
 			}
 		} else {
-			uint64_t value = cfg_obj_asuint64(obj);
+			isc_resourcevalue_t value;
+			value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
 				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
 					    value);
-				CHECK(ISC_R_RANGE);
+				RETERR(ISC_R_RANGE);
 			}
 			journal_size = (uint32_t)value;
 		}
@@ -1516,9 +1536,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype == dns_zone_primary) {
 		dns_acl_t *updateacl;
 
-		CHECK(configure_zone_acl(zconfig, vconfig, config, allow_update,
-					 ac, mayberaw, dns_zone_setupdateacl,
-					 dns_zone_clearupdateacl));
+		RETERR(configure_zone_acl(
+			zconfig, vconfig, config, allow_update, ac, mayberaw,
+			dns_zone_setupdateacl, dns_zone_clearupdateacl));
 
 		updateacl = dns_zone_getupdateacl(mayberaw);
 		if (updateacl != NULL && dns_acl_isinsecure(updateacl)) {
@@ -1529,7 +1549,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				      zname);
 		}
 
-		CHECK(configure_zone_ssutable(zoptions, mayberaw, zname));
+		RETERR(configure_zone_ssutable(zoptions, mayberaw, zname));
 	}
 
 	/*
@@ -1606,7 +1626,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "key-directory", &obj);
 		if (result == ISC_R_SUCCESS) {
 			filename = cfg_obj_asstring(obj);
-			CHECK(dns_zone_setkeydirectory(zone, filename));
+			RETERR(dns_zone_setkeydirectory(zone, filename));
 		}
 
 		obj = NULL;
@@ -1648,8 +1668,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "dnssec-loadkeys-interval",
 					  &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setrefreshkeyinterval(zone,
-						     cfg_obj_asuint32(obj)));
+		RETERR(dns_zone_setrefreshkeyinterval(zone,
+						      cfg_obj_asuint32(obj)));
 
 		obj = NULL;
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
@@ -1677,10 +1697,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}
 
 	if (ztype == dns_zone_secondary || ztype == dns_zone_mirror) {
-		CHECK(configure_zone_acl(zconfig, vconfig, config,
-					 allow_update_forwarding, ac, mayberaw,
-					 dns_zone_setforwardacl,
-					 dns_zone_clearforwardacl));
+		RETERR(configure_zone_acl(zconfig, vconfig, config,
+					  allow_update_forwarding, ac, mayberaw,
+					  dns_zone_setforwardacl,
+					  dns_zone_clearforwardacl));
 	}
 
 	/*%
@@ -1692,13 +1712,13 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (obj != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
-			CHECK(named_config_getipandkeylist(
+			RETERR(named_config_getipandkeylist(
 				config, "parental-agents", obj, mctx, &ipkl));
-			dns_zone_setparentals(zone, ipkl.addrs, ipkl.sources,
-					      ipkl.keys, ipkl.tlss, ipkl.count);
+			dns_zone_setparentals(zone, ipkl.addrs, ipkl.keys,
+					      ipkl.tlss, ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
 		} else {
-			dns_zone_setparentals(zone, NULL, NULL, NULL, NULL, 0);
+			dns_zone_setparentals(zone, NULL, NULL, NULL, 0);
 		}
 	}
 
@@ -1787,6 +1807,13 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME,
 				   ignore);
 
+		obj = NULL;
+		result = named_config_get(maps, "dnssec-secure-to-insecure",
+					  &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		dns_zone_setoption(mayberaw, DNS_ZONEOPT_SECURETOINSECURE,
+				   cfg_obj_asboolean(obj));
+
 		obj = NULL;
 		result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
 		if (result == ISC_R_SUCCESS) {
@@ -1829,7 +1856,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		(void)cfg_map_get(zoptions, "allow-transfer", &obj);
 		if (obj == NULL) {
 			dns_acl_t *none;
-			CHECK(dns_acl_none(mctx, &none));
+			RETERR(dns_acl_none(mctx, &none));
 			dns_zone_setxfracl(zone, none);
 			dns_acl_detach(&none);
 		}
@@ -1854,22 +1881,20 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			result = named_config_getremotesdef(
 				named_g_config, "primaries",
 				DEFAULT_IANA_ROOT_ZONE_PRIMARIES, &obj);
-			CHECK(result);
+			RETERR(result);
 		}
 		if (obj != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
 
-			CHECK(named_config_getipandkeylist(config, "primaries",
-							   obj, mctx, &ipkl));
-			dns_zone_setprimaries(mayberaw, ipkl.addrs,
-					      ipkl.sources, ipkl.keys,
+			RETERR(named_config_getipandkeylist(config, "primaries",
+							    obj, mctx, &ipkl));
+			dns_zone_setprimaries(mayberaw, ipkl.addrs, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
 			count = ipkl.count;
 			dns_ipkeylist_clear(mctx, &ipkl);
 		} else {
-			dns_zone_setprimaries(mayberaw, NULL, NULL, NULL, NULL,
-					      0);
+			dns_zone_setprimaries(mayberaw, NULL, NULL, NULL, 0);
 		}
 
 		multi = false;
@@ -1914,14 +1939,69 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setxfrsource4(mayberaw,
-					     cfg_obj_assockaddr(obj)));
+		RETERR(dns_zone_setxfrsource4(mayberaw,
+					      cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setxfrsource4dscp(mayberaw, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));
 
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		CHECK(dns_zone_setxfrsource6(mayberaw,
-					     cfg_obj_assockaddr(obj)));
+		RETERR(dns_zone_setxfrsource6(mayberaw,
+					      cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setxfrsource6dscp(mayberaw, dscp));
+		named_add_reserved_dispatch(named_g_server,
+					    cfg_obj_assockaddr(obj));
+
+		obj = NULL;
+		result = named_config_get(maps, "alt-transfer-source", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		RETERR(dns_zone_setaltxfrsource4(mayberaw,
+						 cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setaltxfrsource4dscp(mayberaw, dscp));
+
+		obj = NULL;
+		result = named_config_get(maps, "alt-transfer-source-v6", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		RETERR(dns_zone_setaltxfrsource6(mayberaw,
+						 cfg_obj_assockaddr(obj)));
+		dscp = cfg_obj_getdscp(obj);
+		if (dscp == -1) {
+			dscp = named_g_dscp;
+		}
+		RETERR(dns_zone_setaltxfrsource6dscp(mayberaw, dscp));
+
+		obj = NULL;
+		(void)named_config_get(maps, "use-alt-transfer-source", &obj);
+		if (obj == NULL) {
+			/*
+			 * Default off when views are in use otherwise
+			 * on for BIND 8 compatibility.
+			 */
+			view = dns_zone_getview(zone);
+			if (view != NULL && strcmp(view->name, "_default") == 0)
+			{
+				alt = true;
+			} else {
+				alt = false;
+			}
+		} else {
+			alt = cfg_obj_asboolean(obj);
+		}
+		dns_zone_setoption(mayberaw, DNS_ZONEOPT_USEALTXFRSRC, alt);
 
 		obj = NULL;
 		(void)named_config_get(maps, "try-tcp-refresh", &obj);
@@ -1930,21 +2010,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		break;
 
 	case dns_zone_staticstub:
-		CHECK(configure_staticstub(zoptions, zone, zname,
-					   default_dbtype));
+		RETERR(configure_staticstub(zoptions, zone, zname,
+					    default_dbtype));
 		break;
 
 	default:
 		break;
 	}
 
-	result = ISC_R_SUCCESS;
-
-cleanup:
-	if (kasp != NULL) {
-		dns_kasp_detach(&kasp);
-	}
-	return (result);
+	return (ISC_R_SUCCESS);
 }
 
 /*

bin/nsupdate/Makefile.am

@@ -4,6 +4,8 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
+	$(LIBIRS_CFLAGS)	\
+	$(LIBBIND9_CFLAGS)	\
 	$(GSSAPI_CFLAGS)	\
 	$(KRB5_CFLAGS)		\
 	$(READLINE_CFLAGS)
@@ -15,6 +17,8 @@ LDADD +=			\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCFG_LIBS)	\
+	$(LIBIRS_LIBS)		\
+	$(LIBBIND9_LIBS)	\
 	$(GSSAPI_LIBS)		\
 	$(KRB5_LIBS)
 

bin/nsupdate/nsupdate.c

@@ -25,8 +25,8 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/event.h>
 #include <isc/file.h>
-#include <isc/getaddresses.h>
 #include <isc/hash.h>
 #include <isc/job.h>
 #include <isc/lex.h>
@@ -38,19 +38,21 @@
 #include <isc/nonce.h>
 #include <isc/parseint.h>
 #include <isc/portset.h>
+#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/sockaddr.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
-#include <isc/tls.h>
+#include <isc/task.h>
 #include <isc/types.h>
 #include <isc/util.h>
 
 #include <dns/callbacks.h>
 #include <dns/dispatch.h>
 #include <dns/dnssec.h>
+#include <dns/events.h>
 #include <dns/fixedname.h>
 #include <dns/log.h>
 #include <dns/masterdump.h>
@@ -66,7 +68,6 @@
 #include <dns/rdatatype.h>
 #include <dns/request.h>
 #include <dns/tkey.h>
-#include <dns/transport.h>
 #include <dns/tsig.h>
 
 #include <dst/dst.h>
@@ -92,6 +93,8 @@
 
 #endif /* HAVE_GSSAPI */
 
+#include <bind9/getaddresses.h>
+
 #include "../dig/readline.h"
 
 #define MAXCMD	     (128 * 1024)
@@ -103,7 +106,7 @@
 
 #define DNSDEFAULTPORT 53
 
-/* Number of addresses to request from isc_getaddresses() */
+/* Number of addresses to request from bind9_getaddresses() */
 #define MAX_SERVERADDRS 4
 
 static uint16_t dnsport = DNSDEFAULTPORT;
@@ -117,14 +120,15 @@ static bool memdebugging = false;
 static bool have_ipv4 = false;
 static bool have_ipv6 = false;
 static bool is_dst_up = false;
-static bool use_tls = false;
 static bool usevc = false;
 static bool usegsstsig = false;
 static bool use_win2k_gsstsig = false;
 static bool tried_other_gsstsig = false;
 static bool local_only = false;
 static isc_nm_t *netmgr = NULL;
+static isc_taskmgr_t *taskmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
+static isc_task_t *global_task = NULL;
 static isc_log_t *glctx = NULL;
 static isc_mem_t *gmctx = NULL;
 static dns_dispatchmgr_t *dispatchmgr = NULL;
@@ -143,14 +147,6 @@ static dns_tsigkey_t *tsigkey = NULL;
 static dst_key_t *sig0key = NULL;
 static isc_sockaddr_t *servers = NULL;
 static isc_sockaddr_t *primary_servers = NULL;
-static dns_transport_list_t *transport_list = NULL;
-static dns_transport_t *transport = NULL;
-static isc_tlsctx_cache_t *tls_ctx_cache = NULL;
-static char *tls_hostname = NULL;
-static char *tls_client_key_file = NULL;
-static char *tls_client_cert_file = NULL;
-static char *tls_ca_file = NULL;
-static bool tls_always_verify_remote = true;
 static bool default_servers = true;
 static int ns_inuse = 0;
 static int primary_inuse = 0;
@@ -179,7 +175,6 @@ static dns_message_t *answer = NULL;
 static uint32_t default_ttl = 0;
 static bool default_ttl_set = false;
 static bool checknames = true;
-static bool checksvcb = true;
 static const char *resolvconf = RESOLV_CONF;
 
 bool done = false;
@@ -227,7 +222,7 @@ static void
 send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		dns_request_t **request, gss_ctx_id_t context);
 static void
-recvgss(void *arg);
+recvgss(isc_task_t *task, isc_event_t *event);
 #endif /* HAVE_GSSAPI */
 
 static void
@@ -798,19 +793,6 @@ set_source_ports(dns_dispatchmgr_t *manager) {
 	isc_portset_destroy(gmctx, &v6portset);
 }
 
-static isc_result_t
-create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
-	isc_buffer_t namesrc, namebuf;
-
-	dns_name_init(name, NULL);
-	isc_buffer_constinit(&namesrc, str, strlen(str));
-	isc_buffer_add(&namesrc, strlen(str));
-	isc_buffer_init(&namebuf, namedata, len);
-
-	return (dns_name_fromtext(name, &namesrc, dns_rootname,
-				  DNS_NAME_DOWNCASE, &namebuf));
-}
-
 static void
 setup_system(void) {
 	isc_result_t result;
@@ -818,8 +800,6 @@ setup_system(void) {
 	isc_sockaddrlist_t *nslist;
 	isc_logconfig_t *logconfig = NULL;
 	irs_resconf_t *resconf = NULL;
-	dns_name_t tlsname;
-	char namedata[DNS_NAME_FORMATSIZE + 1];
 
 	ddebug("setup_system()");
 
@@ -882,8 +862,7 @@ setup_system(void) {
 		 */
 		ns_total = 0;
 		for (sa = ISC_LIST_HEAD(*nslist); sa != NULL;
-		     sa = ISC_LIST_NEXT(sa, link))
-		{
+		     sa = ISC_LIST_NEXT(sa, link)) {
 			switch (sa->type.sa.sa_family) {
 			case AF_INET:
 				if (have_ipv4) {
@@ -905,8 +884,7 @@ setup_system(void) {
 
 		i = 0;
 		for (sa = ISC_LIST_HEAD(*nslist); sa != NULL;
-		     sa = ISC_LIST_NEXT(sa, link))
-		{
+		     sa = ISC_LIST_NEXT(sa, link)) {
 			switch (sa->type.sa.sa_family) {
 			case AF_INET:
 				if (have_ipv4) {
@@ -936,6 +914,9 @@ setup_system(void) {
 	result = dns_dispatchmgr_create(gmctx, netmgr, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");
 
+	result = isc_task_create(taskmgr, &global_task, 0);
+	check_result(result, "isc_task_create");
+
 	result = dst_lib_init(gmctx, NULL);
 	check_result(result, "dst_lib_init");
 	is_dst_up = true;
@@ -955,33 +936,8 @@ setup_system(void) {
 						&dispatchv4);
 		check_result(result, "dns_dispatch_createudp (v4)");
 	}
-	transport_list = dns_transport_list_new(gmctx);
 
-	isc_tlsctx_cache_create(gmctx, &tls_ctx_cache);
-
-	if (tls_client_key_file == NULL) {
-		result = create_name("tls-non-auth-client", namedata,
-				     sizeof(namedata), &tlsname);
-		check_result(result, "create_name (tls-non-auth-client)");
-		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
-					      transport_list);
-		dns_transport_set_tlsname(transport, "tls-non-auth-client");
-	} else {
-		result = create_name("tls-auth-client", namedata,
-				     sizeof(namedata), &tlsname);
-		check_result(result, "create_name (tls-auth-client)");
-		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
-					      transport_list);
-		dns_transport_set_tlsname(transport, "tls-auth-client");
-		dns_transport_set_keyfile(transport, tls_client_key_file);
-		dns_transport_set_certfile(transport, tls_client_cert_file);
-	}
-	dns_transport_set_cafile(transport, tls_ca_file);
-	dns_transport_set_remote_hostname(transport, tls_hostname);
-	dns_transport_set_always_verify_remote(transport,
-					       tls_always_verify_remote);
-
-	result = dns_requestmgr_create(gmctx, dispatchmgr, dispatchv4,
+	result = dns_requestmgr_create(gmctx, taskmgr, dispatchmgr, dispatchv4,
 				       dispatchv6, &requestmgr);
 	check_result(result, "dns_requestmgr_create");
 
@@ -1007,7 +963,7 @@ get_addresses(char *host, in_port_t port, isc_sockaddr_t *sockaddr,
 	isc_result_t result;
 
 	isc_loopmgr_blocking(loopmgr);
-	result = isc_getaddresses(host, port, sockaddr, naddrs, &count);
+	result = bind9_getaddresses(host, port, sockaddr, naddrs, &count);
 	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
 		error("couldn't get address for '%s': %s", host,
@@ -1016,7 +972,7 @@ get_addresses(char *host, in_port_t port, isc_sockaddr_t *sockaddr,
 	return (count);
 }
 
-#define PARSE_ARGS_FMT "46A:C:dDE:ghH:iK:lL:MoOk:p:Pr:R:St:Tu:vVy:"
+#define PARSE_ARGS_FMT "46C:dDghilL:Mok:p:Pr:R:t:Tu:vVy:"
 
 static void
 pre_parse_args(int argc, char **argv) {
@@ -1059,9 +1015,7 @@ pre_parse_args(int argc, char **argv) {
 			fprintf(stderr, "usage: nsupdate [-CdDi] [-L level] "
 					"[-l] [-g | -o | -y keyname:secret "
 					"| -k keyfile] [-p port] "
-					"[ -S [-K tlskeyfile] [-E tlscertfile] "
-					"[-A tlscafile] [-H tlshostname] "
-					"[-O] ] [-v] [-V] [-P] [-T] [-4 | -6] "
+					"[-v] [-V] [-P] [-T] [-4 | -6] "
 					"[filename]\n");
 			exit(1);
 
@@ -1133,11 +1087,6 @@ parse_args(int argc, char **argv) {
 				fatal("can't find IPv6 networking");
 			}
 			break;
-		case 'A':
-			use_tls = true;
-			usevc = true;
-			tls_ca_file = isc_commandline_argument;
-			break;
 		case 'C':
 			resolvconf = isc_commandline_argument;
 			break;
@@ -1148,27 +1097,12 @@ parse_args(int argc, char **argv) {
 			debugging = true;
 			ddebugging = true;
 			break;
-		case 'E':
-			use_tls = true;
-			usevc = true;
-			tls_client_cert_file = isc_commandline_argument;
-			break;
-		case 'H':
-			use_tls = true;
-			usevc = true;
-			tls_hostname = isc_commandline_argument;
-			break;
 		case 'M':
 			break;
 		case 'i':
 			force_interactive = true;
 			interactive = true;
 			break;
-		case 'K':
-			use_tls = true;
-			usevc = true;
-			tls_client_key_file = isc_commandline_argument;
-			break;
 		case 'l':
 			local_only = true;
 			break;
@@ -1201,11 +1135,6 @@ parse_args(int argc, char **argv) {
 			usegsstsig = true;
 			use_win2k_gsstsig = true;
 			break;
-		case 'O':
-			use_tls = true;
-			usevc = true;
-			tls_always_verify_remote = false;
-			break;
 		case 'p':
 			result = isc_parse_uint16(&dnsport,
 						  isc_commandline_argument, 10);
@@ -1217,10 +1146,6 @@ parse_args(int argc, char **argv) {
 				exit(1);
 			}
 			break;
-		case 'S':
-			use_tls = true;
-			usevc = true;
-			break;
 		case 't':
 			result = isc_parse_uint32(&timeout,
 						  isc_commandline_argument, 10);
@@ -1286,25 +1211,6 @@ parse_args(int argc, char **argv) {
 	}
 #endif /* HAVE_GSSAPI */
 
-	if (use_tls) {
-		if ((tls_client_key_file == NULL) !=
-		    (tls_client_cert_file == NULL))
-		{
-			fprintf(stderr,
-				"%s: cannot specify the -K option without"
-				"the -E option, and vice versa.\n",
-				argv[0]);
-			exit(1);
-		}
-		if (tls_ca_file != NULL && tls_always_verify_remote == false) {
-			fprintf(stderr,
-				"%s: cannot specify the -A option in "
-				"conjuction with the -O option.\n",
-				argv[0]);
-			exit(1);
-		}
-	}
-
 	if (argv[isc_commandline_index] != NULL) {
 		if (strcmp(argv[isc_commandline_index], "-") == 0) {
 			input = stdin;
@@ -1371,7 +1277,8 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 
 	if (*cmdline != 0) {
 		dns_rdatacallbacks_init(&callbacks);
-		isc_lex_create(gmctx, strlen(cmdline), &lex);
+		result = isc_lex_create(gmctx, strlen(cmdline), &lex);
+		check_result(result, "isc_lex_create");
 		isc_buffer_init(&source, cmdline, strlen(cmdline));
 		isc_buffer_add(&source, strlen(cmdline));
 		result = isc_lex_openbuffer(lex, &source);
@@ -1587,8 +1494,9 @@ evaluate_server(char *cmdline) {
 
 	ns_alloc = MAX_SERVERADDRS;
 	ns_inuse = 0;
-	servers = isc_mem_getx(gmctx, ns_alloc * sizeof(isc_sockaddr_t),
-			       ISC_MEM_ZERO);
+	servers = isc_mem_get(gmctx, ns_alloc * sizeof(isc_sockaddr_t));
+
+	memset(servers, 0, ns_alloc * sizeof(isc_sockaddr_t));
 	ns_total = get_addresses(server, (in_port_t)port, servers, ns_alloc);
 	if (ns_total == 0) {
 		return (STATUS_SYNTAX);
@@ -1994,8 +1902,7 @@ parseclass:
 		dns_name_t *bad;
 
 		if (!dns_rdata_checkowner(name, rdata->rdclass, rdata->type,
-					  true))
-		{
+					  true)) {
 			char namebuf[DNS_NAME_FORMATSIZE];
 
 			dns_name_format(name, namebuf, sizeof(namebuf));
@@ -2015,15 +1922,6 @@ parseclass:
 		}
 	}
 
-	if (!isdelete && checksvcb && rdata->type == dns_rdatatype_svcb) {
-		result = dns_rdata_checksvcb(name, rdata);
-		if (result != ISC_R_SUCCESS) {
-			fprintf(stderr, "check-svcb failed: %s\n",
-				isc_result_totext(result));
-			goto failure;
-		}
-	}
-
 	if (!isdelete && rdata->type == dns_rdatatype_nsec3param) {
 		dns_rdata_nsec3param_t nsec3param;
 
@@ -2110,32 +2008,6 @@ evaluate_checknames(char *cmdline) {
 	return (STATUS_MORE);
 }
 
-static uint16_t
-evaluate_checksvcb(char *cmdline) {
-	char *word;
-
-	ddebug("evaluate_checksvcb()");
-	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (word == NULL || *word == 0) {
-		fprintf(stderr, "could not read check-svcb directive\n");
-		return (STATUS_SYNTAX);
-	}
-	if (strcasecmp(word, "yes") == 0 || strcasecmp(word, "true") == 0 ||
-	    strcasecmp(word, "on") == 0)
-	{
-		checksvcb = true;
-	} else if (strcasecmp(word, "no") == 0 ||
-		   strcasecmp(word, "false") == 0 ||
-		   strcasecmp(word, "off") == 0)
-	{
-		checksvcb = false;
-	} else {
-		fprintf(stderr, "incorrect check-svcb directive: %s\n", word);
-		return (STATUS_SYNTAX);
-	}
-	return (STATUS_MORE);
-}
-
 static void
 setzone(dns_name_t *zonename) {
 	isc_result_t result;
@@ -2292,15 +2164,9 @@ do_next_command(char *cmdline) {
 		return (evaluate_realm(cmdline));
 	}
 	if (strcasecmp(word, "check-names") == 0 ||
-	    strcasecmp(word, "checknames") == 0)
-	{
+	    strcasecmp(word, "checknames") == 0) {
 		return (evaluate_checknames(cmdline));
 	}
-	if (strcasecmp(word, "check-svcb") == 0 ||
-	    strcasecmp(word, "checksvcb") == 0)
-	{
-		return (evaluate_checksvcb(cmdline));
-	}
 	if (strcasecmp(word, "gsstsig") == 0) {
 #if HAVE_GSSAPI
 		usegsstsig = true;
@@ -2467,24 +2333,32 @@ next_primary(const char *caller, isc_sockaddr_t *addr, isc_result_t eresult) {
 }
 
 static void
-update_completed(void *arg) {
-	dns_request_t *request = (dns_request_t *)arg;
+update_completed(isc_task_t *task, isc_event_t *event) {
+	dns_requestevent_t *reqev = NULL;
 	isc_result_t result;
+	dns_request_t *request;
+
+	UNUSED(task);
 
 	ddebug("update_completed()");
 
 	requests--;
 
+	REQUIRE(event->ev_type == DNS_EVENT_REQUESTDONE);
+	reqev = (dns_requestevent_t *)event;
+	request = reqev->request;
+
 	if (shuttingdown) {
 		dns_request_destroy(&request);
+		isc_event_free(&event);
 		maybeshutdown();
 		return;
 	}
 
-	result = dns_request_getresult(request);
-	if (result != ISC_R_SUCCESS) {
+	if (reqev->result != ISC_R_SUCCESS) {
 		if (!next_primary("update_completed",
-				  &primary_servers[primary_inuse], result))
+				  &primary_servers[primary_inuse],
+				  reqev->result))
 		{
 			seenerror = true;
 			goto done;
@@ -2495,6 +2369,7 @@ update_completed(void *arg) {
 		dns_message_renderreset(updatemsg);
 		dns_message_settsigkey(updatemsg, NULL);
 		send_update(zname, &primary_servers[primary_inuse]);
+		isc_event_free(&event);
 		return;
 	}
 
@@ -2565,6 +2440,7 @@ done:
 		dns_name_init(&tmpzonename, 0);
 		dns_name_init(&restart_primary, 0);
 	}
+	isc_event_free(&event);
 	done_update();
 }
 
@@ -2572,10 +2448,8 @@ static void
 send_update(dns_name_t *zone, isc_sockaddr_t *primary) {
 	isc_result_t result;
 	dns_request_t *request = NULL;
+	unsigned int options = DNS_REQUESTOPT_CASE;
 	isc_sockaddr_t *srcaddr;
-	unsigned int options = DNS_REQUESTOPT_CASE | DNS_REQUESTOPT_LARGE;
-	dns_transport_t *req_transport = NULL;
-	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
 
 	ddebug("send_update()");
 
@@ -2583,12 +2457,7 @@ send_update(dns_name_t *zone, isc_sockaddr_t *primary) {
 
 	if (usevc) {
 		options |= DNS_REQUESTOPT_TCP;
-		if (use_tls) {
-			req_transport = transport;
-			req_tls_ctx_cache = tls_ctx_cache;
-		}
 	}
-
 	if (tsigkey == NULL && sig0key != NULL) {
 		result = dns_message_setsig0key(updatemsg, sig0key);
 		check_result(result, "dns_message_setsig0key");
@@ -2608,15 +2477,14 @@ send_update(dns_name_t *zone, isc_sockaddr_t *primary) {
 
 	/* Windows doesn't like the tsig name to be compressed. */
 	if (updatemsg->tsigname) {
-		updatemsg->tsigname->attributes.nocompress = true;
+		updatemsg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
 	}
 
-	result = dns_request_create(requestmgr, updatemsg, srcaddr, primary,
-				    req_transport, req_tls_ctx_cache, options,
-				    tsigkey, timeout, udp_timeout, udp_retries,
-				    isc_loop_main(loopmgr), update_completed,
-				    NULL, &request);
-	check_result(result, "dns_request_create");
+	result = dns_request_createvia(requestmgr, updatemsg, srcaddr, primary,
+				       -1, options, tsigkey, timeout,
+				       udp_timeout, udp_retries, global_task,
+				       update_completed, NULL, &request);
+	check_result(result, "dns_request_createvia");
 
 	if (debugging) {
 		show_message(stdout, updatemsg, "Outgoing update query:");
@@ -2640,11 +2508,10 @@ next_server(const char *caller, isc_sockaddr_t *addr, isc_result_t eresult) {
 }
 
 static void
-recvsoa(void *arg) {
-	dns_request_t *request = (dns_request_t *)arg;
-	isc_result_t result, eresult = dns_request_getresult(request);
-	nsu_requestinfo_t *reqinfo = dns_request_getarg(request);
-	dns_message_t *soaquery = reqinfo->msg;
+recvsoa(isc_task_t *task, isc_event_t *event) {
+	dns_requestevent_t *reqev = NULL;
+	dns_request_t *request = NULL;
+	isc_result_t result, eresult;
 	dns_message_t *rcvmsg = NULL;
 	dns_section_t section;
 	dns_name_t *name = NULL;
@@ -2653,20 +2520,33 @@ recvsoa(void *arg) {
 	dns_rdata_t soarr = DNS_RDATA_INIT;
 	int pass = 0;
 	dns_name_t primary;
-	isc_sockaddr_t *addr = reqinfo->addr;
-	isc_sockaddr_t *srcaddr = NULL;
+	nsu_requestinfo_t *reqinfo;
+	dns_message_t *soaquery = NULL;
+	isc_sockaddr_t *addr;
+	isc_sockaddr_t *srcaddr;
 	bool seencname = false;
 	dns_name_t tname;
 	unsigned int nlabels;
 
+	UNUSED(task);
+
 	ddebug("recvsoa()");
 
 	requests--;
 
+	REQUIRE(event->ev_type == DNS_EVENT_REQUESTDONE);
+	reqev = (dns_requestevent_t *)event;
+	request = reqev->request;
+	eresult = reqev->result;
+	reqinfo = reqev->ev_arg;
+	soaquery = reqinfo->msg;
+	addr = reqinfo->addr;
+
 	if (shuttingdown) {
 		dns_request_destroy(&request);
 		dns_message_detach(&soaquery);
 		isc_mem_put(gmctx, reqinfo, sizeof(nsu_requestinfo_t));
+		isc_event_free(&event);
 		maybeshutdown();
 		return;
 	}
@@ -2679,22 +2559,21 @@ recvsoa(void *arg) {
 		dns_message_settsigkey(soaquery, NULL);
 		sendrequest(&servers[ns_inuse], soaquery, &request);
 		isc_mem_put(gmctx, reqinfo, sizeof(nsu_requestinfo_t));
+		isc_event_free(&event);
 		setzoneclass(dns_rdataclass_none);
 		return;
 	}
 
 	isc_mem_put(gmctx, reqinfo, sizeof(nsu_requestinfo_t));
 	reqinfo = NULL;
+	isc_event_free(&event);
+	reqev = NULL;
 
 	ddebug("About to create rcvmsg");
 	dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
 	result = dns_request_getresponse(request, rcvmsg,
 					 DNS_MESSAGEPARSE_PRESERVEORDER);
 	if (result == DNS_R_TSIGERRORSET && servers != NULL) {
-		unsigned int options = DNS_REQUESTOPT_CASE;
-		dns_transport_t *req_transport = NULL;
-		isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
-
 		dns_message_detach(&rcvmsg);
 		ddebug("Destroying request [%p]", request);
 		dns_request_destroy(&request);
@@ -2704,26 +2583,17 @@ recvsoa(void *arg) {
 		dns_message_renderreset(soaquery);
 		ddebug("retrying soa request without TSIG");
 
-		if (usevc) {
-			options |= DNS_REQUESTOPT_TCP;
-			if (!default_servers && use_tls) {
-				req_transport = transport;
-				req_tls_ctx_cache = tls_ctx_cache;
-			}
-		}
-
 		if (isc_sockaddr_pf(addr) == AF_INET6) {
 			srcaddr = localaddr6;
 		} else {
 			srcaddr = localaddr4;
 		}
 
-		result = dns_request_create(
-			requestmgr, soaquery, srcaddr, addr, req_transport,
-			req_tls_ctx_cache, options, NULL, FIND_TIMEOUT * 20,
-			FIND_TIMEOUT, 3, isc_loop_main(loopmgr), recvsoa,
-			reqinfo, &request);
-		check_result(result, "dns_request_create");
+		result = dns_request_createvia(
+			requestmgr, soaquery, srcaddr, addr, -1, 0, NULL,
+			FIND_TIMEOUT * 20, FIND_TIMEOUT, 3, global_task,
+			recvsoa, reqinfo, &request);
+		check_result(result, "dns_request_createvia");
 		requests++;
 		return;
 	}
@@ -2750,8 +2620,7 @@ recvsoa(void *arg) {
 	}
 
 	if (rcvmsg->rcode != dns_rcode_noerror &&
-	    rcvmsg->rcode != dns_rcode_nxdomain)
-	{
+	    rcvmsg->rcode != dns_rcode_nxdomain) {
 		fatal("response to SOA query was unsuccessful");
 	}
 
@@ -2763,8 +2632,8 @@ recvsoa(void *arg) {
 		dns_request_destroy(&request);
 		dns_message_detach(&soaquery);
 		ddebug("Out of recvsoa");
-		seenerror = true;
 		done_update();
+		seenerror = true;
 		return;
 	}
 
@@ -2865,18 +2734,13 @@ lookforsoa:
 		}
 		primary_alloc = MAX_SERVERADDRS;
 		size = primary_alloc * sizeof(isc_sockaddr_t);
-		primary_servers = isc_mem_getx(gmctx, size, ISC_MEM_ZERO);
+		primary_servers = isc_mem_get(gmctx, size);
+
+		memset(primary_servers, 0, size);
 		primary_total = get_addresses(serverstr, dnsport,
 					      primary_servers, primary_alloc);
 		if (primary_total == 0) {
-			seenerror = true;
-			dns_rdata_freestruct(&soa);
-			dns_message_detach(&soaquery);
-			dns_request_destroy(&request);
-			dns_message_detach(&rcvmsg);
-			ddebug("Out of recvsoa");
-			done_update();
-			return;
+			exit(1);
 		}
 		primary_inuse = 0;
 	} else {
@@ -2933,17 +2797,6 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	isc_result_t result;
 	nsu_requestinfo_t *reqinfo;
 	isc_sockaddr_t *srcaddr;
-	unsigned int options = DNS_REQUESTOPT_CASE;
-	dns_transport_t *req_transport = NULL;
-	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
-
-	if (usevc) {
-		options |= DNS_REQUESTOPT_TCP;
-		if (!default_servers && use_tls) {
-			req_transport = transport;
-			req_tls_ctx_cache = tls_ctx_cache;
-		}
-	}
 
 	reqinfo = isc_mem_get(gmctx, sizeof(nsu_requestinfo_t));
 	reqinfo->msg = msg;
@@ -2955,12 +2808,11 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		srcaddr = localaddr4;
 	}
 
-	result = dns_request_create(
-		requestmgr, msg, srcaddr, destaddr, req_transport,
-		req_tls_ctx_cache, options, default_servers ? NULL : tsigkey,
-		FIND_TIMEOUT * 20, FIND_TIMEOUT, 3, isc_loop_main(loopmgr),
-		recvsoa, reqinfo, request);
-	check_result(result, "dns_request_create");
+	result = dns_request_createvia(requestmgr, msg, srcaddr, destaddr, -1,
+				       0, default_servers ? NULL : tsigkey,
+				       FIND_TIMEOUT * 20, FIND_TIMEOUT, 3,
+				       global_task, recvsoa, reqinfo, request);
+	check_result(result, "dns_request_createvia");
 	requests++;
 }
 
@@ -3101,7 +2953,7 @@ start_gssrequest(dns_name_t *primary) {
 	}
 
 	/* Windows doesn't recognize name compression in the key name. */
-	keyname->attributes.nocompress = true;
+	keyname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
 
 	rmsg = NULL;
 	dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &rmsg);
@@ -3138,26 +2990,19 @@ static void
 send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		dns_request_t **request, gss_ctx_id_t context) {
 	isc_result_t result;
-	nsu_gssinfo_t *reqinfo = NULL;
-	isc_sockaddr_t *srcaddr = NULL;
-	unsigned int options = DNS_REQUESTOPT_CASE | DNS_REQUESTOPT_TCP;
-	dns_transport_t *req_transport = NULL;
-	isc_tlsctx_cache_t *req_tls_ctx_cache = NULL;
-
-	if (!default_servers && use_tls) {
-		req_transport = transport;
-		req_tls_ctx_cache = tls_ctx_cache;
-	}
+	nsu_gssinfo_t *reqinfo;
+	unsigned int options = 0;
+	isc_sockaddr_t *srcaddr;
 
 	debug("send_gssrequest");
 	REQUIRE(destaddr != NULL);
 
 	reqinfo = isc_mem_get(gmctx, sizeof(nsu_gssinfo_t));
-	*reqinfo = (nsu_gssinfo_t){
-		.msg = msg,
-		.addr = destaddr,
-		.context = context,
-	};
+	reqinfo->msg = msg;
+	reqinfo->addr = destaddr;
+	reqinfo->context = context;
+
+	options |= DNS_REQUESTOPT_TCP;
 
 	if (isc_sockaddr_pf(destaddr) == AF_INET6) {
 		srcaddr = localaddr6;
@@ -3165,12 +3010,11 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 		srcaddr = localaddr4;
 	}
 
-	result = dns_request_create(requestmgr, msg, srcaddr, destaddr,
-				    req_transport, req_tls_ctx_cache, options,
-				    tsigkey, FIND_TIMEOUT * 20, FIND_TIMEOUT, 3,
-				    isc_loop_main(loopmgr), recvgss, reqinfo,
-				    request);
-	check_result(result, "dns_request_create");
+	result = dns_request_createvia(requestmgr, msg, srcaddr, destaddr, -1,
+				       options, tsigkey, FIND_TIMEOUT * 20,
+				       FIND_TIMEOUT, 3, global_task, recvgss,
+				       reqinfo, request);
+	check_result(result, "dns_request_createvia");
 	if (debugging) {
 		show_message(stdout, msg, "Outgoing update query:");
 	}
@@ -3178,27 +3022,40 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 }
 
 static void
-recvgss(void *arg) {
-	dns_request_t *request = (dns_request_t *)arg;
-	nsu_gssinfo_t *reqinfo = dns_request_getarg(request);
-	isc_result_t result, eresult = dns_request_getresult(request);
+recvgss(isc_task_t *task, isc_event_t *event) {
+	dns_requestevent_t *reqev = NULL;
+	dns_request_t *request = NULL;
+	isc_result_t result, eresult;
 	dns_message_t *rcvmsg = NULL;
-	dns_message_t *tsigquery = reqinfo->msg;
-	dns_gss_ctx_id_t context = reqinfo->context;
-	isc_sockaddr_t *addr = reqinfo->addr;
+	nsu_gssinfo_t *reqinfo;
+	dns_message_t *tsigquery = NULL;
+	isc_sockaddr_t *addr;
+	dns_gss_ctx_id_t context;
 	isc_buffer_t buf;
-	dns_name_t *servname = NULL;
+	dns_name_t *servname;
 	dns_fixedname_t fname;
 	char *err_message = NULL;
 
+	UNUSED(task);
+
 	ddebug("recvgss()");
 
 	requests--;
 
+	REQUIRE(event->ev_type == DNS_EVENT_REQUESTDONE);
+	reqev = (dns_requestevent_t *)event;
+	request = reqev->request;
+	eresult = reqev->result;
+	reqinfo = reqev->ev_arg;
+	tsigquery = reqinfo->msg;
+	context = reqinfo->context;
+	addr = reqinfo->addr;
+
 	if (shuttingdown) {
 		dns_request_destroy(&request);
 		dns_message_detach(&tsigquery);
 		isc_mem_put(gmctx, reqinfo, sizeof(nsu_gssinfo_t));
+		isc_event_free(&event);
 		maybeshutdown();
 		return;
 	}
@@ -3216,10 +3073,14 @@ recvgss(void *arg) {
 			send_gssrequest(kserver, tsigquery, &request, context);
 		}
 		isc_mem_put(gmctx, reqinfo, sizeof(nsu_gssinfo_t));
+		isc_event_free(&event);
 		return;
 	}
 	isc_mem_put(gmctx, reqinfo, sizeof(nsu_gssinfo_t));
 
+	isc_event_free(&event);
+	reqev = NULL;
+
 	ddebug("recvgss creating rcvmsg");
 	dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
 
@@ -3250,8 +3111,7 @@ recvgss(void *arg) {
 	}
 
 	if (rcvmsg->rcode != dns_rcode_noerror &&
-	    rcvmsg->rcode != dns_rcode_nxdomain)
-	{
+	    rcvmsg->rcode != dns_rcode_nxdomain) {
 		fatal("response to GSS-TSIG query was unsuccessful");
 	}
 
@@ -3411,14 +3271,6 @@ static void
 cleanup(void) {
 	ddebug("cleanup()");
 
-	if (tls_ctx_cache != NULL) {
-		isc_tlsctx_cache_detach(&tls_ctx_cache);
-	}
-
-	if (transport_list != NULL) {
-		dns_transport_list_detach(&transport_list);
-	}
-
 	LOCK(&answer_lock);
 	if (answer != NULL) {
 		dns_message_detach(&answer);
@@ -3441,6 +3293,9 @@ cleanup(void) {
 	}
 
 #ifdef HAVE_GSSAPI
+	/*
+	 * Cleanup GSSAPI resources after taskmgr has been destroyed.
+	 */
 	if (kserver != NULL) {
 		isc_mem_put(gmctx, kserver, sizeof(isc_sockaddr_t));
 		kserver = NULL;
@@ -3474,7 +3329,7 @@ cleanup(void) {
 	}
 
 	ddebug("Shutting down managers");
-	isc_managers_destroy(&gmctx, &loopmgr, &netmgr);
+	isc_managers_destroy(&gmctx, &loopmgr, &netmgr, &taskmgr);
 }
 
 static void
@@ -3493,6 +3348,7 @@ getinput(void *arg) {
 	more = user_interaction();
 	isc_loopmgr_nonblocking(loopmgr);
 	if (!more) {
+		isc_task_detach(&global_task);
 		isc_loopmgr_shutdown(loopmgr);
 		return;
 	}
@@ -3521,7 +3377,7 @@ main(int argc, char **argv) {
 
 	pre_parse_args(argc, argv);
 
-	isc_managers_create(&gmctx, 1, &loopmgr, &netmgr);
+	isc_managers_create(&gmctx, 1, &loopmgr, &netmgr, &taskmgr);
 
 	parse_args(argc, argv);
 

bin/nsupdate/nsupdate.rst

@@ -19,7 +19,7 @@ nsupdate - dynamic DNS update utility
 Synopsis
 ~~~~~~~~
 
-:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [ [**-S**] [**-K** tlskeyfile] [**-E** tlscertfile] [**-A** tlscafile] [**-H** tlshostname] [-O] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]
+:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename]
 
 Description
 ~~~~~~~~~~~
@@ -71,15 +71,6 @@ Options
 
    This option sets use of IPv6 only.
 
-.. option:: -A tlscafile
-
-   This option specifies the file of the certificate authorities (CA) certificates
-   (in PEM format) in order to verify the remote server TLS certificate when
-   using DNS-over-TLS (DoT), to achieve Strict or Mutual TLS. When used, it will
-   override the certificates from the global certificates store, which are
-   otherwise used by default when :option:`-S` is enabled. This option can not
-   be used in conjuction with :option:`-O`, and it implies :option:`-S`.
-
 .. option:: -C
 
    Overrides the default `resolv.conf` file. This is only intended for testing.
@@ -93,23 +84,10 @@ Options
 
    This option sets extra debug mode.
 
-.. option:: -E tlscertfile
-
-   This option sets the certificate(s) file for authentication for the
-   DNS-over-TLS (DoT) transport to the remote server. The certificate
-   chain file is expected to be in PEM format. This option implies :option:`-S`,
-   and can only be used with :option:`-K`.
-
 .. option:: -g
 
    This option enables standard GSS-TSIG mode.
 
-.. option:: -H tlshostname
-
-   This option makes :program:`nsupdate` use the provided hostname during remote
-   server TLS certificate verification. Otherwise, the DNS server name
-   is used. This option implies :option:`-S`.
-
 .. option:: -i
 
    This option forces interactive mode, even when standard input is not a terminal.
@@ -126,13 +104,6 @@ Options
    key used to authenticate Dynamic DNS update requests. In this case,
    the key specified is not an HMAC-MD5 key.
 
-.. option:: -K tlskeyfile
-
-   This option sets the key file for authenticated encryption for the
-   DNS-over-TLS (DoT) transport with the remote server. The private key file is
-   expected to be in PEM format. This option implies :option:`-S`, and can only
-   be used with :option:`-E`.
-
 .. option:: -l
 
    This option sets local-host only mode, which sets the server address to localhost
@@ -152,14 +123,6 @@ Options
    This option enables a non-standards-compliant variant of GSS-TSIG
    used by Windows 2000.
 
-.. option:: -O
-
-   This option enables Opportunistic TLS. When used, the remote peer's TLS
-   certificate will not be verified. This option should be used for debugging
-   purposes only, and it is not recommended to use it in production. This
-   option can not be used in conjuction with :option:`-A`, and it implies
-   :option:`-S`.
-
 .. option:: -p port
 
    This option sets the port to use for connections to a name server. The default is
@@ -175,15 +138,6 @@ Options
    This option sets the number of UDP retries. The default is 3. If zero, only one update
    request is made.
 
-.. option:: -S
-
-   This option indicates whether to use DNS-over-TLS (DoT) when querying
-   name servers specified by ``server servername port`` syntax in the input
-   file, and the primary server discovered through a SOA request. When the
-   :option:`-K` and :option:`-E` options are used, then the specified TLS
-   client certificate and private key pair are used for authentication
-   (Mutual TLS). This option implies :option:`-v`.
-
 .. option:: -t timeout
 
    This option sets the maximum time an update request can take before it is aborted. The
@@ -262,8 +216,6 @@ The command formats and their meanings are as follows:
    update requests are sent. If no port number is specified, the default
    DNS port number of 53 is used.
 
-   .. note:: This command has no effect when GSS-TSIG is in use.
-
 ``local address port``
    This command sends all dynamic update requests using the local ``address``. When
    no local statement is provided, :program:`nsupdate` sends updates using
@@ -310,12 +262,6 @@ The command formats and their meanings are as follows:
    By default check-names processing is on. If check-names processing
    fails, the record is not added to the UPDATE message.
 
-``check-svbc [boolean]``
-   This command turns on or off check-svcb processing on records to be added.
-   Check-svcb has no effect on prerequisites or records to be deleted.
-   By default check-svcb processing is on. If check-svcb processing
-   fails, the record is not added to the UPDATE message.
-
 ``prereq nxdomain domain-name``
    This command requires that no resource record of any type exist with the name
    ``domain-name``.

bin/plugins/filter-a.c

@@ -339,7 +339,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
 
 	inst = isc_mem_get(mctx, sizeof(*inst));
-	*inst = (filter_instance_t){ 0 };
+	memset(inst, 0, sizeof(*inst));
 	isc_mem_attach(mctx, &inst->mctx);
 
 	if (parameters != NULL) {
@@ -619,8 +619,7 @@ process_section(const section_filter_t *filter) {
 		}
 
 		if (section == DNS_SECTION_ANSWER ||
-		    section == DNS_SECTION_AUTHORITY)
-		{
+		    section == DNS_SECTION_AUTHORITY) {
 			message->flags &= ~DNS_MESSAGEFLAG_AD;
 		}
 	}
@@ -670,8 +669,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		result = ns_client_checkaclsilent(qctx->client, NULL,
 						  inst->a_acl, true);
 		if (result == ISC_R_SUCCESS && inst->v4_a != NONE &&
-		    is_v4_client(qctx->client))
-		{
+		    is_v4_client(qctx->client)) {
 			client_state->mode = inst->v4_a;
 		} else if (result == ISC_R_SUCCESS && inst->v6_a != NONE &&
 			   is_v6_client(qctx->client))

bin/plugins/filter-aaaa.c

@@ -342,8 +342,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
 
 	inst = isc_mem_get(mctx, sizeof(*inst));
-	*inst = (filter_instance_t){ 0 };
-
+	memset(inst, 0, sizeof(*inst));
 	isc_mem_attach(mctx, &inst->mctx);
 
 	if (parameters != NULL) {
@@ -623,8 +622,7 @@ process_section(const section_filter_t *filter) {
 		}
 
 		if (section == DNS_SECTION_ANSWER ||
-		    section == DNS_SECTION_AUTHORITY)
-		{
+		    section == DNS_SECTION_AUTHORITY) {
 			message->flags &= ~DNS_MESSAGEFLAG_AD;
 		}
 	}

bin/plugins/filter-aaaa.rst

@@ -30,7 +30,7 @@ Description
 
 Until BIND 9.12, this feature was implemented natively in :iscman:`named` and
 enabled with the ``filter-aaaa`` ACL and the ``filter-aaaa-on-v4`` and
-``filter-aaaa-on-v6`` options. These options are no longer available in
+``filter-aaaa-on-v6`` options. These options are now deprecated in
 :iscman:`named.conf` but can be passed as parameters to the
 ``filter-aaaa.so`` plugin, for example:
 

bin/rndc/Makefile.am

@@ -4,7 +4,8 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
-	$(LIBISCCC_CFLAGS)
+	$(LIBISCCC_CFLAGS)	\
+	$(LIBBIND9_CFLAGS)
 
 AM_CPPFLAGS +=						\
 	-DRNDC_CONFFILE=\"${sysconfdir}/rndc.conf\"	\
@@ -21,4 +22,5 @@ rndc_LDADD =			\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCC_LIBS)	\
-	$(LIBISCCFG_LIBS)
+	$(LIBISCCFG_LIBS)	\
+	$(LIBBIND9_LIBS)

bin/rndc/rndc.c

@@ -22,18 +22,19 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/getaddresses.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netmgr.h>
+#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/refcount.h>
 #include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/thread.h>
 #include <isc/util.h>
 
@@ -49,6 +50,8 @@
 
 #include <isccfg/namedconf.h>
 
+#include <bind9/getaddresses.h>
+
 #include "util.h"
 
 #define SERVERADDRS 10
@@ -57,7 +60,9 @@ const char *progname = NULL;
 bool verbose;
 
 static isc_nm_t *netmgr = NULL;
+static isc_taskmgr_t *taskmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
+static isc_task_t *rndc_task = NULL;
 
 static const char *admin_conffile = NULL;
 static const char *admin_keyfile = NULL;
@@ -277,7 +282,7 @@ get_addresses(const char *host, in_port_t port) {
 		}
 	} else {
 		count = SERVERADDRS - nserveraddrs;
-		result = isc_getaddresses(
+		result = bind9_getaddresses(
 			host, port, &serveraddrs[nserveraddrs], count, &found);
 		nserveraddrs += found;
 	}
@@ -303,6 +308,7 @@ rndc_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	    atomic_load_acquire(&recvs) == 0)
 	{
 		shuttingdown = true;
+		isc_task_detach(&rndc_task);
 		isc_loopmgr_shutdown(loopmgr);
 	}
 }
@@ -388,6 +394,7 @@ rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	    atomic_load_acquire(&sends) == 0)
 	{
 		shuttingdown = true;
+		isc_task_detach(&rndc_task);
 		isc_loopmgr_shutdown(loopmgr);
 	}
 }
@@ -681,8 +688,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 		(void)cfg_map_get(config, "server", &servers);
 		if (servers != NULL) {
 			for (elt = cfg_list_first(servers); elt != NULL;
-			     elt = cfg_list_next(elt))
-			{
+			     elt = cfg_list_next(elt)) {
 				const char *name = NULL;
 				server = cfg_listelt_value(elt);
 				name = cfg_obj_asstring(
@@ -719,8 +725,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 	} else {
 		DO("get config key list", cfg_map_get(config, "key", &keys));
 		for (elt = cfg_list_first(keys); elt != NULL;
-		     elt = cfg_list_next(elt))
-		{
+		     elt = cfg_list_next(elt)) {
 			const char *name = NULL;
 
 			key = cfg_listelt_value(elt);
@@ -930,13 +935,11 @@ main(int argc, char **argv) {
 			break;
 		case 'b':
 			if (inet_pton(AF_INET, isc_commandline_argument, &in) ==
-			    1)
-			{
+			    1) {
 				isc_sockaddr_fromin(&local4, &in, 0);
 				local4set = true;
 			} else if (inet_pton(AF_INET6, isc_commandline_argument,
-					     &in6) == 1)
-			{
+					     &in6) == 1) {
 				isc_sockaddr_fromin6(&local6, &in6, 0);
 				local6set = true;
 			}
@@ -1019,9 +1022,10 @@ main(int argc, char **argv) {
 
 	serial = isc_random32();
 
-	isc_managers_create(&rndc_mctx, 1, &loopmgr, &netmgr);
-	isc_loopmgr_setup(loopmgr, rndc_start, NULL);
+	isc_managers_create(&rndc_mctx, 1, &loopmgr, &netmgr, &taskmgr);
+	isc_loopmgr_setup(loopmgr, rndc_start, rndc_task);
 
+	DO("create task", isc_task_create(taskmgr, &rndc_task, 0));
 	isc_log_create(rndc_mctx, &log, &logconfig);
 	isc_log_setcontext(log);
 	isc_log_settag(logconfig, progname);
@@ -1091,7 +1095,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(rndc_mctx, stderr);
 	}
 
-	isc_managers_destroy(&rndc_mctx, &loopmgr, &netmgr);
+	isc_managers_destroy(&rndc_mctx, &loopmgr, &netmgr, &taskmgr);
 
 	if (failed) {
 		return (1);

bin/rndc/util.c

@@ -19,6 +19,8 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#include <isc/print.h>
+
 extern bool verbose;
 extern const char *progname;
 

bin/tests/Makefile.am

@@ -1,7 +1,5 @@
 include $(top_srcdir)/Makefile.top
 
-EXTRA_DIST = convert-trs-to-junit.py
-
 SUBDIRS = system
 
 noinst_PROGRAMS =	\

bin/tests/system/.gitignore

@@ -1,6 +1,5 @@
 .cache
 .hypothesis
-.mypy_cache
 __pycache__
 dig.out*
 rndc.out*

bin/tests/system/Makefile.am

@@ -23,6 +23,7 @@ check_PROGRAMS =		\
 	feature-test		\
 	makejournal		\
 	pipelined/pipequeries	\
+	resolve			\
 	rndc/gencheck		\
 	rpz/dnsrps		\
 	tkey/keycreate		\
@@ -48,13 +49,13 @@ pipelined_pipequeries_LDADD =	\
 	$(LDADD)		\
 	$(LIBDNS_LIBS)
 
-rpz_dnsrps_CPPFLAGS =		\
+resolve_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
-	$(LIBDNS_CFLAGS)
+	$(LIBISC_CFLAGS)	\
+	$(LIBDNS_CFLAGS)	\
+	$(LIBIRS_CFLAGS)
 
-rpz_dnsrps_LDADD =		\
-	$(LDADD)		\
-	$(LIBDNS_LIBS)
+resolve_LDADD = $(LIBISC_LIBS) $(LIBIRS_LIBS) $(LIBDNS_LIBS)
 
 tkey_keycreate_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
@@ -104,17 +105,16 @@ TESTS +=			\
 	checknames		\
 	checkzone		\
 	database		\
-	dialup			\
 	dlzexternal		\
 	dns64			\
+	dscp			\
 	dsdigest		\
-	dupsigs			\
 	dyndb			\
 	ecdsa			\
 	eddsa			\
 	ednscompliance		\
 	emptyzones		\
-	enginepkcs11		\
+	engine_pkcs11		\
 	filter-aaaa		\
 	formerr			\
 	geoip2			\
@@ -124,7 +124,6 @@ TESTS +=			\
 	inline			\
 	integrity		\
 	hooks			\
-	host			\
 	journal			\
 	keepalive		\
 	keyfromlabel		\
@@ -171,6 +170,12 @@ TESTS +=			\
 	xferquota		\
 	zonechecks
 
+# The "stress" test is not run by default since it creates enough
+# load on the machine to make it unusable to other users.
+# The "dialup", "delzone", and "dupsigs" tests are also not run by
+# default because they take a very long time to complete.
+# TESTS += delzone dialup dupsigs stress
+
 if HAVE_LMDB
 TESTS += nzd2nzf
 endif # HAVE_LMDB
@@ -183,7 +188,6 @@ TESTS +=		\
 	nsupdate	\
 	resolver	\
 	statistics	\
-	stress		\
 	upforwd		\
 	zero
 

bin/tests/system/acl/tests.sh

@@ -98,7 +98,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1
 # and other values? right out
 t=`expr $t + 1`
 $DIG $DIGOPTS tsigzone. \
-	@10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:three:1234abcd8765" > dig.out.${t}
+	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}
 grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
 
 # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two

bin/tests/system/addzone/tests.sh

@@ -45,7 +45,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-if $FEATURETEST --with-lmdb; then
+if [ -n "$NZD" ]; then
     echo_i "checking that existing NZF file was renamed after migration ($n)"
     [ -e ns2/3bf305731dd26307.nzf~ ] || ret=1
     n=`expr $n + 1`
@@ -124,7 +124,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-if ! $FEATURETEST --with-lmdb; then
+if [ -z "$NZD" ]; then
     echo_i "verifying no comments in NZF file ($n)"
     ret=0
     hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
@@ -143,7 +143,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-if $FEATURETEST --with-lmdb; then
+if [ -n "$NZD" ]; then
     echo_i "checking zone is present in NZD ($n)"
     ret=0
     $NZD2NZF ns2/_default.nzd | grep previous.example > /dev/null || ret=1
@@ -169,14 +169,14 @@ check_nzd2nzf() (
 	! grep previous.example nzd2nzf.out.$n > /dev/null
 )
 
-if $FEATURETEST --with-lmdb; then
+if [ -n "$NZD" ]; then
     echo_i "checking zone was deleted from NZD ($n)"
     retry_quiet 10 check_nzd2nzf || ret=1
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=`expr $status + $ret`
 fi
 
-if ! $FEATURETEST --with-lmdb; then
+if [ -z "$NZD" ]; then
     echo_i "checking NZF file now has comment ($n)"
     ret=0
     hcount=`grep "^# New zone file for view: _default" ns2/3bf305731dd26307.nzf | wc -l`
@@ -512,7 +512,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-if ! $FEATURETEST --with-lmdb; then
+if [ -z "$NZD" ]; then
     echo_i "checking new NZF file has comment ($n)"
     ret=0
     hcount=`grep "^# New zone file for view: external" ns2/external.nzf | wc -l`
@@ -522,7 +522,7 @@ if ! $FEATURETEST --with-lmdb; then
     status=`expr $status + $ret`
 fi
 
-if $FEATURETEST --with-lmdb; then
+if [ -n "$NZD" ]; then
     echo_i "verifying added.example in external view created an external.nzd DB ($n)"
     ret=0
     [ -e ns2/external.nzd ] || ret=1
@@ -548,7 +548,7 @@ status=`expr $status + $ret`
 
 echo_i "checking rndc showzone with newly added zone ($n)"
 _check_rndc_showzone_newly_added() (
-	if ! $FEATURETEST --with-lmdb; then
+	if [ -z "$NZD" ]; then
 		expected='zone "added.example" in external { type primary; file "added.db"; };'
 	else
 		expected='zone "added.example" { type primary; file "added.db"; };'
@@ -655,7 +655,7 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-if $FEATURETEST --with-lmdb; then
+if [ -n "$NZD" ]; then
     echo_i "checking NZD file was created in new-zones-directory ($n)"
     expect=ns2/new-zones/directory.nzd
 else
@@ -725,8 +725,8 @@ $RNDCCMD 10.53.0.3 addzone '"test\".baz"' '{ type primary; check-names ignore; f
 $RNDCCMD 10.53.0.3 addzone '"test\\.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 addzone '"test\032.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 addzone '"test\010.baz"' '{ type primary; check-names ignore; file "e.db"; };' > /dev/null 2>&1 || ret=1
-stop_server ns3
-start_server --noclean --restart --port ${PORT} ns3 || ret=1
+stop_server addzone ns3
+start_server --noclean --restart --port ${PORT} addzone ns3 || ret=1
 retry_quiet 10 _check_version_bind || ret=1
 $DIG $DIGOPTS @10.53.0.3 SOA  "test4.baz" > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1

bin/tests/system/allow-query/tests.sh

@@ -95,7 +95,6 @@ $DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret
 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1
 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
-nextpart ns2/named.run | grep 'recursion not enabled for view' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -637,13 +636,11 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "test $n: default allow-recursion configuration"
 ret=0
-nextpart ns3/named.run > /dev/null
 $DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a > dig.out.ns3.1.$n
 grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 a.normal.example a > dig.out.ns3.2.$n
 grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1
-nextpart ns3/named.run | grep 'allow-recursion did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -656,7 +653,6 @@ grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 ns . > dig.out.ns3.2.$n
 grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1
-nextpart ns3/named.run | grep 'allow-recursion did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -675,7 +671,6 @@ grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
 $DIG -p ${PORT} @10.53.0.3 b.normal.example a > dig.out.ns3.2.$n
 grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
 grep 'ANSWER: 0' dig.out.ns3.2.$n > /dev/null || ret=1
-nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -702,7 +697,6 @@ $DIG -p ${PORT} @10.53.1.2 d.normal.example a > dig.out.ns3.4.$n
 grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.4.$n > /dev/null || ret=1
-nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -729,7 +723,6 @@ $DIG -p ${PORT} @10.53.1.2 f.normal.example a > dig.out.ns3.4.$n
 grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
 grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
 grep 'EDE: 18 (Prohibited)' dig.out.ns3.4.$n > /dev/null || ret=1
-nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 

bin/tests/system/auth/clean.sh

@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0

bin/tests/system/autosign/clean.sh

@@ -59,8 +59,11 @@ rm -f ns3/optout.example.db
 rm -f ns3/optout.nsec3.example.db
 rm -f ns3/optout.optout.example.db
 rm -f ns3/prepub.example.db
+rm -f ns3/prepub.example.db.in
 rm -f ns3/reconf.example.db
 rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
+rm -f ns3/secure-to-insecure.example.db
+rm -f ns3/secure-to-insecure2.example.db
 rm -f ns3/secure.example.db
 rm -f ns3/secure.nsec3.example.db
 rm -f ns3/secure.optout.example.db

bin/tests/system/autosign/ns2/keygen.sh

@@ -16,8 +16,9 @@
 # Have the child generate subdomain keys and pass DS sets to us.
 ( cd ../ns3 && $SHELL keygen.sh )
 
-for subdomain in secure nsec3 optout rsasha256 rsasha512 \
-		 nsec3-to-nsec oldsigs dname-at-apex-nsec3
+for subdomain in secure nsec3 autonsec3 optout rsasha256 rsasha512 \
+		 nsec3-to-nsec oldsigs sync dname-at-apex-nsec3 cds-delete \
+		 cdnskey-delete
 do
 	cp ../ns3/dsset-$subdomain.example. .
 done

bin/tests/system/autosign/ns3/keygen.sh

@@ -192,11 +192,31 @@ $KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM $zone > kg.out 2>&1 || dumpit kg.out
 $SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > s.out || dumpit s.out
 
+#
+# secure-to-insecure transition test zone; used to test removal of
+# keys via nsupdate
+#
+setup secure-to-insecure.example
+$KEYGEN -a $DEFAULT_ALGORITHM -q -fk $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -a $DEFAULT_ALGORITHM -q $zone > kg.out 2>&1 || dumpit kg.out
+$SIGNER -S -o $zone -f $zonefile $infile > s.out || dumpit s.out
+
+#
+# another secure-to-insecure transition test zone; used to test
+# removal of keys on schedule.
+#
+setup secure-to-insecure2.example
+ksk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 -fk $zone 2> kg.out) || dumpit kg.out
+echo $ksk > ../del1.key
+zsk=$($KEYGEN -q -a $DEFAULT_ALGORITHM -3 $zone 2> kg.out) || dumpit kg.out
+echo $zsk > ../del2.key
+$SIGNER -S -3 beef -o $zone -f $zonefile $infile > s.out || dumpit s.out
+
 #
 # Introducing a pre-published key test.
 #
 setup prepub.example
-infile="prepub.example.db.in"
+infile="secure-to-insecure2.example.db.in"
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q -fk $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q $zone > kg.out 2>&1 || dumpit kg.out
 $SIGNER -S -3 beef -o $zone -f $zonefile $infile > s.out || dumpit s.out

bin/tests/system/autosign/ns3/named.conf.in

@@ -170,6 +170,21 @@ zone "nsec3-to-nsec.example" {
 	auto-dnssec maintain;
 };
 
+zone "secure-to-insecure.example" {
+	type primary;
+	file "secure-to-insecure.example.db";
+	allow-update { any; };
+	dnssec-secure-to-insecure yes;
+};
+
+zone "secure-to-insecure2.example" {
+	type primary;
+	file "secure-to-insecure2.example.db";
+	allow-update { any; };
+	auto-dnssec maintain;
+	dnssec-secure-to-insecure yes;
+};
+
 zone "oldsigs.example" {
 	type primary;
 	file "oldsigs.example.db";

bin/tests/system/autosign/tests.sh

@@ -267,6 +267,80 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+echo_i "checking NSEC->NSEC3 conversion prerequisites ($n)"
+ret=0
+# these commands should result in an empty file:
+$DIG $DIGOPTS +noall +answer nsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.1.test$n || ret=1
+grep "NSEC3PARAM" dig.out.ns3.1.test$n > /dev/null && ret=1
+$DIG $DIGOPTS +noall +answer autonsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
+grep "NSEC3PARAM" dig.out.ns3.2.test$n > /dev/null && ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking NSEC3->NSEC conversion prerequisites ($n)"
+ret=0
+$DIG $DIGOPTS +noall +answer nsec3-to-nsec.example. nsec3param @10.53.0.3 > dig.out.ns3.test$n || ret=1
+grep "NSEC3PARAM" dig.out.ns3.test$n > /dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "converting zones from nsec to nsec3"
+$NSUPDATE > /dev/null 2>&1 <<END	|| status=1
+server 10.53.0.3 ${PORT}
+zone nsec3.nsec3.example.
+update add nsec3.nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
+send
+zone optout.nsec3.example.
+update add optout.nsec3.example. 3600 NSEC3PARAM 1 1 10 BEEF
+send
+zone nsec3.example.
+update add nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
+send
+zone autonsec3.example.
+update add autonsec3.example. 3600 NSEC3PARAM 1 0 20 DEAF
+send
+zone nsec3.optout.example.
+update add nsec3.optout.example. 3600 NSEC3PARAM 1 0 10 BEEF
+send
+zone optout.optout.example.
+update add optout.optout.example. 3600 NSEC3PARAM 1 1 10 BEEF
+send
+zone optout.example.
+update add optout.example. 3600 NSEC3PARAM 1 1 10 BEEF
+send
+END
+
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+    # try to convert nsec-only.example; this should fail due to
+    # non-NSEC3 compatible keys
+    echo_i "preset nsec3param in unsigned zone via nsupdate ($n)"
+    $NSUPDATE > nsupdate.out 2>&1 <<END
+server 10.53.0.3 ${PORT}
+zone nsec-only.example.
+update add nsec-only.example. 3600 NSEC3PARAM 1 0 10 BEEF
+send
+END
+fi
+
+echo_i "checking for nsec3param in unsigned zone ($n)"
+ret=0
+$DIG $DIGOPTS +noall +answer autonsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.test$n || ret=1
+grep "NSEC3PARAM" dig.out.ns3.test$n > /dev/null && ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking for nsec3param signing record ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 signing -list autonsec3.example. > signing.out.test$n 2>&1
+grep "Pending NSEC3 chain 1 0 20 DEAF" signing.out.test$n > /dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "resetting nsec3param via rndc signing ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 signing -clear all autonsec3.example. > /dev/null 2>&1
@@ -285,22 +359,6 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
-echo_i "setting nsec3param via rndc signing ($n)"
-ret=0
-$RNDCCMD 10.53.0.3 signing -nsec3param 1 1 10 beef optout.example. 2>&1
-for i in 0 1 2 3 4 5 6 7 8 9; do
-	ret=0
-	$DIG $DIGOPTS @10.53.0.3 nsec3param optout.example > dig.out.ns3.test$n
-	# Note that the Opt-Out flag is not used in NSEC3PARAM and is set to zero.
-	grep "NSEC3PARAM.*1.*0.*10.*BEEF" dig.out.ns3.test$n > /dev/null || ret=1
-	[ $ret -eq 0 ] && break
-	echo_i "waiting ... ($i)"
-	sleep 2
-done
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 echo_i "signing preset nsec3 zone"
 zsk=$(cat autozsk.key)
 ksk=$(cat autoksk.key)
@@ -311,6 +369,17 @@ $SETTIME -K ns3 -P now -A now $ksk > settime.out.test$n.ksk || ret=1
 echo_i "waiting for changes to take effect"
 sleep 3
 
+echo_i "converting zone from nsec3 to nsec"
+$NSUPDATE > /dev/null 2>&1 << END	|| status=1
+server 10.53.0.3 ${PORT}
+zone nsec3-to-nsec.example.
+update delete nsec3-to-nsec.example. NSEC3PARAM
+send
+END
+
+echo_i "waiting for change to take effect"
+sleep 3
+
 missing=$(keyfile_to_key_id "$(cat noksk-ksk.key)")
 echo_i "checking that expired RRSIGs from missing KSK $missing are not deleted ($n)"
 ret=0
@@ -423,6 +492,51 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+echo_i "checking NSEC->NSEC3 conversion failed with NSEC-only key ($n)"
+ret=0
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+    grep "failed: REFUSED" nsupdate.out > /dev/null || ret=1
+else
+    echo_i "skip: RSASHA1 not supported"
+fi
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking NSEC3->NSEC conversion succeeded ($n)"
+ret=0
+# this command should result in an empty file:
+$DIG $DIGOPTS +noall +answer nsec3-to-nsec.example. nsec3param @10.53.0.3 > dig.out.ns3.nx.test$n || ret=1
+grep "NSEC3PARAM" dig.out.ns3.nx.test$n > /dev/null && ret=1
+$DIG $DIGOPTS +noauth q.nsec3-to-nsec.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+$DIG $DIGOPTS +noauth q.nsec3-to-nsec.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
+digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking NSEC3->NSEC conversion with 'rndc signing -nsec3param none' ($n)"
+ret=0
+$RNDCCMD 10.53.0.3 signing -nsec3param none autonsec3.example. > /dev/null 2>&1
+# this command should result in an empty file:
+no_nsec3param() (
+ $DIG $DIGOPTS +noall +answer autonsec3.example. nsec3param @10.53.0.3 > dig.out.ns3.nx.test$n || return 1
+ grep "NSEC3PARAM" dig.out.ns3.nx.test$n > /dev/null && return 1
+ return 0
+)
+retry_quiet 10 no_nsec3param || ret=1
+$DIG $DIGOPTS +noauth q.autonsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+$DIG $DIGOPTS +noauth q.autonsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
+digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "checking TTLs of imported DNSKEYs (no default) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +noall +answer dnskey ttl1.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
@@ -922,11 +1036,79 @@ n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+echo_i "checking secure-to-insecure transition, nsupdate ($n)"
+ret=0
+$NSUPDATE > /dev/null 2>&1 <<END	|| status=1
+server 10.53.0.3 ${PORT}
+zone secure-to-insecure.example
+update delete secure-to-insecure.example dnskey
+send
+END
+for i in 0 1 2 3 4 5 6 7 8 9; do
+	ret=0
+	$DIG $DIGOPTS axfr secure-to-insecure.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
+	egrep '(RRSIG|DNSKEY|NSEC)' dig.out.ns3.test$n > /dev/null && ret=1
+	[ $ret -eq 0 ] && break
+	echo_i "waiting ... ($i)"
+	sleep 2
+done
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking secure-to-insecure transition, scheduled ($n)"
+ret=0
+file="ns3/$(cat del1.key).key"
+$SETTIME -I now -D now $file > settime.out.test$n.1 || ret=1
+file="ns3/$(cat del2.key).key"
+$SETTIME -I now -D now $file > settime.out.test$n.2 || ret=1
+($RNDCCMD 10.53.0.3 sign secure-to-insecure2.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+for i in 0 1 2 3 4 5 6 7 8 9; do
+	ret=0
+	$DIG $DIGOPTS axfr secure-to-insecure2.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
+	egrep '(RRSIG|DNSKEY|NSEC3)' dig.out.ns3.test$n > /dev/null && ret=1
+	[ $ret -eq 0 ] && break
+	echo_i "waiting ... ($i)"
+	sleep 2
+done
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "checking jitter in a newly signed NSEC3 zone ($n)"
+ret=0
+# Use DNS UPDATE to add an NSEC3PARAM record into the zone.
+$NSUPDATE > nsupdate.out.test$n 2>&1 <<END || ret=1
+server 10.53.0.3 ${PORT}
+zone jitter.nsec3.example.
+update add jitter.nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
+send
+END
+[ $ret != 0 ] && echo_i "error: dynamic update add NSEC3PARAM failed"
+# Create DNSSEC keys in the zone directory.
+$KEYGEN -a $DEFAULT_ALGORITHM -3 -q -K ns3 jitter.nsec3.example > /dev/null
+# Trigger zone signing.
+($RNDCCMD 10.53.0.3 sign jitter.nsec3.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+# Wait until zone has been signed.
+check_if_nsec3param_exists() {
+	$DIG $DIGOPTS NSEC3PARAM jitter.nsec3.example @10.53.0.3 > dig.out.ns3.1.test$n || return 1
+	grep -q "^jitter\.nsec3\.example\..*NSEC3PARAM" dig.out.ns3.1.test$n || return 1
+}
+retry_quiet 40 check_if_nsec3param_exists || {
+	echo_i "error: NSEC3PARAM not present yet"
+	ret=1
+}
+$DIG $DIGOPTS AXFR jitter.nsec3.example @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
+# Check jitter distribution.
+checkjitter dig.out.ns3.2.test$n || ret=1
+n=$((n + 1))
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "checking that serial number and RRSIGs are both updated (rt21045) ($n)"
 ret=0
-$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-oldserial=$(cat dig.out.ns3.test$n | awk '$0 !~ /SOA/ {print $3}')
-oldinception=$(cat dig.out.ns3.test$n | awk '/SOA/ {print $6}' | sort -u)
+oldserial=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '$0 !~ /SOA/ {print $3}')
+oldinception=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '/SOA/ {print $6}' | sort -u)
 
 $KEYGEN -a $DEFAULT_ALGORITHM -3 -q -K ns3 -P 0 -A +6d -I +38d -D +45d prepub.example > /dev/null
 
@@ -935,12 +1117,12 @@ newserial=$oldserial
 try=0
 while [ $oldserial -eq $newserial -a $try -lt 42 ]
 do
-	$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 > dig.out.ns3.test$n.2
-	newserial=$(cat dig.out.ns3.test$n.2 | awk '$0 !~ /SOA/ {print $3}')
+	newserial=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 |
+		 awk '$0 !~ /SOA/ {print $3}')
 	sleep 1
 	try=$((try + 1))
 done
-newinception=$(cat dig.out.ns3.test$n.2 | awk '/SOA/ {print $6}' | sort -u)
+newinception=$($DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '/SOA/ {print $6}' | sort -u)
 #echo "$oldserial : $newserial"
 #echo "$oldinception : $newinception"
 
@@ -997,6 +1179,7 @@ status=$((status + ret))
 
 echo_i "checking that signing records have been marked as complete ($n)"
 ret=0
+checkprivate . 10.53.0.1 || ret=1
 checkprivate bar 10.53.0.2 || ret=1
 checkprivate example 10.53.0.2 0 type65280 || ret=1 # sig-signing-type 65280
 checkprivate private.secure.example 10.53.0.3 2 || ret=1 # pre-signed
@@ -1018,6 +1201,8 @@ checkprivate rsasha512.example 10.53.0.3 || ret=1
 checkprivate secure.example 10.53.0.3 || ret=1
 checkprivate secure.nsec3.example 10.53.0.3 || ret=1
 checkprivate secure.optout.example 10.53.0.3 || ret=1
+checkprivate secure-to-insecure2.example 10.53.0.3 2|| ret=1 # automatically removed
+checkprivate secure-to-insecure.example 10.53.0.3 2 || ret=1 # automatically removed
 checkprivate ttl1.example 10.53.0.3 || ret=1
 checkprivate ttl2.example 10.53.0.3 || ret=1
 checkprivate ttl3.example 10.53.0.3 || ret=1
@@ -1025,11 +1210,8 @@ checkprivate ttl4.example 10.53.0.3 || ret=1
 n=$((n + 1))
 status=$((status + ret))
 
-echo_i "forcing full sign ($n)"
-ret=0
+echo_i "forcing full sign"
 ($RNDCCMD 10.53.0.1 sign . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
-n=$((n + 1))
-if [ $ret != 0 ]; then echo_i "failed"; fi
 
 echo_i "waiting for change to take effect"
 sleep 5

bin/tests/system/builtin/tests.sh

@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -160,7 +158,7 @@ sleep 1
 grep "zone serial (0) unchanged." ns1/named.run > /dev/null && ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 
-HOST_NAME=`$FEATURETEST --gethostname`
+HOSTNAME=`$FEATURETEST --gethostname`
 BIND_VERSION_STRING=$($NAMED -V | head -1)
 BIND_VERSION=$($NAMED -V | sed -ne 's/^BIND \([^ ]*\).*/\1/p')
 
@@ -168,14 +166,14 @@ n=`expr $n + 1`
 ret=0
 echo_i "Checking that default version works for rndc ($n)"
 $RNDCCMD 10.53.0.1 status > rndc.status.ns1.$n 2>&1
-grep -F "version: $BIND_VERSION_STRING" rndc.status.ns1.$n > /dev/null || ret=1
+fgrep "version: $BIND_VERSION_STRING" rndc.status.ns1.$n > /dev/null || ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 
 n=`expr $n + 1`
 ret=0
 echo_i "Checking that custom version works for rndc ($n)"
 $RNDCCMD 10.53.0.3 status > rndc.status.ns3.$n 2>&1
-grep -F "version: $BIND_VERSION_STRING (this is a test of version)" rndc.status.ns3.$n > /dev/null || ret=1
+fgrep "version: $BIND_VERSION_STRING (this is a test of version)" rndc.status.ns3.$n > /dev/null || ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 
 n=`expr $n + 1`
@@ -196,7 +194,7 @@ n=`expr $n + 1`
 ret=0
 echo_i "Checking that default hostname works for query ($n)"
 $DIG $DIGOPTS +short hostname.bind txt ch @10.53.0.1 > dig.out.ns1.$n
-grep "^\"$HOST_NAME\"$" dig.out.ns1.$n > /dev/null || ret=1
+grep "^\"$HOSTNAME\"$" dig.out.ns1.$n > /dev/null || ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 
 n=`expr $n + 1`
@@ -218,14 +216,14 @@ n=`expr $n + 1`
 ret=0
 echo_i "Checking that server-id hostname works for query ($n)"
 $DIG $DIGOPTS +short id.server txt ch @10.53.0.2 > dig.out.ns2.$n
-grep "^\"$HOST_NAME\"$" dig.out.ns2.$n > /dev/null || ret=1
+grep "^\"$HOSTNAME\"$" dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 
 n=`expr $n + 1`
 ret=0
 echo_i "Checking that server-id hostname works for EDNS name server ID request ($n)"
 $DIG $DIGOPTS +norec +nsid foo @10.53.0.2 > dig.out.ns2.$n
-grep "^; NSID: .* (\"$HOST_NAME\")$" dig.out.ns2.$n > /dev/null || ret=1
+grep "^; NSID: .* (\"$HOSTNAME\")$" dig.out.ns2.$n > /dev/null || ret=1
 if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
 
 n=`expr $n + 1`

bin/tests/system/cacheclean/tests.sh

@@ -108,7 +108,7 @@ echo_i "reset and check that records are correctly cached initially ($n)"
 ret=0
 load_cache
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | egrep '(TXT|ANY)' | wc -l`
 [ $nrecords -eq 18 ] || { ret=1; echo_i "found $nrecords records expected 18"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -202,7 +202,7 @@ n=`expr $n + 1`
 echo_i "check the number of cached records remaining ($n)"
 ret=0
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -v '^;' | grep -E '(TXT|ANY)' | wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -v '^;' | egrep '(TXT|ANY)' | wc -l`
 [ $nrecords -eq 17 ] || { ret=1; echo_i "found $nrecords records expected 17"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -220,7 +220,7 @@ n=`expr $n + 1`
 echo_i "check the number of cached records remaining ($n)"
 ret=0
 dump_cache
-nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | grep -E '(TXT|ANY)' | wc -l`
+nrecords=`filter_tree flushtest.example ns2/named_dump.db.test$n | egrep '(TXT|ANY)' | wc -l`
 [ $nrecords -eq 1 ] || { ret=1; echo_i "found $nrecords records expected 1"; }
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -234,6 +234,7 @@ mv ns2/named_dump.db.test$n ns2/named_dump.db.test$n.a
 sed -n '/plain success\/timeout/,/Unassociated entries/p' \
 	ns2/named_dump.db.test$n.a > sed.out.$n.a
 grep 'plain success/timeout' sed.out.$n.a > /dev/null 2>&1 || ret=1
+grep 'Unassociated entries' sed.out.$n.a > /dev/null 2>&1 || ret=1
 grep 'ns.flushtest.example' sed.out.$n.a > /dev/null 2>&1 || ret=1
 $RNDC $RNDCOPTS flushtree flushtest.example || ret=1
 dump_cache
@@ -241,6 +242,7 @@ mv ns2/named_dump.db.test$n ns2/named_dump.db.test$n.b
 sed -n '/plain success\/timeout/,/Unassociated entries/p' \
 	ns2/named_dump.db.test$n.b > sed.out.$n.b
 grep 'plain success/timeout' sed.out.$n.b > /dev/null 2>&1 || ret=1
+grep 'Unassociated entries' sed.out.$n.b > /dev/null 2>&1 || ret=1
 grep 'ns.flushtest.example' sed.out.$n.b > /dev/null 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

bin/tests/system/case/setup.sh

@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0

bin/tests/system/catz/clean.sh

@@ -1,5 +1,3 @@
-#!/bin/sh
-
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -13,25 +11,21 @@
 
 rm -f dig.out.*
 rm -f ns*/*.jnl
-rm -f ns*/*.mkeys
-rm -f ns*/*.nzd ns*/*.nzd-lock
 rm -f ns*/*.nzf
-rm -f ns*/managed-keys.bind*
-rm -f ns*/named.conf
+rm -f ns*/*.mkeys
 rm -f ns*/named.lock
 rm -f ns*/named.memstats
+rm -f ns*/named.conf
 rm -f ns*/named.run
 rm -f ns*/named.run.prev
 rm -f ns1/*dom*example.db
-rm -f ns1/tls1.example.db
 rm -f ns2/__catz__*db
 rm -f ns2/catalog-bad*.db
 rm -f ns2/named.conf.tmp
 rm -f ns3/dom2.example.db ns3/dom13.example.db ns3/dom14.example.db ns3/dom17.example.db ns3/dom18.example.db
-rm -f ns4/__catz__*db
-rm -f ns4/catalog-self.example.db
-rm -f ns[123]/catalog[1234].example.db
-rm -f ns[14]/catalog-tls.example.db
 rm -f nsupdate.out.*
-rm -f wait_for_message.*
+rm -f ns[123]/catalog[1234].example.db
 rm -rf ns2/zonedir
+rm -f ns*/*.nzd ns*/*.nzd-lock
+rm -f ns*/managed-keys.bind*
+rm -f wait_for_message.*

bin/tests/system/catz/ns1/named.conf.in

@@ -22,12 +22,10 @@ options {
 	notify-source 10.53.0.1;
 	transfer-source 10.53.0.1;
 	port @PORT@;
-	tls-port @TLSPORT@;
 	allow-new-zones yes;
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on port @EXTRAPORT1@ { 10.53.0.1; };
-	listen-on tls ephemeral { 10.53.0.1; };
 	listen-on-v6 { none; };
 	notify no;
 	notify-delay 0;
@@ -107,16 +105,6 @@ view "default" {
 		also-notify { 10.53.0.2; };
 		notify explicit;
 	};
-
-	# A catalog zone that requires TLS to be used
-	zone "catalog-tls.example" {
-		type primary;
-		file "catalog-tls.example.db";
-		allow-transfer transport tls { key tsig_key; };
-		allow-update { any; };
-		also-notify { 10.53.0.4; };
-		notify explicit;
-	};
 };
 
 view "ch" ch {
@@ -137,8 +125,3 @@ key tsig_key. {
 	secret "LSAnCU+Z";
 	algorithm @DEFAULT_HMAC@;
 };
-
-key next_key. {
-	secret "LaAnCU+Z";
-	algorithm @DEFAULT_HMAC@;
-};

bin/tests/system/catz/ns2/named1.conf.in

@@ -78,7 +78,7 @@ view "default" {
 	};
 
 	# A faulty dlz configuration to check if named and catz survive a certain class
-	# of failed configuration attempts (see GL #3060).
+	# of failed configuration attempts (see GL#3060).
 	# We use "dlz" because the dlz processing code is located in an ideal place in
 	# the view configuration function for the test to cover the view reverting code.
 #T3	dlz "bad-dlz" {
@@ -126,15 +126,6 @@ view "default" {
 		primaries { 10.53.0.1; };
 	};
 
-	# When the following zone configuration is enabled, "dom3.example" should
-	# already exist as a member of "catalog1.example", and named should be able
-	# to deal with that situation (see GL #3911). Make sure that this duplicate
-	# zone comes after the the "catalog1.example" zone in the configuration file.
-#T4	zone "dom3.example" {
-#T4	    type secondary;
-#T4	    file "dom2.example.db";
-#T4	};
-
 	# No "version" property
 	zone "catalog-bad1.example" {
 		type secondary;
@@ -186,8 +177,3 @@ key tsig_key. {
 	secret "LSAnCU+Z";
 	algorithm @DEFAULT_HMAC@;
 };
-
-key next_key. {
-	secret "LaAnCU+Z";
-	algorithm @DEFAULT_HMAC@;
-};