Refactor zone.c, use dns_remote_t structure

Use the new dns_remote_t structure for remote server communication to
primaries, parental agents, etc.

.clang-format

@@ -34,10 +34,6 @@ PointerAlignment: Right
 PointerBindsToType: false
 IncludeBlocks: Regroup
 IncludeCategories:
-  - Regex:           '^<(urcu\.h|urcu/urcu-|urcu-)'
-    Priority:        2
-  - Regex:           '^<urcu/'
-    Priority:        3
   - Regex:           '^<isc/'
     Priority:        5
   - Regex:           '^<(pk11|pkcs11)/'
@@ -54,6 +50,8 @@ IncludeCategories:
     Priority:        35
   - Regex:           '^<irs/'
     Priority:        40
+  - Regex:           '^<bind9/'
+    Priority:        45
   - Regex:           '^<(dig|named|rndc|confgen|dlz)/'
     Priority:        50
   - Regex:           '^<dlz_'
@@ -63,9 +61,9 @@ IncludeCategories:
   - Regex:           '^<tests/'
     Priority:        100
   - Regex:           '<openssl/'
-    Priority:        4
+    Priority:        1
   - Regex:           '<(mysql|protobuf-c)/'
-    Priority:        4
+    Priority:        1
   - Regex:           '.*'
     Priority:        0
 IndentExternBlock: NoIndent
@@ -78,4 +76,3 @@ PenaltyBreakString: 80
 PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
-ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]

.clang-format.headers

@@ -34,40 +34,26 @@ PointerAlignment: Right
 PointerBindsToType: false
 IncludeBlocks: Regroup
 IncludeCategories:
-  - Regex:           '^<(urcu/urcu-|urcu-)'
-    Priority:        2
-  - Regex:           '^<urcu/'
-    Priority:        3
   - Regex:           '^<isc/'
-    Priority:        5
-  - Regex:           '^<(pk11|pkcs11)/'
-    Priority:        10
+    Priority:        2
   - Regex:           '^<dns/'
-    Priority:        15
-  - Regex:           '^<dst/'
-    Priority:        20
-  - Regex:           '^<isccc/'
-    Priority:        25
+    Priority:        3
+  - Regex:           '^<iscccc/'
+    Priority:        4
   - Regex:           '^<isccfg/'
-    Priority:        30
+    Priority:        5
   - Regex:           '^<ns/'
-    Priority:        35
-  - Regex:           '^<irs/'
-    Priority:        40
-  - Regex:           '^<(dig|named|rndc|confgen|dlz)/'
-    Priority:        50
-  - Regex:           '^<dlz_'
-    Priority:        55
-  - Regex:           '^".*"'
-    Priority:        99
+    Priority:        6
+  - Regex:           '^<bind9/)'
+    Priority:        7
+  - Regex:           '^(<[^/]*)/)'
+    Priority:        8
   - Regex:           '^<tests/'
-    Priority:        100
-  - Regex:           '<openssl/'
-    Priority:        4
-  - Regex:           '<(mysql|protobuf-c)/'
-    Priority:        4
-  - Regex:           '.*'
-    Priority:        0
+    Priority:        10
+  - Regex:           '<[[:alnum:].]+>'
+    Priority:        1
+  - Regex:           '".*"'
+    Priority:        9
 IndentExternBlock: NoIndent
 KeepEmptyLinesAtTheStartOfBlocks: false
 MaxEmptyLinesToKeep: 1

.dir-locals.el

@@ -49,10 +49,6 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/bind9/include"))
 
-	       ;; libtest
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "tests/include"))
-
 	       ;; bin
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/check"))
@@ -61,7 +57,7 @@
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/confgen"))
 	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/confgen/include"))
+		(concat directory-of-current-dir-locals-file "bin/confgen/include"))	       
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/dig/include"))
 	       (expand-file-name
@@ -79,7 +75,7 @@
 
 	       (expand-file-name "/usr/include/libxml2")
 	       (expand-file-name "/usr/include/json-c")
-
+	       
 	       (expand-file-name "/usr/local/opt/openssl@1.1/include")
 	       (expand-file-name "/usr/local/opt/libxml2/include/libxml2")
 	       (expand-file-name "/usr/local/opt/json-c/include/json-c/")

.editorconfig

@@ -1,5 +0,0 @@
-[*.sh{,.in}]
-indent_style = space
-indent_size = 2
-binary_next_line   = true
-switch_case_indent = true

.github/workflows/codeql.yml

@@ -1,55 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ "bind-9.16", "bind-9.18", "main" ]
-  schedule:
-    - cron: '39 8 * * 3'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'cpp' ]
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    - name: Install build dependencies
-      uses: awalsh128/cache-apt-pkgs-action@latest
-      with:
-        packages: liburcu-dev libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
-        version: 1.0
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-
-    #   If the Autobuild fails above, remove it and uncomment the following three lines.
-    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
-
-    # - run: |
-    #   echo "Run, Build Application using script"
-    #   ./location_of_script_within_repo/buildscript.sh
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
-      with:
-        category: "/language:${{matrix.language}}"

.github/workflows/sonarcloud.yml

@@ -1,50 +0,0 @@
-name: SonarCloud
-
-on:
-  push:
-    branches: [ "bind-9.16", "bind-9.18", "main" ]
-  schedule:
-    - cron: '39 8 * * 3'
-
-jobs:
-  build:
-    name: Build and analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'cpp' ]
-
-    env:
-      BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    - name: Install build dependencies
-      uses: awalsh128/cache-apt-pkgs-action@latest
-      with:
-        packages: liburcu-dev libuv1-dev libssl-dev libnghttp2-dev libxml2-dev liblmdb-dev libjson-c-dev pkg-config autoconf automake autotools-dev libtool-bin libjemalloc-dev libedit-dev libcap-dev libidn2-dev libkrb5-dev libmaxminddb-dev zlib1g-dev python3-ply
-        version: 1.0
-
-    - name: Install sonar-scanner and build-wrapper
-      uses: SonarSource/sonarcloud-github-c-cpp@v1
-
-    - name: Run build-wrapper
-      run: |
-        autoreconf -fi
-        ./configure
-        build-wrapper-linux-x86-64 --out-dir ${{ env.BUILD_WRAPPER_OUT_DIR }} make clean all
-
-    - name: Run sonar-scanner
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-      run: |
-        sonar-scanner --define sonar.cfamily.build-wrapper-output="${{ env.BUILD_WRAPPER_OUT_DIR }}"

.gitignore

@@ -5,7 +5,6 @@
 *.la
 *.lo
 *.log
-*.log.txt
 *.o
 *.orig
 *.plist/ # ccc-analyzer store its results in .plist directories

.gitlab/issue_templates/Bug.md

@@ -1,63 +1,46 @@
 <!--
 If the bug you are reporting is potentially security-related - for example,
 if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please make sure that you make the new issue
-confidential by clicking the checkbox at the bottom!
+triggered repeatedly - then please do *NOT* report it here, but send an
+email to [security-officer@isc.org](security-officer@isc.org).
 -->
 
 ### Summary
 
-<!-- Concisely summarize the bug encountered. -->
+(Summarize the bug encountered concisely.)
 
-### BIND version affected
-<!--
-Make sure you are testing with the **latest** supported version of BIND
-for a given branch. Many bugs have been fixed over time!
+### BIND version used
 
-See https://kb.isc.org/docs/supported-platforms for the current list.
-The latest source is available from https://www.isc.org/download/#BIND
-
-Paste the output of `named -V` here.
--->
+(Paste the output of `named -V`.)
 
 ### Steps to reproduce
 
-<!--
-This is extremely important! Be precise and use itemized lists, please.
-
-Even if a default configuration is affected, please include the full configuration
-files _you were testing with_.
-
-Example:
-1. Use _attached_ configuration file
-2. Start BIND server with command: `named -g -c named.conf ...`
-3. Simulate legitimate clients using command `dnsperf -S1 -d legit-queries ...`
-4. Simulate attack traffic using command `dnsperf -S1 -d attack-queries ...`
--->
-
-1.
-2.
-3.
+(How one can reproduce the issue - this is very important.)
 
 ### What is the current *bug* behavior?
 
-<!-- What actually happens. -->
+(What actually happens.)
 
 ### What is the expected *correct* behavior?
 
-<!-- What you should see instead. -->
+(What you should see instead.)
 
 ### Relevant configuration files
 
-<!-- Paste any relevant configuration files here - please use code blocks (```)
+(Paste any relevant configuration files - please use code blocks (```)
 to format console output. If submitting the contents of your
-configuration file in a non-confidential issue, it is advisable to
-obscure key secrets; this can be done automatically by using
-`named-checkconf -px`. -->
+configuration file in a non-confidential Issue, it is advisable to
+obscure key secrets: this can be done automatically by using
+`named-checkconf -px`.)
 
-### Relevant logs
+### Relevant logs and/or screenshots
 
-<!-- Paste any relevant logs here - please use code blocks (```) to format console
-output, logs, and code, as it's very hard to read otherwise. -->
+(Paste any relevant logs - please use code blocks (```) to format console
+output, logs, and code, as it's very hard to read otherwise.)
 
-/label ~Bug
+### Possible fixes
+
+(If you can, link to the line of code that might be responsible for the
+problem.)
+
+/label ~bug

.gitlab/issue_templates/CVE.md

@@ -0,0 +1,37 @@
+<!--
+THIS ISSUE TEMPLATE IS INTENDED ONLY FOR INTERNAL USE.
+
+If the bug you are reporting is potentially security-related - for example,
+if it involves an assertion failure or other crash in `named` that can be
+triggered repeatedly - then please do *NOT* report it here, but send an
+email to [security-officer@isc.org](security-officer@isc.org).
+-->
+
+### CVE-specific actions
+
+  - [ ] Assign a CVE identifier
+  - [ ] Determine CVSS score
+  - [ ] Determine the range of BIND versions affected (including the Subscription Edition)
+  - [ ] Determine whether workarounds for the problem exists
+  - [ ] Create a draft of the security advisory and put the information above in there
+  - [ ] Prepare a detailed description of the problem which should include the following by default:
+      - instructions for reproducing the problem (a system test is good enough)
+      - explanation of code flow which triggers the problem (a system test is *not* good enough)
+  - [ ] Prepare a private merge request containing the following items in separate commits:
+      - a test for the issue (may be moved to a separate merge request for deferred merging)
+      - a fix for the issue
+      - documentation updates (`CHANGES`, release notes, anything else applicable)
+  - [ ] Ensure the merge request from the previous step is reviewed by SWENG staff and has no outstanding discussions
+  - [ ] Ensure the documentation changes introduced by the merge request addressing the problem are reviewed by Support and Marketing staff
+  - [ ] Prepare backports of the merge request addressing the problem for all affected (and still maintained) BIND branches (backporting might affect the issue's scope and/or description)
+  - [ ] Prepare a standalone patch for the last stable release of each affected (and still maintained) BIND branch
+
+### Release-specific actions
+
+  - [ ] Create/update the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
+  - [ ] Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
+  - [ ] Ensure the merge requests containing CVE fixes are merged into `security-*` branches in CVE identifier order
+
+### Post-disclosure actions
+
+  - [ ] Merge a regression test reproducing the bug into all affected (and still maintained) BIND branches

.gitlab/issue_templates/Default.md

@@ -1,8 +0,0 @@
-Hi and thanks for filing an issue! It will be read with care by human beings.
-
-It would be a tremendous help if you could follow these steps first:
-- [ ] Search the existing issues in GitLab (both open and closed) to see if your report might be a duplicate. We have a large database here and many issues have already been fixed in the latest versions!
-- [ ] Make sure this is **not** a support question. If you have specific trouble configuring or debugging your setup, please use the bind-users mailing list: https://lists.isc.org/mailman/listinfo/bind-users
-- [ ] You have read and understood the "out in the open" support policy: https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open/ . Even though it was written by the PowerDNS folks, we follow it as well!
-
-Before continuing, **please select the appropriate issue template in the drop-down menu above, under the heading _Description_**.

.gitlab/issue_templates/Feature_Request.md

@@ -8,4 +8,4 @@
 
 ### Links / references
 
-/label ~Feature
+/label ~"feature request"

.gitlab/issue_templates/Internal_use_only-CVE.md

@@ -1,123 +0,0 @@
-<!--
-THIS ISSUE TEMPLATE IS INTENDED ONLY FOR INTERNAL USE.
-
-If the bug you are reporting is potentially security-related - for example,
-if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please make sure that you make the new issue
-confidential!
--->
-| Quick Links              | :link:                               |
-| ------------------------ | ------------------------------------ |
-| Incident Manager:        | @user                                |
-| Deputy Incident Manager: | @user                                |
-| Public Disclosure Date:  | YYYY-MM-DD                           |
-| CVSS Score:              | [0.0][cvss_score]                    |
-| Security Advisory:       | isc-private/printing-press!NNN       |
-| Mattermost Channel:      | [CVE-YYYY-NNNN][mattermost_url]      |
-| Support Ticket:          | [URL]                                |
-| Release Checklist:       | #NNNN                                |
-
-[cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
-[mattermost_url]:
-
-:bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
-
-[checklist_explanations]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations
-
-### Earlier Than T-5
-
-  - [ ] [:link:][step_deputy]            **(IM)** Pick a Deputy Incident Manager
-  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
-  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
-  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
-  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
-  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
-  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
-  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text and hand it off to Marketing
-  - [ ] [:link:][step_earliest_send]     **(Marketing)** Update "earliest" notification document in SF portal and send bulk email to earliest customers
-  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
-  - [ ] [:link:][step_reproducer_mr]     **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
-  - [ ] [:link:][step_notify_support]    **(SwEng)** Notify Support when a reproducer is ready
-  - [ ] [:link:][step_code_analysis]     **(SwEng)** Prepare a detailed explanation of the code flow triggering the problem
-  - [ ] [:link:][step_fix_mr]            **(SwEng)** Prepare a private merge request with the fix
-  - [ ] [:link:][step_review_fix]        **(SwEng)** Ensure the merge request with the fix is reviewed and has no outstanding discussions
-  - [ ] [:link:][step_review_docs]       **(Support)** Review the documentation changes introduced by the merge request with the fix
-  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
-  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
-  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] [:link:][step_changes]           **(QA)** (BIND 9 only) Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
-  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
-  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
-  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)
-
-### At T-5
-
-  - [ ] [:link:][step_asn_documents]     **(Marketing)** Update the text on the T-5 (from the Printing Press project) and "earliest" ASN documents in the SF portal
-  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in SF with download links to the new versions
-  - [ ] [:link:][step_asn_send]          **(Marketing)** Bulk email eligible customers to check the SF portal
-  - [ ] [:link:][step_preannouncement]   **(Marketing)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes
-
-### At T-1
-
-  - [ ] [:link:][step_packager_emails]   **(First IM)** Send notifications to OS packagers
-
-### On the Day of Public Disclosure
-
-  - [ ] [:link:][step_clearance]         **(IM)** Grant QA & Marketing clearance to proceed with public release
-  - [ ] [:link:][step_publish]           **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
-  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
-  - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
-  - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
-  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
-  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
-  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
-  - [ ] [:link:][step_asn_clear]         **(Marketing)** Update the SF portal to clear the ASN
-  - [ ] [:link:][step_customers]         **(Marketing)** Email ASN recipients that the embargo is lifted
-
-### After Public Disclosure
-
-  - [ ] [:link:][step_regression]        **(QA)** Merge a regression test reproducing the bug into all affected (and still maintained) branches
-
-[step_deputy]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
-[step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
-[step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
-[step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
-[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
-[step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
-[step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
-[step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
-[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text-and-hand-it-off-to-marketing
-[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-document-in-sf-portal-and-send-bulk-email-to-earliest-customers
-[step_advisory_mr]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
-[step_reproducer_mr]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
-[step_notify_support]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
-[step_code_analysis]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-detailed-explanation-of-the-code-flow-triggering-the-problem
-[step_fix_mr]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-with-the-fix
-[step_review_fix]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-the-merge-request-with-the-fix-is-reviewed-and-has-no-outstanding-discussions
-[step_review_docs]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#review-the-documentation-changes-introduced-by-the-merge-request-with-the-fix
-[step_backports]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-backports-of-the-merge-request-addressing-the-problem-for-all-affected-and-still-maintained-branches-of-a-given-product
-[step_finish_advisory]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#finish-preparing-the-security-advisory
-[step_meta_issue]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-or-update-the-private-issue-containing-links-to-fixes-reproducers-for-all-cves-fixed-in-a-given-release-cycle
-[step_changes]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-reserve-a-block-of-changes-placeholders-once-the-complete-set-of-vulnerabilities-fixed-in-a-given-release-cycle-is-determined
-[step_merge_fixes]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
-[step_patches]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
-[step_asn_releases]:      https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
-[step_asn_documents]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-text-on-the-t-5-from-the-printing-press-project-and-earliest-asn-documents-in-the-sf-portal
-[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-sf-with-download-links-to-the-new-versions
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bulk-email-eligible-customers-to-check-the-sf-portal
-[step_preannouncement]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
-[step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
-[step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
-[step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
-[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
-[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
-[step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
-[step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
-[step_merge_advisory]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
-[step_embargo_end]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
-[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-sf-portal-to-clear-the-asn
-[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#email-asn-recipients-that-the-embargo-is-lifted
-[step_regression]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches
-
-/confidential

.gitlab/issue_templates/Release.md

@@ -30,72 +30,63 @@
 
 ### Before the Code Freeze
 
- - [ ] ***(QA)*** Rebase -S editions on top of current open-source versions: `git checkout bind-9.18-sub && git rebase origin/bind-9.18`
- - [ ] ***(QA)*** [Inform](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/inform_supp_marketing.py) Support and Marketing of impending release (and give estimated release dates).
- - [ ] ***(QA)*** Ensure there are no permanent test failures on any platform. Check [public](https://gitlab.isc.org/isc-projects/bind9/-/pipelines?scope=all&source=schedule) and [private](https://gitlab.isc.org/isc-private/bind9/-/pipelines?scope=all&source=schedule) scheduled pipelines.
- - [ ] ***(QA)*** Check charts from `shotgun:*` jobs in the scheduled pipelines to verify there is no unexplained performance drop for any protocol.
- - [ ] ***(QA)*** Check [Perflab](https://perflab.isc.org/) to ensure there has been no unexplained drop in performance for the versions being released.
+ - [ ] ***(QA)*** Inform Support and Marketing of impending release (and give estimated release dates).
+ - [ ] ***(QA)*** Ensure there are no permanent test failures on any platform.
+ - [ ] ***(QA)*** Check Perflab to ensure there has been no unexplained drop in performance for the versions being released.
  - [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
- - [ ] ***(QA)*** Ensure that there are no outstanding [merge requests in the private repository](https://gitlab.isc.org/isc-private/bind9/-/merge_requests/)[^1] (Subscription Edition only).
- - [ ] ***(QA)*** [Ensure](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/check_backports.py) all merge requests marked for backporting have been indeed backported.
- - [ ] ***(QA)*** [Announce](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/inform_code_freeze.py) (on Mattermost) that the code freeze is in effect.
+ - [ ] ***(QA)*** Ensure that there are no outstanding merge requests in the private repository[^1] (Subscription Edition only).
+ - [ ] ***(QA)*** Ensure all merge requests marked for backporting have been indeed backported.
+ - [ ] ***(QA)*** Update GitLab settings for all maintained branches to disallow merging to them.
+ - [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is in effect.
 
 ### Before the Tagging Deadline
 
- - [ ] ***(QA)*** Inspect the current output of the `cross-version-config-tests` job to verify that no unexpected backward-incompatible change was introduced in the current release cycle.
- - [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well. [Example](https://gitlab.isc.org/isc-private/bind9/-/merge_requests/510)
- - [ ] ***(QA)*** Add a release marker to `CHANGES`. Examples: [9.18](https://gitlab.isc.org/isc-projects/bind9/-/commit/f14d8ad78c0506fd4247187f2177f8eceeb6b3b9), [9.16](https://gitlab.isc.org/isc-projects/bind9/-/commit/1bcdf21874f99a00da389d723e0ad07dfd70f9f1)
- - [ ] ***(QA)*** Add a release marker to `CHANGES.SE` (Subscription Edition only). [Example](https://gitlab.isc.org/isc-private/bind9/-/commit/0f03d5737bcbdaa1bf713c6db1887b14938c3421)
- - [ ] ***(QA)*** Update BIND 9 version in `configure.ac` ([9.18+](https://gitlab.isc.org/isc-projects/bind9/-/commit/3c85ab7f4c35e6d8acef1393606002a0a8730100)) or `version` ([9.16](https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7692/diffs?commit_id=1bcdf21874f99a00da389d723e0ad07dfd70f9f1)).
+ - [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well.
+ - [ ] ***(QA)*** Add a release marker to `CHANGES`.
+ - [ ] ***(QA)*** Add a release marker to `CHANGES.SE` (Subscription Edition only).
+ - [ ] ***(QA)*** Update BIND 9 version in `configure.ac` (9.18+) or `version` (9.16).
  - [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org` (9.16).
- - [ ] ***(QA)*** Update GitLab settings for all maintained branches to disallow merging to them: [public](https://gitlab.isc.org/isc-projects/bind9/-/settings/repository), [private](https://gitlab.isc.org/isc-private/bind9/-/settings/repository)
- - [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9.x.y`).
+ - [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9_x_y`).
 
 ### Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
 
- - [ ] ***(QA)*** Check that the formatting is correct for the HTML version of release notes.
+ - [ ] ***(QA)*** Check that the formatting is correct for HTML and PDF versions of release notes.
  - [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
- - [ ] ***(QA)*** Verify GitLab CI results [for the tags](https://gitlab.isc.org/isc-private/bind9/-/pipelines?scope=tags) created and sign off on the releases to be published.
- - [ ] ***(QA)*** Update GitLab settings for all maintained branches to allow merging to them again: [public](https://gitlab.isc.org/isc-projects/bind9/-/settings/repository), [private](https://gitlab.isc.org/isc-private/bind9/-/settings/repository)
- - [ ] ***(QA)*** Prepare (using [`version_bump.py`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/version_bump.py)) and merge MRs resetting the release notes and updating the version string for each maintained branch.
- - [ ] ***(QA)*** Rebase the Subscription Edition branches (including recent release prep commits) on top of the open source branches with updated version strings.
+ - [ ] ***(QA)*** Verify GitLab CI results for the tags created and prepare a QA report for the releases to be published.
+ - [ ] ***(QA)*** Update GitLab settings for all maintained branches to allow merging to them again.
+ - [ ] ***(QA)*** Prepare and merge MRs resetting the release notes and updating the version string for each maintained branch.
  - [ ] ***(QA)*** Announce (on Mattermost) that the code freeze is over.
- - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums. Ask [signers on Mattermost](https://mattermost.isc.org/isc/channels/bind-9-qa).
- - [ ] ***(Signers)*** Ensure that the contents of tarballs and tags are identical.
+ - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums.
  - [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
- - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again: Run `publish_bind.sh` on repo.isc.org to pre-publish.
- - [ ] ***(QA)*** Prepare the `patches/` subdirectory for each security release (if applicable).
- - [ ] ***(QA)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
- - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages (in [cloudsmith branch in private repo](https://gitlab.isc.org/isc-private/rpms/bind/-/tree/cloudsmith)). [Example](https://gitlab.isc.org/isc-private/rpms/bind/-/commit/e2512f4cfaf991827a635e374e7e93b27a5f38ba)
- - [ ] ***(Marketing)*** Prepare and send out ASN emails (as outlined in the CVE checklist; if applicable).
+ - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again.
+ - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
+ - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages.
+ - [ ] ***(QA)*** Notify Support that the releases have been prepared.
+ - [ ] ***(Support)*** Send out ASNs (if applicable).
 
 ### On the Day of Public Release
 
- - [ ] ***(QA)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
- - [ ] ***(QA)*** Place tarballs in public location on FTP site.
- - [ ] ***(QA)*** Inform Marketing of the release, providing FTP links for the published tarballs.
- - [ ] ***(QA)*** Use the [Printing Press project](https://gitlab.isc.org/isc-private/printing-press/-/wikis/home#adding-new-documents) to prepare a release announcement email.
- - [ ] ***(Marketing)*** Publish links to downloads on ISC website. [Example](https://gitlab.isc.org/website/theme-staging-site/-/commit/1ac7b30b73cb03228df4cd5651fa4e774ac35625)
- - [ ] ***(Marketing)*** Update the BIND -S information document in SF with download links to the new versions. (If this is a security release, this will have already been done as part of the ASN process.)
- - [ ] ***(Marketing)*** Update the Current Software Versions document in the SF portal if any stable versions were released.
- - [ ] ***(Marketing)*** Send the release announcement email to the *bind-announce* mailing list (and to *bind-users* if a major release - [example](https://lists.isc.org/pipermail/bind-users/2022-January/105624.html)).
- - [ ] ***(Marketing)*** Announce release on social media sites.
- - [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
- - [ ] ***(Support)*** Add the new releases to the [vulnerability matrix in the Knowledge Base](https://kb.isc.org/docs/aa-00913).
+ - [ ] ***(Support)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
+ - [ ] ***(Support)*** Place tarballs in public location on FTP site.
+ - [ ] ***(Support)*** Publish links to downloads on ISC website.
+ - [ ] ***(Support)*** Write release email to *bind-announce*.
+ - [ ] ***(Support)*** Write email to *bind-users* (if a major release).
+ - [ ] ***(Support)*** Send eligible customers updated links to the Subscription Edition (update the -S edition delivery tickets, even if those links were provided earlier via an ASN ticket).
  - [ ] ***(Support)*** Update tickets in case of waiting support customers.
- - [ ] ***(QA)*** Build and test any outstanding private packages in [private repo](https://gitlab.isc.org/isc-private/rpms/bind/-/tree/cloudsmith). [Example](https://gitlab.isc.org/isc-private/rpms/bind/-/commit/2007d566db81dd9dfd79e571e2f600a3bc284da4)
- - [ ] ***(QA)*** Build [public RPMs](https://gitlab.isc.org/isc-packages/rpms/bind). [Example commit](https://gitlab.isc.org/isc-packages/rpms/bind/-/commit/3b5e851ea7c4e3570371a4878b5461f02a44f8cc) which triggers [Copr builds](https://copr.fedorainfracloud.org/coprs/isc/) automatically
+ - [ ] ***(QA)*** Build and test any outstanding private packages.
+ - [ ] ***(QA)*** Build public RPMs.
  - [ ] ***(SwEng)*** Build Debian/Ubuntu packages.
- - [ ] ***(SwEng)*** Update Docker files [here](https://gitlab.isc.org/isc-projects/bind9-docker/-/branches) and make sure push is synchronized to [GitHub](https://github.com/isc-projects/bind9-docker). [Docker Hub](https://hub.docker.com/r/internetsystemsconsortium/bind9) should pick it up automatically. [Example](https://gitlab.isc.org/isc-projects/bind9-docker/-/commit/cada7e10e9af951595c98bfffc4bd42512faac05)
- - [ ] ***(QA)*** Ensure all new tags are annotated and signed. `git show --show-signature v9.19.12`
+ - [ ] ***(SwEng)*** Update Docker images.
+ - [ ] ***(QA)*** Inform Marketing of the release.
+ - [ ] ***(Marketing)*** Post short note to Twitter.
+ - [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
+ - [ ] ***(Marketing)*** Write blog article (if a major release).
+ - [ ] ***(QA)*** Ensure all new tags are annotated and signed.
  - [ ] ***(QA)*** Push tags for the published releases to the public repository.
- - [ ] ***(QA)*** Using [`merge_tag.py`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/merge_tag.py), merge published release tags back into the their relevant development/maintenance branches.
- - [ ] ***(QA)*** Ensure `allow_failure: true` is removed from the `cross-version-config-tests` job if it was set during the current release cycle.
+ - [ ] ***(QA)*** Merge published release tags (non-linearly) back into the their relevant development/maintenance branches.
  - [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
- - [ ] ***(QA)*** Sanitize [confidential issues](https://gitlab.isc.org/isc-projects/bind9/-/issues/?sort=milestone_due_desc&state=opened&confidential=yes) which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
- - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Black, PyLint, Sphinx) by modifying the relevant [`Dockerfile`](https://gitlab.isc.org/isc-projects/images/-/merge_requests/228/diffs).
- - [ ] ***(QA)*** Run a pipeline to rebuild all [images](https://gitlab.isc.org/isc-projects/images) used in GitLab CI.
- - [ ] ***(QA)*** Update [`metadata.json`](https://gitlab.isc.org/isc-private/bind-qa/-/blob/master/bind9/releng/metadata.json) with the upcoming release information.
+ - [ ] ***(QA)*** Sanitize confidential issues which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
+ - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.
 
 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
 [^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.

.gitlab/issue_templates/Security_issue.md

@@ -1,139 +0,0 @@
-### Summary
-<!--
-Concisely summarize the bug encountered,
-preferably in one paragraph or less.
--->
-
-### BIND versions affected
-<!--
-Make sure you are testing with the **latest** supported version of BIND.
-See https://kb.isc.org/docs/supported-platforms for the current list.
-The latest source is available from https://www.isc.org/download/#BIND
-
-Paste the output of `named -V` here.
--->
-
-### Preconditions and assumptions
-<!--
-Is a specific setup needed?
-
-Please check the BIND Security Assumptions chapter in the ARM:
-https://bind9.readthedocs.io/en/latest/chapter7.html#security-assumptions
-
-E.g. DNSSEC validation must be disabled, etc.
-E.g. Resolver must be configured to forward to attacker's server via DNS-over-TLS, etc.
-E.g. Authoritative server must be configured to transfer specific primary zone.
-E.g. Attacker must be in posession of a key authorized to modify at least one zone.
-E.g. Attacker can affect system clock on the server running BIND.
--->
-
-### Attacker's abilities
-<!--
-What resources does an attacker need to have under their control to mount this attack?
-
-E.g. If attacking an authoritative server, does the attacked have to have prior
-relationship with it? "The authoritative server under attack needs to
-transfer a malicious zone from attacker's authoritative server via TLS."
-
-E.g. If attacking a resolver, does the attacker need the ability to send
-arbitrary queries to the resolver under attack? Do they need to _also_ control
-an authoritative server at the same time?
--->
-
-
-### Impact
-<!--
-Who or what is the victim of the attack and what is the impact?
-
-Is a third party receiving many packets generated by a reflection attack?
-
-If the affected party is the BIND server itself, please quantify the impact
-on legitimate clients:
-E.g. After launching the attack, the answers-per-second metric for legitimate
-traffic drops to 1/1000 within the first minute of the attack.
--->
-
-
-### Steps to reproduce
-<!--
-This is extremely important! Be precise and use itemized lists, please.
-
-Even if a default configuration is affected, please include the full configuration
-files _you were testing with_.
-
-Example:
-1. Use the _attached_ configuration file
-2. Start the BIND server with command: `named -g -c named.conf ...`
-3. Simulate legitimate clients using the command `dnsperf -S1 -d legit-queries ...`
-4. Simulate attack traffic using the command `dnsperf -S1 -d attack-queries ...`
--->
-
-1.
-2.
-3.
-
-### What is the current *bug* behavior?
-
-<!--
-Examples:
-Legitimate QPS drops 1000x.
-Memory consumption increases out of bounds and the server crashes.
-The server crashes immediately.
--->
-
-### What is the expected *correct* behavior?
-
-<!--
-If the attack causes resource exhaustion, what do you think the correct
-behavior should be? Should BIND refuse to process more requests?
-
-What heuristic do you propose to distinguish legitimate and attack traffic?
--->
-
-### Relevant logs
-<!--
-Please provide log files from your testing. Include full named logs and also
-the output from any testing tools (e.g. dnsperf, DNS Shotgun, kxdpgun, etc.)
-
-If multiple log files are needed, make sure all the files have matching timestamps
-so we can correlate log events across log files.
-
-In the case of resource exhaustion attacks, please _also_ include system monitoring
-data. You can use https://gitlab.isc.org/isc-projects/resource-monitor/ to
-gather system-wide statistics.
--->
-
-### Coordination
-- Does this issue affect multiple implementations?
-<!--
-Issues affecting multiple implementations require very careful coordination. We
-have to make sure the information does not leak to the public until vendors are ready to
-release fixed versions. If it is a multi-vendor issue, we need to know about the situation
-as soon as possible to start the (confidential!) coordination process within
-DNS-OARC and other suitable fora.
-
-Please list implementations you have tested.
--->
-
-- Have you shared the information with anyone else?
-<!--
-Have you informed other affected vendors? Or maybe submitted a paper for
-review?
--->
-
-- What is your plan to publicize this issue?
-<!--
-E.g. we plan to go public during conference XYZ on 20XX-XX-XX
--->
-
-### Acknowledgements
-<!--
-Please specify whether and how you would like to be publicly credited with
-discovering the issue. We normally use the format:
-First_name Last_name, Company_or_Team.
--->
-
-<!-- DO NOT modify the following two lines. -->
-
-/label ~Bug ~Security
-/confidential

.lgtm.yml

@@ -0,0 +1,35 @@
+extraction:
+  cpp:
+    prepare:
+      packages:
+      - "libxml2-dev"
+      - "libjson-c-dev"
+      - "libssl-dev"
+      - "zlib1g-dev"
+      - "libcmocka-dev"
+      - "pkg-config"
+      - "libcap2-dev"
+      - "libedit-dev"
+      - "libidn2-dev"
+      - "libmaxminddb-dev"
+      - "libuv1-dev"
+      - "libnghttp2-dev"
+    configure:
+      command:
+      - "autoreconf -fi"
+      - "CFLAGS=\"-Og -g\" ./configure --enable-developer"
+path_classifiers:
+  test:
+    - "lib/*/tests/"
+    - "bin/tests/"
+  docs:
+    - "**/*.xml"
+    - "**/*.docbook"
+    - "**/*.html"
+    - "**/*.1"
+    - "**/*.5"
+    - "**/*.8"
+queries:
+  - exclude: fuzz/
+  - exclude: "bin/tests/system/*/ans*/*.py"
+  - exclude: cpp/use-of-goto

.pylintrc

@@ -7,4 +7,3 @@ disable=
     C0209, # consider-using-f-string
     C0415, # import-outside-toplevel
     R0801, # duplicate-code
-    R0903, # too-few-public-methods

.readthedocs.yaml

@@ -1,20 +0,0 @@
-# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
-
-version: 2
-
-build:
-  os: ubuntu-22.04
-  tools:
-    python: "3.11"
-
-# Build documentation in doc/arm/ with Sphinx
-sphinx:
-  configuration: doc/arm/conf.py
-
-# Build all formats
-formats: all
-
-# Explicitly set the version of Python and its requirements
-python:
-   install:
-   - requirements: doc/arm/requirements.txt

.reuse/dep5

@@ -42,11 +42,6 @@ Files: **/*.after*
        bin/tests/system/formerr/nametoolong
        bin/tests/system/formerr/noquestions
        bin/tests/system/formerr/twoquestions
-       bin/tests/system/forward/CA/CA.cfg
-       bin/tests/system/forward/CA/README
-       bin/tests/system/forward/CA/index.txt
-       bin/tests/system/forward/CA/index.txt.attr
-       bin/tests/system/forward/CA/serial
        bin/tests/system/journal/ns1/managed-keys.bind.in
        bin/tests/system/journal/ns1/managed-keys.bind.jnl.in
        bin/tests/system/journal/ns2/managed-keys.bind.in
@@ -54,14 +49,6 @@ Files: **/*.after*
        bin/tests/system/keepalive/expected
        bin/tests/system/legacy/ns6/edns512.db.signed
        bin/tests/system/legacy/ns7/edns512-notcp.db.signed
-       bin/tests/system/masterfile/knowngood.include
-       bin/tests/system/masterfile/knowngood.ttl1
-       bin/tests/system/masterfile/knowngood.ttl2
-       bin/tests/system/nsupdate/CA/CA.cfg
-       bin/tests/system/nsupdate/CA/README
-       bin/tests/system/nsupdate/CA/index.txt
-       bin/tests/system/nsupdate/CA/index.txt.attr
-       bin/tests/system/nsupdate/CA/serial
        bin/tests/system/nsupdate/commandlist
        bin/tests/system/nsupdate/verylarge.in
        bin/tests/system/org.isc.bind.system.plist
@@ -84,10 +71,7 @@ Files: **/*.after*
        bin/tests/system/unknown/large.out
        bin/tests/system/xfer/ans5/badkeydata
        bin/tests/system/xfer/ans5/badmessageid
-       bin/tests/system/xfer/ans5/ednsformerr
-       bin/tests/system/xfer/ans5/ednsnotimp
        bin/tests/system/xfer/ans5/goodaxfr
-       bin/tests/system/xfer/ans5/ixfrnotimp
        bin/tests/system/xfer/ans5/partial
        bin/tests/system/xfer/ans5/soamismatch
        bin/tests/system/xfer/ans5/unknownkey
@@ -163,21 +147,16 @@ Files: **/.clang-format
        .clang-format
        .clang-format.headers
        .dir-locals.el
-       .editorconfig
-       .git-blame-ignore-revs
        .gitattributes
        .gitignore
        .gitlab-ci.yml
        .lgtm.yml
        .pylintrc
-       .readthedocs.yaml
-       .tsan-suppress
        .uncrustify.cfg
        doc/misc/*.zoneopt
        doc/misc/options
-       doc/misc/rndc.grammar
-       sonar-project.properties
-       tests/bench/names.csv
+       doc/misc/options.active
+       tsan-suppressions.txt
 Copyright: Internet Systems Consortium, Inc. ("ISC")
 License: CC0-1.0
 

.tsan-suppress

@@ -1,3 +0,0 @@
-# Uninstrumented libraries
-called_from_lib:libfstrm.so
-race:dummyrpz

AUTHORS

@@ -51,4 +51,3 @@ Anay Panvalkar
 colleen
 Robert Edmonds
 João Damas
-Artem Boldariev (Артем Болдарєв)

CONTRIBUTING.md

@@ -71,14 +71,14 @@ To clone the repository, use:
 
 >       $ git clone https://gitlab.isc.org/isc-projects/bind9.git
 
-Release branch names are of the form `bind-9.X`, where X represents the second
-number in the BIND 9 version number.  So, to check out the BIND 9.18
+Release branch names are of the form `v9_X`, where X represents the second
+number in the BIND 9 version number.  So, to check out the BIND 9.12
 branch, use:
 
->       $ git checkout bind-9.18
+>       $ git checkout v9_12
 
 Whenever a branch is ready for publication, a tag is placed of the
-form `v9.X.Y`.  The 9.18.0 release, for instance, is tagged as `v9.18.0`.
+form `v9_X_Y`.  The 9.12.0 release, for instance, is tagged as `v9_12_0`.
 
 The branch in which the next major release is being developed is called
 `main`.
@@ -102,7 +102,22 @@ Twitter, or Facebook.
 
 ### Reporting possible security issues
 
-See `SECURITY.md`.
+If you think you may be seeing a potential security vulnerability in BIND
+(for example, a crash with REQUIRE, INSIST, or ASSERT failure), please
+report it immediately by emailing to security-officer@isc.org. Plain-text
+e-mail is not a secure choice for communications concerning undisclosed
+security issues so please encrypt your communications to us if possible,
+using the [ISC Security Officer public key](https://www.isc.org/pgpkey/).
+
+Do not discuss undisclosed security vulnerabilities on any public mailing list.
+ISC has a long history of handling reported vulnerabilities promptly and
+effectively and we respect and acknowledge responsible reporters.
+
+ISC's Security Vulnerability Disclosure Policy is documented at
+[https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
+
+If you have a crash, you may want to consult
+["What to do if your BIND or DHCP server has crashed."](https://kb.isc.org/docs/aa-00340)
 
 ### <a name="contrib"></a>Contributing code
 
@@ -173,7 +188,7 @@ of documentation in the BIND source tree:
   they document, in files ending in `.rst`: for example, the
   `named` man page is `bin/named/named.rst`.
 * The *BIND 9 Administrator Reference Manual* is in the .rst files in
-  `doc/arm/`; the HTML version is automatically generated from
+  `doc/arm/`; the PDF and HTML versions are automatically generated from
   the `.rst` files.
 * API documentation is in the header file describing the API, in
   Doxygen-formatted comments.

COPYRIGHT

@@ -1,4 +1,4 @@
-Copyright (C) 1996-2023  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2022  Internet Systems Consortium, Inc. ("ISC")
 
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -133,7 +133,7 @@ modification, are permitted provided that the following conditions are met:
 3. Neither the name of the University nor the names of its contributors may
    be used to endorse or promote products derived from this software
    without specific prior written permission.
-
+ 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -149,35 +149,35 @@ POSSIBILITY OF SUCH DAMAGE.
  -----------------------------------------------------------------------------
 
 Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
-(Royal Institute of Technology, Stockholm, Sweden).
-All rights reserved.
+(Royal Institute of Technology, Stockholm, Sweden). 
+All rights reserved. 
 
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
+Redistribution and use in source and binary forms, with or without 
+modification, are permitted provided that the following conditions 
+are met: 
 
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
+1. Redistributions of source code must retain the above copyright 
+   notice, this list of conditions and the following disclaimer. 
 
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
+2. Redistributions in binary form must reproduce the above copyright 
+   notice, this list of conditions and the following disclaimer in the 
+   documentation and/or other materials provided with the distribution. 
 
-3. Neither the name of the Institute nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
+3. Neither the name of the Institute nor the names of its contributors 
+   may be used to endorse or promote products derived from this software 
+   without specific prior written permission. 
 
-THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
+THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+SUCH DAMAGE. 
 
  -----------------------------------------------------------------------------
 

Makefile.am

@@ -1,25 +1,23 @@
 include $(top_srcdir)/Makefile.top
 
-SUBDIRS = . lib doc
+SUBDIRS = . lib doc bin fuzz
 
-# build libtest before fuzz/* and bin/tests
+if HAVE_CMOCKA
 SUBDIRS += tests
+endif HAVE_CMOCKA
 
-# run fuzz tests before system tests
-SUBDIRS += fuzz bin
-
-BUILT_SOURCES += bind.keys.h
-CLEANFILES += bind.keys.h
+BUILT_SOURCES = bind.keys.h
+CLEANFILES = bind.keys.h
 
 bind.keys.h: bind.keys Makefile
 	${PERL} ${top_srcdir}/util/bindkeys.pl ${top_srcdir}/bind.keys > $@
 
+dist_sysconf_DATA = bind.keys
+
 .PHONY: doc
 
 EXTRA_DIST =			\
-	bind.keys		\
 	util/bindkeys.pl	\
-	util/dtrace.sh		\
 	contrib			\
 	CHANGES			\
 	COPYRIGHT		\

Makefile.docs

@@ -2,7 +2,6 @@ SPHINX_V = $(SPHINX_V_@AM_V@)
 SPHINX_V_ = $(SPHINX_V_@AM_DEFAULT_V@)
 SPHINX_V_0 = -q
 SPHINX_V_1 = -n
-SPHINX_W = -W
 
 AM_V_SPHINX = $(AM_V_SPHINX_@AM_V@)
 AM_V_SPHINX_ = $(AM_V_SPHINX_@AM_DEFAULT_V@)
@@ -14,19 +13,23 @@ LF = \n
 RNDC_CONF = .. |rndc_conf| replace:: ``$(sysconfdir)/rndc.conf``
 RNDC_KEY = .. |rndc_key| replace:: ``$(sysconfdir)/rndc.key``
 NAMED_CONF = .. |named_conf| replace:: ``$(sysconfdir)/named.conf``
+BIND_KEYS = .. |bind_keys| replace:: ``$(sysconfdir)/bind.keys``
 NAMED_PID = .. |named_pid| replace:: ``$(runstatedir)/named.pid``
 SESSION_KEY = .. |session_key| replace:: ``$(runstatedir)/session.key``
 
 export RST_EPILOG = $(RNDC_CONF)$(LF)$(RNDC_KEY)$(LF)$(NAMED_CONF)$(LF)$(BIND_KEYS)$(LF)$(NAMED_PID)$(LF)$(SESSION_KEY)
 
 common_SPHINXOPTS =			\
-	$(SPHINX_W)			\
+	-W				\
 	-c $(srcdir)			\
 	-a				\
 	$(SPHINX_V)
 
+# The "today" variable set below is not directly used in the ARM, but its value
+# is implicitly inserted on the title page of the PDF file produced by Sphinx.
 ALLSPHINXOPTS =					\
 	$(common_SPHINXOPTS)			\
+	-D today="$(RELEASE_DATE)"		\
 	-D rst_epilog="$$(printf "$${RST_EPILOG}")"	\
 	$(SPHINXOPTS)				\
 	$(srcdir)
@@ -57,3 +60,15 @@ AM_V_SED_0 = @echo "  SED $@";
 AM_V_CFG_TEST = $(AM_V_CFG_TEST_@AM_V@)
 AM_V_CFG_TEST_ = $(AM_V_CFG_TEST_@AM_DEFAULT_V@)
 AM_V_CFG_TEST_0 = @echo "  CFG_GEN $@";
+
+AM_V_RST_OPTIONS = $(AM_V_CFG_TEST_@AM_V@)
+AM_V_RST_OPTIONS_ = $(AM_V_RST_OPTIONS_@AM_DEFAULT_V@)
+AM_V_RST_OPTIONS_0 = @echo "  RST_OPTIONS $@";
+
+AM_V_RST_ZONEOPT = $(AM_V_CFG_TEST_@AM_V@)
+AM_V_RST_ZONEOPT_ = $(AM_V_RST_ZONEOPT_@AM_DEFAULT_V@)
+AM_V_RST_ZONEOPT_0 = @echo "  RST_ZONEOPT $@";
+
+AM_V_RST_GRAMMARS = $(AM_V_CFG_TEST_@AM_V@)
+AM_V_RST_GRAMMARS_ = $(AM_V_RST_GRAMMARS_@AM_DEFAULT_V@)
+AM_V_RST_GRAMMARS_0 = @echo "  RST_GRAMMARS $@";

Makefile.dtrace

@@ -1,20 +0,0 @@
-# Hey Emacs, this is -*- makefile-automake -*- file!
-# vim: filetype=automake
-
-AM_V_DTRACE = $(AM_V_DTRACE_@AM_V@)
-AM_V_DTRACE_ = $(AM_V_DTRACE_@AM_DEFAULT_V@)
-AM_V_DTRACE_0 = @echo "  DTRACE   $@";
-
-BUILT_SOURCES += probes.h
-CLEANFILES += probes.h probes.o
-
-probes.h: Makefile probes.d
-	$(AM_V_DTRACE)$(DTRACE) -s $(srcdir)/probes.d -h -o $@
-probes.lo: Makefile probes.d $(DTRACE_DEPS)
-	$(AM_V_DTRACE)$(LIBTOOL) --mode=compile --tag=CC $(DTRACE) -s $(srcdir)/probes.d -G -o $@ $(DTRACE_OBJS)
-
-if HAVE_DTRACE
-if !HOST_MACOS
-DTRACE_LIBADD = probes.lo
-endif
-endif

Makefile.tests

@@ -21,8 +21,3 @@ AM_CPPFLAGS +=					\
 LDADD +=						\
 	$(top_builddir)/tests/libtest/libtest.la	\
 	$(CMOCKA_LIBS)
-
-if HAVE_JEMALLOC
-AM_CFLAGS += $(JEMALLOC_CFLAGS)
-LDADD += $(JEMALLOC_LIBS)
-endif

Makefile.top

@@ -15,31 +15,17 @@ AM_LDFLAGS =					\
 	$(STD_LDFLAGS)
 LDADD =
 
-BUILT_SOURCES =
-CLEANFILES =
-
 if HOST_MACOS
 AM_LDFLAGS +=					\
 	-Wl,-flat_namespace
 endif HOST_MACOS
 
-if HAVE_JEMALLOC
-LIBISC_CFLAGS = $(JEMALLOC_CFLAGS)
-LIBISC_LIBS = $(JEMALLOC_LIBS)
-else
-LIBISC_CFLAGS =
-LIBISC_LIBS =
-endif
-
-LIBISC_CFLAGS +=						\
+LIBISC_CFLAGS =						\
 	-I$(top_srcdir)/include				\
 	-I$(top_srcdir)/lib/isc/include			\
 	-I$(top_builddir)/lib/isc/include
 
-LIBISC_LIBS += $(top_builddir)/lib/isc/libisc.la
-if HAVE_DTRACE
-LIBISC_DTRACE = $(top_builddir)/lib/isc/probes.lo
-endif
+LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la
 
 LIBDNS_CFLAGS = \
 	-I$(top_srcdir)/lib/dns/include			\
@@ -47,18 +33,18 @@ LIBDNS_CFLAGS = \
 
 LIBDNS_LIBS = \
 	$(top_builddir)/lib/dns/libdns.la
-if HAVE_DTRACE
-LIBDNS_DTRACE = $(top_builddir)/lib/dns/probes.lo
-endif
 
 LIBNS_CFLAGS = \
 	-I$(top_srcdir)/lib/ns/include
 
 LIBNS_LIBS = \
 	$(top_builddir)/lib/ns/libns.la
-if HAVE_DTRACE
-LIBNS_DTRACE = $(top_builddir)/lib/ns/probes.lo
-endif
+
+LIBIRS_CFLAGS = \
+	-I$(top_srcdir)/lib/irs/include
+
+LIBIRS_LIBS = \
+	$(top_builddir)/lib/irs/libirs.la
 
 LIBISCCFG_CFLAGS = \
 	-I$(top_srcdir)/lib/isccfg/include
@@ -71,3 +57,9 @@ LIBISCCC_CFLAGS = \
 
 LIBISCCC_LIBS = \
 	$(top_builddir)/lib/isccc/libisccc.la
+
+LIBBIND9_CFLAGS = \
+	-I$(top_srcdir)/lib/bind9/include
+
+LIBBIND9_LIBS = \
+	$(top_builddir)/lib/bind9/libbind9.la

OPTIONS.md

@@ -26,4 +26,3 @@ Some of these settings are:
 | `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
 | `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
 | `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
-| `-DOPENSSL_API_COMPAT=10100` | Build using the deprecated OpenSSL APIs so that the `engine` API is available when building with OpenSSL 3.0.0 for PKCS#11 support     |

README.md

@@ -74,9 +74,17 @@ contents of your configuration file in a non-confidential issue, it is
 advisable to obscure key secrets; this can be done automatically by
 using `named-checkconf -px`.
 
-For information about ISC's Security Vulnerability Disclosure Policy and
-information about reporting potential security issues, please see
-`SECURITY.md`.
+If you are reporting a bug that is a potential security issue, such as an
+assertion failure or other crash in `named`, please do *NOT* use GitLab to
+report it. Instead, send mail to
+[security-officer@isc.org](mailto:security-officer@isc.org) using our
+OpenPGP key to secure your message. (Information about OpenPGP and links
+to our key can be found at
+[https://www.isc.org/pgpkey](https://www.isc.org/pgpkey).) Please do not
+discuss the bug on any public mailing list.
+
+For a general overview of ISC security policies, read the Knowledgebase
+article at [https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
 
 Professional support and training for BIND are available from
 ISC. Contact us at [https://www.isc.org/contact](https://www.isc.org/contact)
@@ -117,7 +125,7 @@ including your patch as an attachment, preferably generated by
 ### <a name="build"/> Building BIND 9
 
 For information about building BIND 9, see the
-["Building BIND 9"](doc/arm/build.inc.rst) section in the BIND 9
+["Building BIND 9"](doc/arm/build.rst) section in the BIND 9
 Administrator Reference Manual.
 
 ### <a name="testing"/> Automated testing
@@ -128,7 +136,7 @@ multiple servers to run locally and communicate with each other). These
 IP addresses can be configured by running the command
 `bin/tests/system/ifconfig.sh up` as root.
 
-Some tests require Perl and the `Net::DNS` and/or `IO::Socket::IP` modules,
+Some tests require Perl and the `Net::DNS` and/or `IO::Socket::INET6` modules,
 and are skipped if these are not available. Some tests require Python
 and the `dnspython` module and are skipped if these are not available.
 See bin/tests/system/README for further details.
@@ -141,18 +149,9 @@ parallel test driver; unit tests are also run by `make check`.
 
 The *BIND 9 Administrator Reference Manual* (ARM) is included with the source
 distribution, and in .rst format, in the `doc/arm`
-directory. The HTML version is automatically generated and can
+directory. HTML and PDF versions are automatically generated and can
 be viewed at [https://bind9.readthedocs.io/en/latest/index.html](https://bind9.readthedocs.io/en/latest/index.html).
 
-The PDF version can be built by running:
-
-    cd doc/arm/
-    sphinx-build -b latex . pdf/
-    make -C pdf/ all-pdf
-
-The above requires TeX Live in order to work. The PDF will be written to
-`doc/arm/pdf/Bv9ARM.pdf`.
-
 Man pages for some of the programs in the BIND 9 distribution
 are also included in the BIND ARM.
 

SECURITY.md

@@ -1,35 +0,0 @@
-<!--
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-SPDX-License-Identifier: MPL-2.0
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0.  If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
--->
-# Security Policy
-
-ISC's Security Vulnerability Disclosure Policy is documented in the
-relevant [ISC Knowledgebase article][1].
-
-## Reporting possible security issues
-
-If you think you may be seeing a potential security vulnerability in
-BIND (for example, a crash with a REQUIRE, INSIST, or ASSERT failure),
-please report it immediately by [opening a confidential GitLab issue][2]
-(preferred) or emailing bind-security@isc.org.
-
-Please do not discuss undisclosed security vulnerabilities on any public
-mailing list. ISC has a long history of handling reported
-vulnerabilities promptly and effectively and we respect and acknowledge
-responsible reporters.
-
-If you have a crash, you may want to consult the Knowledgebase article
-entitled ["What to do if your BIND or DHCP server has crashed"][3].
-
-[1]: https://kb.isc.org/docs/aa-00861
-[2]: https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue[confidential]=true&issuable_template=Bug
-[3]: https://kb.isc.org/docs/aa-00340

bin/check/Makefile.am

@@ -4,7 +4,8 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBNS_CFLAGS)		\
-	$(LIBISCCFG_CFLAGS)
+	$(LIBISCCFG_CFLAGS)	\
+	$(LIBBIND9_CFLAGS)
 
 AM_CPPFLAGS +=			\
 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
@@ -20,7 +21,8 @@ LDADD +=			\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBNS_LIBS)		\
-	$(LIBISCCFG_LIBS)
+	$(LIBISCCFG_LIBS)	\
+	$(LIBBIND9_LIBS)
 
 bin_PROGRAMS = named-checkconf named-checkzone
 

bin/check/check-tool.c

@@ -14,7 +14,6 @@
 /*! \file */
 
 #include <inttypes.h>
-#include <netdb.h>
 #include <stdbool.h>
 #include <stdio.h>
 
@@ -22,6 +21,8 @@
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/net.h>
+#include <isc/netdb.h>
+#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/stdio.h>
@@ -73,7 +74,7 @@
 #define ERR_IS_MXCNAME	   6
 #define ERR_IS_SRVCNAME	   7
 
-static const char *dbtype[] = { ZONEDB_DEFAULT };
+static const char *dbtype[] = { "rbt" };
 
 int debug = 0;
 const char *journal = NULL;
@@ -88,13 +89,12 @@ bool dochecksrv = false;
 bool docheckns = false;
 #endif /* if CHECK_LOCAL */
 dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
-			     DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF |
 			     DNS_ZONEOPT_MANYERRORS | DNS_ZONEOPT_CHECKNAMES |
 			     DNS_ZONEOPT_CHECKINTEGRITY |
 #if CHECK_SIBLING
 			     DNS_ZONEOPT_CHECKSIBLING |
 #endif /* if CHECK_SIBLING */
-			     DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
+			     DNS_ZONEOPT_CHECKWILDCARD |
 			     DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;
 
 /*
@@ -205,8 +205,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -408,8 +407,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -495,8 +493,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		 */
 		cur = ai;
 		while (cur != NULL && cur->ai_canonname == NULL &&
-		       cur->ai_next != NULL)
-		{
+		       cur->ai_next != NULL) {
 			cur = cur->ai_next;
 		}
 		if (cur != NULL && cur->ai_canonname != NULL &&
@@ -596,7 +593,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 			zonename, filename, classname);
 	}
 
-	dns_zone_create(&zone, mctx, 0);
+	CHECK(dns_zone_create(&zone, mctx, 0));
 
 	dns_zone_settype(zone, dns_zone_primary);
 
@@ -617,7 +614,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 		CHECK(dns_zone_setjournal(zone, journal));
 	}
 
-	region.base = UNCONST(classname);
+	DE_CONST(classname, region.base);
 	region.length = strlen(classname);
 	CHECK(dns_rdataclass_fromtext(&rdclass, &region));
 

bin/check/named-checkconf.c

@@ -24,6 +24,7 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -36,14 +37,17 @@
 #include <dns/rootns.h>
 #include <dns/zone.h>
 
-#include <isccfg/check.h>
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
 
+#include <bind9/check.h>
+
 #include "check-tool.h"
 
 static const char *program = "named-checkconf";
 
+static bool loadplugins = true;
+
 isc_log_t *logc = NULL;
 
 #define CHECK(r)                             \
@@ -60,10 +64,10 @@ usage(void);
 static void
 usage(void) {
 	fprintf(stderr,
-		"usage: %s [-achijlvz] [-p [-x]] [-t directory] "
+		"usage: %s [-chijlvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n",
 		program);
-	exit(EXIT_SUCCESS);
+	exit(1);
 }
 
 /*% directory callback */
@@ -155,7 +159,7 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 		return (ISC_R_FAILURE);
 	}
 
-	r.base = UNCONST(zclass);
+	DE_CONST(zclass, r.base);
 	r.length = strlen(zclass);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -242,9 +246,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	 * Skip checks when using an alternate data source.
 	 */
 	cfg_map_get(zoptions, "database", &dbobj);
-	if (dbobj != NULL &&
-	    strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
-	{
+	if (dbobj != NULL && strcmp("rbt", cfg_obj_asstring(dbobj)) != 0) {
 		return (ISC_R_SUCCESS);
 	}
 
@@ -399,28 +401,6 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		zone_options |= DNS_ZONEOPT_CHECKSPF;
 	}
 
-	obj = NULL;
-	if (get_maps(maps, "check-svcb", &obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			zone_options |= DNS_ZONEOPT_CHECKSVCB;
-		} else {
-			zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
-		}
-	} else {
-		zone_options |= DNS_ZONEOPT_CHECKSVCB;
-	}
-
-	obj = NULL;
-	if (get_maps(maps, "check-wildcard", &obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
-		} else {
-			zone_options &= ~DNS_ZONEOPT_CHECKWILDCARD;
-		}
-	} else {
-		zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
-	}
-
 	obj = NULL;
 	if (get_checknames(maps, &obj)) {
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
@@ -512,7 +492,7 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		*classp = defclass;
 		return (ISC_R_SUCCESS);
 	}
-	r.base = UNCONST(cfg_obj_asstring(classobj));
+	DE_CONST(cfg_obj_asstring(classobj), r.base);
 	r.length = strlen(r.base);
 	return (dns_rdataclass_fromtext(classp, &r));
 }
@@ -577,10 +557,10 @@ cleanup:
 
 static void
 output(void *closure, const char *text, int textlen) {
+	UNUSED(closure);
 	if (fwrite(text, 1, textlen, stdout) != (size_t)textlen) {
-		isc_result_t *result = closure;
 		perror("fwrite");
-		*result = ISC_R_FAILURE;
+		exit(1);
 	}
 }
 
@@ -592,21 +572,20 @@ main(int argc, char **argv) {
 	cfg_obj_t *config = NULL;
 	const char *conffile = NULL;
 	isc_mem_t *mctx = NULL;
-	isc_result_t result = ISC_R_SUCCESS;
-	bool cleanup_dst = true;
+	isc_result_t result;
+	int exit_status = 0;
 	bool load_zones = false;
 	bool list_zones = false;
 	bool print = false;
 	bool nodeprecate = false;
 	unsigned int flags = 0;
-	unsigned int checkflags = BIND_CHECK_PLUGINS | BIND_CHECK_ALGORITHMS;
 
 	isc_commandline_errprint = false;
 
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "acdhijlm:t:pvxz"
+#define CMDLINE_FLAGS "cdhijlm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -633,12 +612,8 @@ main(int argc, char **argv) {
 
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
 		switch (c) {
-		case 'a':
-			checkflags &= ~BIND_CHECK_ALGORITHMS;
-			break;
-
 		case 'c':
-			checkflags &= ~BIND_CHECK_PLUGINS;
+			loadplugins = false;
 			break;
 
 		case 'd':
@@ -665,7 +640,7 @@ main(int argc, char **argv) {
 			if (result != ISC_R_SUCCESS) {
 				fprintf(stderr, "isc_dir_chroot: %s\n",
 					isc_result_totext(result));
-				CHECK(result);
+				exit(1);
 			}
 			break;
 
@@ -675,8 +650,7 @@ main(int argc, char **argv) {
 
 		case 'v':
 			printf("%s\n", PACKAGE_VERSION);
-			result = ISC_R_SUCCESS;
-			goto cleanup;
+			exit(0);
 
 		case 'x':
 			flags |= CFG_PRINTER_XKEY;
@@ -696,27 +670,25 @@ main(int argc, char **argv) {
 			}
 			FALLTHROUGH;
 		case 'h':
-			isc_mem_detach(&mctx);
 			usage();
 
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			CHECK(ISC_R_FAILURE);
+			exit(1);
 		}
 	}
 
 	if (((flags & CFG_PRINTER_XKEY) != 0) && !print) {
 		fprintf(stderr, "%s: -x cannot be used without -p\n", program);
-		CHECK(ISC_R_FAILURE);
+		exit(1);
 	}
 	if (print && list_zones) {
 		fprintf(stderr, "%s: -l cannot be used with -p\n", program);
-		CHECK(ISC_R_FAILURE);
+		exit(1);
 	}
 
 	if (isc_commandline_index + 1 < argc) {
-		isc_mem_detach(&mctx);
 		usage();
 	}
 	if (argv[isc_commandline_index] != NULL) {
@@ -726,48 +698,43 @@ main(int argc, char **argv) {
 		conffile = NAMED_CONFFILE;
 	}
 
-	CHECK(setup_logging(mctx, stdout, &logc));
+	RUNTIME_CHECK(setup_logging(mctx, stdout, &logc) == ISC_R_SUCCESS);
 
-	CHECK(dst_lib_init(mctx, NULL));
-	cleanup_dst = true;
-
-	CHECK(cfg_parser_create(mctx, logc, &parser));
+	RUNTIME_CHECK(cfg_parser_create(mctx, logc, &parser) == ISC_R_SUCCESS);
 
 	if (nodeprecate) {
 		cfg_parser_setflags(parser, CFG_PCTX_NODEPRECATED, true);
 	}
 	cfg_parser_setcallback(parser, directory_callback, NULL);
 
-	CHECK(cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config));
-	CHECK(isccfg_check_namedconf(config, checkflags, logc, mctx));
-	if (load_zones || list_zones) {
-		CHECK(load_zones_fromconfig(config, mctx, list_zones));
+	if (cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config) !=
+	    ISC_R_SUCCESS)
+	{
+		exit(1);
 	}
 
-	if (print) {
-		cfg_printx(config, flags, output, &result);
+	result = bind9_check_namedconf(config, loadplugins, logc, mctx);
+	if (result != ISC_R_SUCCESS) {
+		exit_status = 1;
 	}
 
-cleanup:
-	if (config != NULL) {
-		cfg_obj_destroy(parser, &config);
+	if (result == ISC_R_SUCCESS && (load_zones || list_zones)) {
+		result = load_zones_fromconfig(config, mctx, list_zones);
+		if (result != ISC_R_SUCCESS) {
+			exit_status = 1;
+		}
 	}
 
-	if (parser != NULL) {
-		cfg_parser_destroy(&parser);
+	if (print && exit_status == 0) {
+		cfg_printx(config, flags, output, NULL);
 	}
+	cfg_obj_destroy(parser, &config);
 
-	if (cleanup_dst) {
-		dst_lib_destroy();
-	}
+	cfg_parser_destroy(&parser);
 
-	if (logc != NULL) {
-		isc_log_destroy(&logc);
-	}
+	isc_log_destroy(&logc);
 
-	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
-	}
+	isc_mem_destroy(&mctx);
 
-	return (result == ISC_R_SUCCESS ? 0 : 1);
+	return (exit_status);
 }

bin/check/named-checkconf.rst

@@ -21,7 +21,7 @@ named-checkconf - named configuration file syntax checking tool
 Synopsis
 ~~~~~~~~
 
-:program:`named-checkconf` [**-achjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
+:program:`named-checkconf` [**-chjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
 
 Description
 ~~~~~~~~~~~
@@ -32,22 +32,14 @@ errors. If no file is specified,
 |named_conf| is read by default.
 
 Note: files that :iscman:`named` reads in separate parser contexts, such as
-``rndc.conf`` or ``rndc.key``, are not automatically read by
-:program:`named-checkconf`.  Configuration errors in these files may cause
-:iscman:`named` to fail to run, even if :program:`named-checkconf` was
-successful.  However, :program:`named-checkconf` can be run on these files
-explicitly.
+``rndc.key`` and ``bind.keys``, are not automatically read by
+:program:`named-checkconf`. Configuration errors in these files may cause
+:iscman:`named` to fail to run, even if :program:`named-checkconf` was successful.
+However, :program:`named-checkconf` can be run on these files explicitly.
 
 Options
 ~~~~~~~
 
-.. option:: -a
-
-   Don't check the `dnssec-policy`'s DNSSEC key algorithms against
-   those supported by the crypto provider.  This is useful when checking
-   a `named.conf` intended to be run on another machine with possibly a
-   different set of supported DNSSEC key algorithms.
-
 .. option:: -h
 
    This option prints the usage summary and exits.

bin/check/named-checkzone.c

@@ -17,6 +17,7 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
@@ -24,8 +25,10 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 
@@ -79,7 +82,7 @@ usage(void) {
 		"%s zonename [ (filename|-) ]\n",
 		prog_name,
 		progmode == progmode_check ? "[-o filename]" : "-o filename");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
@@ -147,12 +150,15 @@ main(int argc, char **argv) {
 		UNREACHABLE();
 	}
 
-	/* When compiling, disable checks by default */
+	/* Compilation specific defaults */
 	if (progmode == progmode_compile) {
-		zone_options = 0;
-		docheckmx = false;
-		docheckns = false;
-		dochecksrv = false;
+		zone_options |= (DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_FATALNS |
+				 DNS_ZONEOPT_CHECKSPF | DNS_ZONEOPT_CHECKDUPRR |
+				 DNS_ZONEOPT_CHECKNAMES |
+				 DNS_ZONEOPT_CHECKNAMESFAIL |
+				 DNS_ZONEOPT_CHECKWILDCARD);
+	} else {
+		zone_options |= (DNS_ZONEOPT_CHECKDUPRR | DNS_ZONEOPT_CHECKSPF);
 	}
 
 #define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)
@@ -160,8 +166,8 @@ main(int argc, char **argv) {
 	isc_commandline_errprint = false;
 
 	while ((c = isc_commandline_parse(argc, argv,
-					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
-					  "DF:M:S:T:W:")) != EOF)
+					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:DF:"
+					  "M:S:T:W:")) != EOF)
 	{
 		switch (c) {
 		case 'c':
@@ -206,7 +212,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -i: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -240,7 +246,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -k: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -251,7 +257,7 @@ main(int argc, char **argv) {
 			if (*endp != '\0') {
 				fprintf(stderr, "source serial number "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -262,7 +268,7 @@ main(int argc, char **argv) {
 			if (*endp != '\0') {
 				fprintf(stderr, "maximum TTL "
 						"must be numeric");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -279,7 +285,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -n: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -296,7 +302,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -m: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -321,7 +327,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -r: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -334,7 +340,7 @@ main(int argc, char **argv) {
 				fprintf(stderr,
 					"unknown or unsupported style: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -344,30 +350,18 @@ main(int argc, char **argv) {
 				fprintf(stderr, "isc_dir_chroot: %s: %s\n",
 					isc_commandline_argument,
 					isc_result_totext(result));
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
 		case 'v':
 			printf("%s\n", PACKAGE_VERSION);
-			exit(EXIT_SUCCESS);
+			exit(0);
 
 		case 'w':
 			workdir = isc_commandline_argument;
 			break;
 
-		case 'C':
-			if (ARGCMP("check-svcb:fail")) {
-				zone_options |= DNS_ZONEOPT_CHECKSVCB;
-			} else if (ARGCMP("check-svcb:ignore")) {
-				zone_options &= ~DNS_ZONEOPT_CHECKSVCB;
-			} else {
-				fprintf(stderr, "invalid argument to -C: %s\n",
-					isc_commandline_argument);
-				exit(EXIT_FAILURE);
-			}
-			break;
-
 		case 'D':
 			dumpzone++;
 			break;
@@ -385,7 +379,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -M: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -402,7 +396,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -S: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -414,7 +408,7 @@ main(int argc, char **argv) {
 			} else {
 				fprintf(stderr, "invalid argument to -T: %s\n",
 					isc_commandline_argument);
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 			break;
 
@@ -438,7 +432,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", prog_name,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -447,7 +441,7 @@ main(int argc, char **argv) {
 		if (result != ISC_R_SUCCESS) {
 			fprintf(stderr, "isc_dir_chdir: %s: %s\n", workdir,
 				isc_result_totext(result));
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -463,7 +457,7 @@ main(int argc, char **argv) {
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 				inputformatstr);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -478,15 +472,14 @@ main(int argc, char **argv) {
 			outputformat = dns_masterformat_raw;
 			rawversion = strtol(outputformatstr + 4, &end, 10);
 			if (end == outputformatstr + 4 || *end != '\0' ||
-			    rawversion > 1U)
-			{
+			    rawversion > 1U) {
 				fprintf(stderr, "unknown raw format version\n");
-				exit(EXIT_FAILURE);
+				exit(1);
 			}
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 				outputformatstr);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -518,8 +511,7 @@ main(int argc, char **argv) {
 	}
 
 	if (argc - isc_commandline_index < 1 ||
-	    argc - isc_commandline_index > 2)
-	{
+	    argc - isc_commandline_index > 2) {
 		usage();
 	}
 

bin/check/named-checkzone.rst

@@ -23,7 +23,7 @@ named-checkzone - zone file validation tool
 Synopsis
 ~~~~~~~~
 
-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
 
 Description
 ~~~~~~~~~~~
@@ -68,15 +68,6 @@ Options
 
    This option specifies the class of the zone. If not specified, ``IN`` is assumed.
 
-.. option:: -C mode
-
-   This option controls check mode on zone files when loading.
-   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
-
-   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
-   records and ``check-svcb:ignore`` disables these checks.  The
-   default is ``check-svcb:fail``.
-
 .. option:: -i mode
 
    This option performs post-load zone integrity checks. Possible modes are

bin/check/named-compilezone.rst

@@ -23,23 +23,17 @@ named-compilezone - zone file converting tool
 Synopsis
 ~~~~~~~~
 
-:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
 
 Description
 ~~~~~~~~~~~
 
 :program:`named-compilezone` checks the syntax and integrity of a zone file,
 and dumps the zone contents to a specified file in a specified format.
-
-Unlike :program:`named-checkzone`, zone contents are not strictly checked
-by default. If the output is to be used as an actual zone file to be loaded
-by :iscman:`named`, then the check levels should be manually configured to
-be at least as strict as those specified in the :iscman:`named` configuration
-file.
-
-Running :program:`named-checkzone` on the input prior to compiling will
-ensure that the zone compiles with the default requirements of
-:iscman:`named`.
+It applies strict check levels by default, since the
+dump output is used as an actual zone file loaded by :iscman:`named`.
+When manually specified otherwise, the check levels must at least be as
+strict as those specified in the :iscman:`named` configuration file.
 
 Options
 ~~~~~~~
@@ -76,20 +70,11 @@ Options
 
    This option specifies the class of the zone. If not specified, ``IN`` is assumed.
 
-.. option:: -C mode
-
-   This option controls check mode on zone files when loading.
-   Possible modes are ``check-svcb:fail`` and ``check-svcb:ignore``.
-
-   ``check-svcb:fail`` turns on additional checks on ``_dns`` SVCB
-   records and ``check-svcb:ignore`` disables these checks.  The
-   default is ``check-svcb:ignore``.
-
 .. option:: -i mode
 
    This option performs post-load zone integrity checks. Possible modes are
-   ``full``, ``full-sibling``, ``local``,
-   ``local-sibling``, and ``none`` (the default).
+   ``full`` (the default), ``full-sibling``, ``local``,
+   ``local-sibling``, and ``none``.
 
    Mode ``full`` checks that MX records refer to A or AAAA records
    (both in-zone and out-of-zone hostnames). Mode ``local`` only
@@ -133,7 +118,7 @@ Options
 .. option:: -k mode
 
    This option performs ``check-names`` checks with the specified failure mode.
-   Possible modes are ``fail``, ``warn``, and ``ignore`` (the default).
+   Possible modes are ``fail`` (the default), ``warn``, and ``ignore``.
 
 .. option:: -l ttl
 
@@ -150,19 +135,19 @@ Options
 .. option:: -m mode
 
    This option specifies whether MX records should be checked to see if they are
-   addresses. Possible modes are ``fail``, ``warn``, and
-   ``ignore`` (the default).
+   addresses. Possible modes are ``fail``, ``warn`` (the default), and
+   ``ignore``.
 
 .. option:: -M mode
 
    This option checks whether a MX record refers to a CNAME. Possible modes are
-   ``fail``, ``warn``, and ``ignore`` (the default).
+   ``fail``, ``warn`` (the default), and ``ignore``.
 
 .. option:: -n mode
 
    This option specifies whether NS records should be checked to see if they are
-   addresses. Possible modes are ``fail``, ``warn``,  and
-   ``ignore`` (the default).
+   addresses. Possible modes are ``fail`` (the default), ``warn``,  and
+   ``ignore``.
 
 .. option:: -o filename
 
@@ -173,7 +158,7 @@ Options
 
    This option checks for records that are treated as different by DNSSEC but are
    semantically equal in plain DNS. Possible modes are ``fail``,
-   ``warn``, and ``ignore`` (the default).
+   ``warn`` (the default), and ``ignore``.
 
 .. option:: -s style
 
@@ -186,7 +171,7 @@ Options
 .. option:: -S mode
 
    This option checks whether an SRV record refers to a CNAME. Possible modes are
-   ``fail``, ``warn``, and ``ignore`` (the default).
+   ``fail``, ``warn`` (the default), and ``ignore``.
 
 .. option:: -t directory
 
@@ -198,7 +183,7 @@ Options
 
    This option checks whether Sender Policy Framework (SPF) records exist and issues a
    warning if an SPF-formatted TXT record is not also present. Possible
-   modes are ``warn`` and ``ignore`` (the default).
+   modes are ``warn`` (the default) and ``ignore``.
 
 .. option:: -w directory
 
@@ -216,7 +201,7 @@ Options
    This option specifies whether to check for non-terminal wildcards. Non-terminal
    wildcards are almost always the result of a failure to understand the
    wildcard matching algorithm (:rfc:`4592`). Possible modes are ``warn``
-   and ``ignore`` (the default).
+   (the default) and ``ignore``.
 
 .. option:: zonename
 
@@ -235,5 +220,5 @@ and 0 otherwise.
 See Also
 ~~~~~~~~
 
-:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-checkzone(8) <named-checkzone>`, :rfc:`1035`,
+:iscman:`named(8) <named>`, :iscman:`named-checkconf(8) <named-checkconf>`, :iscman:`named-checkzone(8) <named-checkzone>`, `:rfc:`1035`,
 BIND 9 Administrator Reference Manual.

bin/confgen/keygen.c

@@ -21,6 +21,7 @@
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 
@@ -33,6 +34,29 @@
 
 #include "util.h"
 
+/*%
+ * Convert algorithm type to string.
+ */
+const char *
+alg_totext(dns_secalg_t alg) {
+	switch (alg) {
+	case DST_ALG_HMACMD5:
+		return ("hmac-md5");
+	case DST_ALG_HMACSHA1:
+		return ("hmac-sha1");
+	case DST_ALG_HMACSHA224:
+		return ("hmac-sha224");
+	case DST_ALG_HMACSHA256:
+		return ("hmac-sha256");
+	case DST_ALG_HMACSHA384:
+		return ("hmac-sha384");
+	case DST_ALG_HMACSHA512:
+		return ("hmac-sha512");
+	default:
+		return ("(unknown)");
+	}
+}
+
 /*%
  * Convert string to algorithm type.
  */
@@ -124,7 +148,7 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 
 	DO("generate key",
 	   dst_key_generate(dns_rootname, alg, keysize, 0, 0, DNS_KEYPROTO_ANY,
-			    dns_rdataclass_in, NULL, mctx, &key, NULL));
+			    dns_rdataclass_in, mctx, &key, NULL));
 
 	isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));
 
@@ -151,7 +175,7 @@ void
 write_key_file(const char *keyfile, const char *user, const char *keyname,
 	       isc_buffer_t *secret, dns_secalg_t alg) {
 	isc_result_t result;
-	const char *algname = dst_hmac_algorithm_totext(alg);
+	const char *algname = alg_totext(alg);
 	FILE *fd = NULL;
 
 	DO("create keyfile", isc_file_safecreate(keyfile, &fd));

bin/confgen/rndc-confgen.c

@@ -34,6 +34,7 @@
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/net.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -146,8 +147,7 @@ main(int argc, char **argv) {
 			keyfile = isc_commandline_argument;
 			break;
 		case 'h':
-			usage(EXIT_SUCCESS);
-			break;
+			usage(0);
 		case 'k':
 		case 'y': /* Compatible with rndc -y. */
 			keyname = isc_commandline_argument;
@@ -193,15 +193,15 @@ main(int argc, char **argv) {
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
-				usage(EXIT_FAILURE);
+				usage(1);
 			} else {
-				usage(EXIT_SUCCESS);
+				usage(0);
 			}
 			break;
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -210,7 +210,7 @@ main(int argc, char **argv) {
 	POST(argv);
 
 	if (argc > 0) {
-		usage(EXIT_FAILURE);
+		usage(1);
 	}
 
 	if (alg == DST_ALG_HMACMD5) {
@@ -222,7 +222,7 @@ main(int argc, char **argv) {
 	if (keysize < 0) {
 		keysize = alg_bits(alg);
 	}
-	algname = dst_hmac_algorithm_totext(alg);
+	algname = alg_totext(alg);
 
 	isc_mem_create(&mctx);
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));

bin/confgen/tsig-keygen.c

@@ -30,6 +30,7 @@
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/net.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -126,8 +127,7 @@ main(int argc, char **argv) {
 	isc_commandline_errprint = false;
 
 	while ((ch = isc_commandline_parse(argc, argv, "a:hk:Mmr:qs:y:z:")) !=
-	       -1)
-	{
+	       -1) {
 		switch (ch) {
 		case 'a':
 			algname = isc_commandline_argument;
@@ -138,13 +138,13 @@ main(int argc, char **argv) {
 			keysize = alg_bits(alg);
 			break;
 		case 'h':
-			usage(EXIT_SUCCESS);
+			usage(0);
 		case 'k':
 		case 'y':
 			if (progmode == progmode_confgen) {
 				keyname = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'M':
@@ -157,7 +157,7 @@ main(int argc, char **argv) {
 			if (progmode == progmode_confgen) {
 				quiet = true;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'r':
@@ -167,29 +167,29 @@ main(int argc, char **argv) {
 			if (progmode == progmode_confgen) {
 				self_domain = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case 'z':
 			if (progmode == progmode_confgen) {
 				zone = isc_commandline_argument;
 			} else {
-				usage(EXIT_FAILURE);
+				usage(1);
 			}
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
-				usage(EXIT_FAILURE);
+				usage(1);
 			} else {
-				usage(EXIT_SUCCESS);
+				usage(0);
 			}
 			break;
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -200,15 +200,15 @@ main(int argc, char **argv) {
 	POST(argv);
 
 	if (self_domain != NULL && zone != NULL) {
-		usage(EXIT_FAILURE); /* -s and -z cannot coexist */
+		usage(1); /* -s and -z cannot coexist */
 	}
 
 	if (argc > isc_commandline_index) {
-		usage(EXIT_FAILURE);
+		usage(1);
 	}
 
 	/* Use canonical algorithm name */
-	algname = dst_hmac_algorithm_totext(alg);
+	algname = alg_totext(alg);
 
 	isc_mem_create(&mctx);
 

bin/confgen/tsig-keygen.rst

@@ -27,10 +27,9 @@ Synopsis
 Description
 ~~~~~~~~~~~
 
-:program:`tsig-keygen` is an utility that generates keys for use with TSIG
-(Transaction Signatures) as defined in :rfc:`2845`. The resulting keys can be used,
-for example, to secure dynamic DNS updates to a zone, or for the :iscman:`rndc`
-command channel.
+:program:`tsig-keygen` is an utility that generates keys for use in TSIG signing.
+The resulting keys can be used, for example, to secure dynamic DNS updates
+to a zone, or for the :iscman:`rndc` command channel.
 
 A domain name can be specified on the command line to be used as the name
 of the generated key. If no name is specified, the default is ``tsig-key``.

bin/confgen/util.c

@@ -13,15 +13,13 @@
 
 /*! \file */
 
+#include "util.h"
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <unistd.h>
 
-#include <isc/tls.h>
-
-#include "util.h"
+#include <isc/print.h>
 
 extern bool verbose;
 extern const char *progname;
@@ -47,5 +45,5 @@ fatal(const char *format, ...) {
 	vfprintf(stderr, format, args);
 	va_end(args);
 	fprintf(stderr, "\n");
-	_exit(EXIT_FAILURE);
+	exit(1);
 }

bin/delv/Makefile.am

@@ -4,8 +4,8 @@ AM_CPPFLAGS +=				\
 	-I$(top_builddir)/include	\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
-	$(LIBNS_CFLAGS)			\
-	$(LIBISCCFG_CFLAGS)
+	$(LIBISCCFG_CFLAGS)		\
+	$(LIBIRS_CFLAGS)
 
 AM_CPPFLAGS +=				\
 	-DSYSCONFDIR=\"${sysconfdir}\"
@@ -14,9 +14,8 @@ bin_PROGRAMS = delv
 
 delv_SOURCES =				\
 	delv.c
-
 delv_LDADD =				\
 	$(LIBISC_LIBS)			\
 	$(LIBDNS_LIBS)			\
-	$(LIBNS_LIBS)			\
-	$(LIBISCCFG_LIBS)
+	$(LIBISCCFG_LIBS)		\
+	$(LIBIRS_LIBS)

bin/delv/delv.rst

@@ -102,21 +102,20 @@ Options
 
 .. option:: -a anchor-file
 
-   This option specifies a file from which to read an alternate
-   DNSSEC root zone trust anchor.
+   This option specifies a file from which to read DNSSEC trust anchors. The default
+   is |bind_keys|, which is included with BIND 9 and contains one
+   or more trust anchors for the root zone (".").
 
-   By default, keys that do not match the root zone name (`.`) are
-   ignored. If an alternate key name is desired, it can be
-   specified using the :option:`+root` option.
+   Keys that do not match the root zone name are ignored. An alternate
+   key name can be specified using the :option:`+root` option.
 
-   Note: When reading trust anchors, :program:`delv` treats
-   ``trust-anchors``, ``initial-key``, and ``static-key`` identically. That
-   is, for a managed key, it is the *initial* key that is trusted;
-   :rfc:`5011` key management is not supported. :program:`delv` does not
-   consult the managed-keys database maintained by :iscman:`named`. This
-   means that if the default key built in to :program:`delv` is revoked,
-   :program:`delv` must be updated to a newer version in order to continue
-   validating.
+   Note: When reading the trust anchor file, :program:`delv` treats ``trust-anchors``,
+   ``initial-key``, and ``static-key`` identically. That is, for a managed key,
+   it is the *initial* key that is trusted; :rfc:`5011` key management is not
+   supported. :program:`delv` does not consult the managed-keys database maintained by
+   :iscman:`named`, which means that if either of the keys in |bind_keys| is
+   revoked and rolled over, |bind_keys| must be updated to
+   use DNSSEC validation in :program:`delv`.
 
 .. option:: -b address
 
@@ -230,36 +229,6 @@ assign values to options like the timeout interval. They have the form
    This option controls whether to display the CLASS when printing a record. The
    default is to display the CLASS.
 
-.. option:: +hint=FILE, +nohint
-
-   This option specifies a filename from which to load root hints;
-   this will be used to find the root name servers when name server
-   mode (``delv +ns``) is in use. If the option is not specified,
-   built-in root hints will be used.
-
-.. option:: +ns, +nons
-
-   This option toggles name server mode. When this option is in use,
-   the ``delv`` process instantiates a full recursive resolver, and uses
-   that to look up the requested query name and type. Turning on this
-   option also activates ``+mtrace``, ``+strace`` and ``+rtrace``, so that
-   every iterative query will be logged, including the full response messages
-   from each authoritatve server.  These logged messages will be written
-   to ``stdout`` rather than ``stderr`` as usual, so that the full trace
-   can be captured more easily.
-
-   This is intended to be similar to the behavior of ``dig +trace``, but
-   because it uses the same code as ``named``, it much more accurately
-   replicates the behavior of a recursive name server with a cold cache
-   that is processing a recursive query.
-
-.. option:: +qmin[=MODE], +noqmin
-
-   When used with ``+ns``, this option enables QNAME minimization mode.
-   Valid options of MODE are ``relaxed`` and ``strict``. By default,
-   QNAME minimization is disabled.  If ``+qmin`` is specified but MODE
-   is omitted, then ``relaxed`` mode will be used.
-
 .. option:: +ttl, +nottl
 
    This option controls whether to display the TTL when printing a record. The
@@ -267,11 +236,11 @@ assign values to options like the timeout interval. They have the form
 
 .. option:: +rtrace, +nortrace
 
-   This option toggles resolver fetch logging. This reports the name and
-   type of each query sent by :program:`delv` in the process of carrying
-   out the resolution and validation process, including the original query
-   and all subsequent queries to follow CNAMEs and to establish a chain of
-   trust for DNSSEC validation.
+   This option toggles resolver fetch logging. This reports the name and type of each
+   query sent by :program:`delv` in the process of carrying out the resolution
+   and validation process, including the original query
+   and all subsequent queries to follow CNAMEs and to establish a chain
+   of trust for DNSSEC validation.
 
    This is equivalent to setting the debug level to 1 in the "resolver"
    logging category. Setting the systemwide debug level to 1 using the
@@ -280,27 +249,15 @@ assign values to options like the timeout interval. They have the form
 
 .. option:: +mtrace, +nomtrace
 
-   This option toggles logging of messages received. This produces
-   a detailed dump of the responses received by :program:`delv` in the
-   process of carrying out the resolution and validation process.
+   This option toggles message logging. This produces a detailed dump of the
+   responses received by :program:`delv` in the process of carrying out the
+   resolution and validation process.
 
    This is equivalent to setting the debug level to 10 for the "packets"
    module of the "resolver" logging category. Setting the systemwide
    debug level to 10 using the :option:`-d` option produces the same
    output, but affects other logging categories as well.
 
-.. option:: +strace, +nostrace
-
-   This option toggles logging of messages sent. This produces a detailed
-   dump of the queries sent by :program:`delv` in the process of carrying
-   out the resolution and validation process. Turning on this option
-   also activates ``+mtrace``.
-
-   This is equivalent to setting the debug level to 11 for the "packets"
-   module of the "resolver" logging category. Setting the systemwide
-   debug level to 11 using the :option:`-d` option produces the same
-   output, but affects other logging categories as well.
-
 .. option:: +vtrace, +novtrace
 
    This option toggles validation logging. This shows the internal process of the
@@ -397,6 +354,8 @@ assign values to options like the timeout interval. They have the form
 Files
 ~~~~~
 
+|bind_keys|
+
 ``/etc/resolv.conf``
 
 See Also

bin/dig/Makefile.am

@@ -4,14 +4,17 @@ AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS)	\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
-	$(LIBIDN2_CFLAGS)	\
-	$(LIBUV_CFLAGS)
+	$(LIBIRS_CFLAGS)	\
+	$(LIBBIND9_CFLAGS)	\
+	$(LIBIDN2_CFLAGS)
 
 LDADD +=			\
 	libdighost.la		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCFG_LIBS)	\
+	$(LIBIRS_LIBS)		\
+	$(LIBBIND9_LIBS)	\
 	$(LIBIDN2_LIBS)
 
 noinst_LTLIBRARIES = libdighost.la

bin/dig/dig.rst

@@ -132,14 +132,12 @@ Options
 
 .. option:: -k keyfile
 
-   This option tells :program:`dig` to sign queries using TSIG or
-   SIG(0) using a key read from the given file. Key files can be
-   generated using :iscman:`tsig-keygen`. When using TSIG authentication
-   with :program:`dig`, the name server that is queried needs to
-   know the key and algorithm that is being used. In BIND, this is
-   done by providing appropriate ``key`` and ``server`` statements
-   in :iscman:`named.conf` for TSIG and by looking up the KEY record
-   in zone data for SIG(0).
+   This option tells :iscman:`named` to sign queries using TSIG using a key read from the given file. Key
+   files can be generated using :iscman:`tsig-keygen`. When using TSIG
+   authentication with :program:`dig`, the name server that is queried needs to
+   know the key and algorithm that is being used. In BIND, this is done
+   by providing appropriate ``key`` and ``server`` statements in
+   :iscman:`named.conf`.
 
 .. option:: -m
 
@@ -347,6 +345,12 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    enables search list processing as if the :option:`+search` option were
    given.
 
+.. option:: +dscp=value
+
+   This option sets the DSCP code point to be used when sending the query. Valid DSCP
+   code points are in the range [0...63]. By default no code point is
+   explicitly set.
+
 .. option:: +edns[=#], +noedns
 
    This option specifies the EDNS version to query with. Valid values are 0 to 255.
@@ -382,14 +386,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    to not try the next server, which is the reverse of normal stub
    resolver behavior.
 
-.. option:: +fuzztime[=value], +nofuzztime
-
-   This option allows the signing time to be specified when generating
-   signed messages.  If a value is specified it is the seconds since
-   00:00:00 January 1, 1970 UTC ignoring leap seconds.  If no value
-   is specified 1646972129 (Fri 11 Mar 2022 04:15:29 UTC) is used.
-   The default is ``+nofuzztime`` and the current time is used.
-
 .. option:: +header-only, +noheader-only
 
    This option sends a query with a DNS header without a question section. The
@@ -436,19 +432,28 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    form answers are requested, the default is not to show the source
    address and port number of the server that provided the answer.
 
-.. option:: +idn, +noidn
+.. option:: +idnin, +noidnin
 
-   Enable or disable IDN processing. By default IDN is enabled for
-   input query names, and for display when the output is a terminal.
+   This option processes [or does not process] IDN domain names on input. This requires
+   ``IDN SUPPORT`` to have been enabled at compile time.
 
-   You can also turn off :program:`dig`'s IDN processing by setting
-   the ``IDN_DISABLE`` environment variable.
+   The default is to process IDN input when standard output is a tty.
+   The IDN processing on input is disabled when :program:`dig` output is redirected
+   to files, pipes, and other non-tty file descriptors.
+
+.. option:: +idnout, +noidnout
+
+   This option converts [or does not convert] puny code on output. This requires
+   ``IDN SUPPORT`` to have been enabled at compile time.
+
+   The default is to process puny code on output when standard output is
+   a tty. The puny code processing on output is disabled when :program:`dig` output
+   is redirected to files, pipes, and other non-tty file descriptors.
 
 .. option:: +ignore, +noignore
 
-   This option ignores [or does not ignore] truncation in UDP
-   responses instead of retrying with TCP. By default, TCP retries are
-   performed.
+   This option ignores [or does not ignore] truncation in UDP responses instead of retrying with TCP. By
+   default, TCP retries are performed.
 
 .. option:: +keepalive, +nokeepalive
 
@@ -507,44 +512,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    mandatory. Responses to padded queries may also be padded, but only
    if the query uses TCP or DNS COOKIE.
 
-.. option:: +proxy[=src_addr[#src_port]-dst_addr[#dst_port]], +noproxy
-
-   When this option is set, :program:`dig` adds PROXYv2 headers to the
-   queries. When source and destination addresses are specified, the
-   headers contain them and use the ``PROXY`` command. It means for
-   the remote peer that the queries were sent on behalf of another
-   node and that the PROXYv2 header reflects the original connection
-   endpoints. The default source port is ``0`` and destination port is
-   `53`.
-
-   For encrypted DNS transports, to prevent accidental information
-   leakage, encryption is applied to the PROXYv2 headers: the headers
-   are sent right after the handshake process has been completed.
-
-   For plain DNS transports, no encryption is applied to the PROXYv2
-   headers.
-
-   If the addressees are omitted, PROXYv2 headers, that use the
-   ``LOCAL`` command set, are added instead. For the remote peer, that
-   means that the queries were sent on purpose without being relayed,
-   so the real connection endpoint addresses must be used.
-
-.. option:: +proxy-plain[=src_addr[#src_port]-dst_addr[#dst_port], +noproxy-plain
-
-   The same as ``+[no]proxy``, but instructs ``dig`` to send PROXYv2
-   headers ahead of any encryption, before any handshake messages are
-   sent. That makes :program:`dig` behave exactly how it is described
-   in the PROXY protocol specification, but not all software expects
-   such behaviour.
-
-   Please consult the software documentation to find out if you need
-   this option. (for example, ``dnsdist`` expects encrypted PROXYv2
-   headers sent over TLS when encryption is used, while ``HAProxy``
-   and many other software packages expect plain ones).
-
-   For plain DNS transports the option is effectively an alias for the
-   ``+[no]proxy`` described above.
-
 .. option:: +qid=value
 
    This option specifies the query ID to use when sending queries.
@@ -614,6 +581,11 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
 
    This option performs [or does not perform] a search showing intermediate results.
 
+.. option:: +sigchase, +nosigchase
+
+   This feature is now obsolete and has been removed; use :iscman:`delv`
+   instead.
+
 .. option:: +split=W
 
    This option splits long hex- or base64-formatted fields in resource records into
@@ -645,11 +617,10 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
 
 .. option:: +tcp, +notcp
 
-   This option indicates whether to use TCP when querying name
-   servers.  The default behavior is to use UDP unless a type ``any``
-   or ``ixfr=N`` query is requested, in which case the default is
-   TCP. AXFR queries always use TCP. To prevent retry over TCP when
-   TC=1 is returned from a UDP query, use ``+ignore``.
+   This option indicates whether to use TCP when querying name servers.
+   The default behavior is to use UDP unless a type ``any`` or ``ixfr=N``
+   query is requested, in which case the default is TCP. AXFR queries
+   always use TCP.
 
 .. option:: +timeout=T
 
@@ -683,23 +654,25 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    server TLS certificate verification. Otherwise, the DNS server name
    is used. This option has no effect if :option:`+tls-ca` is not specified.
 
+.. option:: +topdown, +notopdown
+
+   This feature is related to :option:`dig +sigchase`, which is obsolete and
+   has been removed. Use :iscman:`delv` instead.
+
 .. option:: +trace, +notrace
 
-   This option toggles tracing of the delegation path from the root name
-   servers for the name being looked up. Tracing is disabled by default.
-   When tracing is enabled, :program:`dig` makes iterative queries to
-   resolve the name being looked up. It follows referrals from the root
-   servers, showing the answer from each server that was used to resolve
-   the lookup.
+   This option toggles tracing of the delegation path from the root name servers for
+   the name being looked up. Tracing is disabled by default. When
+   tracing is enabled, :program:`dig` makes iterative queries to resolve the
+   name being looked up. It follows referrals from the root servers,
+   showing the answer from each server that was used to resolve the
+   lookup.
 
    If ``@server`` is also specified, it affects only the initial query for
    the root zone name servers.
 
-   :option:`+dnssec` is set when :option:`+trace` is set, to better
-   emulate the default queries from a name server.
-
-   Note that the ``delv +ns`` option can also be used for tracing the
-   resolution of a name from the root (see :iscman:`delv`).
+   :option:`+dnssec` is also set when :option:`+trace` is set, to better emulate the
+   default queries from a name server.
 
 .. option:: +tries=T
 
@@ -707,6 +680,11 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
    instead of the default, 3. If ``T`` is less than or equal to zero,
    the number of tries is silently rounded up to 1.
 
+.. option:: +trusted-key=####
+
+   This option formerly specified trusted keys for use with :option:`dig +sigchase`. This
+   feature is now obsolete and has been removed; use :iscman:`delv` instead.
+
 .. option:: +ttlid, +nottlid
 
    This option displays [or does not display] the TTL when printing the record.
@@ -768,10 +746,21 @@ shows how :program:`dig` can be used from the command line to make three
 lookups: an ANY query for ``www.isc.org``, a reverse lookup of 127.0.0.1,
 and a query for the NS records of ``isc.org``. A global query option of
 :option:`+qr` is applied, so that :program:`dig` shows the initial query it made for
-each lookup. The final query has a local query option of :option:`+noqr` which
+each lookup. The final query has a local query option of :option:`+qr` which
 means that :program:`dig` does not print the initial query when it looks up the
 NS records for ``isc.org``.
 
+IDN Support
+~~~~~~~~~~~
+
+If :program:`dig` has been built with IDN (internationalized domain name)
+support, it can accept and display non-ASCII domain names. :program:`dig`
+appropriately converts character encoding of a domain name before sending
+a request to a DNS server or displaying a reply from the server.
+To turn off IDN support, use the parameters
+:option:`+idnin` and :option:`+idnout`, or define the ``IDN_DISABLE`` environment
+variable.
+
 Return Codes
 ~~~~~~~~~~~~
 

bin/dig/dighost.h

@@ -23,10 +23,10 @@
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
 #include <isc/list.h>
-#include <isc/loop.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
+#include <isc/print.h>
 #include <isc/refcount.h>
 #include <isc/sockaddr.h>
 #include <isc/time.h>
@@ -105,13 +105,12 @@ typedef struct dig_searchlist dig_searchlist_t;
 struct dig_lookup {
 	unsigned int magic;
 	isc_refcount_t references;
-	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
+	bool aaonly, adflag, badcookie, besteffort, cdflag, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		expire, fuzzing, header_only, identify, /*%< Append an "on
-							   server <foo>" message
-							 */
-		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
-					   message, with newline and tab */
+		expire, header_only, identify, /*%< Append an "on server <foo>"
+						  message */
+		identify_previous_line,	       /*% Prepend a "Nameserver <foo>:"
+						  message, with newline and tab */
 		idnin, idnout, ignore, multiline, need_search, new_search,
 		noclass, nocrypto, nottl, ns_search_only, /*%< dig +nssearch,
 							     host -C */
@@ -166,9 +165,11 @@ struct dig_lookup {
 	char *cookie;
 	dns_ednsopt_t *ednsopts;
 	unsigned int ednsoptscnt;
+	isc_dscp_t dscp;
 	unsigned int ednsflags;
 	dns_opcode_t opcode;
 	int rrcomments;
+	unsigned int eoferr;
 	uint16_t qid;
 	struct {
 		bool http_plain;
@@ -187,14 +188,6 @@ struct dig_lookup {
 		char *tls_key_file;
 		isc_tlsctx_cache_t *tls_ctx_cache;
 	};
-	struct {
-		bool proxy_mode;
-		bool proxy_plain;
-		bool proxy_local;
-		isc_sockaddr_t proxy_src_addr;
-		isc_sockaddr_t proxy_dst_addr;
-	};
-	isc_stdtime_t fuzztime;
 };
 
 /*% The dig_query structure */
@@ -266,12 +259,12 @@ extern isc_sockaddr_t localaddr;
 extern char keynametext[MXNAME];
 extern char keyfile[MXNAME];
 extern char keysecret[MXNAME];
-extern dst_algorithm_t hmac_alg;
+extern const dns_name_t *hmacname;
 extern unsigned int digestbits;
 extern dns_tsigkey_t *tsigkey;
 extern bool validated;
-extern isc_loopmgr_t *loopmgr;
-extern isc_loop_t *mainloop;
+extern isc_taskmgr_t *taskmgr;
+extern isc_task_t *global_task;
 extern bool free_now;
 extern bool debugging, debugtiming, memdebugging;
 extern bool keep_open;
@@ -302,9 +295,6 @@ warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 noreturn void
 digexit(void);
 
-void
-cleanup_openssl_refs(void);
-
 void
 debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
@@ -324,10 +314,7 @@ void
 start_lookup(void);
 
 void
-onrun_callback(void *arg);
-
-void
-run_loop(void *arg);
+onrun_callback(isc_task_t *task, isc_event_t *event);
 
 int
 dhmain(int argc, char **argv);
@@ -348,7 +335,7 @@ isc_result_t
 parse_netprefix(isc_sockaddr_t **sap, const char *value);
 
 void
-parse_hmac(const char *algname);
+parse_hmac(const char *hmacstr);
 
 dig_lookup_t *
 requeue_lookup(dig_lookup_t *lookold, bool servers);
@@ -452,6 +439,12 @@ dig_query_setup(bool, bool, int argc, char **argv);
 void
 dig_startup(void);
 
+/*%
+ * Initiates the next lookup cycle
+ */
+void
+dig_query_start(void);
+
 /*%
  * Activate/deactivate IDN filtering of output.
  */

bin/dig/host.c

@@ -19,11 +19,13 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
+#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/commandline.h>
-#include <isc/loop.h>
 #include <isc/netaddr.h>
+#include <isc/print.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/util.h>
 
 #include <dns/byaddr.h>
@@ -132,12 +134,12 @@ show_usage(void) {
 		"       -W specifies how long to wait for a reply\n"
 		"       -4 use IPv4 query transport only\n"
 		"       -6 use IPv6 query transport only\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
 host_shutdown(void) {
-	isc_loopmgr_shutdown(loopmgr);
+	(void)isc_app_shutdown();
 }
 
 static void
@@ -149,9 +151,9 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		char fromtext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(from, fromtext, sizeof(fromtext));
 		if (query->lookup->use_usec) {
-			now = isc_time_now_hires();
+			TIME_NOW_HIRES(&now);
 		} else {
-			now = isc_time_now();
+			TIME_NOW(&now);
 		}
 		diff = (int)isc_time_microdiff(&now, &query->time_sent);
 		printf("Received %u bytes from %s in %d ms\n", bytes, fromtext,
@@ -531,8 +533,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	}
 
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_AUTHORITY]) &&
-	    !short_form)
-	{
+	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
 				      true, query);
@@ -541,8 +542,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ADDITIONAL]) &&
-	    !short_form)
-	{
+	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_ADDITIONAL, "ADDITIONAL",
 				      true, query);
@@ -590,12 +590,10 @@ pre_parse_args(int argc, char **argv) {
 			{
 				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
 			} else if (strcasecmp("record",
-					      isc_commandline_argument) == 0)
-			{
+					      isc_commandline_argument) == 0) {
 				isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
 			} else if (strcasecmp("usage",
-					      isc_commandline_argument) == 0)
-			{
+					      isc_commandline_argument) == 0) {
 				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 			}
 			break;
@@ -654,7 +652,7 @@ pre_parse_args(int argc, char **argv) {
 			break;
 		case 'V':
 			printf("host %s\n", PACKAGE_VERSION);
-			exit(EXIT_SUCCESS);
+			exit(0);
 			break;
 		case 'w':
 			break;
@@ -706,8 +704,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 't':
 			if (strncasecmp(isc_commandline_argument, "ixfr=", 5) ==
-			    0)
-			{
+			    0) {
 				rdtype = dns_rdatatype_ixfr;
 				/* XXXMPA add error checking */
 				serial = strtoul(isc_commandline_argument + 5,
@@ -726,8 +723,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 				      isc_commandline_argument);
 			}
 			if (!lookup->rdtypeset ||
-			    lookup->rdtype != dns_rdatatype_axfr)
-			{
+			    lookup->rdtype != dns_rdatatype_axfr) {
 				lookup->rdtype = rdtype;
 			}
 			lookup->rdtypeset = true;
@@ -771,8 +767,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			FALLTHROUGH;
 		case 'a':
 			if (!lookup->rdtypeset ||
-			    lookup->rdtype != dns_rdatatype_axfr)
-			{
+			    lookup->rdtype != dns_rdatatype_axfr) {
 				lookup->rdtype = dns_rdatatype_any;
 			}
 			list_type = dns_rdatatype_any;
@@ -846,7 +841,6 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			break;
 		case 'p':
 			port = atoi(isc_commandline_argument);
-			port_set = true;
 			break;
 		}
 	}
@@ -884,6 +878,8 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 
 int
 main(int argc, char **argv) {
+	isc_result_t result;
+
 	tries = 2;
 
 	ISC_LIST_INIT(lookup_list);
@@ -901,6 +897,8 @@ main(int argc, char **argv) {
 	debug("main()");
 	progname = argv[0];
 	pre_parse_args(argc, argv);
+	result = isc_app_start();
+	check_result(result, "isc_app_start");
 	setup_libs();
 	setup_system(ipv4only, ipv6only);
 	parse_args(false, argc, argv);
@@ -909,12 +907,11 @@ main(int argc, char **argv) {
 	} else if (keysecret[0] != 0) {
 		setup_text_key();
 	}
-
-	isc_loopmgr_setup(loopmgr, run_loop, NULL);
-	isc_loopmgr_run(loopmgr);
-
+	result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
+	check_result(result, "isc_app_onrun");
+	isc_app_run();
 	cancel_all();
 	destroy_libs();
-
+	isc_app_finish();
 	return ((seen_error == 0) ? 0 : 1);
 }

bin/dig/nslookup.c

@@ -16,17 +16,17 @@
 #include <stdlib.h>
 #include <unistd.h>
 
-#include <isc/async.h>
+#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/condition.h>
-#include <isc/loop.h>
+#include <isc/event.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
+#include <isc/print.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/util.h>
-#include <isc/work.h>
 
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
@@ -41,9 +41,6 @@
 #include "dighost.h"
 #include "readline.h"
 
-static char cmdlinebuf[COMMSIZE];
-static char *cmdline = NULL;
-
 static bool short_form = true, tcpmode = false, tcpmode_set = false,
 	    identify = false, stats = true, comments = true,
 	    section_question = true, section_answer = true,
@@ -56,6 +53,7 @@ static bool interactive;
 static bool in_use = false;
 static char defclass[MXRD] = "IN";
 static char deftype[MXRD] = "A";
+static isc_event_t *global_event = NULL;
 static int query_error = 1, print_error = 0;
 
 static char domainopt[DNS_NAME_MAXTEXT];
@@ -114,6 +112,9 @@ static const char *rtypetext[] = {
 
 #define N_KNOWN_RRTYPES (sizeof(rtypetext) / sizeof(rtypetext[0]))
 
+static void
+getinput(isc_task_t *task, isc_event_t *event);
+
 static char *
 rcode_totext(dns_rcode_t rcode) {
 	static char buf[sizeof("?65535")];
@@ -131,6 +132,20 @@ rcode_totext(dns_rcode_t rcode) {
 	return (totext.deconsttext);
 }
 
+static void
+query_finished(void) {
+	isc_event_t *event = global_event;
+
+	debug("dighost_shutdown()");
+
+	if (!in_use) {
+		isc_app_shutdown();
+		return;
+	}
+
+	isc_task_send(global_task, &event);
+}
+
 static void
 printsoa(dns_rdata_t *rdata) {
 	dns_rdata_soa_t soa;
@@ -386,6 +401,8 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 static isc_result_t
 printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	     bool headers) {
+	char servtext[ISC_SOCKADDR_FORMATSIZE];
+
 	UNUSED(msgbuf);
 
 	/* I've we've gotten this far, we've reached a server. */
@@ -394,7 +411,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	debug("printmessage()");
 
 	if (!default_lookups || query->lookup->rdtype == dns_rdatatype_a) {
-		char servtext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&query->sockaddr, servtext,
 				    sizeof(servtext));
 		printf("Server:\t\t%s\n", query->userarg);
@@ -566,7 +582,6 @@ set_port(const char *value) {
 	isc_result_t result = parse_uint(&n, value, 65535, "port");
 	if (result == ISC_R_SUCCESS) {
 		port = (uint16_t)n;
-		port_set = true;
 	}
 }
 
@@ -790,8 +805,10 @@ do_next_command(char *input) {
 	} else if ((strcasecmp(ptr, "server") == 0) ||
 		   (strcasecmp(ptr, "lserver") == 0))
 	{
+		isc_app_block();
 		set_nameserver(arg);
 		check_ra = false;
+		isc_app_unblock();
 		show_settings(true, true);
 	} else if (strcasecmp(ptr, "exit") == 0) {
 		in_use = false;
@@ -808,31 +825,28 @@ do_next_command(char *input) {
 }
 
 static void
-readline_next_command(void *arg) {
-	char *ptr = NULL;
+get_next_command(void) {
+	char cmdlinebuf[COMMSIZE];
+	char *cmdline, *ptr = NULL;
 
-	UNUSED(arg);
-
-	isc_loopmgr_blocking(loopmgr);
-	ptr = readline("> ");
-	isc_loopmgr_nonblocking(loopmgr);
-	if (ptr == NULL) {
-		return;
+	isc_app_block();
+	if (interactive) {
+		cmdline = ptr = readline("> ");
+		if (ptr != NULL && *ptr != 0) {
+			add_history(ptr);
+		}
+	} else {
+		cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
 	}
-
-	if (*ptr != 0) {
-		add_history(ptr);
-		strlcpy(cmdlinebuf, ptr, COMMSIZE);
-		cmdline = cmdlinebuf;
+	isc_app_unblock();
+	if (cmdline == NULL) {
+		in_use = false;
+	} else {
+		do_next_command(cmdline);
+	}
+	if (ptr != NULL) {
+		free(ptr);
 	}
-	free(ptr);
-}
-
-static void
-fgets_next_command(void *arg) {
-	UNUSED(arg);
-
-	cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
 }
 
 noreturn static void
@@ -849,7 +863,7 @@ usage(void) {
 			"'host' using default server\n");
 	fprintf(stderr, "   nslookup [-opt ...] host server # just look up "
 			"'host' using 'server'\n");
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
@@ -862,7 +876,7 @@ parse_args(int argc, char **argv) {
 		if (argv[0][0] == '-') {
 			if (strncasecmp(argv[0], "-ver", 4) == 0) {
 				printf("nslookup %s\n", PACKAGE_VERSION);
-				exit(EXIT_SUCCESS);
+				exit(0);
 			} else if (argv[0][1] != 0) {
 				setoption(&argv[0][1]);
 			} else {
@@ -885,54 +899,25 @@ parse_args(int argc, char **argv) {
 }
 
 static void
-start_next_command(void);
-
-static void
-process_next_command(void *arg ISC_ATTR_UNUSED) {
-	isc_loop_t *loop = isc_loop_main(loopmgr);
-	if (cmdline == NULL) {
-		in_use = false;
-	} else {
-		do_next_command(cmdline);
+getinput(isc_task_t *task, isc_event_t *event) {
+	UNUSED(task);
+	if (global_event == NULL) {
+		global_event = event;
+	}
+	while (in_use) {
+		get_next_command();
 		if (ISC_LIST_HEAD(lookup_list) != NULL) {
-			isc_async_run(loop, run_loop, NULL);
+			start_lookup();
 			return;
 		}
 	}
-
-	start_next_command();
-}
-
-static void
-start_next_command(void) {
-	isc_loop_t *loop = isc_loop_main(loopmgr);
-	if (!in_use) {
-		isc_loopmgr_shutdown(loopmgr);
-		return;
-	}
-
-	cmdline = NULL;
-
-	isc_loopmgr_pause(loopmgr);
-	if (interactive) {
-		isc_work_enqueue(loop, readline_next_command,
-				 process_next_command, loop);
-	} else {
-		isc_work_enqueue(loop, fgets_next_command, process_next_command,
-				 loop);
-	}
-	isc_loopmgr_resume(loopmgr);
-}
-
-static void
-read_loop(void *arg) {
-	UNUSED(arg);
-
-	start_next_command();
+	isc_app_shutdown();
 }
 
 int
 main(int argc, char **argv) {
+	isc_result_t result;
+
 	interactive = isatty(0);
 
 	ISC_LIST_INIT(lookup_list);
@@ -945,7 +930,10 @@ main(int argc, char **argv) {
 	dighost_printmessage = printmessage;
 	dighost_received = received;
 	dighost_trying = trying;
-	dighost_shutdown = start_next_command;
+	dighost_shutdown = query_finished;
+
+	result = isc_app_start();
+	check_result(result, "isc_app_start");
 
 	setup_libs();
 	progname = argv[0];
@@ -961,18 +949,23 @@ main(int argc, char **argv) {
 		set_search_domain(domainopt);
 	}
 	if (in_use) {
-		isc_loopmgr_setup(loopmgr, run_loop, NULL);
+		result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
 	} else {
-		isc_loopmgr_setup(loopmgr, read_loop, NULL);
+		result = isc_app_onrun(mctx, global_task, getinput, NULL);
 	}
+	check_result(result, "isc_app_onrun");
 	in_use = !in_use;
 
-	isc_loopmgr_run(loopmgr);
+	(void)isc_app_run();
 
 	puts("");
 	debug("done, and starting to shut down");
+	if (global_event != NULL) {
+		isc_event_free(&global_event);
+	}
 	cancel_all();
 	destroy_libs();
+	isc_app_finish();
 
 	return (query_error | print_error);
 }

bin/dnssec/Makefile.am

@@ -12,8 +12,7 @@ noinst_LTLIBRARIES = libdnssectool.la
 LDADD +=			\
 	libdnssectool.la	\
 	$(LIBISC_LIBS)		\
-	$(LIBDNS_LIBS)		\
-	$(OPENSSL_LIBS)
+	$(LIBDNS_LIBS)
 
 bin_PROGRAMS = \
 	dnssec-cds		\
@@ -32,20 +31,8 @@ libdnssectool_la_SOURCES =	\
 
 dnssec_keygen_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
-	$(LIBISCCFG_CFLAGS)	\
-	$(OPENSSL_CFLAGS)
+	$(LIBISCCFG_CFLAGS)
 
 dnssec_keygen_LDADD =		\
 	$(LDADD)		\
-	$(LIBISCCFG_LIBS)	\
-	$(OPENSSL_LIBS)
-
-dnssec_signzone_CPPFLAGS =	\
-	$(AM_CPPFLAGS)		\
-	$(LIBISCCFG_CFLAGS)	\
-	$(OPENSSL_CFLAGS)
-
-dnssec_signzone_LDADD =		\
-	$(LDADD)		\
-	$(LIBISCCFG_LIBS)	\
-	$(OPENSSL_LIBS)
+	$(LIBISCCFG_LIBS)

bin/dnssec/dnssec-cds.c

@@ -30,6 +30,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/serial.h>
 #include <isc/string.h>
@@ -124,29 +125,15 @@ typedef isc_result_t
 ds_maker_func_t(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
 		dns_rdata_t *crdata);
 
-static dns_rdataset_t cdnskey_set = DNS_RDATASET_INIT;
-static dns_rdataset_t cdnskey_sig = DNS_RDATASET_INIT;
-static dns_rdataset_t cds_set = DNS_RDATASET_INIT;
-static dns_rdataset_t cds_sig = DNS_RDATASET_INIT;
-static dns_rdataset_t dnskey_set = DNS_RDATASET_INIT;
-static dns_rdataset_t dnskey_sig = DNS_RDATASET_INIT;
-static dns_rdataset_t old_ds_set = DNS_RDATASET_INIT;
-static dns_rdataset_t new_ds_set = DNS_RDATASET_INIT;
+static dns_rdataset_t cdnskey_set, cdnskey_sig;
+static dns_rdataset_t cds_set, cds_sig;
+static dns_rdataset_t dnskey_set, dnskey_sig;
+static dns_rdataset_t old_ds_set, new_ds_set;
 
-static keyinfo_t *old_key_tbl = NULL, *new_key_tbl = NULL;
+static keyinfo_t *old_key_tbl, *new_key_tbl;
 
 isc_buffer_t *new_ds_buf = NULL; /* backing store for new_ds_set */
 
-static dns_db_t *child_db = NULL;
-static dns_dbnode_t *child_node = NULL;
-static dns_db_t *parent_db = NULL;
-static dns_dbnode_t *parent_node = NULL;
-static dns_db_t *update_db = NULL;
-static dns_dbnode_t *update_node = NULL;
-static dns_dbversion_t *update_version = NULL;
-static bool cleanup_dst = false;
-static bool print_mem_stats = false;
-
 static void
 verbose_time(int level, const char *msg, isc_stdtime_t time) {
 	isc_result_t result;
@@ -247,8 +234,8 @@ static void
 load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 	isc_result_t result;
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, dbp);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, dbp);
 	check_result(result, "dns_db_create()");
 
 	result = dns_db_load(*dbp, filename, dns_masterformat_text,
@@ -264,27 +251,21 @@ load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 }
 
 static void
-free_db(dns_db_t **dbp, dns_dbnode_t **nodep, dns_dbversion_t **versionp) {
-	if (*dbp != NULL) {
-		if (*nodep != NULL) {
-			dns_db_detachnode(*dbp, nodep);
-		}
-		if (versionp != NULL && *versionp != NULL) {
-			dns_db_closeversion(*dbp, versionp, false);
-		}
-		dns_db_detach(dbp);
-	}
+free_db(dns_db_t **dbp, dns_dbnode_t **nodep) {
+	dns_db_detachnode(*dbp, nodep);
+	dns_db_detach(dbp);
 }
 
 static void
 load_child_sets(const char *file) {
-	load_db(file, &child_db, &child_node);
-	findset(child_db, child_node, dns_rdatatype_dnskey, &dnskey_set,
-		&dnskey_sig);
-	findset(child_db, child_node, dns_rdatatype_cdnskey, &cdnskey_set,
-		&cdnskey_sig);
-	findset(child_db, child_node, dns_rdatatype_cds, &cds_set, &cds_sig);
-	free_db(&child_db, &child_node, NULL);
+	dns_db_t *db = NULL;
+	dns_dbnode_t *node = NULL;
+
+	load_db(file, &db, &node);
+	findset(db, node, dns_rdatatype_dnskey, &dnskey_set, &dnskey_sig);
+	findset(db, node, dns_rdatatype_cdnskey, &cdnskey_set, &cdnskey_sig);
+	findset(db, node, dns_rdatatype_cds, &cds_set, &cds_sig);
+	free_db(&db, &node);
 }
 
 static void
@@ -333,6 +314,8 @@ get_dsset_name(char *filename, size_t size, const char *path,
 static void
 load_parent_set(const char *path) {
 	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbnode_t *node = NULL;
 	isc_time_t modtime;
 	char filename[PATH_MAX + 1];
 
@@ -345,20 +328,21 @@ load_parent_set(const char *path) {
 	}
 	notbefore = isc_time_seconds(&modtime);
 	if (startstr != NULL) {
-		isc_stdtime_t now = isc_stdtime_now();
+		isc_stdtime_t now;
+		isc_stdtime_get(&now);
 		notbefore = strtotime(startstr, now, notbefore, NULL);
 	}
 	verbose_time(1, "child records must not be signed before", notbefore);
 
-	load_db(filename, &parent_db, &parent_node);
-	findset(parent_db, parent_node, dns_rdatatype_ds, &old_ds_set, NULL);
+	load_db(filename, &db, &node);
+	findset(db, node, dns_rdatatype_ds, &old_ds_set, NULL);
 
 	if (!dns_rdataset_isassociated(&old_ds_set)) {
 		fatal("could not find DS records for %s in %s", namestr,
 		      filename);
 	}
 
-	free_db(&parent_db, &parent_node, NULL);
+	free_db(&db, &node);
 }
 
 #define MAX_CDS_RDATA_TEXT_SIZE DNS_RDATA_MAXLENGTH * 2
@@ -383,18 +367,17 @@ formatset(dns_rdataset_t *rdataset) {
 
 	isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
 	result = dns_master_rdatasettotext(name, rdataset, style, NULL, buf);
-	dns_master_styledestroy(&style, mctx);
 
 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
 		result = ISC_R_NOSPACE;
 	}
 
-	if (result != ISC_R_SUCCESS) {
-		isc_buffer_free(&buf);
-		check_result(result, "dns_rdataset_totext()");
-	}
+	check_result(result, "dns_rdataset_totext()");
 
 	isc_buffer_putuint8(buf, 0);
+
+	dns_master_styledestroy(&style, mctx);
+
 	return (buf);
 }
 
@@ -437,7 +420,6 @@ write_parent_set(const char *path, const char *inplace, bool nsupdate,
 
 	result = isc_file_openunique(tmpname, &fp);
 	if (result != ISC_R_SUCCESS) {
-		isc_buffer_free(&buf);
 		fatal("open %s: %s", tmpname, isc_result_totext(result));
 	}
 	fprintf(fp, "%s", (char *)r.base);
@@ -532,22 +514,23 @@ static keyinfo_t *
 match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		   strictness_t strictness) {
 	isc_result_t result;
-	keyinfo_t *keytable, *ki;
+	keyinfo_t *keytable;
 	int i;
 
 	nkey = dns_rdataset_count(keyset);
 
-	keytable = isc_mem_cget(mctx, nkey, sizeof(keytable[0]));
+	keytable = isc_mem_get(mctx, sizeof(keyinfo_t) * nkey);
 
-	for (result = dns_rdataset_first(keyset), i = 0, ki = keytable;
-	     result == ISC_R_SUCCESS;
-	     result = dns_rdataset_next(keyset), i++, ki++)
+	for (result = dns_rdataset_first(keyset), i = 0;
+	     result == ISC_R_SUCCESS; result = dns_rdataset_next(keyset), i++)
 	{
+		keyinfo_t *ki;
 		dns_rdata_dnskey_t dnskey;
 		dns_rdata_t *keyrdata;
 		isc_region_t r;
 
 		INSIST(i < nkey);
+		ki = &keytable[i];
 		keyrdata = &ki->rdata;
 
 		dns_rdata_init(keyrdata);
@@ -585,15 +568,14 @@ free_keytable(keyinfo_t **keytable_p) {
 	keyinfo_t *ki;
 	int i;
 
-	REQUIRE(keytable != NULL);
-
-	for (i = 0, ki = keytable; i < nkey; i++, ki++) {
+	for (i = 0; i < nkey; i++) {
+		ki = &keytable[i];
 		if (ki->dst != NULL) {
 			dst_key_free(&ki->dst);
 		}
 	}
 
-	isc_mem_cput(mctx, keytable, nkey, sizeof(keytable[0]));
+	isc_mem_put(mctx, keytable, sizeof(keyinfo_t) * nkey);
 }
 
 /*
@@ -612,9 +594,8 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	dns_secalg_t *algo;
 	int i;
 
-	REQUIRE(keytbl != NULL);
-
-	algo = isc_mem_cget(mctx, nkey, sizeof(algo[0]));
+	algo = isc_mem_get(mctx, nkey);
+	memset(algo, 0, nkey);
 
 	for (result = dns_rdataset_first(sigset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(sigset))
@@ -655,8 +636,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 						   NULL);
 
 			if (result != ISC_R_SUCCESS &&
-			    result != DNS_R_FROMWILDCARD)
-			{
+			    result != DNS_R_FROMWILDCARD) {
 				vbprintf(1,
 					 "skip RRSIG by key %d:"
 					 " verification failed: %s\n",
@@ -697,7 +677,7 @@ signed_loose(dns_secalg_t *algo) {
 			ok = true;
 		}
 	}
-	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
+	isc_mem_put(mctx, algo, nkey);
 	return (ok);
 }
 
@@ -739,7 +719,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 		}
 	}
 
-	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
+	isc_mem_put(mctx, algo, nkey);
 	return (all_ok);
 }
 
@@ -818,7 +798,6 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 			isc_mem_put(mctx, ds, sizeof(*ds));
 			return (result);
 		default:
-			isc_mem_put(mctx, ds, sizeof(*ds));
 			check_result(result, "ds_from_rdata()");
 		}
 	}
@@ -829,13 +808,12 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 static void
 make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,
 		dns_rdataset_t *crdset) {
+	isc_result_t result;
+	dns_rdatalist_t *dslist;
 	unsigned int size = 16;
+	unsigned i, n;
 
 	for (;;) {
-		isc_result_t result = ISC_R_SUCCESS;
-		dns_rdatalist_t *dslist = NULL;
-		size_t n;
-
 		dslist = isc_mem_get(mctx, sizeof(*dslist));
 		dns_rdatalist_init(dslist);
 		dslist->rdclass = rdclass;
@@ -843,12 +821,13 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,
 		dslist->ttl = ttl;
 
 		dns_rdataset_init(&new_ds_set);
-		dns_rdatalist_tordataset(dslist, &new_ds_set);
+		result = dns_rdatalist_tordataset(dslist, &new_ds_set);
+		check_result(result, "dns_rdatalist_tordataset(dslist)");
 
 		isc_buffer_allocate(mctx, &new_ds_buf, size);
 
 		n = sizeof(dtype) / sizeof(dtype[0]);
-		for (size_t i = 0; i < n && dtype[i] != 0; i++) {
+		for (i = 0; i < n && dtype[i] != 0; i++) {
 			result = append_new_ds_set(ds_from_rdata, new_ds_buf,
 						   dslist, dtype[i], crdset);
 			if (result != ISC_R_SUCCESS) {
@@ -894,7 +873,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 
 	n = dns_rdataset_count(dsset);
 
-	arrdata = isc_mem_cget(mctx, n, sizeof(dns_rdata_t));
+	arrdata = isc_mem_get(mctx, n * sizeof(dns_rdata_t));
 
 	for (result = dns_rdataset_first(dsset), i = 0; result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(dsset), i++)
@@ -908,7 +887,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	/*
 	 * Convert sorted arrdata to more accessible format
 	 */
-	ds = isc_mem_cget(mctx, n, sizeof(dns_rdata_ds_t));
+	ds = isc_mem_get(mctx, n * sizeof(dns_rdata_ds_t));
 
 	for (i = 0; i < n; i++) {
 		result = dns_rdata_tostruct(&arrdata[i], &ds[i], NULL);
@@ -947,8 +926,8 @@ consistent_digests(dns_rdataset_t *dsset) {
 	/*
 	 * Done!
 	 */
-	isc_mem_cput(mctx, ds, n, sizeof(dns_rdata_ds_t));
-	isc_mem_cput(mctx, arrdata, n, sizeof(dns_rdata_t));
+	isc_mem_put(mctx, ds, n * sizeof(dns_rdata_ds_t));
+	isc_mem_put(mctx, arrdata, n * sizeof(dns_rdata_t));
 
 	return (match);
 }
@@ -976,27 +955,32 @@ static void
 update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 	    dns_rdataset_t *delset) {
 	isc_result_t result;
+	dns_db_t *db;
+	dns_dbnode_t *node;
+	dns_dbversion_t *ver;
 	dns_rdataset_t diffset;
 	uint32_t save;
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &update_db);
+	db = NULL;
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &db);
 	check_result(result, "dns_db_create()");
 
-	result = dns_db_newversion(update_db, &update_version);
+	ver = NULL;
+	result = dns_db_newversion(db, &ver);
 	check_result(result, "dns_db_newversion()");
 
-	result = dns_db_findnode(update_db, name, true, &update_node);
+	node = NULL;
+	result = dns_db_findnode(db, name, true, &node);
 	check_result(result, "dns_db_findnode()");
 
 	dns_rdataset_init(&diffset);
 
-	result = dns_db_addrdataset(update_db, update_node, update_version, 0,
-				    addset, DNS_DBADD_MERGE, NULL);
+	result = dns_db_addrdataset(db, node, ver, 0, addset, DNS_DBADD_MERGE,
+				    NULL);
 	check_result(result, "dns_db_addrdataset()");
 
-	result = dns_db_subtractrdataset(update_db, update_node, update_version,
-					 delset, 0, &diffset);
+	result = dns_db_subtractrdataset(db, node, ver, delset, 0, &diffset);
 	if (result == DNS_R_UNCHANGED) {
 		save = addset->ttl;
 		addset->ttl = ttl;
@@ -1009,7 +993,9 @@ update_diff(const char *cmd, uint32_t ttl, dns_rdataset_t *addset,
 		dns_rdataset_disassociate(&diffset);
 	}
 
-	free_db(&update_db, &update_node, &update_version);
+	dns_db_detachnode(db, &node);
+	dns_db_closeversion(db, &ver, false);
+	dns_db_detach(&db);
 }
 
 static void
@@ -1056,33 +1042,7 @@ usage(void) {
 			"    -T <ttl>           TTL of DS records\n"
 			"    -V                 print version\n"
 			"    -v <verbosity>\n");
-	exit(EXIT_FAILURE);
-}
-
-static void
-cleanup(void) {
-	free_db(&child_db, &child_node, NULL);
-	free_db(&parent_db, &parent_node, NULL);
-	free_db(&update_db, &update_node, &update_version);
-	if (old_key_tbl != NULL) {
-		free_keytable(&old_key_tbl);
-	}
-	if (new_key_tbl != NULL) {
-		free_keytable(&new_key_tbl);
-	}
-	free_all_sets();
-	if (lctx != NULL) {
-		cleanup_logging(&lctx);
-	}
-	if (cleanup_dst) {
-		dst_lib_destroy();
-	}
-	if (mctx != NULL) {
-		if (print_mem_stats && verbose > 10) {
-			isc_mem_stats(mctx, stdout);
-		}
-		isc_mem_destroy(&mctx);
-	}
+	exit(1);
 }
 
 int
@@ -1097,8 +1057,6 @@ main(int argc, char *argv[]) {
 	int ch;
 	char *endp;
 
-	setfatalcallback(cleanup);
-
 	isc_mem_create(&mctx);
 
 	isc_commandline_errprint = false;
@@ -1127,8 +1085,7 @@ main(int argc, char *argv[]) {
 			 * optional, so that it works just like sed(1).
 			 */
 			if (isc_commandline_argument ==
-			    argv[isc_commandline_index - 1])
-			{
+			    argv[isc_commandline_index - 1]) {
 				isc_commandline_index--;
 				inplace = "";
 			} else {
@@ -1185,7 +1142,6 @@ main(int argc, char *argv[]) {
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 	}
-	cleanup_dst = true;
 
 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1221,8 +1177,7 @@ main(int argc, char *argv[]) {
 		fatal("missing RRSIG CDNSKEY records for %s", namestr);
 	}
 	if (dns_rdataset_isassociated(&cds_set) &&
-	    !dns_rdataset_isassociated(&cds_sig))
-	{
+	    !dns_rdataset_isassociated(&cds_sig)) {
 		fatal("missing RRSIG CDS records for %s", namestr);
 	}
 
@@ -1245,8 +1200,7 @@ main(int argc, char *argv[]) {
 	if (dns_rdataset_isassociated(&cdnskey_set)) {
 		vbprintf(1, "verify CDNSKEY signature(s)\n");
 		if (!signed_loose(matching_sigs(old_key_tbl, &cdnskey_set,
-						&cdnskey_sig)))
-		{
+						&cdnskey_sig))) {
 			fatal("could not validate child CDNSKEY RRset for %s",
 			      namestr);
 		}
@@ -1254,8 +1208,7 @@ main(int argc, char *argv[]) {
 	if (dns_rdataset_isassociated(&cds_set)) {
 		vbprintf(1, "verify CDS signature(s)\n");
 		if (!signed_loose(
-			    matching_sigs(old_key_tbl, &cds_set, &cds_sig)))
-		{
+			    matching_sigs(old_key_tbl, &cds_set, &cds_sig))) {
 			fatal("could not validate child CDS RRset for %s",
 			      namestr);
 		}
@@ -1285,7 +1238,7 @@ main(int argc, char *argv[]) {
 		vbprintf(1, "%s has neither CDS nor CDNSKEY records\n",
 			 namestr);
 		write_parent_set(ds_path, inplace, nsupdate, &old_ds_set);
-		goto cleanup;
+		exit(0);
 	}
 
 	/*
@@ -1351,9 +1304,13 @@ main(int argc, char *argv[]) {
 
 	write_parent_set(ds_path, inplace, nsupdate, &new_ds_set);
 
-cleanup:
-	print_mem_stats = true;
-	cleanup();
+	free_all_sets();
+	cleanup_logging(&lctx);
+	dst_lib_destroy();
+	if (verbose > 10) {
+		isc_mem_stats(mctx, stdout);
+	}
+	isc_mem_destroy(&mctx);
 
-	return (0);
+	exit(0);
 }

bin/dnssec/dnssec-dsfromkey.c

@@ -23,6 +23,7 @@
 #include <isc/dir.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -100,8 +101,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 
 	dns_name_format(name, setname, sizeof(setname));
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &db);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't create database");
 	}
@@ -274,7 +275,7 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
 		fatal("can't build record");
 	}
 
-	result = dns_name_totext(name, 0, &nameb);
+	result = dns_name_totext(name, false, &nameb);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't print name");
 	}
@@ -313,7 +314,7 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
 
 static void
 emits(bool showall, bool cds, dns_rdata_t *rdata) {
-	unsigned int i, n;
+	unsigned i, n;
 
 	n = sizeof(dtype) / sizeof(dtype[0]);
 	for (i = 0; i < n; i++) {
@@ -353,7 +354,7 @@ usage(void) {
 			"    -V: print version information\n");
 	fprintf(stderr, "Output: DS or CDS RRs\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -452,7 +453,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 

bin/dnssec/dnssec-importkey.c

@@ -21,6 +21,7 @@
 #include <isc/commandline.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -103,8 +104,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 
 	dns_name_format(name, setname, sizeof(setname));
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, &db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, &db);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't create database");
 	}
@@ -289,7 +290,7 @@ usage(void) {
 	fprintf(stderr, "    -D sync date/[+-]offset/none: set/unset "
 			"CDS and CDNSKEY deletion date\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -302,9 +303,10 @@ main(int argc, char **argv) {
 	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;
-	isc_stdtime_t now = isc_stdtime_now();
+	isc_stdtime_t now;
 
 	dns_rdata_init(&rdata);
+	isc_stdtime_get(&now);
 
 	if (argc == 1) {
 		usage();
@@ -395,7 +397,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 

bin/dnssec/dnssec-keyfromlabel.c

@@ -22,6 +22,7 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -56,7 +57,7 @@ usage(void) {
 	fprintf(stderr, "    name: owner of the key\n");
 	fprintf(stderr, "Other options:\n");
 	fprintf(stderr, "    -a algorithm: \n"
-			"        RSASHA1 |\n"
+			"        DH | RSASHA1 |\n"
 			"        NSEC3RSASHA1 |\n"
 			"        RSASHA256 | RSASHA512 |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384 |\n"
@@ -102,7 +103,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<id>.key, "
 			"K<name>+<alg>+<id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -135,6 +136,7 @@ main(int argc, char **argv) {
 	dns_ttl_t ttl = 0;
 	isc_stdtime_t publish = 0, activate = 0, revoke = 0;
 	isc_stdtime_t inactive = 0, deltime = 0;
+	isc_stdtime_t now;
 	int prepub = -1;
 	bool setpub = false, setact = false;
 	bool setrev = false, setinact = false;
@@ -150,7 +152,6 @@ main(int argc, char **argv) {
 	isc_stdtime_t syncadd = 0, syncdel = 0;
 	bool unsetsyncadd = false, setsyncadd = false;
 	bool unsetsyncdel = false, setsyncdel = false;
-	isc_stdtime_t now = isc_stdtime_now();
 
 	if (argc == 1) {
 		usage();
@@ -160,6 +161,8 @@ main(int argc, char **argv) {
 
 	isc_commandline_errprint = false;
 
+	isc_stdtime_get(&now);
+
 #define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -331,7 +334,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -385,6 +388,9 @@ main(int argc, char **argv) {
 		if (ret != ISC_R_SUCCESS) {
 			fatal("unknown algorithm %s", algname);
 		}
+		if (alg == DST_ALG_DH) {
+			options |= DST_TYPE_KEY;
+		}
 
 		if (use_nsec3) {
 			switch (alg) {
@@ -553,8 +559,7 @@ main(int argc, char **argv) {
 		flags |= DNS_KEYOWNER_ZONE;
 	} else if ((options & DST_TYPE_KEY) != 0) { /* KEY */
 		if (strcasecmp(nametype, "host") == 0 ||
-		    strcasecmp(nametype, "entity") == 0)
-		{
+		    strcasecmp(nametype, "entity") == 0) {
 			flags |= DNS_KEYOWNER_ENTITY;
 		} else if (strcasecmp(nametype, "user") == 0) {
 			flags |= DNS_KEYOWNER_USER;
@@ -581,8 +586,7 @@ main(int argc, char **argv) {
 	if (protocol == -1) {
 		protocol = DNS_KEYPROTO_DNSSEC;
 	} else if ((options & DST_TYPE_KEY) == 0 &&
-		   protocol != DNS_KEYPROTO_DNSSEC)
-	{
+		   protocol != DNS_KEYPROTO_DNSSEC) {
 		fatal("invalid DNSKEY protocol: %d", protocol);
 	}
 
@@ -592,6 +596,13 @@ main(int argc, char **argv) {
 		}
 	}
 
+	if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
+	    alg == DNS_KEYALG_DH)
+	{
+		fatal("a key with algorithm '%s' cannot be a zone key",
+		      algname);
+	}
+
 	isc_buffer_init(&buf, filename, sizeof(filename) - 1);
 
 	/* associate the key */
@@ -606,7 +617,7 @@ main(int argc, char **argv) {
 		fatal("failed to get key %s/%s: %s", namestr, algstr,
 		      isc_result_totext(ret));
 		UNREACHABLE();
-		exit(EXIT_FAILURE);
+		exit(-1);
 	}
 
 	/*

bin/dnssec/dnssec-keygen.c

@@ -33,13 +33,11 @@
 #include <stdlib.h>
 #include <unistd.h>
 
-#include <openssl/opensslv.h>
-
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/fips.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -60,25 +58,13 @@
 #include <isccfg/grammar.h>
 #include <isccfg/kaspconf.h>
 #include <isccfg/namedconf.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif
 
 #include "dnssectool.h"
 
 #define MAX_RSA 4096 /* should be long enough... */
-#define MAX_DH	4096 /* should be long enough... */
 
 const char *program = "dnssec-keygen";
 
-/*
- * These are are set here for backwards compatibility.  They are
- * raised to 2048 in FIPS mode.
- */
-static int min_rsa = 1024;
-static int min_dh = 128;
-
 isc_log_t *lctx = NULL;
 
 noreturn static void
@@ -92,10 +78,10 @@ struct keygen_ctx {
 	const char *policy;
 	const char *configfile;
 	const char *directory;
-	dns_keystore_t *keystore;
 	char *algname;
 	char *nametype;
 	char *type;
+	int generator;
 	int protocol;
 	int size;
 	int signatory;
@@ -155,22 +141,17 @@ usage(void) {
 	fprintf(stderr, "    -l <file>: configuration file with dnssec-policy "
 			"statement\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	if (!isc_fips_mode()) {
-		fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
-	}
+	fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
-	fprintf(stderr, "        ED25519 | ED448\n");
+	fprintf(stderr, "        ED25519 | ED448 | DH\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	if (!isc_fips_mode()) {
-		fprintf(stderr, "        RSASHA1:\t[%d..%d]\n", min_rsa,
-			MAX_RSA);
-		fprintf(stderr, "        NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
-			MAX_RSA);
-	}
-	fprintf(stderr, "        RSASHA256:\t[%d..%d]\n", min_rsa, MAX_RSA);
-	fprintf(stderr, "        RSASHA512:\t[%d..%d]\n", min_rsa, MAX_RSA);
+	fprintf(stderr, "        RSASHA1:\t[1024..%d]\n", MAX_RSA);
+	fprintf(stderr, "        NSEC3RSASHA1:\t[1024..%d]\n", MAX_RSA);
+	fprintf(stderr, "        RSASHA256:\t[1024..%d]\n", MAX_RSA);
+	fprintf(stderr, "        RSASHA512:\t[1024..%d]\n", MAX_RSA);
+	fprintf(stderr, "        DH:\t\t[128..4096]\n");
 	fprintf(stderr, "        ECDSAP256SHA256:\tignored\n");
 	fprintf(stderr, "        ECDSAP384SHA384:\tignored\n");
 	fprintf(stderr, "        ED25519:\tignored\n");
@@ -185,7 +166,8 @@ usage(void) {
 	fprintf(stderr, "    -E <engine>:\n");
 	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -f <keyflag>: KSK | REVOKE\n");
-	fprintf(stderr, "    -F: FIPS mode\n");
+	fprintf(stderr, "    -g <generator>: use specified generator "
+			"(DH only)\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
@@ -227,7 +209,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<id>.key, "
 			"K<name>+<alg>+<id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 static void
@@ -256,42 +238,14 @@ progress(int p) {
 
 static void
 kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
-	       const char *keydir, const char *engine, dns_kasp_t **kaspp) {
-	isc_result_t result = ISC_R_NOTFOUND;
+	       dns_kasp_t **kaspp) {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *kasps = NULL;
 	dns_kasp_t *kasp = NULL, *kasp_next;
+	isc_result_t result = ISC_R_NOTFOUND;
 	dns_kasplist_t kasplist;
-	const cfg_obj_t *keystores = NULL;
-	dns_keystore_t *ks = NULL, *ks_next;
-	dns_keystorelist_t kslist;
 
 	ISC_LIST_INIT(kasplist);
-	ISC_LIST_INIT(kslist);
-
-	(void)cfg_map_get(config, "key-store", &keystores);
-	for (element = cfg_list_first(keystores); element != NULL;
-	     element = cfg_list_next(element))
-	{
-		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		ks = NULL;
-		result = cfg_keystore_fromconfig(kconfig, mctx, lctx, engine,
-						 &kslist, NULL);
-		if (result != ISC_R_SUCCESS) {
-			fatal("failed to configure key-store '%s': %s",
-			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			      isc_result_totext(result));
-		}
-	}
-	/* Default key-directory key store. */
-	ks = NULL;
-	(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
-	INSIST(ks != NULL);
-	if (keydir != NULL) {
-		/* '-K keydir' takes priority */
-		dns_keystore_setdirectory(ks, keydir);
-	}
-	dns_keystore_detach(&ks);
 
 	(void)cfg_map_get(config, "dnssec-policy", &kasps);
 	for (element = cfg_list_first(kasps); element != NULL;
@@ -300,13 +254,12 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 		kasp = NULL;
 		if (strcmp(cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
-			   name) != 0)
-		{
+			   name) != 0) {
 			continue;
 		}
 
-		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
-					     &kslist, &kasplist, &kasp);
+		result = cfg_kasp_fromconfig(kconfig, NULL, mctx, lctx,
+					     &kasplist, &kasp);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure dnssec-policy '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -327,15 +280,6 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 		ISC_LIST_UNLINK(kasplist, kasp, link);
 		dns_kasp_detach(&kasp);
 	}
-
-	/*
-	 * Cleanup keystore list.
-	 */
-	for (ks = ISC_LIST_HEAD(kslist); ks != NULL; ks = ks_next) {
-		ks_next = ISC_LIST_NEXT(ks, link);
-		ISC_LIST_UNLINK(kslist, ks, link);
-		dns_keystore_detach(&ks);
-	}
 }
 
 static void
@@ -378,15 +322,8 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			fatal("unsupported algorithm: %s", algstr);
 		}
 
-		if (isc_fips_mode()) {
-			/* verify only in FIPS mode */
-			switch (ctx->alg) {
-			case DST_ALG_RSASHA1:
-			case DST_ALG_NSEC3RSASHA1:
-				fatal("unsupported algorithm: %s", algstr);
-			default:
-				break;
-			}
+		if (ctx->alg == DST_ALG_DH) {
+			ctx->options |= DST_TYPE_KEY;
 		}
 
 		if (ctx->use_nsec3) {
@@ -431,11 +368,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
 			case DST_ALG_NSEC3RSASHA1:
-				if (isc_fips_mode()) {
-					fatal("key size not specified (-b "
-					      "option)");
-				}
-				FALLTHROUGH;
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:
 				ctx->size = 2048;
@@ -459,8 +391,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 
 		if (!ctx->oldstyle && ctx->prepub > 0) {
 			if (ctx->setpub && ctx->setact &&
-			    (ctx->activate - ctx->prepub) < ctx->publish)
-			{
+			    (ctx->activate - ctx->prepub) < ctx->publish) {
 				fatal("Activation and publication dates "
 				      "are closer together than the\n\t"
 				      "prepublication interval.");
@@ -591,18 +522,23 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
-		if (isc_fips_mode()) {
-			fatal("SHA1 based keys not supported in FIPS mode");
-		}
-		FALLTHROUGH;
 	case DNS_KEYALG_RSASHA256:
-	case DNS_KEYALG_RSASHA512:
-		if (ctx->size != 0 &&
-		    (ctx->size < min_rsa || ctx->size > MAX_RSA))
+		if (ctx->size != 0 && (ctx->size < 1024 || ctx->size > MAX_RSA))
 		{
 			fatal("RSA key size %d out of range", ctx->size);
 		}
 		break;
+	case DNS_KEYALG_RSASHA512:
+		if (ctx->size != 0 && (ctx->size < 1024 || ctx->size > MAX_RSA))
+		{
+			fatal("RSA key size %d out of range", ctx->size);
+		}
+		break;
+	case DNS_KEYALG_DH:
+		if (ctx->size != 0 && (ctx->size < 128 || ctx->size > 4096)) {
+			fatal("DH key size %d out of range", ctx->size);
+		}
+		break;
 	case DST_ALG_ECDSA256:
 		ctx->size = 256;
 		break;
@@ -617,6 +553,10 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		break;
 	}
 
+	if (ctx->alg != DNS_KEYALG_DH && ctx->generator != 0) {
+		fatal("specified DH generator for a non-DH key");
+	}
+
 	if (ctx->nametype == NULL) {
 		if ((ctx->options & DST_TYPE_KEY) != 0) { /* KEY */
 			fatal("no nametype specified");
@@ -666,6 +606,12 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		}
 	}
 
+	if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
+	    ctx->alg == DNS_KEYALG_DH)
+	{
+		fatal("a key with algorithm %s cannot be a zone key", algstr);
+	}
+
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
@@ -674,6 +620,10 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		show_progress = true;
 		break;
 
+	case DNS_KEYALG_DH:
+		param = ctx->generator;
+		break;
+
 	case DST_ALG_ECDSA256:
 	case DST_ALG_ECDSA384:
 	case DST_ALG_ED25519:
@@ -693,27 +643,16 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 
 		if (!ctx->quiet && show_progress) {
 			fprintf(stderr, "Generating key pair.");
-		}
-
-		if (ctx->keystore != NULL && ctx->policy != NULL) {
-			ret = dns_keystore_keygen(
-				ctx->keystore, name, ctx->policy, ctx->rdclass,
-				mctx, ctx->alg, ctx->size, flags, &key);
-		} else if (!ctx->quiet && show_progress) {
 			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
 					       flags, ctx->protocol,
-					       ctx->rdclass, NULL, mctx, &key,
+					       ctx->rdclass, mctx, &key,
 					       &progress);
+			putc('\n', stderr);
+			fflush(stderr);
 		} else {
 			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
 					       flags, ctx->protocol,
-					       ctx->rdclass, NULL, mctx, &key,
-					       NULL);
-		}
-
-		if (!ctx->quiet && show_progress) {
-			putc('\n', stderr);
-			fflush(stderr);
+					       ctx->rdclass, mctx, &key, NULL);
 		}
 
 		if (ret != ISC_R_SUCCESS) {
@@ -788,8 +727,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 
 			if (ctx->setdel) {
 				if (ctx->setinact &&
-				    ctx->deltime < ctx->inactive)
-				{
+				    ctx->deltime < ctx->inactive) {
 					fprintf(stderr,
 						"%s: warning: Key is "
 						"scheduled to be deleted "
@@ -909,18 +847,6 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	}
 }
 
-static void
-check_keystore_options(keygen_ctx_t *ctx) {
-	ctx->directory = dns_keystore_directory(ctx->keystore, NULL);
-	if (ctx->directory != NULL) {
-		isc_result_t ret = try_dir(ctx->directory);
-		if (ret != ISC_R_SUCCESS) {
-			fatal("cannot open directory %s: %s", ctx->directory,
-			      isc_result_totext(ret));
-		}
-	}
-}
-
 int
 main(int argc, char **argv) {
 	char *algname = NULL, *freeit = NULL;
@@ -932,17 +858,12 @@ main(int argc, char **argv) {
 	const char *engine = NULL;
 	unsigned char c;
 	int ch;
-	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-	OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif
 
 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
 		.prepub = -1,
 		.protocol = -1,
 		.size = -1,
-		.now = isc_stdtime_now(),
 	};
 
 	if (argc == 1) {
@@ -954,8 +875,8 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS                                        \
-	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
+#define CMDLINE_FLAGS                                           \
+	"3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
 	"T:t:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -980,6 +901,7 @@ main(int argc, char **argv) {
 	isc_commandline_reset = true;
 
 	isc_mem_create(&mctx);
+	isc_stdtime_get(&ctx.now);
 
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -1010,6 +932,10 @@ main(int argc, char **argv) {
 		case 'E':
 			engine = isc_commandline_argument;
 			break;
+		case 'e':
+			fprintf(stderr, "phased-out option -e "
+					"(was 'use (RSA) large exponent')\n");
+			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
 			if (toupper(c) == 'K') {
@@ -1021,6 +947,13 @@ main(int argc, char **argv) {
 				      isc_commandline_argument);
 			}
 			break;
+		case 'g':
+			ctx.generator = strtol(isc_commandline_argument, &endp,
+					       10);
+			if (*endp != '\0' || ctx.generator <= 0) {
+				fatal("-g requires a positive number");
+			}
+			break;
 		case 'K':
 			ctx.directory = isc_commandline_argument;
 			ret = try_dir(ctx.directory);
@@ -1048,8 +981,7 @@ main(int argc, char **argv) {
 			ctx.protocol = strtol(isc_commandline_argument, &endp,
 					      10);
 			if (*endp != '\0' || ctx.protocol < 0 ||
-			    ctx.protocol > 255)
-			{
+			    ctx.protocol > 255) {
 				fatal("-p must be followed by a number "
 				      "[0..255]");
 			}
@@ -1065,8 +997,7 @@ main(int argc, char **argv) {
 			ctx.signatory = strtol(isc_commandline_argument, &endp,
 					       10);
 			if (*endp != '\0' || ctx.signatory < 0 ||
-			    ctx.signatory > 15)
-			{
+			    ctx.signatory > 15) {
 				fatal("-s must be followed by a number "
 				      "[0..15]");
 			}
@@ -1177,8 +1108,8 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-			set_fips_mode = true;
-			break;
+			/* Reserved for FIPS mode */
+			FALLTHROUGH;
 		case '?':
 			if (isc_commandline_option != '?') {
 				fprintf(stderr, "%s: invalid argument -%c\n",
@@ -1196,7 +1127,7 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -1204,40 +1135,11 @@ main(int argc, char **argv) {
 		ctx.quiet = true;
 	}
 
-	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-		fips = OSSL_PROVIDER_load(NULL, "fips");
-		if (fips == NULL) {
-			ERR_clear_error();
-			fatal("Failed to load FIPS provider");
-		}
-		base = OSSL_PROVIDER_load(NULL, "base");
-		if (base == NULL) {
-			OSSL_PROVIDER_unload(fips);
-			ERR_clear_error();
-			fatal("Failed to load base provider");
-		}
-#endif
-		if (!isc_fips_mode()) {
-			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
-		}
-	}
-
 	ret = dst_lib_init(mctx, engine);
 	if (ret != ISC_R_SUCCESS) {
 		fatal("could not initialize dst: %s", isc_result_totext(ret));
 	}
 
-	/*
-	 * After dst_lib_init which will set FIPS mode if requested
-	 * at build time.  The minumums are both raised to 2048.
-	 */
-	if (isc_fips_mode()) {
-		min_rsa = min_dh = 2048;
-	}
-
 	setup_logging(mctx, &lctx);
 
 	ctx.rdclass = strtoclass(classname);
@@ -1330,8 +1232,7 @@ main(int argc, char **argv) {
 				      ctx.policy, ctx.configfile);
 			}
 
-			kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
-				       engine, &kasp);
+			kasp_from_conf(config, mctx, ctx.policy, &kasp);
 			if (kasp == NULL) {
 				fatal("failed to load dnssec-policy '%s'",
 				      ctx.policy);
@@ -1357,10 +1258,7 @@ main(int argc, char **argv) {
 				ctx.ksk = dns_kasp_key_ksk(kaspkey);
 				ctx.zsk = dns_kasp_key_zsk(kaspkey);
 				ctx.lifetime = dns_kasp_key_lifetime(kaspkey);
-				ctx.keystore = dns_kasp_key_keystore(kaspkey);
-				if (ctx.keystore != NULL) {
-					check_keystore_options(&ctx);
-				}
+
 				keygen(&ctx, mctx, argc, argv);
 
 				kaspkey = ISC_LIST_NEXT(kaspkey, link);
@@ -1381,14 +1279,6 @@ main(int argc, char **argv) {
 	}
 	isc_mem_destroy(&mctx);
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
 	if (freeit != NULL) {
 		free(freeit);
 	}

bin/dnssec/dnssec-keygen.rst

@@ -21,13 +21,15 @@ dnssec-keygen: DNSSEC key generation tool
 Synopsis
 ~~~~~~~~
 
-:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
+:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-G**] [**-g** generator] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
 
 Description
 ~~~~~~~~~~~
 
 :program:`dnssec-keygen` generates keys for DNSSEC (Secure DNS), as defined in
-:rfc:`2535` and :rfc:`4034`.
+:rfc:`2535` and :rfc:`4034`. It can also generate keys for use with TSIG
+(Transaction Signatures) as defined in :rfc:`2845`, or TKEY (Transaction
+Key) as defined in :rfc:`2930`.
 
 The ``name`` of the key is specified on the command line. For DNSSEC
 keys, this must match the name of the zone for which the key is being
@@ -47,7 +49,9 @@ Options
 
    This option selects the cryptographic algorithm. For DNSSEC keys, the value of
    ``algorithm`` must be one of RSASHA1, NSEC3RSASHA1, RSASHA256,
-   RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
+   RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448. For
+   TKEY, the value must be DH (Diffie-Hellman); specifying this value
+   automatically sets the :option:`-T KEY <-T>` option as well.
 
    These values are case-insensitive. In some cases, abbreviations are
    supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
@@ -107,17 +111,17 @@ Options
    This option sets the specified flag in the flag field of the KEY/DNSKEY record.
    The only recognized flags are KSK (Key-Signing Key) and REVOKE.
 
-.. option:: -F
-
-   This options turns on FIPS (US Federal Information Processing Standards)
-   mode if the underlying crytographic library supports running in FIPS
-   mode.
-
 .. option:: -G
 
    This option generates a key, but does not publish it or sign with it. This option is
    incompatible with :option:`-P` and :option:`-A`.
 
+.. option:: -g generator
+
+   This option indicates the generator to use if generating a Diffie-Hellman key. Allowed
+   values are 2 and 5. If no generator is specified, a known prime from
+   :rfc:`2539` is used if possible; otherwise the default is 2.
+
 .. option:: -h
 
    This option prints a short summary of the options and arguments to

bin/dnssec/dnssec-revoke.c

@@ -24,6 +24,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -58,7 +59,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
 			"K<name>+<alg>+<new id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 int
@@ -130,13 +131,12 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
 	if (argc < isc_commandline_index + 1 ||
-	    argv[isc_commandline_index] == NULL)
-	{
+	    argv[isc_commandline_index] == NULL) {
 		fatal("The key file name was not specified");
 	}
 	if (argc > isc_commandline_index + 1) {
@@ -190,7 +190,7 @@ main(int argc, char **argv) {
 
 	flags = dst_key_flags(key);
 	if ((flags & DNS_KEYFLAG_REVOKE) == 0) {
-		isc_stdtime_t now = isc_stdtime_now();
+		isc_stdtime_t now;
 
 		if ((flags & DNS_KEYFLAG_KSK) == 0) {
 			fprintf(stderr,
@@ -200,6 +200,7 @@ main(int argc, char **argv) {
 				program);
 		}
 
+		isc_stdtime_get(&now);
 		dst_key_settime(key, DST_TIME_REVOKE, now);
 
 		dst_key_setflags(key, flags | DNS_KEYFLAG_REVOKE);

bin/dnssec/dnssec-settime.c

@@ -26,6 +26,7 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -101,7 +102,7 @@ usage(void) {
 	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
 			"K<name>+<alg>+<new id>.private\n");
 
-	exit(EXIT_FAILURE);
+	exit(-1);
 }
 
 static void
@@ -202,6 +203,7 @@ main(int argc, char **argv) {
 	int prepub = -1;
 	int options;
 	dns_ttl_t ttl = 0;
+	isc_stdtime_t now;
 	isc_stdtime_t dstime = 0, dnskeytime = 0;
 	isc_stdtime_t krrsigtime = 0, zrrsigtime = 0;
 	isc_stdtime_t pub = 0, act = 0, rev = 0, inact = 0, del = 0;
@@ -237,7 +239,6 @@ main(int argc, char **argv) {
 	bool unsetdsadd = false, setdsadd = false;
 	bool unsetdsdel = false, setdsdel = false;
 	bool printdsadd = false, printdsdel = false;
-	isc_stdtime_t now = isc_stdtime_now();
 
 	options = DST_TYPE_PUBLIC | DST_TYPE_PRIVATE | DST_TYPE_STATE;
 
@@ -251,6 +252,8 @@ main(int argc, char **argv) {
 
 	isc_commandline_errprint = false;
 
+	isc_stdtime_get(&now);
+
 #define CMDLINE_FLAGS "A:D:d:E:fg:hI:i:K:k:L:P:p:R:r:S:suv:Vz:"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -536,13 +539,12 @@ main(int argc, char **argv) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
 	if (argc < isc_commandline_index + 1 ||
-	    argv[isc_commandline_index] == NULL)
-	{
+	    argv[isc_commandline_index] == NULL) {
 		fatal("The key file name was not specified");
 	}
 	if (argc > isc_commandline_index + 1) {
@@ -550,8 +552,7 @@ main(int argc, char **argv) {
 	}
 
 	if ((setgoal || setds || setdnskey || setkrrsig || setzrrsig) &&
-	    !write_state)
-	{
+	    !write_state) {
 		fatal("Options -g, -d, -k, -r and -z require -s to be set");
 	}
 

bin/dnssec/dnssec-settime.rst

@@ -148,7 +148,7 @@ All these formats are case-insensitive.
 .. option:: -A date/offset
 
    This option sets the date on which the key is to be activated. After that date,
-   the key is included in the zone and used to sign it.
+   the key is included in the zone and used to sign it. 
 
 .. option:: -R date/offset
 

bin/dnssec/dnssec-signzone.rst

@@ -21,7 +21,7 @@ dnssec-signzone - DNSSEC zone signing tool
 Synopsis
 ~~~~~~~~
 
-:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
+:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-g**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
 
 Description
 ~~~~~~~~~~~
@@ -71,24 +71,11 @@ Options
    engine identifier that drives the cryptographic accelerator or
    hardware service module (usually ``pkcs11``).
 
-.. option:: -F
-
-   This options turns on FIPS (US Federal Information Processing Standards)
-   mode if the underlying crytographic library supports running in FIPS
-   mode.
-
 .. option:: -g
 
    This option indicates that DS records for child zones should be generated from a ``dsset-`` or ``keyset-``
    file. Existing DS records are removed.
 
-.. option:: -G sync-records
-
-   This option indicates which CDS and CDNSKEY records should be generated. ``sync-records`` is a
-   comma-separated string with the following allowed items: ``cdnskey``, and ``cds:<digest-type>``,
-   where ``digest-type`` is an allowed algorithm such as SHA-256 (2), or SHA-384 (4).
-   Only works in combination with smart signing (``-S``).
-
 .. option:: -K directory
 
    This option specifies the directory to search for DNSSEC keys. If not
@@ -359,12 +346,15 @@ Options
 .. option:: -x
 
    This option indicates that BIND 9 should only sign the DNSKEY, CDNSKEY, and CDS RRsets with key-signing keys,
-   and should omit signatures from zone-signing keys.
+   and should omit signatures from zone-signing keys. (This is similar to the
+   ``dnssec-dnskey-kskonly yes;`` zone option in :iscman:`named`.)
 
 .. option:: -z
 
    This option indicates that BIND 9 should ignore the KSK flag on keys when determining what to sign. This causes
    KSK-flagged keys to sign all records, not just the DNSKEY RRset.
+   (This is similar to the ``update-check-ksk no;`` zone option in
+   :iscman:`named`.)
 
 .. option:: -3 salt
 

bin/dnssec/dnssec-verify.c

@@ -17,15 +17,18 @@
 #include <stdlib.h>
 #include <time.h>
 
+#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
+#include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
+#include <isc/print.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/rwlock.h>
@@ -109,8 +112,8 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 		      isc_result_totext(result));
 	}
 
-	result = dns_db_create(mctx, ZONEDB_DEFAULT, name, dns_dbtype_zone,
-			       rdclass, 0, NULL, db);
+	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone, rdclass, 0,
+			       NULL, db);
 	check_result(result, "dns_db_create()");
 
 	result = dns_db_load(*db, file, inputformat, 0);
@@ -162,7 +165,7 @@ usage(void) {
 	fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
 			"not ZSKs\n");
 	fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
-	exit(EXIT_SUCCESS);
+	exit(0);
 }
 
 int
@@ -203,6 +206,7 @@ main(int argc, char *argv[]) {
 		}
 	}
 	isc_commandline_reset = true;
+	check_result(isc_app_start(), "isc_app_start");
 
 	isc_mem_create(&mctx);
 
@@ -271,7 +275,7 @@ main(int argc, char *argv[]) {
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n", program,
 				isc_commandline_option);
-			exit(EXIT_FAILURE);
+			exit(1);
 		}
 	}
 
@@ -281,7 +285,7 @@ main(int argc, char *argv[]) {
 		      isc_result_totext(result));
 	}
 
-	now = isc_stdtime_now();
+	isc_stdtime_get(&now);
 
 	rdclass = strtoclass(classname);
 
@@ -342,5 +346,7 @@ main(int argc, char *argv[]) {
 	}
 	isc_mem_destroy(&mctx);
 
+	(void)isc_app_finish();
+
 	return (result == ISC_R_SUCCESS ? 0 : 1);
 }

bin/dnssec/dnssectool.c

@@ -20,7 +20,6 @@
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
-#include <unistd.h>
 
 #include <isc/base32.h>
 #include <isc/buffer.h>
@@ -30,10 +29,10 @@
 #include <isc/heap.h>
 #include <isc/list.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/time.h>
-#include <isc/tls.h>
 #include <isc/tm.h>
 #include <isc/util.h>
 
@@ -84,7 +83,7 @@ fatal(const char *format, ...) {
 	if (fatalcallback != NULL) {
 		(*fatalcallback)();
 	}
-	_exit(EXIT_FAILURE);
+	exit(1);
 }
 
 void
@@ -114,7 +113,7 @@ vbprintf(int level, const char *fmt, ...) {
 void
 version(const char *name) {
 	printf("%s %s\n", name, PACKAGE_VERSION);
-	exit(EXIT_SUCCESS);
+	exit(0);
 }
 
 void
@@ -291,11 +290,15 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	struct tm tm;
 
 	if (isnone(str)) {
-		SET_IF_NOT_NULL(setp, false);
+		if (setp != NULL) {
+			*setp = false;
+		}
 		return ((isc_stdtime_t)0);
 	}
 
-	SET_IF_NOT_NULL(setp, true);
+	if (setp != NULL) {
+		*setp = true;
+	}
 
 	if ((str[0] == '0' || str[0] == '-') && str[1] == '\0') {
 		return ((isc_stdtime_t)0);
@@ -312,8 +315,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	 */
 	n = strspn(str, "0123456789");
 	if ((n == 8u || n == 14u) &&
-	    (str[n] == '\0' || str[n] == '-' || str[n] == '+'))
-	{
+	    (str[n] == '\0' || str[n] == '-' || str[n] == '+')) {
 		char timestr[15];
 
 		strlcpy(timestr, str, sizeof(timestr));
@@ -329,8 +331,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 		base = val;
 		str += n;
 	} else if (n == 10u &&
-		   (str[n] == '\0' || str[n] == '-' || str[n] == '+'))
-	{
+		   (str[n] == '\0' || str[n] == '-' || str[n] == '+')) {
 		base = strtoll(str, &endp, 0);
 		str += 10;
 	} else if (strncmp(str, "now", 3) == 0) {
@@ -372,7 +373,7 @@ strtoclass(const char *str) {
 	if (str == NULL) {
 		return (dns_rdataclass_in);
 	}
-	r.base = UNCONST(str);
+	DE_CONST(str, r.base);
 	r.length = strlen(str);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -387,7 +388,7 @@ strtodsdigest(const char *str) {
 	dns_dsdigest_t alg;
 	isc_result_t result;
 
-	r.base = UNCONST(str);
+	DE_CONST(str, r.base);
 	r.length = strlen(str);
 	result = dns_dsdigest_fromtext(&alg, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -405,7 +406,7 @@ cmp_dtype(const void *ap, const void *bp) {
 
 void
 add_dtype(unsigned int dt) {
-	unsigned int i, n;
+	unsigned i, n;
 
 	/* ensure there is space for a zero terminator */
 	n = sizeof(dtype) / sizeof(dtype[0]) - 1;
@@ -472,7 +473,8 @@ set_keyversion(dst_key_t *key) {
 	 * set the creation date
 	 */
 	if (major < 1 || (major == 1 && minor <= 2)) {
-		isc_stdtime_t now = isc_stdtime_now();
+		isc_stdtime_t now;
+		isc_stdtime_get(&now);
 		dst_key_settime(key, DST_TIME_CREATED, now);
 	}
 }
@@ -487,7 +489,9 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	uint16_t id, oldid;
 	uint32_t rid, roldid;
 	dns_secalg_t alg;
-	isc_stdtime_t now = isc_stdtime_now();
+	char filename[NAME_MAX];
+	isc_buffer_t fileb;
+	isc_stdtime_t now;
 
 	if (exact != NULL) {
 		*exact = false;
@@ -497,9 +501,24 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	rid = dst_key_rid(dstkey);
 	alg = dst_key_alg(dstkey);
 
+	/*
+	 * For Diffie Hellman just check if there is a direct collision as
+	 * they can't be revoked.  Additionally dns_dnssec_findmatchingkeys
+	 * only handles DNSKEY which is not used for HMAC.
+	 */
+	if (alg == DST_ALG_DH) {
+		isc_buffer_init(&fileb, filename, sizeof(filename));
+		result = dst_key_buildfilename(dstkey, DST_TYPE_PRIVATE, dir,
+					       &fileb);
+		if (result != ISC_R_SUCCESS) {
+			return (true);
+		}
+		return (isc_file_exists(filename));
+	}
+
 	ISC_LIST_INIT(matchkeys);
-	result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
-					     &matchkeys);
+	isc_stdtime_get(&now);
+	result = dns_dnssec_findmatchingkeys(name, dir, now, mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
 		return (false);
 	}

bin/named/Makefile.am

@@ -7,13 +7,13 @@ AM_CPPFLAGS +=				\
 	$(LIBNS_CFLAGS)			\
 	$(LIBISCCC_CFLAGS)		\
 	$(LIBISCCFG_CFLAGS)		\
+	$(LIBBIND9_CFLAGS)		\
 	$(OPENSSL_CFLAGS)		\
 	$(LIBCAP_CFLAGS)		\
 	$(LMDB_CFLAGS)			\
 	$(MAXMINDDB_CFLAGS)		\
 	$(DNSTAP_CFLAGS)		\
 	$(LIBUV_CFLAGS)			\
-	$(LIBSYSTEMD_CFLAGS)		\
 	$(ZLIB_CFLAGS)
 
 if HAVE_JSON_C
@@ -38,8 +38,8 @@ AM_CPPFLAGS +=						\
 sbin_PROGRAMS = named
 
 nodist_named_SOURCES = xsl.c
-BUILT_SOURCES += xsl.c
-CLEANFILES += xsl.c
+BUILT_SOURCES = xsl.c
+CLEANFILES = xsl.c
 
 EXTRA_DIST = bind9.xsl
 
@@ -102,13 +102,14 @@ named_LDADD =					\
 	$(LIBNS_LIBS)				\
 	$(LIBISCCC_LIBS)			\
 	$(LIBISCCFG_LIBS)			\
+	$(LIBBIND9_LIBS)			\
 	$(OPENSSL_LIBS)				\
 	$(LIBCAP_LIBS)				\
 	$(LMDB_LIBS)				\
 	$(MAXMINDDB_LIBS)			\
 	$(DNSTAP_LIBS)				\
 	$(LIBUV_LIBS)				\
-	$(LIBSYSTEMD_LIBS)			\
+	$(LIBXML2_LIBS)				\
 	$(ZLIB_LIBS)
 
 if HAVE_JSON_C
@@ -121,7 +122,5 @@ named_LDADD +=					\
 	$(LIBNGHTTP2_LIBS)
 endif HAVE_LIBNGHTTP2
 
-if HAVE_LIBXML2
-named_LDADD +=					\
-	$(LIBXML2_LIBS)
-endif HAVE_LIBXML2
+MAINTAINERCLEANFILES =				\
+	named.conf.rst

bin/named/bind9.xsl

@@ -15,7 +15,7 @@
   <xsl:output method="html" indent="yes" version="4.0"/>
   <!-- the version number **below** must match version in bin/named/statschannel.c -->
   <!-- don't forget to update "/xml/v<STATS_XML_VERSION_MAJOR>" in the HTTP endpoints listed below -->
-  <xsl:template match="statistics[@version=&quot;3.14&quot;]">
+  <xsl:template match="statistics[@version=&quot;3.12&quot;]">
     <html>
       <head>
         <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
@@ -156,6 +156,29 @@
       background-color: #99ddff;
      }
 
+     table.tasks {
+      border: 1px solid grey;
+      width: 500px;
+     }
+     table.tasks th {
+      text-align: center;
+      border: 1px solid grey;
+      width: 150px;
+     }
+     table.tasks td {
+      text-align: right;
+      font-family: monospace;
+     }
+     table.tasks td:nth-child(2) {
+      text-align: center;
+     }
+     table.tasks td:nth-child(4) {
+      text-align: center;
+     }
+     table.tasks tr:hover{
+      background-color: #99ddff;
+     }
+
      table.netstat {
       border: 1px solid grey;
       width: 500px;
@@ -303,8 +326,8 @@
 	<a href="/xml/v3/status">Status</a>,
 	<a href="/xml/v3/server">Server</a>,
 	<a href="/xml/v3/zones">Zones</a>,
-	<a href="/xml/v3/xfrins">Incoming Zone Transfers</a>,
 	<a href="/xml/v3/net">Network</a>,
+	<a href="/xml/v3/tasks">Tasks</a>,
 	<a href="/xml/v3/mem">Memory</a> and
 	<a href="/xml/v3/traffic">Traffic Size</a></p>
         <hr/>
@@ -908,62 +931,84 @@
             </xsl:for-each>
           </xsl:for-each>
         </xsl:if>
-        <xsl:if test="views/view/xfrins/xfrin">
-          <xsl:for-each select="views/view">
-            <h3>Incoming Zone Transfers for View <xsl:value-of select="@name"/></h3>
-            <table class="xfrins">
-              <thead>
-	        <tr>
-                  <th>Zone Name</th>
-                  <th>Zone Type</th>
-                  <th>Local Serial</th>
-                  <th>Remote Serial</th>
-                  <th>IXFR</th>
-                  <th>First Refresh</th>
-                  <th>State</th>
-                  <th>Additional Refresh Queued</th>
-                  <th>Local Address</th>
-                  <th>Remote Address</th>
-                  <th>SOA Transport</th>
-                  <th>Transport</th>
-                  <th>TSIG Key Name</th>
-                  <th>Duration (s)</th>
-                  <th>Messages Received</th>
-                  <th>Records Received</th>
-                  <th>Bytes Received</th>
-                </tr>
-              </thead>
-              <tbody>
-                <xsl:for-each select="xfrins/xfrin">
-                  <xsl:variable name="css-class16">
-                    <xsl:choose>
-                      <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                      <xsl:otherwise>odd</xsl:otherwise>
-                    </xsl:choose>
-                  </xsl:variable>
-                  <tr class="{$css-class16}">
-                    <td><xsl:value-of select="@name"/></td>
-                    <td><xsl:value-of select="type"/></td>
-                    <td><xsl:value-of select="serial"/></td>
-                    <td><xsl:value-of select="remoteserial"/></td>
-                    <td><xsl:value-of select="ixfr"/></td>
-                    <td><xsl:value-of select="firstrefresh"/></td>
-                    <td><xsl:value-of select="state"/></td>
-                    <td><xsl:value-of select="refreshqueued"/></td>
-                    <td><xsl:value-of select="localaddr"/></td>
-                    <td><xsl:value-of select="remoteaddr"/></td>
-                    <td><xsl:value-of select="soatransport"/></td>
-                    <td><xsl:value-of select="transport"/></td>
-                    <td><xsl:value-of select="tsigkeyname"/></td>
-                    <td><xsl:value-of select="duration"/></td>
-                    <td><xsl:value-of select="nmsg"/></td>
-                    <td><xsl:value-of select="nrecs"/></td>
-                    <td><xsl:value-of select="nbytes"/></td>
-                  </tr>
-                </xsl:for-each>
-              </tbody>
-            </table>
-          </xsl:for-each>
+        <xsl:if test="taskmgr/thread-model/type">
+          <h2>Task Manager Configuration</h2>
+          <table class="counters">
+            <tr>
+              <th class="even">Thread-Model</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/type"/>
+              </td>
+            </tr>
+            <tr class="odd">
+              <th>Worker Threads</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/worker-threads"/>
+              </td>
+            </tr>
+            <tr class="even">
+              <th>Default Quantum</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/default-quantum"/>
+              </td>
+            </tr>
+            <tr class="odd">
+              <th>Tasks Running</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/tasks-running"/>
+              </td>
+            </tr>
+            <tr class="even">
+              <th>Tasks Ready</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/tasks-ready"/>
+              </td>
+            </tr>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="taskmgr/tasks/task">
+          <h2>Tasks</h2>
+          <table class="tasks">
+            <tr>
+              <th>ID</th>
+              <th>Name</th>
+              <th>References</th>
+              <th>State</th>
+              <th>Quantum</th>
+              <th>Events</th>
+            </tr>
+            <xsl:for-each select="taskmgr/tasks/task">
+              <xsl:sort select="name"/>
+              <xsl:variable name="css-class14">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class14}">
+                <td>
+                  <xsl:value-of select="id"/>
+                </td>
+                <td>
+                  <xsl:value-of select="name"/>
+                </td>
+                <td>
+                  <xsl:value-of select="references"/>
+                </td>
+                <td>
+                  <xsl:value-of select="state"/>
+                </td>
+                <td>
+                  <xsl:value-of select="quantum"/>
+                </td>
+                <td>
+                  <xsl:value-of select="events"/>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+          <br/>
         </xsl:if>
         <xsl:if test="memory/summary">
           <h2>Memory Usage Summary</h2>
@@ -994,7 +1039,12 @@
               <th>ID</th>
               <th>Name</th>
               <th>References</th>
+              <th>TotalUse</th>
               <th>InUse</th>
+              <th>MaxUse</th>
+              <th>Malloced</th>
+              <th>MaxMalloced</th>
+              <th>BlockSize</th>
               <th>Pools</th>
               <th>HiWater</th>
               <th>LoWater</th>
@@ -1017,9 +1067,24 @@
                 <td>
                   <xsl:value-of select="references"/>
                 </td>
+                <td>
+                  <xsl:value-of select="total"/>
+                </td>
                 <td>
                   <xsl:value-of select="inuse"/>
                 </td>
+                <td>
+                  <xsl:value-of select="maxinuse"/>
+                </td>
+                <td>
+                  <xsl:value-of select="malloced"/>
+                </td>
+                <td>
+                  <xsl:value-of select="maxmalloced"/>
+                </td>
+                <td>
+                  <xsl:value-of select="blocksize"/>
+                </td>
                 <td>
                   <xsl:value-of select="pools"/>
                 </td>

bin/named/config.c

@@ -49,12 +49,17 @@ static char defaultconf[] = "\
 options {\n\
 	answer-cookie true;\n\
 	automatic-interface-scan yes;\n\
-#	blackhole {none;};\n\
-	cookie-algorithm siphash24;\n\
+	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
+#	blackhole {none;};\n"
+			    "	cookie-algorithm siphash24;\n"
+			    "	coresize default;\n\
+	datasize default;\n"
+			    "\
 #	directory <none>\n\
 	dnssec-policy \"none\";\n\
 	dump-file \"named_dump.db\";\n\
-	edns-udp-size 1232;\n"
+	edns-udp-size 1232;\n\
+	files unlimited;\n"
 #if defined(HAVE_GEOIP2)
 			    "\
 	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
@@ -67,6 +72,7 @@ options {\n\
 	interface-interval 60;\n\
 	listen-on {any;};\n\
 	listen-on-v6 {any;};\n\
+#	lock-file \"" NAMED_LOCALSTATEDIR "/run/named/named.lock\";\n\
 	match-mapped-addresses no;\n\
 	max-ixfr-ratio 100%;\n\
 	max-rsa-exponent-size 0; /* no limit */\n\
@@ -99,6 +105,7 @@ options {\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
+	reserved-sockets 512;\n\
 	resolver-query-timeout 10;\n\
 	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
@@ -108,6 +115,7 @@ options {\n\
 	session-keyalg hmac-sha256;\n\
 #	session-keyfile \"" NAMED_LOCALSTATEDIR "/run/named/session.key\";\n\
 	session-keyname local-ddns;\n\
+	stacksize default;\n\
 	startup-notify-rate 20;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
@@ -118,6 +126,7 @@ options {\n\
 	tcp-listen-queue 10;\n\
 	tcp-receive-buffer 0;\n\
 	tcp-send-buffer 0;\n\
+#	tkey-dhkey <none>\n\
 #	tkey-domain <none>\n\
 #	tkey-gssapi-credential <none>\n\
 	transfer-message-size 20480;\n\
@@ -127,13 +136,10 @@ options {\n\
 	trust-anchor-telemetry yes;\n\
 	udp-receive-buffer 0;\n\
 	udp-send-buffer 0;\n\
-	update-quota 100;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
 	allow-notify {none;};\n\
-	allow-proxy {none;};\n\
-	allow-proxy-on {any;};\n\
 	allow-query-cache { localnets; localhost; };\n\
 	allow-query-cache-on { any; };\n\
 	allow-recursion { localnets; localhost; };\n\
@@ -146,13 +152,9 @@ options {\n\
 	check-names response ignore;\n\
 	check-names secondary warn;\n\
 	check-spf warn;\n\
-	check-svcb yes;\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-validation " VALIDATION_DEFAULT "; \n"
-#ifdef USE_DNSRPS
-			    "	dnsrps-library \"" DNSRPS_LIBRPZ_PATH "\";\n"
-#endif /* ifdef USE_DNSRPS */
 #ifdef HAVE_DNSTAP
 			    "	dnstap-identity hostname;\n"
 #endif /* ifdef HAVE_DNSTAP */
@@ -160,6 +162,7 @@ options {\n\
 	fetch-quota-params 100 0.1 0.3 0.7;\n\
 	fetches-per-server 0;\n\
 	fetches-per-zone 0;\n\
+	glue-cache yes;\n\
 	lame-ttl 0;\n"
 #ifdef HAVE_LMDB
 			    "	lmdb-mapsize 32M;\n"
@@ -189,6 +192,8 @@ options {\n\
 	request-expire true;\n\
 	request-ixfr true;\n\
 	require-server-cookie no;\n\
+	resolver-nonbackoff-tries 3;\n\
+	resolver-retry-interval 800; /* in milliseconds */\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
 #	sortlist <none>\n\
@@ -200,7 +205,6 @@ options {\n\
 	synth-from-dnssec yes;\n\
 #	topology <none>\n\
 	transfer-format many-answers;\n\
-	resolver-use-dns64 false;\n\
 	v6-bias 50;\n\
 	zero-no-soa-ttl-cache no;\n\
 \n\
@@ -209,13 +213,18 @@ options {\n\
 	allow-query-on {any;};\n\
 	allow-transfer {any;};\n\
 #	also-notify <none>\n\
+	alt-transfer-source *;\n\
+	alt-transfer-source-v6 *;\n\
 	check-integrity yes;\n\
 	check-mx-cname warn;\n\
 	check-sibling yes;\n\
 	check-srv-cname warn;\n\
 	check-wildcard yes;\n\
 	dialup no;\n\
+	dnssec-dnskey-kskonly yes;\n\
 	dnssec-loadkeys-interval 60;\n\
+	dnssec-secure-to-insecure no;\n\
+	dnssec-update-mode maintain;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
 #	inline-signing no;\n\
@@ -238,9 +247,12 @@ options {\n\
 	sig-signing-nodes 100;\n\
 	sig-signing-signatures 10;\n\
 	sig-signing-type 65534;\n\
+	sig-validity-interval 30; /* days */\n\
+	dnskey-sig-validity 0; /* default: sig-validity-interval */\n\
 	transfer-source *;\n\
 	transfer-source-v6 *;\n\
 	try-tcp-refresh yes; /* BIND 8 compat */\n\
+	update-check-ksk yes;\n\
 	zero-no-soa-ttl yes;\n\
 	zone-statistics terse;\n\
 };\n\
@@ -291,10 +303,7 @@ dnssec-policy \"default\" {\n\
 		csk key-directory lifetime unlimited algorithm 13;\n\
 	};\n\
 \n\
-	cdnskey yes;\n\
-	cds-digest-types { 2; };\n\
 	dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
-	inline-signing yes;\n\
 	publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
 	retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
 	purge-keys " DNS_KASP_PURGE_KEYS "; \n\
@@ -308,9 +317,7 @@ dnssec-policy \"default\" {\n\
 };\n\
 \n\
 dnssec-policy \"insecure\" {\n\
-	max-zone-ttl 0; \n\
 	keys { };\n\
-	inline-signing yes;\n\
 };\n\
 \n\
 "
@@ -327,14 +334,14 @@ dnssec-policy \"insecure\" {\n\
 			    "# END TRUST ANCHORS\n\
 \n\
 primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
-	2801:1b8:10::b;		# b.root-servers.net\n\
+	2001:500:200::b;	# b.root-servers.net\n\
 	2001:500:2::c;		# c.root-servers.net\n\
 	2001:500:2f::f;		# f.root-servers.net\n\
 	2001:500:12::d0d;	# g.root-servers.net\n\
 	2001:7fd::1;		# k.root-servers.net\n\
 	2620:0:2830:202::132;	# xfr.cjr.dns.icann.org\n\
 	2620:0:2d0:202::132;	# xfr.lax.dns.icann.org\n\
-	170.247.170.2;		# b.root-servers.net\n\
+	199.9.14.201;		# b.root-servers.net\n\
 	192.33.4.12;		# c.root-servers.net\n\
 	192.5.5.241;		# f.root-servers.net\n\
 	192.112.36.4;		# g.root-servers.net\n\
@@ -388,8 +395,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 	for (i = 0; maps[i] != NULL; i++) {
 		checknames = NULL;
 		if (cfg_map_get(maps[i], "check-names", &checknames) ==
-		    ISC_R_SUCCESS)
-		{
+		    ISC_R_SUCCESS) {
 			/*
 			 * Zone map entry is not a list.
 			 */
@@ -405,8 +411,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 
 				for (size_t j = 0; names[j] != NULL; j++) {
 					if (strcasecmp(cfg_obj_asstring(type),
-						       names[j]) == 0)
-					{
+						       names[j]) == 0) {
 						*obj = cfg_tuple_get(value,
 								     "mode");
 						return (ISC_R_SUCCESS);
@@ -440,7 +445,7 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		*classp = defclass;
 		return (ISC_R_SUCCESS);
 	}
-	r.base = UNCONST(cfg_obj_asstring(classobj));
+	DE_CONST(cfg_obj_asstring(classobj), r.base);
 	r.length = strlen(r.base);
 	result = dns_rdataclass_fromtext(classp, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -460,7 +465,7 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 		*typep = deftype;
 		return (ISC_R_SUCCESS);
 	}
-	r.base = UNCONST(cfg_obj_asstring(typeobj));
+	DE_CONST(cfg_obj_asstring(typeobj), r.base);
 	r.length = strlen(r.base);
 	result = dns_rdatatype_fromtext(typep, &r);
 	if (result != ISC_R_SUCCESS) {
@@ -479,8 +484,7 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	if (strcasecmp(str, "primary") == 0 || strcasecmp(str, "master") == 0) {
 		ztype = dns_zone_primary;
 	} else if (strcasecmp(str, "secondary") == 0 ||
-		   strcasecmp(str, "slave") == 0)
-	{
+		   strcasecmp(str, "slave") == 0) {
 		ztype = dns_zone_secondary;
 	} else if (strcasecmp(str, "mirror") == 0) {
 		ztype = dns_zone_mirror;
@@ -496,6 +500,149 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	return (ztype);
 }
 
+static isc_result_t
+named_tuple_getport(const cfg_obj_t *obj, bool optional, in_port_t *portp) {
+	uint32_t val;
+
+	if (obj == NULL || !cfg_obj_isuint32(obj)) {
+		if (optional) {
+			return (ISC_R_SUCCESS);
+		}
+	}
+
+	val = cfg_obj_asuint32(obj);
+	if (val >= UINT16_MAX) {
+		cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
+			    "port '%u' out of range", val);
+		return (ISC_R_RANGE);
+	}
+	*portp = (in_port_t)val;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+named_tuple_getdscp(const cfg_obj_t *obj, bool optional, isc_dscp_t *dscpp) {
+	uint32_t val;
+
+	if (obj == NULL || !cfg_obj_isuint32(obj)) {
+		if (optional) {
+			return (ISC_R_SUCCESS);
+		}
+	}
+
+	val = cfg_obj_asuint32(obj);
+	if (val >= UINT16_MAX) {
+		cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
+			    "dscp '%u' out of range", val);
+		return (ISC_R_RANGE);
+	}
+	*dscpp = (isc_dscp_t)val;
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
+		       in_port_t defport, isc_mem_t *mctx,
+		       isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
+		       uint32_t *countp) {
+	int count, i = 0;
+	const cfg_obj_t *addrlist;
+	const cfg_obj_t *portobj, *dscpobj;
+	const cfg_listelt_t *element;
+	isc_sockaddr_t *addrs;
+	in_port_t port;
+	isc_dscp_t dscp = -1, *dscps = NULL;
+	isc_result_t result;
+
+	INSIST(addrsp != NULL && *addrsp == NULL);
+	INSIST(dscpsp == NULL || *dscpsp == NULL);
+	INSIST(countp != NULL);
+
+	addrlist = cfg_tuple_get(list, "addresses");
+	count = named_config_listcount(addrlist);
+
+	portobj = cfg_tuple_get(list, "port");
+	if (cfg_obj_isuint32(portobj)) {
+		uint32_t val = cfg_obj_asuint32(portobj);
+		if (val > UINT16_MAX) {
+			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
+				    "port '%u' out of range", val);
+			return (ISC_R_RANGE);
+		}
+		port = (in_port_t)val;
+	} else if (defport != 0) {
+		port = defport;
+	} else {
+		result = named_config_getport(config, "port", &port);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
+	}
+
+	if (dscpsp != NULL) {
+		dscpobj = cfg_tuple_get(list, "dscp");
+		if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
+			if (cfg_obj_asuint32(dscpobj) > 63) {
+				cfg_obj_log(dscpobj, named_g_lctx,
+					    ISC_LOG_ERROR,
+					    "dscp value '%u' is out of range",
+					    cfg_obj_asuint32(dscpobj));
+				return (ISC_R_RANGE);
+			}
+			dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
+		}
+
+		dscps = isc_mem_get(mctx, count * sizeof(isc_dscp_t));
+	}
+
+	addrs = isc_mem_get(mctx, count * sizeof(isc_sockaddr_t));
+
+	for (element = cfg_list_first(addrlist); element != NULL;
+	     element = cfg_list_next(element), i++)
+	{
+		const cfg_obj_t *addr;
+		INSIST(i < count);
+		addr = cfg_listelt_value(element);
+		addrs[i] = *cfg_obj_assockaddr(addr);
+		if (dscpsp != NULL) {
+			isc_dscp_t innerdscp;
+			innerdscp = cfg_obj_getdscp(addr);
+			if (innerdscp == -1) {
+				innerdscp = dscp;
+			}
+			dscps[i] = innerdscp;
+		}
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			isc_sockaddr_setport(&addrs[i], port);
+		}
+	}
+	INSIST(i == count);
+
+	*addrsp = addrs;
+	*countp = count;
+
+	if (dscpsp != NULL) {
+		*dscpsp = dscps;
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+void
+named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
+		       isc_dscp_t **dscpsp, uint32_t count) {
+	INSIST(addrsp != NULL && *addrsp != NULL);
+	INSIST(dscpsp == NULL || *dscpsp != NULL);
+
+	isc_mem_put(mctx, *addrsp, count * sizeof(isc_sockaddr_t));
+	*addrsp = NULL;
+
+	if (dscpsp != NULL) {
+		isc_mem_put(mctx, *dscpsp, count * sizeof(isc_dscp_t));
+		*dscpsp = NULL;
+	}
+}
+
 static isc_result_t
 getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 	      const cfg_obj_t **ret) {
@@ -515,8 +662,7 @@ getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 	while (elt != NULL) {
 		obj = cfg_listelt_value(elt);
 		if (strcasecmp(cfg_obj_asstring(cfg_tuple_get(obj, "name")),
-			       name) == 0)
-		{
+			       name) == 0) {
 			*ret = obj;
 			return (ISC_R_SUCCESS);
 		}
@@ -527,19 +673,25 @@ getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 
 isc_result_t
 named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
-			   const char *name, const cfg_obj_t **ret) {
-	isc_result_t result;
+			   const char *name, const cfg_obj_t **ret,
+			   bool *isremote) {
+	isc_result_t result = ISC_R_NOTFOUND;
 
-	if (strcmp(list, "parental-agents") == 0) {
-		return (getremotesdef(cctx, list, name, ret));
+	/* Try "remote" first. */
+	result = getremotesdef(cctx, "remote", name, ret);
+	if (result == ISC_R_SUCCESS) {
+		*isremote = true;
+		return (result);
+	} else if (strcmp(list, "parental-agents") == 0) {
+		result = getremotesdef(cctx, list, name, ret);
 	} else if (strcmp(list, "primaries") == 0) {
 		result = getremotesdef(cctx, list, name, ret);
 		if (result != ISC_R_SUCCESS) {
 			result = getremotesdef(cctx, "masters", name, ret);
 		}
-		return (result);
 	}
-	return (ISC_R_NOTFOUND);
+	*isremote = false;
+	return (result);
 }
 
 static isc_result_t
@@ -576,61 +728,75 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	return (ISC_R_SUCCESS);
 }
 
-#define grow_array(mctx, array, newlen, oldlen)                          \
-	if (newlen >= oldlen) {                                          \
-		array = isc_mem_creget(mctx, array, oldlen, newlen + 16, \
-				       sizeof(array[0]));                \
-		oldlen = newlen + 16;                                    \
+#define grow_array(mctx, array, newlen, oldlen)                    \
+	if (newlen >= oldlen) {                                    \
+		size_t newsize = (newlen + 16) * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]);        \
+		void *tmp = isc_mem_get(mctx, newsize);            \
+		memset(tmp, 0, newsize);                           \
+		if (oldlen != 0) {                                 \
+			memmove(tmp, array, oldsize);              \
+			isc_mem_put(mctx, array, oldsize);         \
+		}                                                  \
+		array = tmp;                                       \
+		oldlen = newlen + 16;                              \
 	}
 
-#define shrink_array(mctx, array, newlen, oldlen)                   \
-	if (newlen < oldlen) {                                      \
-		array = isc_mem_creget(mctx, array, oldlen, newlen, \
-				       sizeof(array[0]));           \
-		oldlen = newlen;                                    \
+#define shrink_array(mctx, array, newlen, oldlen)           \
+	if (newlen < oldlen) {                              \
+		void *tmp = NULL;                           \
+		size_t newsize = newlen * sizeof(array[0]); \
+		size_t oldsize = oldlen * sizeof(array[0]); \
+		if (newlen != 0) {                          \
+			tmp = isc_mem_get(mctx, newsize);   \
+			memset(tmp, 0, newsize);            \
+			memmove(tmp, array, newsize);       \
+		} else {                                    \
+			tmp = NULL;                         \
+		}                                           \
+		isc_mem_put(mctx, array, oldsize);          \
+		array = tmp;                                \
+		oldlen = newlen;                            \
 	}
 
 isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
 			     const cfg_obj_t *list, isc_mem_t *mctx,
 			     dns_ipkeylist_t *ipkl) {
-	uint32_t addrcount = 0, srccount = 0;
-	uint32_t keycount = 0, tlscount = 0;
-	uint32_t listcount = 0, l = 0, i = 0;
+	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, tlscount = 0,
+		 i = 0;
+	uint32_t listcount = 0, l = 0, j;
 	uint32_t stackcount = 0, pushed = 0;
 	isc_result_t result;
 	const cfg_listelt_t *element;
+	const cfg_obj_t *remoteobj;
 	const cfg_obj_t *addrlist;
 	const cfg_obj_t *portobj;
-	const cfg_obj_t *src4obj;
-	const cfg_obj_t *src6obj;
+	const cfg_obj_t *dscpobj;
 	in_port_t port = (in_port_t)0;
 	in_port_t def_port;
 	in_port_t def_tlsport;
-	isc_sockaddr_t src4;
-	isc_sockaddr_t src6;
+	isc_dscp_t dscp = -1;
 	isc_sockaddr_t *addrs = NULL;
-	isc_sockaddr_t *sources = NULL;
+	isc_dscp_t *dscps = NULL;
 	dns_name_t **keys = NULL;
 	dns_name_t **tlss = NULL;
 	struct {
 		const char *name;
-		in_port_t port;
-		isc_sockaddr_t *src4s;
-		isc_sockaddr_t *src6s;
 	} *lists = NULL;
 	struct {
 		const cfg_listelt_t *element;
 		in_port_t port;
-		isc_sockaddr_t src4;
-		isc_sockaddr_t src6;
+		isc_dscp_t dscp;
 	} *stack = NULL;
+	bool isremote = false;
 
 	REQUIRE(ipkl != NULL);
 	REQUIRE(ipkl->count == 0);
 	REQUIRE(ipkl->addrs == NULL);
 	REQUIRE(ipkl->keys == NULL);
 	REQUIRE(ipkl->tlss == NULL);
+	REQUIRE(ipkl->dscps == NULL);
 	REQUIRE(ipkl->labels == NULL);
 	REQUIRE(ipkl->allocated == 0);
 
@@ -647,33 +813,43 @@ named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
 		goto cleanup;
 	}
 
-newlist:
-	addrlist = cfg_tuple_get(list, "addresses");
-	portobj = cfg_tuple_get(list, "port");
-	src4obj = cfg_tuple_get(list, "source");
-	src6obj = cfg_tuple_get(list, "source-v6");
+	result = named_config_getdscp(config, &dscp);
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
 
-	if (cfg_obj_isuint32(portobj)) {
-		uint32_t val = cfg_obj_asuint32(portobj);
-		if (val > UINT16_MAX) {
-			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
-				    "port '%u' out of range", val);
-			result = ISC_R_RANGE;
+newlist:
+	if (isremote) {
+		addrlist = NULL;
+		portobj = NULL;
+		dscpobj = NULL;
+		/* TODO: source, source-v6 */
+		remoteobj = cfg_tuple_get(list, "options");
+		(void)cfg_map_get(remoteobj, "addresses", &addrlist);
+
+		result = named_tuple_getport(list, true, &port);
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
 		}
-		port = (in_port_t)val;
-	}
 
-	if (src4obj != NULL && cfg_obj_issockaddr(src4obj)) {
-		src4 = *cfg_obj_assockaddr(src4obj);
+		result = named_tuple_getdscp(list, true, &dscp);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
 	} else {
-		isc_sockaddr_any(&src4);
-	}
+		addrlist = cfg_tuple_get(list, "addresses");
+		portobj = cfg_tuple_get(list, "port");
+		dscpobj = cfg_tuple_get(list, "dscp");
 
-	if (src6obj != NULL && cfg_obj_issockaddr(src6obj)) {
-		src6 = *cfg_obj_assockaddr(src6obj);
-	} else {
-		isc_sockaddr_any6(&src6);
+		result = named_tuple_getport(portobj, true, &port);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
+
+		result = named_tuple_getdscp(dscpobj, true, &dscp);
+		if (result != ISC_R_SUCCESS) {
+			goto cleanup;
+		}
 	}
 
 	result = ISC_R_NOMEMORY;
@@ -691,9 +867,8 @@ resume:
 		tls = cfg_tuple_get(cfg_listelt_value(element), "tls");
 
 		if (!cfg_obj_issockaddr(addr)) {
-			const char *listname = cfg_obj_asstring(addr);
 			isc_result_t tresult;
-			uint32_t j;
+			const char *listname = cfg_obj_asstring(addr);
 
 			/* Grow lists? */
 			grow_array(mctx, lists, l, listcount);
@@ -708,8 +883,8 @@ resume:
 				continue;
 			}
 			list = NULL;
-			tresult = named_config_getremotesdef(config, listtype,
-							     listname, &list);
+			tresult = named_config_getremotesdef(
+				config, listtype, listname, &list, &isremote);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
 					    "%s \"%s\" not found", listtype,
@@ -730,18 +905,21 @@ resume:
 			 */
 			stack[pushed].element = cfg_list_next(element);
 			stack[pushed].port = port;
-			stack[pushed].src4 = src4;
-			stack[pushed].src6 = src6;
+			stack[pushed].dscp = dscp;
 			pushed++;
 			goto newlist;
 		}
 
 		grow_array(mctx, addrs, i, addrcount);
+		grow_array(mctx, dscps, i, dscpcount);
 		grow_array(mctx, keys, i, keycount);
 		grow_array(mctx, tlss, i, tlscount);
-		grow_array(mctx, sources, i, srccount);
 
 		addrs[i] = *cfg_obj_assockaddr(addr);
+		dscps[i] = cfg_obj_getdscp(addr);
+		if (dscps[i] == -1) {
+			dscps[i] = dscp;
+		}
 
 		result = named_config_getname(mctx, key, &keys[i]);
 		if (result != ISC_R_SUCCESS) {
@@ -757,67 +935,49 @@ resume:
 			goto cleanup;
 		}
 
-		/* If the port is unset, take it from one of the upper levels */
-		if (isc_sockaddr_getport(&addrs[i]) == 0) {
-			in_port_t addr_port = port;
-
-			/* If unset, use the default port or tls-port */
-			if (addr_port == 0) {
-				if (tlss[i] != NULL) {
-					addr_port = def_tlsport;
-				} else {
-					addr_port = def_port;
-				}
+		/* Set the default port or tls-port */
+		if (port == 0) {
+			if (tlss[i] != NULL) {
+				port = def_tlsport;
+			} else {
+				port = def_port;
 			}
-
-			isc_sockaddr_setport(&addrs[i], addr_port);
 		}
 
-		switch (isc_sockaddr_pf(&addrs[i])) {
-		case PF_INET:
-			sources[i] = src4;
-			break;
-		case PF_INET6:
-			sources[i] = src6;
-			break;
-		default:
-			i++; /* Increment here so that cleanup on error works.
-			      */
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup;
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			isc_sockaddr_setport(&addrs[i], port);
 		}
-
 		i++;
 	}
 	if (pushed != 0) {
 		pushed--;
 		element = stack[pushed].element;
 		port = stack[pushed].port;
-		src4 = stack[pushed].src4;
-		src6 = stack[pushed].src6;
+		dscp = stack[pushed].dscp;
 		goto resume;
 	}
 
 	shrink_array(mctx, addrs, i, addrcount);
+	shrink_array(mctx, dscps, i, dscpcount);
 	shrink_array(mctx, keys, i, keycount);
 	shrink_array(mctx, tlss, i, tlscount);
-	shrink_array(mctx, sources, i, srccount);
 
 	if (lists != NULL) {
-		isc_mem_cput(mctx, lists, listcount, sizeof(lists[0]));
+		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
 	}
 	if (stack != NULL) {
-		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
+		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
 	}
 
+	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
 	INSIST(tlscount == addrcount);
-	INSIST(srccount == addrcount);
+	INSIST(keycount == dscpcount);
 
 	ipkl->addrs = addrs;
+	ipkl->dscps = dscps;
 	ipkl->keys = keys;
 	ipkl->tlss = tlss;
-	ipkl->sources = sources;
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;
 
@@ -825,10 +985,13 @@ resume:
 
 cleanup:
 	if (addrs != NULL) {
-		isc_mem_cput(mctx, addrs, addrcount, sizeof(addrs[0]));
+		isc_mem_put(mctx, addrs, addrcount * sizeof(addrs[0]));
+	}
+	if (dscps != NULL) {
+		isc_mem_put(mctx, dscps, dscpcount * sizeof(dscps[0]));
 	}
 	if (keys != NULL) {
-		for (size_t j = 0; j < i; j++) {
+		for (j = 0; j < i; j++) {
 			if (keys[j] == NULL) {
 				continue;
 			}
@@ -837,10 +1000,10 @@ cleanup:
 			}
 			isc_mem_put(mctx, keys[j], sizeof(*keys[j]));
 		}
-		isc_mem_cput(mctx, keys, keycount, sizeof(keys[0]));
+		isc_mem_put(mctx, keys, keycount * sizeof(keys[0]));
 	}
 	if (tlss != NULL) {
-		for (size_t j = 0; j < i; j++) {
+		for (j = 0; j < i; j++) {
 			if (tlss[j] == NULL) {
 				continue;
 			}
@@ -849,16 +1012,13 @@ cleanup:
 			}
 			isc_mem_put(mctx, tlss[j], sizeof(*tlss[j]));
 		}
-		isc_mem_cput(mctx, tlss, tlscount, sizeof(tlss[0]));
-	}
-	if (sources != NULL) {
-		isc_mem_cput(mctx, sources, srccount, sizeof(sources[0]));
+		isc_mem_put(mctx, tlss, tlscount * sizeof(tlss[0]));
 	}
 	if (lists != NULL) {
-		isc_mem_cput(mctx, lists, listcount, sizeof(lists[0]));
+		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
 	}
 	if (stack != NULL) {
-		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
+		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
 	}
 	return (result);
 }
@@ -882,14 +1042,28 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 
 	result = named_config_get(maps, type, &portobj);
 	INSIST(result == ISC_R_SUCCESS);
-	if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
-		cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
-			    "port '%u' out of range",
-			    cfg_obj_asuint32(portobj));
-		return (ISC_R_RANGE);
+
+	return (named_tuple_getport(portobj, false, portp));
+}
+
+isc_result_t
+named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp) {
+	const cfg_obj_t *options = NULL;
+	const cfg_obj_t *dscpobj = NULL;
+	isc_result_t result;
+
+	(void)cfg_map_get(config, "options", &options);
+	if (options == NULL) {
+		return (ISC_R_SUCCESS);
 	}
-	*portp = (in_port_t)cfg_obj_asuint32(portobj);
-	return (ISC_R_SUCCESS);
+
+	result = cfg_map_get(options, "dscp", &dscpobj);
+	if (result != ISC_R_SUCCESS || dscpobj == NULL) {
+		*dscpp = -1;
+		return (ISC_R_SUCCESS);
+	}
+
+	return (named_tuple_getdscp(dscpobj, false, dscpp));
 }
 
 struct keyalgorithms {
@@ -916,8 +1090,14 @@ struct keyalgorithms {
 		   { NULL, hmacnone, DST_ALG_UNKNOWN, 0 } };
 
 isc_result_t
-named_config_getkeyalgorithm(const char *str, unsigned int *typep,
+named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
 			     uint16_t *digestbits) {
+	return (named_config_getkeyalgorithm2(str, name, NULL, digestbits));
+}
+
+isc_result_t
+named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
+			      unsigned int *typep, uint16_t *digestbits) {
 	int i;
 	size_t len = 0;
 	uint16_t bits;
@@ -948,7 +1128,36 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 	} else {
 		bits = algorithms[i].size;
 	}
-	SET_IF_NOT_NULL(typep, algorithms[i].type);
-	SET_IF_NOT_NULL(digestbits, bits);
+
+	if (name != NULL) {
+		switch (algorithms[i].hmac) {
+		case hmacmd5:
+			*name = dns_tsig_hmacmd5_name;
+			break;
+		case hmacsha1:
+			*name = dns_tsig_hmacsha1_name;
+			break;
+		case hmacsha224:
+			*name = dns_tsig_hmacsha224_name;
+			break;
+		case hmacsha256:
+			*name = dns_tsig_hmacsha256_name;
+			break;
+		case hmacsha384:
+			*name = dns_tsig_hmacsha384_name;
+			break;
+		case hmacsha512:
+			*name = dns_tsig_hmacsha512_name;
+			break;
+		default:
+			UNREACHABLE();
+		}
+	}
+	if (typep != NULL) {
+		*typep = algorithms[i].type;
+	}
+	if (digestbits != NULL) {
+		*digestbits = bits;
+	}
 	return (ISC_R_SUCCESS);
 }

bin/named/control.c

@@ -15,6 +15,8 @@
 
 #include <stdbool.h>
 
+#include <isc/app.h>
+#include <isc/event.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -96,7 +98,10 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		return (result);
 	}
 
-	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
+	result = isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
 
 	isc_buffer_init(&src, cmdline, strlen(cmdline));
 	isc_buffer_add(&src, strlen(cmdline));
@@ -170,14 +175,14 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 			named_smf_want_disable = 1;
 		}
 		/*
-		 * If named_smf_got_instance = 0, named_smf_chroot is
-		 * not relevant and we fall through to shutdown below.
+		 * If named_smf_got_instance = 0, named_smf_chroot
+		 * is not relevant and we fall through to
+		 * isc_app_shutdown below.
 		 */
 #endif /* ifdef HAVE_LIBSCF */
 		/* Do not flush master files */
 		named_server_flushonshutdown(named_g_server, false);
 		named_os_shutdownmsg(cmdline, *text);
-		isc_loopmgr_shutdown(named_g_loopmgr);
 		result = ISC_R_SHUTTINGDOWN;
 	} else if (command_compare(command, NAMED_COMMAND_STOP)) {
 		/*
@@ -195,7 +200,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 #endif /* ifdef HAVE_LIBSCF */
 		named_server_flushonshutdown(named_g_server, true);
 		named_os_shutdownmsg(cmdline, *text);
-		isc_loopmgr_shutdown(named_g_loopmgr);
 		result = ISC_R_SHUTTINGDOWN;
 	} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
 		   command_compare(command, NAMED_COMMAND_MODZONE))
@@ -214,8 +218,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
 		result = named_server_dumpstats(named_g_server);
-	} else if (command_compare(command, NAMED_COMMAND_FETCHLIMIT)) {
-		result = named_server_fetchlimit(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSH)) {
 		result = named_server_flushcache(named_g_server, lex);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSHNAME)) {
@@ -278,6 +280,10 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_freeze(named_g_server, false, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_TRACE)) {
 		result = named_server_setdebuglevel(named_g_server, lex);
+	} else if (command_compare(command, NAMED_COMMAND_TSIGDELETE)) {
+		result = named_server_tsigdelete(named_g_server, lex, text);
+	} else if (command_compare(command, NAMED_COMMAND_TSIGLIST)) {
+		result = named_server_tsiglist(named_g_server, text);
 	} else if (command_compare(command, NAMED_COMMAND_VALIDATION)) {
 		result = named_server_validation(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {

bin/named/controlconf.c

@@ -16,9 +16,10 @@
 #include <inttypes.h>
 #include <stdbool.h>
 
-#include <isc/async.h>
+#include <isc/app.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
+#include <isc/event.h>
 #include <isc/file.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -27,30 +28,29 @@
 #include <isc/netmgr.h>
 #include <isc/nonce.h>
 #include <isc/random.h>
-#include <isc/refcount.h>
 #include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/util.h>
 
 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
+#include <isccc/events.h>
 #include <isccc/sexpr.h>
 #include <isccc/symtab.h>
 #include <isccc/util.h>
 
-#include <isccfg/check.h>
 #include <isccfg/namedconf.h>
 
+#include <bind9/check.h>
+
 #include <named/config.h>
 #include <named/control.h>
 #include <named/log.h>
-#include <named/main.h>
 #include <named/server.h>
 
-/* Add -DNAMED_CONTROLCONF_TRACE=1 to CFLAGS for detailed reference tracing */
-
 typedef struct controlkey controlkey_t;
 typedef ISC_LIST(controlkey_t) controlkeylist_t;
 
@@ -68,8 +68,12 @@ struct controlkey {
 };
 
 struct controlconnection {
-	isc_refcount_t references;
+	isc_nmhandle_t *readhandle;
+	isc_nmhandle_t *sendhandle;
+	isc_nmhandle_t *cmdhandle;
 	isccc_ccmsg_t ccmsg;
+	bool reading;
+	bool sending;
 	controllistener_t *listener;
 	isccc_sexpr_t *ctrl;
 	isc_buffer_t *buffer;
@@ -82,7 +86,6 @@ struct controlconnection {
 	isc_stdtime_t now;
 	isc_result_t result;
 	ISC_LINK(controlconnection_t) link;
-	bool shuttingdown;
 };
 
 struct controllistener {
@@ -91,9 +94,10 @@ struct controllistener {
 	isc_sockaddr_t address;
 	isc_nmsocket_t *sock;
 	dns_acl_t *acl;
-	bool shuttingdown;
-	isc_refcount_t references;
+	bool exiting;
+	isc_refcount_t refs;
 	controlkeylist_t keys;
+	isc_mutex_t connections_lock;
 	controlconnectionlist_t connections;
 	isc_socktype_t type;
 	uint32_t perm;
@@ -106,7 +110,7 @@ struct controllistener {
 struct named_controls {
 	named_server_t *server;
 	controllistenerlist_t listeners;
-	bool shuttingdown;
+	atomic_bool shuttingdown;
 	isc_mutex_t symtab_lock;
 	isccc_symtab_t *symtab;
 };
@@ -115,48 +119,9 @@ static isc_result_t
 control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg);
 static void
 control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg);
-static void
-conn_cleanup(controlconnection_t *conn);
-static void
-conn_free(controlconnection_t *conn);
-static void
-conn_shutdown(controlconnection_t *conn);
-
-#if NAMED_CONTROLCONF_TRACE
-#define controllistener_ref(ptr) \
-	controllistener__ref(ptr, __func__, __FILE__, __LINE__)
-#define controllistener_unref(ptr) \
-	controllistener__unref(ptr, __func__, __FILE__, __LINE__)
-#define controllistener_attach(ptr, ptrp) \
-	controllistener__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
-#define controllistener_detach(ptrp) \
-	controllistener__detach(ptrp, __func__, __FILE__, __LINE__)
-ISC_REFCOUNT_TRACE_DECL(controllistener);
-
-#define controlconnection_ref(ptr) \
-	controlconnection__ref(ptr, __func__, __FILE__, __LINE__)
-#define controlconnection_unref(ptr) \
-	controlconnection__unref(ptr, __func__, __FILE__, __LINE__)
-#define controlconnection_attach(ptr, ptrp) \
-	controlconnection__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
-#define controlconnection_detach(ptrp) \
-	controlconnection__detach(ptrp, __func__, __FILE__, __LINE__)
-ISC_REFCOUNT_TRACE_DECL(controlconnection);
-#else
-ISC_REFCOUNT_DECL(controllistener);
-ISC_REFCOUNT_DECL(controlconnection);
-#endif
 
 #define CLOCKSKEW 300
 
-#define CHECK(x)                               \
-	{                                      \
-		result = (x);                  \
-		if (result != ISC_R_SUCCESS) { \
-			goto cleanup;          \
-		}                              \
-	}
-
 static void
 free_controlkey(controlkey_t *key, isc_mem_t *mctx) {
 	if (key->keyname != NULL) {
@@ -179,59 +144,55 @@ free_controlkeylist(controlkeylist_t *keylist, isc_mem_t *mctx) {
 
 static void
 free_listener(controllistener_t *listener) {
-	REQUIRE(listener->shuttingdown);
-	REQUIRE(ISC_LIST_EMPTY(listener->connections));
-	REQUIRE(listener->sock == NULL);
+	INSIST(listener->exiting);
+	INSIST(ISC_LIST_EMPTY(listener->connections));
+
+	isc_refcount_destroy(&listener->refs);
+
+	if (listener->sock != NULL) {
+		isc_nmsocket_close(&listener->sock);
+	}
 
 	free_controlkeylist(&listener->keys, listener->mctx);
 
 	if (listener->acl != NULL) {
 		dns_acl_detach(&listener->acl);
 	}
+	isc_mutex_destroy(&listener->connections_lock);
 
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }
 
-#if NAMED_CONTROLCONF_TRACE
-ISC_REFCOUNT_TRACE_IMPL(controllistener, free_listener);
-ISC_REFCOUNT_TRACE_IMPL(controlconnection, conn_free);
-#else
-ISC_REFCOUNT_IMPL(controllistener, free_listener);
-ISC_REFCOUNT_IMPL(controlconnection, conn_free);
-#endif
+static void
+maybe_free_listener(controllistener_t *listener) {
+	if (isc_refcount_decrement(&listener->refs) == 1) {
+		free_listener(listener);
+	}
+}
 
 static void
 shutdown_listener(controllistener_t *listener) {
-	controlconnection_t *conn = NULL;
-	controlconnection_t *next = NULL;
+	if (!listener->exiting) {
+		char socktext[ISC_SOCKADDR_FORMATSIZE];
 
-	/* Don't shutdown the same listener twice */
-	if (listener->shuttingdown) {
-		return;
+		ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
+
+		isc_sockaddr_format(&listener->address, socktext,
+				    sizeof(socktext));
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
+			      "stopping command channel on %s", socktext);
+#if 0
+		/* XXX: no unix domain socket support */
+		if (listener->type == isc_socktype_unix) {
+			isc_socket_cleanunix(&listener->address, true);
+		}
+#endif
+		listener->exiting = true;
 	}
-	listener->shuttingdown = true;
-
-	for (conn = ISC_LIST_HEAD(listener->connections); conn != NULL;
-	     conn = next)
-	{
-		/*
-		 * 'conn' is likely to be freed by the conn_shutdown() call.
-		 */
-		next = ISC_LIST_NEXT(conn, link);
-		conn_shutdown(conn);
-	}
-
-	ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
-
-	char socktext[ISC_SOCKADDR_FORMATSIZE];
-	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
-		      "stopping command channel on %s", socktext);
 
 	isc_nm_stoplistening(listener->sock);
-	isc_nmsocket_close(&listener->sock);
-	controllistener_detach(&listener);
+	maybe_free_listener(listener);
 }
 
 static bool
@@ -242,6 +203,11 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {
 	isc_result_t result;
 	int match;
 
+	/* ACL doesn't apply to unix domain sockets */
+	if (listener->type != isc_socktype_tcp) {
+		return (true);
+	}
+
 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);
 
 	result = dns_acl_match(&netaddr, NULL, listener->acl, env, &match,
@@ -252,37 +218,43 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {
 static void
 control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	controlconnection_t *conn = (controlconnection_t *)arg;
+	controllistener_t *listener = conn->listener;
+	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);
 
-	if (conn->shuttingdown) {
-		/* The connection is shuttingdown */
-		result = ISC_R_SHUTTINGDOWN;
+	REQUIRE(conn->sending);
+
+	conn->sending = false;
+
+	if (conn->result == ISC_R_SHUTTINGDOWN) {
+		isc_app_shutdown();
+		goto cleanup_sendhandle;
 	}
 
-	if (result == ISC_R_SUCCESS) {
-		/* Everything is peachy, continue reading from the socket */
-		isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage,
-					conn);
-		/* Detach the sending reference */
-		controlconnection_detach(&conn);
-		return;
-	}
-
-	if (result != ISC_R_SHUTTINGDOWN) {
+	if (atomic_load_acquire(&listener->controls->shuttingdown) ||
+	    result == ISC_R_SHUTTINGDOWN)
+	{
+		goto cleanup_sendhandle;
+	} else if (result != ISC_R_SUCCESS) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
-		isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);
 
 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "error sending command response to %s: %s",
 			      socktext, isc_result_totext(result));
+		goto cleanup_sendhandle;
 	}
 
-	/* Shutdown the reading */
-	conn_shutdown(conn);
+	isc_nmhandle_attach(handle, &conn->readhandle);
+	conn->reading = true;
 
-	/* Detach the sending reference */
-	controlconnection_detach(&conn);
+	isc_nmhandle_detach(&conn->sendhandle);
+
+	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
+	return;
+
+cleanup_sendhandle:
+	isc_nmhandle_detach(&conn->sendhandle);
 }
 
 static void
@@ -317,7 +289,7 @@ conn_cleanup(controlconnection_t *conn) {
 }
 
 static void
-control_respond(controlconnection_t *conn) {
+control_respond(isc_nmhandle_t *handle, controlconnection_t *conn) {
 	controllistener_t *listener = conn->listener;
 	isccc_sexpr_t *data = NULL;
 	isc_buffer_t b;
@@ -379,7 +351,7 @@ control_respond(controlconnection_t *conn) {
 	result = isccc_cc_towire(conn->response, &conn->buffer, conn->alg,
 				 &conn->secret);
 	if (result != ISC_R_SUCCESS) {
-		return;
+		goto cleanup;
 	}
 
 	isc_buffer_init(&b, conn->buffer->base, 4);
@@ -388,59 +360,68 @@ control_respond(controlconnection_t *conn) {
 	r.base = conn->buffer->base;
 	r.length = conn->buffer->used;
 
-	/* Attach the sending reference */
-	controlconnection_ref(conn);
-	isccc_ccmsg_sendmessage(&conn->ccmsg, &r, control_senddone, conn);
+	isc_nmhandle_attach(handle, &conn->sendhandle);
+	conn->sending = true;
+	conn_cleanup(conn);
+
+	isc_nmhandle_detach(&conn->cmdhandle);
+
+	isc_nm_send(conn->sendhandle, &r, control_senddone, conn);
+
+	return;
 
 cleanup:
 	conn_cleanup(conn);
+	isc_nmhandle_detach(&conn->cmdhandle);
 }
 
 static void
-control_command(void *arg) {
-	controlconnection_t *conn = (controlconnection_t *)arg;
+control_command(isc_task_t *task, isc_event_t *event) {
+	controlconnection_t *conn = event->ev_arg;
+	controllistener_t *listener = conn->listener;
 
-	/* Don't run the command if we already started the shutdown */
-	if (!conn->shuttingdown) {
-		conn->result = named_control_docommand(
-			conn->request, conn->listener->readonly, &conn->text);
-		control_respond(conn);
+	UNUSED(task);
+
+	if (atomic_load_acquire(&listener->controls->shuttingdown)) {
+		conn_cleanup(conn);
+		isc_nmhandle_detach(&conn->cmdhandle);
+		goto done;
 	}
 
-	/* Detach the control command reference */
-	controlconnection_detach(&conn);
+	conn->result = named_control_docommand(conn->request,
+					       listener->readonly, &conn->text);
+	control_respond(conn->cmdhandle, conn);
+
+done:
+	isc_event_free(&event);
 }
 
 static void
-conn_shutdown(controlconnection_t *conn) {
-	/* Don't shutdown the same controlconnection twice */
-	if (conn->shuttingdown) {
-		return;
-	}
-	conn->shuttingdown = true;
-
-	/*
-	 * Close the TCP connection to make sure that no read callback will be
-	 * called for it ever again.
-	 */
-	isccc_ccmsg_disconnect(&conn->ccmsg);
-
-	/* Detach the reading reference */
-	controlconnection_detach(&conn);
-}
-
-static void
-control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
-		    void *arg) {
+control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	controlconnection_t *conn = (controlconnection_t *)arg;
 	controllistener_t *listener = conn->listener;
 	controlkey_t *key = NULL;
+	isc_event_t *event = NULL;
 	isccc_time_t sent;
 	isccc_time_t exp;
 	uint32_t nonce;
 
+	conn->reading = false;
+
+	/* Is the server shutting down? */
+	if (atomic_load_acquire(&listener->controls->shuttingdown)) {
+		goto cleanup_readhandle;
+	}
+
 	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
+		if (result == ISC_R_SHUTTINGDOWN) {
+			atomic_store_release(&listener->controls->shuttingdown,
+					     true);
+		} else if (result != ISC_R_EOF) {
+			log_invalid(&conn->ccmsg, result);
+		}
+
+		goto cleanup_readhandle;
 	}
 
 	for (key = ISC_LIST_HEAD(listener->keys); key != NULL;
@@ -448,7 +429,8 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	{
 		isccc_region_t ccregion;
 
-		isccc_ccmsg_toregion(&conn->ccmsg, &ccregion);
+		ccregion.rstart = isc_buffer_base(conn->ccmsg.buffer);
+		ccregion.rend = isc_buffer_used(conn->ccmsg.buffer);
 		conn->secret.rstart = isc_mem_get(listener->mctx,
 						  key->secret.length);
 		memmove(conn->secret.rstart, key->secret.base,
@@ -465,36 +447,35 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	}
 
 	if (key == NULL) {
-		result = ISCCC_R_BADAUTH;
+		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
 		goto cleanup;
 	}
 
 	/* We shouldn't be getting a reply. */
 	if (isccc_cc_isreply(conn->request)) {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}
 
-	conn->now = isc_stdtime_now();
+	isc_stdtime_get(&conn->now);
 
 	/*
 	 * Limit exposure to replay attacks.
 	 */
 	conn->ctrl = isccc_alist_lookup(conn->request, "_ctrl");
 	if (!isccc_alist_alistp(conn->ctrl)) {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}
 
 	if (isccc_cc_lookupuint32(conn->ctrl, "_tim", &sent) == ISC_R_SUCCESS) {
 		if ((sent + CLOCKSKEW) < conn->now ||
-		    (sent - CLOCKSKEW) > conn->now)
-		{
-			result = ISCCC_R_CLOCKSKEW;
+		    (sent - CLOCKSKEW) > conn->now) {
+			log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
 			goto cleanup;
 		}
 	} else {
-		result = ISC_R_FAILURE;
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup;
 	}
 
@@ -504,7 +485,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	if (isccc_cc_lookupuint32(conn->ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
 	    conn->now > exp)
 	{
-		result = ISCCC_R_EXPIRED;
+		log_invalid(&conn->ccmsg, ISCCC_R_EXPIRED);
 		goto cleanup;
 	}
 
@@ -520,6 +501,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		if (result == ISC_R_EXISTS) {
 			result = ISCCC_R_DUPLICATE;
 		}
+		log_invalid(&conn->ccmsg, result);
 		goto cleanup;
 	}
 
@@ -528,12 +510,15 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		     ISC_R_SUCCESS ||
 	     conn->nonce != nonce))
 	{
-		result = ISCCC_R_BADAUTH;
+		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
 		goto cleanup;
 	}
 
 	isc_buffer_allocate(listener->mctx, &conn->text, 2 * 2048);
 
+	isc_nmhandle_attach(handle, &conn->cmdhandle);
+	isc_nmhandle_detach(&conn->readhandle);
+
 	if (conn->nonce == 0) {
 		/*
 		 * Establish nonce.
@@ -542,93 +527,103 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 			isc_nonce_buf(&conn->nonce, sizeof(conn->nonce));
 		}
 		conn->result = ISC_R_SUCCESS;
-		control_respond(conn);
+		control_respond(handle, conn);
 		return;
 	}
 
-	/* Attach the command reference */
-	controlconnection_ref(conn);
+	/*
+	 * Trigger the command.
+	 */
 
-	/* Trigger the command asynchronously. */
-	isc_async_run(named_g_mainloop, control_command, conn);
+	event = isc_event_allocate(listener->mctx, conn, NAMED_EVENT_COMMAND,
+				   control_command, conn, sizeof(isc_event_t));
+	isc_task_send(named_g_server->task, &event);
 
 	return;
 
 cleanup:
-	switch (result) {
-	case ISC_R_SHUTTINGDOWN:
-	case ISC_R_EOF:
-		break;
-	default:
-		log_invalid(&conn->ccmsg, result);
-	}
+	conn_cleanup(conn);
 
-	conn_shutdown(conn);
+cleanup_readhandle:
+	/*
+	 * readhandle could be NULL if we're shutting down,
+	 * but if not we need to detach it.
+	 */
+	if (conn->readhandle != NULL) {
+		isc_nmhandle_detach(&conn->readhandle);
+	}
 }
 
 static void
-conn_free(controlconnection_t *conn) {
-	/* Make sure that the connection was shutdown first */
-	REQUIRE(conn->shuttingdown);
-
+conn_reset(void *arg) {
+	controlconnection_t *conn = (controlconnection_t *)arg;
 	controllistener_t *listener = conn->listener;
 
-	isccc_ccmsg_invalidate(&conn->ccmsg);
-
-	conn_cleanup(conn);
-
 	if (conn->buffer != NULL) {
 		isc_buffer_free(&conn->buffer);
 	}
 
+	if (conn->reading) {
+		isccc_ccmsg_cancelread(&conn->ccmsg);
+		return;
+	}
+
+	LOCK(&listener->connections_lock);
 	ISC_LIST_UNLINK(listener->connections, conn, link);
+	UNLOCK(&listener->connections_lock);
 #ifdef ENABLE_AFL
 	if (named_g_fuzz_type == isc_fuzz_rndc) {
 		named_fuzz_notify();
 	}
 #endif /* ifdef ENABLE_AFL */
 
+	isccc_ccmsg_invalidate(&conn->ccmsg);
+}
+
+static void
+conn_put(void *arg) {
+	controlconnection_t *conn = (controlconnection_t *)arg;
+	controllistener_t *listener = conn->listener;
+
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
 		      "freeing control connection");
 
 	isc_mem_put(listener->mctx, conn, sizeof(*conn));
 
-	controllistener_detach(&listener);
+	maybe_free_listener(listener);
 }
 
 static void
 newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
-	/* Don't create new connection if we are shutting down */
-	if (listener->shuttingdown) {
+	controlconnection_t *conn = NULL;
+
+	conn = isc_nmhandle_getdata(handle);
+	if (conn == NULL) {
+		conn = isc_mem_get(listener->mctx, sizeof(*conn));
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
-			      "rejected new control connection: %s",
-			      isc_result_totext(ISC_R_SHUTTINGDOWN));
-		return;
+			      "allocate new control connection");
+		isc_nmhandle_setdata(handle, conn, conn_reset, conn_put);
+		isc_refcount_increment(&listener->refs);
 	}
 
-	controlconnection_t *conn = isc_mem_get(listener->mctx, sizeof(*conn));
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
-		      "allocate new control connection");
+	*conn = (controlconnection_t){ .listener = listener,
+				       .reading = false,
+				       .alg = DST_ALG_UNKNOWN };
 
-	*conn = (controlconnection_t){
-		.alg = DST_ALG_UNKNOWN,
-		.references = ISC_REFCOUNT_INITIALIZER(1),
-		.listener = controllistener_ref(listener),
-		.link = ISC_LINK_INITIALIZER,
-	};
-
-	/* isccc_ccmsg_init() attaches to the handle */
 	isccc_ccmsg_init(listener->mctx, handle, &conn->ccmsg);
 
 	/* Set a 32 KiB upper limit on incoming message. */
 	isccc_ccmsg_setmaxsize(&conn->ccmsg, 32768);
 
-	ISC_LIST_APPEND(listener->connections, conn, link);
+	LOCK(&listener->connections_lock);
+	ISC_LIST_INITANDAPPEND(listener->connections, conn, link);
+	UNLOCK(&listener->connections_lock);
+
+	isc_nmhandle_attach(handle, &conn->readhandle);
+	conn->reading = true;
 
-	/* The reading reference has been initialized in the initializer */
 	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
 }
 
@@ -668,7 +663,8 @@ controls_shutdown(named_controls_t *controls) {
 	     listener = next)
 	{
 		/*
-		 * As listeners shut down, they will call their callbacks.
+		 * This is asynchronous.  As listeners shut down, they will
+		 * call their callbacks.
 		 */
 		next = ISC_LIST_NEXT(listener, link);
 		shutdown_listener(listener);
@@ -677,20 +673,8 @@ controls_shutdown(named_controls_t *controls) {
 
 void
 named_controls_shutdown(named_controls_t *controls) {
-	/*
-	 * Don't ever shutdown the controls twice.
-	 *
-	 * NOTE: This functions is called when the server is shutting down, but
-	 * controls_shutdown() can and will be called multiple times - on each
-	 * reconfiguration, the listeners will be torn down and recreated again,
-	 * see named_controls_configure() for details.
-	 */
-	if (controls->shuttingdown) {
-		return;
-	}
-	controls->shuttingdown = true;
-
 	controls_shutdown(controls);
+	atomic_store_release(&controls->shuttingdown, true);
 }
 
 static isc_result_t
@@ -780,8 +764,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			algstr = cfg_obj_asstring(algobj);
 			secretstr = cfg_obj_asstring(secretobj);
 
-			result = named_config_getkeyalgorithm(algstr, &algtype,
-							      NULL);
+			result = named_config_getkeyalgorithm2(algstr, NULL,
+							       &algtype, NULL);
 			if (result != ISC_R_SUCCESS) {
 				cfg_obj_log(control, named_g_lctx,
 					    ISC_LOG_WARNING,
@@ -819,6 +803,14 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 	}
 }
 
+#define CHECK(x)                               \
+	do {                                   \
+		result = (x);                  \
+		if (result != ISC_R_SUCCESS) { \
+			goto cleanup;          \
+		}                              \
+	} while (0)
+
 static isc_result_t
 get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	isc_result_t result;
@@ -857,7 +849,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		CHECK(ISC_R_NOMEMORY);
 	}
 
-	CHECK(isccfg_check_key(key, named_g_lctx));
+	CHECK(bind9_check_key(key, named_g_lctx));
 
 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
@@ -866,7 +858,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	algstr = cfg_obj_asstring(algobj);
 	secretstr = cfg_obj_asstring(secretobj);
 
-	result = named_config_getkeyalgorithm(algstr, &algtype, NULL);
+	result = named_config_getkeyalgorithm2(algstr, NULL, &algtype, NULL);
 	if (result != ISC_R_SUCCESS) {
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "unsupported algorithm '%s' in "
@@ -925,8 +917,7 @@ get_key_info(const cfg_obj_t *config, const cfg_obj_t *control,
 	control_keylist = cfg_tuple_get(control, "keys");
 
 	if (!cfg_obj_isvoid(control_keylist) &&
-	    cfg_list_first(control_keylist) != NULL)
-	{
+	    cfg_list_first(control_keylist) != NULL) {
 		result = cfg_map_get(config, "key", &global_keylist);
 
 		if (result == ISC_R_SUCCESS) {
@@ -1061,6 +1052,33 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 			      socktext, isc_result_totext(result));
 	}
 
+#if 0
+	/* XXX: no unix socket support yet */
+	if (result == ISC_R_SUCCESS && type == isc_socktype_unix) {
+		uint32_t perm, owner, group;
+		perm = cfg_obj_asuint32(cfg_tuple_get(control, "perm"));
+		owner = cfg_obj_asuint32(cfg_tuple_get(control, "owner"));
+		group = cfg_obj_asuint32(cfg_tuple_get(control, "group"));
+		result = ISC_R_SUCCESS;
+		if (listener->perm != perm || listener->owner != owner ||
+		    listener->group != group)
+		{
+			result = isc_socket_permunix(&listener->address, perm,
+						     owner, group);
+		}
+		if (result == ISC_R_SUCCESS) {
+			listener->perm = perm;
+			listener->owner = owner;
+			listener->group = group;
+		} else if (control != NULL) {
+			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
+				    "couldn't update ownership/permission for "
+				    "command channel %s",
+				    socktext);
+		}
+	}
+#endif
+
 	*listenerp = listener;
 }
 
@@ -1078,21 +1096,16 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	isc_result_t result = ISC_R_SUCCESS;
 	int pf;
 
-	/* Don't create new listener if we are shutting down */
-	if (cp->shuttingdown) {
-		result = ISC_R_SHUTTINGDOWN;
-		goto shuttingdown;
-	}
-
 	listener = isc_mem_get(mctx, sizeof(*listener));
 	*listener = (controllistener_t){ .controls = cp,
 					 .address = *addr,
 					 .type = type };
 	isc_mem_attach(mctx, &listener->mctx);
+	isc_mutex_init(&listener->connections_lock);
 	ISC_LINK_INIT(listener, link);
 	ISC_LIST_INIT(listener->keys);
 	ISC_LIST_INIT(listener->connections);
-	isc_refcount_init(&listener->references, 1);
+	isc_refcount_init(&listener->refs, 1);
 
 	/*
 	 * Make the ACL.
@@ -1137,14 +1150,35 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 
 	pf = isc_sockaddr_pf(&listener->address);
 	if ((pf == AF_INET && isc_net_probeipv4() != ISC_R_SUCCESS) ||
+	    (pf == AF_UNIX && isc_net_probeunix() != ISC_R_SUCCESS) ||
 	    (pf == AF_INET6 && isc_net_probeipv6() != ISC_R_SUCCESS))
 	{
 		CHECK(ISC_R_FAMILYNOSUPPORT);
 	}
 
+#if 0
+	/* XXX: no unix socket support yet */
+	if (type == isc_socktype_unix) {
+		isc_socket_cleanunix(&listener->address, false);
+	}
+#endif
+
 	CHECK(isc_nm_listentcp(named_g_netmgr, ISC_NM_LISTEN_ONE,
 			       &listener->address, control_newconn, listener, 5,
 			       NULL, &listener->sock));
+#if 0
+	/* XXX: no unix socket support yet */
+	if (type == isc_socktype_unix) {
+		listener->perm =
+			cfg_obj_asuint32(cfg_tuple_get(control, "perm"));
+		listener->owner =
+			cfg_obj_asuint32(cfg_tuple_get(control, "owner"));
+		listener->group =
+			cfg_obj_asuint32(cfg_tuple_get(control, "group"));
+		result = isc_socket_permunix(&listener->address, listener->perm,
+					     listener->owner, listener->group);
+	}
+#endif
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
@@ -1153,11 +1187,10 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	return;
 
 cleanup:
-	isc_refcount_decrement(&listener->references);
-	listener->shuttingdown = true;
+	isc_refcount_decrement(&listener->refs);
+	listener->exiting = true;
 	free_listener(listener);
 
-shuttingdown:
 	if (control != NULL) {
 		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 			    "couldn't add command channel %s: %s", socktext,
@@ -1170,6 +1203,8 @@ shuttingdown:
 	}
 
 	*listenerp = NULL;
+
+	/* XXXDCL return error results? fail hard? */
 }
 
 isc_result_t
@@ -1202,19 +1237,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 		{
 			const cfg_obj_t *controls = NULL;
 			const cfg_obj_t *inetcontrols = NULL;
-			const cfg_obj_t *unixcontrols = NULL;
 
 			controls = cfg_listelt_value(element);
-
-			(void)cfg_map_get(controls, "unix", &unixcontrols);
-			if (unixcontrols != NULL) {
-				cfg_obj_log(controls, named_g_lctx,
-					    ISC_LOG_ERROR,
-					    "UNIX domain sockets are not "
-					    "supported");
-				return (ISC_R_FAILURE);
-			}
-
 			(void)cfg_map_get(controls, "inet", &inetcontrols);
 			if (inetcontrols == NULL) {
 				continue;
@@ -1230,8 +1254,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 
 				/*
 				 * The parser handles BIND 8 configuration file
-				 * syntax, so it allows inet phrases with no
-				 * keys{} clause.
+				 * syntax, so it allows unix phrases as well
+				 * inet phrases with no keys{} clause.
 				 */
 				control = cfg_listelt_value(element2);
 
@@ -1279,6 +1303,91 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 				}
 			}
 		}
+		for (element = cfg_list_first(controlslist); element != NULL;
+		     element = cfg_list_next(element))
+		{
+			const cfg_obj_t *controls = NULL;
+			const cfg_obj_t *unixcontrols = NULL;
+
+			controls = cfg_listelt_value(element);
+			(void)cfg_map_get(controls, "unix", &unixcontrols);
+			if (unixcontrols == NULL) {
+				continue;
+			}
+
+			cfg_obj_log(controls, named_g_lctx, ISC_LOG_ERROR,
+				    "UNIX domain sockets not yet supported");
+			return (ISC_R_FAILURE);
+
+#if 0
+			/* XXX: no unix domain socket support in netmgr */
+			for (element2 = cfg_list_first(unixcontrols);
+			     element2 != NULL;
+			     element2 = cfg_list_next(element2))
+			{
+				const cfg_obj_t *control = NULL;
+				const cfg_obj_t *path = NULL;
+				isc_sockaddr_t addr;
+				isc_result_t result;
+
+				/*
+				 * The parser handles BIND 8 configuration file
+				 * syntax, so it allows unix phrases as well
+				 * inet phrases with no keys{} clause.
+				 */
+				control = cfg_listelt_value(element2);
+
+				path = cfg_tuple_get(control, "path");
+				result = isc_sockaddr_frompath(
+					&addr, cfg_obj_asstring(path));
+				if (result != ISC_R_SUCCESS) {
+					isc_log_write(
+						named_g_lctx,
+						NAMED_LOGCATEGORY_GENERAL,
+						NAMED_LOGMODULE_CONTROL,
+						ISC_LOG_DEBUG(9),
+						"control channel '%s': %s",
+						cfg_obj_asstring(path),
+						isc_result_totext(result));
+					continue;
+				}
+
+				isc_log_write(named_g_lctx,
+					      NAMED_LOGCATEGORY_GENERAL,
+					      NAMED_LOGMODULE_CONTROL,
+					      ISC_LOG_DEBUG(9),
+					      "processing control channel '%s'",
+					      cfg_obj_asstring(path));
+
+				update_listener(cp, &listener, control, config,
+						&addr, aclconfctx,
+						cfg_obj_asstring(path),
+						isc_socktype_unix);
+
+				if (listener != NULL) {
+					/*
+					 * Remove the listener from the old
+					 * list, so it won't be shut down.
+					 */
+					ISC_LIST_UNLINK(cp->listeners, listener,
+							link);
+				} else {
+					/*
+					 * This is a new listener.
+					 */
+					add_listener(cp, &listener, control,
+						     config, &addr, aclconfctx,
+						     cfg_obj_asstring(path),
+						     isc_socktype_unix);
+				}
+
+				if (listener != NULL) {
+					ISC_LIST_APPEND(new_listeners, listener,
+							link);
+				}
+			}
+#endif
+		}
 	} else {
 		int i;
 
@@ -1356,6 +1465,7 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 
 	ISC_LIST_INIT(controls->listeners);
 
+	atomic_init(&controls->shuttingdown, false);
 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
 	result = isccc_cc_createsymtab(&controls->symtab);
@@ -1375,7 +1485,6 @@ named_controls_destroy(named_controls_t **ctrlsp) {
 	named_controls_t *controls = *ctrlsp;
 	*ctrlsp = NULL;
 
-	REQUIRE(controls->shuttingdown);
 	REQUIRE(ISC_LIST_EMPTY(controls->listeners));
 
 	LOCK(&controls->symtab_lock);

bin/named/dlz_dlopen_driver.c

@@ -18,6 +18,7 @@
 #include <string.h>
 
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/util.h>
 #include <isc/uv.h>
@@ -224,11 +225,12 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 
 	isc_mem_create(&mctx);
 	cd = isc_mem_get(mctx, sizeof(*cd));
-	*cd = (dlopen_data_t){
-		.mctx = mctx,
-		.dl_path = isc_mem_strdup(mctx, argv[1]),
-		.dlzname = isc_mem_strdup(mctx, dlzname),
-	};
+	memset(cd, 0, sizeof(*cd));
+
+	cd->mctx = mctx;
+
+	cd->dl_path = isc_mem_strdup(cd->mctx, argv[1]);
+	cd->dlzname = isc_mem_strdup(cd->mctx, dlzname);
 
 	/* Initialize the lock */
 	isc_mutex_init(&cd->lock);
@@ -530,7 +532,8 @@ dlz_dlopen_init(isc_mem_t *mctx) {
 				  mctx, &dlz_dlopen);
 
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR("dns_sdlzregister() failed: %s",
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "dns_sdlzregister() failed: %s",
 				 isc_result_totext(result));
 		result = ISC_R_UNEXPECTED;
 	}

bin/named/fuzz.c

@@ -25,8 +25,8 @@
 #include <string.h>
 #include <unistd.h>
 
+#include <isc/app.h>
 #include <isc/condition.h>
-#include <isc/loop.h>
 #include <isc/mutex.h>
 #include <isc/thread.h>
 #include <isc/util.h>
@@ -126,7 +126,7 @@ fuzz_thread_client(void *arg) {
 				close(sockfd);
 				named_server_flushonshutdown(named_g_server,
 							     false);
-				isc_loopmgr_shutdown(named_g_loopmgr);
+				isc_app_shutdown();
 				return (NULL);
 			}
 			raise(SIGSTOP);
@@ -159,7 +159,7 @@ fuzz_thread_client(void *arg) {
 	close(sockfd);
 
 	named_server_flushonshutdown(named_g_server, false);
-	isc_loopmgr_shutdown(named_g_loopmgr);
+	isc_app_shutdown();
 
 	return (NULL);
 }
@@ -374,7 +374,7 @@ fuzz_thread_resolver(void *arg) {
 				close(listenfd);
 				named_server_flushonshutdown(named_g_server,
 							     false);
-				isc_loopmgr_shutdown(named_g_loopmgr);
+				isc_app_shutdown();
 				return (NULL);
 			}
 			raise(SIGSTOP);
@@ -574,7 +574,7 @@ fuzz_thread_resolver(void *arg) {
 	close(sockfd);
 	close(listenfd);
 	named_server_flushonshutdown(named_g_server, false);
-	isc_loopmgr_shutdown(named_g_loopmgr);
+	isc_app_shutdown();
 
 #ifdef __AFL_LOOP
 	/*
@@ -716,7 +716,7 @@ fuzz_thread_tcp(void *arg) {
 	free(buf);
 	close(sockfd);
 	named_server_flushonshutdown(named_g_server, false);
-	isc_loopmgr_shutdown(named_g_loopmgr);
+	isc_app_shutdown();
 
 	return (NULL);
 }
@@ -733,7 +733,7 @@ named_fuzz_notify(void) {
 #ifdef ENABLE_AFL
 	if (getenv("AFL_CMIN")) {
 		named_server_flushonshutdown(named_g_server, false);
-		isc_loopmgr_shutdown(named_g_loopmgr);
+		isc_app_shutdown();
 		return;
 	}
 

bin/named/geoip.c

@@ -18,6 +18,7 @@
 #endif /* if defined(HAVE_GEOIP2) */
 
 #include <isc/dir.h>
+#include <isc/print.h>
 #include <isc/string.h>
 #include <isc/util.h>
 

bin/named/include/named/builtin.h

@@ -15,19 +15,8 @@
 
 /*! \file */
 
-#include <inttypes.h>
-
-#include <isc/lang.h>
 #include <isc/types.h>
 
-#include <dns/clientinfo.h>
-#include <dns/types.h>
-
-/***
- *** Functions
- ***/
-
-/* Initialization functions for builtin zone databases */
 isc_result_t
 named_builtin_init(void);
 

bin/named/include/named/config.h

@@ -52,9 +52,20 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 dns_zonetype_t
 named_config_getzonetype(const cfg_obj_t *zonetypeobj);
 
+isc_result_t
+named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
+		       in_port_t defport, isc_mem_t *mctx,
+		       isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
+		       uint32_t *countp);
+
+void
+named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
+		       isc_dscp_t **dscpsp, uint32_t count);
+
 isc_result_t
 named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
-			   const char *name, const cfg_obj_t **ret);
+			   const char *name, const cfg_obj_t **ret,
+			   bool *isremote);
 
 isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
@@ -66,5 +77,11 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 		     in_port_t *portp);
 
 isc_result_t
-named_config_getkeyalgorithm(const char *str, unsigned int *typep,
+named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
 			     uint16_t *digestbits);
+isc_result_t
+named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
+			      unsigned int *typep, uint16_t *digestbits);
+
+isc_result_t
+named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp);

bin/named/include/named/control.h

@@ -20,10 +20,9 @@
 
 #include <stdbool.h>
 
-#include <isccc/types.h>
-
 #include <isccfg/aclconf.h>
 
+#include <isccc/types.h>
 #include <named/types.h>
 
 #define NAMED_CONTROL_PORT 953
@@ -44,6 +43,8 @@
 #define NAMED_COMMAND_FLUSHNAME	   "flushname"
 #define NAMED_COMMAND_FLUSHTREE	   "flushtree"
 #define NAMED_COMMAND_STATUS	   "status"
+#define NAMED_COMMAND_TSIGLIST	   "tsig-list"
+#define NAMED_COMMAND_TSIGDELETE   "tsig-delete"
 #define NAMED_COMMAND_FREEZE	   "freeze"
 #define NAMED_COMMAND_UNFREEZE	   "unfreeze"
 #define NAMED_COMMAND_THAW	   "thaw"
@@ -69,7 +70,6 @@
 #define NAMED_COMMAND_DNSTAP	   "dnstap"
 #define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
 #define NAMED_COMMAND_SERVESTALE   "serve-stale"
-#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"
 
 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp);

bin/named/include/named/globals.h

@@ -18,7 +18,6 @@
 #include <stdbool.h>
 
 #include <isc/log.h>
-#include <isc/loop.h>
 #include <isc/net.h>
 #include <isc/netmgr.h>
 #include <isc/rwlock.h>
@@ -26,11 +25,10 @@
 #include <dns/acl.h>
 #include <dns/zone.h>
 
-#include <dst/dst.h>
-
 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
 
+#include <dst/dst.h>
 #include <named/fuzz.h>
 #include <named/types.h>
 
@@ -50,9 +48,8 @@
 
 EXTERN isc_mem_t *named_g_mctx		      INIT(NULL);
 EXTERN unsigned int named_g_cpus	      INIT(0);
-EXTERN isc_loop_t *named_g_mainloop	      INIT(NULL);
-EXTERN isc_loopmgr_t *named_g_loopmgr	      INIT(NULL);
-EXTERN bool named_g_loopmgr_running	      INIT(false);
+EXTERN unsigned int named_g_udpdisp	      INIT(0);
+EXTERN isc_taskmgr_t *named_g_taskmgr	      INIT(NULL);
 EXTERN dns_dispatchmgr_t *named_g_dispatchmgr INIT(NULL);
 EXTERN unsigned int named_g_cpus_detected     INIT(1);
 
@@ -64,19 +61,21 @@ EXTERN bool named_g_run_done INIT(false);
  *         for really short timers, another for client timers, and one
  *         for zone timers.
  */
-EXTERN isc_nm_t *named_g_netmgr	       INIT(NULL);
-EXTERN cfg_parser_t *named_g_parser    INIT(NULL);
-EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
-EXTERN const char *named_g_version     INIT(PACKAGE_VERSION);
-EXTERN const char *named_g_product     INIT(PACKAGE_NAME);
-EXTERN const char *named_g_description INIT(PACKAGE_DESCRIPTION);
-EXTERN const char *named_g_srcid       INIT(PACKAGE_SRCID);
-EXTERN const char *named_g_configargs  INIT(PACKAGE_CONFIGARGS);
-EXTERN const char *named_g_builder     INIT(PACKAGE_BUILDER);
-EXTERN in_port_t named_g_port	       INIT(0);
-EXTERN in_port_t named_g_tlsport       INIT(0);
-EXTERN in_port_t named_g_httpsport     INIT(0);
-EXTERN in_port_t named_g_httpport      INIT(0);
+EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
+EXTERN isc_nm_t *named_g_netmgr		INIT(NULL);
+EXTERN cfg_parser_t *named_g_parser	INIT(NULL);
+EXTERN cfg_parser_t *named_g_addparser	INIT(NULL);
+EXTERN const char *named_g_version	INIT(PACKAGE_VERSION);
+EXTERN const char *named_g_product	INIT(PACKAGE_NAME);
+EXTERN const char *named_g_description	INIT(PACKAGE_DESCRIPTION);
+EXTERN const char *named_g_srcid	INIT(PACKAGE_SRCID);
+EXTERN const char *named_g_configargs	INIT(PACKAGE_CONFIGARGS);
+EXTERN const char *named_g_builder	INIT(PACKAGE_BUILDER);
+EXTERN in_port_t named_g_port		INIT(0);
+EXTERN in_port_t named_g_tlsport	INIT(0);
+EXTERN in_port_t named_g_httpsport	INIT(0);
+EXTERN in_port_t named_g_httpport	INIT(0);
+EXTERN isc_dscp_t named_g_dscp		INIT(-1);
 
 EXTERN in_port_t named_g_http_listener_clients INIT(0);
 EXTERN in_port_t named_g_http_streams_per_conn INIT(0);
@@ -97,7 +96,7 @@ EXTERN unsigned int named_g_debuglevel	     INIT(0);
 EXTERN cfg_obj_t *named_g_config	   INIT(NULL);
 EXTERN const cfg_obj_t *named_g_defaults   INIT(NULL);
 EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
-EXTERN const char *named_g_defaultbindkeys INIT(NULL);
+EXTERN const char *named_g_defaultbindkeys INIT(NAMED_SYSCONFDIR "/bind.keys");
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");
 
 EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
@@ -105,6 +104,14 @@ EXTERN dns_name_t			    named_g_sessionkeyname;
 EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);
 
+/*
+ * Initial resource limits.
+ */
+EXTERN isc_resourcevalue_t named_g_initstacksize INIT(0);
+EXTERN isc_resourcevalue_t named_g_initdatasize	 INIT(0);
+EXTERN isc_resourcevalue_t named_g_initcoresize	 INIT(0);
+EXTERN isc_resourcevalue_t named_g_initopenfiles INIT(0);
+
 /*
  * Misc.
  */
@@ -118,6 +125,11 @@ EXTERN const char *named_g_logfile   INIT(NULL);
 EXTERN const char *named_g_defaultsessionkeyfile INIT(NAMED_LOCALSTATEDIR
 						      "/run/named/"
 						      "session.key");
+EXTERN const char *named_g_defaultlockfile INIT(NAMED_LOCALSTATEDIR "/run/"
+								    "named/"
+								    "named."
+								    "lock");
+EXTERN bool named_g_forcelock		   INIT(false);
 
 #if NAMED_RUN_PID_DIR
 EXTERN const char *named_g_defaultpidfile INIT(NAMED_LOCALSTATEDIR "/run/named/"

bin/named/include/named/main.h

@@ -34,6 +34,3 @@ named_main_earlywarning(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
 void
 named_main_setmemstats(const char *);
-
-void
-named_main_shutdown(void *arg, int signum);

bin/named/include/named/os.h

@@ -56,9 +56,15 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user);
 void
 named_os_writepidfile(const char *filename, bool first_time);
 
+bool
+named_os_issingleton(const char *filename);
+
 void
 named_os_shutdown(void);
 
+isc_result_t
+named_os_gethostname(char *buf, size_t len);
+
 void
 named_os_shutdownmsg(char *command, isc_buffer_t *text);
 

bin/named/include/named/server.h

@@ -21,7 +21,6 @@
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/quota.h>
-#include <isc/signal.h>
 #include <isc/sockaddr.h>
 #include <isc/tls.h>
 #include <isc/types.h>
@@ -38,6 +37,13 @@
 
 #include <named/types.h>
 
+#define NAMED_EVENTCLASS     ISC_EVENTCLASS(0x4E43)
+#define NAMED_EVENT_RELOAD   (NAMED_EVENTCLASS + 0)
+#define NAMED_EVENT_DELZONE  (NAMED_EVENTCLASS + 1)
+#define NAMED_EVENT_COMMAND  (NAMED_EVENTCLASS + 2)
+#define NAMED_EVENT_TATSEND  (NAMED_EVENTCLASS + 3)
+#define NAMED_EVENT_SHUTDOWN (NAMED_EVENTCLASS + 4)
+
 /*%
  * Name server state.  Better here than in lots of separate global variables.
  */
@@ -47,25 +53,27 @@ struct named_server {
 
 	ns_server_t *sctx;
 
+	isc_task_t *task;
+
 	char *statsfile;    /*%< Statistics file name */
 	char *dumpfile;	    /*%< Dump file name */
 	char *secrootsfile; /*%< Secroots file name */
-	char *bindkeysfile; /*%< bind.keys file name */
+	char *bindkeysfile; /*%< bind.keys file name
+			     * */
 	char *recfile;	    /*%< Recursive file name */
-	bool  version_set;  /*%< User has set version */
+	bool  version_set;  /*%< User has set version
+			     * */
 	char *version;	    /*%< User-specified version */
-	bool  hostname_set; /*%< User has set hostname */
-	char *hostname;	    /*%< User-specified hostname */
-#ifdef USE_DNSRPS
-	char *dnsrpslib;
-#endif /* ifdef USE_DNSRPS */
+	bool  hostname_set; /*%< User has set hostname
+			     * */
+	char *hostname;	    /*%< User-specified hostname
+			     * */
 
 	/* Server data structures. */
 	dns_loadmgr_t	  *loadmgr;
 	dns_zonemgr_t	  *zonemgr;
 	dns_viewlist_t	   viewlist;
 	dns_kasplist_t	   kasplist;
-	dns_keystorelist_t keystorelist;
 	ns_interfacemgr_t *interfacemgr;
 	dns_db_t	  *in_roothints;
 
@@ -93,7 +101,7 @@ struct named_server {
 
 	named_statschannellist_t statschannels;
 
-	dst_key_t     *sessionkey;
+	dns_tsigkey_t *sessionkey;
 	char	      *session_keyfile;
 	dns_name_t    *session_keyname;
 	unsigned int   session_keyalg;
@@ -104,10 +112,10 @@ struct named_server {
 
 	dns_dtenv_t *dtenv; /*%< Dnstap environment */
 
+	char *lockfile;
+
 	isc_tlsctx_cache_t *tlsctx_server_cache;
 	isc_tlsctx_cache_t *tlsctx_client_cache;
-
-	isc_signal_t *sighup;
 };
 
 #define NAMED_SERVER_MAGIC    ISC_MAGIC('S', 'V', 'E', 'R')
@@ -128,7 +136,13 @@ named_server_destroy(named_server_t **serverp);
  */
 
 void
-named_server_reloadwanted(void *arg, int signum);
+named_server_shutdown(named_server_t *server);
+/*%<
+ * Initiate the server shutdown.
+ */
+
+void
+named_server_reloadwanted(named_server_t *server);
 /*%<
  * Inform a server that a reload is wanted.  This function
  * may be called asynchronously, from outside the server's task.
@@ -248,6 +262,19 @@ named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree);
 isc_result_t
 named_server_status(named_server_t *server, isc_buffer_t **text);
 
+/*%
+ * Report a list of dynamic and static tsig keys, per view.
+ */
+isc_result_t
+named_server_tsiglist(named_server_t *server, isc_buffer_t **text);
+
+/*%
+ * Delete a specific key (with optional view).
+ */
+isc_result_t
+named_server_tsigdelete(named_server_t *server, isc_lex_t *lex,
+			isc_buffer_t **text);
+
 /*%
  * Enable or disable updates for a zone.
  */
@@ -277,6 +304,12 @@ named_server_rekey(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 isc_result_t
 named_server_dumprecursing(named_server_t *server);
 
+/*%
+ * Maintain a list of dispatches that require reserved ports.
+ */
+void
+named_add_reserved_dispatch(named_server_t *server, const isc_sockaddr_t *addr);
+
 /*%
  * Enable or disable dnssec validation.
  */
@@ -368,10 +401,3 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text);
 isc_result_t
 named_server_servestale(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text);
-
-/*%
- * Report fetch-limited ADB server addresses.
- */
-isc_result_t
-named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
-			isc_buffer_t **text);

bin/named/include/named/statschannel.h

@@ -18,10 +18,9 @@
  * The statistics channels built-in the name server.
  */
 
-#include <isccc/types.h>
-
 #include <isccfg/aclconf.h>
 
+#include <isccc/types.h>
 #include <named/types.h>
 
 #define NAMED_STATSCHANNEL_HTTPPORT 80

bin/named/include/named/tsigconf.h

@@ -22,7 +22,7 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
-			     isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
+			     isc_mem_t *mctx, dns_tsig_keyring_t **ringp);
 /*%<
  * Create a TSIG key ring and configure it according to the 'key'
  * statements in the global and view configuration objects.

bin/named/include/named/zoneconf.h

@@ -28,8 +28,8 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
-		     dns_kasplist_t *kasplist, dns_keystorelist_t *keystores,
-		     dns_zone_t *zone, dns_zone_t *raw);
+		     dns_kasplist_t *kasplist, dns_zone_t *zone,
+		     dns_zone_t *raw);
 /*%<
  * Configure or reconfigure a zone according to the named.conf
  * data.
@@ -46,7 +46,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 bool
 named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
-		    dns_kasplist_t *kasplist);
+		    cfg_aclconfctx_t *actx);
 /*%<
  * If 'zone' can be safely reconfigured according to the configuration
  * data in 'zconfig', return true.  If the configuration data is so
@@ -55,12 +55,12 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
  */
 
 bool
-named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
-			 const cfg_obj_t *config, dns_kasplist_t *kasplist);
+named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
+			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
+			 cfg_aclconfctx_t *actx);
 /*%<
  * Determine if zone uses inline-signing. This is true if inline-signing
- * is set to yes, in the zone clause or in the zone's dnssec-policy clause.
- * By default, dnssec-policy uses inline-signing.
+ * is set to yes, or if there is a dnssec-policy on a non-dynamic zone.
  */
 
 isc_result_t

bin/named/log.c

@@ -51,7 +51,6 @@ isc_result_t
 named_log_init(bool safe) {
 	isc_result_t result;
 	isc_logconfig_t *lcfg = NULL;
-	isc_mem_t *log_mctx = NULL;
 
 	named_g_categories = categories;
 	named_g_modules = modules;
@@ -59,10 +58,7 @@ named_log_init(bool safe) {
 	/*
 	 * Setup a logging context.
 	 */
-	isc_mem_create(&log_mctx);
-	isc_mem_setname(log_mctx, "named_log");
-	isc_log_create(log_mctx, &named_g_lctx, &lcfg);
-	isc_mem_detach(&log_mctx);
+	isc_log_create(named_g_mctx, &named_g_lctx, &lcfg);
 
 	/*
 	 * named-checktool.c:setup_logging() needs to be kept in sync.
@@ -202,8 +198,7 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 	isc_result_t result;
 
 	if (sslkeylogfile_path == NULL ||
-	    strcmp(sslkeylogfile_path, "config") == 0)
-	{
+	    strcmp(sslkeylogfile_path, "config") == 0) {
 		return;
 	}
 

bin/named/logconf.c

@@ -17,6 +17,8 @@
 #include <stdbool.h>
 
 #include <isc/file.h>
+#include <isc/offset.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
@@ -144,14 +146,14 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 		const cfg_obj_t *suffixobj = cfg_tuple_get(fileobj, "suffix");
 		int32_t versions = ISC_LOG_ROLLNEVER;
 		isc_log_rollsuffix_t suffix = isc_log_rollsuffix_increment;
-		off_t size = 0;
+		isc_offset_t size = 0;
 		uint64_t maxoffset;
 
 		/*
-		 * off_t is a signed integer type, so the maximum
+		 * isc_offset_t is a signed integer type, so the maximum
 		 * value is all 1s except for the MSB.
 		 */
-		switch (sizeof(off_t)) {
+		switch (sizeof(isc_offset_t)) {
 		case 4:
 			maxoffset = 0x7fffffffULL;
 			break;
@@ -176,7 +178,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 		if (sizeobj != NULL && cfg_obj_isuint64(sizeobj) &&
 		    cfg_obj_asuint64(sizeobj) < maxoffset)
 		{
-			size = (off_t)cfg_obj_asuint64(sizeobj);
+			size = (isc_offset_t)cfg_obj_asuint64(sizeobj);
 		}
 		if (suffixobj != NULL && cfg_obj_isstring(suffixobj) &&
 		    strcasecmp(cfg_obj_asstring(suffixobj), "timestamp") == 0)

bin/named/main.c

@@ -24,25 +24,26 @@
 #include <protobuf-c/protobuf-c.h>
 #endif
 
+#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
-#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
 #include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
+#include <isc/print.h>
+#include <isc/resource.h>
 #include <isc/result.h>
-#include <isc/signal.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 #include <isc/uv.h>
-#include <isc/xml.h>
 
 #include <dns/dispatch.h>
 #include <dns/dyndb.h>
@@ -86,12 +87,7 @@
 #endif /* ifdef HAVE_LIBSCF */
 
 #include <openssl/crypto.h>
-#include <openssl/evp.h>
 #include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-#include <openssl/err.h>
-#include <openssl/provider.h>
-#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/parser.h>
 #include <libxml/xmlversion.h>
@@ -102,20 +98,19 @@
 #ifdef HAVE_LIBNGHTTP2
 #include <nghttp2/nghttp2.h>
 #endif
-
-/* On DragonFly BSD the header does not provide jemalloc API */
-#if defined(HAVE_MALLOC_NP_H) && !defined(__DragonFly__)
-#include <malloc_np.h>
-#include <sys/malloc.h> /* For M_VERSION */
-#elif defined(HAVE_JEMALLOC)
-#include <jemalloc/jemalloc.h>
-#endif
-
 /*
  * Include header files for database drivers here.
  */
 /* #include "xxdb.h" */
 
+/*
+ * The maximum number of stack frames to dump on assertion failure.
+ */
+#ifndef BACKTRACE_MAXFRAME
+#define BACKTRACE_MAXFRAME 128
+#endif /* ifndef BACKTRACE_MAXFRAME */
+
+extern int isc_dscp_check_value;
 extern unsigned int dns_zone_mkey_hour;
 extern unsigned int dns_zone_mkey_day;
 extern unsigned int dns_zone_mkey_month;
@@ -142,9 +137,6 @@ static bool nonearest = false;
 static bool nosoa = false;
 static bool notcp = false;
 static bool sigvalinsecs = false;
-static bool transferinsecs = false;
-static bool transferslowly = false;
-static bool transferstuck = false;
 
 /*
  * -4 and -6
@@ -152,10 +144,6 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-static OSSL_PROVIDER *fips = NULL, *base = NULL;
-#endif
-
 void
 named_main_earlywarning(const char *format, ...) {
 	va_list args;
@@ -194,7 +182,7 @@ named_main_earlyfatal(const char *format, ...) {
 	}
 	va_end(args);
 
-	_exit(EXIT_FAILURE);
+	exit(1);
 }
 
 noreturn static void
@@ -204,6 +192,9 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 static void
 assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond) {
+	void *tracebuf[BACKTRACE_MAXFRAME];
+	int nframes;
+
 	/*
 	 * Handle assertion failures.
 	 */
@@ -215,12 +206,24 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 */
 		isc_assertion_setcallback(NULL);
 
+		nframes = isc_backtrace(tracebuf, BACKTRACE_MAXFRAME);
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
-			      "%s:%d: %s(%s) failed", file, line,
-			      isc_assertion_typetotext(type), cond);
-		isc_backtrace_log(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
+			      "%s:%d: %s(%s) failed%s", file, line,
+			      isc_assertion_typetotext(type), cond,
+			      (nframes > 0) ? ", back trace" : "");
+		if (nframes > 0) {
+			char **strs = isc_backtrace_symbols(tracebuf, nframes);
+			if (strs != NULL) {
+				for (int i = 0; i < nframes; i++) {
+					isc_log_write(named_g_lctx,
+						      NAMED_LOGCATEGORY_GENERAL,
+						      NAMED_LOGMODULE_MAIN,
+						      ISC_LOG_CRITICAL, "%s",
+						      strs[i]);
+				}
+			}
+		}
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "exiting (due to assertion failure)");
@@ -233,16 +236,16 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	if (named_g_coreok) {
 		abort();
 	}
-	_exit(EXIT_FAILURE);
+	exit(1);
 }
 
 noreturn static void
-library_fatal_error(const char *file, int line, const char *func,
-		    const char *format, va_list args) ISC_FORMAT_PRINTF(3, 0);
+library_fatal_error(const char *file, int line, const char *format,
+		    va_list args) ISC_FORMAT_PRINTF(3, 0);
 
 static void
-library_fatal_error(const char *file, int line, const char *func,
-		    const char *format, va_list args) {
+library_fatal_error(const char *file, int line, const char *format,
+		    va_list args) {
 	/*
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */
@@ -256,7 +259,7 @@ library_fatal_error(const char *file, int line, const char *func,
 
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
-			      "%s:%d:%s(): fatal error: ", file, line, func);
+			      "%s:%d: fatal error:", file, line);
 		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
 			       args);
@@ -264,7 +267,7 @@ library_fatal_error(const char *file, int line, const char *func,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "exiting (due to fatal error in library)");
 	} else {
-		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		fprintf(stderr, "%s:%d: fatal error: ", file, line);
 		vfprintf(stderr, format, args);
 		fprintf(stderr, "\n");
 		fflush(stderr);
@@ -273,17 +276,16 @@ library_fatal_error(const char *file, int line, const char *func,
 	if (named_g_coreok) {
 		abort();
 	}
-	_exit(EXIT_FAILURE);
+	exit(1);
 }
 
 static void
-library_unexpected_error(const char *file, int line, const char *func,
-			 const char *format, va_list args)
-	ISC_FORMAT_PRINTF(3, 0);
+library_unexpected_error(const char *file, int line, const char *format,
+			 va_list args) ISC_FORMAT_PRINTF(3, 0);
 
 static void
-library_unexpected_error(const char *file, int line, const char *func,
-			 const char *format, va_list args) {
+library_unexpected_error(const char *file, int line, const char *format,
+			 va_list args) {
 	/*
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */
@@ -291,13 +293,12 @@ library_unexpected_error(const char *file, int line, const char *func,
 	if (named_g_lctx != NULL) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR,
-			      "%s:%d:%s(): unexpected error: ", file, line,
-			      func);
+			      "%s:%d: unexpected error:", file, line);
 		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			       NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR, format,
 			       args);
 	} else {
-		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		fprintf(stderr, "%s:%d: fatal error: ", file, line);
 		vfprintf(stderr, format, args);
 		fprintf(stderr, "\n");
 		fflush(stderr);
@@ -312,7 +313,7 @@ usage(void) {
 			"[-p port] [-s]\n"
 			"             [-S sockets] [-t chrootdir] [-u "
 			"username] [-U listeners]\n"
-			"             [-m "
+			"             [-X lockfile] [-m "
 			"{usage|trace|record|size|mctx}]\n"
 			"             [-M fill|nofill]\n"
 			"usage: named [-v|-V|-C]\n");
@@ -436,8 +437,7 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 		arglen = (int)(end - arg);
 		for (def = defs; def->name != NULL; def++) {
 			if (arglen == (int)strlen(def->name) &&
-			    memcmp(arg, def->name, arglen) == 0)
-			{
+			    memcmp(arg, def->name, arglen) == 0) {
 				if (def->value == 0) {
 					clear = true;
 				}
@@ -462,105 +462,11 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 	}
 }
 
-static void
-list_dnssec_algorithms(isc_buffer_t *b) {
-	for (dst_algorithm_t i = DST_ALG_UNKNOWN; i < DST_MAX_ALGS; i++) {
-		if (i == DST_ALG_GSSAPI ||
-		    (i >= DST_ALG_HMAC_FIRST && i <= DST_ALG_HMAC_LAST))
-		{
-			continue;
-		}
-		if (dst_algorithm_supported(i)) {
-			isc_buffer_putstr(b, " ");
-			(void)dns_secalg_totext(i, b);
-		}
-	}
-}
-
-static void
-list_ds_algorithms(isc_buffer_t *b) {
-	for (size_t i = 0; i < 256; i++) {
-		if (dst_ds_digest_supported(i)) {
-			isc_buffer_putstr(b, " ");
-			(void)dns_dsdigest_totext(i, b);
-		}
-	}
-}
-
-static void
-list_hmac_algorithms(isc_buffer_t *b) {
-	isc_buffer_t sb = *b;
-	for (dst_algorithm_t i = DST_ALG_HMAC_FIRST; i <= DST_ALG_HMAC_LAST;
-	     i++)
-	{
-		if (i == DST_ALG_GSSAPI) {
-			continue;
-		}
-		if (dst_algorithm_supported(i)) {
-			isc_buffer_putstr(b, " ");
-			isc_buffer_putstr(b, dst_hmac_algorithm_totext(i));
-		}
-	}
-	for (unsigned char *s = isc_buffer_used(&sb); s != isc_buffer_used(b);
-	     s++)
-	{
-		*s = toupper(*s);
-	}
-}
-
-static void
-logit(isc_buffer_t *b) {
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "%.*s",
-		      (int)isc_buffer_usedlength(b),
-		      (char *)isc_buffer_base(b));
-}
-
-static void
-printit(isc_buffer_t *b) {
-	printf("%.*s\n", (int)isc_buffer_usedlength(b),
-	       (char *)isc_buffer_base(b));
-}
-
-static void
-format_supported_algorithms(void (*emit)(isc_buffer_t *b)) {
-	isc_buffer_t b;
-	char buf[512];
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_putstr(&b, "DNSSEC algorithms:");
-	list_dnssec_algorithms(&b);
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_putstr(&b, "DS algorithms:");
-	list_ds_algorithms(&b);
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_putstr(&b, "HMAC algorithms:");
-	list_hmac_algorithms(&b);
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_printf(&b, "TKEY mode 2 support (Diffie-Hellman): %s", "no");
-	(*emit)(&b);
-
-	isc_buffer_init(&b, buf, sizeof(buf));
-	isc_buffer_printf(&b, "TKEY mode 3 support (GSS-API): %s",
-			  dst_algorithm_supported(DST_ALG_GSSAPI) ? "yes"
-								  : "no");
-	(*emit)(&b);
-}
-
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
-	isc_mem_t *mctx = NULL;
-	isc_result_t result;
-	isc_buffer_t b;
-	char buf[512];
 #if defined(HAVE_GEOIP2)
+	isc_mem_t *mctx = NULL;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *config = NULL;
 	const cfg_obj_t *defaults = NULL, *obj = NULL;
@@ -586,6 +492,9 @@ printversion(bool verbose) {
 #endif /* ifdef __GNUC__ */
 #endif /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #endif /* ifdef __clang__ */
+#ifdef _MSC_VER
+	printf("compiled by MSVC %d\n", _MSC_VER);
+#endif /* ifdef _MSC_VER */
 #ifdef __SUNPRO_C
 	printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
@@ -603,14 +512,6 @@ printversion(bool verbose) {
 	printf("compiled with libuv version: %d.%d.%d\n", UV_VERSION_MAJOR,
 	       UV_VERSION_MINOR, UV_VERSION_PATCH);
 	printf("linked to libuv version: %s\n", uv_version_string());
-	printf("compiled with %s version: %s\n", RCU_FLAVOR, RCU_VERSION);
-#if defined(JEMALLOC_VERSION)
-	printf("compiled with jemalloc version: %u.%u.%u\n",
-	       JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
-	       JEMALLOC_VERSION_BUGFIX);
-#elif defined(M_VERSION)
-	printf("compiled with system jemalloc version: %u\n", M_VERSION);
-#endif
 #if HAVE_LIBNGHTTP2
 	nghttp2_info *nginfo = NULL;
 	printf("compiled with libnghttp2 version: %s\n", NGHTTP2_VERSION);
@@ -637,19 +538,7 @@ printversion(bool verbose) {
 	printf("compiled with protobuf-c version: %s\n", PROTOBUF_C_VERSION);
 	printf("linked to protobuf-c version: %s\n", protobuf_c_version());
 #endif /* if defined(HAVE_DNSTAP) */
-	printf("threads support is enabled\n");
-
-	isc_mem_create(&mctx);
-	result = dst_lib_init(mctx, named_g_engine);
-	if (result == ISC_R_SUCCESS) {
-		isc_buffer_init(&b, buf, sizeof(buf));
-		format_supported_algorithms(printit);
-		printf("\n");
-		dst_lib_destroy();
-	} else {
-		printf("DST initialization failure: %s\n",
-		       isc_result_totext(result));
-	}
+	printf("threads support is enabled\n\n");
 
 	/*
 	 * The default rndc.conf and rndc.key paths are in the same
@@ -669,10 +558,13 @@ printversion(bool verbose) {
 	printf("default paths:\n");
 	printf("  named configuration:  %s\n", named_g_conffile);
 	printf("  rndc configuration:   %s\n", rndcconf);
+	printf("  DNSSEC root key:      %s\n", named_g_defaultbindkeys);
 	printf("  nsupdate session key: %s\n", named_g_defaultsessionkeyfile);
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
+	printf("  named lock file:      %s\n", named_g_defaultlockfile);
 #if defined(HAVE_GEOIP2)
 #define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
+	isc_mem_create(&mctx);
 	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
 	RTC(named_config_parsedefaults(parser, &config));
 	RTC(cfg_map_get(config, "options", &defaults));
@@ -716,9 +608,13 @@ parse_T_opt(char *option) {
 	/*
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
+	 * dscp=x:     check that dscp values are as
+	 * 	       expected and assert otherwise.
 	 */
 	if (!strcmp(option, "dropedns")) {
 		dropedns = true;
+	} else if (!strncmp(option, "dscp=", 5)) {
+		isc_dscp_check_value = atoi(option + 5);
 	} else if (!strcmp(option, "ednsformerr")) {
 		ednsformerr = true;
 	} else if (!strcmp(option, "ednsnotimp")) {
@@ -787,12 +683,6 @@ parse_T_opt(char *option) {
 		}
 	} else if (!strcmp(option, "sigvalinsecs")) {
 		sigvalinsecs = true;
-	} else if (!strcmp(option, "transferinsecs")) {
-		transferinsecs = true;
-	} else if (!strcmp(option, "transferslowly")) {
-		transferslowly = true;
-	} else if (!strcmp(option, "transferstuck")) {
-		transferstuck = true;
 	} else if (!strncmp(option, "tat=", 4)) {
 		named_g_tat_interval = atoi(option + 4);
 	} else {
@@ -892,7 +782,7 @@ parse_command_line(int argc, char *argv[]) {
 			printf("# Built-in default values. "
 			       "This is NOT the run-time configuration!\n");
 			printf("%s", named_config_getdefault());
-			exit(EXIT_SUCCESS);
+			exit(0);
 		case 'd':
 			named_g_debuglevel = parse_int(isc_commandline_argument,
 						       "debug "
@@ -948,52 +838,38 @@ parse_command_line(int argc, char *argv[]) {
 			parse_T_opt(isc_commandline_argument);
 			break;
 		case 'U':
-			/* Obsolete.  No longer in use.  Ignore. */
+			named_g_udpdisp = parse_int(isc_commandline_argument,
+						    "number of UDP listeners "
+						    "per interface");
 			break;
 		case 'u':
 			named_g_username = isc_commandline_argument;
 			break;
 		case 'v':
 			printversion(false);
-			exit(EXIT_SUCCESS);
+			exit(0);
 		case 'V':
 			printversion(true);
-			exit(EXIT_SUCCESS);
+			exit(0);
 		case 'x':
 			/* Obsolete. No longer in use. Ignore. */
 			break;
 		case 'X':
-			/* Obsolete. No longer in use. Abort. */
-			named_main_earlyfatal("option '-X' has been removed");
+			named_g_forcelock = true;
+			if (strcasecmp(isc_commandline_argument, "none") != 0) {
+				named_g_defaultlockfile =
+					isc_commandline_argument;
+			} else {
+				named_g_defaultlockfile = NULL;
+			}
 			break;
 		case 'F':
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-			fips = OSSL_PROVIDER_load(NULL, "fips");
-			if (fips == NULL) {
-				ERR_clear_error();
-				named_main_earlyfatal(
-					"Failed to load FIPS provider");
-			}
-			base = OSSL_PROVIDER_load(NULL, "base");
-			if (base == NULL) {
-				OSSL_PROVIDER_unload(fips);
-				ERR_clear_error();
-				named_main_earlyfatal(
-					"Failed to load base provider");
-			}
-#endif
-			if (isc_fips_mode()) { /* Already in FIPS mode. */
-				break;
-			}
-			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
-				named_main_earlyfatal(
-					"setting FIPS mode failed");
-			}
-			break;
+			/* Reserved for FIPS mode */
+			FALLTHROUGH;
 		case '?':
 			usage();
 			if (isc_commandline_option == '?') {
-				exit(EXIT_SUCCESS);
+				exit(0);
 			}
 			p = strchr(NAMED_MAIN_ARGS, isc_commandline_option);
 			if (p == NULL || *++p != ':') {
@@ -1023,31 +899,51 @@ parse_command_line(int argc, char *argv[]) {
 
 static isc_result_t
 create_managers(void) {
-	/*
-	 * Set the default named_g_cpus if it was not set from the command line
-	 */
+	isc_result_t result;
+
 	INSIST(named_g_cpus_detected > 0);
+
 	if (named_g_cpus == 0) {
 		named_g_cpus = named_g_cpus_detected;
 	}
-
 	isc_log_write(
 		named_g_lctx, NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
 		named_g_cpus_detected, named_g_cpus_detected == 1 ? "" : "s",
 		named_g_cpus, named_g_cpus == 1 ? "" : "s");
+	if (named_g_udpdisp == 0) {
+		named_g_udpdisp = named_g_cpus_detected;
+	}
+	if (named_g_udpdisp > named_g_cpus) {
+		named_g_udpdisp = named_g_cpus;
+	}
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+		      "using %u UDP listener%s per interface", named_g_udpdisp,
+		      named_g_udpdisp == 1 ? "" : "s");
 
-	isc_managers_create(&named_g_mctx, named_g_cpus, &named_g_loopmgr,
-			    &named_g_netmgr);
+	result = isc_managers_create(named_g_mctx, named_g_cpus,
+				     0 /* quantum */, &named_g_netmgr,
+				     &named_g_taskmgr, &named_g_timermgr);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
 
 	isc_nm_maxudp(named_g_netmgr, maxudp);
 
 	return (ISC_R_SUCCESS);
 }
 
+static void
+destroy_managers(void) {
+	isc_managers_destroy(&named_g_netmgr, &named_g_taskmgr,
+			     &named_g_timermgr);
+}
+
 static void
 setup(void) {
 	isc_result_t result;
+	isc_resourcevalue_t old_openfiles;
 	ns_server_t *sctx;
 #ifdef HAVE_LIBSCF
 	char *instance = NULL;
@@ -1115,6 +1011,16 @@ setup(void) {
 		named_os_daemonize();
 	}
 
+	/*
+	 * We call isc_app_start() here as some versions of FreeBSD's fork()
+	 * destroys all the signal handling it sets up.
+	 */
+	result = isc_app_start();
+	if (result != ISC_R_SUCCESS) {
+		named_main_earlyfatal("isc_app_start() failed: %s",
+				      isc_result_totext(result));
+	}
+
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "starting %s%s <id:%s>", PACKAGE_STRING,
@@ -1149,6 +1055,11 @@ setup(void) {
 #endif /* ifdef __GNUC__ */
 #endif /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #endif /* ifdef __clang__ */
+#ifdef _MSC_VER
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by MSVC %d", _MSC_VER);
+#endif /* ifdef _MSC_VER */
 #ifdef __SUNPRO_C
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1171,37 +1082,6 @@ setup(void) {
 		      "linked to OpenSSL version: %s",
 		      SSLeay_version(SSLEAY_VERSION));
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libuv version: %d.%d.%d", UV_VERSION_MAJOR,
-		      UV_VERSION_MINOR, UV_VERSION_PATCH);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libuv version: %s", uv_version_string());
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with %s version: %s", RCU_FLAVOR, RCU_VERSION);
-#if defined(JEMALLOC_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with jemalloc version: %u.%u.%u",
-		      JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
-		      JEMALLOC_VERSION_BUGFIX);
-#elif defined(M_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with system jemalloc version: %u", M_VERSION);
-#endif
-#if HAVE_LIBNGHTTP2
-	nghttp2_info *nginfo = NULL;
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libnghttp2 version: %s", NGHTTP2_VERSION);
-	nginfo = nghttp2_version(1);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libnghttp2 version: %s", nginfo->version_str);
-#endif
 #ifdef HAVE_LIBXML2
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1227,21 +1107,6 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "linked to zlib version: %s", zlibVersion());
 #endif /* if defined(HAVE_ZLIB) && defined(ZLIB_VERSION) */
-#if defined(HAVE_GEOIP2)
-	/* Unfortunately, no version define on link time */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to maxminddb version: %s", MMDB_lib_version());
-#endif /* if defined(HAVE_GEOIP2) */
-#if defined(HAVE_DNSTAP)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with protobuf-c version: %s",
-		      PROTOBUF_C_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to protobuf-c version: %s", protobuf_c_version());
-#endif /* if defined(HAVE_DNSTAP) */
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
@@ -1261,11 +1126,39 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
 
+	/*
+	 * Get the initial resource limits.
+	 */
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_stacksize,
+					    &named_g_initstacksize) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_datasize,
+					    &named_g_initdatasize) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_coresize,
+					    &named_g_initcoresize) ==
+		      ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles) ==
+		      ISC_R_SUCCESS);
+
 	/*
 	 * System resources cannot effectively be tuned on some systems.
 	 * Raise the limit in such cases for safety.
 	 */
+	old_openfiles = named_g_initopenfiles;
 	named_os_adjustnofile();
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles) ==
+		      ISC_R_SUCCESS);
+	if (old_openfiles != named_g_initopenfiles) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+			      "adjusted limit on open files from "
+			      "%" PRIu64 " to "
+			      "%" PRIu64,
+			      old_openfiles, named_g_initopenfiles);
+	}
 
 	/*
 	 * If the named configuration filename is relative, prepend the current
@@ -1287,7 +1180,11 @@ setup(void) {
 	/*
 	 * Record the server's startup time.
 	 */
-	named_g_boottime = isc_time_now();
+	result = isc_time_now(&named_g_boottime);
+	if (result != ISC_R_SUCCESS) {
+		named_main_earlyfatal("isc_time_now() failed: %s",
+				      isc_result_totext(result));
+	}
 
 	result = create_managers();
 	if (result != ISC_R_SUCCESS) {
@@ -1315,12 +1212,6 @@ setup(void) {
 	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;
 
-	/*
-	 * Report supported algorithms now that dst_lib_init() has
-	 * been called via named_server_create().
-	 */
-	format_supported_algorithms(logit);
-
 	/*
 	 * Modify server context according to command line options
 	 */
@@ -1363,19 +1254,14 @@ setup(void) {
 	if (sigvalinsecs) {
 		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);
 	}
-	if (transferinsecs) {
-		ns_server_setoption(sctx, NS_SERVER_TRANSFERINSECS, true);
-	}
-	if (transferslowly) {
-		ns_server_setoption(sctx, NS_SERVER_TRANSFERSLOWLY, true);
-	}
-	if (transferstuck) {
-		ns_server_setoption(sctx, NS_SERVER_TRANSFERSTUCK, true);
-	}
 }
 
 static void
 cleanup(void) {
+	named_server_shutdown(named_g_server);
+
+	destroy_managers();
+
 	if (named_g_mapped != NULL) {
 		dns_acl_detach(&named_g_mapped);
 	}
@@ -1433,7 +1319,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if ((h = scf_handle_create(SCF_VERSION)) == NULL) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_handle_create() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_handle_create() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		return (ISC_R_FAILURE);
@@ -1441,7 +1328,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if (scf_handle_bind(h) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_handle_bind() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_handle_bind() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1450,7 +1338,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if ((namelen = scf_myname(h, NULL, 0)) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_myname() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_myname() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1458,7 +1347,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 	}
 
 	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
-		UNEXPECTED_ERROR("named_smf_get_instance memory "
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "named_smf_get_instance memory "
 				 "allocation failed: %s",
 				 isc_result_totext(ISC_R_NOMEMORY));
 		scf_handle_destroy(h);
@@ -1467,7 +1357,8 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 
 	if (scf_myname(h, instance, namelen + 1) == -1) {
 		if (debug) {
-			UNEXPECTED_ERROR("scf_myname() failed: %s",
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "scf_myname() failed: %s",
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
@@ -1494,6 +1385,10 @@ main(int argc, char *argv[]) {
 	(void)ProfilerStart(NULL);
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */
 
+#ifdef HAVE_LIBXML2
+	xmlInitThreads();
+#endif /* HAVE_LIBXML2 */
+
 	/*
 	 * Technically, this call is superfluous because on startup of the main
 	 * program, the portable "C" locale is selected by default.  This
@@ -1558,27 +1453,38 @@ main(int argc, char *argv[]) {
 		}
 	}
 
-	setup();
+	isc_mem_create(&named_g_mctx);
 	isc_mem_setname(named_g_mctx, "main");
-	INSIST(named_g_server != NULL);
+
+	setup();
 
 	/*
-	 * Start things running
+	 * Start things running and then wait for a shutdown request
+	 * or reload.
 	 */
-	isc_signal_start(named_g_server->sighup);
+	do {
+		result = isc_app_run();
 
-	/*
-	 * Pause the loop manager in fatal.
-	 */
-	named_g_loopmgr_running = true;
-	isc_loopmgr_run(named_g_loopmgr);
+		if (result == ISC_R_RELOAD) {
+			named_server_reloadwanted(named_g_server);
+		} else if (result != ISC_R_SUCCESS) {
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "isc_app_run(): %s",
+					 isc_result_totext(result));
+			/*
+			 * Force exit.
+			 */
+			result = ISC_R_SUCCESS;
+		}
+	} while (result != ISC_R_SUCCESS);
 
 #ifdef HAVE_LIBSCF
 	if (named_smf_want_disable == 1) {
 		result = named_smf_get_instance(&instance, 1, named_g_mctx);
 		if (result == ISC_R_SUCCESS && instance != NULL) {
 			if (smf_disable_instance(instance, 0) != 0) {
-				UNEXPECTED_ERROR("smf_disable_instance() "
+				UNEXPECTED_ERROR(__FILE__, __LINE__,
+						 "smf_disable_instance() "
 						 "failed for %s : %s",
 						 instance,
 						 scf_strerror(scf_error()));
@@ -1604,31 +1510,20 @@ main(int argc, char *argv[]) {
 			(void)isc_stdio_close(fp);
 		}
 	}
-
-	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr);
-
-#if ENABLE_LEAK_DETECTION
-	isc__tls_setdestroycheck(true);
-	isc__uv_setdestroycheck(true);
-	isc__xml_setdestroycheck(true);
-#endif
-
+	isc_mem_destroy(&named_g_mctx);
 	isc_mem_checkdestroyed(stderr);
 
 	named_main_setmemstats(NULL);
 
+	isc_app_finish();
+
 	named_os_closedevnull();
 
 	named_os_shutdown();
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif
+#ifdef HAVE_LIBXML2
+	xmlCleanupThreads();
+#endif /* HAVE_LIBXML2 */
 
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();

bin/named/named.conf.rst

@@ -25,34 +25,901 @@ Description
 ~~~~~~~~~~~
 
 :file:`named.conf` is the configuration file for :iscman:`named`.
-
-For complete documentation about the configuration statements, please refer to
-the Configuration Reference section in the BIND 9 Administrator Reference
-Manual.
-
 Statements are enclosed in braces and terminated with a semi-colon.
 Clauses in the statements are also semi-colon terminated. The usual
 comment styles are supported:
 
 C style: /\* \*/
 
-C++ style: // to end of line
+ C++ style: // to end of line
 
 Unix style: # to end of line
 
-.. literalinclude:: ../../doc/misc/options
+ACL
+^^^
+
+::
+
+  acl string { address_match_element; ... };
+
+CONTROLS
+^^^^^^^^
+
+::
+
+  controls {
+  	inet ( ipv4_address | ipv6_address |
+  	    * ) [ port ( integer | * ) ] allow
+  	    { address_match_element; ... } [
+  	    keys { string; ... } ] [ read-only
+  	    boolean ];
+  	unix quoted_string perm integer
+  	    owner integer group integer [
+  	    keys { string; ... } ] [ read-only
+  	    boolean ];
+  };
+
+DLZ
+^^^
+
+::
+
+  dlz string {
+  	database string;
+  	search boolean;
+  };
+
+DNSSEC-POLICY
+^^^^^^^^^^^^^
+
+::
+
+  dnssec-policy string {
+  	dnskey-ttl duration;
+  	keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
+  	    duration_or_unlimited algorithm string [ integer ]; ... };
+  	max-zone-ttl duration;
+  	nsec3param [ iterations integer ] [ optout boolean ] [
+  	    salt-length integer ];
+  	parent-ds-ttl duration;
+  	parent-propagation-delay duration;
+  	publish-safety duration;
+  	purge-keys duration;
+  	retire-safety duration;
+  	signatures-refresh duration;
+  	signatures-validity duration;
+  	signatures-validity-dnskey duration;
+  	zone-propagation-delay duration;
+  };
+
+DYNDB
+^^^^^
+
+::
+
+  dyndb string quoted_string {
+      unspecified-text };
+
+HTTP
+^^^^
+
+::
+
+  http string {
+  	endpoints { quoted_string; ... };
+  	listener-clients integer;
+  	streams-per-connection integer;
+  };
+
+KEY
+^^^
+
+::
+
+  key string {
+  	algorithm string;
+  	secret string;
+  };
+
+LOGGING
+^^^^^^^
+
+::
+
+  logging {
+  	category string { string; ... };
+  	channel string {
+  		buffered boolean;
+  		file quoted_string [ versions ( unlimited | integer ) ]
+  		    [ size size ] [ suffix ( increment | timestamp ) ];
+  		null;
+  		print-category boolean;
+  		print-severity boolean;
+  		print-time ( iso8601 | iso8601-utc | local | boolean );
+  		severity log_severity;
+  		stderr;
+  		syslog [ syslog_facility ];
+  	};
+  };
+
+MANAGED-KEYS
+^^^^^^^^^^^^
+
+See DNSSEC-KEYS.
+
+::
+
+  managed-keys { string ( static-key
+      | initial-key | static-ds |
+      initial-ds ) integer integer
+      integer quoted_string; ... };, deprecated
+
+OPTIONS
+^^^^^^^
+
+::
+
+  options {
+  	allow-new-zones boolean;
+  	allow-notify { address_match_element; ... };
+  	allow-query { address_match_element; ... };
+  	allow-query-cache { address_match_element; ... };
+  	allow-query-cache-on { address_match_element; ... };
+  	allow-query-on { address_match_element; ... };
+  	allow-recursion { address_match_element; ... };
+  	allow-recursion-on { address_match_element; ... };
+  	allow-transfer [ port integer ] [ transport string ] {
+  	    address_match_element; ... };
+  	allow-update { address_match_element; ... };
+  	allow-update-forwarding { address_match_element; ... };
+  	also-notify [ port integer ] [ dscp integer ] { (
+  	    remote-servers | ipv4_address [ port integer ] |
+  	    ipv6_address [ port integer ] ) [ key string ] [ tls
+  	    string ]; ... };
+  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
+  	    ] [ dscp integer ];
+  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
+  	    * ) ] [ dscp integer ];
+  	answer-cookie boolean;
+  	attach-cache string;
+  	auth-nxdomain boolean;
+  	auto-dnssec ( allow | maintain | off );
+  	automatic-interface-scan boolean;
+  	avoid-v4-udp-ports { portrange; ... };
+  	avoid-v6-udp-ports { portrange; ... };
+  	bindkeys-file quoted_string;
+  	blackhole { address_match_element; ... };
+  	catalog-zones { zone string [ default-primaries [ port integer
+  	    ] [ dscp integer ] { ( remote-servers | ipv4_address [
+  	    port integer ] | ipv6_address [ port integer ] ) [ key
+  	    string ] [ tls string ]; ... } ] [ zone-directory
+  	    quoted_string ] [ in-memory boolean ] [ min-update-interval
+  	    duration ]; ... };
+  	check-dup-records ( fail | warn | ignore );
+  	check-integrity boolean;
+  	check-mx ( fail | warn | ignore );
+  	check-mx-cname ( fail | warn | ignore );
+  	check-names ( primary | master |
+  	    secondary | slave | response ) (
+  	    fail | warn | ignore );
+  	check-sibling boolean;
+  	check-spf ( warn | ignore );
+  	check-srv-cname ( fail | warn | ignore );
+  	check-wildcard boolean;
+  	clients-per-query integer;
+  	cookie-algorithm ( aes | siphash24 );
+  	cookie-secret string;
+  	coresize ( default | unlimited | sizeval );
+  	datasize ( default | unlimited | sizeval );
+  	deny-answer-addresses { address_match_element; ... } [
+  	    except-from { string; ... } ];
+  	deny-answer-aliases { string; ... } [ except-from { string; ...
+  	    } ];
+  	dialup ( notify | notify-passive | passive | refresh | boolean );
+  	directory quoted_string;
+  	disable-algorithms string { string;
+  	    ... };
+  	disable-ds-digests string { string;
+  	    ... };
+  	disable-empty-zone string;
+  	dns64 netprefix {
+  		break-dnssec boolean;
+  		clients { address_match_element; ... };
+  		exclude { address_match_element; ... };
+  		mapped { address_match_element; ... };
+  		recursive-only boolean;
+  		suffix ipv6_address;
+  	};
+  	dns64-contact string;
+  	dns64-server string;
+  	dnskey-sig-validity integer;
+  	dnsrps-enable boolean;
+  	dnsrps-options { unspecified-text };
+  	dnssec-accept-expired boolean;
+  	dnssec-dnskey-kskonly boolean;
+  	dnssec-loadkeys-interval integer;
+  	dnssec-must-be-secure string boolean;
+  	dnssec-policy string;
+  	dnssec-secure-to-insecure boolean;
+  	dnssec-update-mode ( maintain | no-resign );
+  	dnssec-validation ( yes | no | auto );
+  	dnstap { ( all | auth | client | forwarder | resolver | update ) [
+  	    ( query | response ) ]; ... };
+  	dnstap-identity ( quoted_string | none | hostname );
+  	dnstap-output ( file | unix ) quoted_string [ size ( unlimited |
+  	    size ) ] [ versions ( unlimited | integer ) ] [ suffix (
+  	    increment | timestamp ) ];
+  	dnstap-version ( quoted_string | none );
+  	dscp integer;
+  	dual-stack-servers [ port integer ] { ( quoted_string [ port
+  	    integer ] [ dscp integer ] | ipv4_address [ port
+  	    integer ] [ dscp integer ] | ipv6_address [ port
+  	    integer ] [ dscp integer ] ); ... };
+  	dump-file quoted_string;
+  	edns-udp-size integer;
+  	empty-contact string;
+  	empty-server string;
+  	empty-zones-enable boolean;
+  	fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
+  	fetches-per-server integer [ ( drop | fail ) ];
+  	fetches-per-zone integer [ ( drop | fail ) ];
+  	files ( default | unlimited | sizeval );
+  	flush-zones-on-shutdown boolean;
+  	forward ( first | only );
+  	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
+  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
+  	fstrm-set-buffer-hint integer;
+  	fstrm-set-flush-timeout integer;
+  	fstrm-set-input-queue-size integer;
+  	fstrm-set-output-notify-threshold integer;
+  	fstrm-set-output-queue-model ( mpsc | spsc );
+  	fstrm-set-output-queue-size integer;
+  	fstrm-set-reopen-interval duration;
+  	geoip-directory ( quoted_string | none );
+  	glue-cache boolean;// deprecated
+  	heartbeat-interval integer;
+  	hostname ( quoted_string | none );
+  	http-listener-clients integer;
+  	http-port integer;
+  	http-streams-per-connection integer;
+  	https-port integer;
+  	interface-interval duration;
+  	ipv4only-contact string;
+  	ipv4only-enable boolean;
+  	ipv4only-server string;
+  	ixfr-from-differences ( primary | master | secondary | slave |
+  	    boolean );
+  	key-directory quoted_string;
+  	lame-ttl duration;
+  	listen-on [ port integer ] [ dscp
+  	    integer ] [ tls string ] [ http
+  	    string ] {
+  	    address_match_element; ... };
+  	listen-on-v6 [ port integer ] [ dscp
+  	    integer ] [ tls string ] [ http
+  	    string ] {
+  	    address_match_element; ... };
+  	lmdb-mapsize sizeval;
+  	lock-file ( quoted_string | none );
+  	managed-keys-directory quoted_string;
+  	masterfile-format ( raw | text );
+  	masterfile-style ( full | relative );
+  	match-mapped-addresses boolean;
+  	max-cache-size ( default | unlimited | sizeval | percentage );
+  	max-cache-ttl duration;
+  	max-clients-per-query integer;
+  	max-ixfr-ratio ( unlimited | percentage );
+  	max-journal-size ( default | unlimited | sizeval );
+  	max-ncache-ttl duration;
+  	max-records integer;
+  	max-recursion-depth integer;
+  	max-recursion-queries integer;
+  	max-refresh-time integer;
+  	max-retry-time integer;
+  	max-rsa-exponent-size integer;
+  	max-stale-ttl duration;
+  	max-transfer-idle-in integer;
+  	max-transfer-idle-out integer;
+  	max-transfer-time-in integer;
+  	max-transfer-time-out integer;
+  	max-udp-size integer;
+  	max-zone-ttl ( unlimited | duration );
+  	memstatistics boolean;
+  	memstatistics-file quoted_string;
+  	message-compression boolean;
+  	min-cache-ttl duration;
+  	min-ncache-ttl duration;
+  	min-refresh-time integer;
+  	min-retry-time integer;
+  	minimal-any boolean;
+  	minimal-responses ( no-auth | no-auth-recursive | boolean );
+  	multi-master boolean;
+  	new-zones-directory quoted_string;
+  	no-case-compress { address_match_element; ... };
+  	nocookie-udp-size integer;
+  	notify ( explicit | master-only | primary-only | boolean );
+  	notify-delay integer;
+  	notify-rate integer;
+  	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
+  	    dscp integer ];
+  	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
+  	    [ dscp integer ];
+  	notify-to-soa boolean;
+  	nta-lifetime duration;
+  	nta-recheck duration;
+  	nxdomain-redirect string;
+  	parental-source ( ipv4_address | * ) [ port ( integer | * ) ] [
+  	    dscp integer ];
+  	parental-source-v6 ( ipv6_address | * ) [ port ( integer | * )
+  	    ] [ dscp integer ];
+  	pid-file ( quoted_string | none );
+  	port integer;
+  	preferred-glue string;
+  	prefetch integer [ integer ];
+  	provide-ixfr boolean;
+  	qname-minimization ( strict | relaxed | disabled | off );
+  	query-source ( ( [ address ] ( ipv4_address | * ) [ port (
+  	    integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
+  	    port ( integer | * ) ) ) [ dscp integer ];
+  	query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
+  	    integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
+  	    port ( integer | * ) ) ) [ dscp integer ];
+  	querylog boolean;
+  	random-device ( quoted_string | none );
+  	rate-limit {
+  		all-per-second integer;
+  		errors-per-second integer;
+  		exempt-clients { address_match_element; ... };
+  		ipv4-prefix-length integer;
+  		ipv6-prefix-length integer;
+  		log-only boolean;
+  		max-table-size integer;
+  		min-table-size integer;
+  		nodata-per-second integer;
+  		nxdomains-per-second integer;
+  		qps-scale integer;
+  		referrals-per-second integer;
+  		responses-per-second integer;
+  		slip integer;
+  		window integer;
+  	};
+  	recursing-file quoted_string;
+  	recursion boolean;
+  	recursive-clients integer;
+  	request-expire boolean;
+  	request-ixfr boolean;
+  	request-nsid boolean;
+  	require-server-cookie boolean;
+  	reserved-sockets integer;// deprecated
+  	resolver-nonbackoff-tries integer;
+  	resolver-query-timeout integer;
+  	resolver-retry-interval integer;
+  	response-padding { address_match_element; ... } block-size
+  	    integer;
+  	response-policy { zone string [ add-soa boolean ] [ log
+  	    boolean ] [ max-policy-ttl duration ] [ min-update-interval
+  	    duration ] [ policy ( cname | disabled | drop | given | no-op
+  	    | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
+  	    recursive-only boolean ] [ nsip-enable boolean ] [
+  	    nsdname-enable boolean ]; ... } [ add-soa boolean ] [
+  	    break-dnssec boolean ] [ max-policy-ttl duration ] [
+  	    min-update-interval duration ] [ min-ns-dots integer ] [
+  	    nsip-wait-recurse boolean ] [ nsdname-wait-recurse boolean
+  	    ] [ qname-wait-recurse boolean ] [ recursive-only boolean ]
+  	    [ nsip-enable boolean ] [ nsdname-enable boolean ] [
+  	    dnsrps-enable boolean ] [ dnsrps-options { unspecified-text
+  	    } ];
+  	reuseport boolean;
+  	root-delegation-only [ exclude { string; ... } ];
+  	root-key-sentinel boolean;
+  	rrset-order { [ class string ] [ type string ] [ name
+  	    quoted_string ] string string; ... };
+  	secroots-file quoted_string;
+  	send-cookie boolean;
+  	serial-query-rate integer;
+  	serial-update-method ( date | increment | unixtime );
+  	server-id ( quoted_string | none | hostname );
+  	servfail-ttl duration;
+  	session-keyalg string;
+  	session-keyfile ( quoted_string | none );
+  	session-keyname string;
+  	sig-signing-nodes integer;
+  	sig-signing-signatures integer;
+  	sig-signing-type integer;
+  	sig-validity-interval integer [ integer ];
+  	sortlist { address_match_element; ... };
+  	stacksize ( default | unlimited | sizeval );
+  	stale-answer-client-timeout ( disabled | off | integer );
+  	stale-answer-enable boolean;
+  	stale-answer-ttl duration;
+  	stale-cache-enable boolean;
+  	stale-refresh-time duration;
+  	startup-notify-rate integer;
+  	statistics-file quoted_string;
+  	synth-from-dnssec boolean;
+  	tcp-advertised-timeout integer;
+  	tcp-clients integer;
+  	tcp-idle-timeout integer;
+  	tcp-initial-timeout integer;
+  	tcp-keepalive-timeout integer;
+  	tcp-listen-queue integer;
+  	tcp-receive-buffer integer;
+  	tcp-send-buffer integer;
+  	tkey-dhkey quoted_string integer;
+  	tkey-domain quoted_string;
+  	tkey-gssapi-credential quoted_string;
+  	tkey-gssapi-keytab quoted_string;
+  	tls-port integer;
+  	transfer-format ( many-answers | one-answer );
+  	transfer-message-size integer;
+  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
+  	    dscp integer ];
+  	transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
+  	    ] [ dscp integer ];
+  	transfers-in integer;
+  	transfers-out integer;
+  	transfers-per-ns integer;
+  	trust-anchor-telemetry boolean; // experimental
+  	try-tcp-refresh boolean;
+  	udp-receive-buffer integer;
+  	udp-send-buffer integer;
+  	update-check-ksk boolean;
+  	use-alt-transfer-source boolean;
+  	use-v4-udp-ports { portrange; ... };
+  	use-v6-udp-ports { portrange; ... };
+  	v6-bias integer;
+  	validate-except { string; ... };
+  	version ( quoted_string | none );
+  	zero-no-soa-ttl boolean;
+  	zero-no-soa-ttl-cache boolean;
+  	zone-statistics ( full | terse | none | boolean );
+  };
+
+PARENTAL-AGENTS
+^^^^^^^^^^^^^^^
+
+::
+
+  parental-agents string [ port integer ] [
+      dscp integer ] { ( remote-servers |
+      ipv4_address [ port integer ] |
+      ipv6_address [ port integer ] ) [ key
+      string ] [ tls string ]; ... };
+
+PLUGIN
+^^^^^^
+
+::
+
+  plugin ( query ) string [ { unspecified-text
+      } ];
+
+PRIMARIES
+^^^^^^^^^
+
+::
+
+  primaries string [ port integer ] [ dscp
+      integer ] { ( remote-servers |
+      ipv4_address [ port integer ] |
+      ipv6_address [ port integer ] ) [ key
+      string ] [ tls string ]; ... };
+
+REMOTE
+^^^^^^
+
+::
+
+  remote string {
+  	addresses { ( remote-servers | ipv4_address [ port integer ]
+  	    | ipv6_address [ port integer ] ) [ key string ] [ tls
+  	    string ]; ... };
+  	dscp integer;
+  	port integer;
+  	source ( ipv4_address | * ) [ port ( integer | * ) ] [ dscp
+  	    integer ];
+  	source-v6 ( ipv6_address | * ) [ port ( integer | * ) ] [ dscp
+  	    integer ];
+  };
+
+SERVER
+^^^^^^
+
+::
+
+  server netprefix {
+  	bogus boolean;
+  	edns boolean;
+  	edns-udp-size integer;
+  	edns-version integer;
+  	keys server_key;
+  	max-udp-size integer;
+  	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
+  	    dscp integer ];
+  	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
+  	    [ dscp integer ];
+  	padding integer;
+  	provide-ixfr boolean;
+  	query-source ( ( [ address ] ( ipv4_address | * ) [ port (
+  	    integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
+  	    port ( integer | * ) ) ) [ dscp integer ];
+  	query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
+  	    integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
+  	    port ( integer | * ) ) ) [ dscp integer ];
+  	request-expire boolean;
+  	request-ixfr boolean;
+  	request-nsid boolean;
+  	send-cookie boolean;
+  	tcp-keepalive boolean;
+  	tcp-only boolean;
+  	transfer-format ( many-answers | one-answer );
+  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
+  	    dscp integer ];
+  	transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
+  	    ] [ dscp integer ];
+  	transfers integer;
+  };
+
+STATISTICS-CHANNELS
+^^^^^^^^^^^^^^^^^^^
+
+::
+
+  statistics-channels {
+  	inet ( ipv4_address | ipv6_address |
+  	    * ) [ port ( integer | * ) ] [
+  	    allow { address_match_element; ...
+  	    } ];
+  };
+
+TLS
+^^^
+
+::
+
+  tls string {
+  	ca-file quoted_string;
+  	cert-file quoted_string;
+  	ciphers string;
+  	dhparam-file quoted_string;
+  	key-file quoted_string;
+  	prefer-server-ciphers boolean;
+  	protocols { string; ... };
+  	remote-hostname quoted_string;
+  	session-tickets boolean;
+  };
+
+TRUST-ANCHORS
+^^^^^^^^^^^^^
+
+::
+
+  trust-anchors { string ( static-key |
+      initial-key | static-ds | initial-ds )
+      integer integer integer
+      quoted_string; ... };
+
+TRUSTED-KEYS
+^^^^^^^^^^^^
+
+Deprecated - see DNSSEC-KEYS.
+
+::
+
+  trusted-keys { string integer
+      integer integer
+      quoted_string; ... };, deprecated
+
+VIEW
+^^^^
+
+::
+
+  view string [ class ] {
+  	allow-new-zones boolean;
+  	allow-notify { address_match_element; ... };
+  	allow-query { address_match_element; ... };
+  	allow-query-cache { address_match_element; ... };
+  	allow-query-cache-on { address_match_element; ... };
+  	allow-query-on { address_match_element; ... };
+  	allow-recursion { address_match_element; ... };
+  	allow-recursion-on { address_match_element; ... };
+  	allow-transfer [ port integer ] [ transport string ] {
+  	    address_match_element; ... };
+  	allow-update { address_match_element; ... };
+  	allow-update-forwarding { address_match_element; ... };
+  	also-notify [ port integer ] [ dscp integer ] { (
+  	    remote-servers | ipv4_address [ port integer ] |
+  	    ipv6_address [ port integer ] ) [ key string ] [ tls
+  	    string ]; ... };
+  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
+  	    ] [ dscp integer ];
+  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
+  	    * ) ] [ dscp integer ];
+  	attach-cache string;
+  	auth-nxdomain boolean;
+  	auto-dnssec ( allow | maintain | off );
+  	catalog-zones { zone string [ default-primaries [ port integer
+  	    ] [ dscp integer ] { ( remote-servers | ipv4_address [
+  	    port integer ] | ipv6_address [ port integer ] ) [ key
+  	    string ] [ tls string ]; ... } ] [ zone-directory
+  	    quoted_string ] [ in-memory boolean ] [ min-update-interval
+  	    duration ]; ... };
+  	check-dup-records ( fail | warn | ignore );
+  	check-integrity boolean;
+  	check-mx ( fail | warn | ignore );
+  	check-mx-cname ( fail | warn | ignore );
+  	check-names ( primary | master |
+  	    secondary | slave | response ) (
+  	    fail | warn | ignore );
+  	check-sibling boolean;
+  	check-spf ( warn | ignore );
+  	check-srv-cname ( fail | warn | ignore );
+  	check-wildcard boolean;
+  	clients-per-query integer;
+  	deny-answer-addresses { address_match_element; ... } [
+  	    except-from { string; ... } ];
+  	deny-answer-aliases { string; ... } [ except-from { string; ...
+  	    } ];
+  	dialup ( notify | notify-passive | passive | refresh | boolean );
+  	disable-algorithms string { string;
+  	    ... };
+  	disable-ds-digests string { string;
+  	    ... };
+  	disable-empty-zone string;
+  	dlz string {
+  		database string;
+  		search boolean;
+  	};
+  	dns64 netprefix {
+  		break-dnssec boolean;
+  		clients { address_match_element; ... };
+  		exclude { address_match_element; ... };
+  		mapped { address_match_element; ... };
+  		recursive-only boolean;
+  		suffix ipv6_address;
+  	};
+  	dns64-contact string;
+  	dns64-server string;
+  	dnskey-sig-validity integer;
+  	dnsrps-enable boolean;
+  	dnsrps-options { unspecified-text };
+  	dnssec-accept-expired boolean;
+  	dnssec-dnskey-kskonly boolean;
+  	dnssec-loadkeys-interval integer;
+  	dnssec-must-be-secure string boolean;
+  	dnssec-policy string;
+  	dnssec-secure-to-insecure boolean;
+  	dnssec-update-mode ( maintain | no-resign );
+  	dnssec-validation ( yes | no | auto );
+  	dnstap { ( all | auth | client | forwarder | resolver | update ) [
+  	    ( query | response ) ]; ... };
+  	dual-stack-servers [ port integer ] { ( quoted_string [ port
+  	    integer ] [ dscp integer ] | ipv4_address [ port
+  	    integer ] [ dscp integer ] | ipv6_address [ port
+  	    integer ] [ dscp integer ] ); ... };
+  	dyndb string quoted_string {
+  	    unspecified-text };
+  	edns-udp-size integer;
+  	empty-contact string;
+  	empty-server string;
+  	empty-zones-enable boolean;
+  	fetch-quota-params integer fixedpoint fixedpoint fixedpoint;
+  	fetches-per-server integer [ ( drop | fail ) ];
+  	fetches-per-zone integer [ ( drop | fail ) ];
+  	forward ( first | only );
+  	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
+  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
+  	glue-cache boolean;// deprecated
+  	ipv4only-contact string;
+  	ipv4only-enable boolean;
+  	ipv4only-server string;
+  	ixfr-from-differences ( primary | master | secondary | slave |
+  	    boolean );
+  	key string {
+  		algorithm string;
+  		secret string;
+  	};
+  	key-directory quoted_string;
+  	lame-ttl duration;
+  	lmdb-mapsize sizeval;
+  	managed-keys { string (
+  	    static-key | initial-key
+  	    | static-ds | initial-ds
+  	    ) integer integer
+  	    integer
+  	    quoted_string; ... };, deprecated
+  	masterfile-format ( raw | text );
+  	masterfile-style ( full | relative );
+  	match-clients { address_match_element; ... };
+  	match-destinations { address_match_element; ... };
+  	match-recursive-only boolean;
+  	max-cache-size ( default | unlimited | sizeval | percentage );
+  	max-cache-ttl duration;
+  	max-clients-per-query integer;
+  	max-ixfr-ratio ( unlimited | percentage );
+  	max-journal-size ( default | unlimited | sizeval );
+  	max-ncache-ttl duration;
+  	max-records integer;
+  	max-recursion-depth integer;
+  	max-recursion-queries integer;
+  	max-refresh-time integer;
+  	max-retry-time integer;
+  	max-stale-ttl duration;
+  	max-transfer-idle-in integer;
+  	max-transfer-idle-out integer;
+  	max-transfer-time-in integer;
+  	max-transfer-time-out integer;
+  	max-udp-size integer;
+  	max-zone-ttl ( unlimited | duration );
+  	message-compression boolean;
+  	min-cache-ttl duration;
+  	min-ncache-ttl duration;
+  	min-refresh-time integer;
+  	min-retry-time integer;
+  	minimal-any boolean;
+  	minimal-responses ( no-auth | no-auth-recursive | boolean );
+  	multi-master boolean;
+  	new-zones-directory quoted_string;
+  	no-case-compress { address_match_element; ... };
+  	nocookie-udp-size integer;
+  	notify ( explicit | master-only | primary-only | boolean );
+  	notify-delay integer;
+  	notify-source ( ipv4_address | * ) [ port ( integer | * ) ] [
+  	    dscp integer ];
+  	notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ]
+  	    [ dscp integer ];
+  	notify-to-soa boolean;
+  	nta-lifetime duration;
+  	nta-recheck duration;
+  	nxdomain-redirect string;
+  	parental-source ( ipv4_address | * ) [ port ( integer | * ) ] [
+  	    dscp integer ];
+  	parental-source-v6 ( ipv6_address | * ) [ port ( integer | * )
+  	    ] [ dscp integer ];
+  	plugin ( query ) string [ {
+  	    unspecified-text } ];
+  	preferred-glue string;
+  	prefetch integer [ integer ];
+  	provide-ixfr boolean;
+  	qname-minimization ( strict | relaxed | disabled | off );
+  	query-source ( ( [ address ] ( ipv4_address | * ) [ port (
+  	    integer | * ) ] ) | ( [ [ address ] ( ipv4_address | * ) ]
+  	    port ( integer | * ) ) ) [ dscp integer ];
+  	query-source-v6 ( ( [ address ] ( ipv6_address | * ) [ port (
+  	    integer | * ) ] ) | ( [ [ address ] ( ipv6_address | * ) ]
+  	    port ( integer | * ) ) ) [ dscp integer ];
+  	rate-limit {
+  		all-per-second integer;
+  		errors-per-second integer;
+  		exempt-clients { address_match_element; ... };
+  		ipv4-prefix-length integer;
+  		ipv6-prefix-length integer;
+  		log-only boolean;
+  		max-table-size integer;
+  		min-table-size integer;
+  		nodata-per-second integer;
+  		nxdomains-per-second integer;
+  		qps-scale integer;
+  		referrals-per-second integer;
+  		responses-per-second integer;
+  		slip integer;
+  		window integer;
+  	};
+  	recursion boolean;
+  	request-expire boolean;
+  	request-ixfr boolean;
+  	request-nsid boolean;
+  	require-server-cookie boolean;
+  	resolver-nonbackoff-tries integer;
+  	resolver-query-timeout integer;
+  	resolver-retry-interval integer;
+  	response-padding { address_match_element; ... } block-size
+  	    integer;
+  	response-policy { zone string [ add-soa boolean ] [ log
+  	    boolean ] [ max-policy-ttl duration ] [ min-update-interval
+  	    duration ] [ policy ( cname | disabled | drop | given | no-op
+  	    | nodata | nxdomain | passthru | tcp-only quoted_string ) ] [
+  	    recursive-only boolean ] [ nsip-enable boolean ] [
+  	    nsdname-enable boolean ]; ... } [ add-soa boolean ] [
+  	    break-dnssec boolean ] [ max-policy-ttl duration ] [
+  	    min-update-interval duration ] [ min-ns-dots integer ] [
+  	    nsip-wait-recurse boolean ] [ nsdname-wait-recurse boolean
+  	    ] [ qname-wait-recurse boolean ] [ recursive-only boolean ]
+  	    [ nsip-enable boolean ] [ nsdname-enable boolean ] [
+  	    dnsrps-enable boolean ] [ dnsrps-options { unspecified-text
+  	    } ];
+  	root-delegation-only [ exclude { string; ... } ];
+  	root-key-sentinel boolean;
+  	rrset-order { [ class string ] [ type string ] [ name
+  	    quoted_string ] string string; ... };
+  	send-cookie boolean;
+  	serial-update-method ( date | increment | unixtime );
+  	server netprefix {
+  		bogus boolean;
+  		edns boolean;
+  		edns-udp-size integer;
+  		edns-version integer;
+  		keys server_key;
+  		max-udp-size integer;
+  		notify-source ( ipv4_address | * ) [ port ( integer | *
+  		    ) ] [ dscp integer ];
+  		notify-source-v6 ( ipv6_address | * ) [ port ( integer
+  		    | * ) ] [ dscp integer ];
+  		padding integer;
+  		provide-ixfr boolean;
+  		query-source ( ( [ address ] ( ipv4_address | * ) [ port
+  		    ( integer | * ) ] ) | ( [ [ address ] (
+  		    ipv4_address | * ) ] port ( integer | * ) ) ) [
+  		    dscp integer ];
+  		query-source-v6 ( ( [ address ] ( ipv6_address | * ) [
+  		    port ( integer | * ) ] ) | ( [ [ address ] (
+  		    ipv6_address | * ) ] port ( integer | * ) ) ) [
+  		    dscp integer ];
+  		request-expire boolean;
+  		request-ixfr boolean;
+  		request-nsid boolean;
+  		send-cookie boolean;
+  		tcp-keepalive boolean;
+  		tcp-only boolean;
+  		transfer-format ( many-answers | one-answer );
+  		transfer-source ( ipv4_address | * ) [ port ( integer |
+  		    * ) ] [ dscp integer ];
+  		transfer-source-v6 ( ipv6_address | * ) [ port (
+  		    integer | * ) ] [ dscp integer ];
+  		transfers integer;
+  	};
+  	servfail-ttl duration;
+  	sig-signing-nodes integer;
+  	sig-signing-signatures integer;
+  	sig-signing-type integer;
+  	sig-validity-interval integer [ integer ];
+  	sortlist { address_match_element; ... };
+  	stale-answer-client-timeout ( disabled | off | integer );
+  	stale-answer-enable boolean;
+  	stale-answer-ttl duration;
+  	stale-cache-enable boolean;
+  	stale-refresh-time duration;
+  	synth-from-dnssec boolean;
+  	transfer-format ( many-answers | one-answer );
+  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
+  	    dscp integer ];
+  	transfer-source-v6 ( ipv6_address | * ) [ port ( integer | * )
+  	    ] [ dscp integer ];
+  	trust-anchor-telemetry boolean; // experimental
+  	trust-anchors { string ( static-key |
+  	    initial-key | static-ds | initial-ds
+  	    ) integer integer integer
+  	    quoted_string; ... };
+  	trusted-keys { string
+  	    integer integer
+  	    integer
+  	    quoted_string; ... };, deprecated
+  	try-tcp-refresh boolean;
+  	update-check-ksk boolean;
+  	use-alt-transfer-source boolean;
+  	v6-bias integer;
+  	validate-except { string; ... };
+  	zero-no-soa-ttl boolean;
+  	zero-no-soa-ttl-cache boolean;
+  	zone-statistics ( full | terse | none | boolean );
+  };
+
+ZONE
+^^^^
 
 Any of these zone statements can also be set inside the view statement.
 
-.. literalinclude:: ../../doc/misc/primary.zoneopt
-.. literalinclude:: ../../doc/misc/secondary.zoneopt
-.. literalinclude:: ../../doc/misc/mirror.zoneopt
-.. literalinclude:: ../../doc/misc/forward.zoneopt
-.. literalinclude:: ../../doc/misc/hint.zoneopt
-.. literalinclude:: ../../doc/misc/redirect.zoneopt
-.. literalinclude:: ../../doc/misc/static-stub.zoneopt
-.. literalinclude:: ../../doc/misc/stub.zoneopt
-.. literalinclude:: ../../doc/misc/in-view.zoneopt
+.. include:: ../../doc/misc/primary.zoneopt.rst
+.. include:: ../../doc/misc/secondary.zoneopt.rst
+.. include:: ../../doc/misc/mirror.zoneopt.rst
+.. include:: ../../doc/misc/forward.zoneopt.rst
+.. include:: ../../doc/misc/hint.zoneopt.rst
+.. include:: ../../doc/misc/redirect.zoneopt.rst
+.. include:: ../../doc/misc/static-stub.zoneopt.rst
+.. include:: ../../doc/misc/stub.zoneopt.rst
+.. include:: ../../doc/misc/delegation-only.zoneopt.rst
+.. include:: ../../doc/misc/in-view.zoneopt.rst
 
 Files
 ~~~~~

bin/named/named.rst

@@ -21,7 +21,7 @@ named - Internet domain name server
 Synopsis
 ~~~~~~~~
 
-:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-U** #listeners] [**-u** user] [**-v**] [**-V**] ]
+:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-U** #listeners] [**-u** user] [**-v**] [**-V**] [**-X** lock-file]
 
 Description
 ~~~~~~~~~~~
@@ -86,12 +86,6 @@ Options
 
    This option runs the server in the foreground (i.e., do not daemonize).
 
-.. option:: -F
-
-   This options turns on FIPS (US Federal Information Processing Standards)
-   mode if the underlying crytographic library supports running in FIPS
-   mode.
-
 .. option:: -g
 
    This option runs the server in the foreground and forces all logging to ``stderr``.
@@ -102,17 +96,13 @@ Options
 
 .. option:: -M option
 
-   This option sets the default (comma-separated) memory context
-   options. The possible flags are:
-
-   - ``fill``: fill blocks of memory with tag values when they are
-     allocated or freed, to assist debugging of memory problems; this is
-     the implicit default if :program:`named` has been compiled with
-     ``--enable-developer``.
-
-   - ``nofill``: disable the behavior enabled by ``fill``; this is the
-     implicit default unless :program:`named` has been compiled with
-     ``--enable-developer``.
+   This option sets the default memory context options. If set to ``external``,
+   the internal memory manager is bypassed in favor of
+   system-provided memory allocation functions. If set to ``fill``, blocks
+   of memory are filled with tag values when allocated or freed, to
+   assist debugging of memory problems. ``nofill`` disables this behavior,
+   and is the default unless :program:`named` has been compiled with developer
+   options.
 
 .. option:: -m flag
 
@@ -149,6 +139,22 @@ Options
       This option is mainly of interest to BIND 9 developers and may be
       removed or changed in a future release.
 
+.. option:: -S #max-socks
+
+   This option is deprecated and no longer has any function.
+
+.. warning::
+
+      This option should be unnecessary for the vast majority of users.
+      The use of this option could even be harmful, because the specified
+      value may exceed the limitation of the underlying system API. It
+      is therefore set only when the default configuration causes
+      exhaustion of file descriptors and the operational environment is
+      known to support the specified number of sockets. Note also that
+      the actual maximum number is normally slightly fewer than the
+      specified value, because :program:`named` reserves some file descriptors
+      for its internal use.
+
 .. option:: -t directory
 
    This option tells :program:`named` to chroot to ``directory`` after processing the command-line arguments, but
@@ -193,12 +199,14 @@ Options
 
 .. option:: -V
 
-   This option reports the version number, build options, supported
-   cryptographics algorithms, and exits.
+   This option reports the version number and build options, and exits.
 
 .. option:: -X lock-file
 
-   This option has been removed and using it will cause a fatal error.
+   This option acquires a lock on the specified file at runtime; this helps to
+   prevent duplicate :program:`named` instances from running simultaneously.
+   Use of this option overrides the ``lock-file`` option in
+   :iscman:`named.conf`. If set to ``none``, the lock file check is disabled.
 
 Signals
 ~~~~~~~

bin/named/os.c

@@ -14,7 +14,6 @@
 /*! \file */
 #include <stdarg.h>
 #include <stdbool.h>
-#include <sys/resource.h>
 #include <sys/stat.h>
 #include <sys/types.h> /* dev_t FreeBSD 2.1 */
 #ifdef HAVE_UNAME
@@ -37,13 +36,14 @@
 
 #include <isc/buffer.h>
 #include <isc/file.h>
+#include <isc/print.h>
+#include <isc/resource.h>
 #include <isc/result.h>
 #include <isc/strerr.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
 #include <named/globals.h>
-#include <named/log.h>
 #include <named/main.h>
 #include <named/os.h>
 #ifdef HAVE_LIBSCF
@@ -51,7 +51,9 @@
 #endif /* ifdef HAVE_LIBSCF */
 
 static char *pidfile = NULL;
+static char *lockfile = NULL;
 static int devnullfd = -1;
+static int singletonfd = -1;
 
 #ifndef ISC_FACILITY
 #define ISC_FACILITY LOG_DAEMON
@@ -61,7 +63,7 @@ static struct passwd *runas_pw = NULL;
 static bool done_setuid = false;
 static int dfd[2] = { -1, -1 };
 
-#if HAVE_LIBCAP
+#ifdef HAVE_SYS_CAPABILITY_H
 
 static bool non_root = false;
 static bool non_root_caps = false;
@@ -247,137 +249,7 @@ linux_keepcaps(void) {
 	}
 }
 
-#endif /* HAVE_LIBCAP */
-
-/*
- * First define compatibility shims if {set,get}res{uid,gid} are not available
- */
-
-#if !HAVE_GETRESGID
-static int
-getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid) {
-	*rgid = -1;
-	*egid = getegid();
-	*sgid = -1;
-
-	return (0);
-}
-#endif /* !HAVE_GETRESGID */
-
-#if !HAVE_SETRESGID
-static int
-setresgid(gid_t rgid, gid_t egid, gid_t sgid) {
-	REQUIRE(rgid == (gid_t)-1);
-	REQUIRE(sgid == (gid_t)-1);
-
-#if HAVE_SETREGID
-	return (setregid(rgid, egid));
-#else  /* HAVE_SETREGID */
-	return (setegid(egid));
-#endif /* HAVE_SETREGID */
-}
-#endif /* !HAVE_SETRESGID */
-
-#if !HAVE_GETRESUID
-static int
-getresuid(uid_t *ruid, uid_t *euid, uid_t *suid) {
-	*ruid = -1;
-	*euid = geteuid();
-	*suid = -1;
-
-	return (0);
-}
-#endif /* !HAVE_GETRESUID */
-
-#if !HAVE_SETRESUID
-static int
-setresuid(uid_t ruid, uid_t euid, uid_t suid) {
-	REQUIRE(ruid == (uid_t)-1);
-	REQUIRE(suid == (uid_t)-1);
-
-#if HAVE_SETREGID
-	return (setregid(ruid, euid));
-#else  /* HAVE_SETREGID */
-	return (setegid(euid));
-#endif /* HAVE_SETREGID */
-}
-#endif /* !HAVE_SETRESUID */
-
-static int
-set_effective_gid(gid_t gid) {
-	gid_t oldgid;
-
-	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (oldgid == gid) {
-		return (0);
-	}
-
-	if (setresgid(-1, gid, -1) == -1) {
-		return (-1);
-	}
-
-	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (oldgid != gid) {
-		return (-1);
-	}
-
-	return (0);
-}
-
-static int
-set_effective_uid(uid_t uid) {
-	uid_t olduid;
-
-	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (olduid == uid) {
-		return (0);
-	}
-
-	if (setresuid(-1, uid, -1) == -1) {
-		return (-1);
-	}
-
-	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
-		return (-1);
-	}
-
-	if (olduid != uid) {
-		return (-1);
-	}
-
-	/* Success */
-	return (0);
-}
-
-static void
-setperms(uid_t uid, gid_t gid) {
-	char strbuf[ISC_STRERRORSIZE];
-
-	/*
-	 * Drop the gid privilege first, because in some cases the gid privilege
-	 * cannot be dropped after the uid privilege has been dropped.
-	 */
-	if (set_effective_gid(gid) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		named_main_earlywarning("unable to set effective gid to %d: %s",
-					gid, strbuf);
-	}
-
-	if (set_effective_uid(uid) == -1) {
-		strerror_r(errno, strbuf, sizeof(strbuf));
-		named_main_earlywarning("unable to set effective uid to %d: %s",
-					uid, strbuf);
-	}
-}
+#endif /* HAVE_SYS_CAPABILITY_H */
 
 static void
 setup_syslog(const char *progname) {
@@ -393,9 +265,9 @@ setup_syslog(const char *progname) {
 void
 named_os_init(const char *progname) {
 	setup_syslog(progname);
-#if HAVE_LIBCAP
+#ifdef HAVE_SYS_CAPABILITY_H
 	linux_initialprivs();
-#endif /* HAVE_LIBCAP */
+#endif /* ifdef HAVE_SYS_CAPABILITY_H */
 #ifdef SIGXFSZ
 	signal(SIGXFSZ, SIG_IGN);
 #endif /* ifdef SIGXFSZ */
@@ -428,10 +300,10 @@ named_os_daemonize(void) {
 			char buf;
 			n = read(dfd[0], &buf, 1);
 			if (n == 1) {
-				_exit(EXIT_SUCCESS);
+				_exit(0);
 			}
 		} while (n == -1 && errno == EINTR);
-		_exit(EXIT_FAILURE);
+		_exit(1);
 	}
 	(void)close(dfd[0]);
 
@@ -588,7 +460,7 @@ named_os_changeuser(void) {
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}
 
-#if HAVE_LIBCAP
+#if defined(HAVE_SYS_CAPABILITY_H)
 	/*
 	 * Restore the ability of named to drop core after the setuid()
 	 * call has disabled it.
@@ -600,7 +472,7 @@ named_os_changeuser(void) {
 	}
 
 	linux_minprivs();
-#endif /* HAVE_LIBCAP */
+#endif /* if defined(HAVE_SYS_CAPABILITY_H) */
 }
 
 uid_t
@@ -613,56 +485,30 @@ ns_os_uid(void) {
 
 void
 named_os_adjustnofile(void) {
-	int r;
-	struct rlimit rl;
-	rlim_t rlim_old;
-	char strbuf[ISC_STRERRORSIZE];
+#if defined(__linux__)
+	isc_result_t result;
+	isc_resourcevalue_t newvalue;
 
-	r = getrlimit(RLIMIT_NOFILE, &rl);
-	if (r != 0) {
-		goto fail;
+	/*
+	 * Linux: max number of open files specified by one thread doesn't seem
+	 * to apply to other threads on Linux.
+	 */
+	newvalue = ISC_RESOURCE_UNLIMITED;
+
+	result = isc_resource_setlimit(isc_resource_openfiles, newvalue);
+	if (result != ISC_R_SUCCESS) {
+		named_main_earlywarning("couldn't adjust limit on open files");
 	}
-
-	rlim_old = rl.rlim_cur;
-
-	if (rl.rlim_cur == rl.rlim_max) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-			      "the limit on open files is already at the "
-			      "maximum allowed value: "
-			      "%" PRIu64,
-			      (uint64_t)rl.rlim_max);
-		return;
-	}
-
-	rl.rlim_cur = rl.rlim_max;
-	r = setrlimit(RLIMIT_NOFILE, &rl);
-	if (r != 0) {
-		goto fail;
-	}
-
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "adjusted limit on open files from "
-		      "%" PRIu64 " to "
-		      "%" PRIu64,
-		      (uint64_t)rlim_old, (uint64_t)rl.rlim_cur);
-	return;
-
-fail:
-	strerror_r(errno, strbuf, sizeof(strbuf));
-	named_main_earlywarning("adjusting limit on open files failed: %s",
-				strbuf);
-	return;
+#endif /* if defined(__linux__) */
 }
 
 void
 named_os_minprivs(void) {
-#if HAVE_LIBCAP
+#if defined(HAVE_SYS_CAPABILITY_H)
 	linux_keepcaps();
 	named_os_changeuser();
 	linux_minprivs();
-#endif /* HAVE_LIBCAP */
+#endif /* if defined(HAVE_SYS_CAPABILITY_H) */
 }
 
 static int
@@ -703,6 +549,24 @@ cleanup_pidfile(void) {
 	pidfile = NULL;
 }
 
+static void
+cleanup_lockfile(void) {
+	if (singletonfd != -1) {
+		close(singletonfd);
+		singletonfd = -1;
+	}
+
+	if (lockfile != NULL) {
+		int n = unlink(lockfile);
+		if (n == -1 && errno != ENOENT) {
+			named_main_earlywarning("unlink '%s': failed",
+						lockfile);
+		}
+		free(lockfile);
+		lockfile = NULL;
+	}
+}
+
 /*
  * Ensure that a directory exists.
  * NOTE: This function overwrites the '/' characters in 'filename' with
@@ -764,6 +628,56 @@ error:
 	return (-1);
 }
 
+#if !HAVE_SYS_CAPABILITY_H
+static void
+setperms(uid_t uid, gid_t gid) {
+#if defined(HAVE_SETEGID) || defined(HAVE_SETRESGID)
+	char strbuf[ISC_STRERRORSIZE];
+#endif /* if defined(HAVE_SETEGID) || defined(HAVE_SETRESGID) */
+#if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID)
+	gid_t oldgid, tmpg;
+#endif /* if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID) */
+#if !defined(HAVE_SETEUID) && defined(HAVE_SETRESUID)
+	uid_t olduid, tmpu;
+#endif /* if !defined(HAVE_SETEUID) && defined(HAVE_SETRESUID) */
+#if defined(HAVE_SETEGID)
+	if (getegid() != gid && setegid(gid) == -1) {
+		strerror_r(errno, strbuf, sizeof(strbuf));
+		named_main_earlywarning("unable to set effective "
+					"gid to %ld: %s",
+					(long)gid, strbuf);
+	}
+#elif defined(HAVE_SETRESGID)
+	if (getresgid(&tmpg, &oldgid, &tmpg) == -1 || oldgid != gid) {
+		if (setresgid(-1, gid, -1) == -1) {
+			strerror_r(errno, strbuf, sizeof(strbuf));
+			named_main_earlywarning("unable to set effective "
+						"gid to %d: %s",
+						gid, strbuf);
+		}
+	}
+#endif /* if defined(HAVE_SETEGID) */
+
+#if defined(HAVE_SETEUID)
+	if (geteuid() != uid && seteuid(uid) == -1) {
+		strerror_r(errno, strbuf, sizeof(strbuf));
+		named_main_earlywarning("unable to set effective "
+					"uid to %ld: %s",
+					(long)uid, strbuf);
+	}
+#elif defined(HAVE_SETRESUID)
+	if (getresuid(&tmpu, &olduid, &tmpu) == -1 || olduid != uid) {
+		if (setresuid(-1, uid, -1) == -1) {
+			strerror_r(errno, strbuf, sizeof(strbuf));
+			named_main_earlywarning("unable to set effective "
+						"uid to %d: %s",
+						uid, strbuf);
+		}
+	}
+#endif /* if defined(HAVE_SETEUID) */
+}
+#endif /* !HAVE_SYS_CAPABILITY_H */
+
 FILE *
 named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	char strbuf[ISC_STRERRORSIZE], *f;
@@ -789,17 +703,19 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	if (switch_user && runas_pw != NULL) {
 		uid_t olduid = getuid();
 		gid_t oldgid = getgid();
-
-		/*
-		 * Set UID/GID to the one we'll be running with
-		 * eventually.
-		 */
+#if HAVE_SYS_CAPABILITY_H
+		REQUIRE(olduid == runas_pw->pw_uid);
+		REQUIRE(oldgid == runas_pw->pw_gid);
+#else /* HAVE_SYS_CAPABILITY_H */
+		/* Set UID/GID to the one we'll be running with eventually */
 		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
-
+#endif
 		fd = safe_open(filename, mode, false);
 
+#if !HAVE_SYS_CAPABILITY_H
 		/* Restore UID/GID to previous uid/gid */
 		setperms(olduid, oldgid);
+#endif
 
 		if (fd == -1) {
 			fd = safe_open(filename, mode, false);
@@ -886,10 +802,77 @@ named_os_writepidfile(const char *filename, bool first_time) {
 	(void)fclose(fh);
 }
 
+bool
+named_os_issingleton(const char *filename) {
+	char strbuf[ISC_STRERRORSIZE];
+	struct flock lock;
+
+	if (singletonfd != -1) {
+		return (true);
+	}
+
+	if (strcasecmp(filename, "none") == 0) {
+		return (true);
+	}
+
+	/*
+	 * Make the containing directory if it doesn't exist.
+	 */
+	lockfile = strdup(filename);
+	if (lockfile == NULL) {
+		strerror_r(errno, strbuf, sizeof(strbuf));
+		named_main_earlyfatal("couldn't allocate memory for '%s': %s",
+				      filename, strbuf);
+	} else {
+		int ret = mkdirpath(lockfile, named_main_earlywarning);
+		if (ret == -1) {
+			named_main_earlywarning("couldn't create '%s'",
+						filename);
+			cleanup_lockfile();
+			return (false);
+		}
+	}
+
+	/*
+	 * named_os_openfile() uses safeopen() which removes any existing
+	 * files. We can't use that here.
+	 */
+	singletonfd = open(filename, O_WRONLY | O_CREAT,
+			   S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+	if (singletonfd == -1) {
+		cleanup_lockfile();
+		return (false);
+	}
+
+	memset(&lock, 0, sizeof(lock));
+	lock.l_type = F_WRLCK;
+	lock.l_whence = SEEK_SET;
+	lock.l_start = 0;
+	lock.l_len = 1;
+
+	/* Non-blocking (does not wait for lock) */
+	if (fcntl(singletonfd, F_SETLK, &lock) == -1) {
+		close(singletonfd);
+		singletonfd = -1;
+		return (false);
+	}
+
+	return (true);
+}
+
 void
 named_os_shutdown(void) {
 	closelog();
 	cleanup_pidfile();
+	cleanup_lockfile();
+}
+
+isc_result_t
+named_os_gethostname(char *buf, size_t len) {
+	int n;
+
+	n = gethostname(buf, len);
+	return ((n == 0) ? ISC_R_SUCCESS : ISC_R_FAILURE);
 }
 
 void

bin/named/tkeyconf.c

@@ -48,16 +48,32 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	isc_result_t result;
 	dns_tkeyctx_t *tctx = NULL;
 	const char *s;
+	uint32_t n;
 	dns_fixedname_t fname;
 	dns_name_t *name;
 	isc_buffer_t b;
 	const cfg_obj_t *obj;
+	int type;
 
 	result = dns_tkeyctx_create(mctx, &tctx);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
 
+	obj = NULL;
+	result = cfg_map_get(options, "tkey-dhkey", &obj);
+	if (result == ISC_R_SUCCESS) {
+		s = cfg_obj_asstring(cfg_tuple_get(obj, "name"));
+		n = cfg_obj_asuint32(cfg_tuple_get(obj, "keyid"));
+		isc_buffer_constinit(&b, s, strlen(s));
+		isc_buffer_add(&b, strlen(s));
+		name = dns_fixedname_initname(&fname);
+		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+		type = DST_TYPE_PUBLIC | DST_TYPE_PRIVATE | DST_TYPE_KEY;
+		RETERR(dst_key_fromfile(name, (dns_keytag_t)n, DNS_KEYALG_DH,
+					type, NULL, mctx, &tctx->dhkey));
+	}
+
 	obj = NULL;
 	result = cfg_map_get(options, "tkey-domain", &obj);
 	if (result == ISC_R_SUCCESS) {

bin/named/transportconf.c

@@ -59,8 +59,7 @@
 				const cfg_listelt_t *proto = NULL;                \
 				INSIST(obj != NULL);                              \
 				for (proto = cfg_list_first(obj); proto != 0;     \
-				     proto = cfg_list_next(proto))                \
-				{                                                 \
+				     proto = cfg_list_next(proto)) {              \
 					const cfg_obj_t *tls_proto_obj =          \
 						cfg_listelt_value(proto);         \
 					const char *tls_sver =                    \
@@ -120,13 +119,11 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 					     dns_transport_set_tls_versions);
 		parse_transport_option(doh, transport, "ciphers",
 				       dns_transport_set_ciphers);
-		parse_transport_option(doh, transport, "cipher-suites",
-				       dns_transport_set_cipher_suites);
 		parse_transport_bool_option(
 			doh, transport, "prefer-server-ciphers",
-			dns_transport_set_prefer_server_ciphers);
-		parse_transport_option(doh, transport, "ca-file",
-				       dns_transport_set_cafile);
+			dns_transport_set_prefer_server_ciphers)
+			parse_transport_option(doh, transport, "ca-file",
+					       dns_transport_set_cafile);
 		parse_transport_option(doh, transport, "remote-hostname",
 				       dns_transport_set_remote_hostname);
 	}
@@ -174,13 +171,11 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 					     dns_transport_set_tls_versions);
 		parse_transport_option(tls, transport, "ciphers",
 				       dns_transport_set_ciphers);
-		parse_transport_option(tls, transport, "cipher-suites",
-				       dns_transport_set_cipher_suites);
 		parse_transport_bool_option(
 			tls, transport, "prefer-server-ciphers",
-			dns_transport_set_prefer_server_ciphers);
-		parse_transport_option(tls, transport, "ca-file",
-				       dns_transport_set_cafile);
+			dns_transport_set_prefer_server_ciphers)
+			parse_transport_option(tls, transport, "ca-file",
+					       dns_transport_set_cafile);
 		parse_transport_option(tls, transport, "remote-hostname",
 				       dns_transport_set_remote_hostname);
 	}

bin/named/tsigconf.c

@@ -31,7 +31,7 @@
 #include <named/tsigconf.h>
 
 static isc_result_t
-add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
+add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
 		 isc_mem_t *mctx) {
 	dns_tsigkey_t *tsigkey = NULL;
 	const cfg_listelt_t *element;
@@ -39,7 +39,10 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 	const char *keyid = NULL;
 	unsigned char *secret = NULL;
 	int secretalloc = 0;
+	int secretlen = 0;
 	isc_result_t ret;
+	isc_stdtime_t now;
+	uint16_t bits;
 
 	for (element = cfg_list_first(list); element != NULL;
 	     element = cfg_list_next(element))
@@ -47,14 +50,12 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		const cfg_obj_t *algobj = NULL;
 		const cfg_obj_t *secretobj = NULL;
 		dns_name_t keyname;
-		dst_algorithm_t alg = DST_ALG_UNKNOWN;
-		const char *algstr = NULL;
+		const dns_name_t *alg;
+		const char *algstr;
 		char keynamedata[1024];
 		isc_buffer_t keynamesrc, keynamebuf;
-		const char *secretstr = NULL;
+		const char *secretstr;
 		isc_buffer_t secretbuf;
-		int secretlen = 0;
-		uint16_t bits;
 
 		key = cfg_listelt_value(element);
 		keyid = cfg_obj_asstring(cfg_map_getname(key));
@@ -83,8 +84,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		 */
 		algstr = cfg_obj_asstring(algobj);
 		if (named_config_getkeyalgorithm(algstr, &alg, &bits) !=
-		    ISC_R_SUCCESS)
-		{
+		    ISC_R_SUCCESS) {
 			cfg_obj_log(algobj, named_g_lctx, ISC_LOG_ERROR,
 				    "key '%s': has a "
 				    "unsupported algorithm '%s'",
@@ -103,17 +103,13 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		}
 		secretlen = isc_buffer_usedlength(&secretbuf);
 
-		ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, mctx,
+		isc_stdtime_get(&now);
+		ret = dns_tsigkey_create(&keyname, alg, secret, secretlen,
+					 false, NULL, now, now, mctx, ring,
 					 &tsigkey);
 		isc_mem_put(mctx, secret, secretalloc);
 		secret = NULL;
-		if (ret == ISC_R_SUCCESS) {
-			ret = dns_tsigkeyring_add(ring, tsigkey);
-		}
 		if (ret != ISC_R_SUCCESS) {
-			if (tsigkey != NULL) {
-				dns_tsigkey_detach(&tsigkey);
-			}
 			goto failure;
 		}
 		/*
@@ -126,20 +122,21 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 	return (ISC_R_SUCCESS);
 
 failure:
+	cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring key '%s': %s", keyid, isc_result_totext(ret));
+
 	if (secret != NULL) {
 		isc_mem_put(mctx, secret, secretalloc);
 	}
-	cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
-		    "configuring key '%s': %s", keyid, isc_result_totext(ret));
 	return (ret);
 }
 
 isc_result_t
 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
-			     isc_mem_t *mctx, dns_tsigkeyring_t **ringp) {
+			     isc_mem_t *mctx, dns_tsig_keyring_t **ringp) {
 	const cfg_obj_t *maps[3];
 	const cfg_obj_t *keylist;
-	dns_tsigkeyring_t *ring = NULL;
+	dns_tsig_keyring_t *ring = NULL;
 	isc_result_t result;
 	int i;
 
@@ -154,7 +151,10 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}
 	maps[i] = NULL;
 
-	dns_tsigkeyring_create(mctx, &ring);
+	result = dns_tsigkeyring_create(mctx, &ring);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}
 
 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {