change ISC__BUFFER macros to inline functions

previously, when ISC_BUFFER_USEINLINE was defined, macros were used to implement isc_buffer primitives (isc_buffer_init(), isc_buffer_region(), etc). these macros were missing the DbC assertions for those primitives, which made it possible for coding errors to go undetected. adding the assertions to the macros caused compiler warnings on some platforms. therefore, this commit converts the ISC__BUFFER macros to static inline functions instead, with assertions included, and eliminates the non-inline implementation from buffer.c. the --enable-buffer-useinline configure option has been removed.
Merge branch '3520-rndc-shutdown-hang' into 'main'
2022-09-12 14:36:47 -07:00 · 2022-09-12 20:34:32 +00:00 · 2022-09-12 13:14:19 -07:00 · 2022-09-12 12:08:06 +00:00 · 2022-09-12 12:23:39 +01:00 · 2022-09-12 12:23:39 +01:00
336 changed files with 14459 additions and 15689 deletions
@@ -6,10 +6,6 @@ variables:

  CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
  CCACHE_DIR: "/ccache"
-  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
-  OPENSSL_ENGINES: "/usr/lib/x86_64-linux-gnu/engines-1.1"
-  DEFAULT_OPENSSL_CONF: "/etc/ssl/openssl.cnf"
-  OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"

  GIT_DEPTH: 1
  BUILD_PARALLEL_JOBS: 6
@@ -120,6 +116,10 @@ stages:
  image: "$CI_REGISTRY_IMAGE:oraclelinux-8-amd64"
  <<: *linux_amd64

+.oraclelinux-9-amd64: &oraclelinux_9_amd64_image
+  image: "$CI_REGISTRY_IMAGE:oraclelinux-9-amd64"
+  <<: *linux_amd64
+
 # Debian

 .debian-buster-amd64: &debian_buster_amd64_image
@@ -181,11 +181,11 @@ stages:
  <<: *libvirt_amd64

 .freebsd-13-amd64: &freebsd_13_amd64_image
-  image: "freebsd-13.0-x86_64"
+  image: "freebsd-13.1-x86_64"
  <<: *libvirt_amd64

 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-7.0-x86_64"
+  image: "openbsd-7.1-x86_64"
  <<: *libvirt_amd64

 ### Job Templates
@@ -599,7 +599,7 @@ gcc:oraclelinux8:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--enable-buffer-useinline --with-libidn2"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *oraclelinux_8_amd64_image
  <<: *build_job

@@ -617,6 +617,30 @@ unit:gcc:oraclelinux8:amd64:
    - job: gcc:oraclelinux8:amd64
      artifacts: true

+# Jobs for regular GCC builds on Oracle Linux 9 (amd64)
+
+gcc:oraclelinux9:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *oraclelinux_9_amd64_image
+  <<: *build_job
+
+system:gcc:oraclelinux9:amd64:
+  <<: *oraclelinux_9_amd64_image
+  <<: *system_test_job
+  needs:
+    - job: gcc:oraclelinux9:amd64
+      artifacts: true
+
+unit:gcc:oraclelinux9:amd64:
+  <<: *oraclelinux_9_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: gcc:oraclelinux9:amd64
+      artifacts: true
+
 # Jobs for regular GCC builds on Debian 10 "buster" (amd64)

 gcc:buster:amd64:
@@ -870,7 +894,7 @@ gcc:bionic:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -O2"
-    EXTRA_CONFIGURE: "--disable-dnstap"
+    EXTRA_CONFIGURE: "--disable-dnstap --without-cmocka --without-gssapi"
  <<: *ubuntu_bionic_amd64_image
  <<: *build_job
  <<: *api_schedules_tags_triggers_web_triggering_rules
@@ -921,7 +945,7 @@ gcc:jammy:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2"
+    EXTRA_CONFIGURE: "--with-libidn2 --disable-doh"
  <<: *ubuntu_jammy_amd64_image
  <<: *build_job

@@ -946,14 +970,12 @@ gcc:asan:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined -Wno-error=stringop-overread"
    LDFLAGS: "-fsanitize=address,undefined"
-    SOFTHSM2_MODULE: "/lib64/libsofthsm2.so"
    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc"
  <<: *fedora_35_amd64_image
  <<: *build_job

 system:gcc:asan:
  variables:
-    SOFTHSM2_MODULE: "/lib64/libsofthsm2.so"
    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
  <<: *fedora_35_amd64_image
  <<: *system_test_job
@@ -998,14 +1020,12 @@ gcc:tsan:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    SOFTHSM2_MODULE: "/lib64/libsofthsm2.so"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
  <<: *fedora_35_amd64_image
  <<: *build_job

 system:gcc:tsan:
  variables:
-    SOFTHSM2_MODULE: "/lib64/libsofthsm2.so"
    TSAN_OPTIONS: "${TSAN_OPTIONS_COMMON} external_symbolizer_path=/usr/bin/llvm-symbolizer"
  <<: *fedora_35_amd64_image
  <<: *system_test_tsan_job
@@ -1055,10 +1075,18 @@ clang:bullseye:amd64:
  variables:
    CC: ${CLANG}
    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
+    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
+    EXTRA_CONFIGURE: "--without-jemalloc"
  <<: *debian_bullseye_amd64_image
  <<: *build_job

 system:clang:bullseye:amd64:
+  # Set up environment variables that allow the "keyfromlabel" system test to be run
+  variables:
+    DEFAULT_OPENSSL_CONF: "/etc/ssl/openssl.cnf"
+    OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
+    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
+    SOFTHSM2_MODULE: "/usr/lib/softhsm/libsofthsm2.so"
  <<: *debian_bullseye_amd64_image
  <<: *system_test_job
  needs:
@@ -1200,10 +1228,10 @@ release:
         --form token=$COVERITY_SCAN_TOKEN
  - test "$(md5sum /tmp/cov-analysis-linux64.tgz | awk '{ print $1 }')" = "$(cat /tmp/cov-analysis-linux64.md5)"
  - tar --extract --gzip --file=/tmp/cov-analysis-linux64.tgz --directory=/tmp
-  - test -d /tmp/cov-analysis-linux64-2021.12.1
+  - test -d /tmp/cov-analysis-linux64-2022.6.0

 .coverity_build: &coverity_build
-  - /tmp/cov-analysis-linux64-2021.12.1/bin/cov-build --dir /tmp/cov-int --fs-capture-search . sh -c 'make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1'
+  - /tmp/cov-analysis-linux64-2022.6.0/bin/cov-build --dir /tmp/cov-int --fs-capture-search . sh -c 'make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1'
  - tar --create --gzip --file=/tmp/cov-int.tar.gz --directory /tmp cov-int
  - curl -v https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME
        --form token=$COVERITY_SCAN_TOKEN
@@ -1436,9 +1464,13 @@ gcov:
    # source files from lib/dns/rdata/*/, using an even nastier trick.
    - find lib/dns/rdata/* -name "*.c" -execdir cp -f "{}" ../../ \;
    # Help gcovr process inline functions in headers
-    - cp -f lib/isc/include/isc/*.h lib/dns/
+    - cp -f lib/isc/include/isc/*.h lib/isc/
    - cp -f lib/dns/include/dns/*.h lib/dns/
    - cp -f lib/dns/include/dns/*.h lib/ns/
+    - find bin lib -maxdepth 1 -mindepth 1 -type d -exec cp -f lib/isc/include/isc/buffer.h "{}" \;
+    - cp -f lib/isc/include/isc/buffer.h fuzz/
+    - cp -f lib/isc/include/isc/buffer.h lib/isc/netmgr/buffer.h
+    - cp -f lib/isc/include/isc/hash.h lib/dns/hash.h
    # Generate XML file in the Cobertura XML format suitable for use by GitLab
    # for the purpose of displaying code coverage information in the diff view
    # of a given merge request.
@@ -1,3 +1,107 @@
+5965.	[cleanup]	Move the duplicated ASCII case conversion tables to
+			isc_ascii where they can be shared, and replace the
+			various hot-path tolower() loops with calls to new
+			isc_ascii implementations. [GL !6516]
+
+5964.	[func]		When an international domain name is not valid, DiG will
+			now pass it through unchanged, instead of stopping with
+			an error message. [GL #3527]
+
+5963.	[bug]		Ensure struct named_server is properly initialized.
+			[GL #6531]
+
+5962.	[placeholder]
+
+5961.	[placeholder]
+
+5960.	[placeholder]
+
+5959.	[placeholder]
+
+5958.	[placeholder]
+
+5957.	[placeholder]
+
+5956.	[func]		Make RRL code treat all QNAMEs that are subject to
+			wildcard processing within a given zone as the same
+			name. [GL #3459]
+
+5955.	[port]		The libxml2 library has deprecated the usage of
+			xmlInitThreads() and xmlCleanupThreads() functions. Use
+			xmlInitParser() and xmlCleanupParser() instead.
+			[GL #3518]
+
+5954.	[func]		Fallback to IDNA2003 processing in dig when IDNA2008
+			conversion fails. [GL #3485]
+
+5953.	[bug]		Fix a crash on shutdown in delete_trace_entry(). Add
+			mctx attach/detach pair to make sure that the memory
+			context used by a memory pool is not destroyed before
+			the memory pool itself. [GL #3515]
+
+5952.	[bug]		Use quotes around address strings in YAML output.
+			[GL #3511]
+
+5951.	[bug]		In some cases, the dnstap query_message field was
+			erroneously set when logging response messages.
+			[GL #3501]
+
+5950.	[func]		Implement a feature to set an Extended DNS Error (EDE)
+			code on responses modified by RPZ. [GL #3410]
+
+5949.	[func]		Add new isc_loopmgr API that runs the application
+			event loops and completely replaces the isc_app
+			API. Refactor the isc_taskmgr, isc_timermgr and
+			isc_netmgr to use the isc_loopmgr event loops.
+			[GL #3508]
+
+5948.	[bug]		Fix nsec3.c:dns_nsec3_activex() function, add a missing
+			dns_db_detachnode() call. [GL #3500]
+
+5947.	[func]		Change dnssec-policy to allow graceful transition from
+			an NSEC only zone to NSEC3. [GL #3486]
+
+5946.	[bug]		Fix statistics channel's handling of multiple HTTP
+			requests in a single connection which have non-empty
+			request bodies. [GL #3463]
+
+5945.	[bug]		If parsing /etc/bind.key failed, delv could assert
+			when trying to parse the built in trust anchors as
+			the parser hadn't been reset. [GL !6468]
+
+5944.	[bug]		Fix +http-plain-get and +http-plain-post options
+			support in dig. Thanks to Marco Davids at SIDN for
+			reporting the problem. [GL !6672]
+
+5943.	[placeholder]
+
+5942.	[bug]		Fix tkey.c:buildquery() function's error handling by
+			adding the missing cleanup code. [GL #3492]
+
+5941.	[func]		Zones with dnssec-policy now require dynamic DNS or
+			inline-siging to be configured explicitly. [GL #3381]
+
+5940.	[placeholder]
+
+5939.	[placeholder]
+
+5938.	[bug]		An integer type overflow could cause an assertion
+			failure when freeing memory. [GL #3483]
+
+5937.	[cleanup]	The dns_rdatalist_tordataset() and
+			dns_rdatalist_fromrdataset() functions can no
+			longer fail. Clean up their prototypes and error
+			handling, and that of other calling functions that
+			subsequently cannot fail, including
+			dns_message_setquerytsig(). [GL #3467]
+
+5936.	[bug]		Don't enable serve-stale for lookups that error because
+			it is a duplicate query or a query that would be
+			dropped. [GL #2982]
+
+5935.	[bug]		Fix DiG lookup reference counting bug, which could
+			be observed in NSSEARCH mode. [GL #3478]
+
 	--- 9.19.4 released ---

 5934.	[func]		Improve fetches-per-zone fetch limit logging to log
@@ -17,7 +17,6 @@
 #include <stdbool.h>
 #include <stdlib.h>

-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
@@ -25,7 +25,6 @@
 #include <sys/types.h>
 #include <unistd.h>

-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
@@ -81,6 +80,11 @@ char *progname;
 static isc_mem_t *mctx = NULL;
 static isc_log_t *lctx = NULL;

+/* Managers */
+static isc_nm_t *netmgr = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
+static isc_taskmgr_t *taskmgr = NULL;
+
 /* Configurables */
 static char *server = NULL;
 static const char *port = "53";
@@ -114,6 +118,9 @@ static int num_keys = 0;
 static dns_fixedname_t afn;
 static dns_name_t *anchor_name = NULL;

+static dns_master_style_t *style = NULL;
+static dns_fixedname_t qfn;
+
 /* Default bind.keys contents */
 static char anchortext[] = TRUST_ANCHORS;

@@ -417,8 +424,7 @@ print_status(dns_rdataset_t *rdataset) {
 }

 static isc_result_t
-printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
-	  dns_master_style_t *style) {
+printdata(dns_rdataset_t *rdataset, dns_name_t *owner) {
 	isc_result_t result = ISC_R_SUCCESS;
 	static dns_trust_t trust;
 	static bool first = true;
@@ -512,11 +518,8 @@ cleanup:
 }

 static isc_result_t
-setup_style(dns_master_style_t **stylep) {
+setup_style(void) {
 	isc_result_t result;
-	dns_master_style_t *style = NULL;
-
-	REQUIRE(stylep != NULL && *stylep == NULL);

 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
@@ -557,9 +560,6 @@ setup_style(dns_master_style_t **stylep) {
 						48, 80, 8, splitwidth, mctx);
 	}

-	if (result == ISC_R_SUCCESS) {
-		*stylep = style;
-	}
 	return (result);
 }

@@ -845,6 +845,7 @@ setup_dnsseckeys(dns_client_t *client) {

 		isc_buffer_init(&b, anchortext, sizeof(anchortext) - 1);
 		isc_buffer_add(&b, sizeof(anchortext) - 1);
+		cfg_parser_reset(parser);
 		result = cfg_parse_buffer(parser, &b, NULL, 0,
 					  &cfg_type_bindkeys, 0, &bindkeys);
 		if (result != ISC_R_SUCCESS) {
@@ -1708,59 +1709,57 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 	}
 }

-int
-main(int argc, char *argv[]) {
-	dns_client_t *client = NULL;
-	isc_result_t result;
-	dns_fixedname_t qfn;
-	dns_name_t *query_name, *response_name;
+static void
+resolve_cb(dns_client_t *client, const dns_name_t *query_name,
+	   dns_namelist_t *namelist, isc_result_t result) {
 	char namestr[DNS_NAME_FORMATSIZE];
 	dns_rdataset_t *rdataset;
-	dns_namelist_t namelist;
-	unsigned int resopt;
-	isc_nm_t *netmgr = NULL;
-	isc_taskmgr_t *taskmgr = NULL;
-	isc_timermgr_t *timermgr = NULL;
-	dns_master_style_t *style = NULL;

-	progname = argv[0];
-	preparse_args(argc, argv);
-
-	argc--;
-	argv++;
-
-	isc_mem_create(&mctx);
-
-	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
-		fatal("dst_lib_init failed: %d", result);
-	}
-
-	isc_managers_create(mctx, 1, 0, &netmgr, &taskmgr, &timermgr);
-
-	parse_args(argc, argv);
-
-	CHECK(setup_style(&style));
-
-	setup_logging(stderr);
-
-	/* Create client */
-	result = dns_client_create(mctx, taskmgr, netmgr, timermgr, 0, &client,
-				   srcaddr4, srcaddr6);
-	if (result != ISC_R_SUCCESS) {
-		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
+	if (result != ISC_R_SUCCESS && !yaml) {
+		delv_log(ISC_LOG_ERROR, "resolution failed: %s",
 			 isc_result_totext(result));
-		goto cleanup;
 	}

-	/* Set the nameserver */
-	if (server != NULL) {
-		addserver(client);
-	} else {
-		findserver(client);
+	if (yaml) {
+		printf("type: DELV_RESULT\n");
+		dns_name_format(query_name, namestr, sizeof(namestr));
+		printf("query_name: %s\n", namestr);
+		printf("status: %s\n", isc_result_totext(result));
+		printf("records:\n");
 	}

-	CHECK(setup_dnsseckeys(client));
+	for (dns_name_t *response_name = ISC_LIST_HEAD(*namelist);
+	     response_name != NULL;
+	     response_name = ISC_LIST_NEXT(response_name, link))
+	{
+		for (rdataset = ISC_LIST_HEAD(response_name->list);
+		     rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link))
+		{
+			result = printdata(rdataset, response_name);
+			if (result != ISC_R_SUCCESS) {
+				delv_log(ISC_LOG_ERROR, "print data failed");
+			}
+		}
+	}
+
+	dns_client_freeresanswer(client, namelist);
+	isc_mem_put(mctx, namelist, sizeof(*namelist));
+
+	dns_client_detach(&client);
+
+	isc_loopmgr_shutdown(loopmgr);
+}
+
+static void
+resolve(void *arg) {
+	dns_client_t *client = arg;
+	dns_namelist_t *namelist;
+	unsigned int resopt;
+	isc_result_t result;
+	dns_name_t *query_name;
+
+	namelist = isc_mem_get(mctx, sizeof(*namelist));
+	ISC_LIST_INIT(*namelist);

 	/* Construct QNAME */
 	CHECK(convert_name(&qfn, &query_name, qname));
@@ -1781,36 +1780,71 @@ main(int argc, char *argv[]) {
 	}

 	/* Perform resolution */
-	ISC_LIST_INIT(namelist);
 	result = dns_client_resolve(client, query_name, dns_rdataclass_in,
-				    qtype, resopt, &namelist);
-	if (result != ISC_R_SUCCESS && !yaml) {
+				    qtype, resopt, namelist, resolve_cb);
+
+	if (result != ISC_R_SUCCESS) {
+		goto cleanup;
+	}
+
+	return;
+cleanup:
+	if (!yaml) {
 		delv_log(ISC_LOG_ERROR, "resolution failed: %s",
 			 isc_result_totext(result));
 	}

-	if (yaml) {
-		printf("type: DELV_RESULT\n");
-		dns_name_format(query_name, namestr, sizeof(namestr));
-		printf("query_name: %s\n", namestr);
-		printf("status: %s\n", isc_result_totext(result));
-		printf("records:\n");
+	isc_mem_put(mctx, namelist, sizeof(*namelist));
+	isc_loopmgr_shutdown(loopmgr);
+
+	dns_client_detach(&client);
+}
+
+int
+main(int argc, char *argv[]) {
+	dns_client_t *client = NULL;
+	isc_result_t result;
+
+	progname = argv[0];
+	preparse_args(argc, argv);
+
+	argc--;
+	argv++;
+
+	isc_managers_create(&mctx, 1, &loopmgr, &netmgr, &taskmgr);
+
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("dst_lib_init failed: %d", result);
 	}

-	for (response_name = ISC_LIST_HEAD(namelist); response_name != NULL;
-	     response_name = ISC_LIST_NEXT(response_name, link))
-	{
-		for (rdataset = ISC_LIST_HEAD(response_name->list);
-		     rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link))
-		{
-			result = printdata(rdataset, response_name, style);
-			if (result != ISC_R_SUCCESS) {
-				delv_log(ISC_LOG_ERROR, "print data failed");
-			}
-		}
+	parse_args(argc, argv);
+
+	CHECK(setup_style());
+
+	setup_logging(stderr);
+
+	/* Create client */
+	result = dns_client_create(mctx, loopmgr, taskmgr, netmgr, 0, &client,
+				   srcaddr4, srcaddr6);
+	if (result != ISC_R_SUCCESS) {
+		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
+			 isc_result_totext(result));
+		goto cleanup;
 	}

-	dns_client_freeresanswer(client, &namelist);
+	/* Set the nameserver */
+	if (server != NULL) {
+		addserver(client);
+	} else {
+		findserver(client);
+	}
+
+	CHECK(setup_dnsseckeys(client));
+
+	isc_loop_setup(isc_loop_main(loopmgr), resolve, client);
+
+	isc_loopmgr_run(loopmgr);

 cleanup:
 	if (trust_anchor != NULL) {
@@ -1825,18 +1859,12 @@ cleanup:
 	if (style != NULL) {
 		dns_master_styledestroy(&style, mctx);
 	}
-	if (client != NULL) {
-		dns_client_detach(&client);
-	}

-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr);
-
-	if (lctx != NULL) {
-		isc_log_destroy(&lctx);
-	}
-	isc_mem_detach(&mctx);
+	isc_log_destroy(&lctx);

 	dst_lib_destroy();

+	isc_managers_destroy(&mctx, &loopmgr, &netmgr, &taskmgr);
+
 	return (0);
 }
@@ -19,9 +19,9 @@
 #include <stdlib.h>
 #include <time.h>

-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/dir.h>
+#include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
@@ -59,7 +59,7 @@

 dig_lookup_t *default_lookup = NULL;

-static atomic_uintptr_t batchname = 0;
+static char *batchname = NULL;
 static FILE *batchfp = NULL;
 static char *argv0;
 static int addresscount = 0;
@@ -235,10 +235,8 @@ help(void) {
 	       "                 +[no]identify       (ID responders in short "
 	       "answers)\n"
 #ifdef HAVE_LIBIDN2
-	       "                 +[no]idnin          (Parse IDN names "
-	       "[default=on on tty])\n"
-	       "                 +[no]idnout         (Convert IDN response "
-	       "[default=on on tty])\n"
+	       "                 +[no]idn            (convert international "
+	       "domain names)\n"
 #endif /* ifdef HAVE_LIBIDN2 */
 	       "                 +[no]ignore         (Don't revert to TCP for "
 	       "TC responses.)\n"
@@ -359,9 +357,11 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 			proto = "TLS";
 		} else if (query->lookup->https_mode) {
 			if (query->lookup->http_plain) {
-				proto = "HTTP";
+				proto = query->lookup->https_get ? "HTTP-GET"
+								 : "HTTP";
 			} else {
-				proto = "HTTPS";
+				proto = query->lookup->https_get ? "HTTPS-GET"
+								 : "HTTPS";
 			}
 		} else if (query->lookup->tcp_mode) {
 			proto = "TCP";
@@ -782,7 +782,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 				strlcat(sockstr, "0", sizeof(sockstr));
 			}

-			printf("    response_address: %s\n", sockstr);
+			printf("    response_address: \"%s\"\n", sockstr);
 			printf("    response_port: %u\n", sport);
 		}

@@ -799,7 +799,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 				strlcat(sockstr, "0", sizeof(sockstr));
 			}

-			printf("    query_address: %s\n", sockstr);
+			printf("    query_address: \"%s\"\n", sockstr);
 			printf("    query_port: %u\n", sport);
 		}

@@ -1552,12 +1552,12 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 					FULLCHECK("http-plain");
 					break;
 				case '-':
-					switch (cmd[6]) {
+					switch (cmd[11]) {
 					case 'p':
-						FULLCHECK("https-plain-post");
+						FULLCHECK("http-plain-post");
 						break;
 					case 'g':
-						FULLCHECK("https-plain-get");
+						FULLCHECK("http-plain-get");
 						lookup->https_get = true;
 						break;
 					}
@@ -1613,7 +1613,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		break;
 	case 'i':
 		switch (cmd[1]) {
-		case 'd': /* identify */
+		case 'd':
 			switch (cmd[2]) {
 			case 'e':
 				FULLCHECK("identify");
@@ -1621,33 +1621,28 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				break;
 			case 'n':
 				switch (cmd[3]) {
-				case 'i':
-					FULLCHECK("idnin");
-#ifndef HAVE_LIBIDN2
-					if (state) {
-						fprintf(stderr,
-							";; IDN input support"
-							" not enabled\n");
-					}
-#else  /* ifndef HAVE_LIBIDN2 */
+				case '\0':
+					FULLCHECK("idn");
 					lookup->idnin = state;
-#endif /* ifndef HAVE_LIBIDN2 */
-					break;
-				case 'o':
-					FULLCHECK("idnout");
-#ifndef HAVE_LIBIDN2
-					if (state) {
-						fprintf(stderr,
-							";; IDN output support"
-							" not enabled\n");
-					}
-#else  /* ifndef HAVE_LIBIDN2 */
 					lookup->idnout = state;
-#endif /* ifndef HAVE_LIBIDN2 */
+					break;
+				case 'i': /* (compat) */
+					FULLCHECK("idnin");
+					lookup->idnin = state;
+					break;
+				case 'o': /* (compat) */
+					FULLCHECK("idnout");
+					lookup->idnout = state;
 					break;
 				default:
 					goto invalid_option;
 				}
+#ifndef HAVE_LIBIDN2
+				if (state) {
+					printf(";; IDN support "
+					       "is not available\n");
+				}
+#endif /* ifndef HAVE_LIBIDN2 */
 				break;
 			default:
 				goto invalid_option;
@@ -2350,7 +2345,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		return (value_from_next);
 	case 'f':
-		atomic_store(&batchname, (uintptr_t)value);
+		batchname = value;
 		return (value_from_next);
 	case 'k':
 		strlcpy(keyfile, value, sizeof(keyfile));
@@ -2836,7 +2831,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 	 * first entry, then trust the callback in dighost_shutdown
 	 * to get the rest
 	 */
-	char *filename = (char *)atomic_load(&batchname);
+	char *filename = batchname;
 	if ((filename != NULL) && !(is_batchfile)) {
 		if (strcmp(filename, "-") == 0) {
 			batchfp = stdin;
@@ -2900,38 +2895,32 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 static void
 query_finished(void) {
 	char batchline[MXNAME];
-	int bargc;
-	char *bargv[16];
-
-	if (atomic_load(&batchname) == 0) {
-		isc_app_shutdown();
-		return;
-	}

 	fflush(stdout);
-	if (feof(batchfp)) {
-		atomic_store(&batchname, 0);
-		isc_app_shutdown();
-		if (batchfp != stdin) {
-			fclose(batchfp);
-		}
-		return;
-	}

-	if (fgets(batchline, sizeof(batchline), batchfp) != 0) {
+	if (batchname != NULL && !feof(batchfp) &&
+	    fgets(batchline, sizeof(batchline), batchfp) != NULL)
+	{
+		int bargc;
+		char *bargv[16];
 		debug("batch line %s", batchline);
 		bargc = split_batchline(batchline, bargv, 14, "batch argv");
 		bargv[0] = argv0;
 		parse_args(true, false, bargc, (char **)bargv);
 		start_lookup();
-	} else {
-		atomic_store(&batchname, 0);
+		return;
+	}
+
+	debug("shutdown");
+
+	/* We are done */
+	if (batchname != NULL) {
 		if (batchfp != stdin) {
 			fclose(batchfp);
 		}
-		isc_app_shutdown();
-		return;
+		batchname = NULL;
 	}
+	isc_loopmgr_shutdown(loopmgr);
 }

 static void
@@ -2995,8 +2984,6 @@ dig_comments(dig_lookup_t *lookup, const char *format, ...) {

 void
 dig_setup(int argc, char **argv) {
-	isc_result_t result;
-
 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
 	ISC_LIST_INIT(search_list);
@@ -3015,9 +3002,6 @@ dig_setup(int argc, char **argv) {
 	progname = argv[0];
 	preparse_args(argc, argv);

-	result = isc_app_start();
-	check_result(result, "isc_app_start");
-
 	setup_libs();
 	setup_system(ipv4only, ipv6only);
 }
@@ -3040,13 +3024,10 @@ dig_query_setup(bool is_batchfile, bool config_only, int argc, char **argv) {

 void
 dig_startup(void) {
-	isc_result_t result;
-
 	debug("dig_startup()");

-	result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
-	check_result(result, "isc_app_onrun");
-	isc_app_run();
+	isc_loopmgr_setup(loopmgr, run_loop, NULL);
+	isc_loopmgr_run(loopmgr);
 }

 void
@@ -3057,15 +3038,8 @@ dig_query_start(void) {
 void
 dig_shutdown(void) {
 	destroy_lookup(default_lookup);
-	if (atomic_load(&batchname) != 0) {
-		if (batchfp != stdin) {
-			fclose(batchfp);
-		}
-		atomic_store(&batchname, 0);
-	}
 	cancel_all();
 	destroy_libs();
-	isc_app_finish();
 }

 /*% Main processing routine for dig */
@@ -432,28 +432,19 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   form answers are requested, the default is not to show the source
   address and port number of the server that provided the answer.

-.. option:: +idnin, +noidnin
+.. option:: +idn, +noidn

-   This option processes [or does not process] IDN domain names on input. This requires
-   ``IDN SUPPORT`` to have been enabled at compile time.
+   Enable or disable IDN processing. By default IDN is enabled for
+   input query names, and for display when the output is a terminal.

-   The default is to process IDN input when standard output is a tty.
-   The IDN processing on input is disabled when :program:`dig` output is redirected
-   to files, pipes, and other non-tty file descriptors.
-
-.. option:: +idnout, +noidnout
-
-   This option converts [or does not convert] puny code on output. This requires
-   ``IDN SUPPORT`` to have been enabled at compile time.
-
-   The default is to process puny code on output when standard output is
-   a tty. The puny code processing on output is disabled when :program:`dig` output
-   is redirected to files, pipes, and other non-tty file descriptors.
+   You can also turn off :program:`dig`'s IDN processing by setting
+   the ``IDN_DISABLE`` environment variable.

 .. option:: +ignore, +noignore

-   This option ignores [or does not ignore] truncation in UDP responses instead of retrying with TCP. By
-   default, TCP retries are performed.
+   This option ignores [or does not ignore] truncation in UDP
+   responses instead of retrying with TCP. By default, TCP retries are
+   performed.

 .. option:: +keepalive, +nokeepalive

@@ -750,17 +741,6 @@ each lookup. The final query has a local query option of :option:`+qr` which
 means that :program:`dig` does not print the initial query when it looks up the
 NS records for ``isc.org``.

-IDN Support
-~~~~~~~~~~~
-
-If :program:`dig` has been built with IDN (internationalized domain name)
-support, it can accept and display non-ASCII domain names. :program:`dig`
-appropriately converts character encoding of a domain name before sending
-a request to a DNS server or displaying a reply from the server.
-To turn off IDN support, use the parameters
-:option:`+idnin` and :option:`+idnout`, or define the ``IDN_DISABLE`` environment
-variable.
-
 Return Codes
 ~~~~~~~~~~~~

@@ -34,12 +34,12 @@
 #include <idn2.h>
 #endif /* HAVE_LIBIDN2 */

-#include <isc/app.h>
 #include <isc/base64.h>
 #include <isc/file.h>
 #include <isc/hex.h>
 #include <isc/lang.h>
 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/netaddr.h>
 #include <isc/netdb.h>
@@ -89,7 +89,7 @@ dig_lookuplist_t lookup_list;
 dig_serverlist_t server_list;
 dig_searchlistlist_t search_list;

-static atomic_bool cancel_now = false;
+static bool cancel_now = false;

 bool check_ra = false, have_ipv4 = false, have_ipv6 = false,
     specified_source = false, free_now = false, usesearch = false,
@@ -103,7 +103,8 @@ isc_mem_t *mctx = NULL;
 isc_log_t *lctx = NULL;
 isc_nm_t *netmgr = NULL;
 isc_taskmgr_t *taskmgr = NULL;
-isc_task_t *global_task = NULL;
+isc_loopmgr_t *loopmgr = NULL;
+isc_loop_t *mainloop = NULL;
 isc_sockaddr_t localaddr;
 isc_refcount_t sendcount = 0;
 isc_refcount_t recvcount = 0;
@@ -115,11 +116,7 @@ static char servercookie[256];

 #ifdef HAVE_LIBIDN2
 static void
-idn_locale_to_ace(const char *src, char *dst, size_t dstlen);
-static void
-idn_ace_to_locale(const char *src, char **dst);
-static isc_result_t
-idn_output_filter(isc_buffer_t *buffer, unsigned int used_org);
+idn_input(const char *src, char *dst, size_t dstlen);
 #endif /* HAVE_LIBIDN2 */

 isc_nmhandle_t *keep = NULL;
@@ -151,27 +148,10 @@ bool debugging = false;
 bool debugtiming = false;
 bool memdebugging = false;
 char *progname = NULL;
-isc_mutex_t lookup_lock;
 dig_lookup_t *current_lookup = NULL;

 #define DIG_MAX_ADDRESSES 20

-/*%
- * Apply and clear locks at the event level in global task.
- * Can I get rid of these using shutdown events?  XXX
- */
-#define LOCK_LOOKUP                                             \
-	{                                                       \
-		debug("lock_lookup %s:%d", __FILE__, __LINE__); \
-		isc_mutex_lock((&lookup_lock));                 \
-		debug("success");                               \
-	}
-#define UNLOCK_LOOKUP                                             \
-	{                                                         \
-		debug("unlock_lookup %s:%d", __FILE__, __LINE__); \
-		isc_mutex_unlock((&lookup_lock));                 \
-	}
-
 static void
 default_warnerr(const char *format, ...) {
 	va_list args;
@@ -552,8 +532,10 @@ set_nameserver(char *opt) {
 		return;
 	}

+	isc_loopmgr_blocking(loopmgr);
 	result = bind9_getaddresses(opt, 0, sockaddrs, DIG_MAX_ADDRESSES,
 				    &count);
+	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
 		fatal("couldn't get address for '%s': %s", opt,
 		      isc_result_totext(result));
@@ -599,8 +581,13 @@ clone_server_list(dig_serverlist_t src, dig_serverlist_t *dest) {
 dig_lookup_t *
 make_empty_lookup(void) {
 	dig_lookup_t *looknew;
+	int idnin = false, idnout = false;
+
 #ifdef HAVE_LIBIDN2
-	bool idn_allowed = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false;
+	if (getenv("IDN_DISABLE") == NULL) {
+		idnin = true;
+		idnout = isatty(1);
+	}
 #endif /* HAVE_LIBIDN2 */

 	debug("make_empty_lookup()");
@@ -617,10 +604,8 @@ make_empty_lookup(void) {
 		.besteffort = true,
 		.opcode = dns_opcode_query,
 		.badcookie = true,
-#ifdef HAVE_LIBIDN2
-		.idnin = idn_allowed,
-		.idnout = idn_allowed,
-#endif /* HAVE_LIBIDN2 */
+		.idnin = idnin,
+		.idnout = idnout,
 		.udpsize = -1,
 		.edns = -1,
 		.recurse = true,
@@ -1374,8 +1359,7 @@ setup_libs(void) {
 		fatal("can't find either v4 or v6 networking");
 	}

-	isc_mem_create(&mctx);
-	isc_mem_setname(mctx, "dig");
+	isc_managers_create(&mctx, 1, &loopmgr, &netmgr, &taskmgr);

 	isc_log_create(mctx, &lctx, &logconfig);
 	isc_log_setcontext(lctx);
@@ -1387,17 +1371,12 @@ setup_libs(void) {

 	isc_log_setdebuglevel(lctx, 0);

-	isc_managers_create(mctx, 1, 0, &netmgr, &taskmgr, NULL);
-
-	result = isc_task_create(taskmgr, 0, &global_task, 0);
-	check_result(result, "isc_task_create");
-	isc_task_setname(global_task, "dig", NULL);
+	isc_mem_setname(mctx, "dig");
+	mainloop = isc_loop_main(loopmgr);

 	result = dst_lib_init(mctx, NULL);
 	check_result(result, "dst_lib_init");
 	is_dst_up = true;
-
-	isc_mutex_init(&lookup_lock);
 }

 typedef struct dig_ednsoptname {
@@ -1546,6 +1525,10 @@ check_if_done(void) {
 		INSIST(isc_refcount_current(&recvcount) == 0);
 		debug("shutting down");
 		dighost_shutdown();
+
+		if (current_lookup == NULL && keep != NULL) {
+			isc_nmhandle_detach(&keep);
+		}
 	}
 }

@@ -1773,7 +1756,7 @@ void
 start_lookup(void) {
 	debug("start_lookup()");

-	if (atomic_load(&cancel_now)) {
+	if (cancel_now) {
 		return;
 	}

@@ -1824,11 +1807,19 @@ clear_current_lookup(void) {
 		return;
 	}

+	if (lookup->cleared) {
+		debug("current_lookup is already cleared");
+		return;
+	}
+
 	if (ISC_LIST_HEAD(lookup->q) != NULL) {
 		debug("still have a worker");
 		return;
 	}

+	lookup->cleared = true;
+	debug("lookup cleared");
+
 	lookup_detach(&lookup);
 }

@@ -2228,7 +2219,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	textname = lookup->textname;
 #ifdef HAVE_LIBIDN2
 	if (lookup->idnin) {
-		idn_locale_to_ace(textname, idn_textname, sizeof(idn_textname));
+		idn_input(textname, idn_textname, sizeof(idn_textname));
 		debug("idn_textname: %s", idn_textname);
 		textname = idn_textname;
 	}
@@ -2259,8 +2250,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		origin = lookup->origin->origin;
 #ifdef HAVE_LIBIDN2
 		if (lookup->idnin) {
-			idn_locale_to_ace(origin, idn_origin,
-					  sizeof(idn_origin));
+			idn_input(origin, idn_origin, sizeof(idn_origin));
 			debug("trying idn origin %s", idn_origin);
 			origin = idn_origin;
 		}
@@ -2724,8 +2714,6 @@ send_done(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {

 	INSIST(!free_now);

-	LOCK_LOOKUP;
-
 	isc_nmhandle_detach(&query->sendhandle);

 	lookup_attach(query->lookup, &l);
@@ -2737,7 +2725,6 @@ send_done(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 		}
 		query_detach(&query);
 		lookup_detach(&l);
-		UNLOCK_LOOKUP;
 		return;
 	} else if (eresult != ISC_R_SUCCESS) {
 		debug("send failed: %s", isc_result_totext(eresult));
@@ -2751,7 +2738,6 @@ send_done(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	}

 	check_if_done();
-	UNLOCK_LOOKUP;
 }

 /*%
@@ -2922,6 +2908,8 @@ start_tcp(dig_query_t *query) {
 	isc_tlsctx_t *tlsctx = NULL;
 	bool tls_mode = false;
 	isc_tlsctx_client_session_cache_t *sess_cache = NULL;
+	int local_timeout;
+
 	REQUIRE(DIG_VALID_QUERY(query));

 	debug("start_tcp(%p)", query);
@@ -2992,69 +2980,67 @@ start_tcp(dig_query_t *query) {
 		launch_next_query(query);
 		query_detach(&query);
 		return;
+	} else if (keep != NULL) {
+		isc_nmhandle_detach(&keep);
+	}
+
+	if (timeout != 0) {
+		local_timeout = timeout * 1000;
 	} else {
-		int local_timeout = timeout * 1000;
-		if (local_timeout == 0) {
-			local_timeout = TCP_TIMEOUT * 1000;
+		local_timeout = TCP_TIMEOUT * 1000;
+	}
+
+	if (!specified_source) {
+		if ((isc_sockaddr_pf(&query->sockaddr) == AF_INET) && have_ipv4)
+		{
+			isc_sockaddr_any(&localaddr);
+		} else {
+			isc_sockaddr_any6(&localaddr);
 		}
+	}

-		if (keep != NULL) {
-			isc_nmhandle_detach(&keep);
+	REQUIRE(query != NULL);
+
+	query_attach(query, &connectquery);
+
+	if (tls_mode) {
+		tlsctx = get_create_tls_context(connectquery, false,
+						&sess_cache);
+		if (tlsctx == NULL) {
+			goto failure_tls;
 		}
+		isc_nm_tlsdnsconnect(netmgr, &localaddr, &query->sockaddr,
+				     tcp_connected, connectquery, local_timeout,
+				     tlsctx, sess_cache);
+#if HAVE_LIBNGHTTP2
+	} else if (query->lookup->https_mode) {
+		char uri[4096] = { 0 };
+		isc_nm_http_makeuri(!query->lookup->http_plain,
+				    &query->sockaddr, query->userarg, port,
+				    query->lookup->https_path, uri,
+				    sizeof(uri));

-		if (!specified_source) {
-			if ((isc_sockaddr_pf(&query->sockaddr) == AF_INET) &&
-			    have_ipv4) {
-				isc_sockaddr_any(&localaddr);
-			} else {
-				isc_sockaddr_any6(&localaddr);
-			}
-		}
-
-		REQUIRE(query != NULL);
-
-		query_attach(query, &connectquery);
-
-		if (tls_mode) {
-			tlsctx = get_create_tls_context(connectquery, false,
+		if (!query->lookup->http_plain) {
+			tlsctx = get_create_tls_context(connectquery, true,
 							&sess_cache);
 			if (tlsctx == NULL) {
 				goto failure_tls;
 			}
-			isc_nm_tlsdnsconnect(netmgr, &localaddr,
-					     &query->sockaddr, tcp_connected,
-					     connectquery, local_timeout,
-					     tlsctx, sess_cache);
-#if HAVE_LIBNGHTTP2
-		} else if (query->lookup->https_mode) {
-			char uri[4096] = { 0 };
-			isc_nm_http_makeuri(!query->lookup->http_plain,
-					    &query->sockaddr, query->userarg,
-					    port, query->lookup->https_path,
-					    uri, sizeof(uri));
-
-			if (!query->lookup->http_plain) {
-				tlsctx = get_create_tls_context(
-					connectquery, true, &sess_cache);
-				if (tlsctx == NULL) {
-					goto failure_tls;
-				}
-			}
-
-			isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr,
-					   uri, !query->lookup->https_get,
-					   tcp_connected, connectquery, tlsctx,
-					   sess_cache, local_timeout);
-#endif
-		} else {
-			isc_nm_tcpdnsconnect(netmgr, &localaddr,
-					     &query->sockaddr, tcp_connected,
-					     connectquery, local_timeout);
 		}

-		/* XXX: set DSCP */
+		isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr, uri,
+				   !query->lookup->https_get, tcp_connected,
+				   connectquery, tlsctx, sess_cache,
+				   local_timeout);
+#endif
+	} else {
+		isc_nm_tcpdnsconnect(netmgr, &localaddr, &query->sockaddr,
+				     tcp_connected, connectquery,
+				     local_timeout);
 	}

+	/* XXX: set DSCP */
+
 	return;

 failure_tls:
@@ -3137,7 +3123,7 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {

 	query->started = true;

-	if (atomic_load(&cancel_now)) {
+	if (cancel_now) {
 		query_detach(&query);
 		return;
 	}
@@ -3147,7 +3133,6 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	debug("udp_ready(%p, %s, %p)", handle, isc_result_totext(eresult),
 	      query);

-	LOCK_LOOKUP;
 	lookup_attach(query->lookup, &l);

 	if (eresult == ISC_R_CANCELED || query->canceled) {
@@ -3158,7 +3143,6 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 		query_detach(&query);
 		lookup_detach(&l);
 		clear_current_lookup();
-		UNLOCK_LOOKUP;
 		return;
 	}

@@ -3179,7 +3163,6 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			nssearch_next(l, query);

 			check_if_done();
-			UNLOCK_LOOKUP;
 			return;
 		}

@@ -3214,7 +3197,6 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 		}

 		check_if_done();
-		UNLOCK_LOOKUP;
 		return;
 	}

@@ -3242,7 +3224,6 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {

 	query_detach(&query);
 	lookup_detach(&l);
-	UNLOCK_LOOKUP;
 }

 /*%
@@ -3349,11 +3330,9 @@ force_next(dig_query_t *query) {

 	debug("force_next()");

-	LOCK_LOOKUP;
 	INSIST(!free_now);

-	if (atomic_load(&cancel_now)) {
-		UNLOCK_LOOKUP;
+	if (cancel_now) {
 		return;
 	}

@@ -3361,7 +3340,6 @@ force_next(dig_query_t *query) {

 	if (try_next_server(l)) {
 		lookup_detach(&l);
-		UNLOCK_LOOKUP;
 		return;
 	}

@@ -3376,7 +3354,6 @@ force_next(dig_query_t *query) {
 		      isc_refcount_current(&recvcount));
 		query_detach(&query);
 		clear_current_lookup();
-		UNLOCK_LOOKUP;
 		return;
 	}

@@ -3407,7 +3384,6 @@ force_next(dig_query_t *query) {
 	cancel_lookup(l);
 	lookup_detach(&l);
 	clear_current_lookup();
-	UNLOCK_LOOKUP;
 }

 /*%
@@ -3525,7 +3501,7 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {

 	query->started = true;

-	if (atomic_load(&cancel_now)) {
+	if (cancel_now) {
 		query_detach(&query);
 		return;
 	}
@@ -3535,7 +3511,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	debug("tcp_connected(%p, %s, %p)", handle, isc_result_totext(eresult),
 	      query);

-	LOCK_LOOKUP;
 	lookup_attach(query->lookup, &l);

 	if (eresult == ISC_R_CANCELED || eresult == ISC_R_TLSBADPEERCERT ||
@@ -3562,7 +3537,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 		query_detach(&query);
 		lookup_detach(&l);
 		clear_current_lookup();
-		UNLOCK_LOOKUP;
 		return;
 	}

@@ -3582,9 +3556,7 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 		 */
 		if (l->ns_search_only && !l->trace_root) {
 			nssearch_next(l, query);
-
 			check_if_done();
-			UNLOCK_LOOKUP;
 			return;
 		}

@@ -3620,7 +3592,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 		}

 		check_if_done();
-		UNLOCK_LOOKUP;
 		return;
 	}

@@ -3639,7 +3610,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	launch_next_query(query);
 	query_detach(&query);
 	lookup_detach(&l);
-	UNLOCK_LOOKUP;
 }

 /*%
@@ -3913,8 +3883,6 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	debug("recv_done(%p, %s, %p, %p)", handle, isc_result_totext(eresult),
 	      region, arg);

-	LOCK_LOOKUP;
-
 	isc_refcount_decrement0(&recvcount);
 	debug("recvcount=%" PRIuFAST32, isc_refcount_current(&recvcount));

@@ -3929,7 +3897,6 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		query_detach(&query);
 		lookup_detach(&l);
 		clear_current_lookup();
-		UNLOCK_LOOKUP;
 		return;
 	}

@@ -3939,7 +3906,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		TIME_NOW(&query->time_recv);
 	}

-	if ((!l->pending && !l->ns_search_only) || atomic_load(&cancel_now)) {
+	if ((!l->pending && !l->ns_search_only) || cancel_now) {
 		debug("no longer pending.  Got %s", isc_result_totext(eresult));

 		goto next_lookup;
@@ -4150,8 +4117,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 							  &l->querysig);
 			check_result(result, "dns_message_getquerytsig");
 		}
-		result = dns_message_setquerytsig(msg, l->querysig);
-		check_result(result, "dns_message_setquerytsig");
+		dns_message_setquerytsig(msg, l->querysig);
 		result = dns_message_settsigkey(msg, tsigkey);
 		check_result(result, "dns_message_settsigkey");
 		msg->tsigctx = l->tsigctx;
@@ -4522,7 +4488,6 @@ keep_query:
 	if (donext) {
 		clear_current_lookup();
 	}
-	UNLOCK_LOOKUP;
 }

 /*%
@@ -4534,16 +4499,10 @@ isc_result_t
 get_address(char *host, in_port_t myport, isc_sockaddr_t *sockaddr) {
 	int count;
 	isc_result_t result;
-	bool is_running;

-	is_running = isc_app_isrunning();
-	if (is_running) {
-		isc_app_block();
-	}
+	isc_loopmgr_blocking(loopmgr);
 	result = bind9_getaddresses(host, myport, sockaddr, 1, &count);
-	if (is_running) {
-		isc_app_unblock();
-	}
+	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -4562,8 +4521,10 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 	dig_server_t *srv;
 	char tmp[ISC_NETADDR_FORMATSIZE];

+	isc_loopmgr_blocking(loopmgr);
 	result = bind9_getaddresses(host, 0, sockaddrs, DIG_MAX_ADDRESSES,
 				    &count);
+	isc_loopmgr_nonblocking(loopmgr);
 	if (resultp != NULL) {
 		*resultp = result;
 	}
@@ -4611,13 +4572,17 @@ do_lookup(dig_lookup_t *lookup) {
 * Start everything in action upon task startup.
 */
 void
-onrun_callback(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
+onrun_callback(void *arg) {
+	UNUSED(arg);
+
+	start_lookup();
+}
+
+void
+run_loop(void *arg) {
+	UNUSED(arg);

-	isc_event_free(&event);
-	LOCK_LOOKUP;
 	start_lookup();
-	UNLOCK_LOOKUP;
 }

 /*%
@@ -4631,12 +4596,12 @@ cancel_all(void) {

 	debug("cancel_all()");

-	LOCK_LOOKUP;
 	if (free_now) {
-		UNLOCK_LOOKUP;
 		return;
 	}
-	atomic_store(&cancel_now, true);
+
+	cancel_now = true;
+
 	while (current_lookup != NULL) {
 		for (q = ISC_LIST_HEAD(current_lookup->q); q != NULL; q = nq) {
 			nq = ISC_LIST_NEXT(q, link);
@@ -4664,7 +4629,6 @@ cancel_all(void) {
 		lookup_detach(&l);
 		l = n;
 	}
-	UNLOCK_LOOKUP;
 }

 /*%
@@ -4673,18 +4637,8 @@ cancel_all(void) {
 */
 void
 destroy_libs(void) {
-	if (keep != NULL) {
-		isc_nmhandle_detach(&keep);
-	}
 	debug("destroy_libs()");
-	if (global_task != NULL) {
-		debug("freeing task");
-		isc_task_detach(&global_task);
-	}

-	isc_managers_destroy(&netmgr, &taskmgr, NULL);
-
-	LOCK_LOOKUP;
 	isc_refcount_destroy(&recvcount);
 	isc_refcount_destroy(&sendcount);

@@ -4712,8 +4666,6 @@ destroy_libs(void) {
 		is_dst_up = false;
 	}

-	UNLOCK_LOOKUP;
-	isc_mutex_destroy(&lookup_lock);
 	debug("Removing log context");
 	isc_log_destroy(&lctx);

@@ -4721,63 +4673,53 @@ destroy_libs(void) {
 	if (memdebugging != 0) {
 		isc_mem_stats(mctx, stderr);
 	}
-	if (mctx != NULL) {
-		isc_mem_destroy(&mctx);
-	}
+
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr, &taskmgr);
 }

 #ifdef HAVE_LIBIDN2
+
 static isc_result_t
-idn_output_filter(isc_buffer_t *buffer, unsigned int used_org) {
-	char src[MXNAME], *dst = NULL;
+idn_filter(isc_buffer_t *buffer, unsigned start) {
+	char src[MXNAME];
+	char *dst = NULL;
 	size_t srclen, dstlen;
-	isc_result_t result = ISC_R_SUCCESS;
+	int res;

 	/*
 	 * Copy name from 'buffer' to 'src' and terminate it with NULL.
 	 */
-	srclen = isc_buffer_usedlength(buffer) - used_org;
-	if (srclen >= sizeof(src)) {
-		warn("Input name too long to perform IDN conversion");
-		goto cleanup;
-	}
-	memmove(src, (char *)isc_buffer_base(buffer) + used_org, srclen);
+	srclen = isc_buffer_usedlength(buffer) - start;
+	INSIST(srclen < sizeof(src));
+	memmove(src, (char *)isc_buffer_base(buffer) + start, srclen);
 	src[srclen] = '\0';

+	/*
+	 * Try to convert the name; leave it unchanged if conversion fails.
+	 */
 	systemlocale(LC_ALL);
-
-	/*
-	 * Convert 'src' to the current locale's character encoding.
-	 */
-	idn_ace_to_locale(src, &dst);
-
+	res = idn2_to_unicode_8zlz(src, &dst, IDN2_NONTRANSITIONAL);
+	if (res == IDN2_DISALLOWED) {
+		res = idn2_to_unicode_8zlz(src, &dst, IDN2_TRANSITIONAL);
+	}
 	resetlocale(LC_ALL);
-
-	/*
-	 * Check whether the converted name will fit back into 'buffer'.
-	 */
-	dstlen = strlen(dst);
-	if (isc_buffer_length(buffer) < used_org + dstlen) {
-		result = ISC_R_NOSPACE;
-		goto cleanup;
+	if (res != IDN2_OK) {
+		return (ISC_R_SUCCESS);
 	}

 	/*
-	 * Put the converted name back into 'buffer'.
+	 * Copy the converted back into 'buffer' if it fits.
 	 */
+	dstlen = strlen(dst);
+	if (isc_buffer_length(buffer) < start + dstlen) {
+		return (ISC_R_NOSPACE);
+	}
 	isc_buffer_subtract(buffer, srclen);
 	memmove(isc_buffer_used(buffer), dst, dstlen);
 	isc_buffer_add(buffer, dstlen);

-	/*
-	 * Clean up.
-	 */
-cleanup:
-	if (dst != NULL) {
-		idn2_free(dst);
-	}
-
-	return (result);
+	idn2_free(dst);
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -4788,119 +4730,42 @@ cleanup:
 * 'dst' MUST be large enough to hold any valid domain name.
 */
 static void
-idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
-	const char *final_src;
-	char *ascii_src;
+idn_input(const char *src, char *dst, size_t dstlen) {
+	char *ascii = NULL;
+	size_t len;
 	int res;

-	systemlocale(LC_ALL);
-
 	/*
 	 * We trust libidn2 to return an error if 'src' is too large to be a
 	 * valid domain name.
+	 *
+	 * If conversion fails under IDNA2008 rules, retry with transitional
+	 * rules. The aim is that characters whose interpretation changed will
+	 * be handled under the new rules, but we will accept characters (such
+	 * as emoji) that were OK but are now forbidden.
 	 */
-	res = idn2_to_ascii_lz(src, &ascii_src, IDN2_NONTRANSITIONAL);
-	if (res != IDN2_OK) {
-		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin",
-		      src, idn2_strerror(res));
-	}
-
-	/*
-	 * idn2_to_ascii_lz() normalizes all strings to lower case, but we
-	 * generally don't want to lowercase all input strings; make sure to
-	 * return the original case if the two strings differ only in case.
-	 */
-	final_src = (strcasecmp(src, ascii_src) == 0 ? src : ascii_src);
-
-	(void)strlcpy(dst, final_src, dstlen);
-
-	idn2_free(ascii_src);
-
-	resetlocale(LC_ALL);
-}
-
-/*%
- * Convert 'src', which is an ACE string suitable for use in the DNS, into a
- * string using the current locale's character encoding, storing the conversion
- * result in 'dst'.
- *
- * The caller MUST subsequently release 'dst' using idn2_free().
- */
-static void
-idn_ace_to_locale(const char *src, char **dst) {
-	char *local_src, *utf8_src;
-	int res;
-
 	systemlocale(LC_ALL);
-
-	/*
-	 * We need to:
-	 *
-	 *  1) check whether 'src' is a valid IDNA2008 name,
-	 *  2) if it is, output it in the current locale's character encoding.
-	 *
-	 * Unlike idn2_to_ascii_*(), idn2_to_unicode_*() functions are unable
-	 * to perform IDNA2008 validity checks.  Thus, we need to decode any
-	 * Punycode in 'src', check if the resulting name is a valid IDNA2008
-	 * name, and only once we ensure it is, output that name in the current
-	 * locale's character encoding.
-	 *
-	 * We could just use idn2_to_unicode_8zlz() + idn2_to_ascii_lz(), but
-	 * then we would not be able to universally tell invalid names and
-	 * character encoding errors apart (if the current locale uses ASCII
-	 * for character encoding, the former function would fail even for a
-	 * valid IDNA2008 name, as long as it contained any non-ASCII
-	 * character).  Thus, we need to take a longer route.
-	 *
-	 * First, convert 'src' to UTF-8, ignoring the current locale.
-	 */
-	res = idn2_to_unicode_8z8z(src, &utf8_src, 0);
-	if (res != IDN2_OK) {
-		fatal("Bad ACE string '%s' (%s), use +noidnout", src,
-		      idn2_strerror(res));
+	res = idn2_to_ascii_lz(src, &ascii, IDN2_NONTRANSITIONAL);
+	if (res == IDN2_DISALLOWED) {
+		res = idn2_to_ascii_lz(src, &ascii, IDN2_TRANSITIONAL);
 	}
-
-	/*
-	 * Then, check whether decoded 'src' is a valid IDNA2008 name.
-	 */
-	res = idn2_to_ascii_8z(utf8_src, NULL, IDN2_NONTRANSITIONAL);
-	if (res != IDN2_OK) {
-		fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnout",
-		      src, idn2_strerror(res));
-	}
-
-	/*
-	 * Finally, try converting the decoded 'src' into the current locale's
-	 * character encoding.
-	 */
-	res = idn2_to_unicode_8zlz(utf8_src, &local_src, 0);
-	if (res != IDN2_OK) {
-		static bool warned = false;
-
-		res = idn2_to_ascii_8z(utf8_src, &local_src, 0);
-		if (res != IDN2_OK) {
-			fatal("Cannot represent '%s' "
-			      "in the current locale nor ascii (%s), "
-			      "use +noidnout or a different locale",
-			      src, idn2_strerror(res));
-		} else if (!warned) {
-			fprintf(stderr,
-				";; Warning: cannot represent '%s' "
-				"in the current locale",
-				local_src);
-			warned = true;
-		}
-	}
-
-	/*
-	 * Free the interim conversion result.
-	 */
-	idn2_free(utf8_src);
-
-	*dst = local_src;
-
 	resetlocale(LC_ALL);
+
+	/*
+	 * idn2_to_ascii_lz() normalizes all strings to lower case, but
+	 * we generally don't want to lowercase all input strings; make
+	 * sure to return the original case if the two strings differ
+	 * only in case.
+	 */
+	if (res == IDN2_OK && strcasecmp(src, ascii) != 0) {
+		len = strlcpy(dst, ascii, dstlen);
+	} else {
+		len = strlcpy(dst, src, dstlen);
+	}
+	INSIST(len < dstlen);
+	idn2_free(ascii);
 }
+
 #endif /* HAVE_LIBIDN2 */

 void
@@ -4908,7 +4773,7 @@ dig_idnsetup(dig_lookup_t *lookup, bool active) {
 #ifdef HAVE_LIBIDN2
 	isc_result_t result;
 	result = dns_name_settotextfilter(
-		(active && lookup->idnout) ? idn_output_filter : NULL);
+		(active && lookup->idnout) ? idn_filter : NULL);
 	check_result(result, "dns_name_settotextfilter");
 #else
 	UNUSED(lookup);
@@ -23,6 +23,7 @@
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
 #include <isc/list.h>
+#include <isc/loop.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
@@ -105,7 +106,7 @@ typedef struct dig_searchlist dig_searchlist_t;
 struct dig_lookup {
 	unsigned int magic;
 	isc_refcount_t references;
-	bool aaonly, adflag, badcookie, besteffort, cdflag, comments,
+	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
 		expire, header_only, identify, /*%< Append an "on server <foo>"
 						  message */
@@ -263,7 +264,8 @@ extern unsigned int digestbits;
 extern dns_tsigkey_t *tsigkey;
 extern bool validated;
 extern isc_taskmgr_t *taskmgr;
-extern isc_task_t *global_task;
+extern isc_loopmgr_t *loopmgr;
+extern isc_loop_t *mainloop;
 extern bool free_now;
 extern bool debugging, debugtiming, memdebugging;
 extern bool keep_open;
@@ -313,7 +315,10 @@ void
 start_lookup(void);

 void
-onrun_callback(isc_task_t *task, isc_event_t *event);
+onrun_callback(void *arg);
+
+void
+run_loop(void *arg);

 int
 dhmain(int argc, char **argv);
@@ -19,9 +19,9 @@
 #include <stdbool.h>
 #include <stdlib.h>

-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/commandline.h>
+#include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/print.h>
 #include <isc/string.h>
@@ -139,7 +139,7 @@ show_usage(void) {

 static void
 host_shutdown(void) {
-	(void)isc_app_shutdown();
+	isc_loopmgr_shutdown(loopmgr);
 }

 static void
@@ -878,8 +878,6 @@ parse_args(bool is_batchfile, int argc, char **argv) {

 int
 main(int argc, char **argv) {
-	isc_result_t result;
-
 	tries = 2;

 	ISC_LIST_INIT(lookup_list);
@@ -897,8 +895,6 @@ main(int argc, char **argv) {
 	debug("main()");
 	progname = argv[0];
 	pre_parse_args(argc, argv);
-	result = isc_app_start();
-	check_result(result, "isc_app_start");
 	setup_libs();
 	setup_system(ipv4only, ipv6only);
 	parse_args(false, argc, argv);
@@ -907,11 +903,12 @@ main(int argc, char **argv) {
 	} else if (keysecret[0] != 0) {
 		setup_text_key();
 	}
-	result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
-	check_result(result, "isc_app_onrun");
-	isc_app_run();
+
+	isc_loopmgr_setup(loopmgr, run_loop, NULL);
+	isc_loopmgr_run(loopmgr);
+
 	cancel_all();
 	destroy_libs();
-	isc_app_finish();
+
 	return ((seen_error == 0) ? 0 : 1);
 }
@@ -16,17 +16,20 @@
 #include <stdlib.h>
 #include <unistd.h>

-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/condition.h>
 #include <isc/event.h>
+#include <isc/job.h>
+#include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/util.h>
+#include <isc/work.h>

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
@@ -41,6 +44,9 @@
 #include "dighost.h"
 #include "readline.h"

+static char cmdlinebuf[COMMSIZE];
+static char *cmdline = NULL;
+
 static bool short_form = true, tcpmode = false, tcpmode_set = false,
 	    identify = false, stats = true, comments = true,
 	    section_question = true, section_answer = true,
@@ -53,7 +59,6 @@ static bool interactive;
 static bool in_use = false;
 static char defclass[MXRD] = "IN";
 static char deftype[MXRD] = "A";
-static isc_event_t *global_event = NULL;
 static int query_error = 1, print_error = 0;

 static char domainopt[DNS_NAME_MAXTEXT];
@@ -112,9 +117,6 @@ static const char *rtypetext[] = {

 #define N_KNOWN_RRTYPES (sizeof(rtypetext) / sizeof(rtypetext[0]))

-static void
-getinput(isc_task_t *task, isc_event_t *event);
-
 static char *
 rcode_totext(dns_rcode_t rcode) {
 	static char buf[sizeof("?65535")];
@@ -132,20 +134,6 @@ rcode_totext(dns_rcode_t rcode) {
 	return (totext.deconsttext);
 }

-static void
-query_finished(void) {
-	isc_event_t *event = global_event;
-
-	debug("dighost_shutdown()");
-
-	if (!in_use) {
-		isc_app_shutdown();
-		return;
-	}
-
-	isc_task_send(global_task, &event);
-}
-
 static void
 printsoa(dns_rdata_t *rdata) {
 	dns_rdata_soa_t soa;
@@ -401,8 +389,6 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 static isc_result_t
 printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	     bool headers) {
-	char servtext[ISC_SOCKADDR_FORMATSIZE];
-
 	UNUSED(msgbuf);

 	/* I've we've gotten this far, we've reached a server. */
@@ -411,6 +397,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	debug("printmessage()");

 	if (!default_lookups || query->lookup->rdtype == dns_rdatatype_a) {
+		char servtext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&query->sockaddr, servtext,
 				    sizeof(servtext));
 		printf("Server:\t\t%s\n", query->userarg);
@@ -805,10 +792,8 @@ do_next_command(char *input) {
 	} else if ((strcasecmp(ptr, "server") == 0) ||
 		   (strcasecmp(ptr, "lserver") == 0))
 	{
-		isc_app_block();
 		set_nameserver(arg);
 		check_ra = false;
-		isc_app_unblock();
 		show_settings(true, true);
 	} else if (strcasecmp(ptr, "exit") == 0) {
 		in_use = false;
@@ -825,28 +810,31 @@ do_next_command(char *input) {
 }

 static void
-get_next_command(void) {
-	char cmdlinebuf[COMMSIZE];
-	char *cmdline, *ptr = NULL;
+readline_next_command(void *arg) {
+	char *ptr = NULL;

-	isc_app_block();
-	if (interactive) {
-		cmdline = ptr = readline("> ");
-		if (ptr != NULL && *ptr != 0) {
-			add_history(ptr);
-		}
-	} else {
-		cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
+	UNUSED(arg);
+
+	isc_loopmgr_blocking(loopmgr);
+	ptr = readline("> ");
+	isc_loopmgr_nonblocking(loopmgr);
+	if (ptr == NULL) {
+		return;
 	}
-	isc_app_unblock();
-	if (cmdline == NULL) {
-		in_use = false;
-	} else {
-		do_next_command(cmdline);
-	}
-	if (ptr != NULL) {
-		free(ptr);
+
+	if (*ptr != 0) {
+		add_history(ptr);
+		strlcpy(cmdlinebuf, ptr, COMMSIZE);
+		cmdline = cmdlinebuf;
 	}
+	free(ptr);
+}
+
+static void
+fgets_next_command(void *arg) {
+	UNUSED(arg);
+
+	cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
 }

 noreturn static void
@@ -899,25 +887,53 @@ parse_args(int argc, char **argv) {
 }

 static void
-getinput(isc_task_t *task, isc_event_t *event) {
-	UNUSED(task);
-	if (global_event == NULL) {
-		global_event = event;
-	}
-	while (in_use) {
-		get_next_command();
+start_next_command(void);
+
+static void
+process_next_command(void *arg __attribute__((__unused__))) {
+	if (cmdline == NULL) {
+		in_use = false;
+	} else {
+		do_next_command(cmdline);
 		if (ISC_LIST_HEAD(lookup_list) != NULL) {
-			start_lookup();
+			isc_job_run(loopmgr, run_loop, NULL);
 			return;
 		}
 	}
-	isc_app_shutdown();
+
+	start_next_command();
+}
+
+static void
+start_next_command(void) {
+	isc_loop_t *loop = isc_loop_main(loopmgr);
+	if (!in_use) {
+		isc_loopmgr_shutdown(loopmgr);
+		return;
+	}
+
+	cmdline = NULL;
+
+	isc_loopmgr_pause(loopmgr);
+	if (interactive) {
+		isc_work_enqueue(loop, readline_next_command,
+				 process_next_command, loop);
+	} else {
+		isc_work_enqueue(loop, fgets_next_command, process_next_command,
+				 loop);
+	}
+	isc_loopmgr_resume(loopmgr);
+}
+
+static void
+read_loop(void *arg) {
+	UNUSED(arg);
+
+	start_next_command();
 }

 int
 main(int argc, char **argv) {
-	isc_result_t result;
-
 	interactive = isatty(0);

 	ISC_LIST_INIT(lookup_list);
@@ -930,10 +946,7 @@ main(int argc, char **argv) {
 	dighost_printmessage = printmessage;
 	dighost_received = received;
 	dighost_trying = trying;
-	dighost_shutdown = query_finished;
-
-	result = isc_app_start();
-	check_result(result, "isc_app_start");
+	dighost_shutdown = start_next_command;

 	setup_libs();
 	progname = argv[0];
@@ -949,23 +962,18 @@ main(int argc, char **argv) {
 		set_search_domain(domainopt);
 	}
 	if (in_use) {
-		result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
+		isc_loopmgr_setup(loopmgr, run_loop, NULL);
 	} else {
-		result = isc_app_onrun(mctx, global_task, getinput, NULL);
+		isc_loopmgr_setup(loopmgr, read_loop, NULL);
 	}
-	check_result(result, "isc_app_onrun");
 	in_use = !in_use;

-	(void)isc_app_run();
+	isc_loopmgr_run(loopmgr);

 	puts("");
 	debug("done, and starting to shut down");
-	if (global_event != NULL) {
-		isc_event_free(&global_event);
-	}
 	cancel_all();
 	destroy_libs();
-	isc_app_finish();

 	return (query_error | print_error);
 }
@@ -808,12 +808,13 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 static void
 make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,
 		dns_rdataset_t *crdset) {
-	isc_result_t result;
-	dns_rdatalist_t *dslist;
 	unsigned int size = 16;
-	unsigned i, n;

 	for (;;) {
+		isc_result_t result = ISC_R_SUCCESS;
+		dns_rdatalist_t *dslist = NULL;
+		size_t n;
+
 		dslist = isc_mem_get(mctx, sizeof(*dslist));
 		dns_rdatalist_init(dslist);
 		dslist->rdclass = rdclass;
@@ -821,13 +822,12 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,
 		dslist->ttl = ttl;

 		dns_rdataset_init(&new_ds_set);
-		result = dns_rdatalist_tordataset(dslist, &new_ds_set);
-		check_result(result, "dns_rdatalist_tordataset(dslist)");
+		dns_rdatalist_tordataset(dslist, &new_ds_set);

 		isc_buffer_allocate(mctx, &new_ds_buf, size);

 		n = sizeof(dtype) / sizeof(dtype[0]);
-		for (i = 0; i < n && dtype[i] != 0; i++) {
+		for (size_t i = 0; i < n && dtype[i] != 0; i++) {
 			result = append_new_ds_set(ds_from_rdata, new_ds_buf,
 						   dslist, dtype[i], crdset);
 			if (result != ISC_R_SUCCESS) {
@@ -33,7 +33,6 @@
 #include <time.h>
 #include <unistd.h>

-#include <isc/app.h>
 #include <isc/atomic.h>
 #include <isc/attributes.h>
 #include <isc/base32.h>
@@ -43,6 +42,8 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
+#include <isc/job.h>
+#include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/md.h>
 #include <isc/mem.h>
@@ -57,6 +58,7 @@
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/task.h>
+#include <isc/tid.h>
 #include <isc/time.h>
 #include <isc/util.h>

@@ -145,6 +147,7 @@ static unsigned int nverified = 0, nverifyfailed = 0;
 static const char *directory = NULL, *dsdir = NULL;
 static isc_mutex_t namelock, statslock;
 static isc_nm_t *netmgr = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
 static dns_dbversion_t *gversion; /* The database version */
@@ -156,7 +159,7 @@ static dns_iterations_t nsec3iter = 0U;
 static unsigned char saltbuf[255];
 static unsigned char *gsalt = saltbuf;
 static size_t salt_length = 0;
-static isc_task_t *main_task = NULL;
+static isc_task_t *write_task = NULL;
 static unsigned int ntasks = 0;
 static atomic_bool shuttingdown;
 static atomic_bool finished;
@@ -1567,7 +1570,9 @@ signapex(void) {
 	result = dns_dbiterator_current(gdbiter, &node, name);
 	check_dns_dbiterator_current(result);
 	signname(node, name);
+	LOCK(&namelock);
 	dumpnode(name, node);
+	UNLOCK(&namelock);
 	cleannode(gdb, gversion, node);
 	dns_db_detachnode(gdb, &node);
 	result = dns_dbiterator_first(gdbiter);
@@ -1584,11 +1589,11 @@ signapex(void) {
 * lock.
 */
 static void
-assignwork(isc_task_t *task, isc_task_t *worker) {
-	dns_fixedname_t *fname;
-	dns_name_t *name;
-	dns_dbnode_t *node;
-	sevent_t *sevent;
+assignwork(isc_task_t *task) {
+	dns_fixedname_t *fname = NULL;
+	dns_name_t *name = NULL;
+	dns_dbnode_t *node = NULL;
+	sevent_t *sevent = NULL;
 	dns_rdataset_t nsec;
 	bool found;
 	isc_result_t result;
@@ -1604,8 +1609,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	if (atomic_load(&finished)) {
 		ended++;
 		if (ended == ntasks) {
-			isc_task_detach(&task);
-			isc_app_shutdown();
+			isc_task_detach(&write_task);
+			isc_loopmgr_shutdown(loopmgr);
 		}
 		goto unlock;
 	}
@@ -1679,8 +1684,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	if (!found) {
 		ended++;
 		if (ended == ntasks) {
-			isc_task_detach(&task);
-			isc_app_shutdown();
+			isc_task_detach(&write_task);
+			isc_loopmgr_shutdown(loopmgr);
 		}
 		isc_mem_put(mctx, fname, sizeof(dns_fixedname_t));
 		goto unlock;
@@ -1690,7 +1695,7 @@ assignwork(isc_task_t *task, isc_task_t *worker) {

 	sevent->node = node;
 	sevent->fname = fname;
-	isc_task_send(worker, ISC_EVENT_PTR(&sevent));
+	isc_task_send(task, ISC_EVENT_PTR(&sevent));
 unlock:
 	UNLOCK(&namelock);
 }
@@ -1699,12 +1704,30 @@ unlock:
 * Start a worker task
 */
 static void
-startworker(isc_task_t *task, isc_event_t *event) {
-	isc_task_t *worker;
+startworker(void *arg) {
+	isc_task_t **tasks = (isc_task_t **)arg;
+	isc_result_t result;
+	int tid;

-	worker = (isc_task_t *)event->ev_arg;
-	assignwork(task, worker);
-	isc_event_free(&event);
+	REQUIRE(tasks != NULL);
+
+	tid = isc_tid();
+	result = isc_task_create(taskmgr, &tasks[tid], tid);
+	if (result != ISC_R_SUCCESS) {
+		fatal("failed to create task: %s", isc_result_totext(result));
+	}
+
+	assignwork(tasks[tid]);
+}
+
+/*%
+ * Finish a worker task
+ */
+static void
+workerdone(void *arg) {
+	isc_task_t **tasks = (isc_task_t **)arg;
+
+	isc_task_detach(&tasks[isc_tid()]);
 }

 /*%
@@ -1712,15 +1735,15 @@ startworker(isc_task_t *task, isc_event_t *event) {
 */
 static void
 writenode(isc_task_t *task, isc_event_t *event) {
-	isc_task_t *worker;
 	sevent_t *sevent = (sevent_t *)event;

-	worker = (isc_task_t *)event->ev_sender;
+	LOCK(&namelock);
 	dumpnode(dns_fixedname_name(sevent->fname), sevent->node);
+	UNLOCK(&namelock);
 	cleannode(gdb, gversion, sevent->node);
 	dns_db_detachnode(gdb, &sevent->node);
 	isc_mem_put(mctx, sevent->fname, sizeof(dns_fixedname_t));
-	assignwork(task, worker);
+	assignwork(task);
 	isc_event_free(&event);
 }

@@ -1733,18 +1756,20 @@ sign(isc_task_t *task, isc_event_t *event) {
 	dns_dbnode_t *node;
 	sevent_t *sevent, *wevent;

+	UNUSED(task);
+
 	sevent = (sevent_t *)event;
 	node = sevent->node;
 	fname = sevent->fname;
 	isc_event_free(&event);

 	signname(node, dns_fixedname_name(fname));
-	wevent = (sevent_t *)isc_event_allocate(mctx, task, SIGNER_EVENT_WRITE,
-						writenode, NULL,
-						sizeof(sevent_t));
+	wevent = (sevent_t *)isc_event_allocate(mctx, write_task,
+						SIGNER_EVENT_WRITE, writenode,
+						NULL, sizeof(sevent_t));
 	wevent->node = node;
 	wevent->fname = fname;
-	isc_task_send(main_task, ISC_EVENT_PTR(&wevent));
+	isc_task_send(write_task, ISC_EVENT_PTR(&wevent));
 }

 /*%
@@ -2040,8 +2065,7 @@ addnsec3param(const unsigned char *salt, size_t salt_len,
 	rdatalist.rdclass = rdata.rdclass;
 	rdatalist.type = rdata.type;
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-	check_result(result, "dns_rdatalist_tordataset()");
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);

 	result = dns_db_findnode(gdb, gorigin, true, &node);
 	check_result(result, "dns_db_findnode(gorigin)");
@@ -2102,8 +2126,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node, const unsigned char *salt,
 	rdatalist.type = rdata.type;
 	rdatalist.ttl = ttl;
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
-	check_result(result, "dns_rdatalist_tordataset()");
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	result = dns_db_findnsec3node(gdb, dns_fixedname_name(&hashname), true,
 				      &nsec3node);
 	check_result(result, "addnsec3: dns_db_findnode()");
@@ -2204,8 +2227,7 @@ nsec3clean(dns_name_t *name, dns_dbnode_t *node, unsigned int hashalg,
 		dns_rdata_init(&delrdata);
 		dns_rdata_clone(&rdata, &delrdata);
 		ISC_LIST_APPEND(rdatalist.rdata, &delrdata, link);
-		result = dns_rdatalist_tordataset(&rdatalist, &delrdataset);
-		check_result(result, "dns_rdatalist_tordataset()");
+		dns_rdatalist_tordataset(&rdatalist, &delrdataset);
 		result = dns_db_subtractrdataset(gdb, node, gversion,
 						 &delrdataset, 0, NULL);
 		dns_rdataset_disassociate(&delrdataset);
@@ -3327,7 +3349,7 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish,

 int
 main(int argc, char *argv[]) {
-	int i, ch;
+	int ch;
 	char *startstr = NULL, *endstr = NULL, *classname = NULL;
 	char *dnskey_endstr = NULL;
 	char *origin = NULL, *file = NULL, *output = NULL;
@@ -3388,12 +3410,7 @@ main(int argc, char *argv[]) {

 	masterstyle = &dns_master_style_explicitttl;

-	check_result(isc_app_start(), "isc_app_start");
-
-	isc_mem_create(&mctx);
-
 	isc_commandline_errprint = false;
-
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case '3':
@@ -3671,12 +3688,6 @@ main(int argc, char *argv[]) {
 		}
 	}

-	result = dst_lib_init(mctx, engine);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize dst: %s",
-		      isc_result_totext(result));
-	}
-
 	isc_stdtime_get(&now);

 	if (startstr != NULL) {
@@ -3706,7 +3717,7 @@ main(int argc, char *argv[]) {
 	}

 	if (ntasks == 0) {
-		ntasks = isc_os_ncpus() * 2;
+		ntasks = isc_os_ncpus();
 	}
 	vbprintf(4, "using %d cpus\n", ntasks);

@@ -3716,6 +3727,16 @@ main(int argc, char *argv[]) {
 		directory = ".";
 	}

+	isc_managers_create(&mctx, ntasks, &loopmgr, &netmgr, &taskmgr);
+
+	isc_task_create(taskmgr, &write_task, 0);
+
+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
 	setup_logging(mctx, &log);

 	argc -= isc_commandline_index;
@@ -3904,7 +3925,7 @@ main(int argc, char *argv[]) {
 		hashlist_init(&hashlist,
 			      dns_db_nodecount(gdb, dns_dbtree_main) * 2,
 			      hash_length);
-		result = dns_nsec_nseconly(gdb, gversion, &answer);
+		result = dns_nsec_nseconly(gdb, gversion, NULL, &answer);
 		if (result == ISC_R_NOTFOUND) {
 			fprintf(stderr,
 				"%s: warning: NSEC3 generation "
@@ -3998,24 +4019,6 @@ main(int argc, char *argv[]) {
 	print_time(outfp);
 	print_version(outfp);

-	isc_managers_create(mctx, ntasks, 0, &netmgr, &taskmgr, NULL);
-
-	main_task = NULL;
-	result = isc_task_create(taskmgr, 0, &main_task, 0);
-	if (result != ISC_R_SUCCESS) {
-		fatal("failed to create task: %s", isc_result_totext(result));
-	}
-
-	tasks = isc_mem_get(mctx, ntasks * sizeof(isc_task_t *));
-	for (i = 0; i < (int)ntasks; i++) {
-		tasks[i] = NULL;
-		result = isc_task_create(taskmgr, 0, &tasks[i], i);
-		if (result != ISC_R_SUCCESS) {
-			fatal("failed to create task: %s",
-			      isc_result_totext(result));
-		}
-	}
-
 	isc_mutex_init(&namelock);

 	if (printstats) {
@@ -4030,27 +4033,21 @@ main(int argc, char *argv[]) {
 		 * There is more work to do.  Spread it out over multiple
 		 * processors if possible.
 		 */
-		for (i = 0; i < (int)ntasks; i++) {
-			result = isc_app_onrun(mctx, main_task, startworker,
-					       tasks[i]);
-			if (result != ISC_R_SUCCESS) {
-				fatal("failed to start task: %s",
-				      isc_result_totext(result));
-			}
-		}
-		(void)isc_app_run();
+		tasks = isc_mem_get(mctx, ntasks * sizeof(isc_task_t *));
+		memset(tasks, 0, ntasks * sizeof(isc_task_t *));
+
+		isc_loopmgr_setup(loopmgr, startworker, tasks);
+		isc_loopmgr_teardown(loopmgr, workerdone, tasks);
+
+		isc_loopmgr_run(loopmgr);
+
 		if (!atomic_load(&finished)) {
 			fatal("process aborted by user");
 		}
-	} else {
-		isc_task_detach(&main_task);
+
+		isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
 	}
 	atomic_store(&shuttingdown, true);
-	for (i = 0; i < (int)ntasks; i++) {
-		isc_task_detach(&tasks[i]);
-	}
-	isc_managers_destroy(&netmgr, &taskmgr, NULL);
-	isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
 	postsign();
 	TIME_NOW(&sign_finish);

@@ -4082,11 +4079,6 @@ main(int argc, char *argv[]) {
 		check_result(result, "dns_master_dumptostream3");
 	}

-	isc_mutex_destroy(&namelock);
-	if (printstats) {
-		isc_mutex_destroy(&statslock);
-	}
-
 	if (!output_stdout) {
 		result = isc_stdio_close(outfp);
 		check_result(result, "isc_stdio_close");
@@ -4130,15 +4122,16 @@ main(int argc, char *argv[]) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_destroy(&mctx);

-	(void)isc_app_finish();
+	isc_managers_destroy(&mctx, &loopmgr, &netmgr, &taskmgr);

 	if (printstats) {
 		TIME_NOW(&timer_finish);
 		print_stats(&timer_start, &timer_finish, &sign_start,
 			    &sign_finish);
+		isc_mutex_destroy(&statslock);
 	}
+	isc_mutex_destroy(&namelock);

 	return (vresult == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -17,7 +17,6 @@
 #include <stdlib.h>
 #include <time.h>

-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
@@ -206,7 +205,6 @@ main(int argc, char *argv[]) {
 		}
 	}
 	isc_commandline_reset = true;
-	check_result(isc_app_start(), "isc_app_start");

 	isc_mem_create(&mctx);

@@ -346,7 +344,5 @@ main(int argc, char *argv[]) {
 	}
 	isc_mem_destroy(&mctx);

-	(void)isc_app_finish();
-
 	return (result == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -15,7 +15,6 @@

 #include <stdbool.h>

-#include <isc/app.h>
 #include <isc/event.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
@@ -175,9 +174,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 			named_smf_want_disable = 1;
 		}
 		/*
-		 * If named_smf_got_instance = 0, named_smf_chroot
-		 * is not relevant and we fall through to
-		 * isc_app_shutdown below.
+		 * If named_smf_got_instance = 0, named_smf_chroot is
+		 * not relevant and we fall through to shutdown below.
 		 */
 #endif /* ifdef HAVE_LIBSCF */
 		/* Do not flush master files */
@@ -16,7 +16,6 @@
 #include <inttypes.h>
 #include <stdbool.h>

-#include <isc/app.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/event.h>
@@ -49,6 +48,7 @@
 #include <named/config.h>
 #include <named/control.h>
 #include <named/log.h>
+#include <named/main.h>
 #include <named/server.h>

 typedef struct controlkey controlkey_t;
@@ -149,9 +149,7 @@ free_listener(controllistener_t *listener) {

 	isc_refcount_destroy(&listener->refs);

-	if (listener->sock != NULL) {
-		isc_nmsocket_close(&listener->sock);
-	}
+	REQUIRE(listener->sock == NULL);

 	free_controlkeylist(&listener->keys, listener->mctx);

@@ -192,6 +190,7 @@ shutdown_listener(controllistener_t *listener) {
 	}

 	isc_nm_stoplistening(listener->sock);
+	isc_nmsocket_close(&listener->sock);
 	maybe_free_listener(listener);
 }

@@ -226,7 +225,7 @@ control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	conn->sending = false;

 	if (conn->result == ISC_R_SHUTTINGDOWN) {
-		isc_app_shutdown();
+		isc_loopmgr_shutdown(named_g_loopmgr);
 		goto cleanup_sendhandle;
 	}

@@ -25,8 +25,8 @@
 #include <string.h>
 #include <unistd.h>

-#include <isc/app.h>
 #include <isc/condition.h>
+#include <isc/loop.h>
 #include <isc/mutex.h>
 #include <isc/thread.h>
 #include <isc/util.h>
@@ -126,7 +126,7 @@ fuzz_thread_client(void *arg) {
 				close(sockfd);
 				named_server_flushonshutdown(named_g_server,
 							     false);
-				isc_app_shutdown();
+				isc_loopmgr_shutdown(named_g_loopmgr);
 				return (NULL);
 			}
 			raise(SIGSTOP);
@@ -159,7 +159,7 @@ fuzz_thread_client(void *arg) {
 	close(sockfd);

 	named_server_flushonshutdown(named_g_server, false);
-	isc_app_shutdown();
+	isc_loopmgr_shutdown(named_g_loopmgr);

 	return (NULL);
 }
@@ -374,7 +374,7 @@ fuzz_thread_resolver(void *arg) {
 				close(listenfd);
 				named_server_flushonshutdown(named_g_server,
 							     false);
-				isc_app_shutdown();
+				isc_loopmgr_shutdown(named_g_loopmgr);
 				return (NULL);
 			}
 			raise(SIGSTOP);
@@ -574,7 +574,7 @@ fuzz_thread_resolver(void *arg) {
 	close(sockfd);
 	close(listenfd);
 	named_server_flushonshutdown(named_g_server, false);
-	isc_app_shutdown();
+	isc_loopmgr_shutdown(named_g_loopmgr);

 #ifdef __AFL_LOOP
 	/*
@@ -716,7 +716,7 @@ fuzz_thread_tcp(void *arg) {
 	free(buf);
 	close(sockfd);
 	named_server_flushonshutdown(named_g_server, false);
-	isc_app_shutdown();
+	isc_loopmgr_shutdown(named_g_loopmgr);

 	return (NULL);
 }
@@ -733,7 +733,7 @@ named_fuzz_notify(void) {
 #ifdef ENABLE_AFL
 	if (getenv("AFL_CMIN")) {
 		named_server_flushonshutdown(named_g_server, false);
-		isc_app_shutdown();
+		isc_loopmgr_shutdown(named_g_loopmgr);
 		return;
 	}

@@ -18,6 +18,7 @@
 #include <stdbool.h>

 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/net.h>
 #include <isc/netmgr.h>
 #include <isc/rwlock.h>
@@ -50,6 +51,8 @@ EXTERN isc_mem_t *named_g_mctx		      INIT(NULL);
 EXTERN unsigned int named_g_cpus	      INIT(0);
 EXTERN unsigned int named_g_udpdisp	      INIT(0);
 EXTERN isc_taskmgr_t *named_g_taskmgr	      INIT(NULL);
+EXTERN isc_loop_t *named_g_mainloop	      INIT(NULL);
+EXTERN isc_loopmgr_t *named_g_loopmgr	      INIT(NULL);
 EXTERN dns_dispatchmgr_t *named_g_dispatchmgr INIT(NULL);
 EXTERN unsigned int named_g_cpus_detected     INIT(1);

@@ -61,21 +64,20 @@ EXTERN bool named_g_run_done INIT(false);
 *         for really short timers, another for client timers, and one
 *         for zone timers.
 */
-EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
-EXTERN isc_nm_t *named_g_netmgr		INIT(NULL);
-EXTERN cfg_parser_t *named_g_parser	INIT(NULL);
-EXTERN cfg_parser_t *named_g_addparser	INIT(NULL);
-EXTERN const char *named_g_version	INIT(PACKAGE_VERSION);
-EXTERN const char *named_g_product	INIT(PACKAGE_NAME);
-EXTERN const char *named_g_description	INIT(PACKAGE_DESCRIPTION);
-EXTERN const char *named_g_srcid	INIT(PACKAGE_SRCID);
-EXTERN const char *named_g_configargs	INIT(PACKAGE_CONFIGARGS);
-EXTERN const char *named_g_builder	INIT(PACKAGE_BUILDER);
-EXTERN in_port_t named_g_port		INIT(0);
-EXTERN in_port_t named_g_tlsport	INIT(0);
-EXTERN in_port_t named_g_httpsport	INIT(0);
-EXTERN in_port_t named_g_httpport	INIT(0);
-EXTERN isc_dscp_t named_g_dscp		INIT(-1);
+EXTERN isc_nm_t *named_g_netmgr	       INIT(NULL);
+EXTERN cfg_parser_t *named_g_parser    INIT(NULL);
+EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
+EXTERN const char *named_g_version     INIT(PACKAGE_VERSION);
+EXTERN const char *named_g_product     INIT(PACKAGE_NAME);
+EXTERN const char *named_g_description INIT(PACKAGE_DESCRIPTION);
+EXTERN const char *named_g_srcid       INIT(PACKAGE_SRCID);
+EXTERN const char *named_g_configargs  INIT(PACKAGE_CONFIGARGS);
+EXTERN const char *named_g_builder     INIT(PACKAGE_BUILDER);
+EXTERN in_port_t named_g_port	       INIT(0);
+EXTERN in_port_t named_g_tlsport       INIT(0);
+EXTERN in_port_t named_g_httpsport     INIT(0);
+EXTERN in_port_t named_g_httpport      INIT(0);
+EXTERN isc_dscp_t named_g_dscp	       INIT(-1);

 EXTERN in_port_t named_g_http_listener_clients INIT(0);
 EXTERN in_port_t named_g_http_streams_per_conn INIT(0);
@@ -34,3 +34,6 @@ named_main_earlywarning(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
 named_main_setmemstats(const char *);
+
+void
+named_main_shutdown(void *arg, int signum);
@@ -21,6 +21,7 @@
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/quota.h>
+#include <isc/signal.h>
 #include <isc/sockaddr.h>
 #include <isc/tls.h>
 #include <isc/types.h>
@@ -42,7 +43,8 @@
 #define NAMED_EVENT_DELZONE  (NAMED_EVENTCLASS + 1)
 #define NAMED_EVENT_COMMAND  (NAMED_EVENTCLASS + 2)
 #define NAMED_EVENT_TATSEND  (NAMED_EVENTCLASS + 3)
-#define NAMED_EVENT_SHUTDOWN (NAMED_EVENTCLASS + 4)
+#define NAMED_EVENT_RUN	     (NAMED_EVENTCLASS + 4)
+#define NAMED_EVENT_SHUTDOWN (NAMED_EVENTCLASS + 5)

 /*%
 * Name server state.  Better here than in lots of separate global variables.
@@ -116,6 +118,8 @@ struct named_server {

 	isc_tlsctx_cache_t *tlsctx_server_cache;
 	isc_tlsctx_cache_t *tlsctx_client_cache;
+
+	isc_signal_t *sighup;
 };

 #define NAMED_SERVER_MAGIC    ISC_MAGIC('S', 'V', 'E', 'R')
@@ -142,7 +146,7 @@ named_server_shutdown(named_server_t *server);
 */

 void
-named_server_reloadwanted(named_server_t *server);
+named_server_reloadwanted(void *arg, int signum);
 /*%<
 * Inform a server that a reload is wanted.  This function
 * may be called asynchronously, from outside the server's task.
@@ -44,9 +44,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 */

 bool
-named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
-		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
-		    cfg_aclconfctx_t *actx);
+named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig);
 /*%<
 * If 'zone' can be safely reconfigured according to the configuration
 * data in 'zconfig', return true.  If the configuration data is so
@@ -55,12 +53,10 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 */

 bool
-named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
-			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
-			 cfg_aclconfctx_t *actx);
+named_zone_inlinesigning(const cfg_obj_t *zconfig);
 /*%<
 * Determine if zone uses inline-signing. This is true if inline-signing
- * is set to yes, or if there is a dnssec-policy on a non-dynamic zone.
+ * is set to yes.
 */

 isc_result_t
@@ -51,6 +51,7 @@ isc_result_t
 named_log_init(bool safe) {
 	isc_result_t result;
 	isc_logconfig_t *lcfg = NULL;
+	isc_mem_t *log_mctx = NULL;

 	named_g_categories = categories;
 	named_g_modules = modules;
@@ -58,7 +59,9 @@ named_log_init(bool safe) {
 	/*
 	 * Setup a logging context.
 	 */
-	isc_log_create(named_g_mctx, &named_g_lctx, &lcfg);
+	isc_mem_create(&log_mctx);
+	isc_log_create(log_mctx, &named_g_lctx, &lcfg);
+	isc_mem_detach(&log_mctx);

 	/*
 	 * named-checktool.c:setup_logging() needs to be kept in sync.
@@ -24,7 +24,6 @@
 #include <protobuf-c/protobuf-c.h>
 #endif

-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
@@ -38,6 +37,7 @@
 #include <isc/print.h>
 #include <isc/resource.h>
 #include <isc/result.h>
+#include <isc/signal.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/task.h>
@@ -899,13 +899,14 @@ parse_command_line(int argc, char *argv[]) {

 static isc_result_t
 create_managers(void) {
-	isc_result_t result;
-
+	/*
+	 * Set the default named_g_cpus if it was not set from the command line
+	 */
 	INSIST(named_g_cpus_detected > 0);
-
 	if (named_g_cpus == 0) {
 		named_g_cpus = named_g_cpus_detected;
 	}
+
 	isc_log_write(
 		named_g_lctx, NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
@@ -922,24 +923,14 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface", named_g_udpdisp,
 		      named_g_udpdisp == 1 ? "" : "s");

-	result = isc_managers_create(named_g_mctx, named_g_cpus,
-				     0 /* quantum */, &named_g_netmgr,
-				     &named_g_taskmgr, &named_g_timermgr);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
+	isc_managers_create(&named_g_mctx, named_g_cpus, &named_g_loopmgr,
+			    &named_g_netmgr, &named_g_taskmgr);

 	isc_nm_maxudp(named_g_netmgr, maxudp);

 	return (ISC_R_SUCCESS);
 }

-static void
-destroy_managers(void) {
-	isc_managers_destroy(&named_g_netmgr, &named_g_taskmgr,
-			     &named_g_timermgr);
-}
-
 static void
 setup(void) {
 	isc_result_t result;
@@ -1011,16 +1002,6 @@ setup(void) {
 		named_os_daemonize();
 	}

-	/*
-	 * We call isc_app_start() here as some versions of FreeBSD's fork()
-	 * destroys all the signal handling it sets up.
-	 */
-	result = isc_app_start();
-	if (result != ISC_R_SUCCESS) {
-		named_main_earlyfatal("isc_app_start() failed: %s",
-				      isc_result_totext(result));
-	}
-
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "starting %s%s <id:%s>", PACKAGE_STRING,
@@ -1258,10 +1239,6 @@ setup(void) {

 static void
 cleanup(void) {
-	named_server_shutdown(named_g_server);
-
-	destroy_managers();
-
 	if (named_g_mapped != NULL) {
 		dns_acl_detach(&named_g_mapped);
 	}
@@ -1386,7 +1363,7 @@ main(int argc, char *argv[]) {
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */

 #ifdef HAVE_LIBXML2
-	xmlInitThreads();
+	xmlInitParser();
 #endif /* HAVE_LIBXML2 */

 	/*
@@ -1453,30 +1430,15 @@ main(int argc, char *argv[]) {
 		}
 	}

-	isc_mem_create(&named_g_mctx);
+	setup();
 	isc_mem_setname(named_g_mctx, "main");

-	setup();
-
 	/*
-	 * Start things running and then wait for a shutdown request
-	 * or reload.
+	 * Start things running
 	 */
-	do {
-		result = isc_app_run();
+	isc_signal_start(named_g_server->sighup);

-		if (result == ISC_R_RELOAD) {
-			named_server_reloadwanted(named_g_server);
-		} else if (result != ISC_R_SUCCESS) {
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_app_run(): %s",
-					 isc_result_totext(result));
-			/*
-			 * Force exit.
-			 */
-			result = ISC_R_SUCCESS;
-		}
-	} while (result != ISC_R_SUCCESS);
+	isc_loopmgr_run(named_g_loopmgr);

 #ifdef HAVE_LIBSCF
 	if (named_smf_want_disable == 1) {
@@ -1510,19 +1472,19 @@ main(int argc, char *argv[]) {
 			(void)isc_stdio_close(fp);
 		}
 	}
-	isc_mem_destroy(&named_g_mctx);
+
+	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr,
+			     &named_g_taskmgr);
 	isc_mem_checkdestroyed(stderr);

 	named_main_setmemstats(NULL);

-	isc_app_finish();
-
 	named_os_closedevnull();

 	named_os_shutdown();

 #ifdef HAVE_LIBXML2
-	xmlCleanupThreads();
+	xmlCleanupParser();
 #endif /* HAVE_LIBXML2 */

 #ifdef HAVE_GPERFTOOLS_PROFILER
@@ -621,17 +621,14 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	CHECK(dns_db_findnode(db, &apexname, false, &apexnode));

 	/* Add NS RRset */
-	RUNTIME_CHECK(dns_rdatalist_tordataset(&rdatalist_ns, &rdataset) ==
-		      ISC_R_SUCCESS);
+	dns_rdatalist_tordataset(&rdatalist_ns, &rdataset);
 	CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset, 0,
 				 NULL));
 	dns_rdataset_disassociate(&rdataset);

 	/* Add glue A RRset, if any */
 	if (!ISC_LIST_EMPTY(rdatalist_a.rdata)) {
-		RUNTIME_CHECK(
-			dns_rdatalist_tordataset(&rdatalist_a, &rdataset) ==
-			ISC_R_SUCCESS);
+		dns_rdatalist_tordataset(&rdatalist_a, &rdataset);
 		CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset,
 					 0, NULL));
 		dns_rdataset_disassociate(&rdataset);
@@ -639,9 +636,7 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,

 	/* Add glue AAAA RRset, if any */
 	if (!ISC_LIST_EMPTY(rdatalist_aaaa.rdata)) {
-		RUNTIME_CHECK(
-			dns_rdatalist_tordataset(&rdatalist_aaaa, &rdataset) ==
-			ISC_R_SUCCESS);
+		dns_rdatalist_tordataset(&rdatalist_aaaa, &rdataset);
 		CHECK(dns_db_addrdataset(db, apexnode, dbversion, 0, &rdataset,
 					 0, NULL));
 		dns_rdataset_disassociate(&rdataset);
@@ -2049,9 +2044,7 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 }

 bool
-named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
-		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
-		    cfg_aclconfctx_t *actx) {
+named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 	const cfg_obj_t *zoptions = NULL;
 	const cfg_obj_t *obj = NULL;
 	const char *cfilename;
@@ -2085,8 +2078,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 		has_raw = false;
 	}

-	inline_signing = named_zone_inlinesigning(zone, zconfig, vconfig,
-						  config, actx);
+	inline_signing = named_zone_inlinesigning(zconfig);
 	if (!inline_signing && has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was inline-signing");
@@ -2123,88 +2115,15 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 }

 bool
-named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
-			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
-			 cfg_aclconfctx_t *actx) {
-	isc_result_t res;
+named_zone_inlinesigning(const cfg_obj_t *zconfig) {
 	const cfg_obj_t *zoptions = NULL;
-	const cfg_obj_t *voptions = NULL;
-	const cfg_obj_t *options = NULL;
 	const cfg_obj_t *signing = NULL;
-	const cfg_obj_t *allowupdate = NULL;
-	const cfg_obj_t *updatepolicy = NULL;
-	bool zone_is_dynamic = false;
 	bool inline_signing = false;
-	bool dnssec_policy = false;
-
-	(void)cfg_map_get(config, "options", &options);

 	zoptions = cfg_tuple_get(zconfig, "options");
-	if (vconfig != NULL) {
-		voptions = cfg_tuple_get(vconfig, "options");
-	}
-
 	inline_signing = (cfg_map_get(zoptions, "inline-signing", &signing) ==
 				  ISC_R_SUCCESS &&
 			  cfg_obj_asboolean(signing));
-	if (inline_signing) {
-		return (true);
-	}
-
-	if (cfg_map_get(zoptions, "update-policy", &updatepolicy) ==
-	    ISC_R_SUCCESS) {
-		zone_is_dynamic = true;
-	} else {
-		res = cfg_map_get(zoptions, "allow-update", &allowupdate);
-		if (res != ISC_R_SUCCESS && voptions != NULL) {
-			res = cfg_map_get(voptions, "allow-update",
-					  &allowupdate);
-		}
-		if (res != ISC_R_SUCCESS && options != NULL) {
-			res = cfg_map_get(options, "allow-update",
-					  &allowupdate);
-		}
-		if (res == ISC_R_SUCCESS) {
-			dns_acl_t *acl = NULL;
-			res = cfg_acl_fromconfig(
-				allowupdate, config, named_g_lctx, actx,
-				dns_zone_getmctx(zone), 0, &acl);
-			if (res == ISC_R_SUCCESS && acl != NULL &&
-			    !dns_acl_isnone(acl)) {
-				zone_is_dynamic = true;
-			}
-			if (acl != NULL) {
-				dns_acl_detach(&acl);
-			}
-		}
-	}
-
-	/*
-	 * If inline-signing is not set, perhaps implictly through a
-	 * dnssec-policy.  Since automated DNSSEC maintenance requires
-	 * a dynamic zone, or inline-siging to be enabled, check if
-	 * the zone with dnssec-policy allows updates.  If not, enable
-	 * inline-signing.
-	 */
-	signing = NULL;
-	res = cfg_map_get(zoptions, "dnssec-policy", &signing);
-	if (res != ISC_R_SUCCESS && voptions != NULL) {
-		res = cfg_map_get(voptions, "dnssec-policy", &signing);
-	}
-	if (res != ISC_R_SUCCESS && options != NULL) {
-		res = cfg_map_get(options, "dnssec-policy", &signing);
-	}
-	if (res == ISC_R_SUCCESS) {
-		dnssec_policy = (strcmp(cfg_obj_asstring(signing), "none") !=
-				 0);
-	}
-
-	if (!inline_signing && !zone_is_dynamic && dnssec_policy) {
-		inline_signing = true;
-		dns_zone_log(zone, ISC_LOG_DEBUG(1),
-			     "inline-signing: "
-			     "implicitly through dnssec-policy");
-	}

 	return (inline_signing);
 }
@@ -21,7 +21,6 @@
 #include <stdlib.h>
 #include <unistd.h>

-#include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
@@ -29,8 +28,10 @@
 #include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/job.h>
 #include <isc/lex.h>
 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
@@ -126,8 +127,8 @@ static bool tried_other_gsstsig = false;
 static bool local_only = false;
 static isc_nm_t *netmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
 static isc_task_t *global_task = NULL;
-static isc_event_t *global_event = NULL;
 static isc_log_t *glctx = NULL;
 static isc_mem_t *gmctx = NULL;
 static dns_dispatchmgr_t *dispatchmgr = NULL;
@@ -176,6 +177,8 @@ static bool default_ttl_set = false;
 static bool checknames = true;
 static const char *resolvconf = RESOLV_CONF;

+bool done = false;
+
 typedef struct nsu_requestinfo {
 	dns_message_t *msg;
 	isc_sockaddr_t *addr;
@@ -187,6 +190,9 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 static void
 send_update(dns_name_t *zonename, isc_sockaddr_t *primary);

+static void
+getinput(void *arg);
+
 noreturn static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

@@ -681,8 +687,6 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {

 static void
 doshutdown(void) {
-	isc_task_detach(&global_task);
-
 	/*
 	 * The isc_mem_put of primary_servers must be before the
 	 * isc_mem_put of servers as it sets the servers pointer
@@ -752,7 +756,9 @@ maybeshutdown(void) {
 }

 static void
-shutdown_program(void) {
+shutdown_program(void *arg) {
+	UNUSED(arg);
+
 	ddebug("shutdown_program()");

 	shuttingdown = true;
@@ -905,13 +911,10 @@ setup_system(void) {

 	irs_resconf_destroy(&resconf);

-	result = isc_managers_create(gmctx, 1, 0, &netmgr, &taskmgr, NULL);
-	check_result(result, "isc_managers_create");
-
 	result = dns_dispatchmgr_create(gmctx, netmgr, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");

-	result = isc_task_create(taskmgr, 0, &global_task, 0);
+	result = isc_task_create(taskmgr, &global_task, 0);
 	check_result(result, "isc_task_create");

 	result = dst_lib_init(gmctx, NULL);
@@ -959,9 +962,9 @@ get_addresses(char *host, in_port_t port, isc_sockaddr_t *sockaddr,
 	int count = 0;
 	isc_result_t result;

-	isc_app_block();
+	isc_loopmgr_blocking(loopmgr);
 	result = bind9_getaddresses(host, port, sockaddr, naddrs, &count);
-	isc_app_unblock();
+	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
 		error("couldn't get address for '%s': %s", host,
 		      isc_result_totext(result));
@@ -2238,7 +2241,6 @@ get_next_command(void) {
 	char cmdlinebuf[MAXCMD];
 	char *cmdline = NULL, *ptr = NULL;

-	isc_app_block();
 	if (interactive) {
 		cmdline = ptr = readline("> ");
 		if (ptr != NULL && *ptr != 0) {
@@ -2247,7 +2249,6 @@ get_next_command(void) {
 	} else {
 		cmdline = fgets(cmdlinebuf, MAXCMD, input);
 	}
-	isc_app_unblock();

 	if (cmdline != NULL) {
 		char *tmp = cmdline;
@@ -2285,9 +2286,9 @@ user_interaction(void) {

 static void
 done_update(void) {
-	isc_event_t *event = global_event;
 	ddebug("done_update()");
-	isc_task_send(global_task, &event);
+
+	isc_job_run(loopmgr, getinput, NULL);
 }

 static void
@@ -3276,9 +3277,6 @@ cleanup(void) {
 	}
 	UNLOCK(&answer_lock);

-	ddebug("Shutting down managers");
-	isc_managers_destroy(&netmgr, &taskmgr, NULL);
-
 #if HAVE_GSSAPI
 	if (tsigkey != NULL) {
 		ddebug("detach tsigkey x%p", tsigkey);
@@ -3294,9 +3292,6 @@ cleanup(void) {
 		dst_key_free(&sig0key);
 	}

-	ddebug("Destroying event");
-	isc_event_free(&global_event);
-
 #ifdef HAVE_GSSAPI
 	/*
 	 * Cleanup GSSAPI resources after taskmgr has been destroyed.
@@ -3324,7 +3319,6 @@ cleanup(void) {
 	if (memdebugging) {
 		isc_mem_stats(gmctx, stderr);
 	}
-	isc_mem_destroy(&gmctx);

 	isc_mutex_destroy(&answer_lock);

@@ -3333,44 +3327,44 @@ cleanup(void) {
 		dst_lib_destroy();
 		is_dst_up = false;
 	}
+
+	ddebug("Shutting down managers");
+	isc_managers_destroy(&gmctx, &loopmgr, &netmgr, &taskmgr);
 }

 static void
-getinput(isc_task_t *task, isc_event_t *event) {
+getinput(void *arg) {
 	bool more;

-	UNUSED(task);
+	UNUSED(arg);

 	if (shuttingdown) {
 		maybeshutdown();
 		return;
 	}

-	if (global_event == NULL) {
-		global_event = event;
-	}
-
 	reset_system();
+	isc_loopmgr_blocking(loopmgr);
 	more = user_interaction();
+	isc_loopmgr_nonblocking(loopmgr);
 	if (!more) {
-		isc_app_shutdown();
+		isc_task_detach(&global_task);
+		isc_loopmgr_shutdown(loopmgr);
 		return;
 	}
+
+	done = false;
 	start_update();
-	return;
 }

 int
 main(int argc, char **argv) {
-	isc_result_t result;
 	style = &dns_master_style_debug;

 	input = stdin;

 	interactive = isatty(0);

-	isc_app_start();
-
 	if (isc_net_probeipv4() == ISC_R_SUCCESS) {
 		have_ipv4 = true;
 	}
@@ -3383,23 +3377,18 @@ main(int argc, char **argv) {

 	pre_parse_args(argc, argv);

-	isc_mem_create(&gmctx);
+	isc_managers_create(&gmctx, 1, &loopmgr, &netmgr, &taskmgr);

 	parse_args(argc, argv);

 	setup_system();

-	result = isc_app_onrun(gmctx, global_task, getinput, NULL);
-	check_result(result, "isc_app_onrun");
-
-	(void)isc_app_run();
-
-	shutdown_program();
+	isc_loopmgr_setup(loopmgr, getinput, NULL);
+	isc_loopmgr_teardown(loopmgr, shutdown_program, NULL);
+	isc_loopmgr_run(loopmgr);

 	cleanup();

-	isc_app_finish();
-
 	if (seenerror) {
 		return (2);
 	} else {
@@ -17,13 +17,13 @@
 #include <stdbool.h>
 #include <stdlib.h>

-#include <isc/app.h>
 #include <isc/atomic.h>
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/log.h>
+#include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/net.h>
@@ -61,6 +61,7 @@ bool verbose;

 static isc_nm_t *netmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
+static isc_loopmgr_t *loopmgr = NULL;
 static isc_task_t *rndc_task = NULL;

 static const char *admin_conffile = NULL;
@@ -307,7 +308,8 @@ rndc_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	    atomic_load_acquire(&recvs) == 0)
 	{
 		shuttingdown = true;
-		isc_app_shutdown();
+		isc_task_detach(&rndc_task);
+		isc_loopmgr_shutdown(loopmgr);
 	}
 }

@@ -388,11 +390,12 @@ rndc_recvdone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	REQUIRE(recvdone_handle == handle);
 	isc_nmhandle_detach(&recvdone_handle);

-	if (atomic_load_acquire(&sends) == 0 &&
-	    atomic_fetch_sub_release(&recvs, 1) == 1)
+	if (atomic_fetch_sub_release(&recvs, 1) == 1 &&
+	    atomic_load_acquire(&sends) == 0)
 	{
 		shuttingdown = true;
-		isc_app_shutdown();
+		isc_task_detach(&rndc_task);
+		isc_loopmgr_shutdown(loopmgr);
 	}
 }

@@ -601,10 +604,8 @@ rndc_startconnect(isc_sockaddr_t *addr) {
 }

 static void
-rndc_start(isc_task_t *task, isc_event_t *event) {
-	isc_event_free(&event);
-
-	UNUSED(task);
+rndc_start(void *arg) {
+	UNUSED(arg);

 	currentaddr = 0;
 	rndc_startconnect(&serveraddrs[currentaddr]);
@@ -914,11 +915,6 @@ main(int argc, char **argv) {
 	isc_sockaddr_any(&local4);
 	isc_sockaddr_any6(&local6);

-	result = isc_app_start();
-	if (result != ISC_R_SUCCESS) {
-		fatal("isc_app_start() failed: %s", isc_result_totext(result));
-	}
-
 	isc_commandline_errprint = false;

 	preparse_args(argc, argv);
@@ -1026,9 +1022,10 @@ main(int argc, char **argv) {

 	serial = isc_random32();

-	isc_mem_create(&rndc_mctx);
-	isc_managers_create(rndc_mctx, 1, 0, &netmgr, &taskmgr, NULL);
-	DO("create task", isc_task_create(taskmgr, 0, &rndc_task, 0));
+	isc_managers_create(&rndc_mctx, 1, &loopmgr, &netmgr, &taskmgr);
+	isc_loopmgr_setup(loopmgr, rndc_start, rndc_task);
+
+	DO("create task", isc_task_create(taskmgr, &rndc_task, 0));
 	isc_log_create(rndc_mctx, &log, &logconfig);
 	isc_log_setcontext(log);
 	isc_log_settag(logconfig, progname);
@@ -1074,15 +1071,7 @@ main(int argc, char **argv) {
 		get_addresses(servername, (in_port_t)remoteport);
 	}

-	DO("post event", isc_app_onrun(rndc_mctx, rndc_task, rndc_start, NULL));
-
-	result = isc_app_run();
-	if (result != ISC_R_SUCCESS) {
-		fatal("isc_app_run() failed: %s", isc_result_totext(result));
-	}
-
-	isc_task_detach(&rndc_task);
-	isc_managers_destroy(&netmgr, &taskmgr, NULL);
+	isc_loopmgr_run(loopmgr);

 	/*
 	 * Note: when TCP connections are shut down, there will be a final
@@ -1106,7 +1095,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(rndc_mctx, stderr);
 	}

-	isc_mem_destroy(&rndc_mctx);
+	isc_managers_destroy(&rndc_mctx, &loopmgr, &netmgr, &taskmgr);

 	if (failed) {
 		return (1);
@@ -1,5 +0,0 @@
-; This is a key-signing key, keyid 30676, for bar.
-; Created: Sat Dec 26 03:13:10 2009
-; Publish: Sat Dec 26 03:13:10 2009
-; Activate: Sat Dec 26 03:13:10 2009
-bar. IN DNSKEY 257 3 5 AwEAAc7ppysDZjlldTwsvcXcTTOYJd5TvW5RUWWYKRsee+ozwY6C7vNI 0Xp1PiY+H31GhcnNMCjQU00y8Vezo42oJ4kpRTDevL0STksExXi1/wG+ M4j1CFMh2wgJ/9XLFzHaEWzt4sflVBAVZVXa/qNkRWDXYjsr30MWyylA wHCIxEuyA+NxAL6UL+ZuFo1j84AvfwkGcMbXTcOBSCaHT6AJToSXAcCa X4fnKJIzG4RyJoN2GK4TVdj4qSzLxL1lRkYHNqJvcmMjezxUs9A5fHNI iBEBRPs7NKrQJxegAGVn9ALylKHyhJW6uyBjleOWUDom4ej2J1vGrpQT /KCA35toCvU=
@@ -1,13 +0,0 @@
-Private-key-format: v1.3
-Algorithm: 5 (RSASHA1)
-Modulus: zumnKwNmOWV1PCy9xdxNM5gl3lO9blFRZZgpGx576jPBjoLu80jRenU+Jj4ffUaFyc0wKNBTTTLxV7OjjagniSlFMN68vRJOSwTFeLX/Ab4ziPUIUyHbCAn/1csXMdoRbO3ix+VUEBVlVdr+o2RFYNdiOyvfQxbLKUDAcIjES7ID43EAvpQv5m4WjWPzgC9/CQZwxtdNw4FIJodPoAlOhJcBwJpfh+cokjMbhHImg3YYrhNV2PipLMvEvWVGRgc2om9yYyN7PFSz0Dl8c0iIEQFE+zs0qtAnF6AAZWf0AvKUofKElbq7IGOV45ZQOibh6PYnW8aulBP8oIDfm2gK9Q==
-PublicExponent: AQAB
-PrivateExponent: BcfjYsFCjuH1x4ucdbW09ncOv8ppJXbiJkt9AoP0hFOT2c5wrJ1hNOGnrdvYd2CMBlpUOR+w5BxDP+cF78Q97ogXpcjjTwj+5PuqJLg4+qx8thvacrAkdXIKEsgMytjD2d4/ksQmeBiQ7zgiGyCHC7CYzvxnzXEKlgl4FuzLRy4SH1YiSTxKfw1ANKKHxmw8Xvav9ljubrzNdBEQNs6eJNkC6c3aGqiPFyTWGa90s6t1mwTXSxFqBUR1WlbfyYfuiAK2CAvFHeNo7VuC934ri7ceEq8jeOSuY0IqDq2pA3gVWVOyR4NFLXJWeDA3pjqi109t/WGg9IGydD/hsleP4Q==
-Prime1: /hz+WxAL+9bO1l/857ME/OhxImSp86Xi7eA920sAo5ukOIQAQ6hbaKemYxyUbwBmGHEX9d0GOU+xAgZWUU9PbZgXw0fdf+uw6Hrgfce0rWY+uJpUcVHfjLPFgMC/XYrfcVQ8tsCXqRsIbqL+ynsEkQ4vybLhlSAyFqGqYFk/Qt0=
-Prime2: 0HLxXynoSxUcNW15cbuMRHD34ri8sUQsqCtezofPWcCo/17jqf42W7X9YGO70+BvmG3awSr3LaLf862ovCR5+orwE2MqamAV6JZMyR7nvMNGSHTdg3Kk7Jv7T5Gu7Cg6K+on8pMRW3aIms4gs/Z16j0Gxz74ES9IP3vsvC+q6vk=
-Exponent1: NLeXHRUrJ0fdCSRIt1iwRDeEoPn5OA7GEUtgCcp5i3eSjhb0ZxTaQc/l+NHJCW4vwApWSi9cRy99LUpbResKM1ZGN8EE9rDStqgnQnDXztFTWcDKm+e8VNhGtPtHuARDbqNnJRK3Y+Gz0iAGc8Mpo14qE9IEcoeHXKKVUf+x3BE=
-Exponent2: dKCbJB+SdM/u5IXH+TZyGKkMSLIMATKfucfqV6vs+86rv5Yb0zUEvPNqPNAQe0+LoMF2L7YWblY+71wumHXgOaobAP3u8W2pVGUjuTOtfRPU8x1QAwfV9vye87oTINaxFXkBuNtITuBXNiY2bfprpw9WB4zXxuWpiruPjQsumiE=
-Coefficient: qk8HX5fy74Sx6z3niBfTM/SUEjcsnJCTTmsXy6e7nOXWBK5ihKkmMw7LDhaY4OwjXvaVQH0Z190dfyOkWYTbXInIyNNnqCD+xZXkuzuvsUwLNgvXEFhVnzrrj3ozNiizZsyeAhFCKcITz3ci15HB3y8ZLChGYBPFU1ui7MsSkc8=
-Created: 20091226021310
-Publish: 20091226021310
-Activate: 20091226021310
@@ -1,5 +0,0 @@
-; This is a key-signing key, keyid 30804, for bar.
-; Created: Sat Dec 26 03:13:10 2009
-; Publish: Sat Dec 26 03:13:10 2009
-; Activate: Sat Dec 26 03:13:10 2009
-bar. IN DNSKEY 257 3 5 AwEAgc7ppysDZjlldTwsvcXcTTOYJd5TvW5RUWWYKRsee+ozwY6C7vNI 0Xp1PiY+H31GhcnNMCjQU00y8Vezo42oJ4kpRTDevL0STksExXi1/wG+ M4j1CFMh2wgJ/9XLFzHaEWzt4sflVBAVZVXa/qNkRWDXYjsr30MWyylA wHCIxEuyA+NxAL6UL+ZuFo1j84AvfwkGcMbXTcOBSCaHT6AJToSXAcCa X4fnKJIzG4RyJoN2GK4TVdj4qSzLxL1lRkYHNqJvcmMjezxUs9A5fHNI iBEBRPs7NKrQJxegAGVn9ALylKHyhJW6uyBjleOWUDom4ej2J1vGrpQT /KCA35toCvU=
@@ -1,13 +0,0 @@
-Private-key-format: v1.3
-Algorithm: 5 (RSASHA1)
-Modulus: zumnKwNmOWV1PCy9xdxNM5gl3lO9blFRZZgpGx576jPBjoLu80jRenU+Jj4ffUaFyc0wKNBTTTLxV7OjjagniSlFMN68vRJOSwTFeLX/Ab4ziPUIUyHbCAn/1csXMdoRbO3ix+VUEBVlVdr+o2RFYNdiOyvfQxbLKUDAcIjES7ID43EAvpQv5m4WjWPzgC9/CQZwxtdNw4FIJodPoAlOhJcBwJpfh+cokjMbhHImg3YYrhNV2PipLMvEvWVGRgc2om9yYyN7PFSz0Dl8c0iIEQFE+zs0qtAnF6AAZWf0AvKUofKElbq7IGOV45ZQOibh6PYnW8aulBP8oIDfm2gK9Q==
-PublicExponent: AQCB
-PrivateExponent: I5TcRq2sbSi1u5a+jL6VVBBu3nyY7p3NXeD1WYYYD66b8RWbgJdTtsZxgixD5sKKrW/xT68d3FUsIjs36w7yp5+g99q7lJ3v35VcMuLXbaKitS/LJdTZF/GIWwRs+DHdt+chh0QeNLzclq8ZfBeTAycFxwC7zVDLsqqcL6/JHiJhHT+dNEqj6/AIOgSYJzVeBI34LtZLW94IKf4dHLzREnLK6+64PFjpwjOG12O9klKfwHRIRN9WUsDG4AuzDSABH+qo2Zc6uJusC/D6HADbiG7tXmLYL6IxanWTbTrx4Hfp01fF+JQCuyOCRmN47X/nCumvDXKMn9Ve5+OlYi0vAQ==
-Prime1: /hz+WxAL+9bO1l/857ME/OhxImSp86Xi7eA920sAo5ukOIQAQ6hbaKemYxyUbwBmGHEX9d0GOU+xAgZWUU9PbZgXw0fdf+uw6Hrgfce0rWY+uJpUcVHfjLPFgMC/XYrfcVQ8tsCXqRsIbqL+ynsEkQ4vybLhlSAyFqGqYFk/Qt0=
-Prime2: 0HLxXynoSxUcNW15cbuMRHD34ri8sUQsqCtezofPWcCo/17jqf42W7X9YGO70+BvmG3awSr3LaLf862ovCR5+orwE2MqamAV6JZMyR7nvMNGSHTdg3Kk7Jv7T5Gu7Cg6K+on8pMRW3aIms4gs/Z16j0Gxz74ES9IP3vsvC+q6vk=
-Exponent1: JDLRyjRz53hTP7H2oaKgQYADs/UDswN2lwWpuag0wsPwQmeRAZZY2TiISPSu+3Mvh4XJ6r5UHQd5FbAN1v2mG4aYgWwoYwoxyvdTLcnQXciX2z+7877GcEyKHPno4fYXRqhVH4i1QjKaQl8dw9LFvzbVvGvvwsHGwQeqPprw7hk=
-Exponent2: vbnob7AZKqKhiVdEcnnhbeZBGcaKkTpE+RAkUL7spNQDiTPvJgo5fcTk/h6G7ijAXK0j62ZHZ3RS7RnaRa+KhO7usPcYMFiJ/VdAyRlIivhyi+WNQ2x4vSygwDy2VV9elljFeNe4dV1Cb+ssE8kAmbP52JjJD6MkhvVLd0u/jMk=
-Coefficient: qk8HX5fy74Sx6z3niBfTM/SUEjcsnJCTTmsXy6e7nOXWBK5ihKkmMw7LDhaY4OwjXvaVQH0Z190dfyOkWYTbXInIyNNnqCD+xZXkuzuvsUwLNgvXEFhVnzrrj3ozNiizZsyeAhFCKcITz3ci15HB3y8ZLChGYBPFU1ui7MsSkc8=
-Created: 20091226021310
-Publish: 20091226021310
-Activate: 20091226021310
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 59973, for bar.
+; Created: 20220623022335 (Thu Jun 23 12:23:35 2022)
+; Publish: 20220623022335 (Thu Jun 23 12:23:35 2022)
+; Activate: 20220623022335 (Thu Jun 23 12:23:35 2022)
+bar. IN DNSKEY 257 3 13 QT6CpMaV4BT072+NaKLY5H01Mj2r1MOgsxgoiTAq1Fbf6rrkEWpnbktu Dh9Ol9kuzcUrefxDuxNwsXJu3iDPxw==
@@ -0,0 +1,6 @@
+Private-key-format: v1.3
+Algorithm: 13 (ECDSAP256SHA256)
+PrivateKey: joFZ8vCdyqkgMb6rZ0zanrdrzOSCg1GyEJV6tp5F+Bw=
+Created: 20220623022335
+Publish: 20220623022335
+Activate: 20220623022335
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 60101, for bar.
+; Created: 20220623022331 (Thu Jun 23 12:23:31 2022)
+; Publish: 20220623022331 (Thu Jun 23 12:23:31 2022)
+; Activate: 20220623022331 (Thu Jun 23 12:23:31 2022)
+bar. IN DNSKEY 257 3 13 dLGGOAE5uJd53Gci9MdymaRTMwsXVn13j05IfGJoVt9ucpeXpoIKVViX JNVE/uO4eJvkHycdEAvdVUWcslEmMQ==
@@ -0,0 +1,6 @@
+Private-key-format: v1.3
+Algorithm: 13 (ECDSAP256SHA256)
+PrivateKey: pTTXxZUTzeVBXHMUJxTMxjh9yU4oxDtEhEvpkj+olf0=
+Created: 20220623022331
+Publish: 20220623022331
+Activate: 20220623022331
@@ -48,10 +48,10 @@ zone=bar
 zonefile="${zone}.db"
 infile="${zonefile}.in"
 cat $infile > $zonefile
-for i in Xbar.+005+30676.key Xbar.+005+30804.key Xbar.+005+30676.private \
-	 Xbar.+005+30804.private
+for i in Xbar.+013+59973.key Xbar.+013+59973.private \
+	 Xbar.+013+60101.key Xbar.+013+60101.private
 do
-	cp $i $(echo $i | sed s/X/K/)
+    cp $i $(echo $i | sed s/X/K/)
 done
-$KEYGEN -a RSASHA1 -q $zone > /dev/null
-$DSFROMKEY Kbar.+005+30804.key > dsset-bar.
+$KEYGEN -a ECDSAP256SHA256 -q $zone > /dev/null
+$DSFROMKEY Kbar.+013+60101.key > dsset-bar.
@@ -139,7 +139,7 @@ $DSFROMKEY $ksk.key > dsset-${zone}.
 setup rsasha256.example
 cp $infile $zonefile
 ksk=$($KEYGEN -q -a RSASHA256 -b 2048 -fk $zone 2> kg.out) || dumpit kg.out
-$KEYGEN -q -a RSASHA256 -b 1024 $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -q -a RSASHA256 -b 2048 $zone > kg.out 2>&1 || dumpit kg.out
 $DSFROMKEY $ksk.key > dsset-${zone}.

 #
@@ -148,17 +148,24 @@ $DSFROMKEY $ksk.key > dsset-${zone}.
 setup rsasha512.example
 cp $infile $zonefile
 ksk=$($KEYGEN -q -a RSASHA512 -b 2048 -fk $zone 2> kg.out) || dumpit kg.out
-$KEYGEN -q -a RSASHA512 -b 1024 $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -q -a RSASHA512 -b 2048 $zone > kg.out 2>&1 || dumpit kg.out
 $DSFROMKEY $ksk.key > dsset-${zone}.

 #
 # NSEC-only zone. A zone using NSEC-only DNSSEC algorithms.
+# None of these algorithms are supported for signing in FIPS mode
+# as they are MD5 and SHA1 based.
 #
-setup nsec-only.example
-cp $infile $zonefile
-ksk=$($KEYGEN -q -a RSASHA1 -fk $zone 2> kg.out) || dumpit kg.out
-$KEYGEN -q -a RSASHA1 $zone > kg.out 2>&1 || dumpit kg.out
-$DSFROMKEY $ksk.key > dsset-${zone}.
+if (cd ..; $SHELL ../testcrypto.sh -q RSASHA1)
+then
+    setup nsec-only.example
+    cp $infile $zonefile
+    ksk=$($KEYGEN -q -a RSASHA1 -fk $zone 2> kg.out) || dumpit kg.out
+    $KEYGEN -q -a RSASHA1 $zone > kg.out 2>&1 || dumpit kg.out
+    $DSFROMKEY $ksk.key > dsset-${zone}.
+else
+    echo_i "skip: nsec-only.example - signing with RSASHA1 not supported"
+fi

 #
 # Signature refresh test zone.  Signatures are set to expire long
@@ -170,7 +177,7 @@ count=1
 while [ $count -le 1000 ]
 do
    echo "label${count} IN TXT label${count}" >> $zonefile
-    count=$(expr $count + 1)
+    count=$((count + 1))
 done
 $KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -q -a $DEFAULT_ALGORITHM $zone > kg.out 2>&1 || dumpit kg.out
@@ -181,8 +188,8 @@ mv $zonefile.signed $zonefile
 # NSEC3->NSEC transition test zone.
 #
 setup nsec3-to-nsec.example
-$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk $zone > kg.out 2>&1 || dumpit kg.out
-$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM -fk $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -q -a $DEFAULT_ALGORITHM $zone > kg.out 2>&1 || dumpit kg.out
 $SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > s.out || dumpit s.out

 #
@@ -312,14 +312,18 @@ update add optout.example. 3600 NSEC3PARAM 1 1 10 BEEF
 send
 END

-# try to convert nsec-only.example; this should fail due to non-NSEC key
-echo_i "preset nsec3param in unsigned zone via nsupdate ($n)"
-$NSUPDATE > nsupdate.out 2>&1 <<END
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+    # try to convert nsec-only.example; this should fail due to
+    # non-NSEC3 compatible keys
+    echo_i "preset nsec3param in unsigned zone via nsupdate ($n)"
+    $NSUPDATE > nsupdate.out 2>&1 <<END
 server 10.53.0.3 ${PORT}
 zone nsec-only.example.
 update add nsec-only.example. 3600 NSEC3PARAM 1 0 10 BEEF
 send
 END
+fi

 echo_i "checking for nsec3param in unsigned zone ($n)"
 ret=0
@@ -490,7 +494,12 @@ status=$((status + ret))

 echo_i "checking NSEC->NSEC3 conversion failed with NSEC-only key ($n)"
 ret=0
-grep "failed: REFUSED" nsupdate.out > /dev/null || ret=1
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+    grep "failed: REFUSED" nsupdate.out > /dev/null || ret=1
+else
+    echo_i "skip: RSASHA1 not supported"
+fi
 n=$((n + 1))
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
@@ -1144,7 +1153,7 @@ oldserial=$($DIG $DIGOPTS +short soa . @10.53.0.1 | awk '{print $3}')
 sleep 4

 echo_i "revoking key to duplicated key ID"
-$SETTIME -R now -K ns2 Kbar.+005+30676.key > settime.out.test$n.3 || ret=1
+$SETTIME -R now -K ns2 Kbar.+013+59973.key > settime.out.test$n.3 || ret=1

 ($RNDCCMD 10.53.0.2 loadkeys bar. 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1

@@ -1178,7 +1187,10 @@ checkprivate nsec3.example 10.53.0.3 || ret=1
 checkprivate nsec3.nsec3.example 10.53.0.3 || ret=1
 checkprivate nsec3.optout.example 10.53.0.3 || ret=1
 checkprivate nsec3-to-nsec.example 10.53.0.3 2 || ret=1 # automatically removed
-checkprivate nsec-only.example 10.53.0.3 || ret=1
+if $SHELL ../testcrypto.sh -q RSASHA1
+then
+    checkprivate nsec-only.example 10.53.0.3 || ret=1
+fi
 checkprivate oldsigs.example 10.53.0.3 2 || ret=1 # pre-signed
 checkprivate optout.example 10.53.0.3 || ret=1
 checkprivate optout.nsec3.example 10.53.0.3 || ret=1
@@ -1311,8 +1323,8 @@ status=$((status + ret))

 echo_i "checking revoked key with duplicate key ID ($n)"
 ret=0
-id=30676
-rid=30804
+id=59973
+rid=60101
 $DIG $DIGOPTS +multi dnskey bar @10.53.0.2 > dig.out.ns2.test$n || ret=1
 grep '; key id = '"$id"'$' dig.out.ns2.test$n > /dev/null && ret=1
 keys=$(grep '; key id = '"$rid"'$' dig.out.ns2.test$n | wc -l)
@@ -28,6 +28,7 @@ options {
 	listen-on port @EXTRAPORT1@ { 10.53.0.1; };
 	listen-on-v6 { none; };
 	notify no;
+	notify-delay 0;
 	recursion no;
 	allow-transfer { any; };
 };
@@ -26,6 +26,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
 	notify no;
+	notify-delay 0;
 	recursion no;
 	serial-query-rate 100;
 };
@@ -41,29 +42,38 @@ view "default" {
 	catalog-zones {
 		zone "catalog1.example"
 			default-masters { 10.53.0.1; }
+			min-update-interval 1s
 			in-memory no
 			zone-directory "zonedir";
 		zone "catalog2.example"
 			default-primaries { 10.53.0.1 port @EXTRAPORT1@; }
+			min-update-interval 1s
 			in-memory yes;
 		zone "catalog3.example"
 			default-masters { 10.53.0.1; }
+			min-update-interval 1s
 			zone-directory "nonexistent";
 #T1		zone "catalog4.example"
+#T1			min-update-interval 1s
 #T1			default-masters { 10.53.0.1; };
 #T2		zone "catalog5.example"
+#T2			min-update-interval 1s
 #T2			default-primaries { 10.53.0.1; };
 		zone "catalog-bad1.example"
 			default-masters { 10.53.0.1; }
+			min-update-interval 1s
 			in-memory yes;
 		zone "catalog-bad2.example"
 			default-masters { 10.53.0.1; }
+			min-update-interval 1s
 			in-memory yes;
 		zone "catalog-bad3.example"
 			default-masters { 10.53.0.1; }
+			min-update-interval 1s
 			in-memory yes;
 		zone "catalog-bad4.example"
 			default-masters { 10.53.0.1; }
+			min-update-interval 1s
 			in-memory yes;
 	};

@@ -26,6 +26,7 @@ options {
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { fd92:7065:b8e:ffff::2; };
 	notify no;
+	notify-delay 0;
 	recursion no;
 	serial-query-rate 100;
 };
@@ -28,6 +28,7 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { fd92:7065:b8e:ffff::3; };
 	notify no;
+	notify-delay 0;
 	recursion no;
 };

@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "badnsec3alg" {
+	keys {
+		csk lifetime unlimited algorithm rsasha1;
+	};
+	nsec3param iterations 0 optout 0 salt-length 0;
+};
+
+zone "example.net" {
+	type primary;
+	file "example.db";
+	dnssec-policy "badnsec3alg";
+};
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com." {
+	type primary;
+	file "example.com.zone";
+};
+
+options {
+	response-policy {
+		zone "example.com." ede unsupported;
+	};
+};
@@ -40,15 +40,20 @@ options {
 zone "example1" {
 	type primary;
 	file "example1.db";
+	inline-signing yes;
 };
 zone "example2" {
 	type primary;
 	file "example2.db";
+	allow-update {
+		"any";
+	};
 	dnssec-policy "test";
 };
 zone "example3" {
 	type primary;
 	file "example3.db";
+	inline-signing yes;
 	dnssec-policy "default";
 };
 zone "dnssec-policy-none-shared-zonefile1" {
@@ -46,6 +46,7 @@ view "localhost" {
        type primary;
        file "localhost/example.com.zone";
        dnssec-policy "localhost";
+        inline-signing yes;
    };
 };

@@ -56,6 +57,7 @@ view "external" {
        type primary;
        file "external/example.com.zone";
        dnssec-policy "internet";
+        inline-signing yes;
    };
 };

@@ -66,5 +68,6 @@ view "internal" {
        type primary;
        file "internal/example.com.zone";
        dnssec-policy "intranet";
+        inline-signing yes;
    };
 };
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com." {
+	type primary;
+	file "example.com.zone";
+};
+
+options {
+	response-policy {
+		zone "example.com." ede none;
+	};
+};
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com." {
+	type primary;
+	file "example.com.zone";
+};
+
+options {
+	response-policy {
+		zone "example.com." ede filtered;
+	};
+};
@@ -103,6 +103,7 @@ view "first" {
 	zone "clone" {
 		type primary;
 		file "yyy";
+		inline-signing yes;
 		max-ixfr-ratio unlimited;
 	};
 	dnssec-validation auto;
@@ -166,9 +167,12 @@ view "third" {
 	zone "p" {
 		type primary;
 		file "pfile";
+		inline-signing yes;
 	};
 	zone "s" {
 		type secondary;
+		file "sfile";
+		inline-signing yes;
 		primaries {
 			1.2.3.4;
 		};
@@ -179,6 +183,7 @@ view "fourth" {
 	zone "dnssec-test" {
 		type primary;
 		file "dnssec-test.db";
+		inline-signing yes;
 		parental-agents {
 			1.2.3.4;
 			1.2.3.5;
@@ -189,6 +194,7 @@ view "fourth" {
 	zone "dnssec-default" {
 		type primary;
 		file "dnssec-default.db";
+		inline-signing yes;
 		parental-agents {
 			"parents";
 		};
@@ -197,6 +203,7 @@ view "fourth" {
 	zone "dnssec-inherit" {
 		type primary;
 		file "dnssec-inherit.db";
+		inline-signing yes;
 	};
 	zone "dnssec-none" {
 		type primary;
@@ -206,11 +213,13 @@ view "fourth" {
 	zone "dnssec-view1" {
 		type primary;
 		file "dnssec-view41.db";
+		inline-signing yes;
 		dnssec-policy "test";
 	};
 	zone "dnssec-view2" {
 		type primary;
 		file "dnssec-view42.db";
+		inline-signing yes;
 	};
 	zone "dnssec-view3" {
 		type primary;
@@ -230,17 +239,20 @@ view "fifth" {
 	zone "dnssec-view1" {
 		type primary;
 		file "dnssec-view51.db";
+		inline-signing yes;
 		dnssec-policy "test";
 	};
 	zone "dnssec-view2" {
 		type primary;
 		file "dnssec-view52.db";
+		inline-signing yes;
 		dnssec-policy "test";
 		key-directory "keys";
 	};
 	zone "dnssec-view3" {
 		type primary;
 		file "dnssec-view53.db";
+		inline-signing yes;
 		dnssec-policy "default";
 		key-directory "keys";
 	};
@@ -255,6 +267,7 @@ view "chaos" chaos {
 	zone "hostname.bind" chaos {
 		type primary;
 		database "_builtin hostname";
+		inline-signing yes;
 	};
 };
 dyndb "name" "library.so" {
@@ -26,4 +26,3 @@ zone "nsec3.net" {
 	sig-validity-interval 3600;
 	update-check-ksk yes;
 };
-
@@ -57,4 +57,5 @@ zone "example.net" {
 	type primary;
 	file "example.db";
 	dnssec-policy "default";
+	inline-signing yes;
 };
@@ -34,11 +34,13 @@ dnssec-policy "bad-sigrefresh-dnskey" {
 zone "sigrefresh.example.net" {
 	type primary;
 	file "sigrefresh.example.db";
+	inline-signing yes;
 	dnssec-policy "bad-sigrefresh";
 };

 zone "dnskey.example.net" {
 	type primary;
 	file "dnskey.example.db";
+	inline-signing yes;
 	dnssec-policy "bad-sigrefresh-dnskey";
 };
@@ -22,5 +22,6 @@ zone "example.net" {
 	type primary;
 	file "example.db";
 	dnssec-policy "warn-length";
+	inline-signing yes;
 };

@@ -42,18 +42,21 @@ dnssec-policy "warn3" {
 zone "warn1.example.net" {
 	type primary;
 	file "warn1.example.db";
+	inline-signing yes;
 	dnssec-policy "warn1";
 };

 zone "warn2.example.net" {
 	type primary;
 	file "warn2.example.db";
+	inline-signing yes;
 	dnssec-policy "warn2";
 };

 zone "warn3.example.net" {
 	type primary;
 	file "warn3.example.db";
+	inline-signing yes;
 	dnssec-policy "warn3";
 };

@@ -492,7 +492,7 @@ n=`expr $n + 1`
 echo_i "checking named-checkconf kasp errors ($n)"
 ret=0
 $CHECKCONF kasp-and-other-dnssec-options.conf > checkconf.out$n 2>&1 && ret=1
-grep "'inline-signing;' cannot be set to 'no' if dnssec-policy is also set on a non-dynamic DNS zone" < checkconf.out$n > /dev/null || ret=1
+grep "'dnssec-policy;' requires dynamic DNS or inline-signing to be configured for the zone" < checkconf.out$n > /dev/null || ret=1
 grep "'auto-dnssec maintain;' cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
 grep "dnskey-sig-validity: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
 grep "dnssec-dnskey-kskonly: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
@@ -49,6 +49,7 @@ zone "." {
 zone "dspublished.checkds" {
 	type primary;
 	file "dspublished.checkds.db";
+	inline-signing yes;
 	dnssec-policy "default";
 	parental-agents { 10.53.0.2 port @PORT@; };
 };
@@ -60,6 +61,7 @@ zone "dspublished.checkds" {
 zone "reference.checkds" {
 	type primary;
 	file "reference.checkds.db";
+	inline-signing yes;
 	dnssec-policy "default";
 	parental-agents { "ns2"; };
 };
@@ -71,6 +73,7 @@ zone "reference.checkds" {
 zone "missing-dspublished.checkds" {
 	type primary;
 	file "missing-dspublished.checkds.db";
+	inline-signing yes;
 	dnssec-policy "default";
 	parental-agents {
 		10.53.0.5 port @PORT@; // missing
@@ -85,6 +88,7 @@ zone "missing-dspublished.checkds" {
 zone "bad-dspublished.checkds" {
 	type primary;
 	file "bad-dspublished.checkds.db";
+	inline-signing yes;
 	dnssec-policy "default";
 	parental-agents {
 		10.53.0.6 port @PORT@; // bad
@@ -98,6 +102,7 @@ zone "bad-dspublished.checkds" {
 zone "multiple-dspublished.checkds" {
 	type primary;
 	file "multiple-dspublished.checkds.db";
+	inline-signing yes;
 	dnssec-policy "default";
 	parental-agents {
 		10.53.0.2 port @PORT@;
@@ -113,6 +118,7 @@ zone "multiple-dspublished.checkds" {
 zone "incomplete-dspublished.checkds" {
 	type primary;
 	file "incomplete-dspublished.checkds.db";
+	inline-signing yes;
 	dnssec-policy "default";
 	parental-agents {
 		10.53.0.2 port @PORT@;
@@ -130,6 +136,7 @@ zone "incomplete-dspublished.checkds" {
 zone "bad2-dspublished.checkds" {
 	type primary;
 	file "bad2-dspublished.checkds.db";
+	inline-signing yes;
 	dnssec-policy "default";
 	parental-agents {
 		10.53.0.2 port @PORT@;
@@ -150,6 +157,7 @@ zone "bad2-dspublished.checkds" {
 zone "dswithdrawn.checkds" {
 	type primary;
 	file "dswithdrawn.checkds.db";
+	inline-signing yes;
 	dnssec-policy "insecure";
 	parental-agents { 10.53.0.5 port @PORT@; };
 };
@@ -157,6 +165,7 @@ zone "dswithdrawn.checkds" {
 zone "missing-dswithdrawn.checkds" {
 	type primary;
 	file "missing-dswithdrawn.checkds.db";
+	inline-signing yes;
 	dnssec-policy "insecure";
 	parental-agents {
 		10.53.0.2 port @PORT@; // still published
@@ -166,6 +175,7 @@ zone "missing-dswithdrawn.checkds" {
 zone "bad-dswithdrawn.checkds" {
 	type primary;
 	file "bad-dswithdrawn.checkds.db";
+	inline-signing yes;
 	dnssec-policy "insecure";
 	parental-agents {
 		10.53.0.6 port @PORT@; // bad
@@ -175,6 +185,7 @@ zone "bad-dswithdrawn.checkds" {
 zone "multiple-dswithdrawn.checkds" {
 	type primary;
 	file "multiple-dswithdrawn.checkds.db";
+	inline-signing yes;
 	dnssec-policy "insecure";
 	parental-agents {
 		10.53.0.5 port @PORT@;
@@ -185,6 +196,7 @@ zone "multiple-dswithdrawn.checkds" {
 zone "incomplete-dswithdrawn.checkds" {
 	type primary;
 	file "incomplete-dswithdrawn.checkds.db";
+	inline-signing yes;
 	dnssec-policy "insecure";
 	parental-agents {
 		10.53.0.2 port @PORT@; // still published
@@ -196,6 +208,7 @@ zone "incomplete-dswithdrawn.checkds" {
 zone "bad2-dswithdrawn.checkds" {
 	type primary;
 	file "bad2-dswithdrawn.checkds.db";
+	inline-signing yes;
 	dnssec-policy "insecure";
 	parental-agents {
 		10.53.0.5 port @PORT@;
@@ -1 +0,0 @@
-example.com. IN DNSKEY 256 3 5 AwEAAaF0z17DdkBAKiYScVNqzsqXw7Vz/Cx5OCw7T/6RnU/KiGv815kl H2obywRZX2ZcEg9R8SUzQiP9ygY0s1xF5IFYi32HsWftNV7V/gNwNrMn GC0gV2e3OawsQ2CYWZZVwObr/fmcKIXuY6eRdJtyOilMRhlvroJdXZw1 CQdicxpZ
@@ -1,10 +0,0 @@
-Private-key-format: v1.2
-Algorithm: 5 (RSASHA1)
-Modulus: oXTPXsN2QEAqJhJxU2rOypfDtXP8LHk4LDtP/pGdT8qIa/zXmSUfahvLBFlfZlwSD1HxJTNCI/3KBjSzXEXkgViLfYexZ+01XtX+A3A2sycYLSBXZ7c5rCxDYJhZllXA5uv9+Zwohe5jp5F0m3I6KUxGGW+ugl1dnDUJB2JzGlk=
-PublicExponent: AQAB
-PrivateExponent: QrbJmRabHiFlSSYFvbo8iGn9bFTotlfAZkZ732y72+SMSlLHo3g7atThJoLncJxKuhnZ0s1DXyvW9omAM3iN2lxfVDW58at1amj/lWRDYkjI0fM8z6eyrF4U2lHKDM2YEstg+sGAAs5DUZBbli4Y7+zHjhxSKLYvRf4AJvX8aoE=
-Prime1: 0259CgdF0JW+miedRZXC6tn3FijZJ4/j5edzd8IpTpdUSZupQg9hMP1ot7crreNq7MnzO0Z2ImbowUx8CDOuXQ==
-Prime2: w31/WLM2275Z1tsHEOhrntUQCUk55B4PNOCmM4hjp0vAvA/SVSgAYRNb7rc/ujaLf0DnxnDsnVsFAS2PmvQELQ==
-Exponent1: yKPhJNMh/X8dEUzmglJMVnHheLXq3RA/RL0PZmZqrJoO8os1Y+sUYFkaNr0sRie6IFrE50tGb/8YgdcDHQVuQQ==
-Exponent2: lVhDuGy5RSjnk1eiz0zwIthctutlOZupPFk/P3E7yGv74vAnXH0BxSe3/Oer3MOc0GuyZYyRhyko6px28AbpRQ==
-Coefficient: Hjup1nDnPFkQrxU2qLQBJrDz+ipw0RkNhsjWs6IgAq1Mq4sFV50bR9hOTLDd9oNhhtAwVjF+Oc0WIq+M1Mi6Ow==
@@ -1 +0,0 @@
-example.com. IN DNSKEY 257 3 5 AwEAAbuWh5W3eGwixISqPwxszotQ0246KqhUB2Mb6JqNMJd6cWR66IrX YnevpIHsb6oanqJmVzOcJ6Yj3rXOIYtYYXgLbT7EJ8x7BNCZPHxG+w5C 7I1WsDbT6eGf//FLn2c4odKLOXaWCVITeNy61w43IlteIT9Q1egKdt+8 a7X9605j
@@ -1,10 +0,0 @@
-Private-key-format: v1.2
-Algorithm: 5 (RSASHA1)
-Modulus: u5aHlbd4bCLEhKo/DGzOi1DTbjoqqFQHYxvomo0wl3pxZHroitdid6+kgexvqhqeomZXM5wnpiPetc4hi1hheAttPsQnzHsE0Jk8fEb7DkLsjVawNtPp4Z//8UufZzih0os5dpYJUhN43LrXDjciW14hP1DV6Ap237xrtf3rTmM=
-PublicExponent: AQAB
-PrivateExponent: XZSssv3CL3/wtZYQuewV5d4+e8C8wxiYTtL/aQqCcS7+HnhKRelJEBgpYz9GPX/mH3Iakn6WMQW39s6MYW2HwXUnqhsvHoyabGX0Dbc/1LcY4J2VPgzVHwSXYm+j4unOByOOS4KoBtUAQxJsTBokVZrZ5pKsLUK9X2gdywYw+PE=
-Prime1: 9fB7PaygjKoT1nbbeEMy1KYNqetg3zmN49Mk6ilEWxzJXKSSjTIhdkiLGXtYmE8rDBLBiYm8YWNe7YdA9PbQ7Q==
-Prime2: w0L7mTOLDecH3XAkC/wvALv8K9KSoZ31ajidKBxV15u8awj5AxDG7gjerYgCLjU1fq1GulMr11j8r4ftQn3Cjw==
-Exponent1: Up52yEE1rgt0npdPIxdv+//Ml0h7QoITKHXF8OPsEq+Y9YZTtRsiIpo8IFNPb9somuWyHoImxpCbUzAcoi5IAQ==
-Exponent2: uYTbvYx+UsAt9dOFPCnnkqAJEK3qCUomET0m/CQn30mldGC7DpGTIDgnMeLmh3agk/IYIBHDtsBinHfeEe2guw==
-Coefficient: FiHAet8On9Yaz1ksEAlCWulwck3zPWIsgqJBM2J4kHhgHTm17mZyxtVxIzLAMBNMIBcFl40FCpmPmTLY5QK5mw==
@@ -0,0 +1,5 @@
+; This is a zone-signing key, keyid 18240, for example.com.
+; Created: 20211221062121 (Tue Dec 21 17:21:21 2021)
+; Publish: 20211221062121 (Tue Dec 21 17:21:21 2021)
+; Activate: 20211221062121 (Tue Dec 21 17:21:21 2021)
+example.com. IN DNSKEY 256 3 10 AwEAAe5GunnuJFyzmKiGUknSQY3aPtR5UR8vNLLyMCJswffRzoYwY14/ 60ZTsqzh7N+lJV3KAOraocFSsTnmWIM7D7DPpqtaJMQw90ypBG0cnUP1 wKX9L/gdOH/ITlluBiZpCv9Aux3FRECHBO4Gx8Rse8ST2Vag3UuOPW+q HkLsWQt22K/hYuDhEtUWWx2dTIaXUVXNSNbk2zPL+lhC9PaRV+//1Fjo UX4qXCUuUN4TiqlkK2v4UkcIyld1n2R7qTQAkoN9amGFtPu8z5Zw7CxC San03yUSNuKub3fGys11gQRFuEHRX7FxKxvJjmcngG9qCh8AyfHZ8zYb VstTy1unFoM=
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 10 (RSASHA512)
+Modulus: 7ka6ee4kXLOYqIZSSdJBjdo+1HlRHy80svIwImzB99HOhjBjXj/rRlOyrOHs36UlXcoA6tqhwVKxOeZYgzsPsM+mq1okxDD3TKkEbRydQ/XApf0v+B04f8hOWW4GJmkK/0C7HcVEQIcE7gbHxGx7xJPZVqDdS449b6oeQuxZC3bYr+Fi4OES1RZbHZ1MhpdRVc1I1uTbM8v6WEL09pFX7//UWOhRfipcJS5Q3hOKqWQra/hSRwjKV3WfZHupNACSg31qYYW0+7zPlnDsLEJJqfTfJRI24q5vd8bKzXWBBEW4QdFfsXErG8mOZyeAb2oKHwDJ8dnzNhtWy1PLW6cWgw==
+PublicExponent: AQAB
+PrivateExponent: U/ipDv9V4TWJvxpXNZzbbVpUehym8g54y/d97yPU17kgxzmWS0jLaWVluneEOuzAVmUyHZIfHzo9KuJ6nwTZar5DRm/mNR3siR+nZ6yF38VjtxubJB1oI+A7fFjB4hdywLHXP46dlv/+RMQu8pIorAZOubDHTDE8hXW2ZG9WkisJ5P7KoaL4KFHHHXi5vsXAMph4Zphd/zPxVL2tHD3l5c3QXRpQWfTNZNQcZ1f/4yVCuMRibg5LCvpia0ZwRrlygfZdAHUUd0VJDfRO45J5nlIJSAHQtjYtVTL+xNISWOHXovVlInkVyluACqfX94I7qPXTu41yg3SxrrtHE6RTwQ==
+Prime1: +/YsRxmUxgvHKUh4SxdjzqNDDEi8b2BtM5IpctjVG3oYsL6J9xJB3U5/lbrGEPgl/1ndBUSXMQ6zQ5WcDE1qBAdW8t0eyniyuiexcgQ9f04Ds7p7oUiSHGLRn8YqQOzmiASXoZmkzfJZ+42pGhT3RZ+aYKtWQGMHqXabwV3zZl0=
+Prime2: 8hhnKzPzExy6wv/MV0aYKo1g4azrRjug6743/ctTC7zjnMmDW7RMFTXmq5Tu3pFaIL4N4C4m1b7P3abfTrjm+DwHnrlRIvLWS3zJnvUEM22i4BwqqTLRiJpoT5Bfp4pVsdOPT7Iyx1q5UsJZ7Q4qMpg2TFpGiQyieRB5Xwpu4l8=
+Exponent1: ZFPx7Z3SD8pA0793pu75Xx7DY/DSl8bdtNtOhdyxfu9vRXGZnjg24diQFR76H2ewOa2exKo7Sd2ApDi+mmd4/4Gsrag+yoClKlsD3VKy6i42ayqmb+Jly8fNkMFnsdKjOSYa+s4jQZ5vFiuiWjBfBeo3nqabAahtNJ12B9lRQkE=
+Exponent2: tNz4TnVsFo4zFLVHsrghvECM7WxjBMBNc3FToT6CV1WRcjO1+A/Ve08eenc0kYBjpex2r1GrX6pC3uPpFoXav/8Q7kqiTArBf/nFIwUHU2iH8wf38xntIjHA1hgU7jTR2p0kBrUpbHfh1esuhYQ8kDnY7ufOpFqVEv70vcUsm98=
+Coefficient: 3acDCJ9jCnHAP1km7jRO388mOpiI8U6SMv0PBD8l2UoB4CYwujrFxy6PhgUa486bbm5xZEaOwhYZcbw/g1qyC6Qt5kYOb2fVWOob/lEQmyqbDvHMQWTJoIbqaDTKQN/szI4xVdb/xZ6QR4Bq7JgbJpUACgweS540Y7Lf8Dry8C0=
+Created: 20211221062121
+Publish: 20211221062121
+Activate: 20211221062121
@@ -0,0 +1,5 @@
+; This is a key-signing key, keyid 28633, for example.com.
+; Created: 20211221062130 (Tue Dec 21 17:21:30 2021)
+; Publish: 20211221062130 (Tue Dec 21 17:21:30 2021)
+; Activate: 20211221062130 (Tue Dec 21 17:21:30 2021)
+example.com. IN DNSKEY 257 3 10 AwEAAc4lt8fDsdCzMCLHxXm8Ok/dw6XDiqx06Rf47LTeLmo6b64xm1Fs 0zloNMrcZDgwS5IxjQ3Breqc5aEc+jehueqCXa/fJXMdIt1VpUG0H7GP 4B+1IVmEiziHfmOozktdkuAyLqcsNhsf+J1+bCoHJSffgz6KbjBks/jR 12uyUnZCDrKGE/KfiR0gpT3watqGqqChO0KXq2N2PsnYfyRDea5FMUjM oPgOOyAT8LIMsM8x4f+EbU6m9Zc3Esafek9iLCS9R1333Pm1EEh5ghQT BsZ7omc5aSvrKUaIneojU3RdofceZouCliIDXmqscfY0y6bivGcmCQI/ LM4XUh7GWlM=
@@ -0,0 +1,13 @@
+Private-key-format: v1.3
+Algorithm: 10 (RSASHA512)
+Modulus: ziW3x8Ox0LMwIsfFebw6T93DpcOKrHTpF/jstN4uajpvrjGbUWzTOWg0ytxkODBLkjGNDcGt6pzloRz6N6G56oJdr98lcx0i3VWlQbQfsY/gH7UhWYSLOId+Y6jOS12S4DIupyw2Gx/4nX5sKgclJ9+DPopuMGSz+NHXa7JSdkIOsoYT8p+JHSClPfBq2oaqoKE7QperY3Y+ydh/JEN5rkUxSMyg+A47IBPwsgywzzHh/4RtTqb1lzcSxp96T2IsJL1HXffc+bUQSHmCFBMGxnuiZzlpK+spRoid6iNTdF2h9x5mi4KWIgNeaqxx9jTLpuK8ZyYJAj8szhdSHsZaUw==
+PublicExponent: AQAB
+PrivateExponent: Wr3fl99cdjFqDuVA18UzJdTIOj9I24Da2eKIz1S9uaTfZB4R8FWm5K4qDuHUe6dGnKOTI2sN0ygdLD5FJhfabo/UDYZ8RZ+dqS/5/mH7UX2zekGQ3Iargcaiq9uycxpNfMKaJpwfdPEtzqXHlvhuMo8AhpcIyeSKFAzKdm2YPtUqIrum4RARHyfRLfLyWlkIotPdyiaKCVGQxiRbFsTcmIB2Bizmt7zRjlB+Hxf8MooXmaKUFRQtMCLnFGK0ecFI1CWAxmLSanvYVKQ0HxcFkFKzRiZAz1au7ZfMgYDZj0jF72WAGU3Edcmdc0QIQRTWjb/3wcBfwlr9s6lKoF3ngQ==
+Prime1: 1EIziKhz7dF41rb/hckdr2qeY8eM7tLrT5jIMPLISHCCuKm5IK2u7PY6m6NjMdhx1ilm7K2RGTt+TTFZaqDIEd8qpzRCxAGcfTVOmB9iHwmi9i9RoPSlY6o+iShft68ZnvPiGJWUF2huRYVK2F0cIWErwSqaBGsFd79mXmlkn98=
+Prime2: +KEdNtZj9JyCCR2xbLAw3tnAYxHvJ3skVMjxV3cyUupMWi12NWxGhHH1nnetXxDR2LBBuqIl4pE/4MeXe3sClMHTL3Z9XG+pzQAsHS7yvsfZERdyuWZYYy0ya/7XY2auvRVO6LxN7d47VWjYxAGfoCsbCEivgDxmt1dTZhAtRA0=
+Exponent1: d5TcZ69PsLoEtCLhDkRh/wO4PEqeMaaOf4d5sWn2QCly3Apyi+CN3l5SYoDIT7q7V4Z3v/uA9ZA49dBJqfLvBHKQGycsPjUSLtAreTSlGQtazguWl3F9BAtTs/4U/u0dKBoKVQNgLVfeWDhiFEdQo9WUyvzvTHHm4LHqQGJsGE0=
+Exponent2: EU2dK+DVygNOZXYEkAzfCdNbuUlZPIUsbR4i9bRc8zpNIAWD8YncioEn1+R6U2BnSk5R9LwuKMt1B568YyKXdmTa3rW/WbyHs7WsXEeVK0PbTn40RMTjp9tQZAWzVb6isJQYDsh0H/bUaEhItbNrOYlmczgjxqftehsAudysWc0=
+Coefficient: sl2u/8vttxpiTbspGV4SsaDmKUNdzQH7BgJ5rl3mXPp/aUpLw0Sr7FuARy8W8tq3yVNi9qCOnvGwVl6aQzZP7b8N04KiH8gewlAVdSfxG24yFKJIQNbWGKFZYZFYyjtLVlpK6NYF0f0I1KpAjn58XR0qIBvRFZYWBAkggU9C7ro=
+Created: 20211221062130
+Publish: 20211221062130
+Activate: 20211221062130
@@ -1,6 +1,6 @@
 ;
 ; This is a bogus key.  It will not have a .private file.
 ;
-; This will be key id 7091
+; This will be key id 23221
 ;
-example.com. IN DNSKEY 257 3 5 AwEAAaF0z17DdkBAKiYScVNqzsqXw7Vz/Cx5OCw7T/6RnU/KiGv815kl H2obywRZX2ZcEg9R8SUzQiP9ygY0s1xF5IFYi32HsWftNV7V/gNwNrMn GC0gV2e3OawsQ2CYWZZVwObr/fmcKIXuY6eRdJtyOilMRhlvroJdXZw1 CQdicxpz
+example.com. IN DNSKEY 257 3 10 AwEAAbcyptpM++pVjhpYQW2fVtyOw04IBSw4X0SYi/Ke4wVkmDNW2vBm AFkgiVVKmmNbb0IHDYQiIY7seXk0fjEwjzeY2bmeOAZxDdv2KT9VQpoY Matk2y4NTi6F/V04x0lL/CBvyifTeNbZKvY+S1eKFuWHeS5Ss8tiagz9 zdYWUe/msvmin+Hbs2tlLwXVl4hOmABCL9uK9H8R6GPL5VdEXYyFOh/v 71CNhRU5ufrARti69YYkfzH6NpWhlJWyJvDjqAdt2L3H8V71C2vcXbBu S5NscEYl+8JQfwUvOTN553I5IQrG+NQEusW36UM/Rkad8mMnUVM9Vzqk GH86GHKtLMc=
@@ -1,6 +1,6 @@
 ;
 ; This is a bogus key.  It will not have a .private file.
 ;
-; This will be key id 7092
+; This will be key id 48930
 ;
-example.com. IN DNSKEY 256 3 5 AwEAAaF0z17DdkBAKiYScVNqzsqXw7Vz/Cx5OCw7T/6RnU/KiGv815kl H2obywRZX2ZcEg9R8SUzQiP9ygY0s1xF5IFYi32HsWftNV7V/gNwNrMn GC0gV2e3OawsQ2CYWZZVwObr/fmcKIXuY6eRdJtyOilMRhlvroJdXZw1 CQdicxpz
+example.com. IN DNSKEY 256 3 10 AwEAAa/0IcnbGutPVkrz04tw5ZIYx6rU+FprB2rlKS8cTK/wiBOqbOC6 QIDdegDpZG1fOdj04ZQGa3pIizqC2CnlIWfxpfR6W+qSLRBuQ8gmwTmS c/Jy/0vAGB3fv3oVIqKslLNqIXZb3CKNiA2kGcut3aUgfeOW970Jga6z PAGKqPpPZTelW1Qy9N5BO4cRTuYo4uvbZveJv1W/2n5RN+UaeqU0f+AE DP0+wqSWNUfZsi6HygLwk08x3eO8PzTBlqBlAMfvNAygrmXqccMREyyH KEc5dVJ1qOXfj8BAdJUPmunyJhIwC9PxzOW7mn1lW7mZO2D5U/Jaxw2k eX2KblmVk8s=
@@ -15,5 +15,5 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
@@ -15,4 +15,4 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
+$include Kexample.com.+010+18240.key
@@ -15,4 +15,4 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+28633.key
@@ -15,6 +15,6 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
 $include bogus-zsk.key
@@ -14,6 +14,6 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
 $include bogus-ksk.key
@@ -15,7 +15,7 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+07065.key
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+18240.key
+$include Kexample.com.+010+28633.key
 $include bogus-ksk.key
 $include bogus-zsk.key
@@ -15,5 +15,5 @@
 ;
 $TTL 3600
 example.com.	IN	SOA ns hostmaster 00090000 1200 3600 604800 300
-$include Kexample.com.+005+23362.key
+$include Kexample.com.+010+28633.key
 $include bogus-zsk.key
@@ -1804,8 +1804,12 @@ $SIGNER -O raw -f signer.out.5 -Sxt -o example example.db > /dev/null
 $SIGNER -O raw=0 -f signer.out.6 -Sxt -o example example.db > /dev/null
 $SIGNER -O raw -f - -Sxt -o example example.db > signer.out.7 2> /dev/null
 ) || ret=1
-awk '/IN *SOA/ {if (NF != 11) exit(1)}' signer/signer.out.3 || ret=1
-awk '/IN *SOA/ {if (NF != 7) exit(1)}' signer/signer.out.4 || ret=1
+awk 'BEGIN { found = 0; }
+     $1 == "example." && $3 == "IN" && $4 == "SOA" { found = 1; if (NF != 11) exit(1); }
+     END { if (!found) exit(1); }' signer/signer.out.3 || ret=1
+awk 'BEGIN { found = 0; }
+     $1 == "example." && $3 == "IN" && $4 == "SOA" { found = 1; if (NF != 7) exit(1); }
+     END { if (!found) exit(1); }' signer/signer.out.4 || ret=1
 israw1 signer/signer.out.5 || ret=1
 israw0 signer/signer.out.6 || ret=1
 israw1 signer/signer.out.7 || ret=1
@@ -344,16 +344,18 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking DoH query (POST) ($n)"
 ret=0
-dig_with_https_opts @10.53.0.1 . SOA > dig.out.test$n
+dig_with_https_opts +stat @10.53.0.1 . SOA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTPS)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

 n=$((n + 1))
 echo_i "checking DoH query via IPv6 (POST) ($n)"
 ret=0
-dig_with_https_opts -6 @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n
+dig_with_https_opts +stat -6 @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTPS)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -416,16 +418,18 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking DoH query (GET) ($n)"
 ret=0
-dig_with_https_opts +https-get @10.53.0.1 . SOA > dig.out.test$n
+dig_with_https_opts +stat +https-get @10.53.0.1 . SOA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTPS-GET)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

 n=$((n + 1))
 echo_i "checking DoH query via IPv6 (GET) ($n)"
 ret=0
-dig_with_https_opts -6 +https-get @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n
+dig_with_https_opts -6 +stat +https-get @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTPS-GET)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -488,32 +492,36 @@ status=$((status + ret))
 n=$((n + 1))
 echo_i "checking unencrypted DoH query (POST) ($n)"
 ret=0
-dig_with_http_opts @10.53.0.1 . SOA > dig.out.test$n
+dig_with_http_opts +stat @10.53.0.1 . SOA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTP)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

 n=$((n + 1))
 echo_i "checking unencrypted DoH query via IPv6 (POST) ($n)"
 ret=0
-dig_with_http_opts -6 @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n
+dig_with_http_opts -6 +stat @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTP)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

 n=$((n + 1))
 echo_i "checking unencrypted DoH query (GET) ($n)"
 ret=0
-dig_with_http_opts +http-plain-get @10.53.0.1 . SOA > dig.out.test$n
+dig_with_http_opts +stat +http-plain-get @10.53.0.1 . SOA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTP-GET)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

 n=$((n + 1))
 echo_i "checking unencrypted DoH query via IPv6 (GET) ($n)"
 ret=0
-dig_with_http_opts -6 +http-plain-get @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n
+dig_with_http_opts -6 +stat +http-plain-get @fd92:7065:b8e:ffff::1 . SOA > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep -F "(HTTP-GET)" dig.out.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -10,13 +10,11 @@ sample_la_SOURCES =	\
 	db.c		\
 	driver.c	\
 	instance.c	\
-	lock.c		\
 	log.c		\
 	syncptr.c	\
 	zone.c		\
 	db.h		\
 	instance.h	\
-	lock.h		\
 	log.h		\
 	syncptr.h	\
 	util.h		\
@@ -614,7 +614,7 @@ add_soa(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	rdatalist.rdclass = rdata.rdclass;
 	rdatalist.ttl = 86400;
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	CHECK(dns_db_findnode(db, name, true, &node));
 	CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
 cleanup:
@@ -652,7 +652,7 @@ add_ns(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	rdatalist.rdclass = rdata.rdclass;
 	rdatalist.ttl = 86400;
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	CHECK(dns_db_findnode(db, name, true, &node));
 	CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
 cleanup:
@@ -688,7 +688,7 @@ add_a(dns_db_t *db, dns_dbversion_t *version, const dns_name_t *name,
 	rdatalist.rdclass = rdata.rdclass;
 	rdatalist.ttl = 86400;
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
-	CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
+	dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	CHECK(dns_db_findnode(db, name, true, &node));
 	CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
 cleanup:
@@ -1,81 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0 AND ISC
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * Copyright (C) Red Hat
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include "lock.h"
-
-#include <isc/task.h>
-#include <isc/util.h>
-
-/*
- * Lock BIND dispatcher and allow only single task to run.
- *
- * @warning
- * All calls to isc_task_beginexclusive() have to operate on the same task
- * otherwise it would not be possible to distinguish recursive locking
- * from real conflict on the dispatcher lock.
- * For this reason this wrapper function always works with inst->task.
- * As a result, this function have to be be called only from inst->task.
- *
- * Recursive locking is allowed. Auxiliary variable pointed to by "statep"
- * stores information if last run_exclusive_enter() operation really locked
- * something or if the lock was called recursively and was no-op.
- *
- * The pair (inst, state) used for run_exclusive_enter() has to be
- * used for run_exclusive_exit().
- *
- * @param[in]  	  inst   The instance with the only task which is allowed to
- * run.
- * @param[in,out] statep Lock state: ISC_R_SUCCESS or ISC_R_LOCKBUSY
- */
-void
-run_exclusive_enter(sample_instance_t *inst, isc_result_t *statep) {
-	REQUIRE(statep != NULL);
-	REQUIRE(*statep == ISC_R_IGNORE);
-
-	*statep = isc_task_beginexclusive(inst->task);
-	RUNTIME_CHECK(*statep == ISC_R_SUCCESS || *statep == ISC_R_LOCKBUSY);
-}
-
-/*
- * Exit task-exclusive mode.
- *
- * @param[in] inst  The instance used for previous run_exclusive_enter() call.
- * @param[in] state Lock state as returned by run_exclusive_enter().
- */
-void
-run_exclusive_exit(sample_instance_t *inst, isc_result_t state) {
-	if (state == ISC_R_SUCCESS) {
-		isc_task_endexclusive(inst->task);
-	} else {
-		/* Unlocking recursive lock or the lock was never locked. */
-		INSIST(state == ISC_R_LOCKBUSY || state == ISC_R_IGNORE);
-	}
-
-	return;
-}
@@ -1,39 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * SPDX-License-Identifier: MPL-2.0 AND ISC
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * Copyright (C) Red Hat
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND AUTHORS DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-#pragma once
-
-#include "instance.h"
-#include "util.h"
-
-void
-run_exclusive_enter(sample_instance_t *inst, isc_result_t *statep);
-
-void
-run_exclusive_exit(sample_instance_t *inst, isc_result_t state);
@@ -35,6 +35,7 @@
 #include <inttypes.h>
 #include <stdbool.h>

+#include <isc/task.h>
 #include <isc/util.h>

 #include <dns/dyndb.h>
@@ -42,7 +43,6 @@
 #include <dns/zone.h>

 #include "instance.h"
-#include "lock.h"
 #include "log.h"
 #include "util.h"

@@ -134,7 +134,6 @@ publish_zone(sample_instance_t *inst, dns_zone_t *zone) {
 	bool freeze = false;
 	dns_zone_t *zone_in_view = NULL;
 	dns_view_t *view_in_zone = NULL;
-	isc_result_t lock_state = ISC_R_IGNORE;

 	REQUIRE(inst != NULL);
 	REQUIRE(zone != NULL);
@@ -172,7 +171,7 @@ publish_zone(sample_instance_t *inst, dns_zone_t *zone) {
 		CLEANUP_WITH(ISC_R_UNEXPECTED);
 	}

-	run_exclusive_enter(inst, &lock_state);
+	isc_task_beginexclusive(inst->task);
 	if (inst->view->frozen) {
 		freeze = true;
 		dns_view_thaw(inst->view);
@@ -194,7 +193,7 @@ cleanup:
 	if (freeze) {
 		dns_view_freeze(inst->view);
 	}
-	run_exclusive_exit(inst, lock_state);
+	isc_task_endexclusive(inst->task);

 	return (result);
 }
@@ -22,17 +22,6 @@ export LC_ALL

 # This set of tests check the behavior of the IDNA options in "dig".
 #
-# "dig" supports two IDNA-related options:
-#
-# +[no]idnin -  Translates a domain name into punycode format before sending
-#               the query to the server.
-#
-#               Should the input name be a punycode name, "dig +idnin" will also
-#               validate the punycode, rejecting it if it is invalid.
-#
-# +[no]idnout - Translates the received punycode domain names into appropriate
-#               unicode characters before displaying.
-#
 # The tests run "dig" against an authoritative server configured with a minimal
 # root zone and nothing else.  As a result, all queries will result in an
 # NXDOMAIN.  The server will return the qname sent, which "dig" will display
@@ -156,11 +145,12 @@ idna_fail() {

 ascii_case_preservation_test() {
    text="Checking valid ASCII label"
-    idna_test "$text" ""                   LocalhosT LocalhosT.
+    idna_test "$text" "+noidn"             LocalhosT LocalhosT.
    idna_test "$text" "+noidnin +noidnout" LocalhosT LocalhosT.
    idna_test "$text" "+noidnin +idnout"   LocalhosT LocalhosT.
    idna_test "$text" "+idnin   +noidnout" LocalhosT LocalhosT.
    idna_test "$text" "+idnin   +idnout"   LocalhosT LocalhosT.
+    idna_test "$text" "+idn"               LocalhosT LocalhosT.
 }

 # Function to perform the tests if IDNA is enabled.
@@ -186,12 +176,12 @@ idna_enabled_test() {
    # Note that ASCII characters are converted to lower-case.

    text="Checking valid non-ASCII label"
-    idna_test "$text" ""                   "München" "M\195\188nchen."
+    idna_test "$text" "+noidn"             "München" "M\195\188nchen."
    idna_test "$text" "+noidnin +noidnout" "München" "M\195\188nchen."
    idna_test "$text" "+noidnin +idnout"   "München" "M\195\188nchen."
    idna_test "$text" "+idnin   +noidnout" "München" "xn--mnchen-3ya."
    idna_test "$text" "+idnin   +idnout"   "München" "münchen."
-
+    idna_test "$text" "+idn"               "München" "münchen."

    # Tests of transitional processing of a valid U-label
    #
@@ -206,28 +196,28 @@ idna_enabled_test() {
    # under IDNA2003, go to www.fass.example but under IDNA2008 would end up at
    # www.fa\195\159.example - a different web site).
    #
-    # BIND has adopted a hard transition, so this test checks that these
-    # transitional mapping is not used.  The tests are essentially the same as
-    # for the valid U-label.
+    # BIND has adopted a (mostly) hard transition, so this test checks that
+    # the transitional mapping is not used for characters that are valid in
+    # IDNA2008. The tests are essentially the same as for the valid U-label.

    text="Checking that non-transitional IDNA processing is used"
-    idna_test "$text" ""                   "faß.de" "fa\195\159.de."
+    idna_test "$text" "+noidn"             "faß.de" "fa\195\159.de."
    idna_test "$text" "+noidnin +noidnout" "faß.de" "fa\195\159.de."
    idna_test "$text" "+noidnin +idnout"   "faß.de" "fa\195\159.de."
    idna_test "$text" "+idnin   +noidnout" "faß.de" "xn--fa-hia.de."
    idna_test "$text" "+idnin   +idnout"   "faß.de" "faß.de."
+    idna_test "$text" "+idn"               "faß.de" "faß.de."

    # Another problem character.  The final character in the first label mapped
    # onto the Greek sigma character ("σ") in IDNA2003.

    text="Second check that non-transitional IDNA processing is used"
-    idna_test "$text" ""                   "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
+    idna_test "$text" "+noidn"             "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
    idna_test "$text" "+noidnin +noidnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
    idna_test "$text" "+noidnin +idnout"   "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com."
    idna_test "$text" "+idnin   +noidnout" "βόλος.com" "xn--nxasmm1c.com."
    idna_test "$text" "+idnin   +idnout"   "βόλος.com" "βόλος.com."
-
-
+    idna_test "$text" "+idn"               "βόλος.com" "βόλος.com."

    # Tests of a valid A-label (i.e. starting xn--)
    #
@@ -239,11 +229,12 @@ idna_enabled_test() {
    # The "+[no]idnin" flag has no effect in these cases.

    text="Checking valid A-label"
-    idna_test "$text" ""                   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
+    idna_test "$text" "+noidn"             "xn--nxasmq6b.com" "xn--nxasmq6b.com."
    idna_test "$text" "+noidnin +noidnout" "xn--nxasmq6b.com" "xn--nxasmq6b.com."
    idna_test "$text" "+noidnin +idnout"   "xn--nxasmq6b.com" "βόλοσ.com."
    idna_test "$text" "+idnin +noidnout"   "xn--nxasmq6b.com" "xn--nxasmq6b.com."
    idna_test "$text" "+idnin +idnout"     "xn--nxasmq6b.com" "βόλοσ.com."
+    idna_test "$text" "+idn"               "xn--nxasmq6b.com" "βόλοσ.com."

    # Test of valid A-label in locale that cannot display it
    #
@@ -258,17 +249,16 @@ idna_enabled_test() {
    text="Checking valid A-label in C locale"
    label="xn--nxasmq6b.com"
    if command -v idn2 >/dev/null && ! idn2 -d "$label" >/dev/null 2>/dev/null; then
-	idna_test "$text" ""                   "$label" "$label."
+	idna_test "$text" "+noidn"             "$label" "$label."
 	idna_test "$text" "+noidnin +noidnout" "$label" "$label."
 	idna_test "$text" "+noidnin +idnout"   "$label" "$label."
 	idna_test "$text" "+idnin +noidnout"   "$label" "$label."
 	idna_test "$text" "+idnin +idnout"     "$label" "$label."
 	idna_test "$text" "+noidnin +idnout"   "$label" "$label."
+	idna_test "$text" "+idn"               "$label" "$label."
    fi
    LC_ALL="${saved_LC_ALL}"

-
-
    # Tests of invalid A-labels
    #
    # +noidnin: The label is sent as-is to the server and dig will display the
@@ -277,42 +267,48 @@ idna_enabled_test() {
    #
    # +[no]idnout: If the label makes it to the server (via +noidnin), "dig"
    #           should report an error if +idnout is specified.
+    #
+    # +idn=lax: The label is sent and printed as-is.

    # The minimum length of a punycode A-label is 7 characters.  Check that
    # a shorter label is detected and rejected.

    text="Checking punycode label shorter than minimum valid length"
-    idna_test "$text" ""                   "xn--xx" "xn--xx."
+    idna_test "$text" "+noidn"             "xn--xx" "xn--xx."
    idna_test "$text" "+noidnin +noidnout" "xn--xx" "xn--xx."
-    idna_fail "$text" "+noidnin   +idnout" "xn--xx"
-    idna_fail "$text" "+idnin   +noidnout" "xn--xx"
-    idna_fail "$text" "+idnin     +idnout" "xn--xx"
+    idna_test "$text" "+noidnin   +idnout" "xn--xx" "xn--xx."
+    idna_test "$text" "+idnin   +noidnout" "xn--xx" "xn--xx."
+    idna_test "$text" "+idnin     +idnout" "xn--xx" "xn--xx."
+    idna_test "$text" "+idn"               "xn--xx" "xn--xx."

    # Fake A-label - the string does not translate to anything.
+    # This name is a syntax error: IDNA expects be punycode-encoded
+    # non-ascii characters after the last hyphen, but they are missing
+    # in this test.

    text="Checking fake A-label"
-    idna_test "$text" ""                   "xn--ahahah" "xn--ahahah."
-    idna_test "$text" "+noidnin +noidnout" "xn--ahahah" "xn--ahahah."
-    idna_fail "$text" "+noidnin   +idnout" "xn--ahahah"
-    idna_fail "$text" "+idnin   +noidnout" "xn--ahahah"
-    idna_fail "$text" "+idnin     +idnout" "xn--ahahah"
+    idna_test "$text" "+noidn"             "xn--ah-" "xn--ah-."
+    idna_test "$text" "+noidnin +noidnout" "xn--ah-" "xn--ah-."
+    idna_test "$text" "+noidnin   +idnout" "xn--ah-" "xn--ah-."
+    idna_test "$text" "+idnin   +noidnout" "xn--ah-" "xn--ah-."
+    idna_test "$text" "+idnin     +idnout" "xn--ah-" "xn--ah-."
+    idna_test "$text" "+idn"               "xn--ah-" "xn--ah-."

    # Too long a label. The punycode string is too long (at 64 characters).
    # BIND rejects such labels: with +idnin

    label="xn--xflod18hstflod18hstflod18hstflod18hstflod18hstflod18-1iejjjj"
    text="Checking punycode label longer than maximum valid length"
-    idna_fail "$text" ""                   "$label"
+    idna_fail "$text" "+noidn"             "$label"
    idna_fail "$text" "+noidnin +noidnout" "$label"
    idna_fail "$text" "+noidnin   +idnout" "$label"
    idna_fail "$text" "+idnin   +noidnout" "$label"
    idna_fail "$text" "+idnin     +idnout" "$label"
+    idna_fail "$text" "+idn"               "$label"

    # Tests of a valid unicode string but an invalid U-label (input)
    #
-    # Symbols are not valid IDNA2008 names.  Check whether dig rejects them
-    # when they are supplied on the command line to ensure no IDNA2003
-    # fallbacks are in place.
+    # Symbols are not valid IDNA2008 names, but are allowed by IDNA2003.
    #
    # +noidnin: "dig" should send unicode octets to the server and display the
    #           returned qname in the same form.
@@ -321,22 +317,16 @@ idna_enabled_test() {
    # The +[no]idnout options should not have any effect on the test.

    text="Checking invalid input U-label"
-    idna_test "$text" ""                   "√.com" "\226\136\154.com."
+    idna_test "$text" "+noidn"             "√.com" "\226\136\154.com."
    idna_test "$text" "+noidnin +noidnout" "√.com" "\226\136\154.com."
    idna_test "$text" "+noidnin +idnout"   "√.com" "\226\136\154.com."
-    idna_fail "$text" "+idnin   +noidnout" "√.com"
-    idna_fail "$text" "+idnin   +idnout"   "√.com"
+    idna_test "$text" "+idnin   +noidnout" "√.com" "xn--19g.com."
+    idna_test "$text" "+idnin   +idnout"   "√.com" "√.com."
+    idna_test "$text" "+idn"               "√.com" "√.com."

    # Tests of a valid unicode string but an invalid U-label (output)
    #
-    # Symbols are not valid IDNA2008 names.  Check whether dig rejects them
-    # when they are received in DNS responses to ensure no IDNA2003 fallbacks
-    # are in place.
-    #
-    # Note that "+idnin +noidnout" is not tested because libidn2 2.2.0+ parses
-    # Punycode more strictly than older versions and thus dig fails with that
-    # combination of options with libidn2 2.2.0+ but succeeds with older
-    # versions.
+    # Symbols are not valid IDNA2008 names, but are allowed by IDNA2003.
    #
    # +noidnout: "dig" should send the ACE string to the server and display the
    #            returned qname.
@@ -345,28 +335,32 @@ idna_enabled_test() {
    # The +[no]idnin options should not have any effect on the test.

    text="Checking invalid output U-label"
-    idna_test "$text" ""                   "xn--19g" "xn--19g."
+    idna_test "$text" "+noidn"             "xn--19g" "xn--19g."
    idna_test "$text" "+noidnin +noidnout" "xn--19g" "xn--19g."
-    idna_fail "$text" "+noidnin +idnout"   "xn--19g"
-    idna_fail "$text" "+idnin   +idnout"   "xn--19g"
-
+    idna_test "$text" "+noidnin +idnout"   "xn--19g" "√."
+    idna_test "$text" "+idnin   +noidnout" "xn--19g" "xn--19g."
+    idna_test "$text" "+idnin   +idnout"   "xn--19g" "√."
+    idna_test "$text" "+idn"               "xn--19g" "√."

    # Test that non-letter characters are preserved in the output.  When
    # UseSTD3ASCIIRules are enabled, it would mangle non-letter characters like
    # `_` (underscore) and `*` (wildcard.

-    test="Checking valid non-letter characters"
-    idna_test "$text" ""                   "*.xn--nxasmq6b.com" "*.xn--nxasmq6b.com."
+    text="Checking valid non-letter characters"
+    idna_test "$text" "+noidn"             "*.xn--nxasmq6b.com" "*.xn--nxasmq6b.com."
    idna_test "$text" "+noidnin +noidnout" "*.xn--nxasmq6b.com" "*.xn--nxasmq6b.com."
    idna_test "$text" "+noidnin +idnout"   "*.xn--nxasmq6b.com" "*.βόλοσ.com."
    idna_test "$text" "+idnin +noidnout"   "*.xn--nxasmq6b.com" "*.xn--nxasmq6b.com."
    idna_test "$text" "+idnin +idnout"     "*.xn--nxasmq6b.com" "*.βόλοσ.com."
+    idna_test "$text" "+idn"               "*.xn--nxasmq6b.com" "*.βόλοσ.com."

-    idna_test "$text" ""                   "_tcp.xn--nxasmq6b.com" "_tcp.xn--nxasmq6b.com."
+    idna_test "$text" "+noidn"             "_tcp.xn--nxasmq6b.com" "_tcp.xn--nxasmq6b.com."
    idna_test "$text" "+noidnin +noidnout" "_tcp.xn--nxasmq6b.com" "_tcp.xn--nxasmq6b.com."
    idna_test "$text" "+noidnin +idnout"   "_tcp.xn--nxasmq6b.com" "_tcp.βόλοσ.com."
    idna_test "$text" "+idnin +noidnout"   "_tcp.xn--nxasmq6b.com" "_tcp.xn--nxasmq6b.com."
    idna_test "$text" "+idnin +idnout"     "_tcp.xn--nxasmq6b.com" "_tcp.βόλοσ.com."
+    idna_test "$text" "+idn=strict"        "_tcp.xn--nxasmq6b.com" "_tcp.βόλοσ.com."
+    idna_test "$text" "+idn=lax"           "_tcp.xn--nxasmq6b.com" "_tcp.βόλοσ.com."
 }


@@ -24,6 +24,10 @@
 # We also set the MTU on the 1500 bytes to match the default MTU on physical
 # interfaces, so we can properly test the cases with packets bigger than
 # interface MTU.
+#
+# See also org.isc.bind.system (a version of this script for use on macOS)
+# and testsock.pl (which checks the interfaces are configured)
+#

 top_srcdir=@abs_top_srcdir@

@@ -237,6 +241,10 @@ sequence() (
 # 'ns' in the namserver being configured.
 # 'int' interface identifier.
 #
+# See also `org.isc.bind.system`.
+#
+# This `max` setting is grepped out for use by testsock.pl
+#
 max=11
 case $1 in
    start|up|stop|down)
@@ -796,22 +796,16 @@ mv ns2/named.conf.new ns2/named.conf
 $RNDCCMD 10.53.0.2 reconfig || ret=1
 # Request ns3 to retransfer the "retransfer3" zone.
 $RNDCCMD 10.53.0.3 retransfer retransfer3 || ret=1
-# Wait until ns3 finishes building the NSEC3 chain for "retransfer3".  There is
-# no need to immediately set ret=1 if building the NSEC3 chain is not finished
-# within the time limit because the query we will send shortly will detect any
-# problems anyway.
+# Check whether "retransfer3" uses NSEC3 as requested.
 for i in 0 1 2 3 4 5 6 7 8 9
 do
-	$RNDCCMD 10.53.0.3 signing -list retransfer3 > signing.out.test$n.$i 2>&1
-	keys_done=$(grep "Done signing" signing.out.test$n.$i | wc -l)
-	nsec3_pending=$(grep "NSEC3 chain" signing.out.test$n.$i | wc -l)
-	test $keys_done -eq 2 -a $nsec3_pending -eq 0 && break
+	ret=0
+	$DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.post.test$n.$i
+	grep "status: NXDOMAIN" dig.out.ns3.post.test$n.$i > /dev/null || ret=1
+	grep "NSEC3" dig.out.ns3.post.test$n.$i > /dev/null || ret=1
+	test $ret -eq 0 && break
 	sleep 1
 done
-# Check whether "retransfer3" uses NSEC3 as requested.
-$DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.post.test$n
-grep "status: NXDOMAIN" dig.out.ns3.post.test$n > /dev/null || ret=1
-grep "NSEC3" dig.out.ns3.post.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))

@@ -18,6 +18,7 @@ rm -f ./K*.private ./K*.key ./K*.state ./K*.cmp
 rm -rf ./keys/
 rm -f dig.out* rrsig.out.* keyevent.out.*
 rm -f ns*/named.conf ns*/named.memstats ns*/named.run*
+rm -f ns*/named-fips.conf
 rm -f ns*/policies/*.conf
 rm -f ns*/*.jnl ns*/*.jbk
 rm -f ns*/K*.private ns*/K*.key ns*/K*.state
@@ -21,7 +21,7 @@ dnssec-policy "kasp" {
 	keys {
 		csk key-directory lifetime P1Y  algorithm 13;
 		ksk key-directory lifetime P1Y  algorithm 8;
-		zsk key-directory lifetime P30D algorithm 8 1024;
-		zsk key-directory lifetime P6M  algorithm 8 2000;
+		zsk key-directory lifetime P30D algorithm 8 2048;
+		zsk key-directory lifetime P6M  algorithm 8 3072;
 	};
 };
@@ -46,8 +46,9 @@ zone "unsigned.tld" {

 zone "signed.tld" {
 	type primary;
-	dnssec-policy "default";
 	file "signed.tld.db";
+	dnssec-policy "default";
+	inline-signing yes;
 };

 /* Primary service for ns3 */
@@ -24,5 +24,6 @@ dnssec-policy "ed25519" {
 zone "ed25519.kasp" {
        type primary;
        file "ed25519.kasp.db";
+	inline-signing yes;
        dnssec-policy "ed25519";
 };
@@ -24,5 +24,6 @@ dnssec-policy "ed448" {
 zone "ed448.kasp" {
        type primary;
        file "ed448.kasp.db";
+	inline-signing yes;
        dnssec-policy "ed448";
 };
@@ -0,0 +1,508 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+include "policies/kasp.conf";
+include "policies/autosign.conf";
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	allow-transfer { any; };
+	recursion no;
+	dnssec-policy "rsasha256";
+};
+
+key rndc_key {
+        secret "1234abcd8765";
+        algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+        inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+/* Zones that are getting initially signed */
+
+/* The default case: No keys created, using default policy. */
+zone "default.kasp" {
+	type primary;
+	file "default.kasp.db";
+	inline-signing yes;
+	dnssec-policy "default";
+};
+
+/* checkds: Zone with one KSK. */
+zone "checkds-ksk.kasp" {
+	type primary;
+	file "checkds-ksk.kasp.db";
+	inline-signing yes;
+	dnssec-policy "checkds-ksk";
+};
+
+/* checkds: Zone with two KSKs. */
+zone "checkds-doubleksk.kasp" {
+	type primary;
+	file "checkds-doubleksk.kasp.db";
+	inline-signing yes;
+	dnssec-policy "checkds-doubleksk";
+};
+
+/* checkds: Zone with one CSK. */
+zone "checkds-csk.kasp" {
+	type primary;
+	file "checkds-csk.kasp.db";
+	inline-signing yes;
+	dnssec-policy "checkds-csk";
+};
+
+/* Key lifetime unlimited. */
+zone "unlimited.kasp" {
+	type primary;
+	file "unlimited.kasp.db";
+	inline-signing yes;
+	dnssec-policy "unlimited";
+};
+
+/* Manual rollover. */
+zone "manual-rollover.kasp" {
+	type primary;
+	file "manual-rollover.kasp.db";
+	inline-signing yes;
+	dnssec-policy "manual-rollover";
+};
+
+/* A zone that inherits dnssec-policy. */
+zone "inherit.kasp" {
+	type primary;
+	inline-signing yes;
+	file "inherit.kasp.db";
+};
+
+/* A zone that overrides dnssec-policy. */
+zone "unsigned.kasp" {
+	type primary;
+	file "unsigned.kasp.db";
+	inline-signing yes;
+	dnssec-policy "none";
+};
+
+/* A zone that is initially set to insecure. */
+zone "insecure.kasp" {
+	type primary;
+	file "insecure.kasp.db";
+	inline-signing yes;
+	dnssec-policy "insecure";
+};
+
+/* A primary zone with dnssec-policy but keys already created. */
+zone "dnssec-keygen.kasp" {
+	type primary;
+	file "dnssec-keygen.kasp.db";
+	inline-signing yes;
+	dnssec-policy "rsasha256";
+};
+
+/* A secondary zone with dnssec-policy. */
+zone "secondary.kasp" {
+	type secondary;
+	primaries { 10.53.0.2; };
+	file "secondary.kasp.db";
+	inline-signing yes;
+	dnssec-policy "rsasha256";
+};
+
+/* A dynamic zone with dnssec-policy. */
+zone "dynamic.kasp" {
+	type primary;
+	file "dynamic.kasp.db";
+	dnssec-policy "default";
+	allow-update { any; };
+};
+
+/* A dynamic inline-signed zone with dnssec-policy. */
+zone "dynamic-inline-signing.kasp" {
+	type primary;
+	file "dynamic-inline-signing.kasp.db";
+	dnssec-policy "default";
+	allow-update { any; };
+	inline-signing yes;
+};
+
+/* An inline-signed zone with dnssec-policy. */
+zone "inline-signing.kasp" {
+	type primary;
+	file "inline-signing.kasp.db";
+	dnssec-policy "default";
+	inline-signing yes;
+};
+
+/*
+ * A configured dnssec-policy but some keys already created.
+ */
+zone "some-keys.kasp" {
+	type primary;
+	file "some-keys.kasp.db";
+	inline-signing yes;
+	dnssec-policy "rsasha256";
+};
+
+/*
+ * A configured dnssec-policy but some keys already in use.
+ */
+zone "legacy-keys.kasp" {
+	type primary;
+	file "legacy-keys.kasp.db";
+	inline-signing yes;
+	dnssec-policy "migrate-to-dnssec-policy";
+};
+
+/*
+ * A configured dnssec-policy with (too) many keys pregenerated.
+ */
+zone "pregenerated.kasp" {
+	type primary;
+	file "pregenerated.kasp.db";
+	inline-signing yes;
+	dnssec-policy "rsasha256";
+};
+
+/*
+ * A configured dnssec-policy with one rumoured key.
+ * Bugfix case for GL #1593.
+ */
+zone "rumoured.kasp" {
+	type primary;
+	file "rumoured.kasp.db";
+	inline-signing yes;
+	dnssec-policy "rsasha256";
+};
+
+/* RFC 8901 Multi-signer Model 2. */
+zone "multisigner-model2.kasp" {
+	type primary;
+	file "multisigner-model2.kasp.db";
+	dnssec-policy "multisigner-model2";
+	allow-update { any; };
+};
+
+/*
+ * Different algorithms.
+ */
+zone "rsasha256.kasp" {
+	type primary;
+	file "rsasha256.kasp.db";
+	inline-signing yes;
+	dnssec-policy "rsasha256";
+};
+zone "rsasha512.kasp" {
+	type primary;
+	file "rsasha512.kasp.db";
+	inline-signing yes;
+	dnssec-policy "rsasha512";
+};
+zone "ecdsa256.kasp" {
+	type primary;
+	file "ecdsa256.kasp.db";
+	inline-signing yes;
+	dnssec-policy "ecdsa256";
+};
+zone "ecdsa384.kasp" {
+	type primary;
+	file "ecdsa384.kasp.db";
+	inline-signing yes;
+	dnssec-policy "ecdsa384";
+};
+
+/*
+ * Zone with too high TTL.
+ */
+zone "max-zone-ttl.kasp" {
+	type primary;
+	file "max-zone-ttl.kasp.db";
+	inline-signing yes;
+	dnssec-policy "ttl";
+};
+
+/*
+ * Zones in different signing states.
+ */
+
+/*
+ * Zone that has expired signatures.
+ */
+zone "expired-sigs.autosign" {
+	type primary;
+	file "expired-sigs.autosign.db";
+	inline-signing yes;
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has valid, fresh signatures.
+ */
+zone "fresh-sigs.autosign" {
+	type primary;
+	file "fresh-sigs.autosign.db";
+	inline-signing yes;
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has unfresh signatures.
+ */
+zone "unfresh-sigs.autosign" {
+	type primary;
+	file "unfresh-sigs.autosign.db";
+	inline-signing yes;
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has missing private KSK.
+ */
+zone "ksk-missing.autosign" {
+	type primary;
+	file "ksk-missing.autosign.db";
+	inline-signing yes;
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has missing private ZSK.
+ */
+zone "zsk-missing.autosign" {
+	type primary;
+	file "zsk-missing.autosign.db";
+	inline-signing yes;
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zone that has inactive ZSK.
+ */
+zone "zsk-retired.autosign" {
+	type primary;
+	file "zsk-retired.autosign.db";
+	inline-signing yes;
+	dnssec-policy "autosign";
+};
+
+/*
+ * Zones for testing enabling DNSSEC.
+ */
+zone "step1.enable-dnssec.autosign" {
+	type primary;
+	file "step1.enable-dnssec.autosign.db";
+	inline-signing yes;
+	dnssec-policy "enable-dnssec";
+};
+zone "step2.enable-dnssec.autosign" {
+	type primary;
+	file "step2.enable-dnssec.autosign.db";
+	inline-signing yes;
+	dnssec-policy "enable-dnssec";
+};
+zone "step3.enable-dnssec.autosign" {
+	type primary;
+	file "step3.enable-dnssec.autosign.db";
+	inline-signing yes;
+	dnssec-policy "enable-dnssec";
+};
+zone "step4.enable-dnssec.autosign" {
+	type primary;
+	file "step4.enable-dnssec.autosign.db";
+	inline-signing yes;
+	dnssec-policy "enable-dnssec";
+};
+
+/*
+ * Zones for testing ZSK Pre-Publication steps.
+ */
+zone "step1.zsk-prepub.autosign" {
+	type primary;
+	file "step1.zsk-prepub.autosign.db";
+	inline-signing yes;
+	dnssec-policy "zsk-prepub";
+};
+zone "step2.zsk-prepub.autosign" {
+	type primary;
+	file "step2.zsk-prepub.autosign.db";
+	inline-signing yes;
+	dnssec-policy "zsk-prepub";
+};
+zone "step3.zsk-prepub.autosign" {
+	type primary;
+	file "step3.zsk-prepub.autosign.db";
+	inline-signing yes;
+	dnssec-policy "zsk-prepub";
+};
+zone "step4.zsk-prepub.autosign" {
+	type primary;
+	file "step4.zsk-prepub.autosign.db";
+	inline-signing yes;
+	dnssec-policy "zsk-prepub";
+};
+zone "step5.zsk-prepub.autosign" {
+	type primary;
+	file "step5.zsk-prepub.autosign.db";
+	inline-signing yes;
+	dnssec-policy "zsk-prepub";
+};
+zone "step6.zsk-prepub.autosign" {
+	type primary;
+	file "step6.zsk-prepub.autosign.db";
+	inline-signing yes;
+	dnssec-policy "zsk-prepub";
+};
+
+/*
+ * Zones for testing KSK Double-KSK steps.
+ */
+zone "step1.ksk-doubleksk.autosign" {
+	type primary;
+	file "step1.ksk-doubleksk.autosign.db";
+	inline-signing yes;
+	dnssec-policy "ksk-doubleksk";
+};
+zone "step2.ksk-doubleksk.autosign" {
+	type primary;
+	file "step2.ksk-doubleksk.autosign.db";
+	inline-signing yes;
+	dnssec-policy "ksk-doubleksk";
+};
+zone "step3.ksk-doubleksk.autosign" {
+	type primary;
+	file "step3.ksk-doubleksk.autosign.db";
+	inline-signing yes;
+	dnssec-policy "ksk-doubleksk";
+};
+zone "step4.ksk-doubleksk.autosign" {
+	type primary;
+	file "step4.ksk-doubleksk.autosign.db";
+	inline-signing yes;
+	dnssec-policy "ksk-doubleksk";
+};
+zone "step5.ksk-doubleksk.autosign" {
+	type primary;
+	file "step5.ksk-doubleksk.autosign.db";
+	inline-signing yes;
+	dnssec-policy "ksk-doubleksk";
+};
+zone "step6.ksk-doubleksk.autosign" {
+	type primary;
+	file "step6.ksk-doubleksk.autosign.db";
+	inline-signing yes;
+	dnssec-policy "ksk-doubleksk";
+};
+
+/*
+ * Zones for testing CSK rollover steps.
+ */
+zone "step1.csk-roll.autosign" {
+	type primary;
+	file "step1.csk-roll.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll";
+};
+zone "step2.csk-roll.autosign" {
+	type primary;
+	file "step2.csk-roll.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll";
+};
+zone "step3.csk-roll.autosign" {
+	type primary;
+	file "step3.csk-roll.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll";
+};
+zone "step4.csk-roll.autosign" {
+	type primary;
+	file "step4.csk-roll.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll";
+};
+zone "step5.csk-roll.autosign" {
+	type primary;
+	file "step5.csk-roll.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll";
+};
+zone "step6.csk-roll.autosign" {
+	type primary;
+	file "step6.csk-roll.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll";
+};
+zone "step7.csk-roll.autosign" {
+	type primary;
+	file "step7.csk-roll.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll";
+};
+zone "step8.csk-roll.autosign" {
+	type primary;
+	file "step8.csk-roll.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll";
+};
+
+zone "step1.csk-roll2.autosign" {
+	type primary;
+	file "step1.csk-roll2.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll2";
+};
+zone "step2.csk-roll2.autosign" {
+	type primary;
+	file "step2.csk-roll2.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll2";
+};
+zone "step3.csk-roll2.autosign" {
+	type primary;
+	file "step3.csk-roll2.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll2";
+};
+zone "step4.csk-roll2.autosign" {
+	type primary;
+	file "step4.csk-roll2.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll2";
+};
+zone "step5.csk-roll2.autosign" {
+	type primary;
+	file "step5.csk-roll2.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll2";
+};
+zone "step6.csk-roll2.autosign" {
+	type primary;
+	file "step6.csk-roll2.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll2";
+};
+zone "step7.csk-roll2.autosign" {
+	type primary;
+	file "step7.csk-roll2.autosign.db";
+	inline-signing yes;
+	dnssec-policy "csk-roll2";
+};
@@ -13,451 +13,18 @@

 // NS3

-include "policies/kasp.conf";
-include "policies/autosign.conf";
+include "named-fips.conf";

-options {
-	query-source address 10.53.0.3;
-	notify-source 10.53.0.3;
-	transfer-source 10.53.0.3;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.3; };
-	listen-on-v6 { none; };
-	allow-transfer { any; };
-	recursion no;
-	dnssec-policy "rsasha1";
-};
-
-key rndc_key {
-        secret "1234abcd8765";
-        algorithm @DEFAULT_HMAC@;
-};
-
-controls {
-        inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-/* Zones that are getting initially signed */
-
-/* The default case: No keys created, using default policy. */
-zone "default.kasp" {
-	type primary;
-	file "default.kasp.db";
-	dnssec-policy "default";
-};
-
-/* checkds: Zone with one KSK. */
-zone "checkds-ksk.kasp" {
-	type primary;
-	file "checkds-ksk.kasp.db";
-	dnssec-policy "checkds-ksk";
-};
-
-/* checkds: Zone with two KSKs. */
-zone "checkds-doubleksk.kasp" {
-	type primary;
-	file "checkds-doubleksk.kasp.db";
-	dnssec-policy "checkds-doubleksk";
-};
-
-/* checkds: Zone with one CSK. */
-zone "checkds-csk.kasp" {
-	type primary;
-	file "checkds-csk.kasp.db";
-	dnssec-policy "checkds-csk";
-};
-
-/* Key lifetime unlimited. */
-zone "unlimited.kasp" {
-	type primary;
-	file "unlimited.kasp.db";
-	dnssec-policy "unlimited";
-};
-
-/* Manual rollover. */
-zone "manual-rollover.kasp" {
-	type primary;
-	file "manual-rollover.kasp.db";
-	dnssec-policy "manual-rollover";
-};
-
-/* A primary zone with dnssec-policy, no keys created. */
 zone "rsasha1.kasp" {
 	type primary;
 	file "rsasha1.kasp.db";
-	dnssec-policy "rsasha1";
-};
-
-/* A zone that inherits dnssec-policy. */
-zone "inherit.kasp" {
-	type primary;
-	file "inherit.kasp.db";
-};
-
-/* A zone that overrides dnssec-policy. */
-zone "unsigned.kasp" {
-	type primary;
-	file "unsigned.kasp.db";
-	dnssec-policy "none";
-};
-
-/* A zone that is initially set to insecure. */
-zone "insecure.kasp" {
-	type primary;
-	file "insecure.kasp.db";
-	dnssec-policy "insecure";
-};
-
-/* A primary zone with dnssec-policy but keys already created. */
-zone "dnssec-keygen.kasp" {
-	type primary;
-	file "dnssec-keygen.kasp.db";
-	dnssec-policy "rsasha1";
-};
-
-/* A secondary zone with dnssec-policy. */
-zone "secondary.kasp" {
-	type secondary;
-	primaries { 10.53.0.2; };
-	file "secondary.kasp.db";
-	dnssec-policy "rsasha1";
-};
-
-/* A dynamic zone with dnssec-policy. */
-zone "dynamic.kasp" {
-	type primary;
-	file "dynamic.kasp.db";
-	dnssec-policy "default";
-	allow-update { any; };
-};
-
-/* A dynamic inline-signed zone with dnssec-policy. */
-zone "dynamic-inline-signing.kasp" {
-	type primary;
-	file "dynamic-inline-signing.kasp.db";
-	dnssec-policy "default";
-	allow-update { any; };
 	inline-signing yes;
-};
-
-/* An inline-signed zone with dnssec-policy. */
-zone "inline-signing.kasp" {
-	type primary;
-	file "inline-signing.kasp.db";
-	dnssec-policy "default";
-	inline-signing yes;
-};
-
-/*
- * A configured dnssec-policy but some keys already created.
- */
-zone "some-keys.kasp" {
-	type primary;
-	file "some-keys.kasp.db";
 	dnssec-policy "rsasha1";
 };

-/*
- * A configured dnssec-policy but some keys already in use.
- */
-zone "legacy-keys.kasp" {
-	type primary;
-	file "legacy-keys.kasp.db";
-	dnssec-policy "migrate-to-dnssec-policy";
-};
-
-/*
- * A configured dnssec-policy with (too) many keys pregenerated.
- */
-zone "pregenerated.kasp" {
-	type primary;
-	file "pregenerated.kasp.db";
-	dnssec-policy "rsasha1";
-};
-
-/*
- * A configured dnssec-policy with one rumoured key.
- * Bugfix case for GL #1593.
- */
-zone "rumoured.kasp" {
-	type primary;
-	file "rumoured.kasp.db";
-	dnssec-policy "rsasha1";
-};
-
-/* RFC 8901 Multi-signer Model 2. */
-zone "multisigner-model2.kasp" {
-	type primary;
-	file "multisigner-model2.kasp.db";
-	dnssec-policy "multisigner-model2";
-	allow-update { any; };
-};
-
-/*
- * Different algorithms.
- */
 zone "rsasha1-nsec3.kasp" {
 	type primary;
 	file "rsasha1-nsec3.kasp.db";
+	inline-signing yes;
 	dnssec-policy "rsasha1-nsec3";
 };
-zone "rsasha256.kasp" {
-	type primary;
-	file "rsasha256.kasp.db";
-	dnssec-policy "rsasha256";
-};
-zone "rsasha512.kasp" {
-	type primary;
-	file "rsasha512.kasp.db";
-	dnssec-policy "rsasha512";
-};
-zone "ecdsa256.kasp" {
-	type primary;
-	file "ecdsa256.kasp.db";
-	dnssec-policy "ecdsa256";
-};
-zone "ecdsa384.kasp" {
-	type primary;
-	file "ecdsa384.kasp.db";
-	dnssec-policy "ecdsa384";
-};
-
-/*
- * Zone with too high TTL.
- */
-zone "max-zone-ttl.kasp" {
-	type primary;
-	file "max-zone-ttl.kasp.db";
-	dnssec-policy "ttl";
-};
-
-/*
- * Zones in different signing states.
- */
-
-/*
- * Zone that has expired signatures.
- */
-zone "expired-sigs.autosign" {
-	type primary;
-	file "expired-sigs.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zone that has valid, fresh signatures.
- */
-zone "fresh-sigs.autosign" {
-	type primary;
-	file "fresh-sigs.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zone that has unfresh signatures.
- */
-zone "unfresh-sigs.autosign" {
-	type primary;
-	file "unfresh-sigs.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zone that has missing private KSK.
- */
-zone "ksk-missing.autosign" {
-	type primary;
-	file "ksk-missing.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zone that has missing private ZSK.
- */
-zone "zsk-missing.autosign" {
-	type primary;
-	file "zsk-missing.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zone that has inactive ZSK.
- */
-zone "zsk-retired.autosign" {
-	type primary;
-	file "zsk-retired.autosign.db";
-	dnssec-policy "autosign";
-};
-
-/*
- * Zones for testing enabling DNSSEC.
- */
-zone "step1.enable-dnssec.autosign" {
-	type primary;
-	file "step1.enable-dnssec.autosign.db";
-	dnssec-policy "enable-dnssec";
-};
-zone "step2.enable-dnssec.autosign" {
-	type primary;
-	file "step2.enable-dnssec.autosign.db";
-	dnssec-policy "enable-dnssec";
-};
-zone "step3.enable-dnssec.autosign" {
-	type primary;
-	file "step3.enable-dnssec.autosign.db";
-	dnssec-policy "enable-dnssec";
-};
-zone "step4.enable-dnssec.autosign" {
-	type primary;
-	file "step4.enable-dnssec.autosign.db";
-	dnssec-policy "enable-dnssec";
-};
-
-/*
- * Zones for testing ZSK Pre-Publication steps.
- */
-zone "step1.zsk-prepub.autosign" {
-	type primary;
-	file "step1.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-zone "step2.zsk-prepub.autosign" {
-	type primary;
-	file "step2.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-zone "step3.zsk-prepub.autosign" {
-	type primary;
-	file "step3.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-zone "step4.zsk-prepub.autosign" {
-	type primary;
-	file "step4.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-zone "step5.zsk-prepub.autosign" {
-	type primary;
-	file "step5.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-zone "step6.zsk-prepub.autosign" {
-	type primary;
-	file "step6.zsk-prepub.autosign.db";
-	dnssec-policy "zsk-prepub";
-};
-
-/*
- * Zones for testing KSK Double-KSK steps.
- */
-zone "step1.ksk-doubleksk.autosign" {
-	type primary;
-	file "step1.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-zone "step2.ksk-doubleksk.autosign" {
-	type primary;
-	file "step2.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-zone "step3.ksk-doubleksk.autosign" {
-	type primary;
-	file "step3.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-zone "step4.ksk-doubleksk.autosign" {
-	type primary;
-	file "step4.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-zone "step5.ksk-doubleksk.autosign" {
-	type primary;
-	file "step5.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-zone "step6.ksk-doubleksk.autosign" {
-	type primary;
-	file "step6.ksk-doubleksk.autosign.db";
-	dnssec-policy "ksk-doubleksk";
-};
-
-/*
- * Zones for testing CSK rollover steps.
- */
-zone "step1.csk-roll.autosign" {
-	type primary;
-	file "step1.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step2.csk-roll.autosign" {
-	type primary;
-	file "step2.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step3.csk-roll.autosign" {
-	type primary;
-	file "step3.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step4.csk-roll.autosign" {
-	type primary;
-	file "step4.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step5.csk-roll.autosign" {
-	type primary;
-	file "step5.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step6.csk-roll.autosign" {
-	type primary;
-	file "step6.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step7.csk-roll.autosign" {
-	type primary;
-	file "step7.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-zone "step8.csk-roll.autosign" {
-	type primary;
-	file "step8.csk-roll.autosign.db";
-	dnssec-policy "csk-roll";
-};
-
-zone "step1.csk-roll2.autosign" {
-	type primary;
-	file "step1.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step2.csk-roll2.autosign" {
-	type primary;
-	file "step2.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step3.csk-roll2.autosign" {
-	type primary;
-	file "step3.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step4.csk-roll2.autosign" {
-	type primary;
-	file "step4.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step5.csk-roll2.autosign" {
-	type primary;
-	file "step5.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step6.csk-roll2.autosign" {
-	type primary;
-	file "step6.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
-zone "step7.csk-roll2.autosign" {
-	type primary;
-	file "step7.csk-roll2.autosign.db";
-	dnssec-policy "csk-roll2";
-};
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "unlimited" {
+	dnskey-ttl 1234;
+
+	keys {
+		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "manual-rollover" {
+	dnskey-ttl 3600;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "multisigner-model2" {
+	dnskey-ttl 3600;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "migrate-to-dnssec-policy" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime P6M algorithm 8;
+		zsk key-directory lifetime P6M algorithm 8;
+	};
+};
+
+dnssec-policy "rsasha256" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime P10Y algorithm 8;
+		zsk key-directory lifetime P5Y  algorithm 8;
+		zsk key-directory lifetime P1Y  algorithm 8 3072;
+	};
+};
+
+dnssec-policy "rsasha512" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime P10Y algorithm 10;
+		zsk key-directory lifetime P5Y  algorithm 10;
+		zsk key-directory lifetime P1Y  algorithm 10 3072;
+	};
+};
+
+dnssec-policy "ecdsa256" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime P10Y algorithm 13;
+		zsk key-directory lifetime P5Y  algorithm 13;
+		zsk key-directory lifetime P1Y  algorithm 13 256;
+	};
+};
+
+dnssec-policy "ecdsa384" {
+	dnskey-ttl 1234;
+
+	keys {
+		ksk key-directory lifetime P10Y algorithm 14;
+		zsk key-directory lifetime P5Y  algorithm 14;
+		zsk key-directory lifetime P1Y  algorithm 14 384;
+	};
+};
+
+dnssec-policy "checkds-ksk" {
+	dnskey-ttl 303;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "checkds-doubleksk" {
+	dnskey-ttl 303;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "checkds-csk" {
+	dnskey-ttl 303;
+
+	keys {
+		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "ttl" {
+	max-zone-ttl 299;
+};
@@ -11,31 +11,7 @@
 * information regarding copyright ownership.
 */

-dnssec-policy "unlimited" {
-	dnskey-ttl 1234;
-
-	keys {
-		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "manual-rollover" {
-	dnskey-ttl 3600;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "multisigner-model2" {
-	dnskey-ttl 3600;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
+include "policies/kasp-fips.conf";

 dnssec-policy "rsasha1" {
 	dnskey-ttl 1234;
@@ -47,15 +23,6 @@ dnssec-policy "rsasha1" {
 	};
 };

-dnssec-policy "migrate-to-dnssec-policy" {
-	dnskey-ttl 1234;
-
-	keys {
-		ksk key-directory lifetime P6M algorithm 5;
-		zsk key-directory lifetime P6M algorithm 5;
-	};
-};
-
 dnssec-policy "rsasha1-nsec3" {
 	dnskey-ttl 1234;

@@ -65,74 +32,3 @@ dnssec-policy "rsasha1-nsec3" {
 		zsk key-directory lifetime P1Y  algorithm 7 2000;
 	};
 };
-
-dnssec-policy "rsasha256" {
-	dnskey-ttl 1234;
-
-	keys {
-		ksk key-directory lifetime P10Y algorithm 8;
-		zsk key-directory lifetime P5Y  algorithm 8;
-		zsk key-directory lifetime P1Y  algorithm 8 2000;
-	};
-};
-
-dnssec-policy "rsasha512" {
-	dnskey-ttl 1234;
-
-	keys {
-		ksk key-directory lifetime P10Y algorithm 10;
-		zsk key-directory lifetime P5Y  algorithm 10;
-		zsk key-directory lifetime P1Y  algorithm 10 2000;
-	};
-};
-
-dnssec-policy "ecdsa256" {
-	dnskey-ttl 1234;
-
-	keys {
-		ksk key-directory lifetime P10Y algorithm 13;
-		zsk key-directory lifetime P5Y  algorithm 13;
-		zsk key-directory lifetime P1Y  algorithm 13 256;
-	};
-};
-
-dnssec-policy "ecdsa384" {
-	dnskey-ttl 1234;
-
-	keys {
-		ksk key-directory lifetime P10Y algorithm 14;
-		zsk key-directory lifetime P5Y  algorithm 14;
-		zsk key-directory lifetime P1Y  algorithm 14 384;
-	};
-};
-
-dnssec-policy "checkds-ksk" {
-	dnskey-ttl 303;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "checkds-doubleksk" {
-	dnskey-ttl 303;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "checkds-csk" {
-	dnskey-ttl 303;
-
-	keys {
-		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-	};
-};
-
-dnssec-policy "ttl" {
-	max-zone-ttl 299;
-};
@@ -42,8 +42,8 @@ U="UNRETENTIVE"
 #
 # Set up zones that will be initially signed.
 #
-for zn in default rsasha1 dnssec-keygen some-keys legacy-keys pregenerated \
-	  rumoured rsasha1-nsec3 rsasha256 rsasha512 ecdsa256 ecdsa384 \
+for zn in default dnssec-keygen some-keys legacy-keys pregenerated \
+	  rumoured rsasha256 rsasha512 ecdsa256 ecdsa384 \
 	  dynamic dynamic-inline-signing inline-signing \
 	  checkds-ksk checkds-doubleksk checkds-csk inherit unlimited \
 	  manual-rollover multisigner-model2
@@ -52,6 +52,22 @@ do
 	cp template.db.in "$zonefile"
 done

+#
+# Set up RSASHA1 based zones
+#
+for zn in rsasha1 rsasha1-nsec3
+do
+	if (cd ..; $SHELL ../testcrypto.sh -q RSASHA1)
+	then
+		setup "${zn}.kasp"
+		cp template.db.in "$zonefile"
+	else
+		# don't add to zones.
+		echo_i "setting up zone: ${zn}.kasp"
+		cp template.db.in "${zn}.kasp.db"
+	fi
+done
+
 if [ -f ../ed25519-supported.file ]; then
 	setup "ed25519.kasp"
 	cp template.db.in "$zonefile"
@@ -78,31 +94,31 @@ done
 # Some of these zones already have keys.
 zone="dnssec-keygen.kasp"
 echo_i "setting up zone: $zone"
-$KEYGEN -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
+$KEYGEN -k rsasha256 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1

 zone="some-keys.kasp"
 echo_i "setting up zone: $zone"
-$KEYGEN -G -a RSASHA1 -b 2000 -L 1234 $zone > keygen.out.$zone.1 2>&1
-$KEYGEN -G -a RSASHA1 -f KSK  -L 1234 $zone > keygen.out.$zone.2 2>&1
+$KEYGEN -G -a RSASHA256 -b 2048 -L 1234 $zone > keygen.out.$zone.1 2>&1
+$KEYGEN -G -a RSASHA256 -f KSK  -L 1234 $zone > keygen.out.$zone.2 2>&1

 zone="legacy-keys.kasp"
 echo_i "setting up zone: $zone"
-ZSK=$($KEYGEN -a RSASHA1 -b 2048 -L 1234 $zone 2> keygen.out.$zone.1)
-KSK=$($KEYGEN -a RSASHA1 -f KSK  -L 1234 $zone 2> keygen.out.$zone.2)
+ZSK=$($KEYGEN -a RSASHA256 -b 2048 -L 1234 $zone 2> keygen.out.$zone.1)
+KSK=$($KEYGEN -a RSASHA256 -f KSK  -L 1234 $zone 2> keygen.out.$zone.2)
 echo $ZSK > legacy-keys.kasp.zsk
 echo $KSK > legacy-keys.kasp.ksk
 # Predecessor keys:
 Tact="now-9mo"
 Tret="now-3mo"
-ZSK=$($KEYGEN -a RSASHA1 -b 2048 -L 1234 $zone 2> keygen.out.$zone.3)
-KSK=$($KEYGEN -a RSASHA1 -f KSK  -L 1234 $zone 2> keygen.out.$zone.4)
+ZSK=$($KEYGEN -a RSASHA256 -b 2048 -L 1234 $zone 2> keygen.out.$zone.3)
+KSK=$($KEYGEN -a RSASHA256 -f KSK  -L 1234 $zone 2> keygen.out.$zone.4)
 $SETTIME -P $Tact -A $Tact -I $Tret -D $Tret "$ZSK"  > settime.out.$zone.1 2>&1
 $SETTIME -P $Tact -A $Tact -I $Tret -D $Tret "$KSK"  > settime.out.$zone.2 2>&1

 zone="pregenerated.kasp"
 echo_i "setting up zone: $zone"
-$KEYGEN -G -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
-$KEYGEN -G -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.2 2>&1
+$KEYGEN -G -k rsasha256 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
+$KEYGEN -G -k rsasha256 -l policies/kasp.conf $zone > keygen.out.$zone.2 2>&1

 zone="multisigner-model2.kasp"
 echo_i "setting up zone: $zone"
@@ -122,9 +138,9 @@ echo_i "setting up zone: $zone"
 Tpub="now"
 Tact="now+1d"
 keytimes="-P ${Tpub} -A ${Tact}"
-KSK=$($KEYGEN  -a RSASHA1 -f KSK  -L 1234 $keytimes $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1 -b 2000 -L 1234 $keytimes $zone 2> keygen.out.$zone.2)
-ZSK2=$($KEYGEN -a RSASHA1         -L 1234 $keytimes $zone 2> keygen.out.$zone.3)
+KSK=$($KEYGEN  -a RSASHA256 -f KSK  -L 1234 $keytimes $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256 -b 3072 -L 1234 $keytimes $zone 2> keygen.out.$zone.2)
+ZSK2=$($KEYGEN -a RSASHA256         -L 1234 $keytimes $zone 2> keygen.out.$zone.3)
 $SETTIME -s -g $O -k $R $Tpub -r $R $Tpub -d $H $Tpub  "$KSK"  > settime.out.$zone.1 2>&1
 $SETTIME -s -g $O -k $R $Tpub -z $R $Tpub              "$ZSK1" > settime.out.$zone.2 2>&1
 $SETTIME -s -g $O -k $R $Tpub -z $R $Tpub              "$ZSK2" > settime.out.$zone.2 2>&1
@@ -75,20 +75,22 @@ view "inherit" {
 	zone "inherit.inherit.signed" {
 		type primary;
 		file "inherit.inherit.signed.db";
+		inline-signing yes;
 	};

 	/* Override dnssec-policy */
 	zone "override.inherit.signed" {
 		type primary;
-		dnssec-policy "default";
 		file "override.inherit.signed.db";
+		inline-signing yes;
+		dnssec-policy "default";
 	};

 	/* Unset dnssec-policy */
 	zone "none.inherit.signed" {
 		type primary;
-		dnssec-policy "none";
 		file "none.inherit.signed.db";
+		dnssec-policy "none";
 	};
 };

@@ -100,20 +102,22 @@ view "override" {
 	zone "inherit.override.signed" {
 		type primary;
 		file "inherit.override.signed.db";
+		inline-signing yes;
 	};

 	/* Override dnssec-policy */
 	zone "override.override.signed" {
 		type primary;
-		dnssec-policy "test";
 		file "override.override.signed.db";
+		inline-signing yes;
+		dnssec-policy "test";
 	};

 	/* Unset dnssec-policy */
 	zone "none.override.signed" {
 		type primary;
-		dnssec-policy "none";
 		file "none.override.signed.db";
+		dnssec-policy "none";
 	};
 };

@@ -130,15 +134,16 @@ view "none" {
 	/* Override dnssec-policy */
 	zone "override.none.signed" {
 		type primary;
-		dnssec-policy "test";
 		file "override.none.signed.db";
+		inline-signing yes;
+		dnssec-policy "test";
 	};

 	/* Unset dnssec-policy */
 	zone "none.none.signed" {
 		type primary;
-		dnssec-policy "none";
 		file "none.none.signed.db";
+		dnssec-policy "none";
 	};
 };

@@ -150,7 +155,6 @@ view "example1" {
 	zone "example.net" {
 		type primary;
 		file "example1.db";
-		// Dynamic zone, inline-signing disabled, policy inerhited.
 	};
 };

@@ -160,7 +164,7 @@ view "example2" {
 	zone "example.net" {
 		type primary;
 		file "example2.db";
-		// Static zone, inline-signing, policy inherited.
+		inline-signing yes;
 	};
 };

@@ -65,15 +65,16 @@ view "inherit" {
 	/* Override dnssec-policy */
 	zone "override.inherit.unsigned" {
 		type primary;
-		dnssec-policy "default";
 		file "override.inherit.unsigned.db";
+		inline-signing yes;
+		dnssec-policy "default";
 	};

 	/* Unset dnssec-policy */
 	zone "none.inherit.unsigned" {
 		type primary;
-		dnssec-policy "none";
 		file "none.inherit.unsigned.db";
+		dnssec-policy "none";
 	};
 };

@@ -85,20 +86,22 @@ view "override" {
 	zone "inherit.override.unsigned" {
 		type primary;
 		file "inherit.override.unsigned.db";
+		inline-signing yes;
 	};

 	/* Override dnssec-policy */
 	zone "override.override.unsigned" {
 		type primary;
-		dnssec-policy "test";
 		file "override.override.unsigned.db";
+		inline-signing yes;
+		dnssec-policy "test";
 	};

 	/* Unset dnssec-policy */
 	zone "none.override.unsigned" {
 		type primary;
-		dnssec-policy "none";
 		file "none.override.unsigned.db";
+		dnssec-policy "none";
 	};
 };

@@ -115,14 +118,15 @@ view "none" {
 	/* Override dnssec-policy */
 	zone "override.none.unsigned" {
 		type primary;
-		dnssec-policy "test";
 		file "override.none.unsigned.db";
+		inline-signing yes;
+		dnssec-policy "test";
 	};

 	/* Unset dnssec-policy */
 	zone "none.none.unsigned" {
 		type primary;
-		dnssec-policy "none";
 		file "none.none.unsigned.db";
+		dnssec-policy "none";
 	};
 };
@@ -42,6 +42,7 @@ controls {
 zone "step1.going-insecure.kasp" {
 	type primary;
 	file "step1.going-insecure.kasp.db";
+	inline-signing yes;
 	dnssec-policy "unsigning";
 };

@@ -55,6 +56,7 @@ zone "step1.going-insecure-dynamic.kasp" {
 zone "step1.going-straight-to-none.kasp" {
 	type primary;
 	file "step1.going-straight-to-none.kasp.db";
+	inline-signing yes;
 	dnssec-policy "default";
 };

@@ -62,12 +64,14 @@ zone "step1.going-straight-to-none.kasp" {
 zone "step1.algorithm-roll.kasp" {
 	type primary;
 	file "step1.algorithm-roll.kasp.db";
-	dnssec-policy "rsasha1";
+	inline-signing yes;
+	dnssec-policy "rsasha256";
 };

 zone "step1.csk-algorithm-roll.kasp" {
 	type primary;
 	file "step1.csk-algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "csk-algoroll";
 };

@@ -79,6 +83,7 @@ dnssec-policy "modified" {

 zone example {
 	type primary;
-	dnssec-policy modified;
 	file "example.db";
+	inline-signing yes;
+	dnssec-policy modified;
 };
@@ -41,12 +41,14 @@ controls {
 zone "step1.going-insecure.kasp" {
        type primary;
        file "step1.going-insecure.kasp.db";
+	inline-signing yes;
        dnssec-policy "insecure";
 };

 zone "step2.going-insecure.kasp" {
        type primary;
        file "step2.going-insecure.kasp.db";
+	inline-signing yes;
        dnssec-policy "insecure";
 };

@@ -76,36 +78,42 @@ zone "step1.going-straight-to-none.kasp" {
 zone "step1.algorithm-roll.kasp" {
 	type primary;
 	file "step1.algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "ecdsa256";
 };

 zone "step2.algorithm-roll.kasp" {
 	type primary;
 	file "step2.algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "ecdsa256";
 };

 zone "step3.algorithm-roll.kasp" {
 	type primary;
 	file "step3.algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "ecdsa256";
 };

 zone "step4.algorithm-roll.kasp" {
 	type primary;
 	file "step4.algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "ecdsa256";
 };

 zone "step5.algorithm-roll.kasp" {
 	type primary;
 	file "step5.algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "ecdsa256";
 };

 zone "step6.algorithm-roll.kasp" {
 	type primary;
 	file "step6.algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "ecdsa256";
 };

@@ -115,36 +123,42 @@ zone "step6.algorithm-roll.kasp" {
 zone "step1.csk-algorithm-roll.kasp" {
 	type primary;
 	file "step1.csk-algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "csk-algoroll";
 };

 zone "step2.csk-algorithm-roll.kasp" {
 	type primary;
 	file "step2.csk-algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "csk-algoroll";
 };

 zone "step3.csk-algorithm-roll.kasp" {
 	type primary;
 	file "step3.csk-algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "csk-algoroll";
 };

 zone "step4.csk-algorithm-roll.kasp" {
 	type primary;
 	file "step4.csk-algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "csk-algoroll";
 };

 zone "step5.csk-algorithm-roll.kasp" {
 	type primary;
 	file "step5.csk-algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "csk-algoroll";
 };

 zone "step6.csk-algorithm-roll.kasp" {
 	type primary;
 	file "step6.csk-algorithm-roll.kasp.db";
+	inline-signing yes;
 	dnssec-policy "csk-algoroll";
 };

@@ -156,6 +170,7 @@ dnssec-policy "modified" {

 zone example {
 	type primary;
-	dnssec-policy modified;
 	file "example.db";
+	inline-signing yes;
+	dnssec-policy modified;
 };
@@ -17,7 +17,7 @@ dnssec-policy "csk-algoroll" {
 	signatures-validity-dnskey 30d;

 	keys {
-		csk lifetime unlimited algorithm rsasha1;
+		csk lifetime unlimited algorithm rsasha256;
 	};

 	dnskey-ttl 1h;
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "unsigning" {
+	dnskey-ttl 7200;
+
+	keys {
+		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+		zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
+	};
+};
+
+dnssec-policy "rsasha256" {
+	signatures-refresh P5D;
+	signatures-validity 30d;
+	signatures-validity-dnskey 30d;
+
+	keys {
+		ksk lifetime unlimited algorithm rsasha256;
+		zsk lifetime unlimited algorithm rsasha256;
+	};
+
+	dnskey-ttl 1h;
+	publish-safety PT1H;
+	retire-safety 2h;
+	zone-propagation-delay 3600;
+	max-zone-ttl 6h;
+	parent-propagation-delay pt1h;
+	parent-ds-ttl 7200;
+};
+
+dnssec-policy "ecdsa256" {
+	signatures-refresh P5D;
+	signatures-validity 30d;
+	signatures-validity-dnskey 30d;
+
+	keys {
+		ksk lifetime unlimited algorithm ecdsa256;
+		zsk lifetime unlimited algorithm ecdsa256;
+	};
+
+	dnskey-ttl 1h;
+	publish-safety PT1H;
+	retire-safety 2h;
+	zone-propagation-delay 3600;
+	max-zone-ttl 6h;
+	parent-propagation-delay pt1h;
+	parent-ds-ttl 7200;
+};
@@ -11,14 +11,7 @@
 * information regarding copyright ownership.
 */

-dnssec-policy "unsigning" {
-	dnskey-ttl 7200;
-
-	keys {
-		ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
-		zsk key-directory lifetime P60D algorithm @DEFAULT_ALGORITHM@;
-	};
-};
+include "policies/kasp-fips.conf";

 dnssec-policy "rsasha1" {
 	signatures-refresh P5D;
@@ -38,22 +31,3 @@ dnssec-policy "rsasha1" {
 	parent-propagation-delay pt1h;
 	parent-ds-ttl 7200;
 };
-
-dnssec-policy "ecdsa256" {
-	signatures-refresh P5D;
-	signatures-validity 30d;
-	signatures-validity-dnskey 30d;
-
-	keys {
-		ksk lifetime unlimited algorithm ecdsa256;
-		zsk lifetime unlimited algorithm ecdsa256;
-	};
-
-	dnskey-ttl 1h;
-	publish-safety PT1H;
-	retire-safety 2h;
-	zone-propagation-delay 3600;
-	max-zone-ttl 6h;
-	parent-propagation-delay pt1h;
-	parent-ds-ttl 7200;
-};
@@ -92,13 +92,13 @@ echo "$zone" >> zones
 TactN="now"
 ksktimes="-P ${TactN} -A ${TactN} -P sync ${TactN}"
 zsktimes="-P ${TactN} -A ${TactN}"
-KSK=$($KEYGEN -a RSASHA1 -L 3600 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
-ZSK=$($KEYGEN -a RSASHA1 -L 3600        $zsktimes $zone 2> keygen.out.$zone.2)
+KSK=$($KEYGEN -a RSASHA256 -L 3600 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
+ZSK=$($KEYGEN -a RSASHA256 -L 3600        $zsktimes $zone 2> keygen.out.$zone.2)
 $SETTIME -s -g $O -k $O $TactN -r $O $TactN -d $O $TactN "$KSK" > settime.out.$zone.1 2>&1
 $SETTIME -s -g $O -k $O $TactN -z $O $TactN              "$ZSK" > settime.out.$zone.2 2>&1
 cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
-private_type_record $zone 5 "$KSK" >> "$infile"
-private_type_record $zone 5 "$ZSK" >> "$infile"
+private_type_record $zone 8 "$KSK" >> "$infile"
+private_type_record $zone 8 "$ZSK" >> "$infile"
 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1

 # Step 2:
@@ -114,8 +114,8 @@ ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I now"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I now"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
 zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1            -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1            -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256          -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256          -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
 KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
 ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600        $zsk2times $zone 2> keygen.out.$zone.4)
 $SETTIME -s -g $H -k $O $TactN  -r $O $TactN  -d $O $TactN  "$KSK1" > settime.out.$zone.1 2>&1
@@ -126,8 +126,8 @@ $SETTIME -s -g $O -k $R $TpubN1 -z $R $TpubN1               "$ZSK2" > settime.ou
 echo "Lifetime: 0" >> "${KSK1}.state"
 echo "Lifetime: 0" >> "${ZSK1}.state"
 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5  "$KSK1" >> "$infile"
-private_type_record $zone 5  "$ZSK1" >> "$infile"
+private_type_record $zone 8  "$KSK1" >> "$infile"
+private_type_record $zone 8  "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
@@ -144,8 +144,8 @@ ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
 zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1            -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1            -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256          -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256          -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
 KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
 ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600        $zsk2times $zone 2> keygen.out.$zone.4)
 $SETTIME -s -g $H -k $O $TactN  -r $O $TactN  -d $O $TactN  "$KSK1" > settime.out.$zone.1 2>&1
@@ -156,8 +156,8 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1               "$ZSK2" > settime.ou
 echo "Lifetime: 0" >> "${KSK1}.state"
 echo "Lifetime: 0" >> "${ZSK1}.state"
 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5  "$KSK1" >> "$infile"
-private_type_record $zone 5  "$ZSK1" >> "$infile"
+private_type_record $zone 8  "$KSK1" >> "$infile"
+private_type_record $zone 8  "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
@@ -175,8 +175,8 @@ ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
 zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1            -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1            -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256          -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256          -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
 KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
 ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600        $zsk2times $zone 2> keygen.out.$zone.4)
 $SETTIME -s -g $H -k $O $TactN  -r $O $TactN  -d $U $TactN1 -D ds $TactN1 "$KSK1" > settime.out.$zone.1 2>&1
@@ -187,8 +187,8 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1                             "$ZSK2
 echo "Lifetime: 0" >> "${KSK1}.state"
 echo "Lifetime: 0" >> "${ZSK1}.state"
 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5  "$KSK1" >> "$infile"
-private_type_record $zone 5  "$ZSK1" >> "$infile"
+private_type_record $zone 8  "$KSK1" >> "$infile"
+private_type_record $zone 8  "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
@@ -207,8 +207,8 @@ ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
 zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1            -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1            -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256          -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256          -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
 KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
 ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600        $zsk2times $zone 2> keygen.out.$zone.4)
 $SETTIME -s -g $H -k $U $TremN  -r $U $TremN  -d $H $TactN1 "$KSK1" > settime.out.$zone.1 2>&1
@@ -219,8 +219,8 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1               "$ZSK2" > settime.ou
 echo "Lifetime: 0" >> "${KSK1}.state"
 echo "Lifetime: 0" >> "${ZSK1}.state"
 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5  "$KSK1" >> "$infile"
-private_type_record $zone 5  "$ZSK1" >> "$infile"
+private_type_record $zone 8  "$KSK1" >> "$infile"
+private_type_record $zone 8  "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
@@ -240,8 +240,8 @@ ksk1times="-P ${TactN}  -A ${TactN}  -P sync ${TactN}  -I ${TretN}"
 zsk1times="-P ${TactN}  -A ${TactN}                    -I ${TretN}"
 ksk2times="-P ${TpubN1} -A ${TpubN1} -P sync ${TsbmN1}"
 zsk2times="-P ${TpubN1} -A ${TpubN1}"
-KSK1=$($KEYGEN -a RSASHA1            -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1            -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
+KSK1=$($KEYGEN -a RSASHA256          -L 3600 -f KSK $ksk1times $zone 2> keygen.out.$zone.1)
+ZSK1=$($KEYGEN -a RSASHA256          -L 3600        $zsk1times $zone 2> keygen.out.$zone.2)
 KSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600 -f KSK $ksk2times $zone 2> keygen.out.$zone.3)
 ZSK2=$($KEYGEN -a $DEFAULT_ALGORITHM -L 3600        $zsk2times $zone 2> keygen.out.$zone.4)
 $SETTIME -s -g $H -k $H $TremN  -r $U $TdeaN  -d $H $TactN1 "$KSK1" > settime.out.$zone.1 2>&1
@@ -252,8 +252,8 @@ $SETTIME -s -g $O -k $O $TpubN1 -z $R $TpubN1               "$ZSK2" > settime.ou
 echo "Lifetime: 0" >> "${KSK1}.state"
 echo "Lifetime: 0" >> "${ZSK1}.state"
 cat template.db.in "${KSK1}.key" "${ZSK1}.key" "${KSK2}.key" "${ZSK2}.key" > "$infile"
-private_type_record $zone 5  "$KSK1" >> "$infile"
-private_type_record $zone 5  "$ZSK1" >> "$infile"
+private_type_record $zone 8  "$KSK1" >> "$infile"
+private_type_record $zone 8  "$ZSK1" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$KSK2" >> "$infile"
 private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$ZSK2" >> "$infile"
 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`example.com. IN DNSKEY 256 3 5 AwEAAaF0z17DdkBAKiYScVNqzsqXw7Vz/Cx5OCw7T/6RnU/KiGv815kl H2obywRZX2ZcEg9R8SUzQiP9ygY0s1xF5IFYi32HsWftNV7V/gNwNrMn GC0gV2e3OawsQ2CYWZZVwObr/fmcKIXuY6eRdJtyOilMRhlvroJdXZw1 CQdicxpZ`
				`@@ -1 +0,0 @@`
				`example.com. IN DNSKEY 257 3 5 AwEAAbuWh5W3eGwixISqPwxszotQ0246KqhUB2Mb6JqNMJd6cWR66IrX YnevpIHsb6oanqJmVzOcJ6Yj3rXOIYtYYXgLbT7EJ8x7BNCZPHxG+w5C 7I1WsDbT6eGf//FLn2c4odKLOXaWCVITeNy61w43IlteIT9Q1egKdt+8 a7X9605j`