experiment

fix some minor code redundancies.

.gitlab-ci.yml

@@ -56,16 +56,6 @@ variables:
   # Some jobs may clean up the build artifacts unless this is set to 0.
   CLEAN_BUILD_ARTIFACTS_ON_SUCCESS: 1
 
-  # DNS Shotgun performance testing defaults
-  SHOTGUN_ROUNDS: 1
-  SHOTGUN_DURATION: 120
-  # allow unlimited improvements against baseline
-  SHOTGUN_EVAL_THRESHOLD_CPU_MIN: '-inf'
-  SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN: '-inf'
-  SHOTGUN_EVAL_THRESHOLD_RCODE_MAX: '+inf'
-  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN: '-inf'
-  SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN: '-inf'
-
 default:
   # Allow all running CI jobs to be automatically canceled when a new
   # version of a branch is pushed.
@@ -117,55 +107,16 @@ stages:
     - runner-manager
     - aarch64
 
-.freebsd-autoscaler-13-amd64-tags: &freebsd_autoscaler_13_amd64_tags
+# Autoscaling GitLab Runner on AWS EC2 (FreeBSD)
+
+.freebsd-stress-amd64: &freebsd_stress_amd64
   tags:
-    - amd64
-    - autoscaler
+    - bsd-stress-test
     - aws
-    - bsd-stress-test-1
+    - autoscaler
     - shell
     - stress-test
-
-.freebsd-autoscaler-14-amd64-tags: &freebsd_autoscaler_14_amd64_tags
-  tags:
     - amd64
-    - autoscaler
-    - aws
-    - bsd-stress-test-2
-    - shell
-    - stress-test
-
-.freebsd-autoscaler-amd64: &freebsd_autoscaler_amd64
-  variables:
-    CC: clang
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    # Even though there's only one job per runtime environment, the GitLab
-    # "instance" executor insists on cloning the Git repository to a path that
-    # contains a variable number from zero to the "maximum concurrent instances
-    # count" allowed on the GitLab Runner. See the "0" directory in this
-    # example path: /home/ec2-user/builds/t1_4FZzvz/0/isc-projects/bind9/.git/.
-    #
-    # This is not a problem for isolated jobs like "stress" tests that depend
-    # on no other jobs. However, it is a problem for jobs that need other jobs'
-    # artifacts. For example, a system test job that has its Git repo cloned to
-    # the "/1/" sub-path will fail if it downloads build job artifacts that
-    # have ./configure output files with "/0/" in its sub-path recorded.
-    GIT_CLONE_PATH: "/home/ec2-user/builds/${CI_PROJECT_PATH}/"
-    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
-    # incompatibility; see https://bugs.freebsd.org/275241.
-    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE} --with-gssapi=/usr/local/bin/krb5-config"
-
-# Autoscaling GitLab Runner on AWS EC2 (FreeBSD 13)
-
-.freebsd-autoscaler-13-amd64: &freebsd_autoscaler_13_amd64
-  <<: *freebsd_autoscaler_amd64
-  <<: *freebsd_autoscaler_13_amd64_tags
-
-# Autoscaling GitLab Runner on AWS EC2 (FreeBSD 14)
-
-.freebsd-autoscaler-14-amd64: &freebsd_autoscaler_14_amd64
-  <<: *freebsd_autoscaler_amd64
-  <<: *freebsd_autoscaler_14_amd64_tags
 
 ### Docker Image Templates
 
@@ -253,6 +204,14 @@ stages:
 
 ### QCOW2 Image Templates
 
+.freebsd-13-amd64: &freebsd_13_amd64_image
+  image: "freebsd-13.4-x86_64"
+  <<: *libvirt_amd64
+
+.freebsd-14-amd64: &freebsd_14_amd64_image
+  image: "freebsd-14.2-x86_64"
+  <<: *libvirt_amd64
+
 .openbsd-amd64: &openbsd_amd64_image
   image: "openbsd-7.6-x86_64"
   <<: *libvirt_amd64
@@ -260,18 +219,31 @@ stages:
 ### Job Templates
 
 .api-pipelines-schedules-tags-triggers-web-triggering-rules: &api_pipelines_schedules_tags_triggers_web_triggering_rules
-  rules:
-    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - api
+    - pipelines
+    - schedules
+    - tags
+    - triggers
+    - web
 
 .api-pipelines-schedules-triggers-web-triggering-rules: &api_pipelines_schedules_triggers_web_triggering_rules
-  rules:
-    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
+  only:
+    - api
+    - pipelines
+    - schedules
+    - triggers
+    - web
 
 .default-triggering-rules: &default_triggering_rules
-  rules:
-    - if: '$CI_PIPELINE_SOURCE =~ /^(api|merge_request_event|pipeline|schedule|trigger|web)$/'
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - api
+    - merge_requests
+    - pipelines
+    - schedules
+    - tags
+    - triggers
+    - web
 
 .precheck: &precheck_job
   <<: *default_triggering_rules
@@ -371,38 +343,18 @@ stages:
 
 .shotgun: &shotgun_job
   <<: *base_image
+  <<: *api_pipelines_schedules_tags_triggers_web_triggering_rules
   stage: performance
-  rules:
-    - &shotgun_rule_mr
-      if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
-      variables:
-        BASELINE: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
-    - &shotgun_rule_tag
-      if: '$CI_COMMIT_TAG != null'
-      variables:
-        SHOTGUN_ROUNDS: 3
-    - &shotgun_rule_other
-      if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
   script:
-    - if [ -z "$BASELINE" ]; then export BASELINE=$BIND_BASELINE_VERSION; fi  # this dotenv variable can't be set in the rules section, because rules are evaluated before any jobs run
+    - if [ -z "$CI_COMMIT_TAG" ]; then export SHOTGUN_ROUNDS=1; else export SHOTGUN_ROUNDS=3; fi
     - PIPELINE_ID=$(curl -s -X POST --fail
         -F "token=$CI_JOB_TOKEN"
         -F ref=main
-        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BASELINE']"
+        -F "variables[SHOTGUN_TEST_VERSION]=['$CI_COMMIT_REF_NAME', '$BIND_BASELINE_VERSION']"
         -F "variables[SHOTGUN_DURATION]=300"
         -F "variables[SHOTGUN_ROUNDS]=$SHOTGUN_ROUNDS"
         -F "variables[SHOTGUN_TRAFFIC_MULTIPLIER]=$SHOTGUN_TRAFFIC_MULTIPLIER"
         -F "variables[SHOTGUN_SCENARIO]=$SHOTGUN_SCENARIO"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MIN]=$SHOTGUN_EVAL_THRESHOLD_CPU_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_CPU_MAX]=$SHOTGUN_EVAL_THRESHOLD_CPU_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX]=$SHOTGUN_EVAL_THRESHOLD_MEMORY_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MIN]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_RCODE_MAX]=$SHOTGUN_EVAL_THRESHOLD_RCODE_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MIN"
-        -F "variables[SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX]=$SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_DRIFT_MAX"
         https://gitlab.isc.org/api/v4/projects/188/trigger/pipeline | jq .id)
     - util/ci-wait-shotgun.py $PIPELINE_ID
   needs:
@@ -559,8 +511,6 @@ misc:
     - if git grep SYSTEMTESTTOP -- ':!.gitlab-ci.yml'; then echo 'Please use relative paths instead of $SYSTEMTESTTOP.'; exit 1; fi
     - bash util/unused-headers.sh
     - bash util/xmllint-html.sh
-    # Check dangling symlinks in the repository
-    - if find . -xtype l | grep .; then exit 1; fi
   needs: []
   artifacts:
     paths:
@@ -669,8 +619,9 @@ danger:
   script:
     - pip install git+https://gitlab.isc.org/isc-projects/hazard.git
     - hazard
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+  only:
+    refs:
+      - merge_requests
 
 checkbashisms:
   <<: *precheck_job
@@ -1338,7 +1289,7 @@ gcc:tsan:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread -ggdb -O2 -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
+    LDFLAGS: "-fsanitize=thread"
     EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
   <<: *tsan_fedora_41_amd64_image
   <<: *build_job
@@ -1367,8 +1318,7 @@ clang:tsan:
   variables:
     CC: "${CLANG}"
     CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
-    # -Wl,--disable-new-dtags ensures that Clang creates valid TSAN reports
-    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
+    LDFLAGS: "-fsanitize=thread"
     EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
 
 system:clang:tsan:
@@ -1447,19 +1397,27 @@ unit:clang:bookworm:amd64:
 # Jobs for Clang builds on FreeBSD 13 (amd64)
 
 clang:freebsd13:amd64:
+  variables:
+    CFLAGS: "${CFLAGS_COMMON}"
+    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
+    # incompatibility; see https://bugs.freebsd.org/275241.
+    EXTRA_CONFIGURE: "${WITH_READLINE_LIBEDIT} --with-gssapi=/usr/local/bin/krb5-config"
+    USER: gitlab-runner
+  <<: *freebsd_13_amd64_image
   <<: *build_job
-  <<: *freebsd_autoscaler_13_amd64
 
 system:clang:freebsd13:amd64:
+  <<: *freebsd_13_amd64_image
   <<: *system_test_job
-  <<: *freebsd_autoscaler_13_amd64
+  variables:
+    USER: gitlab-runner
   needs:
     - job: clang:freebsd13:amd64
       artifacts: true
 
 unit:clang:freebsd13:amd64:
+  <<: *freebsd_13_amd64_image
   <<: *unit_test_job
-  <<: *freebsd_autoscaler_13_amd64
   needs:
     - job: clang:freebsd13:amd64
       artifacts: true
@@ -1467,19 +1425,27 @@ unit:clang:freebsd13:amd64:
 # Jobs for Clang builds on FreeBSD 14 (amd64)
 
 clang:freebsd14:amd64:
+  variables:
+    CFLAGS: "${CFLAGS_COMMON}"
+    # Use MIT Kerberos5 for BIND 9 GSS-API support because of FreeBSD Heimdal
+    # incompatibility; see https://bugs.freebsd.org/275241.
+    EXTRA_CONFIGURE: "${WITH_READLINE_EDITLINE} --with-gssapi=/usr/local/bin/krb5-config"
+    USER: gitlab-runner
+  <<: *freebsd_14_amd64_image
   <<: *build_job
-  <<: *freebsd_autoscaler_14_amd64
 
 system:clang:freebsd14:amd64:
+  <<: *freebsd_14_amd64_image
   <<: *system_test_job
-  <<: *freebsd_autoscaler_14_amd64
+  variables:
+    USER: gitlab-runner
   needs:
     - job: clang:freebsd14:amd64
       artifacts: true
 
 unit:clang:freebsd14:amd64:
+  <<: *freebsd_14_amd64_image
   <<: *unit_test_job
-  <<: *freebsd_autoscaler_14_amd64
   needs:
     - job: clang:freebsd14:amd64
       artifacts: true
@@ -1528,8 +1494,8 @@ release:
       artifacts: true
     - job: docs
       artifacts: true
-  rules:
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - tags
   artifacts:
     paths:
       - "*-release"
@@ -1572,8 +1538,8 @@ sign:
   needs:
     - job: release
       artifacts: true
-  rules:
-    - if: '$CI_COMMIT_TAG != null'
+  only:
+    - tags
   when: manual
   allow_failure: false
 
@@ -1625,8 +1591,10 @@ coverity:
       - cov-int.tar.gz
     expire_in: "1 week"
     when: on_failure
-  rules:
-    - if: '$COVERITY_SCAN_PROJECT_NAME != null && $COVERITY_SCAN_TOKEN != null'
+  only:
+    variables:
+      - $COVERITY_SCAN_PROJECT_NAME
+      - $COVERITY_SCAN_TOKEN
 
 # Respdiff tests
 
@@ -1661,9 +1629,9 @@ respdiff:tsan:
   <<: *default_triggering_rules
   <<: *tsan_debian_bookworm_amd64_image
   variables:
-    CC: "${CLANG}"
-    CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
-    LDFLAGS: "-fsanitize=thread -Wl,--disable-new-dtags"
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
+    LDFLAGS: "-fsanitize=thread"
     EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
     MAX_DISAGREEMENTS_PERCENTAGE: "0.15"
     TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
@@ -1702,28 +1670,24 @@ shotgun:tcp:
   variables:
     SHOTGUN_SCENARIO: tcp
     SHOTGUN_TRAFFIC_MULTIPLIER: 13
+  when: delayed
+  start_in: 5 minutes
 
 shotgun:dot:
   <<: *shotgun_job
   variables:
     SHOTGUN_SCENARIO: dot
     SHOTGUN_TRAFFIC_MULTIPLIER: 6
-  rules: &shotgun_rules_manual_mr
-    - if: '$CI_MERGE_REQUEST_DIFF_BASE_SHA != null'
-      variables:
-        BASELINE: '$CI_MERGE_REQUEST_DIFF_BASE_SHA'
-      when: manual  # don't run on each MR unless requested
-      allow_failure: true
-    - *shotgun_rule_tag
-    - *shotgun_rule_other
+  when: delayed
+  start_in: 5 minutes
 
 shotgun:doh-get:
   <<: *shotgun_job
   variables:
     SHOTGUN_SCENARIO: doh-get
     SHOTGUN_TRAFFIC_MULTIPLIER: 3
-    SHOTGUN_EVAL_THRESHOLD_LATENCY_PCTL_MAX: 0.3  # bump from the default due to increased tail-end jitter
-  rules: *shotgun_rules_manual_mr
+  when: delayed
+  start_in: 5 minutes
 
 .stress-test: &stress_test
   stage: performance
@@ -1762,8 +1726,8 @@ fsck:
     - git clone https://gitlab.isc.org/isc-projects/bind9.git bind9-full-clone
     - cd bind9-full-clone/
     - git fsck
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+  only:
+    - schedules
   needs: []
 
 gcov:
@@ -1815,8 +1779,9 @@ pairwise:
       - pairwise-model.txt
       - pairwise-output.*.txt
     when: on_failure
-  rules:
-    - if: '$PAIRWISE_TESTING != null'
+  only:
+    variables:
+      - $PAIRWISE_TESTING
 
 .post_merge_template: &post_merge
   <<: *base_image

ChangeLog

@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES

bin/check/named-checkconf.c

@@ -761,7 +761,7 @@ cleanup:
 	}
 
 	if (mctx != NULL) {
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}
 
 	return result == ISC_R_SUCCESS ? 0 : 1;

bin/check/named-checkzone.c

@@ -577,7 +577,7 @@ main(int argc, char **argv) {
 		fprintf(errout, "OK\n");
 	}
 	destroy();
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return (result == ISC_R_SUCCESS) ? 0 : 1;
 }

bin/confgen/rndc-confgen.c

@@ -290,7 +290,7 @@ options {\n\
 		isc_mem_stats(mctx, stderr);
 	}
 
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return 0;
 }

bin/confgen/tsig-keygen.c

@@ -296,7 +296,7 @@ nsupdate -k <keyfile>\n");
 		isc_mem_stats(mctx, stderr);
 	}
 
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return 0;
 }

bin/delv/delv.c

@@ -26,12 +26,16 @@
 #include <unistd.h>
 
 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 
 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/hex.h>
 #include <isc/lib.h>
 #include <isc/log.h>
@@ -163,6 +167,10 @@ static dns_fixedname_t qfn;
 /* Default trust anchors */
 static char anchortext[] = TRUST_ANCHORS;
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 /*
  * Static function prototypes
  */
@@ -1611,7 +1619,24 @@ preparse_args(int argc, char **argv) {
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
 			case 'F':
-				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				fips = OSSL_PROVIDER_load(NULL, "fips");
+				if (fips == NULL) {
+					ERR_clear_error();
+					fatal("Failed to load FIPS provider");
+				}
+				base = OSSL_PROVIDER_load(NULL, "base");
+				if (base == NULL) {
+					OSSL_PROVIDER_unload(fips);
+					ERR_clear_error();
+					fatal("Failed to load base provider");
+				}
+#endif
+				/* Already in FIPS mode?  */
+				if (isc_fips_mode()) {
+					break;
+				}
+				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 					fatal("setting FIPS mode failed");
 				}
 				break;
@@ -2284,5 +2309,14 @@ cleanup:
 
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	return 0;
 }

bin/dig/dig.c

@@ -20,8 +20,8 @@
 #include <time.h>
 
 #include <isc/attributes.h>
-#include <isc/crypto.h>
 #include <isc/dir.h>
+#include <isc/fips.h>
 #include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
@@ -73,6 +73,14 @@ static bool short_form = false, printcmd = true, plusquest = false,
 static uint32_t splitwidth = 0xffffffff;
 
 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 
 /*% opcode text */
 static const char *const opcodetext[] = {
@@ -2923,7 +2931,24 @@ preparse_args(int argc, char **argv) {
 				debugging = true;
 				break;
 			case 'F':
-				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				fips = OSSL_PROVIDER_load(NULL, "fips");
+				if (fips == NULL) {
+					ERR_clear_error();
+					fatal("Failed to load FIPS provider");
+				}
+				base = OSSL_PROVIDER_load(NULL, "base");
+				if (base == NULL) {
+					OSSL_PROVIDER_unload(fips);
+					ERR_clear_error();
+					fatal("Failed to load base provider");
+				}
+#endif
+				/* Already in FIPS mode?  */
+				if (isc_fips_mode()) {
+					break;
+				}
+				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 					fatal("setting FIPS mode failed");
 				}
 				break;
@@ -3451,5 +3476,14 @@ main(int argc, char **argv) {
 	dig_startup();
 	dig_shutdown();
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	return exitcode;
 }

bin/dig/nslookup.c

@@ -20,6 +20,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/condition.h>
 #include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>

bin/dnssec/Makefile.am

@@ -41,14 +41,6 @@ dnssec_keygen_LDADD =		\
 	$(LDADD)		\
 	$(OPENSSL_LIBS)
 
-dnssec_ksr_CPPFLAGS=		\
-	$(AM_CPPFLAGS)		\
-	$(OPENSSL_CFLAGS)
-
-dnssec_ksr_LDADD =		\
-	$(LDADD)		\
-	$(OPENSSL_LIBS)
-
 dnssec_signzone_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
 	$(OPENSSL_CFLAGS)

bin/dnssec/dnssec-cds.c

@@ -1075,7 +1075,7 @@ cleanup(void) {
 		if (print_mem_stats && verbose > 10) {
 			isc_mem_stats(mctx, stdout);
 		}
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}
 }
 

bin/dnssec/dnssec-dsfromkey.c

@@ -543,7 +543,7 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	fflush(stdout);
 	if (ferror(stdout)) {

bin/dnssec/dnssec-importkey.c

@@ -456,7 +456,7 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	fflush(stdout);
 	if (ferror(stdout)) {

bin/dnssec/dnssec-keyfromlabel.c

@@ -746,7 +746,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, label);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	if (freeit != NULL) {
 		free(freeit);

bin/dnssec/dnssec-keygen.c

@@ -38,7 +38,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -58,6 +58,11 @@
 
 #include <dst/dst.h>
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
 #include "dnssectool.h"
 
 const char *program = "dnssec-keygen";
@@ -146,7 +151,7 @@ usage(void) {
 	fprintf(stderr, "    -l <file>: configuration file with dnssec-policy "
 			"statement\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	}
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
@@ -154,7 +159,7 @@ usage(void) {
 	fprintf(stderr, "        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1:\t[%d..%d]\n", min_rsa,
 			MAX_RSA);
 		fprintf(stderr, "        NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
@@ -283,7 +288,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			fatal("unsupported algorithm: %s", algstr);
 		}
 
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			/* verify only in FIPS mode */
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
@@ -336,7 +341,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
 			case DST_ALG_NSEC3RSASHA1:
-				if (isc_crypto_fips_mode()) {
+				if (isc_fips_mode()) {
 					fatal("key size not specified (-b "
 					      "option)");
 				}
@@ -496,7 +501,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			fatal("SHA1 based keys not supported in FIPS mode");
 		}
 		FALLTHROUGH;
@@ -842,6 +847,10 @@ main(int argc, char **argv) {
 	isc_textregion_t r;
 	unsigned char c;
 	int ch;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 
 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
@@ -1100,9 +1109,7 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
@@ -1129,11 +1136,32 @@ main(int argc, char **argv) {
 		ctx.quiet = true;
 	}
 
+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	/*
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}
 
@@ -1280,8 +1308,16 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
 	if (freeit != NULL) {
 		free(freeit);
 	}

bin/dnssec/dnssec-ksr.c

@@ -18,7 +18,7 @@
 
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/lex.h>
 #include <isc/lib.h>
 #include <isc/mem.h>
@@ -362,7 +362,7 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	switch (ksr->alg) {
 	case DST_ALG_RSASHA1:
 	case DST_ALG_NSEC3RSASHA1:
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			/* verify-only in FIPS mode */
 			fatal("unsupported algorithm: %s", algstr);
 		}
@@ -1348,6 +1348,10 @@ main(int argc, char *argv[]) {
 	isc_buffer_t buf;
 	int ch;
 	char *endp;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 	ksr_ctx_t ksr = {
 		.now = isc_stdtime_now(),
 	};
@@ -1367,9 +1371,7 @@ main(int argc, char *argv[]) {
 					    ksr.now, &ksr.setend);
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 		case 'f':
 			ksr.file = isc_commandline_argument;
@@ -1423,12 +1425,31 @@ main(int argc, char *argv[]) {
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}
 
 	setup_logging();
 
+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	/* zone */
 	namestr = argv[1];
 	name = dns_fixedname_initname(&fname);

bin/dnssec/dnssec-revoke.c

@@ -248,7 +248,7 @@ cleanup:
 	if (dir != NULL) {
 		isc_mem_free(mctx, dir);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return 0;
 }

bin/dnssec/dnssec-settime.c

@@ -949,7 +949,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, directory);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return 0;
 }

bin/dnssec/dnssec-signzone.c

@@ -42,6 +42,7 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/lib.h>
@@ -89,6 +90,10 @@
 #include <dns/zoneverify.h>
 
 #include <dst/dst.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 
 #include "dnssectool.h"
 
@@ -3375,6 +3380,10 @@ main(int argc, char *argv[]) {
 	bool set_optout = false;
 	bool set_iter = false;
 	bool nonsecify = false;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 
 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);
@@ -3663,9 +3672,7 @@ main(int argc, char *argv[]) {
 			break;
 
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 
 		case '?':
@@ -3736,6 +3743,27 @@ main(int argc, char *argv[]) {
 
 	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);
 
+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	setup_logging();
 
 	argc -= isc_commandline_index;
@@ -4107,6 +4135,15 @@ main(int argc, char *argv[]) {
 		isc_mem_stats(mctx, stdout);
 	}
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);
 
 	if (printstats) {

bin/dnssec/dnssec-verify.c

@@ -330,7 +330,7 @@ main(int argc, char *argv[]) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return result == ISC_R_SUCCESS ? 0 : 1;
 }

bin/named/fuzz.c

@@ -25,6 +25,7 @@
 #include <string.h>
 #include <unistd.h>
 
+#include <isc/condition.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>

bin/named/include/named/globals.h

@@ -86,6 +86,7 @@ EXTERN named_server_t *named_g_server INIT(NULL);
 /*
  * Logging.
  */
+EXTERN bool named_g_logging	       INIT(false);
 EXTERN unsigned int named_g_debuglevel INIT(0);
 
 /*

bin/named/log.c

@@ -52,6 +52,8 @@ named_log_init(bool safe) {
 	named_log_setdefaultsslkeylogfile(lcfg);
 	rcu_read_unlock();
 
+	named_g_logging = true;
+
 	return ISC_R_SUCCESS;
 
 cleanup:

bin/named/main.c

@@ -30,6 +30,7 @@
 #include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
 #include <isc/lib.h>
@@ -90,6 +91,10 @@
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/parser.h>
 #include <libxml/xmlversion.h>
@@ -150,13 +155,24 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 void
 named_main_earlywarning(const char *format, ...) {
 	va_list args;
 
 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_WARNING, format, args);
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_WARNING, format, args);
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);
 }
 
@@ -165,10 +181,18 @@ named_main_earlyfatal(const char *format, ...) {
 	va_list args;
 
 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to early fatal error)");
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to early fatal error)");
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);
 
 	_exit(EXIT_FAILURE);
@@ -185,19 +209,26 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	 * Handle assertion failures.
 	 */
 
-	/*
-	 * Reset the assertion callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_assertion_setcallback(NULL);
+	if (named_g_logging) {
+		/*
+		 * Reset the assertion callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_assertion_setcallback(NULL);
 
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file, line,
-		      isc_assertion_typetotext(type), cond);
-	isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			  ISC_LOG_CRITICAL);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to assertion failure)");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file,
+			      line, isc_assertion_typetotext(type), cond);
+		isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL,
+				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to assertion failure)");
+	} else {
+		fprintf(stderr, "%s:%d: %s(%s) failed\n", file, line,
+			isc_assertion_typetotext(type), cond);
+		fflush(stderr);
+	}
 
 	if (named_g_coreok) {
 		abort();
@@ -216,20 +247,27 @@ library_fatal_error(const char *file, int line, const char *func,
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */
 
-	/*
-	 * Reset the error callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_error_setfatal(NULL);
+	if (named_g_logging) {
+		/*
+		 * Reset the error callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_error_setfatal(NULL);
 
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d:%s(): fatal error: ", file, line,
-		      func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL,
-		      "exiting (due to fatal error in library)");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "%s:%d:%s(): fatal error: ", file, line, func);
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to fatal error in library)");
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 
 	if (named_g_coreok) {
 		abort();
@@ -249,11 +287,19 @@ library_unexpected_error(const char *file, int line, const char *func,
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */
 
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_ERROR, "%s:%d:%s(): unexpected error: ", file,
-		      line, func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_ERROR, format, args);
+	if (named_g_logging) {
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_ERROR,
+			      "%s:%d:%s(): unexpected error: ", file, line,
+			      func);
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_ERROR, format, args);
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 }
 
 static void
@@ -906,7 +952,25 @@ parse_command_line(int argc, char *argv[]) {
 			named_main_earlyfatal("option '-X' has been removed");
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+			fips = OSSL_PROVIDER_load(NULL, "fips");
+			if (fips == NULL) {
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load FIPS provider");
+			}
+			base = OSSL_PROVIDER_load(NULL, "base");
+			if (base == NULL) {
+				OSSL_PROVIDER_unload(fips);
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load base provider");
+			}
+#endif
+			if (isc_fips_mode()) { /* Already in FIPS mode. */
+				break;
+			}
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 				named_main_earlyfatal(
 					"setting FIPS mode failed");
 			}
@@ -1510,6 +1574,15 @@ main(int argc, char *argv[]) {
 
 	named_os_shutdown();
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */

bin/named/server.c

@@ -38,6 +38,7 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
 #include <isc/hmac.h>
@@ -9376,7 +9377,7 @@ view_loaded(void *arg) {
 
 		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_NOTICE, "FIPS mode is %s",
-			      isc_crypto_fips_mode() ? "enabled" : "disabled");
+			      isc_fips_mode() ? "enabled" : "disabled");
 
 #if HAVE_LIBSYSTEMD
 		sd_notifyf(0,

bin/named/statschannel.c

@@ -1617,13 +1617,9 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			TRY0(xmlTextWriterWriteString(writer,
-						      ISC_XMLCHAR addr_buf));
-		} else {
-			TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
 	}
@@ -2675,15 +2671,10 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			json_object_object_add(
-				xfrinobj, "remoteaddr",
-				json_object_new_string(addr_buf));
-		} else {
-			json_object_object_add(xfrinobj, "remoteaddr",
-					       json_object_new_string("-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		json_object_object_add(xfrinobj, "remoteaddr",
+				       json_object_new_string(addr_buf));
 	} else {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string("-"));

bin/tests/system/feature-test.c

@@ -23,7 +23,7 @@
 #include <openssl/provider.h>
 #endif
 
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/lib.h>
 #include <isc/md.h>
 #include <isc/mem.h>
@@ -134,7 +134,7 @@ main(int argc, char **argv) {
 		return 1;
 #endif
 #else
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
 			return 0;
 #else
@@ -149,7 +149,7 @@ main(int argc, char **argv) {
 #if defined(ENABLE_FIPS_MODE)
 		return 0;
 #else
-		return isc_crypto_fips_mode() ? 0 : 1;
+		return isc_fips_mode() ? 0 : 1;
 #endif
 	}
 

bin/tests/system/makejournal.c

@@ -111,7 +111,7 @@ cleanup:
 	}
 
 	if (mctx != NULL) {
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}
 
 	return result != ISC_R_SUCCESS ? 1 : 0;

bin/tests/system/rpzextra/tests_rpzextra.py

@@ -102,23 +102,6 @@ def test_rpz_passthru_logging():
         dns.rrset.from_text("allowed.", 300, "IN", "A", "10.53.0.2")
     ]
 
-    # Should also generate a log entry into rpz_passthru.txt
-    msg_allowed_any = dns.message.make_query("allowed.", "ANY")
-    res_allowed_any = isctest.query.udp(
-        msg_allowed_any,
-        resolver_ip,
-        source="10.53.0.1",
-        expected_rcode=dns.rcode.NOERROR,
-    )
-    assert res_allowed_any.answer == [
-        dns.rrset.from_text("allowed.", 300, "IN", "NS", "ns1.allowed."),
-        dns.rrset.from_text("allowed.", 300, "IN", "A", "10.53.0.2"),
-    ]
-    # The comparison above doesn't compare the TTL values, and we want to
-    # make sure that the "passthru" rpz doesn't cap the TTL with max-policy-ttl.
-    assert res_allowed_any.answer[0].ttl > 200
-    assert res_allowed_any.answer[1].ttl > 200
-
     # baddomain.com isn't allowed (CNAME .), should return NXDOMAIN
     # Should generate a log entry into rpz.txt
     msg_not_allowed = dns.message.make_query("baddomain.", "A")

bin/tests/system/rsabigexponent/bigkey.c

@@ -140,7 +140,7 @@ main(int argc, char **argv) {
 	printf("%s\n", filename);
 	dst_key_free(&key);
 
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 	return 0;
 }
 

bin/tests/system/start.pl

@@ -234,7 +234,7 @@ sub construct_ns_command {
 		$command = "taskset $taskset $NAMED ";
 	} elsif ($ENV{'USE_RR'}) {
 		$ENV{'_RR_TRACE_DIR'} = ".";
-		$command = "$ENV{'TOP_BUILDDIR'}/libtool --mode=execute rr record --chaos $NAMED ";
+		$command = "rr record --chaos $NAMED ";
 	} else {
 		$command = "$NAMED ";
 	}

bin/tests/wire_test.c

@@ -260,7 +260,7 @@ main(int argc, char *argv[]) {
 	if (printmemstats) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return 0;
 }

bin/tools/dnstap-read.c

@@ -425,7 +425,7 @@ cleanup:
 	if (message != NULL) {
 		dns_message_detach(&message);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	exit(rv);
 }

bin/tools/named-rrchecker.c

@@ -61,7 +61,7 @@ cleanup(void) {
 		isc_lex_destroy(&lex);
 	}
 	if (mctx != NULL) {
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}
 }
 

configure.ac

@@ -17,7 +17,7 @@
 m4_define([bind_VERSION_MAJOR], 9)dnl
 m4_define([bind_VERSION_MINOR], 21)dnl
 m4_define([bind_VERSION_PATCH], 6)dnl
-m4_define([bind_VERSION_EXTRA], )dnl
+m4_define([bind_VERSION_EXTRA], -dev)dnl
 m4_define([bind_DESCRIPTION], [(Development Release)])dnl
 m4_define([bind_SRCID], [m4_esyscmd_s([git rev-parse --short HEAD | cut -b1-7])])dnl
 m4_define([bind_PKG_VERSION], [[bind_VERSION_MAJOR.bind_VERSION_MINOR.bind_VERSION_PATCH]bind_VERSION_EXTRA])dnl
@@ -886,6 +886,31 @@ AC_CHECK_HEADERS([execinfo.h],
 		 [AC_SEARCH_LIBS([backtrace_symbols], [execinfo],
 				 [AC_CHECK_FUNCS([backtrace_symbols])])])
 
+#
+# We do the IPv6 compilation checking after libtool so that we can put
+# the right suffix on the files.
+#
+AC_MSG_CHECKING([for IPv6 structures])
+AC_COMPILE_IFELSE(
+  [AC_LANG_PROGRAM(
+     [[
+       #include <sys/types.h>
+       #include <sys/socket.h>
+       #include <netinet/in.h>
+     ]],
+     [[
+       struct sockaddr_in6 sin6;
+       struct in6_addr in6;
+       struct in6_pktinfo in6_pi;
+       struct sockaddr_storage storage;
+       in6 = in6addr_any;
+       in6 = in6addr_loopback;
+       sin6.sin6_scope_id = 0;
+       return (0);
+     ]])],
+  [AC_MSG_RESULT([yes])],
+  [AC_MSG_FAILURE([IPv6 support is mandatory])])
+
 #
 # Allow forcibly disabling TCP Fast Open support as autodetection might yield
 # confusing results on some systems (e.g. FreeBSD; see set_tcp_fastopen()

doc/arm/changelog.rst

@@ -18,7 +18,6 @@ Changelog
    development. Regular users should refer to :ref:`Release Notes <relnotes>`
    for changes relevant to them.
 
-.. include:: ../changelog/changelog-9.21.6.rst
 .. include:: ../changelog/changelog-9.21.5.rst
 .. include:: ../changelog/changelog-9.21.4.rst
 .. include:: ../changelog/changelog-9.21.3.rst

doc/arm/notes.rst

@@ -47,7 +47,6 @@ The list of known issues affecting the latest version in the 9.21 branch can be
 found at
 https://gitlab.isc.org/isc-projects/bind9/-/wikis/Known-Issues-in-BIND-9.21
 
-.. include:: ../notes/notes-9.21.6.rst
 .. include:: ../notes/notes-9.21.5.rst
 .. include:: ../notes/notes-9.21.4.rst
 .. include:: ../notes/notes-9.21.3.rst

doc/changelog/changelog-9.21.6.rst

@@ -1,478 +0,0 @@
-.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-..
-.. SPDX-License-Identifier: MPL-2.0
-..
-.. This Source Code Form is subject to the terms of the Mozilla Public
-.. License, v. 2.0.  If a copy of the MPL was not distributed with this
-.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
-..
-.. See the COPYRIGHT file distributed with this work for additional
-.. information regarding copyright ownership.
-
-BIND 9.21.6
------------
-
-New Features
-~~~~~~~~~~~~
-
-- Implement the min-transfer-rate-in configuration option.
-  ``a282f1ba3f``
-
-  A new option 'min-transfer-rate-in <bytes> <minutes>' has been added
-  to the view and zone configurations. It can abort incoming zone
-  transfers which run very slowly due to network related issues, for
-  example. The default value is set to 10240 bytes in 5 minutes.
-  :gl:`#3914` :gl:`!9098`
-
-- Add digest methods for SIG and RRSIG. ``fd48df20f3``
-
-  ZONEMD digests RRSIG records and potentially digests SIG record. Add
-  digests methods for both record types. :gl:`#5219` :gl:`!10217`
-
-- Add HTTPS record query to host command line tool. ``d34414c47b``
-
-  The host command was extended to also query for the HTTPS RR type by
-  default. :gl:`!8642`
-
-Removed Features
-~~~~~~~~~~~~~~~~
-
-- Clean up unnecessary code in qpcache. ``74c9ff384e``
-
-  Removed some code from the cache database implementation that was left
-  over from before it and the zone database implementation were
-  separated. :gl:`!9991`
-
-- Cleanup isc/util.h header and friends. ``239712df16``
-
-  Cleanup short list macros from <isc/util.h>, remove two unused
-  headers, move locking macros to respective headers and use only the
-  C11 static assertion. :gl:`!10196`
-
-- Remove check for the mandatory IPv6 support. ``daa9c17905``
-
-  IPv6 Advanced Socket API (:rfc:`3542`) is a hard requirement, remove
-  the autoconf check to speed up the ./configure run a little bit.
-  :gl:`!10201`
-
-- Remove log initialization checks from named. ``1b3e7f52ec``
-
-  Logging initialization check is now redundant as there is a default
-  global log context created during libisc's constructor.
-
-  `isc_log` calls can safely be made at any time outside libisc's
-  constructor. :gl:`!10186`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- Refactor and simplify isc_symtab. ``5559539eb0``
-
-  This commit does several changes to isc_symtab:
-
-  1. Rewrite the isc_symtab to internally use isc_hashmap instead of
-  hand-stiched hashtable.
-
-  2. Create a new isc_symtab_define_and_return() api, which returns
-  the already defined symvalue on ISC_R_EXISTS; this allows users    of
-  the API to skip the isc_symtab_lookup()+isc_symtab_define()    calls
-  and directly call isc_symtab_define_and_return().
-
-  3. Merge isccc_symtab into isc_symtab - the only missing function
-  was isccc_symtab_foreach() that was merged into isc_symtab API.
-
-  4. Add full set of unit tests for the isc_symtab API. :gl:`#5103`
-  :gl:`!9921`
-
-- Drop malformed notify messages early instead of decompressing them.
-  ``7fce7707db``
-
-  The DNS header shows if a message has multiple questions or invalid
-  NOTIFY sections. We can drop these messages early, right after parsing
-  the question. This matches RFC 9619 for multi-question messages and
-  Unbound's handling of NOTIFY. We still parse the question to include
-  it in our FORMERR response.
-
-  Add drop_msg_early() function to check for these conditions: -
-  Messages with more than one question, as required by RFC 9619 - NOTIFY
-  query messages containing answer sections (like Unbound) - NOTIFY
-  messages containing authority sections (like Unbound) :gl:`#5158`,
-  #3656 :gl:`!10056`
-
-- Cleanup parts of the isc_mem API. ``4ba1ccfa2e``
-
-  This MR changes custom attach/detach implementation with refcount
-  macros, replaces isc_mem_destroy() with isc_mem_detach(), and does
-  various small cleanups. :gl:`!9456`
-
-- Move the library initialization and shutdown to executables.
-  ``6e0c1f151c``
-
-  Instead of relying on unreliable order of execution of the library
-  constructors and destructors, move them to individual binaries.  The
-  advantage is that the execution time and order will remain constant
-  and will not depend on the dynamic load dependency solver.
-  :gl:`!10069`
-
-- Reduce memory used to store DNS names. ``24db1b1a8a``
-
-  The memory used to internally store the DNS names has been reduced.
-  :gl:`!10140`
-
-- Unify fips handling to isc_crypto and make the toggle one way.
-  ``3de629d6b7``
-
-  Since algorithm fetching is handled purely in libisc, FIPS mode
-  toggling can be purely done in within the library instead of provider
-  fetching in the binary for OpenSSL >=3.0.
-
-  Disabling FIPS mode isn't a realistic requirement and isn't done
-  anywhere in the codebase. Make the FIPS mode toggle enable-only to
-  reflect the situation. :gl:`!9920`
-
-Bug Fixes
-~~~~~~~~~
-
-- Prevent a reference leak when using plugins. ``5604d3a44e``
-
-  The `NS_QUERY_DONE_BEGIN` and `NS_QUERY_DONE_SEND` plugin hooks could
-  cause a reference leak if they returned `NS_HOOK_RETURN` without
-  cleaning up the query context properly. :gl:`#2094` :gl:`!9971`
-
-- Fix isc_quota bug. ``742d379d88``
-
-  Running jobs which were entered into the isc_quota queue is the
-  responsibility of the isc_quota_release() function, which, when
-  releasing a previously acquired quota, checks whether the queue is
-  empty, and if it's not, it runs a job from the queue without touching
-  the 'quota->used' counter. This mechanism is susceptible to a possible
-  hangup of a newly queued job in case when between the time a decision
-  has been made to queue it (because used >= max) and the time it was
-  actually queued, the last quota was released. Since there is no more
-  quotas to be released (unless arriving in the future), the newly
-  entered job will be stuck in the queue.
-
-  Fix the issue by adding checks in both isc_quota_release() and
-  isc_quota_acquire_cb() to make sure that the described hangup does not
-  happen. Also see code comments. :gl:`#4965` :gl:`!10082`
-
-- Fix dual-stack-servers configuration option. ``6af708f3b0``
-
-  The dual-stack-servers configuration option was not working as
-  expected; the specified servers were not being used when they should
-  have been, leading to resolution failures. This has been fixed.
-  :gl:`#5019` :gl:`!9708`
-
-- Implement sig0key-checks-limit and sig0message-checks-limit.
-  ``d78ebff861``
-
-  Previously a hard-coded limitation of maximum two key or message
-  verification checks were introduced when checking the message's SIG(0)
-  signature. It was done in order to protect against possible DoS
-  attacks. The logic behind choosing the number 2 was that more than a
-  single key should only be required during key rotations, and in that
-  case two keys are enough. But later it became apparent that there are
-  other use cases too where even more keys are required, see issue
-  number #5050 in GitLab.
-
-  This change introduces two new configuration options for the views,
-  `sig0key-checks-limit` and `sig0message-checks-limit`, which define
-  how many keys are allowed to be checked to find a matching key, and
-  how many message verifications are allowed to take place once a
-  matching key has been found. The latter protects against expensive
-  cryptographic operations when there are keys with colliding tags and
-  algorithm numbers, with default being 2, and the former protects
-  against a bit less expensive key parsing operations and defaults to
-  16. :gl:`#5050` :gl:`!9967`
-
-- Fix the data race causing a permanent active client increase.
-  ``479c366c2b``
-
-  Previously, a data race could cause a newly created fetch context for
-  a new client to be used before it had been fully initialized, which
-  would cause the query to become stuck; queries for the same data would
-  be either paused indefinitely or dropped because of the
-  `clients-per-query` limit. This has been fixed. :gl:`#5053`
-  :gl:`!10146`
-
-- Fix deferred validation of unsigned DS and DNSKEY records.
-  ``ebf1606f38``
-
-  When processing a query with the "checking disabled" bit set (CD=1),
-  `named` stores the unvalidated result in the cache, marked "pending".
-  When the same query is sent with CD=0, the cached data is validated,
-  and either accepted as an answer, or ejected from the cache as
-  invalid. This deferred validation was not attempted for DS and DNSKEY
-  records if they had no cached signatures, causing spurious validation
-  failures. We now complete the deferred validation in this scenario.
-
-  Also, if deferred validation fails, we now re-query the data to find
-  out whether the zone has been corrected since the invalid data was
-  cached. :gl:`#5066` :gl:`!10104`
-
-- When recording an rr trace, use libtool. ``6320586df0``
-
-  When a system test is run with the `USE_RR` environment variable set
-  to 1, an `rr` trace is now correctly generated for each instance of
-  `named`. :gl:`#5079` :gl:`!10197`
-
-- Do not cache signatures for rejected data. ``fc3a4d6f89``
-
-  The cache has been updated so that if new data is rejected - for
-  example, because there was already existing data at a higher trust
-  level - then its covering RRSIG will also be rejected. :gl:`#5132`
-  :gl:`!9999`
-
-- Fix wrong logging severity in do_nsfetch() ``1f6a16e6d0``
-
-  ISC_LOG_WARNING was used while ISC_LOG_DEBUG(3) was implied.
-  :gl:`#5145` :gl:`!10017`
-
-- Fix RPZ race condition during a reconfiguration. ``5ba811bea2``
-
-  With RPZ in use, `named` could terminate unexpectedly because of a
-  race condition when a reconfiguration command was received using
-  `rndc`. This has been fixed. :gl:`#5146` :gl:`!10079`
-
-- "CNAME and other data check" not applied to all types. ``b694acbe45``
-
-  An incorrect optimization caused "CNAME and other data" errors not to
-  be detected if certain types were at the same node as a CNAME.  This
-  has been fixed. :gl:`#5150` :gl:`!10033`
-
-- Use named Service Parameter Keys (SvcParamKeys) by default.
-  ``3f61a87be3``
-
-  When converting SVCB records to text representation `named` now uses
-  named `SvcParamKeys` values unless backward-compatible mode is
-  activated, in which case the values which were not defined initially
-  in RFC9460 and were added later (see [1]) are converted to opaque
-  "keyNNNN" syntax, like, for example, "key7" instead of "dohpath".
-
-  Also a new `+[no]svcparamkeycompat` option is implemented for `dig`,
-  which enables the backward-compatible mode and uses the opaque syntax,
-  if required for interoperability with other software or scripts. By
-  default, the compatibility mode is disabled.
-
-  [1] https://www.iana.org/assignments/dns-svcb/dns-svcb.xhtml
-  :gl:`#5156` :gl:`!10085`
-
-- Relax private DNSKEY and RRSIG constraints. ``1bc7016d7a``
-
-  DNSKEY, KEY, RRSIG and SIG constraints have been relaxed to allow
-  empty key and signature material after the algorithm identifier for
-  PRIVATEOID and PRIVATEDNS. It is arguable whether this falls within
-  the expected use of these types as no key material is shared and the
-  signatures are ineffective but these are private algorithms and they
-  can be totally insecure. :gl:`#5167` :gl:`!10083`
-
-- Delete dead nodes when committing a new version. ``67255da4b3``
-
-  In the qpzone implementation of `dns_db_closeversion()`, if there are
-  changed nodes that have no remaining data, delete them. :gl:`#5169`
-  :gl:`!10089`
-
-- Revert "Delete dead nodes when committing a new version"
-  ``b652d5327c``
-
-  This reverts commit 67255da4b376f65138b299dcd5eb6a3b7f9735a9,
-  reversing changes made to 74c9ff384e695d1b27fa365d1fee84576f869d4c.
-  :gl:`#5169` :gl:`!10224`
-
-- Fix dns_qp_insert() checks in qpzone. ``d6b63210a8``
-
-  Remove code in the QP zone database to handle failures of
-  `dns_qp_insert()` which can't actually happen. :gl:`#5171`
-  :gl:`!10088`
-
-- Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse.
-  ``f0785fedf1``
-
-  Previously, when parsing responses, named incorrectly rejected
-  responses without matching RRSIG records for NSEC/DS/NSEC3 records in
-  the authority section. This rejection, if appropriate, should have
-  been left for the validator to determine and has been fixed.
-  :gl:`#5185` :gl:`!10125`
-
-- Fix TTL issue with ANY queries processed through RPZ "passthru"
-  ``23c1fbc609``
-
-  Answers to an "ANY" query which were processed by the RPZ "passthru"
-  policy had the response-policy's `max-policy-ttl` value unexpectedly
-  applied. This has been fixed. :gl:`#5187` :gl:`!10176`
-
-- Save time when creating a slab from another slab. ``cf981ab13b``
-
-  The `dns_rdataslab_fromrdataset()` function creates a slab from an
-  rdataset. If the source rdataset already uses a slab, then no
-  processing is necessary; we can just copy the existing slab to a new
-  location. :gl:`#5188` :gl:`!10162`
-
-- Dnssec-signzone needs to check for a NULL key when setting offline.
-  ``26f8ee7229``
-
-  dnssec-signzone could dereference a NULL key pointer when resigning a
-  zone.  This has been fixed. :gl:`#5192` :gl:`!10161`
-
-- Acquire the database reference before possibly last node release.
-  ``c4868b5bd9``
-
-  Acquire the database reference in the detachnode() to prevent the last
-  reference to be release while the NODE_LOCK being locked.  The
-  NODE_LOCK is locked/unlocked inside the RCU critical section, thus it
-  is most probably this should not pose a problem as the database uses
-  call_rcu memory reclamation, but this it is still safer to acquire the
-  reference before releasing the node. :gl:`#5194` :gl:`!10155`
-
-- Fix a logic error in cache_name() ``02ef8ff01c``
-
-  A change in 6aba56ae8 (checking whether a rejected RRset was identical
-  to the data it would have replaced, so that we could still cache a
-  signature) inadvertently introduced cases where processing of a
-  response would continue when previously it would have been skipped.
-  :gl:`#5197` :gl:`!10157`
-
-- Fix a bug in the statistics channel when querying zone transfers
-  information. ``e02d73e7e3``
-
-  When querying zone transfers information from the statistics channel
-  there was a rare possibility that `named` could terminate unexpectedly
-  if a zone transfer was in a state when transferring from all the
-  available primary servers had failed earlier. This has been fixed.
-  :gl:`#5198` :gl:`!10182`
-
-- Fix assertion failure when dumping recursing clients. ``796b662b92``
-
-  Previously, if a new counter was added to the hashtable while dumping
-  recursing clients via the `rndc recursing` command, and
-  `fetches-per-zone` was enabled, an assertion failure could occur. This
-  has been fixed. :gl:`#5200` :gl:`!10164`
-
-- Validating ADB fetches could cause a crash in import_rdataset()
-  ``49ccbe857a``
-
-  Previously, in some cases, the resolver could return rdatasets of type
-  CNAME or DNAME without the result code being set to `DNS_R_CNAME` or
-  `DNS_R_DNAME`. This could trigger an assertion failure in the ADB. The
-  resolver error has been fixed. :gl:`#5201` :gl:`!10172`
-
-- Call isc__iterated_hash_initialize in isc__work_cb. ``f3458fdf43``
-
-  isc_iterated_hash didn't work in offloaded threads as the per thread
-  initialisation has not been done.  This has been fixed. :gl:`#5214`
-  :gl:`!10206`
-
-- Fix a bug in get_request_transport_type() ``db5166ab99``
-
-  When `dns_remote_done()` is true, calling `dns_remote_curraddr()`
-  asserts. Add a `dns_remote_curraddr()` check before calling
-  `dns_remote_curraddr()`. :gl:`#5215` :gl:`!10222`
-
-- Clean up dns_rdataslab module. ``948f8d7a98``
-
-  Rdata slabs used in the QP databases are usually prepended with a slab
-  header, but are sometimes "raw", containing only the rdata and no
-  header. Previously, to allow for them to be used both ways, functions
-  that operated on them took a `reservelen` argument, which would be set
-  to either the header length or to zero, and skipped over that many
-  bytes at the beginning of the buffer. Most such functions were never
-  used on the raw form. To make the code clearer, each of these
-  functions now operates on full slabs with headers, and an alternate
-  "raw" version of the function has been added in cases where that was
-  needed.
-
-  In addition, the `dns_rdataslab_merge()` and `_subtract()` functions
-  have been rewritten for clarity and efficiency, and a minor bug has
-  been fixed in `dns_rdataslab_equal()` and `_equalx()`, which could
-  cause an incorrect result if both slabs being compared had zero
-  length. :gl:`!10084`
-
-- Dump the active resolver fetches from dns_resolver_dumpfetches()
-  ``5d0c347e75``
-
-  Previously, active resolver fetches were only dumped when the
-  `fetches-per-zone` configuration option was enabled. Now, active
-  resolver fetches are dumped along with the number of
-  `clients-per-server` counters per resolver fetch. :gl:`!10107`
-
-- Fix the foundname vs dcname madness in qpcache_findzonecut()
-  ``4e68dbf194``
-
-  The qpcache_findzonecut() accepts two "foundnames": 'foundname' and
-  'dcname' could be NULL.  Originally, when 'dcname' would be NULL, the
-  'dcname' would be set to 'foundname' which basically means that we
-  were copying the .ndata over itself for no apparent reason.
-  :gl:`!10049`
-
-- Post [CVE-2024-12705] Performance Drop Fixes, Part 2. ``c8104daf8d``
-
-  This merge request addresses several key performance bottlenecks in
-  the DoH (DNS over HTTPS) implementation by introducing significant
-  optimizations and improvements.
-
-  ### Key Improvements
-
-  1. **Simplification and Optimisation of `http_do_bio()` Function**:
-  - The code flow in the `http_do_bio()` function has been significantly
-  simplified. 2. **Flushing HTTP Write Buffer on Outgoing DNS
-  Messages**:    - The buffer is flushed and a send operation is
-  performed when there is an outgoing DNS message. 3. **Bumping Active
-  Streams Processing Limit**:    - The total number of active streams
-  has been increased to 60% of the total streams limit.
-
-  These changes collectively enhance the performance and reliability of
-  the DoH implementation, making it more efficient and robust for
-  handling high-load scenarios, particularly noticeable in long runs (>=
-  1h) of `stress:long:rpz:doh+udp:linux:*` tests. It improves perf. for
-  tests for BIND 9.18, but it likely will have a positive but less
-  pronounced effect on newer versions as well.
-
-  In essence, the merge request fixes three bottlenecks stacked upon
-  each other.
-
-  *It is a logical continuation of the merge requests !10109.* !10109,
-  unfortunately, did not completely [address the performance drop in
-  9.18](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/221545)
-  for longer runs of the stress test. This merge request [addresses
-  that](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/223661).
-
-  **P.S.**
-
-  The origin of the fixes is, in fact, the branch in !10193. So this MR
-  is a ... *forward port* of them. :gl:`!10192`
-
-- Post [CVE-2024-12705] Performance Drop Fixes. ``3033d127d2``
-
-  This merge request fixes a [performance
-  drop](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/216728)
-  after merging the fixes for #4795, in particular in 9.18.
-
-  The MR [fixes the
-  problem](https://gitlab.isc.org/isc-projects/bind9/-/pipelines/219825)
-  without affecting performance for the newer versions, in particular
-  for [the development version](https://gitlab.isc.org/isc-projects/bind
-  9/-/pipelines/220619). :gl:`!10109`
-
-- Remove 'target' from dns_adb. ``764eb65cf6``
-
-  When a server name turns out to be a CNAME or DNAME, the ADB does not
-  use it, but the `dns_adbname` structure still stored a copy of the
-  target name. This is unnecessary and the code has been removed.
-  :gl:`!10149`
-
-- Simplify some dns_name API calls. ``e16560a650``
-
-  Several functions in the `dns_name` module have had parameters
-  removed, that were rarely or never used: - `dns_name_fromtext()` and
-  `dns_name_concatenate()` no longer take a target buffer. -
-  `dns_name_towire()` no longer takes a compression offset pointer; this
-  is now part of the compression context. - `dns_name_towire()` with a
-  `NULL` compression context will copy name data directly into a buffer
-  with no processing. :gl:`!10152`
-
-- Sync the TSAN CC, CFLAGS and LDFLAGS in the respdiff:tsan job.
-  ``22b5442722``
-
-  :gl:`!10209`
-
-

doc/misc/cfg_test.c

@@ -154,7 +154,7 @@ main(int argc, char **argv) {
 	if (memstats) {
 		isc_mem_stats(mctx, stderr);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	fflush(stdout);
 	if (ferror(stdout)) {

doc/notes/notes-9.21.6.rst

@@ -1,186 +0,0 @@
-.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-..
-.. SPDX-License-Identifier: MPL-2.0
-..
-.. This Source Code Form is subject to the terms of the Mozilla Public
-.. License, v. 2.0.  If a copy of the MPL was not distributed with this
-.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
-..
-.. See the COPYRIGHT file distributed with this work for additional
-.. information regarding copyright ownership.
-
-Notes for BIND 9.21.6
----------------------
-
-New Features
-~~~~~~~~~~~~
-
-- Implement the :any:`min-transfer-rate-in` configuration option.
-
-  A new option :any:`min-transfer-rate-in` has been added
-  to the view and zone configurations. It can abort incoming zone
-  transfers that run very slowly due to network-related issues, for
-  example. The default value is 10240 bytes in five minutes.
-  :gl:`#3914`
-
-- Add HTTPS record query to :iscman:`host` command line tool.
-
-  The :iscman:`host` command was extended to also query for the HTTPS RR
-  type by default.
-
-- Implement :any:`sig0key-checks-limit` and :any:`sig0message-checks-limit`.
-
-  Previously, a hard-coded limitation of a maximum of two key or message
-  verification checks was introduced when checking a message's ``SIG(0)``
-  signature, to protect against possible DoS
-  attacks. Two as a maximum was chosen so that more than a
-  single key should only be required during key rotations, and in that
-  case two keys are enough. It later became apparent that there are
-  other use cases where even more keys are required; see the related GitLab issue for examples.
-
-  This change introduces two new configuration options for the views:
-  :any:`sig0key-checks-limit` and :any:`sig0message-checks-limit`. They define
-  how many keys can be checked to find a matching key, and
-  how many message verifications are allowed to take place once a
-  matching key has been found. The former provides
-  slightly less "expensive" key parsing operations and defaults to
-  16. The latter protects against expensive
-  cryptographic operations when there are keys with colliding tags and
-  algorithm numbers; the default is 2. :gl:`#5050`
-
-Feature Changes
-~~~~~~~~~~~~~~~
-
-- Drop malformed notify messages early instead of decompressing them.
-
-  The DNS header shows whether a message has multiple questions or invalid
-  NOTIFY sections. :iscman:`named` can now drop these messages early, right after parsing
-  the question, to match :rfc:`9619` for multi-question messages and
-  Unbound's handling of NOTIFY. Questions are still parsed to be included
-  in BIND's FORMERR response.
-
-  Add ``drop_msg_early()`` function to check for these conditions:
-
-    - Messages with more than one question, as required by :rfc:`9619`
-    - NOTIFY query messages containing answer sections (like Unbound)
-
-  :gl:`#5158`
-
-- Reduce memory used to store DNS names.
-
-  The memory used to internally store the DNS names has been reduced
-  by no longer caching certain fields from an internal data structure.
-
-
-Bug Fixes
-~~~~~~~~~
-
-- Fix :any:`dual-stack-servers` configuration option.
-
-  The :any:`dual-stack-servers` configuration option was not working as
-  expected; the specified servers were not being used when they should
-  have been, leading to resolution failures. This has been fixed.
-  :gl:`#5019`
-
-- Fix a data race causing a permanent active client increase.
-
-  Previously, a data race could cause a newly created fetch context for
-  a new client to be used before it had been fully initialized, which
-  would cause the query to become stuck; queries for the same data would
-  be either paused indefinitely or dropped because of the
-  :any:`clients-per-query` limit. This has been fixed. :gl:`#5053`
-
-- Fix deferred validation of unsigned DS and DNSKEY records.
-
-  When processing a query with the "checking disabled" bit set (CD=1),
-  :iscman:`named` stores the invalidated result in the cache, marked "pending".
-  When the same query is sent with CD=0, the cached data is validated
-  and either accepted as an answer, or ejected from the cache as
-  invalid. This deferred validation was not attempted for DS and DNSKEY
-  records if they had no cached signatures, causing spurious validation
-  failures. The deferred validation is now completed in this scenario.
-
-  Also, if deferred validation fails, the data is now re-queried to find
-  out whether the zone has been corrected since the invalid data was
-  cached. :gl:`#5066`
-
-- Fix RPZ race condition during a reconfiguration.
-
-  With RPZ in use, :iscman:`named` could terminate unexpectedly because of a
-  race condition when a reconfiguration command was received using
-  :iscman:`rndc`. This has been fixed. :gl:`#5146`
-
-- "CNAME and other data check" not applied to all types.
-
-  An incorrect optimization caused "CNAME and other data" errors not to
-  be detected if certain types were at the same node as a CNAME.  This
-  has been fixed. :gl:`#5150`
-
-- Use named Service Parameter Keys (``SvcParamKeys``) by default.
-
-  When converting SVCB records to text representation, :iscman:`named` now uses
-  named ``SvcParamKeys`` values unless backward-compatible mode is
-  activated. In that case, values which were not defined initially
-  in :rfc:`9460` and were added later (see [1]) are converted to opaque
-  "keyNNNN" syntax, e.g. "key7" instead of "dohpath".
-
-  Also a new ``+[no]svcparamkeycompat`` option is implemented for :iscman:`dig`,
-  which enables the backward-compatible mode and uses the opaque syntax,
-  if required for interoperability with other software or scripts. By
-  default, the compatibility mode is disabled.
-
-  [1] https://www.iana.org/assignments/dns-svcb/dns-svcb.xhtml
-  :gl:`#5156`
-
-- Relax private DNSKEY and RRSIG constraints.
-
-  DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to allow
-  empty key and signature material after the algorithm identifier for
-  PRIVATEOID and PRIVATEDNS. It is arguable whether this falls within
-  the expected use of these types, as no key material is shared and the
-  signatures are ineffective, but these are private algorithms and they
-  can be totally insecure. :gl:`#5167`
-
-- Remove NSEC/DS/NSEC3 RRSIG check from ``dns_message_parse()``.
-
-  Previously, when parsing responses, :iscman:`named` incorrectly rejected
-  responses without matching RRSIG records for NSEC/DS/NSEC3 records in
-  the authority section. This rejection, if appropriate, should have
-  been left for the validator to determine and has been fixed.
-  :gl:`#5185`
-
-- Fix TTL issue with ANY queries processed through RPZ "passthru".
-
-  Answers to an "ANY" query which were processed by the RPZ "passthru"
-  policy had the response-policy's ``max-policy-ttl`` value unexpectedly
-  applied. This has been fixed. :gl:`#5187`
-
-- :iscman:`dnssec-signzone` needs to check for a NULL key when setting offline.
-
-  :iscman:`dnssec-signzone` could dereference a NULL key pointer when resigning
-  a zone.  This has been fixed. :gl:`#5192`
-
-- Fix a bug in the statistics channel when querying zone transfer
-  information.
-
-  When querying zone transfer information from the statistics channel,
-  there was a rare possibility that :iscman:`named` could terminate unexpectedly
-  if a zone transfer was in a state when transferring from all the
-  available primary servers had failed earlier. This has been fixed.
-  :gl:`#5198`
-
-- Fix assertion failure when dumping recursing clients.
-
-  Previously, if a new counter was added to the hash table while dumping
-  recursing clients via the :option:`rndc recursing` command, and
-  :any:`fetches-per-zone` was enabled, an assertion failure could occur. This
-  has been fixed. :gl:`#5200`
-
-- Dump the active resolver fetches from ``dns_resolver_dumpfetches()``
-
-  Previously, active resolver fetches were only dumped when the
-  :any:`fetches-per-zone` configuration option was enabled. Now, active
-  resolver fetches are dumped along with the number of
-  :any:`clients-per-query` counters per resolver fetch.
-
-

fuzz/dns_master_load.c

@@ -74,6 +74,6 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 
 end:
 	dns_db_detach(&db);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 	return 0;
 }

fuzz/dns_qp.c

@@ -211,7 +211,7 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 	}
 
 	dns_qp_destroy(&qp);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 	isc_mem_checkdestroyed(stderr);
 
 	for (size_t i = 0; i < ARRAY_SIZE(item); i++) {

fuzz/dns_rdata_fromtext.c

@@ -145,6 +145,6 @@ LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
 cleanup:
 	isc_lex_close(lex);
 	isc_lex_destroy(&lex);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 	return 0;
 }

lib/dns/adb.c

@@ -567,6 +567,14 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 		rdataset->ttl = ttlclamp(rdataset->ttl);
 	}
 
+if (rdtype != dns_rdatatype_a && rdtype != dns_rdatatype_aaaa) {
+char rb[DNS_RDATATYPE_FORMATSIZE];
+char nb[DNS_NAME_FORMATSIZE];
+dns_rdatatype_format(rdtype, rb, sizeof(rb));
+dns_name_format(adbname->name, nb, sizeof(nb));
+isc_log_write(DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
+	      "%s has %s", nb, rb);
+}
 	REQUIRE(rdtype == dns_rdatatype_a || rdtype == dns_rdatatype_aaaa);
 
 	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;

lib/dns/dst_api.c

@@ -38,9 +38,9 @@
 #include <unistd.h>
 
 #include <isc/buffer.h>
-#include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
@@ -226,7 +226,7 @@ dst__lib_shutdown(void) {
 		}
 	}
 
-	isc_mem_detach(&dst__mctx);
+	isc_mem_destroy(&dst__mctx);
 }
 
 bool

lib/dns/dyndb.c

@@ -43,7 +43,7 @@ struct dyndb_implementation {
 	dns_dyndb_destroy_t *destroy_func;
 	char *name;
 	void *inst;
-	ISC_LINK(dyndb_implementation_t) link;
+	LINK(dyndb_implementation_t) link;
 };
 
 /*
@@ -52,7 +52,7 @@ struct dyndb_implementation {
  * These are stored here so they can be cleaned up on shutdown.
  * (The order in which they are stored is not important.)
  */
-static ISC_LIST(dyndb_implementation_t) dyndb_implementations;
+static LIST(dyndb_implementation_t) dyndb_implementations;
 
 /* Locks dyndb_implementations. */
 static isc_mutex_t dyndb_lock;
@@ -60,7 +60,7 @@ static isc_mutex_t dyndb_lock;
 void
 dns__dyndb_initialize(void) {
 	isc_mutex_init(&dyndb_lock);
-	ISC_LIST_INIT(dyndb_implementations);
+	INIT_LIST(dyndb_implementations);
 }
 
 void
@@ -135,7 +135,7 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
 
 	isc_mem_attach(mctx, &imp->mctx);
 
-	ISC_LINK_INIT(imp, link);
+	INIT_LINK(imp, link);
 
 	r = uv_dlopen(filename, &imp->handle);
 	if (r != 0) {
@@ -225,7 +225,7 @@ dns_dyndb_load(const char *libname, const char *name, const char *parameters,
 	CHECK(implementation->register_func(mctx, name, parameters, file, line,
 					    dctx, &implementation->inst));
 
-	ISC_LIST_APPEND(dyndb_implementations, implementation, link);
+	APPEND(dyndb_implementations, implementation, link);
 	result = ISC_R_SUCCESS;
 
 cleanup:
@@ -245,10 +245,10 @@ dns_dyndb_cleanup(void) {
 	dyndb_implementation_t *prev;
 
 	LOCK(&dyndb_lock);
-	elem = ISC_LIST_TAIL(dyndb_implementations);
+	elem = TAIL(dyndb_implementations);
 	while (elem != NULL) {
-		prev = ISC_LIST_PREV(elem, link);
-		ISC_LIST_UNLINK(dyndb_implementations, elem, link);
+		prev = PREV(elem, link);
+		UNLINK(dyndb_implementations, elem, link);
 		isc_log_write(DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DYNDB,
 			      ISC_LOG_INFO, "unloading DynDB instance '%s'",
 			      elem->name);

lib/dns/include/dns/ncache.h

@@ -54,21 +54,16 @@
 isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
-	       dns_ttl_t maxttl, dns_rdataset_t *addedrdataset);
-isc_result_t
-dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
-		     dns_dbnode_t *node, dns_rdatatype_t covers,
-		     isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
-		     bool optout, dns_rdataset_t *addedrdataset);
+	       dns_ttl_t maxttl, bool optout, bool secure,
+	       dns_rdataset_t *addedrdataset);
 /*%<
  * Convert the authority data from 'message' into a negative cache
  * rdataset, and store it in 'cache' at 'node' with a TTL limited to
  * 'maxttl'.
  *
- * \li dns_ncache_add produces a negative cache entry with a trust of no
- *     more than answer
- * \li dns_ncache_addoptout produces a negative cache entry which will have
- *     a trust of secure if all the records that make up the entry are secure.
+ * \li if 'secure' is true and all the records that make up the entry
+ *     are secure, then dns_ncache_add produces a negative cache entry
+ *     with trust level secure.
  *
  * The 'covers' argument is the RR type whose nonexistence we are caching,
  * or dns_rdatatype_any when caching a NXDOMAIN response.

lib/dns/include/dns/stats.h

@@ -399,7 +399,7 @@ dns_opcodestats_increment(dns_stats_t *stats, dns_opcode_t code);
  */
 
 void
-dns_rcodestats_increment(dns_stats_t *stats, dns_rcode_t code);
+dns_rcodestats_increment(dns_stats_t *stats, dns_opcode_t code);
 /*%<
  * Increment the statistics counter for 'code'.
  *

lib/dns/include/dns/types.h

@@ -124,7 +124,7 @@ typedef struct dns_nametree	   dns_nametree_t;
 typedef ISC_LIST(dns_name_t) dns_namelist_t;
 typedef struct dns_ntatable	    dns_ntatable_t;
 typedef struct dns_ntnode	    dns_ntnode_t;
-typedef enum dns_opcode		    dns_opcode_t;
+typedef uint16_t		    dns_opcode_t;
 typedef struct dns_order	    dns_order_t;
 typedef struct dns_peer		    dns_peer_t;
 typedef struct dns_peerlist	    dns_peerlist_t;
@@ -308,18 +308,20 @@ enum {
 /*%
  * Opcodes.
  */
-enum dns_opcode {
+enum {
 	dns_opcode_query = 0,
+#define dns_opcode_query ((dns_opcode_t)dns_opcode_query)
 	dns_opcode_iquery = 1,
+#define dns_opcode_iquery ((dns_opcode_t)dns_opcode_iquery)
 	dns_opcode_status = 2,
+#define dns_opcode_status ((dns_opcode_t)dns_opcode_status)
 	dns_opcode_notify = 4,
+#define dns_opcode_notify ((dns_opcode_t)dns_opcode_notify)
 	dns_opcode_update = 5, /* dynamic update */
+#define dns_opcode_update ((dns_opcode_t)dns_opcode_update)
 	dns_opcode_max = 6,
-	dns__opcode_expand = UINT16_MAX,
-} __attribute__((__packed__));
-/* Absent attribute packed, the enum will be sized as an int */
-STATIC_ASSERT(sizeof(uint16_t) == sizeof(dns_opcode_t),
-	      "sizeof(dns_opecode)t) is not 16-bit");
+#define dns_opcode_max ((dns_opcode_t)dns_opcode_max)
+};
 
 /*%
  * Trust levels.  Must be kept in sync with trustnames[] in masterdump.c.

lib/dns/include/dns/zone.h

@@ -1539,19 +1539,14 @@ dns_zone_getsourceaddr(dns_zone_t *zone);
  * \li	'zone' has a non-empty primaries list.
  */
 
-isc_result_t
-dns_zone_getprimaryaddr(dns_zone_t *zone, isc_sockaddr_t *dest);
+isc_sockaddr_t
+dns_zone_getprimaryaddr(dns_zone_t *zone);
 /*%<
- * Get the zone's current primary server into '*dest'.
+ * Get the zone's current primary server.
  *
  * Requires:
  * \li	'zone' to be a valid zone.
  * \li	'zone' has a non-empty primaries list.
- * \li	'dest' != NULL.
- *
- * Returns:
- *\li	#ISC_R_SUCCESS if the current primary server was found
- *\li	#ISC_R_NOMORE if all the primaries were already iterated over
  */
 
 isc_time_t

lib/dns/ncache.c

@@ -50,12 +50,6 @@ atomic_getuint8(isc_buffer_t *b) {
 	return ret;
 }
 
-static isc_result_t
-addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
-	  dns_ttl_t maxttl, bool optout, bool secure,
-	  dns_rdataset_t *addedrdataset);
-
 static isc_result_t
 copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) {
 	isc_result_t result;
@@ -107,25 +101,8 @@ copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) {
 isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
-	       dns_ttl_t maxttl, dns_rdataset_t *addedrdataset) {
-	return addoptout(message, cache, node, covers, now, minttl, maxttl,
-			 false, false, addedrdataset);
-}
-
-isc_result_t
-dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
-		     dns_dbnode_t *node, dns_rdatatype_t covers,
-		     isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
-		     bool optout, dns_rdataset_t *addedrdataset) {
-	return addoptout(message, cache, node, covers, now, minttl, maxttl,
-			 optout, true, addedrdataset);
-}
-
-static isc_result_t
-addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
-	  dns_ttl_t maxttl, bool optout, bool secure,
-	  dns_rdataset_t *addedrdataset) {
+	       dns_ttl_t maxttl, bool optout, bool secure,
+	       dns_rdataset_t *addedrdataset) {
 	isc_result_t result;
 	isc_buffer_t buffer;
 	isc_region_t r;

lib/dns/openssl_link.c

@@ -30,6 +30,7 @@
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
+#include <isc/mutexblock.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/thread.h>

lib/dns/opensslecdsa_link.c

@@ -26,6 +26,7 @@
 #include <openssl/param_build.h>
 #endif
 
+#include <isc/fips.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/safe.h>
@@ -706,7 +707,7 @@ opensslecdsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 		}
 
 #if OPENSSL_VERSION_NUMBER >= 0x30200000L
-		if (!isc_crypto_fips_mode()) {
+		if (!isc_fips_mode()) {
 			ret = opensslecdsa_set_deterministic(
 				pctx, dctx->key->key_alg);
 			if (ret != ISC_R_SUCCESS) {

lib/dns/qpcache.c

@@ -202,10 +202,9 @@ struct qpcnode {
 	uint8_t	      : 0;
 
 	/*%
-	 * Used for dead nodes cleaning.  This linked list is used to mark nodes
-	 * which have no data any longer, but we cannot unlink at that exact
-	 * moment because we did not or could not obtain a write lock on the
-	 * tree.
+	 * Used for dead node cleaning. The deadnodes queue is used
+	 * for nodes that have no data any longer, but we can't unlink
+	 * yet because we don't have a tree lock.
 	 */
 	isc_queue_node_t deadlink;
 };
@@ -216,9 +215,8 @@ struct qpcnode {
  * to reduce contention between threads.
  */
 typedef struct qpcache_bucket {
-	/*%
-	 * Temporary storage for stale cache nodes and dynamically
-	 * deleted nodes that await being cleaned up.
+	/*
+	 * Temporary storage for cache nodes that need to be deleted.
 	 */
 	isc_queue_t deadnodes;
 
@@ -1999,23 +1997,78 @@ tree_exit:
 }
 
 static isc_result_t
-seek_ns_headers(qpc_search_t *search, qpcnode_t *node, dns_dbnode_t **nodep,
-		dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
-		dns_name_t *foundname, dns_name_t *dcname,
-		isc_rwlocktype_t *tlocktype) {
+qpcache_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
+		    isc_stdtime_t __now, dns_dbnode_t **nodep,
+		    dns_name_t *foundname, dns_name_t *dcname,
+		    dns_rdataset_t *rdataset,
+		    dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
+	qpcnode_t *node = NULL;
+	isc_rwlock_t *nlock = NULL;
+	isc_result_t result;
 	dns_slabheader_t *header = NULL;
 	dns_slabheader_t *header_prev = NULL, *header_next = NULL;
-	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
-	isc_rwlock_t *nlock = &search->qpdb->buckets[node->locknum].lock;
 	dns_slabheader_t *found = NULL, *foundsig = NULL;
+	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
+	isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
+	bool dcnull = (dcname == NULL);
+	qpc_search_t search = (qpc_search_t){
+		.qpdb = (qpcache_t *)db,
+		.options = options,
+		.now = __now ? __now : isc_stdtime_now(),
+	};
 
+	REQUIRE(VALID_QPDB((qpcache_t *)db));
+
+	if (dcnull) {
+		dcname = foundname;
+	}
+
+	TREE_RDLOCK(&search.qpdb->tree_lock, &tlocktype);
+
+	/*
+	 * Search down from the root of the tree.
+	 */
+	result = dns_qp_lookup(search.qpdb->tree, name, NULL, NULL,
+			       &search.chain, (void **)&node, NULL);
+	if (result != ISC_R_NOTFOUND) {
+		dns_name_copy(&node->name, dcname);
+	}
+	if ((options & DNS_DBFIND_NOEXACT) != 0 && result == ISC_R_SUCCESS) {
+		int len = dns_qpchain_length(&search.chain);
+		if (len >= 2) {
+			node = NULL;
+			dns_qpchain_node(&search.chain, len - 2, NULL,
+					 (void **)&node, NULL);
+			search.chain.len = len - 1;
+			result = DNS_R_PARTIALMATCH;
+		} else {
+			result = ISC_R_NOTFOUND;
+		}
+	}
+
+	if (result == DNS_R_PARTIALMATCH) {
+		result = find_deepest_zonecut(&search, node, nodep, foundname,
+					      rdataset,
+					      sigrdataset DNS__DB_FLARG_PASS);
+		goto tree_exit;
+	} else if (result != ISC_R_SUCCESS) {
+		goto tree_exit;
+	} else if (!dcnull) {
+		dns_name_copy(dcname, foundname);
+	}
+
+	/*
+	 * We now go looking for an NS rdataset at the node.
+	 */
+
+	nlock = &search.qpdb->buckets[node->locknum].lock;
 	NODE_RDLOCK(nlock, &nlocktype);
 
 	for (header = node->data; header != NULL; header = header_next) {
 		header_next = header->next;
 		bool ns = (header->type == dns_rdatatype_ns ||
 			   header->type == DNS_SIGTYPE(dns_rdatatype_ns));
-		if (check_stale_header(node, header, &nlocktype, nlock, search,
+		if (check_stale_header(node, header, &nlocktype, nlock, &search,
 				       &header_prev))
 		{
 			if (ns) {
@@ -2038,108 +2091,32 @@ seek_ns_headers(qpc_search_t *search, qpcnode_t *node, dns_dbnode_t **nodep,
 	}
 
 	if (found == NULL) {
-		isc_result_t result;
-
 		/*
 		 * No active NS records found. Call find_deepest_zonecut()
 		 * to look for them in nodes above this one.
 		 */
 		NODE_UNLOCK(nlock, &nlocktype);
-		result = find_deepest_zonecut(search, node, nodep, foundname,
-					      rdataset,
-					      sigrdataset DNS__DB_FLARG_PASS);
-		if (dcname != NULL) {
-			dns_name_copy(foundname, dcname);
-		}
-		return result;
-	}
-
-	if (nodep != NULL) {
-		qpcnode_acquire(search->qpdb, node, nlocktype,
-				*tlocktype DNS__DB_FLARG_PASS);
-		*nodep = (dns_dbnode_t *)node;
-	}
-
-	bindrdatasets(search->qpdb, node, found, foundsig, search->now,
-		      nlocktype, *tlocktype, rdataset,
-		      sigrdataset DNS__DB_FLARG_PASS);
-	maybe_update_headers(search->qpdb, found, foundsig, nlock, &nlocktype,
-			     search->now);
-
-	NODE_UNLOCK(nlock, &nlocktype);
-
-	return ISC_R_SUCCESS;
-}
-
-static isc_result_t
-qpcache_findzonecut(dns_db_t *db, const dns_name_t *name, unsigned int options,
-		    isc_stdtime_t __now, dns_dbnode_t **nodep,
-		    dns_name_t *foundname, dns_name_t *dcname,
-		    dns_rdataset_t *rdataset,
-		    dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
-	qpcnode_t *node = NULL;
-	isc_result_t result;
-	isc_rwlocktype_t tlocktype = isc_rwlocktype_none;
-	qpc_search_t search = (qpc_search_t){
-		.qpdb = (qpcache_t *)db,
-		.options = options,
-		.now = __now ? __now : isc_stdtime_now(),
-	};
-	unsigned int len = 0;
-
-	REQUIRE(VALID_QPDB((qpcache_t *)db));
-
-	TREE_RDLOCK(&search.qpdb->tree_lock, &tlocktype);
-
-	/*
-	 * Search down from the root of the tree.
-	 */
-	result = dns_qp_lookup(search.qpdb->tree, name, NULL, NULL,
-			       &search.chain, (void **)&node, NULL);
-
-	switch (result) {
-	case ISC_R_SUCCESS:
-		if ((options & DNS_DBFIND_NOEXACT) == 0) {
-			if (dcname != NULL) {
-				dns_name_copy(&node->name, dcname);
-			}
-			dns_name_copy(&node->name, foundname);
-			result = seek_ns_headers(&search, node, nodep, rdataset,
-						 sigrdataset, foundname, dcname,
-						 &tlocktype);
-			break;
-		}
-
-		len = dns_qpchain_length(&search.chain);
-		if (len < 2) {
-			result = ISC_R_NOTFOUND;
-			break;
-		}
-
-		FALLTHROUGH;
-	case DNS_R_PARTIALMATCH:
-		if (dcname != NULL) {
-			dns_name_copy(&node->name, dcname);
-		}
-
-		if (result == ISC_R_SUCCESS) {
-			/* Fell through from the previous case */
-			INSIST(len >= 2);
-
-			node = NULL;
-			dns_qpchain_node(&search.chain, len - 2, NULL,
-					 (void **)&node, NULL);
-			search.chain.len = len - 1;
-		}
-
 		result = find_deepest_zonecut(&search, node, nodep, foundname,
 					      rdataset,
 					      sigrdataset DNS__DB_FLARG_PASS);
-		break;
-	default:
-		break;
+		dns_name_copy(foundname, dcname);
+		goto tree_exit;
 	}
 
+	if (nodep != NULL) {
+		qpcnode_acquire(search.qpdb, node, nlocktype,
+				tlocktype DNS__DB_FLARG_PASS);
+		*nodep = (dns_dbnode_t *)node;
+	}
+
+	bindrdatasets(search.qpdb, node, found, foundsig, search.now, nlocktype,
+		      tlocktype, rdataset, sigrdataset DNS__DB_FLARG_PASS);
+	maybe_update_headers(search.qpdb, found, foundsig, nlock, &nlocktype,
+			     search.now);
+
+	NODE_UNLOCK(nlock, &nlocktype);
+
+tree_exit:
 	TREE_UNLOCK(&search.qpdb->tree_lock, &tlocktype);
 
 	INSIST(!search.need_cleanup);

lib/dns/qpzone.c

@@ -544,7 +544,7 @@ qpzone_destroy(qpzonedb_t *qpdb) {
 	isc_refcount_decrementz(&qpdb->current_version->references);
 
 	isc_refcount_destroy(&qpdb->current_version->references);
-	ISC_LIST_UNLINK(qpdb->open_versions, qpdb->current_version, link);
+	UNLINK(qpdb->open_versions, qpdb->current_version, link);
 	cds_wfs_destroy(&qpdb->current_version->glue_stack);
 	isc_rwlock_destroy(&qpdb->current_version->rwlock);
 	isc_mem_put(qpdb->common.mctx, qpdb->current_version,
@@ -723,7 +723,7 @@ dns__qpzone_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	 * Keep the current version in the open list so that list operation
 	 * won't happen in normal lookup operations.
 	 */
-	ISC_LIST_PREPEND(qpdb->open_versions, qpdb->current_version, link);
+	PREPEND(qpdb->open_versions, qpdb->current_version, link);
 
 	qpdb->common.magic = DNS_DB_MAGIC;
 	qpdb->common.impmagic = QPZONE_DB_MAGIC;
@@ -875,6 +875,7 @@ clean_zone_node(qpznode_t *node, uint32_t least_serial) {
 		}
 		top_prev = current;
 	}
+
 	if (!still_dirty) {
 		node->dirty = false;
 	}
@@ -1124,13 +1125,13 @@ cleanup_nondirty(qpz_version_t *version, qpz_changedlist_t *cleanup_list) {
 	 *
 	 * The caller must be holding the database lock.
 	 */
-	for (changed = ISC_LIST_HEAD(version->changed_list); changed != NULL;
+	for (changed = HEAD(version->changed_list); changed != NULL;
 	     changed = next_changed)
 	{
-		next_changed = ISC_LIST_NEXT(changed, link);
+		next_changed = NEXT(changed, link);
 		if (!changed->dirty) {
-			ISC_LIST_UNLINK(version->changed_list, changed, link);
-			ISC_LIST_APPEND(*cleanup_list, changed, link);
+			UNLINK(version->changed_list, changed, link);
+			APPEND(*cleanup_list, changed, link);
 		}
 	}
 }
@@ -1377,13 +1378,12 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 				(void)isc_refcount_current(
 					&cur_version->references);
 				if (cur_version->serial == qpdb->least_serial) {
-					INSIST(ISC_LIST_EMPTY(
+					INSIST(EMPTY(
 						cur_version->changed_list));
 				}
-				ISC_LIST_UNLINK(qpdb->open_versions,
-						cur_version, link);
+				UNLINK(qpdb->open_versions, cur_version, link);
 			}
-			if (ISC_LIST_EMPTY(qpdb->open_versions)) {
+			if (EMPTY(qpdb->open_versions)) {
 				/*
 				 * We're going to become the least open
 				 * version.
@@ -1413,9 +1413,8 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 			 */
 			if (cur_ref == 1) {
 				cleanup_version = cur_version;
-				ISC_LIST_APPENDLIST(
-					version->changed_list,
-					cleanup_version->changed_list, link);
+				APPENDLIST(version->changed_list,
+					   cleanup_version->changed_list, link);
 			}
 			/*
 			 * Become the current version.
@@ -1434,8 +1433,8 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 			 */
 			INSIST(isc_refcount_increment0(&version->references) ==
 			       0);
-			ISC_LIST_PREPEND(qpdb->open_versions,
-					 qpdb->current_version, link);
+			PREPEND(qpdb->open_versions, qpdb->current_version,
+				link);
 			resigned_list = version->resigned_list;
 			ISC_LIST_INIT(version->resigned_list);
 		} else {
@@ -1462,7 +1461,7 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 			 * Find the version with the least serial
 			 * number greater than ours.
 			 */
-			least_greater = ISC_LIST_PREV(version, link);
+			least_greater = PREV(version, link);
 			if (least_greater == NULL) {
 				least_greater = qpdb->current_version;
 			}
@@ -1483,21 +1482,20 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 				 * Add any unexecuted cleanups to
 				 * those of the least greater version.
 				 */
-				ISC_LIST_APPENDLIST(least_greater->changed_list,
-						    version->changed_list,
-						    link);
+				APPENDLIST(least_greater->changed_list,
+					   version->changed_list, link);
 			}
 		} else if (version->serial == qpdb->least_serial) {
-			INSIST(ISC_LIST_EMPTY(version->changed_list));
+			INSIST(EMPTY(version->changed_list));
 		}
-		ISC_LIST_UNLINK(qpdb->open_versions, version, link);
+		UNLINK(qpdb->open_versions, version, link);
 	}
 	least_serial = qpdb->least_serial;
 	RWUNLOCK(&qpdb->lock, isc_rwlocktype_write);
 
 	if (cleanup_version != NULL) {
 		isc_refcount_destroy(&cleanup_version->references);
-		INSIST(ISC_LIST_EMPTY(cleanup_version->changed_list));
+		INSIST(EMPTY(cleanup_version->changed_list));
 		cleanup_gluelists(&cleanup_version->glue_stack);
 		cds_wfs_destroy(&cleanup_version->glue_stack);
 		isc_rwlock_destroy(&cleanup_version->rwlock);
@@ -1508,8 +1506,8 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 	/*
 	 * Commit/rollback re-signed headers.
 	 */
-	for (header = ISC_LIST_HEAD(resigned_list); header != NULL;
-	     header = ISC_LIST_HEAD(resigned_list))
+	for (header = HEAD(resigned_list); header != NULL;
+	     header = HEAD(resigned_list))
 	{
 		isc_rwlock_t *nlock = NULL;
 		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
@@ -1526,18 +1524,16 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 		NODE_UNLOCK(nlock, &nlocktype);
 	}
 
-	if (ISC_LIST_EMPTY(cleanup_list)) {
-		*versionp = NULL;
-		return;
-	}
+	dns_qp_t *tree = NULL, *nsec = NULL, *nsec3 = NULL;
+	bool need_tree = false, need_nsec = false, need_nsec3 = false;
 
-	for (changed = ISC_LIST_HEAD(cleanup_list); changed != NULL;
+	for (changed = HEAD(cleanup_list); changed != NULL;
 	     changed = next_changed)
 	{
 		isc_rwlock_t *nlock = NULL;
 		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
-		next_changed = ISC_LIST_NEXT(changed, link);
+		next_changed = NEXT(changed, link);
 		node = changed->node;
 		nlock = &qpdb->buckets[node->locknum].lock;
 
@@ -1545,14 +1541,100 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 		if (rollback) {
 			rollback_node(node, serial);
 		}
+
+		qpznode_ref(node);
 		qpznode_release(qpdb, node, least_serial,
 				&nlocktype DNS__DB_FILELINE);
 
+		/* If the node is now empty, we can delete it. */
+		if (commit && node->data == NULL) {
+			switch ((int)node->nsec) {
+			case DNS_DB_NSEC_HAS_NSEC:
+				/*
+				 * Delete the matching node from the NSEC tree
+				 * first, then fall through to the main tree.
+				 */
+				if (nsec == NULL) {
+					need_nsec = true;
+					next_changed = changed;
+				} else {
+					dns_qp_deletename(nsec, &node->name,
+							  NULL, NULL);
+				}
+				FALLTHROUGH;
+			case DNS_DB_NSEC_NORMAL:
+				if (tree == NULL) {
+					need_tree = true;
+					next_changed = changed;
+				} else {
+					dns_qp_deletename(tree, &node->name,
+							  NULL, NULL);
+				}
+				break;
+			case DNS_DB_NSEC_NSEC:
+				if (nsec == NULL) {
+					need_nsec = true;
+					next_changed = changed;
+				} else {
+					dns_qp_deletename(nsec, &node->name,
+							  NULL, NULL);
+				}
+				break;
+			case DNS_DB_NSEC_NSEC3:
+				if (nsec3 == NULL) {
+					need_nsec3 = true;
+					next_changed = changed;
+				} else {
+					dns_qp_deletename(nsec3, &node->name,
+							  NULL, NULL);
+				}
+				break;
+			default:
+				UNREACHABLE();
+			}
+		}
+
+		qpznode_detach(&node);
+
 		NODE_UNLOCK(nlock, &nlocktype);
 
+		if (next_changed == changed) {
+			/*
+			 * We found a node to delete but didn't have a
+			 * QP writer open, so we open one now, then go
+			 * back to delete the node. If there's a next
+			 * time, we'll already have the writer open,
+			 * so we won't need this extra step.
+			 */
+			if (need_tree && tree == NULL) {
+				dns_qpmulti_write(qpdb->tree, &tree);
+			}
+			if (need_nsec && nsec == NULL) {
+				dns_qpmulti_write(qpdb->nsec, &nsec);
+			}
+			if (need_nsec3 && nsec3 == NULL) {
+				dns_qpmulti_write(qpdb->nsec3, &nsec3);
+			}
+
+			continue;
+		}
+
 		isc_mem_put(qpdb->common.mctx, changed, sizeof(*changed));
 	}
 
+	if (tree != NULL) {
+		dns_qp_compact(tree, DNS_QPGC_MAYBE);
+		dns_qpmulti_commit(qpdb->tree, &tree);
+	}
+	if (nsec != NULL) {
+		dns_qp_compact(nsec, DNS_QPGC_MAYBE);
+		dns_qpmulti_commit(qpdb->nsec, &nsec);
+	}
+	if (nsec3 != NULL) {
+		dns_qp_compact(nsec3, DNS_QPGC_MAYBE);
+		dns_qpmulti_commit(qpdb->nsec3, &nsec3);
+	}
+
 	*versionp = NULL;
 }
 

lib/dns/rdata/generic/rrsig_46.c

@@ -387,9 +387,6 @@ static int
 compare_rrsig(ARGS_COMPARE) {
 	isc_region_t r1;
 	isc_region_t r2;
-	dns_name_t name1;
-	dns_name_t name2;
-	int order;
 
 	REQUIRE(rdata1->type == rdata2->type);
 	REQUIRE(rdata1->rdclass == rdata2->rdclass);
@@ -399,32 +396,6 @@ compare_rrsig(ARGS_COMPARE) {
 
 	dns_rdata_toregion(rdata1, &r1);
 	dns_rdata_toregion(rdata2, &r2);
-
-	INSIST(r1.length > 18);
-	INSIST(r2.length > 18);
-	r1.length = 18;
-	r2.length = 18;
-	order = isc_region_compare(&r1, &r2);
-	if (order != 0) {
-		return order;
-	}
-
-	dns_name_init(&name1);
-	dns_name_init(&name2);
-	dns_rdata_toregion(rdata1, &r1);
-	dns_rdata_toregion(rdata2, &r2);
-	isc_region_consume(&r1, 18);
-	isc_region_consume(&r2, 18);
-	dns_name_fromregion(&name1, &r1);
-	dns_name_fromregion(&name2, &r2);
-	order = dns_name_rdatacompare(&name1, &name2);
-	if (order != 0) {
-		return order;
-	}
-
-	isc_region_consume(&r1, name_length(&name1));
-	isc_region_consume(&r2, name_length(&name2));
-
 	return isc_region_compare(&r1, &r2);
 }
 
@@ -592,32 +563,13 @@ additionaldata_rrsig(ARGS_ADDLDATA) {
 
 static isc_result_t
 digest_rrsig(ARGS_DIGEST) {
-	isc_region_t r1, r2;
-	dns_name_t name;
-
 	REQUIRE(rdata->type == dns_rdatatype_rrsig);
 
-	dns_rdata_toregion(rdata, &r1);
-	r2 = r1;
+	UNUSED(rdata);
+	UNUSED(digest);
+	UNUSED(arg);
 
-	/*
-	 * Type covered (2) + Algorithm (1) +
-	 * Labels (1) + Original TTL (4) +
-	 * Expire time (4) +  Time signed (4) +
-	 * Key ID (2).
-	 */
-	isc_region_consume(&r2, 18);
-	r1.length = 18;
-	RETERR((digest)(arg, &r1));
-
-	/* Signer */
-	dns_name_init(&name);
-	dns_name_fromregion(&name, &r2);
-	RETERR(dns_name_digest(&name, digest, arg));
-	isc_region_consume(&r2, name_length(&name));
-
-	/* Signature */
-	return (digest)(arg, &r2);
+	return ISC_R_NOTIMPLEMENTED;
 }
 
 static dns_rdatatype_t
@@ -658,7 +610,47 @@ checknames_rrsig(ARGS_CHECKNAMES) {
 
 static int
 casecompare_rrsig(ARGS_COMPARE) {
-	return compare_rrsig(rdata1, rdata2);
+	isc_region_t r1;
+	isc_region_t r2;
+	dns_name_t name1;
+	dns_name_t name2;
+	int order;
+
+	REQUIRE(rdata1->type == rdata2->type);
+	REQUIRE(rdata1->rdclass == rdata2->rdclass);
+	REQUIRE(rdata1->type == dns_rdatatype_rrsig);
+	REQUIRE(rdata1->length != 0);
+	REQUIRE(rdata2->length != 0);
+
+	dns_rdata_toregion(rdata1, &r1);
+	dns_rdata_toregion(rdata2, &r2);
+
+	INSIST(r1.length > 18);
+	INSIST(r2.length > 18);
+	r1.length = 18;
+	r2.length = 18;
+	order = isc_region_compare(&r1, &r2);
+	if (order != 0) {
+		return order;
+	}
+
+	dns_name_init(&name1);
+	dns_name_init(&name2);
+	dns_rdata_toregion(rdata1, &r1);
+	dns_rdata_toregion(rdata2, &r2);
+	isc_region_consume(&r1, 18);
+	isc_region_consume(&r2, 18);
+	dns_name_fromregion(&name1, &r1);
+	dns_name_fromregion(&name2, &r2);
+	order = dns_name_rdatacompare(&name1, &name2);
+	if (order != 0) {
+		return order;
+	}
+
+	isc_region_consume(&r1, name_length(&name1));
+	isc_region_consume(&r2, name_length(&name2));
+
+	return isc_region_compare(&r1, &r2);
 }
 
 #endif /* RDATA_GENERIC_RRSIG_46_C */

lib/dns/rdata/generic/sig_24.c

@@ -556,32 +556,13 @@ additionaldata_sig(ARGS_ADDLDATA) {
 
 static isc_result_t
 digest_sig(ARGS_DIGEST) {
-	isc_region_t r1, r2;
-	dns_name_t name;
-
 	REQUIRE(rdata->type == dns_rdatatype_sig);
 
-	dns_rdata_toregion(rdata, &r1);
-	r2 = r1;
+	UNUSED(rdata);
+	UNUSED(digest);
+	UNUSED(arg);
 
-	/*
-	 * Type covered (2) + Algorithm (1) +
-	 * Labels (1) + Original TTL (4) +
-	 * Expire time (4) +  Time signed (4) +
-	 * Key ID (2).
-	 */
-	isc_region_consume(&r2, 18);
-	r1.length = 18;
-	RETERR((digest)(arg, &r1));
-
-	/* Signer */
-	dns_name_init(&name);
-	dns_name_fromregion(&name, &r2);
-	RETERR(dns_name_digest(&name, digest, arg));
-	isc_region_consume(&r2, name_length(&name));
-
-	/* Signature */
-	return (digest)(arg, &r2);
+	return ISC_R_NOTIMPLEMENTED;
 }
 
 static dns_rdatatype_t

lib/dns/resolver.c

@@ -5263,7 +5263,7 @@ validated(void *arg) {
 	 * is returned, and that the rdatasets are bound.
 	 */
 	if (val->result == ISC_R_SUCCESS && !negative &&
-	    val->rdataset != NULL && CHAINING(val->rdataset))
+	    CHAINING(val->rdataset))
 	{
 		if (val->rdataset->type == dns_rdatatype_cname) {
 			eresult = DNS_R_CNAME;
@@ -5357,18 +5357,14 @@ validated(void *arg) {
 		nextval = ISC_LIST_HEAD(fctx->validators);
 		if (nextval != NULL) {
 			dns_validator_send(nextval);
-			goto cleanup_fetchctx;
 		} else if (sentresponse) {
 			done = true;
-			goto cleanup_fetchctx;
 		} else if (result == DNS_R_BROKENCHAIN) {
 			done = true;
-			goto cleanup_fetchctx;
 		} else {
 			fctx_try(fctx, true);
-			goto cleanup_fetchctx;
 		}
-		UNREACHABLE();
+		goto cleanup_fetchctx;
 	}
 
 	if (negative) {
@@ -5663,9 +5659,7 @@ answer_response:
 			if (NEGATIVE(hresp->rdataset)) {
 				INSIST(eresult == DNS_R_NCACHENXDOMAIN ||
 				       eresult == DNS_R_NCACHENXRRSET);
-			} else if (eresult == ISC_R_SUCCESS &&
-				   hresp->rdataset->type != fctx->type)
-			{
+			} else if (eresult == ISC_R_SUCCESS) {
 				switch (hresp->rdataset->type) {
 				case dns_rdatatype_cname:
 					eresult = DNS_R_CNAME;
@@ -6328,12 +6322,9 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
 			 */
 			if (dns_rdataset_isassociated(resp->rdataset)) {
 				if (NEGATIVE(resp->rdataset)) {
-					INSIST(eresult ==
-						       DNS_R_NCACHENXDOMAIN ||
+					INSIST(eresult == DNS_R_NCACHENXDOMAIN ||
 					       eresult == DNS_R_NCACHENXRRSET);
-				} else if (eresult == ISC_R_SUCCESS &&
-					   resp->rdataset->type != fctx->type)
-				{
+				} else if (eresult == ISC_R_SUCCESS) {
 					switch (resp->rdataset->type) {
 					case dns_rdatatype_cname:
 						eresult = DNS_R_CNAME;
@@ -6409,8 +6400,7 @@ cache_message(fetchctx_t *fctx, dns_message_t *message,
 }
 
 /*
- * Do what dns_ncache_addoptout() does, and then compute an appropriate
- * eresult.
+ * Call dns_ncache_add() and then compute an appropriate eresult.
  */
 static isc_result_t
 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
@@ -6424,14 +6414,9 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 		dns_rdataset_init(&rdataset);
 		ardataset = &rdataset;
 	}
-	if (secure) {
-		result = dns_ncache_addoptout(message, cache, node, covers, now,
-					      minttl, maxttl, optout,
-					      ardataset);
-	} else {
-		result = dns_ncache_add(message, cache, node, covers, now,
-					minttl, maxttl, ardataset);
-	}
+
+	result = dns_ncache_add(message, cache, node, covers, now, optout,
+				secure, minttl, maxttl, ardataset);
 	if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
 		/*
 		 * If the cache now contains a negative entry and we

lib/dns/zone.c

@@ -18385,22 +18385,18 @@ dns_zone_getsourceaddr(dns_zone_t *zone) {
 	return sourceaddr;
 }
 
-isc_result_t
-dns_zone_getprimaryaddr(dns_zone_t *zone, isc_sockaddr_t *dest) {
-	isc_result_t result = ISC_R_NOMORE;
+isc_sockaddr_t
+dns_zone_getprimaryaddr(dns_zone_t *zone) {
+	isc_sockaddr_t curraddr;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
-	REQUIRE(dest != NULL);
 
 	LOCK_ZONE(zone);
 	INSIST(dns_remote_count(&zone->primaries) > 0);
-	if (!dns_remote_done(&zone->primaries)) {
-		*dest = dns_remote_curraddr(&zone->primaries);
-		result = ISC_R_SUCCESS;
-	}
+	curraddr = dns_remote_curraddr(&zone->primaries);
 	UNLOCK_ZONE(zone);
 
-	return result;
+	return curraddr;
 }
 
 isc_time_t
@@ -18461,9 +18457,7 @@ get_request_transport_type(dns_zone_t *zone) {
 					 : DNS_TRANSPORT_UDP;
 
 		/* Check if the peer is forced to always use TCP. */
-		if (transport_type != DNS_TRANSPORT_TCP &&
-		    !dns_remote_done(&zone->primaries))
-		{
+		if (transport_type != DNS_TRANSPORT_TCP) {
 			isc_result_t result;
 			isc_sockaddr_t primaryaddr;
 			isc_netaddr_t primaryip;

lib/isc/Makefile.am

@@ -15,6 +15,7 @@ libisc_la_HEADERS =			\
 	include/isc/base64.h		\
 	include/isc/buffer.h		\
 	include/isc/commandline.h	\
+	include/isc/condition.h		\
 	include/isc/counter.h		\
 	include/isc/crypto.h		\
 	include/isc/dir.h		\
@@ -24,6 +25,7 @@ libisc_la_HEADERS =			\
 	include/isc/errno.h		\
 	include/isc/error.h		\
 	include/isc/file.h		\
+	include/isc/fips.h		\
 	include/isc/formatcheck.h	\
 	include/isc/fuzz.h		\
 	include/isc/getaddresses.h	\
@@ -50,6 +52,7 @@ libisc_la_HEADERS =			\
 	include/isc/mem.h		\
 	include/isc/meminfo.h		\
 	include/isc/mutex.h		\
+	include/isc/mutexblock.h	\
 	include/isc/net.h		\
 	include/isc/netaddr.h		\
 	include/isc/netmgr.h		\
@@ -120,6 +123,7 @@ libisc_la_SOURCES =		\
 	base32.c		\
 	base64.c		\
 	commandline.c		\
+	condition.c		\
 	counter.c		\
 	crypto.c		\
 	dir.c			\
@@ -129,6 +133,7 @@ libisc_la_SOURCES =		\
 	errno2result.h		\
 	error.c			\
 	file.c			\
+	fips.c			\
 	getaddresses.c		\
 	hash.c			\
 	hashmap.c		\
@@ -156,6 +161,7 @@ libisc_la_SOURCES =		\
 	meminfo.c		\
 	mutex.c			\
 	mutex_p.h		\
+	mutexblock.c		\
 	net.c			\
 	netaddr.c		\
 	netscope.c		\

lib/isc/async.c

@@ -18,6 +18,7 @@
 #include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/barrier.h>
+#include <isc/condition.h>
 #include <isc/job.h>
 #include <isc/loop.h>
 #include <isc/magic.h>

lib/isc/condition.c

@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <errno.h>
+
+#include <isc/condition.h>
+#include <isc/strerr.h>
+#include <isc/string.h>
+#include <isc/time.h>
+#include <isc/util.h>
+
+isc_result_t
+isc__condition_waituntil(pthread_cond_t *c, pthread_mutex_t *m, isc_time_t *t) {
+	int presult;
+	isc_result_t result;
+	struct timespec ts;
+
+	REQUIRE(c != NULL && m != NULL && t != NULL);
+
+	/*
+	 * POSIX defines a timespec's tv_sec as time_t.
+	 */
+	result = isc_time_secondsastimet(t, &ts.tv_sec);
+
+	/*
+	 * If we have a range error ts.tv_sec is most probably a signed
+	 * 32 bit value.  Set ts.tv_sec to INT_MAX.  This is a kludge.
+	 */
+	if (result == ISC_R_RANGE) {
+		ts.tv_sec = INT_MAX;
+	} else if (result != ISC_R_SUCCESS) {
+		return result;
+	}
+
+	/*!
+	 * POSIX defines a timespec's tv_nsec as long.  isc_time_nanoseconds
+	 * ensures its return value is < 1 billion, which will fit in a long.
+	 */
+	ts.tv_nsec = (long)isc_time_nanoseconds(t);
+
+	do {
+		presult = pthread_cond_timedwait(c, m, &ts);
+		if (presult == 0) {
+			return ISC_R_SUCCESS;
+		}
+		if (presult == ETIMEDOUT) {
+			return ISC_R_TIMEDOUT;
+		}
+	} while (presult == EINTR);
+
+	UNEXPECTED_SYSERROR(presult, "pthread_cond_timedwait()");
+	return ISC_R_UNEXPECTED;
+}

lib/isc/crypto.c

@@ -11,17 +11,13 @@
  * information regarding copyright ownership.
  */
 
-#include <openssl/crypto.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/rand.h>
 #include <openssl/ssl.h>
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-#include <openssl/provider.h>
-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
-
 #include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/tls.h>
@@ -29,10 +25,6 @@
 
 static isc_mem_t *isc__crypto_mctx = NULL;
 
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-static OSSL_PROVIDER *base = NULL, *fips = NULL;
-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
-
 const EVP_MD *isc__crypto_md5 = NULL;
 const EVP_MD *isc__crypto_sha1 = NULL;
 const EVP_MD *isc__crypto_sha224 = NULL;
@@ -57,6 +49,7 @@ const EVP_MD *isc__crypto_sha512 = NULL;
 			isc__crypto_##alg = NULL;                \
 		}                                                \
 	}
+
 #else /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
 #define md_register_algorithm(alg, algname)      \
 	{                                        \
@@ -68,34 +61,6 @@ const EVP_MD *isc__crypto_sha512 = NULL;
 #define md_unregister_algorithm(alg)
 #endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
 
-static isc_result_t
-register_algorithms(void) {
-	if (!isc_crypto_fips_mode()) {
-		md_register_algorithm(md5, "MD5");
-	}
-
-	md_register_algorithm(sha1, "SHA1");
-	md_register_algorithm(sha224, "SHA224");
-	md_register_algorithm(sha256, "SHA256");
-	md_register_algorithm(sha384, "SHA384");
-	md_register_algorithm(sha512, "SHA512");
-
-	return ISC_R_SUCCESS;
-}
-
-static void
-unregister_algorithms(void) {
-	md_unregister_algorithm(sha512);
-	md_unregister_algorithm(sha384);
-	md_unregister_algorithm(sha256);
-	md_unregister_algorithm(sha224);
-	md_unregister_algorithm(sha1);
-	md_unregister_algorithm(md5);
-}
-
-#undef md_unregister_algorithm
-#undef md_register_algorithm
-
 #if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L
 /*
  * This was crippled with LibreSSL, so just skip it:
@@ -114,14 +79,14 @@ unregister_algorithms(void) {
 
 static void *
 isc__crypto_malloc_ex(size_t size, const char *file, int line) {
-	return isc__mem_allocate(isc__crypto_mctx, size, 0, __func__, file,
+	return isc__mem_allocate(isc__crypto_mctx, size, 0, file,
 				 (unsigned int)line);
 }
 
 static void *
 isc__crypto_realloc_ex(void *ptr, size_t size, const char *file, int line) {
-	return isc__mem_reallocate(isc__crypto_mctx, ptr, size, 0, __func__,
-				   file, (unsigned int)line);
+	return isc__mem_reallocate(isc__crypto_mctx, ptr, size, 0, file,
+				   (unsigned int)line);
 }
 
 static void
@@ -130,7 +95,7 @@ isc__crypto_free_ex(void *ptr, const char *file, int line) {
 		return;
 	}
 	if (isc__crypto_mctx != NULL) {
-		isc__mem_free(isc__crypto_mctx, ptr, 0, __func__, file,
+		isc__mem_free(isc__crypto_mctx, ptr, 0, file,
 			      (unsigned int)line);
 	}
 }
@@ -167,82 +132,6 @@ isc__crypto_free_ex(void *ptr, const char *file, int line) {
 
 #endif /* !defined(LIBRESSL_VERSION_NUMBER) */
 
-#if defined(HAVE_EVP_DEFAULT_PROPERTIES_ENABLE_FIPS)
-bool
-isc_crypto_fips_mode(void) {
-	return EVP_default_properties_is_fips_enabled(NULL) != 0;
-}
-
-isc_result_t
-isc_crypto_fips_enable(void) {
-	if (isc_crypto_fips_mode()) {
-		return ISC_R_SUCCESS;
-	}
-
-	INSIST(fips == NULL);
-	fips = OSSL_PROVIDER_load(NULL, "fips");
-	if (fips == NULL) {
-		return isc_tlserr2result(
-			ISC_LOGCATEGORY_GENERAL, ISC_LOGMODULE_CRYPTO,
-			"OSSL_PROVIDER_load", ISC_R_CRYPTOFAILURE);
-	}
-
-	INSIST(base == NULL);
-	base = OSSL_PROVIDER_load(NULL, "base");
-	if (base == NULL) {
-		OSSL_PROVIDER_unload(fips);
-		return isc_tlserr2result(
-			ISC_LOGCATEGORY_GENERAL, ISC_LOGMODULE_CRYPTO,
-			"OSS_PROVIDER_load", ISC_R_CRYPTOFAILURE);
-	}
-
-	if (EVP_default_properties_enable_fips(NULL, 1) == 0) {
-		return isc_tlserr2result(ISC_LOGCATEGORY_GENERAL,
-					 ISC_LOGMODULE_CRYPTO,
-					 "EVP_default_properties_enable_fips",
-					 ISC_R_CRYPTOFAILURE);
-	}
-
-	unregister_algorithms();
-	register_algorithms();
-
-	return ISC_R_SUCCESS;
-}
-#elif defined(HAVE_FIPS_MODE)
-bool
-isc_crypto_fips_mode(void) {
-	return FIPS_mode() != 0;
-}
-
-isc_result_t
-isc_crypto_fips_enable(void) {
-	if (isc_crypto_fips_mode()) {
-		return ISC_R_SUCCESS;
-	}
-
-	if (FIPS_mode_set(1) == 0) {
-		return isc_tlserr2result(ISC_LOGCATEGORY_GENERAL,
-					 ISC_LOGMODULE_CRYPTO, "FIPS_mode_set",
-					 ISC_R_CRYPTOFAILURE);
-	}
-
-	unregister_algorithms();
-	register_algorithms();
-
-	return ISC_R_SUCCESS;
-}
-#else
-bool
-isc_crypto_fips_mode(void) {
-	return false;
-}
-
-isc_result_t
-isc_crypto_fips_enable(void) {
-	return ISC_R_NOTIMPLEMENTED;
-}
-#endif
-
 void
 isc__crypto_setdestroycheck(bool check) {
 	isc_mem_setdestroycheck(isc__crypto_mctx, check);
@@ -278,16 +167,6 @@ isc__crypto_initialize(void) {
 
 	RUNTIME_CHECK(OPENSSL_init_ssl(opts, NULL) == 1);
 
-	register_algorithms();
-
-#if defined(ENABLE_FIPS_MODE)
-	if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-		ERR_clear_error();
-		FATAL_ERROR("Failed to toggle FIPS mode but is "
-			    "required for this build");
-	}
-#endif
-
 	/* Protect ourselves against unseeded PRNG */
 	if (RAND_status() != 1) {
 		isc_tlserr2result(ISC_LOGCATEGORY_GENERAL, ISC_LOGMODULE_CRYPTO,
@@ -296,23 +175,39 @@ isc__crypto_initialize(void) {
 			    "cannot be initialized (see the `PRNG not "
 			    "seeded' message in the OpenSSL FAQ)");
 	}
+
+#if defined(ENABLE_FIPS_MODE)
+	if (!isc_fips_mode()) {
+		if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+			isc_tlserr2result(ISC_LOGCATEGORY_GENERAL,
+					  ISC_LOGMODULE_CRYPTO, "FIPS_mode_set",
+					  ISC_R_CRYPTOFAILURE);
+			exit(EXIT_FAILURE);
+		}
+	}
+#endif
+
+	md_register_algorithm(md5, "MD5");
+	md_register_algorithm(sha1, "SHA1");
+	md_register_algorithm(sha224, "SHA224");
+	md_register_algorithm(sha256, "SHA256");
+	md_register_algorithm(sha384, "SHA384");
+	md_register_algorithm(sha512, "SHA512");
 }
 
 void
 isc__crypto_shutdown(void) {
-	unregister_algorithms();
-
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
-	if (base != NULL) {
-		OSSL_PROVIDER_unload(base);
-	}
-
-	if (fips != NULL) {
-		OSSL_PROVIDER_unload(fips);
-	}
-#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
+	md_unregister_algorithm(sha512);
+	md_unregister_algorithm(sha384);
+	md_unregister_algorithm(sha256);
+	md_unregister_algorithm(sha224);
+	md_unregister_algorithm(sha1);
+	md_unregister_algorithm(md5);
 
 	OPENSSL_cleanup();
 
-	isc_mem_detach(&isc__crypto_mctx);
+	isc_mem_destroy(&isc__crypto_mctx);
 }
+
+#undef md_unregister_algorithm
+#undef md_register_algorithm

lib/isc/fips.c

@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <isc/fips.h>
+#include <isc/util.h>
+
+#if defined(HAVE_EVP_DEFAULT_PROPERTIES_ENABLE_FIPS)
+#include <openssl/evp.h>
+bool
+isc_fips_mode(void) {
+	return EVP_default_properties_is_fips_enabled(NULL) != 0;
+}
+
+isc_result_t
+isc_fips_set_mode(int mode) {
+	return EVP_default_properties_enable_fips(NULL, mode) != 0
+		       ? ISC_R_SUCCESS
+		       : ISC_R_FAILURE;
+}
+#elif defined(HAVE_FIPS_MODE)
+#include <openssl/crypto.h>
+
+bool
+isc_fips_mode(void) {
+	return FIPS_mode() != 0;
+}
+
+isc_result_t
+isc_fips_set_mode(int mode) {
+	return FIPS_mode_set(mode) != 0 ? ISC_R_SUCCESS : ISC_R_FAILURE;
+}
+#else
+bool
+isc_fips_mode(void) {
+	return false;
+}
+
+isc_result_t
+isc_fips_set_mode(int mode) {
+	UNUSED(mode);
+	return ISC_R_NOTIMPLEMENTED;
+}
+#endif

lib/isc/helper.c

@@ -17,6 +17,7 @@
 
 #include <isc/atomic.h>
 #include <isc/barrier.h>
+#include <isc/condition.h>
 #include <isc/helper.h>
 #include <isc/job.h>
 #include <isc/loop.h>

lib/isc/include/isc/condition.h

@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file */
+
+#include <errno.h>
+#include <stdlib.h>
+
+#include <isc/error.h>
+#include <isc/mutex.h>
+#include <isc/result.h>
+#include <isc/string.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+/*
+ * We use macros instead of static inline functions so that the exact code
+ * location can be reported when PTHREADS_RUNTIME_CHECK() fails or when mutrace
+ * reports lock contention.
+ */
+
+#ifdef ISC_TRACK_PTHREADS_OBJECTS
+
+typedef pthread_cond_t *isc_condition_t;
+
+#define isc_condition_init(cp)              \
+	{                                   \
+		*cp = malloc(sizeof(**cp)); \
+		isc__condition_init(*cp);   \
+	}
+#define isc_condition_wait(cp, mp)	   isc__condition_wait(*cp, *mp)
+#define isc_condition_waituntil(cp, mp, t) isc__condition_waituntil(*cp, *mp, t)
+#define isc_condition_signal(cp)	   isc__condition_signal(*cp)
+#define isc_condition_broadcast(cp)	   isc__condition_broadcast(*cp)
+#define isc_condition_destroy(cp)            \
+	{                                    \
+		isc__condition_destroy(*cp); \
+		free(*cp);                   \
+	}
+
+#else /* ISC_TRACK_PTHREADS_OBJECTS */
+
+typedef pthread_cond_t isc_condition_t;
+
+#define isc_condition_init(cond)	   isc__condition_init(cond)
+#define isc_condition_wait(cp, mp)	   isc__condition_wait(cp, mp)
+#define isc_condition_waituntil(cp, mp, t) isc__condition_waituntil(cp, mp, t)
+#define isc_condition_signal(cp)	   isc__condition_signal(cp)
+#define isc_condition_broadcast(cp)	   isc__condition_broadcast(cp)
+#define isc_condition_destroy(cp)	   isc__condition_destroy(cp)
+
+#endif /* ISC_TRACK_PTHREADS_OBJECTS */
+
+#define isc__condition_init(cond)                                \
+	{                                                        \
+		int _ret = pthread_cond_init(cond, NULL);        \
+		PTHREADS_RUNTIME_CHECK(pthread_cond_init, _ret); \
+	}
+
+#define isc__condition_wait(cp, mp)                              \
+	{                                                        \
+		int _ret = pthread_cond_wait(cp, mp);            \
+		PTHREADS_RUNTIME_CHECK(pthread_cond_wait, _ret); \
+	}
+
+#define isc__condition_signal(cp)                                  \
+	{                                                          \
+		int _ret = pthread_cond_signal(cp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_cond_signal, _ret); \
+	}
+
+#define isc__condition_broadcast(cp)                                  \
+	{                                                             \
+		int _ret = pthread_cond_broadcast(cp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_cond_broadcast, _ret); \
+	}
+
+#define isc__condition_destroy(cp)                                  \
+	{                                                           \
+		int _ret = pthread_cond_destroy(cp);                \
+		PTHREADS_RUNTIME_CHECK(pthread_cond_destroy, _ret); \
+	}
+
+isc_result_t
+isc__condition_waituntil(pthread_cond_t *, pthread_mutex_t *, isc_time_t *);

lib/isc/include/isc/crypto.h

@@ -24,20 +24,6 @@ extern const EVP_MD *isc__crypto_sha256;
 extern const EVP_MD *isc__crypto_sha384;
 extern const EVP_MD *isc__crypto_sha512;
 
-bool
-isc_crypto_fips_mode(void);
-/*
- * Return if FIPS mode is currently enabled or not.
- */
-
-isc_result_t
-isc_crypto_fips_enable(void);
-/*
- * Enable FIPS mode. It cannot be disabled afterwards.
- *
- * This function is NOT thread safe.
- */
-
 /**
  * Private
  */

lib/isc/include/isc/fips.h

@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*****
+***** Module Info
+*****/
+
+/***
+ *** Imports
+ ***/
+
+#include <isc/types.h>
+
+/***
+ *** Functions
+ ***/
+
+bool
+isc_fips_mode(void);
+/*
+ * Return if FIPS mode is currently enabled or not
+ */
+
+isc_result_t
+isc_fips_set_mode(int mode);
+/*
+ * Enable FIPS mode.
+ */

lib/isc/include/isc/mem.h

@@ -21,12 +21,9 @@
 #include <isc/attributes.h>
 #include <isc/mutex.h>
 #include <isc/overflow.h>
-#include <isc/refcount.h>
 #include <isc/types.h>
 #include <isc/urcu.h>
 
-/* Add -DISC_MEM_TRACE=1 to CFLAGS for detailed reference tracing */
-
 /*%
  * Define ISC_MEM_TRACKLINES=1 to turn on detailed tracing of memory
  * allocation and freeing by file and line number.
@@ -65,8 +62,8 @@ extern unsigned int isc_mem_defaultflags;
 /*@}*/
 
 #if ISC_MEM_TRACKLINES
-#define _ISC_MEM_FILELINE , __func__, __FILE__, __LINE__
-#define _ISC_MEM_FLARG	  , const char *, const char *, unsigned int
+#define _ISC_MEM_FILELINE , __FILE__, __LINE__
+#define _ISC_MEM_FLARG	  , const char *, unsigned int
 #else /* if ISC_MEM_TRACKLINES */
 #define _ISC_MEM_FILELINE
 #define _ISC_MEM_FLARG
@@ -252,16 +249,35 @@ isc_mem_arena_set_dirty_decay_ms(isc_mem_t *mctx, const ssize_t decay_ms);
  */
 /*@}*/
 
-#if ISC_MEM_TRACE
-#define isc_mem_ref(ptr)   isc_mem__ref(ptr, __func__, __FILE__, __LINE__)
-#define isc_mem_unref(ptr) isc_mem__unref(ptr, __func__, __FILE__, __LINE__)
-#define isc_mem_attach(ptr, ptrp) \
-	isc_mem__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
-#define isc_mem_detach(ptrp) isc_mem__detach(ptrp, __func__, __FILE__, __LINE__)
-ISC_REFCOUNT_TRACE_DECL(isc_mem);
-#else
-ISC_REFCOUNT_DECL(isc_mem);
-#endif
+void
+isc_mem_attach(isc_mem_t *, isc_mem_t **);
+
+/*@{*/
+void
+isc_mem_attach(isc_mem_t *, isc_mem_t **);
+#define isc_mem_detach(cp) isc__mem_detach((cp)_ISC_MEM_FILELINE)
+void
+isc__mem_detach(isc_mem_t **_ISC_MEM_FLARG);
+/*!<
+ * \brief Attach to / detach from a memory context.
+ *
+ * This is intended for applications that use multiple memory contexts
+ * in such a way that it is not obvious when the last allocations from
+ * a given context has been freed and destroying the context is safe.
+ *
+ * Most applications do not need to call these functions as they can
+ * simply create a single memory context at the beginning of main()
+ * and destroy it at the end of main(), thereby guaranteeing that it
+ * is not destroyed while there are outstanding allocations.
+ */
+/*@}*/
+
+#define isc_mem_destroy(cp) isc__mem_destroy((cp)_ISC_MEM_FILELINE)
+void
+isc__mem_destroy(isc_mem_t **_ISC_MEM_FLARG);
+/*%<
+ * Destroy a memory context.
+ */
 
 void
 isc_mem_stats(isc_mem_t *mctx, FILE *out);

lib/isc/include/isc/mutex.h

@@ -22,21 +22,6 @@
 #include <isc/result.h> /* for ISC_R_ codes */
 #include <isc/util.h>
 
-#define LOCK(lp)                                                           \
-	{                                                                  \
-		ISC_UTIL_TRACE(fprintf(stderr, "LOCKING %p %s %d\n", (lp), \
-				       __FILE__, __LINE__));               \
-		isc_mutex_lock((lp));                                      \
-		ISC_UTIL_TRACE(fprintf(stderr, "LOCKED %p %s %d\n", (lp),  \
-				       __FILE__, __LINE__));               \
-	}
-#define UNLOCK(lp)                                                          \
-	{                                                                   \
-		isc_mutex_unlock((lp));                                     \
-		ISC_UTIL_TRACE(fprintf(stderr, "UNLOCKED %p %s %d\n", (lp), \
-				       __FILE__, __LINE__));                \
-	}
-
 /*
  * We use macros instead of static inline functions so that the exact code
  * location can be reported when PTHREADS_RUNTIME_CHECK() fails or when mutrace

lib/isc/include/isc/mutexblock.h

@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file isc/mutexblock.h */
+
+#include <isc/mutex.h>
+#include <isc/types.h>
+
+void
+isc_mutexblock_init(isc_mutex_t *block, unsigned int count);
+/*%<
+ * Initialize a block of locks.  If an error occurs all initialized locks
+ * will be destroyed, if possible.
+ *
+ * Requires:
+ *
+ *\li	block != NULL
+ *
+ *\li	count > 0
+ *
+ */
+
+void
+isc_mutexblock_destroy(isc_mutex_t *block, unsigned int count);
+/*%<
+ * Destroy a block of locks.
+ *
+ * Requires:
+ *
+ *\li	block != NULL
+ *
+ *\li	count > 0
+ *
+ *\li	Each lock in the block be initialized via isc_mutex_init() or
+ * 	the whole block was initialized via isc_mutex_initblock().
+ *
+ */

lib/isc/include/isc/rwlock.h

@@ -14,6 +14,7 @@
 #pragma once
 
 #include <inttypes.h>
+#include <stdlib.h>
 
 /*! \file isc/rwlock.h */
 
@@ -26,42 +27,7 @@ typedef enum {
 	isc_rwlocktype_write
 } isc_rwlocktype_t;
 
-#define RWLOCK(lp, t)                                                         \
-	{                                                                     \
-		ISC_UTIL_TRACE(fprintf(stderr, "RWLOCK %p, %d %s %d\n", (lp), \
-				       (t), __FILE__, __LINE__));             \
-		isc_rwlock_lock((lp), (t));                                   \
-		ISC_UTIL_TRACE(fprintf(stderr, "RWLOCKED %p, %d %s %d\n",     \
-				       (lp), (t), __FILE__, __LINE__));       \
-	}
-#define RWUNLOCK(lp, t)                                                   \
-	{                                                                 \
-		ISC_UTIL_TRACE(fprintf(stderr, "RWUNLOCK %p, %d %s %d\n", \
-				       (lp), (t), __FILE__, __LINE__));   \
-		isc_rwlock_unlock((lp), (t));                             \
-	}
-
-#define RDLOCK(lp)   RWLOCK(lp, isc_rwlocktype_read)
-#define RDUNLOCK(lp) RWUNLOCK(lp, isc_rwlocktype_read)
-#define WRLOCK(lp)   RWLOCK(lp, isc_rwlocktype_write)
-#define WRUNLOCK(lp) RWUNLOCK(lp, isc_rwlocktype_write)
-
-#define UPGRADELOCK(lock, locktype)                                         \
-	{                                                                   \
-		if (locktype == isc_rwlocktype_read) {                      \
-			if (isc_rwlock_tryupgrade(lock) == ISC_R_SUCCESS) { \
-				locktype = isc_rwlocktype_write;            \
-			} else {                                            \
-				RWUNLOCK(lock, locktype);                   \
-				locktype = isc_rwlocktype_write;            \
-				RWLOCK(lock, locktype);                     \
-			}                                                   \
-		}                                                           \
-		INSIST(locktype == isc_rwlocktype_write);                   \
-	}
-
 #if USE_PTHREAD_RWLOCK
-#include <errno.h>
 #include <pthread.h>
 
 /*
@@ -72,8 +38,6 @@ typedef enum {
 
 #if ISC_TRACK_PTHREADS_OBJECTS
 
-#include <stdlib.h>
-
 typedef pthread_rwlock_t *isc_rwlock_t;
 typedef pthread_rwlock_t  isc__rwlock_t;
 

lib/isc/include/isc/spinlock.h

@@ -21,21 +21,6 @@
 #include <isc/atomic.h>
 #include <isc/util.h>
 
-#define SPINLOCK(sp)                                                           \
-	{                                                                      \
-		ISC_UTIL_TRACE(fprintf(stderr, "SPINLOCKING %p %s %d\n", (sp), \
-				       __FILE__, __LINE__));                   \
-		isc_spinlock_lock((sp));                                       \
-		ISC_UTIL_TRACE(fprintf(stderr, "SPINLOCKED %p %s %d\n", (sp),  \
-				       __FILE__, __LINE__));                   \
-	}
-#define SPINUNLOCK(sp)                                                    \
-	{                                                                 \
-		isc_spinlock_unlock((sp));                                \
-		ISC_UTIL_TRACE(fprintf(stderr, "SPINUNLOCKED %p %s %d\n", \
-				       (sp), __FILE__, __LINE__));        \
-	}
-
 /*
  * We use macros instead of static inline functions so that the exact code
  * location can be reported when PTHREADS_RUNTIME_CHECK() fails or when mutrace

lib/isc/include/isc/util.h

@@ -27,6 +27,8 @@
  * ISC_ or isc_ to the name.
  */
 
+#include <isc/attributes.h>
+
 /***
  *** Clang Compatibility Macros
  ***/
@@ -108,6 +110,11 @@
  */
 #define EMPTY_TRANSLATION_UNIT extern int isc__empty;
 
+/*%
+ * We use macros instead of calling the routines directly because
+ * the capital letters make the locking stand out.
+ */
+
 #ifdef ISC_UTIL_TRACEON
 #define ISC_UTIL_TRACE(a) a
 #include <stdio.h> /* Required for fprintf/stderr when tracing. */
@@ -115,6 +122,125 @@
 #define ISC_UTIL_TRACE(a)
 #endif /* ifdef ISC_UTIL_TRACEON */
 
+#include <isc/result.h> /* Contractual promise. */
+
+#define SPINLOCK(sp)                                                           \
+	{                                                                      \
+		ISC_UTIL_TRACE(fprintf(stderr, "SPINLOCKING %p %s %d\n", (sp), \
+				       __FILE__, __LINE__));                   \
+		isc_spinlock_lock((sp));                                       \
+		ISC_UTIL_TRACE(fprintf(stderr, "SPINLOCKED %p %s %d\n", (sp),  \
+				       __FILE__, __LINE__));                   \
+	}
+#define SPINUNLOCK(sp)                                                    \
+	{                                                                 \
+		isc_spinlock_unlock((sp));                                \
+		ISC_UTIL_TRACE(fprintf(stderr, "SPINUNLOCKED %p %s %d\n", \
+				       (sp), __FILE__, __LINE__));        \
+	}
+
+#define LOCK(lp)                                                           \
+	{                                                                  \
+		ISC_UTIL_TRACE(fprintf(stderr, "LOCKING %p %s %d\n", (lp), \
+				       __FILE__, __LINE__));               \
+		isc_mutex_lock((lp));                                      \
+		ISC_UTIL_TRACE(fprintf(stderr, "LOCKED %p %s %d\n", (lp),  \
+				       __FILE__, __LINE__));               \
+	}
+#define UNLOCK(lp)                                                          \
+	{                                                                   \
+		isc_mutex_unlock((lp));                                     \
+		ISC_UTIL_TRACE(fprintf(stderr, "UNLOCKED %p %s %d\n", (lp), \
+				       __FILE__, __LINE__));                \
+	}
+
+#define BROADCAST(cvp)                                                        \
+	{                                                                     \
+		ISC_UTIL_TRACE(fprintf(stderr, "BROADCAST %p %s %d\n", (cvp), \
+				       __FILE__, __LINE__));                  \
+		isc_condition_broadcast((cvp));                               \
+	}
+#define SIGNAL(cvp)                                                        \
+	{                                                                  \
+		ISC_UTIL_TRACE(fprintf(stderr, "SIGNAL %p %s %d\n", (cvp), \
+				       __FILE__, __LINE__));               \
+		isc_condition_signal((cvp));                               \
+	}
+#define WAIT(cvp, lp)                                                         \
+	{                                                                     \
+		ISC_UTIL_TRACE(fprintf(stderr, "WAIT %p LOCK %p %s %d\n",     \
+				       (cvp), (lp), __FILE__, __LINE__));     \
+		isc_condition_wait((cvp), (lp));                              \
+		ISC_UTIL_TRACE(fprintf(stderr, "WAITED %p LOCKED %p %s %d\n", \
+				       (cvp), (lp), __FILE__, __LINE__));     \
+	}
+
+/*
+ * isc_condition_waituntil can return ISC_R_TIMEDOUT, so we
+ * don't RUNTIME_CHECK the result.
+ *
+ *  XXX Also, can't really debug this then...
+ */
+
+#define WAITUNTIL(cvp, lp, tp) isc_condition_waituntil((cvp), (lp), (tp))
+
+#define RWLOCK(lp, t)                                                         \
+	{                                                                     \
+		ISC_UTIL_TRACE(fprintf(stderr, "RWLOCK %p, %d %s %d\n", (lp), \
+				       (t), __FILE__, __LINE__));             \
+		isc_rwlock_lock((lp), (t));                                   \
+		ISC_UTIL_TRACE(fprintf(stderr, "RWLOCKED %p, %d %s %d\n",     \
+				       (lp), (t), __FILE__, __LINE__));       \
+	}
+#define RWUNLOCK(lp, t)                                                   \
+	{                                                                 \
+		ISC_UTIL_TRACE(fprintf(stderr, "RWUNLOCK %p, %d %s %d\n", \
+				       (lp), (t), __FILE__, __LINE__));   \
+		isc_rwlock_unlock((lp), (t));                             \
+	}
+
+#define RDLOCK(lp)   RWLOCK(lp, isc_rwlocktype_read)
+#define RDUNLOCK(lp) RWUNLOCK(lp, isc_rwlocktype_read)
+#define WRLOCK(lp)   RWLOCK(lp, isc_rwlocktype_write)
+#define WRUNLOCK(lp) RWUNLOCK(lp, isc_rwlocktype_write)
+
+#define UPGRADELOCK(lock, locktype)                                         \
+	{                                                                   \
+		if (locktype == isc_rwlocktype_read) {                      \
+			if (isc_rwlock_tryupgrade(lock) == ISC_R_SUCCESS) { \
+				locktype = isc_rwlocktype_write;            \
+			} else {                                            \
+				RWUNLOCK(lock, locktype);                   \
+				locktype = isc_rwlocktype_write;            \
+				RWLOCK(lock, locktype);                     \
+			}                                                   \
+		}                                                           \
+		INSIST(locktype == isc_rwlocktype_write);                   \
+	}
+
+/*
+ * List Macros.
+ */
+#include <isc/list.h> /* Contractual promise. */
+
+#define LIST(type)		       ISC_LIST(type)
+#define INIT_LIST(type)		       ISC_LIST_INIT(type)
+#define LINK(type)		       ISC_LINK(type)
+#define INIT_LINK(elt, link)	       ISC_LINK_INIT(elt, link)
+#define HEAD(list)		       ISC_LIST_HEAD(list)
+#define TAIL(list)		       ISC_LIST_TAIL(list)
+#define EMPTY(list)		       ISC_LIST_EMPTY(list)
+#define PREV(elt, link)		       ISC_LIST_PREV(elt, link)
+#define NEXT(elt, link)		       ISC_LIST_NEXT(elt, link)
+#define APPEND(list, elt, link)	       ISC_LIST_APPEND(list, elt, link)
+#define PREPEND(list, elt, link)       ISC_LIST_PREPEND(list, elt, link)
+#define UNLINK(list, elt, link)	       ISC_LIST_UNLINK(list, elt, link)
+#define ENQUEUE(list, elt, link)       ISC_LIST_APPEND(list, elt, link)
+#define DEQUEUE(list, elt, link)       ISC_LIST_UNLINK(list, elt, link)
+#define INSERTBEFORE(li, b, e, ln)     ISC_LIST_INSERTBEFORE(li, b, e, ln)
+#define INSERTAFTER(li, a, e, ln)      ISC_LIST_INSERTAFTER(li, a, e, ln)
+#define APPENDLIST(list1, list2, link) ISC_LIST_APPENDLIST(list1, list2, link)
+
 /*%
  * Performance
  */
@@ -140,7 +266,18 @@
 #define ISC_NO_SANITIZE_THREAD
 #endif /* if __SANITIZE_THREAD__ */
 
+#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR >= 6)
 #define STATIC_ASSERT(cond, msg) _Static_assert(cond, msg)
+#elif __has_feature(c_static_assert)
+#define STATIC_ASSERT(cond, msg) _Static_assert(cond, msg)
+#else /* if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR >= 6) */
+
+/* Courtesy of Joseph Quinsey: https://godbolt.org/z/K9RvWS */
+#define TOKENPASTE(a, b)	a##b /* "##" is the "Token Pasting Operator" */
+#define EXPAND_THEN_PASTE(a, b) TOKENPASTE(a, b) /* expand then paste */
+#define STATIC_ASSERT(x, msg) \
+	enum { EXPAND_THEN_PASTE(ASSERT_line_, __LINE__) = 1 / ((msg) && (x)) }
+#endif /* if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR >= 6) */
 
 #ifdef UNIT_TESTING
 extern void
@@ -199,6 +336,8 @@ mock_assert(const int result, const char *const expression,
 /*
  * Errors
  */
+#include <errno.h> /* for errno */
+
 #include <isc/error.h>	/* Contractual promise. */
 #include <isc/strerr.h> /* for ISC_STRERRORSIZE */
 

lib/isc/job.c

@@ -17,6 +17,7 @@
 
 #include <isc/atomic.h>
 #include <isc/barrier.h>
+#include <isc/condition.h>
 #include <isc/job.h>
 #include <isc/list.h>
 #include <isc/loop.h>

lib/isc/lex.c

@@ -61,7 +61,7 @@ struct isc_lex {
 	unsigned int paren_count;
 	unsigned int saved_paren_count;
 	isc_lexspecials_t specials;
-	ISC_LIST(struct inputsource) sources;
+	LIST(struct inputsource) sources;
 };
 
 static void
@@ -104,7 +104,7 @@ isc_lex_create(isc_mem_t *mctx, size_t max_token, isc_lex_t **lexp) {
 	lex->paren_count = 0;
 	lex->saved_paren_count = 0;
 	memset(lex->specials, 0, 256);
-	ISC_LIST_INIT(lex->sources);
+	INIT_LIST(lex->sources);
 	lex->magic = LEX_MAGIC;
 
 	*lexp = lex;
@@ -123,7 +123,7 @@ isc_lex_destroy(isc_lex_t **lexp) {
 	*lexp = NULL;
 	REQUIRE(VALID_LEX(lex));
 
-	while (!ISC_LIST_EMPTY(lex->sources)) {
+	while (!EMPTY(lex->sources)) {
 		RUNTIME_CHECK(isc_lex_close(lex) == ISC_R_SUCCESS);
 	}
 	if (lex->data != NULL) {
@@ -259,7 +259,7 @@ isc_lex_close(isc_lex_t *lex) {
 
 	REQUIRE(VALID_LEX(lex));
 
-	source = ISC_LIST_HEAD(lex->sources);
+	source = HEAD(lex->sources);
 	if (source == NULL) {
 		return ISC_R_NOMORE;
 	}
@@ -352,7 +352,7 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 	 */
 
 	REQUIRE(VALID_LEX(lex));
-	source = ISC_LIST_HEAD(lex->sources);
+	source = HEAD(lex->sources);
 	REQUIRE(tokenp != NULL);
 
 	if (source == NULL) {
@@ -999,7 +999,7 @@ isc_lex_ungettoken(isc_lex_t *lex, isc_token_t *tokenp) {
 	 */
 
 	REQUIRE(VALID_LEX(lex));
-	source = ISC_LIST_HEAD(lex->sources);
+	source = HEAD(lex->sources);
 	REQUIRE(source != NULL);
 	REQUIRE(tokenp != NULL);
 	REQUIRE(isc_buffer_consumedlength(source->pushback) != 0 ||
@@ -1018,7 +1018,7 @@ isc_lex_getlasttokentext(isc_lex_t *lex, isc_token_t *tokenp, isc_region_t *r) {
 	inputsource *source;
 
 	REQUIRE(VALID_LEX(lex));
-	source = ISC_LIST_HEAD(lex->sources);
+	source = HEAD(lex->sources);
 	REQUIRE(source != NULL);
 	REQUIRE(tokenp != NULL);
 	REQUIRE(isc_buffer_consumedlength(source->pushback) != 0 ||
@@ -1038,7 +1038,7 @@ isc_lex_getsourcename(isc_lex_t *lex) {
 	inputsource *source;
 
 	REQUIRE(VALID_LEX(lex));
-	source = ISC_LIST_HEAD(lex->sources);
+	source = HEAD(lex->sources);
 
 	if (source == NULL) {
 		return NULL;
@@ -1052,7 +1052,7 @@ isc_lex_getsourceline(isc_lex_t *lex) {
 	inputsource *source;
 
 	REQUIRE(VALID_LEX(lex));
-	source = ISC_LIST_HEAD(lex->sources);
+	source = HEAD(lex->sources);
 
 	if (source == NULL) {
 		return 0;
@@ -1067,7 +1067,7 @@ isc_lex_setsourcename(isc_lex_t *lex, const char *name) {
 	char *newname;
 
 	REQUIRE(VALID_LEX(lex));
-	source = ISC_LIST_HEAD(lex->sources);
+	source = HEAD(lex->sources);
 
 	if (source == NULL) {
 		return ISC_R_NOTFOUND;
@@ -1083,7 +1083,7 @@ isc_lex_setsourceline(isc_lex_t *lex, unsigned long line) {
 	inputsource *source;
 
 	REQUIRE(VALID_LEX(lex));
-	source = ISC_LIST_HEAD(lex->sources);
+	source = HEAD(lex->sources);
 
 	if (source == NULL) {
 		return ISC_R_NOTFOUND;
@@ -1099,7 +1099,7 @@ isc_lex_isfile(isc_lex_t *lex) {
 
 	REQUIRE(VALID_LEX(lex));
 
-	source = ISC_LIST_HEAD(lex->sources);
+	source = HEAD(lex->sources);
 
 	if (source == NULL) {
 		return false;

lib/isc/loop.c

@@ -18,6 +18,7 @@
 #include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/barrier.h>
+#include <isc/condition.h>
 #include <isc/job.h>
 #include <isc/list.h>
 #include <isc/log.h>

lib/isc/managers.c

@@ -47,5 +47,5 @@ isc_managers_destroy(isc_mem_t **mctxp, isc_loopmgr_t **loopmgrp,
 
 	isc_netmgr_destroy(netmgrp);
 	isc_loopmgr_destroy(loopmgrp);
-	isc_mem_detach(mctxp);
+	isc_mem_destroy(mctxp);
 }

lib/isc/mem.c

@@ -86,15 +86,14 @@ struct debuglink {
 	ISC_LINK(debuglink_t) link;
 	const void *ptr;
 	size_t size;
-	const char *func;
 	const char *file;
 	unsigned int line;
 };
 
 typedef ISC_LIST(debuglink_t) debuglist_t;
 
-#define FLARG_PASS , func, file, line
-#define FLARG	   , const char *func, const char *file, unsigned int line
+#define FLARG_PASS , file, line
+#define FLARG	   , const char *file, unsigned int line
 #else /* if ISC_MEM_TRACKLINES */
 #define FLARG_PASS
 #define FLARG
@@ -165,8 +164,8 @@ struct isc_mempool {
  */
 
 #if !ISC_MEM_TRACKLINES
-#define ADD_TRACE(mctx, ptr, size, func, file, line)
-#define DELETE_TRACE(mctx, ptr, size, func, file, line)
+#define ADD_TRACE(mctx, ptr, size, file, line)
+#define DELETE_TRACE(mctx, ptr, size, file, line)
 #define ISC_MEMFUNC_SCOPE
 #else /* if !ISC_MEM_TRACKLINES */
 #define TRACE_OR_RECORD (ISC_MEM_DEBUGTRACE | ISC_MEM_DEBUGRECORD)
@@ -174,14 +173,14 @@ struct isc_mempool {
 #define SHOULD_TRACE_OR_RECORD(mctx, ptr) \
 	(((mctx)->debugging & TRACE_OR_RECORD) != 0 && ptr != NULL)
 
-#define ADD_TRACE(mctx, ptr, size, func, file, line)                \
-	if (SHOULD_TRACE_OR_RECORD(mctx, ptr)) {                    \
-		add_trace_entry(mctx, ptr, size, func, file, line); \
+#define ADD_TRACE(mctx, ptr, size, file, line)                \
+	if (SHOULD_TRACE_OR_RECORD(mctx, ptr)) {              \
+		add_trace_entry(mctx, ptr, size, file, line); \
 	}
 
-#define DELETE_TRACE(mctx, ptr, size, func, file, line)                \
-	if (SHOULD_TRACE_OR_RECORD(mctx, ptr)) {                       \
-		delete_trace_entry(mctx, ptr, size, func, file, line); \
+#define DELETE_TRACE(mctx, ptr, size, file, line)                \
+	if (SHOULD_TRACE_OR_RECORD(mctx, ptr)) {                 \
+		delete_trace_entry(mctx, ptr, size, file, line); \
 	}
 
 static void
@@ -201,9 +200,8 @@ add_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size FLARG) {
 	MCTXLOCK(mctx);
 
 	if ((mctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
-		fprintf(stderr,
-			"add %p size %zu func %s file %s line %u mctx %p\n",
-			ptr, size, func, file, line, mctx);
+		fprintf(stderr, "add %p size %zu file %s line %u mctx %p\n",
+			ptr, size, file, line, mctx);
 	}
 
 	if (mctx->debuglist == NULL) {
@@ -227,7 +225,6 @@ add_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size FLARG) {
 	ISC_LINK_INIT(dl, link);
 	dl->ptr = ptr;
 	dl->size = size;
-	dl->func = func;
 	dl->file = file;
 	dl->line = line;
 
@@ -238,7 +235,8 @@ unlock:
 }
 
 static void
-delete_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size FLARG) {
+delete_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size,
+		   const char *file, unsigned int line) {
 	debuglink_t *dl = NULL;
 	uint32_t hash;
 	uint32_t idx;
@@ -246,9 +244,8 @@ delete_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size FLARG) {
 	MCTXLOCK(mctx);
 
 	if ((mctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
-		fprintf(stderr,
-			"del %p size %zu func %s file %s line %u mctx %p\n",
-			ptr, size, func, file, line, mctx);
+		fprintf(stderr, "del %p size %zu file %s line %u mctx %p\n",
+			ptr, size, file, line, mctx);
 	}
 
 	if (mctx->debuglist == NULL) {
@@ -430,8 +427,6 @@ void
 isc__mem_shutdown(void) {
 	bool empty;
 
-	rcu_barrier();
-
 	isc__mem_checkdestroyed();
 
 	LOCK(&contextslock);
@@ -500,11 +495,8 @@ mem_create(isc_mem_t **ctxp, unsigned int debugging, unsigned int flags,
  */
 
 static void
-mem_destroy(isc_mem_t *ctx) {
+destroy(isc_mem_t *ctx) {
 	unsigned int arena_no;
-
-	isc_refcount_destroy(&ctx->references);
-
 	LOCK(&contextslock);
 	ISC_LIST_UNLINK(contexts, ctx, link);
 	UNLOCK(&contextslock);
@@ -551,11 +543,36 @@ mem_destroy(isc_mem_t *ctx) {
 	}
 }
 
-#if ISC_MEM_TRACE
-ISC_REFCOUNT_TRACE_IMPL(isc_mem, mem_destroy);
-#else
-ISC_REFCOUNT_IMPL(isc_mem, mem_destroy);
+void
+isc_mem_attach(isc_mem_t *source, isc_mem_t **targetp) {
+	REQUIRE(VALID_CONTEXT(source));
+	REQUIRE(targetp != NULL && *targetp == NULL);
+
+	isc_refcount_increment(&source->references);
+
+	*targetp = source;
+}
+
+void
+isc__mem_detach(isc_mem_t **ctxp FLARG) {
+	isc_mem_t *ctx = NULL;
+
+	REQUIRE(ctxp != NULL && VALID_CONTEXT(*ctxp));
+
+	ctx = *ctxp;
+	*ctxp = NULL;
+
+	if (isc_refcount_decrement(&ctx->references) == 1) {
+		isc_refcount_destroy(&ctx->references);
+#if ISC_MEM_TRACKLINES
+		if ((ctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
+			fprintf(stderr, "destroy mctx %p file %s line %u\n",
+				ctx, file, line);
+		}
 #endif
+		destroy(ctx);
+	}
+}
 
 /*
  * isc_mem_putanddetach() is the equivalent of:
@@ -578,11 +595,41 @@ isc__mem_putanddetach(isc_mem_t **ctxp, void *ptr, size_t size,
 	*ctxp = NULL;
 
 	isc__mem_put(ctx, ptr, size, flags FLARG_PASS);
-#if ISC_MEM_TRACE
-	isc_mem__detach(&ctx, func, file, line);
-#else
-	isc_mem_detach(&ctx);
-#endif
+	isc__mem_detach(&ctx FLARG_PASS);
+}
+
+void
+isc__mem_destroy(isc_mem_t **ctxp FLARG) {
+	isc_mem_t *ctx = NULL;
+
+	/*
+	 * This routine provides legacy support for callers who use mctxs
+	 * without attaching/detaching.
+	 */
+
+	REQUIRE(ctxp != NULL && VALID_CONTEXT(*ctxp));
+
+	ctx = *ctxp;
+	*ctxp = NULL;
+
+	rcu_barrier();
+
+#if ISC_MEM_TRACKLINES
+	if ((ctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
+		fprintf(stderr, "destroy mctx %p file %s line %u\n", ctx, file,
+			line);
+	}
+
+	if (isc_refcount_decrement(&ctx->references) > 1) {
+		print_active(ctx, stderr);
+	}
+#else  /* if ISC_MEM_TRACKLINES */
+	isc_refcount_decrementz(&ctx->references);
+#endif /* if ISC_MEM_TRACKLINES */
+	isc_refcount_destroy(&ctx->references);
+	destroy(ctx);
+
+	*ctxp = NULL;
 }
 
 void *
@@ -594,7 +641,7 @@ isc__mem_get(isc_mem_t *ctx, size_t size, int flags FLARG) {
 	ptr = mem_get(ctx, size, flags);
 
 	mem_getstats(ctx, size);
-	ADD_TRACE(ctx, ptr, size, func, file, line);
+	ADD_TRACE(ctx, ptr, size, file, line);
 
 	return ptr;
 }
@@ -603,7 +650,7 @@ void
 isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size, int flags FLARG) {
 	REQUIRE(VALID_CONTEXT(ctx));
 
-	DELETE_TRACE(ctx, ptr, size, func, file, line);
+	DELETE_TRACE(ctx, ptr, size, file, line);
 
 	mem_putstats(ctx, size);
 	mem_put(ctx, ptr, size, flags);
@@ -700,7 +747,7 @@ isc__mem_allocate(isc_mem_t *ctx, size_t size, int flags FLARG) {
 	size = sallocx(ptr, flags | ctx->jemalloc_flags);
 
 	mem_getstats(ctx, size);
-	ADD_TRACE(ctx, ptr, size, func, file, line);
+	ADD_TRACE(ctx, ptr, size, file, line);
 
 	return ptr;
 }
@@ -716,13 +763,13 @@ isc__mem_reget(isc_mem_t *ctx, void *old_ptr, size_t old_size, size_t new_size,
 	} else if (new_size == 0) {
 		isc__mem_put(ctx, old_ptr, old_size, flags FLARG_PASS);
 	} else {
-		DELETE_TRACE(ctx, old_ptr, old_size, func, file, line);
+		DELETE_TRACE(ctx, old_ptr, old_size, file, line);
 		mem_putstats(ctx, old_size);
 
 		new_ptr = mem_realloc(ctx, old_ptr, old_size, new_size, flags);
 
 		mem_getstats(ctx, new_size);
-		ADD_TRACE(ctx, new_ptr, new_size, func, file, line);
+		ADD_TRACE(ctx, new_ptr, new_size, file, line);
 
 		/*
 		 * We want to postpone the call to water in edge case
@@ -748,7 +795,7 @@ isc__mem_reallocate(isc_mem_t *ctx, void *old_ptr, size_t new_size,
 	} else {
 		size_t old_size = sallocx(old_ptr, flags | ctx->jemalloc_flags);
 
-		DELETE_TRACE(ctx, old_ptr, old_size, func, file, line);
+		DELETE_TRACE(ctx, old_ptr, old_size, file, line);
 		mem_putstats(ctx, old_size);
 
 		new_ptr = mem_realloc(ctx, old_ptr, old_size, new_size, flags);
@@ -757,7 +804,7 @@ isc__mem_reallocate(isc_mem_t *ctx, void *old_ptr, size_t new_size,
 		new_size = sallocx(new_ptr, flags | ctx->jemalloc_flags);
 
 		mem_getstats(ctx, new_size);
-		ADD_TRACE(ctx, new_ptr, new_size, func, file, line);
+		ADD_TRACE(ctx, new_ptr, new_size, file, line);
 
 		/*
 		 * We want to postpone the call to water in edge case
@@ -778,7 +825,7 @@ isc__mem_free(isc_mem_t *ctx, void *ptr, int flags FLARG) {
 
 	size = sallocx(ptr, flags | ctx->jemalloc_flags);
 
-	DELETE_TRACE(ctx, ptr, size, func, file, line);
+	DELETE_TRACE(ctx, ptr, size, file, line);
 
 	mem_putstats(ctx, size);
 	mem_put(ctx, ptr, size, flags);
@@ -963,9 +1010,8 @@ isc__mempool_create(isc_mem_t *restrict mctx, const size_t element_size,
 
 #if ISC_MEM_TRACKLINES
 	if ((mctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
-		fprintf(stderr,
-			"create pool %p func %s file %s line %u mctx %p\n",
-			mpctx, func, file, line, mctx);
+		fprintf(stderr, "create pool %p file %s line %u mctx %p\n",
+			mpctx, file, line, mctx);
 	}
 #endif /* ISC_MEM_TRACKLINES */
 
@@ -1004,9 +1050,8 @@ isc__mempool_destroy(isc_mempool_t **restrict mpctxp FLARG) {
 
 #if ISC_MEM_TRACKLINES
 	if ((mctx->debugging & ISC_MEM_DEBUGTRACE) != 0) {
-		fprintf(stderr,
-			"destroy pool %p func %s file %s line %u mctx %p\n",
-			mpctx, func, file, line, mctx);
+		fprintf(stderr, "destroy pool %p file %s line %u mctx %p\n",
+			mpctx, file, line, mctx);
 	}
 #endif
 
@@ -1078,7 +1123,7 @@ isc__mempool_get(isc_mempool_t *restrict mpctx FLARG) {
 	mpctx->freecount--;
 	mpctx->gets++;
 
-	ADD_TRACE(mpctx->mctx, item, mpctx->size, func, file, line);
+	ADD_TRACE(mpctx->mctx, item, mpctx->size, file, line);
 
 	return item;
 }
@@ -1102,7 +1147,7 @@ isc__mempool_put(isc_mempool_t *restrict mpctx, void *mem FLARG) {
 	INSIST(mpctx->allocated > 0);
 	mpctx->allocated--;
 
-	DELETE_TRACE(mctx, mem, mpctx->size, func, file, line);
+	DELETE_TRACE(mctx, mem, mpctx->size, file, line);
 
 	/*
 	 * If our free list is full, return this to the mctx directly.
@@ -1437,8 +1482,8 @@ isc__mem_create(isc_mem_t **mctxp FLARG) {
 	mem_create(mctxp, isc_mem_debugging, isc_mem_defaultflags, 0);
 #if ISC_MEM_TRACKLINES
 	if ((isc_mem_debugging & ISC_MEM_DEBUGTRACE) != 0) {
-		fprintf(stderr, "create mctx %p func %s file %s line %u\n",
-			*mctxp, func, file, line);
+		fprintf(stderr, "create mctx %p file %s line %u\n", *mctxp,
+			file, line);
 	}
 #endif /* ISC_MEM_TRACKLINES */
 }
@@ -1464,9 +1509,9 @@ isc__mem_create_arena(isc_mem_t **mctxp FLARG) {
 #if ISC_MEM_TRACKLINES
 	if ((isc_mem_debugging & ISC_MEM_DEBUGTRACE) != 0) {
 		fprintf(stderr,
-			"create mctx %p func %s file %s line %u "
-			"for jemalloc arena %u\n",
-			*mctxp, func, file, line, arena_no);
+			"create mctx %p file %s line %u for jemalloc arena "
+			"%u\n",
+			*mctxp, file, line, arena_no);
 	}
 #endif /* ISC_MEM_TRACKLINES */
 }

lib/isc/mutexblock.c

@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*! \file */
+
+#include <isc/mutexblock.h>
+#include <isc/util.h>
+
+void
+isc_mutexblock_init(isc_mutex_t *block, unsigned int count) {
+	unsigned int i;
+
+	for (i = 0; i < count; i++) {
+		isc_mutex_init(&block[i]);
+	}
+}
+
+void
+isc_mutexblock_destroy(isc_mutex_t *block, unsigned int count) {
+	unsigned int i;
+
+	for (i = 0; i < count; i++) {
+		isc_mutex_destroy(&block[i]);
+	}
+}

lib/isc/netmgr/http.c

@@ -150,7 +150,7 @@ typedef struct http_cstream {
 
 	isc_nm_http_response_status_t response_status;
 	isc_nmsocket_t *httpsock;
-	ISC_LINK(struct http_cstream) link;
+	LINK(struct http_cstream) link;
 } http_cstream_t;
 
 #define HTTP2_SESSION_MAGIC    ISC_MAGIC('H', '2', 'S', 'S')
@@ -190,8 +190,6 @@ struct isc_nm_http_session {
 
 	size_t data_in_flight;
 
-	bool async_queued;
-
 	/*
 	 * The statistical values below are for usage on server-side
 	 * only. They are meant to detect clients that are taking too many
@@ -1295,10 +1293,7 @@ http_readcb(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		}
 		isc_buffer_putmem(session->buf, region->base + readlen,
 				  unread_size);
-		if (session->handle != NULL) {
-			INSIST(VALID_NMHANDLE(session->handle));
-			isc_nm_read_stop(session->handle);
-		}
+		isc_nm_read_stop(session->handle);
 		http_do_bio_async(session);
 	} else {
 		/* We might have something to receive or send, do IO */
@@ -1467,27 +1462,26 @@ http_send_outgoing(isc_nm_http_session_t *session, isc_nmhandle_t *httphandle,
 	 * to avoid hitting unnecessary limitations on a TLS record size
 	 * within some tools (e.g. flamethrower).
 	 */
-	if (cb != NULL) {
+	if (max_total_write_size >= FLUSH_HTTP_WRITE_BUFFER_AFTER) {
 		/*
-		 * Case 0: The callback is specified, that means that a DNS
-		 * message is ready. Let's flush the the buffer.
-		 */
-		total = max_total_write_size;
-	} else if (max_total_write_size >= FLUSH_HTTP_WRITE_BUFFER_AFTER) {
-		/*
-		 * Case 1: We have equal or more than
-		 * FLUSH_HTTP_WRITE_BUFFER_AFTER bytes to send. Let's flush it.
+		 * Case 1: We have at least FLUSH_HTTP_WRITE_BUFFER_AFTER
+		 * bytes to send. Let's flush it.
 		 */
 		total = max_total_write_size;
 	} else if (session->sending > 0 && total > 0) {
 		/*
 		 * Case 2: There is one or more write requests in flight and
-		 * we have some new data form nghttp2 to send.
-		 * Then let's return from the function: as soon as the
+		 * we have some new data form nghttp2 to send. Let's put the
+		 * write callback (if any) into the pending write callbacks
+		 * list. Then let's return from the function: as soon as the
 		 * "in-flight" write callback get's called or we have reached
 		 * FLUSH_HTTP_WRITE_BUFFER_AFTER bytes in the write buffer, we
-		 * will flush the buffer. */
-		INSIST(cb == NULL);
+		 * will flush the buffer.
+		 */
+		if (cb != NULL) {
+			http_append_pending_send_request(session, httphandle,
+							 cb, cbarg);
+		}
 		goto nothing_to_send;
 	} else if (session->sending == 0 && total == 0 &&
 		   session->pending_write_data != NULL)
@@ -1522,6 +1516,8 @@ http_send_outgoing(isc_nm_http_session_t *session, isc_nmhandle_t *httphandle,
 		       (total == 0 && session->sending == 0) ||
 		       (total > 0 && session->sending == 0));
 	}
+#else
+	INSIST(ISC_LIST_EMPTY(session->pending_write_callbacks));
 #endif /* ENABLE_HTTP_WRITE_BUFFERING */
 
 	if (total == 0) {
@@ -1583,7 +1579,7 @@ http_too_many_active_streams(isc_nm_http_session_t *session) {
 	 */
 	const uint64_t max_active_streams =
 		ISC_MAX(ISC_NETMGR_MAX_STREAM_CLIENTS_PER_CONN,
-			(session->max_concurrent_streams * 6) / 10); /* 60% */
+			session->max_concurrent_streams / 3);
 
 	if (session->client) {
 		return false;
@@ -1603,12 +1599,10 @@ http_too_many_active_streams(isc_nm_http_session_t *session) {
 static void
 http_do_bio(isc_nm_http_session_t *session, isc_nmhandle_t *send_httphandle,
 	    isc_nm_cb_t send_cb, void *send_cbarg) {
-	isc__nm_uvreq_t *req = NULL;
-	size_t remaining = 0;
 	REQUIRE(VALID_HTTP2_SESSION(session));
 
 	if (session->closed) {
-		goto cancel;
+		return;
 	} else if (session->closing) {
 		/*
 		 * There might be leftover callbacks waiting to be received
@@ -1616,24 +1610,23 @@ http_do_bio(isc_nm_http_session_t *session, isc_nmhandle_t *send_httphandle,
 		if (session->sending == 0) {
 			finish_http_session(session);
 		}
-		goto cancel;
-	} else if (nghttp2_session_want_read(session->ngsession) == 0 &&
-		   nghttp2_session_want_write(session->ngsession) == 0 &&
-		   session->pending_write_data == NULL)
-	{
-		session->closing = true;
-		if (session->handle != NULL) {
-			isc_nm_read_stop(session->handle);
-		}
-		if (session->sending == 0) {
-			finish_http_session(session);
-		}
-		goto cancel;
+		return;
 	}
 
-	else if (session->buf != NULL)
-	{
-		remaining = isc_buffer_remaininglength(session->buf);
+	if (send_cb != NULL) {
+		INSIST(VALID_NMHANDLE(send_httphandle));
+		http_send_outgoing(session, send_httphandle, send_cb,
+				   send_cbarg);
+		return;
+	}
+
+	INSIST(send_httphandle == NULL);
+	INSIST(send_cb == NULL);
+	INSIST(send_cbarg == NULL);
+
+	if (session->pending_write_data != NULL && session->sending == 0) {
+		http_send_outgoing(session, NULL, NULL, NULL);
+		return;
 	}
 
 	if (nghttp2_session_want_read(session->ngsession) != 0) {
@@ -1642,7 +1635,9 @@ http_do_bio(isc_nm_http_session_t *session, isc_nmhandle_t *send_httphandle,
 			isc__nmsocket_timer_start(session->handle->sock);
 			isc_nm_read(session->handle, http_readcb, session);
 			session->reading = true;
-		} else if (session->buf != NULL && remaining > 0) {
+		} else if (session->buf != NULL) {
+			size_t remaining =
+				isc_buffer_remaininglength(session->buf);
 			/* Leftover data in the buffer, use it */
 			size_t remaining_after = 0;
 			ssize_t readlen = 0;
@@ -1666,12 +1661,8 @@ http_do_bio(isc_nm_http_session_t *session, isc_nmhandle_t *send_httphandle,
 				http_log_flooding_peer(session);
 				failed_read_cb(ISC_R_RANGE, session);
 			} else if ((size_t)readlen == remaining) {
-				isc_buffer_clear(session->buf);
-				isc_buffer_compact(session->buf);
-				http_do_bio(session, send_httphandle, send_cb,
-					    send_cbarg);
-				isc__nm_httpsession_detach(&tmpsess);
-				return;
+				isc_buffer_free(&session->buf);
+				http_do_bio(session, NULL, NULL, NULL);
 			} else if (remaining_after > 0 &&
 				   remaining_after < remaining)
 			{
@@ -1688,36 +1679,39 @@ http_do_bio(isc_nm_http_session_t *session, isc_nmhandle_t *send_httphandle,
 				 * it and that could overwhelm the server.
 				 */
 				http_do_bio_async(session);
+			} else {
+				http_send_outgoing(session, NULL, NULL, NULL);
 			}
+
 			isc__nm_httpsession_detach(&tmpsess);
-		} else if (session->handle != NULL) {
-			INSIST(VALID_NMHANDLE(session->handle));
+			return;
+		} else {
 			/*
 			 * Resume reading, it's idempotent, wait for more
 			 */
 			isc__nmsocket_timer_start(session->handle->sock);
 			isc_nm_read(session->handle, http_readcb, session);
 		}
-	} else if (session->handle != NULL) {
-		INSIST(VALID_NMHANDLE(session->handle));
+	} else {
 		/* We don't want more data, stop reading for now */
 		isc_nm_read_stop(session->handle);
 	}
 
 	/* we might have some data to send after processing */
-	http_send_outgoing(session, send_httphandle, send_cb, send_cbarg);
+	http_send_outgoing(session, NULL, NULL, NULL);
+
+	if (nghttp2_session_want_read(session->ngsession) == 0 &&
+	    nghttp2_session_want_write(session->ngsession) == 0 &&
+	    session->pending_write_data == NULL)
+	{
+		session->closing = true;
+		isc_nm_read_stop(session->handle);
+		if (session->sending == 0) {
+			finish_http_session(session);
+		}
+	}
 
 	return;
-cancel:
-	if (send_cb == NULL) {
-		return;
-	}
-	req = isc__nm_uvreq_get(send_httphandle->sock);
-
-	req->cb.send = send_cb;
-	req->cbarg = send_cbarg;
-	isc_nmhandle_attach(send_httphandle, &req->handle);
-	isc__nm_sendcb(send_httphandle->sock, req, ISC_R_CANCELED, true);
 }
 
 static void
@@ -1726,8 +1720,6 @@ http_do_bio_async_cb(void *arg) {
 
 	REQUIRE(VALID_HTTP2_SESSION(session));
 
-	session->async_queued = false;
-
 	if (session->handle != NULL &&
 	    !isc__nmsocket_closing(session->handle->sock))
 	{
@@ -1744,12 +1736,10 @@ http_do_bio_async(isc_nm_http_session_t *session) {
 	REQUIRE(VALID_HTTP2_SESSION(session));
 
 	if (session->handle == NULL ||
-	    isc__nmsocket_closing(session->handle->sock) ||
-	    session->async_queued)
+	    isc__nmsocket_closing(session->handle->sock))
 	{
 		return;
 	}
-	session->async_queued = true;
 	isc__nm_httpsession_attach(session, &tmpsess);
 	isc_async_run(session->handle->sock->worker->loop, http_do_bio_async_cb,
 		      tmpsess);

lib/isc/netmgr/netmgr-int.h

@@ -21,6 +21,7 @@
 #include <isc/atomic.h>
 #include <isc/barrier.h>
 #include <isc/buffer.h>
+#include <isc/condition.h>
 #include <isc/dnsstream.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
@@ -270,8 +271,8 @@ struct isc_nmhandle {
 	void *backtrace[TRACE_SIZE];
 	int backtrace_size;
 #endif
-	ISC_LINK(isc_nmhandle_t) active_link;
-	ISC_LINK(isc_nmhandle_t) inactive_link;
+	LINK(isc_nmhandle_t) active_link;
+	LINK(isc_nmhandle_t) inactive_link;
 
 	void *opaque;
 
@@ -422,7 +423,7 @@ typedef struct isc_nm_httphandler {
 	char *path;
 	isc_nm_recv_cb_t cb;
 	void *cbarg;
-	ISC_LINK(struct isc_nm_httphandler) link;
+	LINK(struct isc_nm_httphandler) link;
 } isc_nm_httphandler_t;
 
 struct isc_nm_http_endpoints {
@@ -466,7 +467,7 @@ typedef struct isc_nmsocket_h2 {
 
 	isc_nm_recv_cb_t cb;
 	void *cbarg;
-	ISC_LINK(struct isc_nmsocket_h2) link;
+	LINK(struct isc_nmsocket_h2) link;
 
 	isc_nm_http_endpoints_t **listener_endpoints;
 	size_t n_listener_endpoints;
@@ -712,7 +713,7 @@ struct isc_nmsocket {
 	void *backtrace[TRACE_SIZE];
 	int backtrace_size;
 #endif
-	ISC_LINK(isc_nmsocket_t) active_link;
+	LINK(isc_nmsocket_t) active_link;
 
 	isc_job_t job;
 };

lib/isc/netmgr/netmgr.c

@@ -20,6 +20,7 @@
 #include <isc/backtrace.h>
 #include <isc/barrier.h>
 #include <isc/buffer.h>
+#include <isc/condition.h>
 #include <isc/errno.h>
 #include <isc/job.h>
 #include <isc/list.h>

lib/isc/netmgr/tcp.c

@@ -18,6 +18,7 @@
 #include <isc/atomic.h>
 #include <isc/barrier.h>
 #include <isc/buffer.h>
+#include <isc/condition.h>
 #include <isc/errno.h>
 #include <isc/log.h>
 #include <isc/magic.h>

lib/isc/netmgr/tlsstream.c

@@ -21,6 +21,7 @@
 #include <isc/async.h>
 #include <isc/atomic.h>
 #include <isc/buffer.h>
+#include <isc/condition.h>
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/mem.h>

lib/isc/netmgr/udp.c

@@ -17,6 +17,7 @@
 #include <isc/atomic.h>
 #include <isc/barrier.h>
 #include <isc/buffer.h>
+#include <isc/condition.h>
 #include <isc/errno.h>
 #include <isc/magic.h>
 #include <isc/mem.h>

lib/isc/ratelimiter.c

@@ -231,7 +231,7 @@ isc__ratelimiter_tick(void *arg) {
 	REQUIRE(rl->timer != NULL);
 
 	if (rl->state == isc_ratelimiter_shuttingdown) {
-		INSIST(ISC_LIST_EMPTY(rl->pending));
+		INSIST(EMPTY(rl->pending));
 		goto unlock;
 	}
 
@@ -277,7 +277,7 @@ isc__ratelimiter_doshutdown(void *arg) {
 
 	LOCK(&rl->lock);
 	INSIST(rl->state == isc_ratelimiter_shuttingdown);
-	INSIST(ISC_LIST_EMPTY(rl->pending));
+	INSIST(EMPTY(rl->pending));
 
 	isc_timer_stop(rl->timer);
 	isc_timer_destroy(&rl->timer);

lib/isc/timer.c

@@ -17,6 +17,7 @@
 
 #include <isc/async.h>
 #include <isc/atomic.h>
+#include <isc/condition.h>
 #include <isc/heap.h>
 #include <isc/job.h>
 #include <isc/log.h>

lib/isc/tls.c

@@ -35,11 +35,13 @@
 
 #include <isc/atomic.h>
 #include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/ht.h>
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
+#include <isc/mutexblock.h>
 #include <isc/once.h>
 #include <isc/random.h>
 #include <isc/refcount.h>

lib/isc/uv.c

@@ -146,7 +146,7 @@ void
 isc__uv_shutdown(void) {
 #if UV_VERSION_HEX >= UV_VERSION(1, 38, 0)
 	uv_library_shutdown();
-	isc_mem_detach(&isc__uv_mctx);
+	isc_mem_destroy(&isc__uv_mctx);
 #endif /* UV_VERSION_HEX < UV_VERSION(1, 38, 0) */
 }
 

lib/isc/work.c

@@ -13,7 +13,6 @@
 
 #include <stdlib.h>
 
-#include <isc/iterated_hash.h>
 #include <isc/job.h>
 #include <isc/loop.h>
 #include <isc/urcu.h>
@@ -26,15 +25,11 @@ static void
 isc__work_cb(uv_work_t *req) {
 	isc_work_t *work = uv_req_get_data((uv_req_t *)req);
 
-	isc__iterated_hash_initialize();
-
 	rcu_register_thread();
 
 	work->work_cb(work->cbarg);
 
 	rcu_unregister_thread();
-
-	isc__iterated_hash_shutdown();
 }
 
 static void

lib/isc/xml.c

@@ -64,7 +64,7 @@ void
 isc__xml_shutdown(void) {
 #ifdef HAVE_LIBXML2
 	xmlCleanupParser();
-	isc_mem_detach(&isc__xml_mctx);
+	isc_mem_destroy(&isc__xml_mctx);
 #endif /* HAVE_LIBXML2 */
 }
 

lib/isccfg/kaspconf.c

@@ -15,7 +15,7 @@
 #include <stdbool.h>
 #include <stdlib.h>
 
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -227,7 +227,7 @@ cfg_kaspkey_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
 			goto cleanup;
 		}
 
-		if (check_algorithms && isc_crypto_fips_mode() &&
+		if (check_algorithms && isc_fips_mode() &&
 		    (key->algorithm == DNS_KEYALG_RSASHA1 ||
 		     key->algorithm == DNS_KEYALG_NSEC3RSASHA1))
 		{
@@ -259,7 +259,7 @@ cfg_kaspkey_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
 			case DNS_KEYALG_NSEC3RSASHA1:
 			case DNS_KEYALG_RSASHA256:
 			case DNS_KEYALG_RSASHA512:
-				if (isc_crypto_fips_mode()) {
+				if (isc_fips_mode()) {
 					min = 2048;
 				} else {
 					min = DNS_KEYALG_RSASHA512 ? 1024 : 512;

lib/ns/hooks.c

@@ -48,7 +48,7 @@ struct ns_plugin {
 	ns_plugin_check_t *check_func;
 	ns_plugin_register_t *register_func;
 	ns_plugin_destroy_t *destroy_func;
-	ISC_LINK(ns_plugin_t) link;
+	LINK(ns_plugin_t) link;
 };
 
 static ns_hooklist_t default_hooktable[NS_HOOKPOINTS_COUNT];

lib/ns/query.c

@@ -7757,10 +7757,7 @@ query_respond_any(query_ctx_t *qctx) {
 			}
 
 			qctx->rpz_st = qctx->client->query.rpz_st;
-			if (qctx->rpz_st != NULL &&
-			    qctx->rpz_st->m.policy != DNS_RPZ_POLICY_MISS &&
-			    qctx->rpz_st->m.policy != DNS_RPZ_POLICY_PASSTHRU)
-			{
+			if (qctx->rpz_st != NULL) {
 				qctx->rdataset->ttl =
 					ISC_MIN(qctx->rdataset->ttl,
 						qctx->rpz_st->m.ttl);

tests/bench/compress.c

@@ -100,7 +100,7 @@ main(void) {
 
 	printf("names %u\n", count);
 
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return 0;
 }

tests/bench/qpmulti.c

@@ -889,7 +889,7 @@ main(void) {
 
 	isc_mem_free(mctx, item);
 	isc_mem_checkdestroyed(stdout);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);
 
 	return 0;
 }

tests/dns/dst_test.c

@@ -30,8 +30,8 @@
 #define UNIT_TESTING
 #include <cmocka.h>
 
-#include <isc/crypto.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hex.h>
 #include <isc/lib.h>
 #include <isc/result.h>
@@ -471,7 +471,7 @@ ISC_RUN_TEST_IMPL(ecdsa_determinism_test) {
 	dst_context_destroy(&ctx);
 
 #if OPENSSL_VERSION_NUMBER >= 0x30200000L
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		assert_memory_not_equal(sigbuf1->base, sigbuf2->base, siglen);
 	} else {
 		assert_memory_equal(sigbuf1->base, sigbuf2->base, siglen);

tests/dns/qpdb_test.c

@@ -158,7 +158,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_bigrdata) {
 	}
 
 	dns_db_detach(&db);
-	isc_mem_detach(&mctx2);
+	isc_mem_destroy(&mctx2);
 	isc_loopmgr_shutdown(loopmgr);
 }
 
@@ -208,7 +208,7 @@ ISC_LOOP_TEST_IMPL(overmempurge_longname) {
 	}
 
 	dns_db_detach(&db);
-	isc_mem_detach(&mctx2);
+	isc_mem_destroy(&mctx2);
 	isc_loopmgr_shutdown(loopmgr);
 }
 

tests/include/tests/isc.h

@@ -249,7 +249,7 @@ teardown_managers(void **state);
 			r = cmocka_run_group_tests(tests, setup, teardown);             \
 		}                                                                       \
                                                                                         \
-		isc_mem_detach(&mctx);                                                  \
+		isc_mem_destroy(&mctx);                                                 \
                                                                                         \
 		return (r);                                                             \
 	}