lib/ns/query.c: use global static variables for logging with proper atomic initialization

fixup! Test: use mutex-locked atomics to profile usage
Add gitlab CI job for mutexatomics
2019-06-07 15:01:44 +02:00 · 2019-06-07 13:49:14 +02:00 · 2019-06-07 13:46:06 +02:00 · 2019-06-07 13:44:37 +02:00 · 2019-06-07 13:21:55 +02:00 · 2019-06-07 13:15:10 +02:00
197 changed files with 3817 additions and 2512 deletions
@@ -429,6 +429,28 @@ unit:asan:sid:amd64:
  dependencies:
    - asan:sid:amd64

+mutexatomics:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --enable-mutex-atomics"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+system:mutexatomics:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - mutexatomics:sid:amd64
+
+unit:mutexatomics:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - mutexatomics:sid:amd64
+
+
+
 # Jobs for Clang builds on Debian Stretch (amd64)

 clang:stretch:amd64:
@@ -476,3 +498,25 @@ unit:pkcs11:sid:amd64:
  <<: *unit_test_job
  dependencies:
    - pkcs11:sid:amd64
+
+# Jobs with libtool disabled
+
+nolibtool:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -Og -g"
+    EXTRA_CONFIGURE: "--with-libidn2 --without-libtool --with-dlopen"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+system:nolibtool:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - nolibtool:sid:amd64
+
+unit:nolibtool:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - nolibtool:sid:amd64
@@ -1,3 +1,61 @@
+5248.	[func]		To clarify the configuration of DNSSEC keys,
+			the "managed-keys" and "trusted-keys" options
+			have both been deprecated.  The new "dnssec-keys"
+			statement can now be used for all trust anchors,
+			with the keywords "iniital-key" or "static-key"
+			to indicate whether the configured trust anchor
+			should be used for initialization of RFC 5011 key
+			management, or as a permanent trust anchor.
+
+			The "static-key" keyword will generate a warning if
+			used for the root zone.
+
+			Configurations using "trusted-keys" or "managed-keys"
+			will continue to work with no changes, but will
+			generate warnings in the log. In a future release,
+			these options will be marked obsolete. [GL #6]
+
+5247.	[cleanup]	The 'cleaning-interval' option has been removed.
+			[GL !1731]
+
+5246.	[func]		Log TSIG if appropriate in 'sending notify to' message.
+			[GL #1058]
+
+5245.	[cleanup]	Reduce logging level for IXFR up-to-date poll
+			responses. [GL #1009]
+
+5244.	[placeholder]
+
+5243.	[bug]		Fix a possible race between dispatcher and socket
+			code in a high-load cold-cache resolver scenario.
+			[GL #943]
+
+5242.	[bug]		In relaxed qname minimizatiom mode, fall back to
+			normal resolution when encountering a lame
+			delegation, and use _.domain/A queries rather
+			than domain/NS. [GL #1055]
+
+5241.	[bug]		Fix Ed448 private and public key ASN.1 prefix blobs.
+			[GL #225]
+
+5240.	[bug]		Remove key id calculation for RSAMD5. [GL #996]
+
+5239.	[func]		Change the json-c detection to pkg-config. [GL #855]
+
+5238.	[bug]		Fix a possible deadlock in TCP code. [GL #1046]
+
+5237.	[bug]		Recurse to find the root server list with 'dig +trace'.
+			[GL #1028]
+
+5236.	[func]		Add SipHash 2-4 implementation in lib/isc/siphash.c
+			and switch isc_hash_function() to use SipHash 2-4.
+			[GL #605]
+
+5235.	[cleanup]	Refactor lib/isc/app.c to be thread-safe, unused
+			parts of the API has been removed and the
+			isc_appctx_t data type has been changed to be
+			fully opaque. [GL #1023]
+
 5234.	[port]		arm: just use the compiler's default support for
 			yield. [GL #981]

@@ -314,6 +314,24 @@ releases (i.e., those with version numbers ending in zero). Some new
 functionality may be backported to older releases on a case-by-case basis.
 All other change types may be applied to all currently-supported releases.

+Bug report identifiers
+
+Most notes in the CHANGES file include a reference to a bug report or
+issue number. Prior to 2018, these were usually of the form [RT #NNN] and
+referred to entries in the "bind9-bugs" RT database, which was not open to
+the public. More recent entries use the form [GL #NNN] or, less often, [GL
+!NNN], which, respectively, refer to issues or merge requests in the
+Gitlab database. Most of these are publically readable, unless they
+include information which is confidential or security senstive.
+
+To look up a Gitlab issue by its number, use the URL https://
+gitlab.isc.org/isc-projects/bind9/issues/NNN. To look up a merge request,
+use https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN.
+
+In rare cases, an issue or merge request number may be followed with the
+letter "P". This indicates that the information is in the private ISC
+Gitlab instance, which is not visible to the public.
+
 Acknowledgments

  * The original development of BIND 9 was underwritten by the following
@@ -200,8 +200,10 @@ To support the HTTP statistics channel, the server must be linked with at
 least one of the following: libxml2
 [http://xmlsoft.org](http://xmlsoft.org) or json-c
 [https://github.com/json-c](https://github.com/json-c).  If these are
-installed at a nonstandard location, specify the prefix using
-`--with-libxml2=/prefix` or `--with-libjson=/prefix`.
+installed at a nonstandard location, then:
+
+* for libxml2, specify the prefix using `--with-libxml2=/prefix`,
+* for json-c, adjust `PKG_CONFIG_PATH`.

 To support compression on the HTTP statistics channel, the server must be
 linked against libzlib.  If this is installed in a nonstandard location,
@@ -323,6 +325,25 @@ releases (i.e., those with version numbers ending in zero).  Some new
 functionality may be backported to older releases on a case-by-case basis.
 All other change types may be applied to all currently-supported releases.

+#### Bug report identifiers
+
+Most notes in the CHANGES file include a reference to a bug report or
+issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
+and referred to entries in the "bind9-bugs" RT database, which was not open
+to the public. More recent entries use the form `[GL #NNN]` or, less often,
+`[GL !NNN]`, which, respectively, refer to issues or merge requests in the
+Gitlab database. Most of these are publically readable, unless they include
+information which is confidential or security senstive.
+
+To look up a Gitlab issue by its number, use the URL
+[https://gitlab.isc.org/isc-projects/bind9/issues/NNN](https://gitlab.isc.org/isc-projects/bind9/issues).
+To look up a merge request, use
+[https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN](https://gitlab.isc.org/isc-projects/bind9/merge_requests).
+
+In rare cases, an issue or merge request number may be followed with the
+letter "P". This indicates that the information is in the private ISC
+Gitlab instance, which is not visible to the public.
+
 ### <a name="ack"/> Acknowledgments

 * The original development of BIND 9 was underwritten by the
@@ -16,7 +16,7 @@ VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@

 CINCLUDES =	${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
-		${ISC_INCLUDES} @OPENSSL_INCLUDES@
+		${ISC_INCLUDES} @OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES = 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =
@@ -34,8 +34,8 @@ ISCDEPLIBS =	../../lib/isc/libisc.@A@
 BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
 NSDEPENDLIBS =	../../lib/ns/libns.@A@

-LIBS =		${ISCLIBS} @LIBS@
-NOSYMLIBS =	${ISCNOSYMLIBS} @LIBS@
+LIBS =		${ISCLIBS} @JSON_C_LIBS@ @LIBS@
+NOSYMLIBS =	${ISCNOSYMLIBS} @JSON_C_LIBS@ @LIBS@

 SUBDIRS =

@@ -20,7 +20,7 @@ VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@

 CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
-	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
+	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} @JSON_C_CFLAGS@

 CDEFINES =
 CWARNINGS =
@@ -41,9 +41,9 @@ BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
 RNDCLIBS =	${ISCCFGLIBS} ${ISCCCLIBS} ${BIND9LIBS} ${DNSLIBS} ${ISCLIBS} @LIBS@
 RNDCDEPLIBS =	${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${BIND9DEPLIBS} ${DNSDEPLIBS} ${ISCDEPLIBS}

-LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+LIBS =		${DNSLIBS} ${ISCLIBS} @JSON_C_LIBS@ @LIBS@

-NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
+NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @JSON_C_LIBS@ @LIBS@

 CONFDEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}

@@ -16,7 +16,7 @@ VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@

 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @OPENSSL_INCLUDES@
+		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =	-DVERSION=\"${VERSION}\" \
 		-DSYSCONFDIR=\"${sysconfdir}\"
@@ -35,8 +35,8 @@ IRSDEPLIBS =	../../lib/irs/libirs.@A@

 DEPLIBS =	${DNSDEPLIBS} ${IRSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}

-LIBS =		${DNSLIBS} ${IRSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @LIBS@
-NOSYMLIBS =	${DNSLIBS} ${IRSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
+LIBS =		${DNSLIBS} ${IRSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @JSON_C_LIBS@ @LIBS@
+NOSYMLIBS =	${DNSLIBS} ${IRSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @JSON_C_LIBS@ @LIBS@

 SUBDIRS =

@@ -133,13 +133,13 @@ static bool use_tcp = false;
 static char *anchorfile = NULL;
 static char *trust_anchor = NULL;
 static char *dlv_anchor = NULL;
-static int trusted_keys = 0;
+static int num_keys = 0;

 static dns_fixedname_t afn, dfn;
 static dns_name_t *anchor_name = NULL, *dlv_name = NULL;

 /* Default bind.keys contents */
-static char anchortext[] = MANAGED_KEYS;
+static char anchortext[] = DNSSEC_KEYS;

 /*
 * Static function prototypes
@@ -642,7 +642,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {

 	CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
 				       keyname, &rrdatabuf));
-	trusted_keys++;
+	num_keys++;

 cleanup:
 	if (result == DST_R_NOCRYPTO)
@@ -693,13 +693,15 @@ static isc_result_t
 setup_dnsseckeys(dns_client_t *client) {
 	isc_result_t result;
 	cfg_parser_t *parser = NULL;
-	const cfg_obj_t *keys = NULL;
+	const cfg_obj_t *trusted_keys = NULL;
 	const cfg_obj_t *managed_keys = NULL;
+	const cfg_obj_t *dnssec_keys = NULL;
 	cfg_obj_t *bindkeys = NULL;
 	const char *filename = anchorfile;

-	if (!root_validation && !dlv_validation)
+	if (!root_validation && !dlv_validation) {
 		return (ISC_R_SUCCESS);
+	}

 	if (filename == NULL) {
 #ifndef WIN32
@@ -714,27 +716,33 @@ setup_dnsseckeys(dns_client_t *client) {

 	if (trust_anchor == NULL) {
 		trust_anchor = isc_mem_strdup(mctx, ".");
-		if (trust_anchor == NULL)
+		if (trust_anchor == NULL) {
 			fatal("out of memory");
+		}
 	}

-	if (trust_anchor != NULL)
+	if (trust_anchor != NULL) {
 		CHECK(convert_name(&afn, &anchor_name, trust_anchor));
-	if (dlv_anchor != NULL)
+	}
+	if (dlv_anchor != NULL) {
 		CHECK(convert_name(&dfn, &dlv_name, dlv_anchor));
+	}

 	CHECK(cfg_parser_create(mctx, dns_lctx, &parser));

 	if (access(filename, R_OK) != 0) {
-		if (anchorfile != NULL)
+		if (anchorfile != NULL) {
 			fatal("Unable to read key file '%s'", anchorfile);
+		}
 	} else {
 		result = cfg_parse_file(parser, filename,
 					&cfg_type_bindkeys, &bindkeys);
-		if (result != ISC_R_SUCCESS)
-			if (anchorfile != NULL)
+		if (result != ISC_R_SUCCESS) {
+			if (anchorfile != NULL) {
 				fatal("Unable to load keys from '%s'",
 				      anchorfile);
+			}
+		}
 	}

 	if (bindkeys == NULL) {
@@ -744,25 +752,34 @@ setup_dnsseckeys(dns_client_t *client) {
 		isc_buffer_add(&b, sizeof(anchortext) - 1);
 		result = cfg_parse_buffer(parser, &b, NULL, 0,
 					  &cfg_type_bindkeys, 0, &bindkeys);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			fatal("Unable to parse built-in keys");
+		}
 	}

 	INSIST(bindkeys != NULL);
-	cfg_map_get(bindkeys, "trusted-keys", &keys);
+	cfg_map_get(bindkeys, "trusted-keys", &trusted_keys);
 	cfg_map_get(bindkeys, "managed-keys", &managed_keys);
+	cfg_map_get(bindkeys, "dnssec-keys", &dnssec_keys);

-	if (keys != NULL)
-		CHECK(load_keys(keys, client));
-	if (managed_keys != NULL)
+	if (trusted_keys != NULL) {
+		CHECK(load_keys(trusted_keys, client));
+	}
+	if (managed_keys != NULL) {
 		CHECK(load_keys(managed_keys, client));
+	}
+	if (dnssec_keys != NULL) {
+		CHECK(load_keys(dnssec_keys, client));
+	}
 	result = ISC_R_SUCCESS;

-	if (trusted_keys == 0)
+	if (num_keys == 0) {
 		fatal("No trusted keys were loaded");
+	}

-	if (dlv_validation)
+	if (dlv_validation) {
 		dns_client_setdlv(client, dns_rdataclass_in, dlv_anchor);
+	}


 cleanup:
@@ -772,9 +789,10 @@ setup_dnsseckeys(dns_client_t *client) {
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			  isc_result_totext(result));
+	}
 	return (result);
 }

@@ -1622,9 +1640,9 @@ main(int argc, char *argv[]) {
 		fatal("failed to create mctx");

 	CHECK(isc_appctx_create(mctx, &actx));
-	CHECK(isc_taskmgr_createinctx(mctx, actx, 1, 0, &taskmgr));
-	CHECK(isc_socketmgr_createinctx(mctx, actx, &socketmgr));
-	CHECK(isc_timermgr_createinctx(mctx, actx, &timermgr));
+	CHECK(isc_taskmgr_createinctx(mctx, 1, 0, &taskmgr));
+	CHECK(isc_socketmgr_createinctx(mctx, &socketmgr));
+	CHECK(isc_timermgr_createinctx(mctx, &timermgr));

 	parse_args(argc, argv);

@@ -218,14 +218,17 @@
 	  </para>
 	  <para>
 	    Note: When reading the trust anchor file,
-	    <command>delv</command> treats <option>managed-keys</option>
-	    statements and <option>trusted-keys</option> statements
-	    identically.  That is, for a managed key, it is the
-	    <emphasis>initial</emphasis> key that is trusted; RFC 5011
-	    key management is not supported. <command>delv</command>
-	    will not consult the managed-keys database maintained by
-	    <command>named</command>. This means that if either of the
-	    keys in <filename>/etc/bind.keys</filename> is revoked
+	    <command>delv</command> treats <option>dnssec-keys</option>
+	    <option>initial-key</option> and <option>static-key</option>
+	    entries identically.  That is, even if a key is configured
+	    with <command>initial-key</command>, indicating that it is
+	    meant to be used only as an initializing key for RFC 5011
+	    key maintenance, it is still treated by <command>delv</command>
+	    as if it had been configured as a <command>static-key</command>.
+	    <command>delv</command> does not consult the managed keys
+	    database maintained by <command>named</command>. This means
+	    that if either of the keys in
+	    <filename>/etc/bind.keys</filename> is revoked
 	    and rolled over, it will be necessary to update
 	    <filename>/etc/bind.keys</filename> to use DNSSEC
 	    validation in <command>delv</command>.
@@ -19,7 +19,7 @@ READLINE_LIB = @READLINE_LIB@

 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @OPENSSL_INCLUDES@
+		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =
@@ -41,10 +41,10 @@ DEPLIBS =	${DNSDEPLIBS} ${IRSDEPLIBS} ${BIND9DEPLIBS} \
 		${ISCDEPLIBS} ${ISCCFGDEPLIBS}

 LIBS =		${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
-		${ISCLIBS} @LIBIDN2_LIBS@ @LIBS@
+		${ISCLIBS} @LIBIDN2_LIBS@ @JSON_C_LIBS@ @LIBS@

 NOSYMLIBS =	${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
-		${ISCNOSYMLIBS} @LIBIDN2_LIBS@ @LIBS@
+		${ISCNOSYMLIBS} @LIBIDN2_LIBS@ @JSON_C_LIBS@ @LIBS@

 SUBDIRS =

@@ -1462,7 +1462,7 @@ plus_option(char *option, bool is_batchfile,
 				lookup->trace = state;
 				lookup->trace_root = state;
 				if (state) {
-					lookup->recurse = false;
+					lookup->recurse = true;
 					lookup->identify = true;
 					lookup->comments = false;
 					lookup->rrcomments = 0;
@@ -1010,8 +1010,10 @@
 	      in the query.  This bit is set by default, which means
 	      <command>dig</command> normally sends recursive
 	      queries.  Recursion is automatically disabled when
-	      the <parameter>+nssearch</parameter> or
-	      <parameter>+trace</parameter> query options are used.
+	      using the <parameter>+nssearch</parameter> option, and
+	      when using <parameter>+trace</parameter> except for
+	      an initial recursive query to get the list of root
+	      servers.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -2191,12 +2191,14 @@ setup_lookup(dig_lookup_t *lookup) {
 	lookup->sendmsg->id = (dns_messageid_t)isc_random16();
 	lookup->sendmsg->opcode = lookup->opcode;
 	lookup->msgcounter = 0;
+
 	/*
-	 * If this is a trace request, completely disallow recursion, since
-	 * it's meaningless for traces.
+	 * If this is a trace request, completely disallow recursion after
+	 * looking up the root name servers, since it's meaningless for traces.
 	 */
-	if (lookup->trace || (lookup->ns_search_only && !lookup->trace_root))
+	if ((lookup->trace || lookup->ns_search_only) && !lookup->trace_root) {
 		lookup->recurse = false;
+	}

 	if (lookup->recurse &&
 	    lookup->rdtype != dns_rdatatype_axfr &&
@@ -15,7 +15,7 @@ VERSION=@BIND9_VERSION@

@BIND9_MAKE_INCLUDES@

-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =
@@ -29,9 +29,9 @@ ISCDEPLIBS =	../../lib/isc/libisc.@A@

 DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}

-LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+LIBS =		${DNSLIBS} ${ISCLIBS} @JSON_C_LIBS@ @LIBS@

-NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
+NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @JSON_C_LIBS@ @LIBS@

 # Alphabetically
 TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
@@ -46,7 +46,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${NS_INCLUDES} ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
-		${DBDRIVER_INCLUDES} @OPENSSL_INCLUDES@
+		${DBDRIVER_INCLUDES} @OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =      @CONTRIB_DLZ@

@@ -73,12 +73,12 @@ DEPLIBS =	${NSDEPLIBS} ${DNSDEPLIBS} ${BIND9DEPLIBS} \
 LIBS =		${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCLIBS} \
 		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBCAP_LIBS@ \
-		@LIBS@
+		@JSON_C_LIBS@ @LIBS@

 NOSYMLIBS =	${NSLIBS} ${DNSLIBS} ${BIND9LIBS} \
 		${ISCCFGLIBS} ${ISCCCLIBS} ${ISCNOSYMLIBS} \
 		${DLZDRIVER_LIBS} ${DBDRIVER_LIBS} @LIBCAP_LIBS@ \
-		@LIBS@
+		@JSON_C_LIBS@ @LIBS@

 SUBDIRS =	unix

@@ -140,7 +140,6 @@ options {\n\
 	check-names response ignore;\n\
 	check-names slave warn;\n\
 	check-spf warn;\n\
-	cleaning-interval 0;  /* now meaningless */\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-validation " VALIDATION_DEFAULT "; \n"
@@ -291,10 +290,10 @@ view \"_bind\" chaos {\n\
 # \"dnssec-validation auto;\" is set and\n\
 #  sysconfdir/bind.keys doesn't exist).\n\
 #\n\
-# BEGIN MANAGED KEYS\n"
+# BEGIN DNSSEC KEYS\n"

 /* Imported from bind.keys.h: */
-MANAGED_KEYS
+DNSSEC_KEYS

 "# END MANAGED KEYS\n\
 \n\
@@ -338,7 +338,7 @@ save_command_line(int argc, char *argv[]) {
 	int i;
 	char *dst = saved_command_line;
 	char *eob = saved_command_line + sizeof(saved_command_line) - 1;
-	char *rollback;
+	char *rollback = dst;

 	for (i = 1; i < argc && dst < eob; i++) {
 		char *src = argv[i];
@@ -526,10 +526,10 @@ OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	printf("linked to libxml2 version: %s\n",
 	       xmlParserVersion);
 #endif
-#if defined(HAVE_JSON) && defined(JSON_C_VERSION)
-	printf("compiled with libjson-c version: %s\n",
+#if defined(HAVE_JSON_C)
+	printf("compiled with json-c version: %s\n",
 	       JSON_C_VERSION);
-	printf("linked to libjson-c version: %s\n",
+	printf("linked to json-c version: %s\n",
 	       json_c_version());
 #endif
 #if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
@@ -1092,13 +1092,13 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "linked to libxml2 version: %s", xmlParserVersion);
 #endif
-#if defined(HAVE_JSON) && defined(JSON_C_VERSION)
+#if defined(HAVE_JSON_C)
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libjson-c version: %s", JSON_C_VERSION);
+		      "compiled with json-c version: %s", JSON_C_VERSION);
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libjson-c version: %s", json_c_version());
+		      "linked to json-c version: %s", json_c_version());
 #endif
 #if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -13,7 +13,7 @@

 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2018-12-07</date>
+    <date>2019-05-10</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -80,14 +80,12 @@
  </refsection>

  <refsection><info><title>ACL</title></info>
-
    <literallayout class="normal">
 acl <replaceable>string</replaceable> { <replaceable>address_match_element</replaceable>; ... };
 </literallayout>
  </refsection>

  <refsection><info><title>CONTROLS</title></info>
-
    <literallayout class="normal">
 controls {
 	inet ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> |
@@ -104,7 +102,6 @@ controls {
  </refsection>

  <refsection><info><title>DLZ</title></info>
-
    <literallayout class="normal">
 dlz <replaceable>string</replaceable> {
 	database <replaceable>string</replaceable>;
@@ -113,8 +110,15 @@ dlz <replaceable>string</replaceable> {
 </literallayout>
  </refsection>

-  <refsection><info><title>DYNDB</title></info>
+  <refsection><info><title>DNSSEC-KEYS</title></info>
+    <literallayout class="normal">
+dnssec-keys { <replaceable>string</replaceable> ( static-key |
+    initial-key ) <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+    <replaceable>quoted_string</replaceable>; ... };
+</literallayout>
+  </refsection>

+  <refsection><info><title>DYNDB</title></info>
    <literallayout class="normal">
 dyndb <replaceable>string</replaceable> <replaceable>quoted_string</replaceable> {
    <replaceable>unspecified-text</replaceable> };
@@ -122,7 +126,6 @@ dyndb <replaceable>string</replaceable> <replaceable>quoted_string</replaceable>
  </refsection>

  <refsection><info><title>KEY</title></info>
-
    <literallayout class="normal">
 key <replaceable>string</replaceable> {
 	algorithm <replaceable>string</replaceable>;
@@ -132,7 +135,6 @@ key <replaceable>string</replaceable> {
  </refsection>

  <refsection><info><title>LOGGING</title></info>
-
    <literallayout class="normal">
 logging {
 	category <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };
@@ -154,15 +156,15 @@ logging {


  <refsection><info><title>MANAGED-KEYS</title></info>
-
+  <para>See DNSSEC-KEYS.</para>
    <literallayout class="normal">
-managed-keys { <replaceable>string</replaceable> <replaceable>string</replaceable> <replaceable>integer</replaceable>
-    <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; ... };
+managed-keys { <replaceable>string</replaceable> ( static-key |
+    initial-key ) <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+    <replaceable>quoted_string</replaceable>; ... };
 </literallayout>
  </refsection>

  <refsection><info><title>MASTERS</title></info>
-
    <literallayout class="normal">
 masters <replaceable>string</replaceable> [ port <replaceable>integer</replaceable> ] [ dscp
    <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [
@@ -172,7 +174,6 @@ masters <replaceable>string</replaceable> [ port <replaceable>integer</replaceab
  </refsection>

  <refsection><info><title>OPTIONS</title></info>
-
    <literallayout class="normal">
 options {
 	allow-new-zones <replaceable>boolean</replaceable>;
@@ -251,7 +252,6 @@ options {
 	dnsrps-options { <replaceable>unspecified-text</replaceable> };
 	dnssec-accept-expired <replaceable>boolean</replaceable>;
 	dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
-	dnssec-enable <replaceable>boolean</replaceable>;
 	dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 	dnssec-lookaside ( <replaceable>string</replaceable> trust-anchor
 	    <replaceable>string</replaceable> | auto | no );
@@ -403,11 +403,12 @@ options {
 	resolver-retry-interval <replaceable>integer</replaceable>;
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
-	    <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [ policy ( cname |
-	    disabled | drop | given | no-op | nodata | nxdomain | passthru
-	    | tcp-only <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ] [
-	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ]; ... } [
+	response-policy { zone <replaceable>string</replaceable> [ add-soa <replaceable>boolean</replaceable> ] [ log
+	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval
+	    <replaceable>ttlval</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
+	    nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
+	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
+	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ add-soa <replaceable>boolean</replaceable> ] [
 	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
 	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
 	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
@@ -474,7 +475,6 @@ options {
  </refsection>

  <refsection><info><title>PLUGIN</title></info>
-
    <literallayout class="normal">
 plugin ( query ) <replaceable>string</replaceable> [ { <replaceable>unspecified-text</replaceable>
    } ];
@@ -482,7 +482,6 @@ plugin ( query ) <replaceable>string</replaceable> [ { <replaceable>unspecified-
  </refsection>

  <refsection><info><title>SERVER</title></info>
-
    <literallayout class="normal">
 server <replaceable>netprefix</replaceable> {
 	bogus <replaceable>boolean</replaceable>;
@@ -520,7 +519,6 @@ server <replaceable>netprefix</replaceable> {
  </refsection>

  <refsection><info><title>STATISTICS-CHANNELS</title></info>
-
    <literallayout class="normal">
 statistics-channels {
 	inet ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> |
@@ -532,15 +530,15 @@ statistics-channels {
  </refsection>

  <refsection><info><title>TRUSTED-KEYS</title></info>
-
+  <para>Deprecated - see DNSSEC-KEYS.</para>
    <literallayout class="normal">
-trusted-keys { <replaceable>string</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
-    <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; ... };
+trusted-keys { <replaceable>string</replaceable> <replaceable>integer</replaceable>
+    <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+    <replaceable>quoted_string</replaceable>; ... };, deprecated
 </literallayout>
  </refsection>

  <refsection><info><title>VIEW</title></info>
-
    <literallayout class="normal">
 view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	allow-new-zones <replaceable>boolean</replaceable>;
@@ -612,7 +610,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnsrps-options { <replaceable>unspecified-text</replaceable> };
 	dnssec-accept-expired <replaceable>boolean</replaceable>;
 	dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
-	dnssec-enable <replaceable>boolean</replaceable>;
+	dnssec-keys { <replaceable>string</replaceable> ( static-key |
+	    initial-key ) <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+	    <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; ... };
 	dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 	dnssec-lookaside ( <replaceable>string</replaceable> trust-anchor
 	    <replaceable>string</replaceable> | auto | no );
@@ -650,9 +650,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	key-directory <replaceable>quoted_string</replaceable>;
 	lame-ttl <replaceable>ttlval</replaceable>;
 	lmdb-mapsize <replaceable>sizeval</replaceable>;
-	managed-keys { <replaceable>string</replaceable> <replaceable>string</replaceable>
-	    <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
-	    <replaceable>quoted_string</replaceable>; ... };
+	managed-keys { <replaceable>string</replaceable> ( static-key |
+	    initial-key ) <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+	    <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; ... };
 	masterfile-format ( map | raw | text );
 	masterfile-style ( full | relative );
 	match-clients { <replaceable>address_match_element</replaceable>; ... };
@@ -735,11 +735,12 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	resolver-retry-interval <replaceable>integer</replaceable>;
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
-	response-policy { zone <replaceable>string</replaceable> [ log <replaceable>boolean</replaceable> ] [ max-policy-ttl
-	    <replaceable>ttlval</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ] [ policy ( cname |
-	    disabled | drop | given | no-op | nodata | nxdomain | passthru
-	    | tcp-only <replaceable>quoted_string</replaceable> ) ] [ recursive-only <replaceable>boolean</replaceable> ] [
-	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ]; ... } [
+	response-policy { zone <replaceable>string</replaceable> [ add-soa <replaceable>boolean</replaceable> ] [ log
+	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval
+	    <replaceable>ttlval</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
+	    nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
+	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
+	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ add-soa <replaceable>boolean</replaceable> ] [
 	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
 	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
 	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
@@ -801,9 +802,10 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	trust-anchor-telemetry <replaceable>boolean</replaceable>; // experimental
-	trusted-keys { <replaceable>string</replaceable> <replaceable>integer</replaceable>
-	    <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>;
-	    ... };
+	trusted-keys { <replaceable>string</replaceable>
+	    <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+	    <replaceable>integer</replaceable>
+	    <replaceable>quoted_string</replaceable>; ... };, deprecated
 	try-tcp-refresh <replaceable>boolean</replaceable>;
 	update-check-ksk <replaceable>boolean</replaceable>;
 	use-alt-transfer-source <replaceable>boolean</replaceable>;
@@ -915,7 +917,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
  </refsection>

  <refsection><info><title>ZONE</title></info>
-
    <literallayout class="normal">
 zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	allow-notify { <replaceable>address_match_element</replaceable>; ... };
@@ -700,11 +700,9 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 }

 static isc_result_t
-dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
-		  bool managed, dst_key_t **target, const char **keynamestrp,
-		  isc_mem_t *mctx)
+dstkey_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **target,
+		  const char **keynamestrp, isc_mem_t *mctx)
 {
-	dns_rdataclass_t viewclass;
 	dns_rdata_dnskey_t keystruct;
 	uint32_t flags, proto, alg;
 	const char *keystr, *keynamestr;
@@ -729,13 +727,15 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
 	*keynamestrp = keynamestr;

-	if (managed) {
+	if (*initialp) {
 		const char *initmethod;
 		initmethod = cfg_obj_asstring(cfg_tuple_get(key, "init"));

-		if (strcasecmp(initmethod, "initial-key") != 0) {
+		if (strcasecmp(initmethod, "static-key") == 0) {
+			*initialp = false;
+		} else if (strcasecmp(initmethod, "initial-key") != 0) {
 			cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
-				    "managed key '%s': "
+				    "key '%s': "
 				    "invalid initialization method '%s'",
 				    keynamestr, initmethod);
 			result = ISC_R_FAILURE;
@@ -743,15 +743,12 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 		}
 	}

-	if (vconfig == NULL)
-		viewclass = dns_rdataclass_in;
-	else {
-		const cfg_obj_t *classobj = cfg_tuple_get(vconfig, "class");
-		CHECK(named_config_getclass(classobj, dns_rdataclass_in,
-					 &viewclass));
-	}
-	keystruct.common.rdclass = viewclass;
+	/*
+	 * This function should never be reached for non-IN classes.
+	 */
+	keystruct.common.rdclass = dns_rdataclass_in;
 	keystruct.common.rdtype = dns_rdatatype_dnskey;
+
 	/*
 	 * The key data in keystruct is not dynamically allocated.
 	 */
@@ -782,10 +779,12 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,

 	if ((keystruct.algorithm == DST_ALG_RSASHA1) &&
 	    r.length > 1 && r.base[0] == 1 && r.base[1] == 3)
+	{
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
-			    "%s key '%s' has a weak exponent",
-			    managed ? "managed" : "trusted",
+			    "%s '%s' has a weak exponent",
+			    *initialp ? "initial-key" : "static-key",
 			    keynamestr);
+	}

 	CHECK(dns_rdata_fromstruct(NULL,
 				   keystruct.common.rdclass,
@@ -795,7 +794,7 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 	isc_buffer_constinit(&namebuf, keynamestr, strlen(keynamestr));
 	isc_buffer_add(&namebuf, strlen(keynamestr));
 	CHECK(dns_name_fromtext(keyname, &namebuf, dns_rootname, 0, NULL));
-	CHECK(dst_key_fromdns(keyname, viewclass, &rrdatabuf,
+	CHECK(dst_key_fromdns(keyname, dns_rdataclass_in, &rrdatabuf,
 			      mctx, &dstkey));

 	*target = dstkey;
@@ -821,18 +820,19 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 * the memory context to use for allocating memory.
 */
 static isc_result_t
-process_key(const cfg_obj_t *key, const cfg_obj_t *vconfig,
-	    dns_keytable_t *secroots, const dns_name_t *keyname_match,
-	    dns_resolver_t *resolver, bool managed, isc_mem_t *mctx)
+process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
+	    const dns_name_t *keyname_match, dns_resolver_t *resolver,
+	    bool managed, isc_mem_t *mctx)
 {
 	const dns_name_t *keyname = NULL;
 	const char *keynamestr = NULL;
 	dst_key_t *dstkey = NULL;
 	unsigned int keyalg;
 	isc_result_t result;
+	bool initializing = managed;

-	result = dstkey_fromconfig(vconfig, key, managed, &dstkey, &keynamestr,
-				   mctx);
+	result = dstkey_fromconfig(key, &initializing,
+				   &dstkey, &keynamestr, mctx);

 	switch (result) {
 	case ISC_R_SUCCESS:
@@ -851,8 +851,8 @@ process_key(const cfg_obj_t *key, const cfg_obj_t *vconfig,
 		 * but do not prevent any further ones from being processed.
 		 */
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
-			    "ignoring %s key for '%s': %s",
-			    managed ? "managed" : "trusted",
+			    "ignoring %s for '%s': %s",
+			    initializing ? "initial-key" : "static-key",
 			    keynamestr, isc_result_totext(result));
 		return (ISC_R_SUCCESS);
 	case DST_R_NOCRYPTO:
@@ -860,8 +860,8 @@ process_key(const cfg_obj_t *key, const cfg_obj_t *vconfig,
 		 * Crypto support is not available.
 		 */
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
-			    "ignoring %s key for '%s': no crypto support",
-			    managed ? "managed" : "trusted",
+			    "ignoring %s for '%s': no crypto support",
+			    initializing ? "initial-key" : "static-key",
 			    keynamestr);
 		return (result);
 	default:
@@ -871,8 +871,8 @@ process_key(const cfg_obj_t *key, const cfg_obj_t *vconfig,
 		 * is interrupted.
 		 */
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
-			    "configuring %s key for '%s': %s",
-			    managed ? "managed" : "trusted",
+			    "configuring %s for '%s': %s",
+			    initializing ? "initial-key" : "static-key",
 			    keynamestr, isc_result_totext(result));
 		return (ISC_R_FAILURE);
 	}
@@ -893,17 +893,21 @@ process_key(const cfg_obj_t *key, const cfg_obj_t *vconfig,
 	 */
 	if (!dns_resolver_algorithm_supported(resolver, keyname, keyalg)) {
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
-			    "ignoring %s key for '%s': algorithm is disabled",
-			    managed ? "managed" : "trusted", keynamestr);
+			    "ignoring %s for '%s': algorithm is disabled",
+			    initializing ? "initial-key" : "static-key",
+			    keynamestr);
 		goto done;
 	}

 	/*
-	 * Add the key to 'secroots'.  This key is taken from the
-	 * configuration, so if it's a managed key then it's an initializing
-	 * key; that's why 'managed' is duplicated below.
+	 * Add the key to 'secroots'.  Keys from a "dnssec-keys" or
+	 * "managed-keys" statement may be either static or initializing
+	 * keys. If it's not initializing, we don't want to treat it as
+	 * managed, so we use 'initializing' twice here, for both the
+	 * 'managed' and 'initializing' arguments to dns_keytable_add().
 	 */
-	result = dns_keytable_add(secroots, managed, managed, &dstkey);
+	result = dns_keytable_add(secroots, initializing,
+				  initializing, &dstkey);

 done:
 	/*
@@ -924,8 +928,7 @@ process_key(const cfg_obj_t *key, const cfg_obj_t *vconfig,
 * an initializing key.
 */
 static isc_result_t
-load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
-	       dns_view_t *view, bool managed,
+load_view_keys(const cfg_obj_t *keys, dns_view_t *view, bool managed,
 	       const dns_name_t *keyname, isc_mem_t *mctx)
 {
 	const cfg_listelt_t *elt, *elt2;
@@ -945,7 +948,7 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 		     elt2 != NULL;
 		     elt2 = cfg_list_next(elt2))
 		{
-			CHECK(process_key(cfg_listelt_value(elt2), vconfig,
+			CHECK(process_key(cfg_listelt_value(elt2),
 					  secroots, keyname, view->resolver,
 					  managed, mctx));
 		}
@@ -999,7 +1002,9 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	const cfg_obj_t *view_keys = NULL;
 	const cfg_obj_t *global_keys = NULL;
 	const cfg_obj_t *view_managed_keys = NULL;
+	const cfg_obj_t *view_dnssec_keys = NULL;
 	const cfg_obj_t *global_managed_keys = NULL;
+	const cfg_obj_t *global_dnssec_keys = NULL;
 	const cfg_obj_t *maps[4];
 	const cfg_obj_t *voptions = NULL;
 	const cfg_obj_t *options = NULL;
@@ -1019,15 +1024,24 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 		if (voptions != NULL) {
 			(void) cfg_map_get(voptions, "trusted-keys",
 					   &view_keys);
+
+			/* managed-keys and dnssec-keys are synonyms. */
 			(void) cfg_map_get(voptions, "managed-keys",
 					   &view_managed_keys);
+			(void) cfg_map_get(voptions, "dnssec-keys",
+					   &view_dnssec_keys);
+
 			maps[i++] = voptions;
 		}
 	}

 	if (config != NULL) {
 		(void)cfg_map_get(config, "trusted-keys", &global_keys);
+
+		/* managed-keys and dnssec-keys are synonyms. */
 		(void)cfg_map_get(config, "managed-keys", &global_managed_keys);
+		(void)cfg_map_get(config, "dnssec-keys", &global_dnssec_keys);
+
 		(void)cfg_map_get(config, "options", &options);
 		if (options != NULL) {
 			maps[i++] = options;
@@ -1055,11 +1069,10 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,

 	if (auto_root && view->rdclass == dns_rdataclass_in) {
 		const cfg_obj_t *builtin_keys = NULL;
-		const cfg_obj_t *builtin_managed_keys = NULL;

 		/*
 		 * If bind.keys exists and is populated, it overrides
-		 * the managed-keys clause hard-coded in named_g_config.
+		 * the dnssec-keys clause hard-coded in named_g_config.
 		 */
 		if (bindkeys != NULL) {
 			isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY,
@@ -1068,13 +1081,10 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 				      "from '%s'",
 				      view->name, named_g_server->bindkeysfile);

-			(void)cfg_map_get(bindkeys, "trusted-keys",
+			(void)cfg_map_get(bindkeys, "dnssec-keys",
 					  &builtin_keys);
-			(void)cfg_map_get(bindkeys, "managed-keys",
-					  &builtin_managed_keys);

-			if ((builtin_keys == NULL) &&
-			    (builtin_managed_keys == NULL))
+			if (builtin_keys == NULL) {
 				isc_log_write(named_g_lctx,
 					      DNS_LOGCATEGORY_SECURITY,
 					      NAMED_LOGMODULE_SERVER,
@@ -1082,29 +1092,23 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 					      "dnssec-validation auto: "
 					      "WARNING: root zone key "
 					      "not found");
+			}
 		}

-		if ((builtin_keys == NULL) &&
-		    (builtin_managed_keys == NULL))
-		{
+		if (builtin_keys == NULL) {
 			isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 				      "using built-in root key for view %s",
 				      view->name);

-			(void)cfg_map_get(named_g_config, "trusted-keys",
+			(void)cfg_map_get(named_g_config, "dnssec-keys",
 					  &builtin_keys);
-			(void)cfg_map_get(named_g_config, "managed-keys",
-					  &builtin_managed_keys);
 		}

-		if (builtin_keys != NULL)
-			CHECK(load_view_keys(builtin_keys, vconfig, view,
-					     false, dns_rootname, mctx));
-		if (builtin_managed_keys != NULL)
-			CHECK(load_view_keys(builtin_managed_keys, vconfig,
-					     view, true, dns_rootname,
-					     mctx));
+		if (builtin_keys != NULL) {
+			CHECK(load_view_keys(builtin_keys, view, true,
+					     dns_rootname, mctx));
+		}

 		if (!keyloaded(view, dns_rootname)) {
 			isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY,
@@ -1115,16 +1119,16 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 		}
 	}

-	CHECK(load_view_keys(view_keys, vconfig, view, false,
-			     NULL, mctx));
-	CHECK(load_view_keys(view_managed_keys, vconfig, view, true,
-			     NULL, mctx));
+	CHECK(load_view_keys(view_keys, view, false, NULL, mctx));
+	CHECK(load_view_keys(view_managed_keys, view, true, NULL, mctx));
+	CHECK(load_view_keys(view_dnssec_keys, view, true, NULL, mctx));

 	if (view->rdclass == dns_rdataclass_in) {
-		CHECK(load_view_keys(global_keys, vconfig, view, false,
+		CHECK(load_view_keys(global_keys, view, false, NULL, mctx));
+		CHECK(load_view_keys(global_managed_keys, view, true,
+				     NULL, mctx));
+		CHECK(load_view_keys(global_dnssec_keys, view, true,
 				     NULL, mctx));
-		CHECK(load_view_keys(global_managed_keys, vconfig, view,
-				     true, NULL, mctx));
 	}

 	/*
@@ -1804,7 +1808,6 @@ cache_reusable(dns_view_t *originview, dns_view_t *view,
 static bool
 cache_sharable(dns_view_t *originview, dns_view_t *view,
 	       bool new_zero_no_soattl,
-	       unsigned int new_cleaning_interval,
 	       uint64_t new_max_cache_size,
 	       uint32_t new_stale_ttl)
 {
@@ -1819,9 +1822,7 @@ cache_sharable(dns_view_t *originview, dns_view_t *view,
 	 * Check other cache related parameters that must be consistent among
 	 * the sharing views.
 	 */
-	if (dns_cache_getcleaninginterval(originview->cache) !=
-	    new_cleaning_interval ||
-	    dns_cache_getservestalettl(originview->cache) != new_stale_ttl ||
+	if (dns_cache_getservestalettl(originview->cache) != new_stale_ttl ||
 	    dns_cache_getcachesize(originview->cache) != new_max_cache_size) {
 		return (false);
 	}
@@ -3800,7 +3801,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	in_port_t port;
 	dns_cache_t *cache = NULL;
 	isc_result_t result;
-	unsigned int cleaning_interval;
 	size_t max_cache_size;
 	uint32_t max_cache_size_percent = 0;
 	size_t max_adb_size;
@@ -4014,11 +4014,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	 * Obtain configuration parameters that affect the decision of whether
 	 * we can reuse/share an existing cache.
 	 */
-	obj = NULL;
-	result = named_config_get(maps, "cleaning-interval", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	cleaning_interval = cfg_obj_asuint32(obj) * 60;
-
 	obj = NULL;
 	result = named_config_get(maps, "max-cache-size", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -4306,8 +4301,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	nsc = cachelist_find(cachelist, cachename, view->rdclass);
 	if (nsc != NULL) {
 		if (!cache_sharable(nsc->primaryview, view, zero_no_soattl,
-				    cleaning_interval, max_cache_size,
-				    max_stale_ttl))
+				    max_cache_size, max_stale_ttl))
 		{
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
@@ -4405,7 +4399,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			CHECK(dns_cache_load(cache));
 	}

-	dns_cache_setcleaninginterval(cache, cleaning_interval);
 	dns_cache_setcachesize(cache, max_cache_size);
 	dns_cache_setservestalettl(cache, max_stale_ttl);

@@ -74,7 +74,7 @@ stats_dumparg {

 static isc_once_t once = ISC_ONCE_INIT;

-#if defined(HAVE_LIBXML2) || defined(HAVE_JSON)
+#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 #define EXTENDED_STATS
 #else
 #undef EXTENDED_STATS
@@ -1070,7 +1070,7 @@ dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 	xmlTextWriterPtr writer;
 	int xmlrc;
 #endif
-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 	json_object *job, *cat, *counter;
 #endif

@@ -1086,7 +1086,7 @@ dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 	memset(values, 0, sizeof(values[0]) * ncounters);
 	isc_stats_dump(stats, generalstat_dump, &dumparg, options);

-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 	cat = job = (json_object *) arg;
 	if (ncounters > 0 && type == isc_statsformat_json) {
 		if (category != NULL) {
@@ -1161,7 +1161,7 @@ dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 #endif
 			break;
 		case isc_statsformat_json:
-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 			counter = json_object_new_int64(value);
 			if (counter == NULL)
 				return (ISC_R_NOMEMORY);
@@ -1190,7 +1190,7 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	xmlTextWriterPtr writer;
 	int xmlrc;
 #endif
-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 	json_object *zoneobj, *obj;
 #endif

@@ -1224,7 +1224,7 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 #endif
 		break;
 	case isc_statsformat_json:
-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 		zoneobj = (json_object *) dumparg->arg;
 		obj = json_object_new_int64(val);
 		if (obj == NULL)
@@ -1256,7 +1256,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	xmlTextWriterPtr writer;
 	int xmlrc;
 #endif
-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 	json_object *zoneobj, *obj;
 	char buf[1024];
 #endif
@@ -1308,7 +1308,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 #endif
 		break;
 	case isc_statsformat_json:
-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 		zoneobj = (json_object *) dumparg->arg;
 		snprintf(buf, sizeof(buf), "%s%s%s",
 			 stale ? "#" : "", nxrrset ? "!" : "", typestr);
@@ -1340,7 +1340,7 @@ opcodestat_dump(dns_opcode_t code, uint64_t val, void *arg) {
 	xmlTextWriterPtr writer;
 	int xmlrc;
 #endif
-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 	json_object *zoneobj, *obj;
 #endif

@@ -1366,7 +1366,7 @@ opcodestat_dump(dns_opcode_t code, uint64_t val, void *arg) {
 #endif
 		break;
 	case isc_statsformat_json:
-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 		zoneobj = (json_object *) dumparg->arg;
 		obj = json_object_new_int64(val);
 		if (obj == NULL)
@@ -1397,7 +1397,7 @@ rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {
 	xmlTextWriterPtr writer;
 	int xmlrc;
 #endif
-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 	json_object *zoneobj, *obj;
 #endif

@@ -1423,7 +1423,7 @@ rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {
 #endif
 		break;
 	case isc_statsformat_json:
-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 		zoneobj = (json_object *) dumparg->arg;
 		obj = json_object_new_int64(val);
 		if (obj == NULL)
@@ -2195,7 +2195,7 @@ render_xml_traffic(const char *url, isc_httpdurl_t *urlinfo,

 #endif	/* HAVE_LIBXML2 */

-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 /*
 * Which statistics to include when rendering to JSON
 */
@@ -3098,7 +3098,7 @@ render_json_traffic(const char *url, isc_httpdurl_t *urlinfo,
 			    freecb, freecb_args));
 }

-#endif /* HAVE_JSON */
+#endif /* HAVE_JSON_C */

 static isc_result_t
 render_xsl(const char *url, isc_httpdurl_t *urlinfo,
@@ -3314,7 +3314,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_httpdmgr_addurl(listener->httpdmgr, "/xml/v3/traffic",
 			    render_xml_traffic, server);
 #endif
-#ifdef HAVE_JSON
+#ifdef HAVE_JSON_C
 	isc_httpdmgr_addurl(listener->httpdmgr, "/json",
 			    render_json_all, server);
 	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1",
@@ -3449,12 +3449,12 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 			      "statistics-channels: XML library missing, "
 			      "only JSON stats will be available");
 #endif /* !HAVE_LIBXML2 */
-#ifndef HAVE_JSON
+#ifndef HAVE_JSON_C
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "statistics-channels: JSON library missing, "
 			      "only XML stats will be available");
-#endif /* !HAVE_JSON */
+#endif /* !HAVE_JSON_C */
 #endif /* EXTENDED_STATS */

 		for (element = cfg_list_first(statschannellist);
@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@

 CINCLUDES =	-I${srcdir}/include -I${srcdir}/../include \
 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
-		${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+		${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =
 CWARNINGS =
@@ -21,7 +21,7 @@ DST_GSSAPI_INC = @DST_GSSAPI_INC@

 CINCLUDES =	${DNS_INCLUDES} ${BIND9_INCLUDES} ${ISC_INCLUDES} \
 		${ISCCFG_INCLUDES} ${IRS_INCLUDES} ${DST_GSSAPI_INC} \
-		@OPENSSL_INCLUDES@
+		@OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =	-DVERSION=\"${VERSION}\" @USE_GSSAPI@
 CWARNINGS =
@@ -43,10 +43,10 @@ DEPLIBS =	${DNSDEPLIBS} ${IRSDEPLIBS} ${BIND9DEPLIBS} \
 		${ISCDEPLIBS} ${ISCCFGDEPLIBS}

 LIBS =		${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} \
-		${ISCCFGLIBS} ${ISCLIBS} @LIBS@
+		${ISCCFGLIBS} ${ISCLIBS} @JSON_C_LIBS@ @LIBS@

 NOSYMLIBS =	${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} \
-		${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
+		${ISCCFGLIBS} ${ISCNOSYMLIBS} @JSON_C_LIBS@ @LIBS@

 SUBDIRS =

@@ -13,7 +13,7 @@ top_srcdir =	@top_srcdir@

@BIND9_MAKE_INCLUDES@

-CINCLUDES =	${ISC_INCLUDES}
+CINCLUDES =	${ISC_INCLUDES} @JSON_C_CFLAGS@

 CDEFINES =

@@ -24,7 +24,7 @@ ISCDEPLIBS =	../../lib/isc/libisc.@A@
 DEPLIBS =	${ISCDEPLIBS}

 # if FORCE_STATIC_PROVIDER: LIBS += ${PROVIDER}
-LIBS =		${ISCLIBS} @LIBS@
+LIBS =		${ISCLIBS} @JSON_C_LIBS@ @LIBS@

 SUBDIRS =	benchmarks

@@ -15,7 +15,7 @@ top_srcdir =	@top_srcdir@

 CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${NS_INCLUDES} ${DNS_INCLUDES} \
-		${ISCCFG_INCLUDES} ${ISC_INCLUDES}
+		${ISCCFG_INCLUDES} ${ISC_INCLUDES} @JSON_C_CFLAGS@

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -16,7 +16,7 @@ VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@

 CINCLUDES = -I${srcdir}/include ${ISC_INCLUDES} ${ISCCC_INCLUDES} \
-	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES}
+	${ISCCFG_INCLUDES} ${DNS_INCLUDES} ${BIND9_INCLUDES} @JSON_C_CFLAGS@

 CDEFINES =
 CWARNINGS =
@@ -34,8 +34,8 @@ ISCDEPLIBS =	../../lib/isc/libisc.@A@
 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@

-LIBS =		${ISCLIBS} @LIBS@
-NOSYMLIBS =	${ISCNOSYMLIBS} @LIBS@
+LIBS =		${ISCLIBS} @JSON_C_LIBS@ @LIBS@
+NOSYMLIBS =	${ISCNOSYMLIBS} @JSON_C_LIBS@ @LIBS@

 RNDCDEPLIBS =	${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${BIND9DEPLIBS} ${DNSDEPLIBS} ${ISCDEPLIBS}

@@ -278,7 +278,7 @@ rndc_senddone(isc_task_t *task, isc_event_t *event) {
 	if (sends == 0 && recvs == 0) {
 		isc_socket_detach(&sock);
 		isc_task_shutdown(task);
-		RUNTIME_CHECK(isc_app_shutdown() == ISC_R_SUCCESS);
+		isc_app_shutdown();
 	}
 }

@@ -347,7 +347,7 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) {
 	if (sends == 0 && recvs == 0) {
 		isc_socket_detach(&sock);
 		isc_task_shutdown(task);
-		RUNTIME_CHECK(isc_app_shutdown() == ISC_R_SUCCESS);
+		isc_app_shutdown();
 	}
 }

@@ -458,7 +458,7 @@
 	<term><userinput>managed-keys <replaceable>(status | refresh | sync | destroy)</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
 	<listitem>
 	  <para>
-            Inspect and control the "managed-keys" database which
+            Inspect and control the "managed keys" database which
            handles RFC 5011 DNSSEC trust anchor maintenance. If a view
            is specified, these commands are applied to that view;
            otherwise they are applied to all views.
@@ -467,14 +467,14 @@
            <listitem>
              <para>
                When run with the <literal>status</literal> keyword, prints
-                the current status of the managed-keys database.
+                the current status of the managed keys database.
              </para>
            </listitem>
            <listitem>
              <para>
                When run with the <literal>refresh</literal> keyword,
                forces an immediate refresh query to be sent for all
-                the managed keys, updating the managed-keys database
+                the managed keys, updating the managed keys database
                if any new keys are found, without waiting the normal
                refresh interval.
              </para>
@@ -482,7 +482,7 @@
            <listitem>
              <para>
                When run with the <literal>sync</literal> keyword, forces an
-                immediate dump of the managed-keys database to disk
+                immediate dump of the managed keys database to disk
                (in the file <filename>managed-keys.bind</filename> or
                (<filename><replaceable>viewname</replaceable>.mkeys</filename>).
                This synchronizes the database with its journal file, so
@@ -493,7 +493,7 @@
            <listitem>
              <para>
                When run with the <literal>destroy</literal> keyword, the
-                managed-keys database is shut down and deleted, and all key
+                managed keys database is shut down and deleted, and all key
                maintenance is terminated.  This command should be used only
                with extreme caution.
              </para>
@@ -772,9 +772,10 @@
 	<listitem>
 	  <para>
 	    Dump the security roots (i.e., trust anchors
-	    configured via <command>trusted-keys</command>,
-	    <command>managed-keys</command>, or
-	    <command>dnssec-validation auto</command>) and negative trust
+	    configured via <command>dnssec-keys</command> statements,
+	    or the synonymous <command>managed-keys</command> or
+	    the deprecated <command>trusted-keys</command> statements, or
+	    via <command>dnssec-validation auto</command>) and negative trust
 	    anchors for the specified views.  If no view is specified, all
 	    views are dumped.  Security roots will indicate whether
 	    they are configured as trusted keys, managed keys, or
@@ -1066,7 +1067,7 @@
 	  <para>
 	    List the names of all TSIG keys currently configured
 	    for use by <command>named</command> in each view.  The
-	    list both statically configured keys and dynamic
+	    list includes both statically configured keys and dynamic
 	    TKEY-negotiated keys.
 	  </para>
 	</listitem>
@@ -14,7 +14,7 @@ top_srcdir =	@top_srcdir@
@BIND9_MAKE_INCLUDES@

 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
-		@OPENSSL_INCLUDES@
+		@OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =
 CWARNINGS =
@@ -30,7 +30,7 @@ ISCDEPLIBS =	../../lib/isc/libisc.@A@
 ISCDEPNOSYMLIBS = ../../lib/isc/libisc-nosymtbl.@A@
 ISCCFGDEPLIBS = ../../lib/isccfg/libisccfg.@A@

-LIBS =		@LIBS@
+LIBS =		@JSON_C_LIBS@ @LIBS@

 SUBDIRS =	system @PKCS11_TOOLS@
 TESTDIRS =	system
@@ -174,7 +174,6 @@ options {
 	files 230;
 	max-cache-size 1m;
 	stacksize 231;
-	cleaning-interval 1000;
 	heartbeat-interval 1001;
 	interface-interval 1002;
 	statistics-interval 1003;
@@ -260,8 +259,8 @@ key "non-viewkey" { secret "YWFh" ; algorithm "zzz" ; };
 view "test-view" in {
 	key "viewkey" { algorithm "xxx" ; secret "eXl5" ; };
 	also-notify { 10.2.2.3; };
-	trusted-keys {
-		foo.com. 4 3 2 "abdefghijklmnopqrstuvwxyz";
+	managed-keys {
+		foo.com. static 4 3 2 "abdefghijklmnopqrstuvwxyz";
 	};
 	sig-validity-interval 45;
 	max-cache-size 100000;
@@ -285,7 +284,6 @@ view "test-view" in {
 	query-source-v6 address 6:6:6:6:6:6:6:6 port *;
 	max-transfer-time-out 45;
 	max-transfer-idle-out 55;
-	cleaning-interval 100;
 	min-roots 3;
 	lame-ttl 477;
 	max-ncache-ttl 333;
@@ -344,8 +342,8 @@ zone "." {
 //	pubkey 257 255 1 "AQP2fHpZ4VMpKo/jc9Fod821uyfY5p8j5h/Am0V/KpBTMZjdXmp9QJe6yFRoIIzkaNCgTIftASdpXGgCwFB2j2KXP/rick6gvEer5VcDEkLR5Q==";
 };

-trusted-keys {
-	"." 257 255 1 "AQP2fHpZ4VMpKo/jc9Fod821uyfY5p8j5h/Am0V/KpBTMZjdXmp9QJe6yFRoIIzkaNCgTIftASdpXGgCwFB2j2KXP/rick6gvEer5VcDEkLR5Q==";
+managed-keys {
+	"." static 257 255 1 "AQP2fHpZ4VMpKo/jc9Fod821uyfY5p8j5h/Am0V/KpBTMZjdXmp9QJe6yFRoIIzkaNCgTIftASdpXGgCwFB2j2KXP/rick6gvEer5VcDEkLR5Q==";
 };


@@ -14,7 +14,7 @@ top_srcdir =	@top_srcdir@
@BIND9_MAKE_INCLUDES@

 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
-		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@
+		@OPENSSL_INCLUDES@ @DST_GSSAPI_INC@ @JSON_C_CFLAGS@

 CDEFINES =	@USE_GSSAPI@

@@ -32,7 +32,7 @@ ISCDEPLIBS =	../../../lib/isc/libisc.@A@
 ISCDEPNOSYMLIBS = ../../../lib/isc/libisc-nosymtbl.@A@
 ISCCFGDEPLIBS = ../../../lib/isccfg/libisccfg.@A@

-LIBS =		@LIBS@
+LIBS =		@JSON_C_LIBS@ @LIBS@

 SUBDIRS =

@@ -98,7 +98,7 @@ tick(isc_task_t *task, isc_event_t *event) {
 	info->ticks++;
 	if (strcmp(info->name, "1") == 0) {
 		if (info->ticks == 10) {
-			RUNTIME_CHECK(isc_app_shutdown() == ISC_R_SUCCESS);
+			isc_app_shutdown();
 		} else if (info->ticks >= 15 && info->exiting) {
 			isc_timer_detach(&info->timer);
 			isc_task_detach(&info->task);
@@ -33,12 +33,12 @@ rm $zsknopriv.private
 ksksby=`$KEYGEN -3 -a RSASHA1 -q -P now -A now+15s -fk $zone`
 kskrev=`$KEYGEN -3 -a RSASHA1 -q -R now+15s -fk $zone`

-keyfile_to_trusted_keys $ksksby > trusted.conf
+keyfile_to_static_keys $ksksby > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf

-keyfile_to_trusted_keys $kskrev > trusted.conf
+keyfile_to_static_keys $kskrev > trusted.conf
 cp trusted.conf ../ns5/trusted.conf

 echo $zskact > ../active.key
@@ -37,7 +37,7 @@ zonefile="${zone}.db"
 infile="${zonefile}.in"
 ksk=`$KEYGEN -a RSASHA1 -3 -q -fk $zone`
 $KEYGEN -a RSASHA1 -3 -q $zone > /dev/null
-keyfile_to_trusted_keys $ksk > private.conf
+keyfile_to_static_keys $ksk > private.conf
 cp private.conf ../ns4/private.conf
 $SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > /dev/null 2>&1

@@ -13,7 +13,7 @@ options {
 	dnssec-validation yes;
 };

-managed-keys {
+dnssec-keys {
 	example. initial-key 257 3 8 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl
 		25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafG
 		tURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJY
@@ -23,8 +23,8 @@ managed-keys {
 		NQyrszHhWUU=";
 };

-trusted-keys {
-	example. 257 3 8 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbod
+dnssec-keys {
+	example. static-key 257 3 8 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbod
 		y0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQ
 		YfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX
 		2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuw
@@ -13,7 +13,7 @@ options {
 	dnssec-validation yes;
 };

-managed-keys {
+dnssec-keys {
 	. initial-key 257 3 8 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl
 		25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafG
 		tURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJY
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-keys {
+	# This key (19036) is to be phased out starting in 2017. It will
+	# remain in the root zone for some time after its successor key
+	# has been added. It will remain this file until it is removed from
+	# the root zone.
+	. static-key 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
+		FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
+		bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
+		X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
+		W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
+		Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq
+		QxA+Uk1ihz0=";
+
+	# This key (20326) was published in the root zone in 2017.
+	# Servers which were already using the old key (19036) should
+	# roll seamlessly to this new one via RFC 5011 rollover. Servers
+	# being set up for the first time can use the contents of this
+	# file as initializing keys; thereafter, the keys in the
+	# managed key database will be trusted and maintained
+	# automatically.
+	. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+		+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+		ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+		0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+		oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+		RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+		R1AkUTV74bU=";
+};
@@ -13,8 +13,8 @@ options {
 	dnssec-validation auto;
 };

-trusted-keys {
-	. 257 3 8 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbod
+dnssec-keys {
+	. static-key 257 3 8 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbod
 		y0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQ
 		YfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX
 		2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuw
@@ -9,8 +9,8 @@
 * information regarding copyright ownership.
 */

-trusted-keys {
-	dlv.isc.org 257 3 5 "BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWE
+dnssec-keys {
+	dlv.isc.org static-key 257 3 5 "BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWE
 		n4MxDCE1+lLy2brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8
 		+jAGl2FZLK8t+1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ
 		2kJb56dhgMde5ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnG
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-keys {
+	# This key (19036) is to be phased out starting in 2017. It will
+	# remain in the root zone for some time after its successor key
+	# has been added. It will remain this file until it is removed from
+	# the root zone.
+	. static-key 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
+		FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
+		bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
+		X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
+		W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
+		Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq
+		QxA+Uk1ihz0=";
+};
+
+managed-keys {
+	# This key (20326) was published in the root zone in 2017.
+	# Servers which were already using the old key (19036) should
+	# roll seamlessly to this new one via RFC 5011 rollover. Servers
+	# being set up for the first time can use the contents of this
+	# file as initializing keys; thereafter, the keys in the
+	# managed key database will be trusted and maintained
+	# automatically.
+	. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+		+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+		ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+		0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+		oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+		RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+		R1AkUTV74bU=";
+};
@@ -9,12 +9,12 @@
 * information regarding copyright ownership.
 */

-trusted-keys {
+dnssec-keys {
 	# This key (19036) is to be phased out starting in 2017. It will
 	# remain in the root zone for some time after its successor key
 	# has been added. It will remain this file until it is removed from
 	# the root zone.
-	. 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
+	. initial-key 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
 		FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
 		bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
 		X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-trusted-keys {
+dnssec-keys {
 	# This key (20326) was published in the root zone in 2017.
 	# Servers which were already using the old key (19036) should
 	# roll seamlessly to this new one via RFC 5011 rollover. Servers
@@ -17,7 +17,7 @@ trusted-keys {
 	# file as initializing keys; thereafter, the keys in the
 	# managed key database will be trusted and maintained
 	# automatically.
-	. 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+	. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
 		+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
 		ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
 		0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
@@ -9,12 +9,12 @@
 * information regarding copyright ownership.
 */

-trusted-keys {
+dnssec-keys {
 	# This key (19036) is to be phased out starting in 2017. It will
 	# remain in the root zone for some time after its successor key
 	# has been added. It will remain this file until it is removed from
 	# the root zone.
-	. 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
+	. initial-key 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
 		FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
 		bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
 		X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
@@ -29,7 +29,7 @@ trusted-keys {
 	# file as initializing keys; thereafter, the keys in the
 	# managed key database will be trusted and maintained
 	# automatically.
-	. 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+	. initial-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
 		+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
 		ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
 		0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-keys {
+	# This key (20326) was published in the root zone in 2017.
+	# Servers which were already using the old key (19036) should
+	# roll seamlessly to this new one via RFC 5011 rollover. Servers
+	# being set up for the first time can use the contents of this
+	# file as initializing keys; thereafter, the keys in the
+	# managed key database will be trusted and maintained
+	# automatically.
+	. static-key 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+		+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+		ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+		0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+		oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+		RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+		R1AkUTV74bU=";
+};
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+trusted-keys {
+	# This key (20326) was published in the root zone in 2017.
+	# Servers which were already using the old key (19036) should
+	# roll seamlessly to this new one via RFC 5011 rollover. Servers
+	# being set up for the first time can use the contents of this
+	# file as initializing keys; thereafter, the keys in the
+	# managed key database will be trusted and maintained
+	# automatically.
+	. 257 3 8 "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3
+		+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv
+		ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF
+		0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e
+		oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd
+		RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN
+		R1AkUTV74bU=";
+};
@@ -13,7 +13,7 @@ options {
 	dnssec-validation yes;
 };

-managed-keys {
+dnssec-keys {
 	example. initial-key 257 3 8 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl
 		25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafG
 		tURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJY
@@ -16,7 +16,7 @@ n=0
 n=`expr $n + 1`
 echo_i "checking that named-checkconf handles a known good config ($n)"
 ret=0
-$CHECKCONF good.conf > /dev/null 2>&1 || ret=1
+$CHECKCONF good.conf > checkconf.out$n 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -25,7 +25,8 @@ echo_i "checking that named-checkconf prints a known good config ($n)"
 ret=0
 awk 'BEGIN { ok = 0; } /cut here/ { ok = 1; getline } ok == 1 { print }' good.conf > good.conf.in
 [ -s good.conf.in ] || ret=1
-$CHECKCONF -p good.conf.in | grep -v '^good.conf.in:' > good.conf.out 2>&1 || ret=1
+$CHECKCONF -p good.conf.in  > checkconf.out$n || ret=1
+grep -v '^good.conf.in:' < checkconf.out$n > good.conf.out 2>&1 || ret=1
 cmp good.conf.in good.conf.out || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -36,7 +37,8 @@ ret=0
 # ensure there is a secret and that it is not the check string.
 grep 'secret "' good.conf.in > /dev/null || ret=1
 grep 'secret "????????????????"' good.conf.in > /dev/null 2>&1 && ret=1
-$CHECKCONF -p -x good.conf.in | grep -v '^good.conf.in:' > good.conf.out 2>&1 || ret=1
+$CHECKCONF -p -x good.conf.in > checkconf.out$n || ret=1
+grep -v '^good.conf.in:' < checkconf.out$n > good.conf.out 2>&1 || ret=1
 grep 'secret "????????????????"' good.conf.out > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -46,21 +48,21 @@ do
    n=`expr $n + 1`
    echo_i "checking that named-checkconf detects error in $bad ($n)"
    ret=0
-    $CHECKCONF $bad > checkconf.out 2>&1
+    $CHECKCONF $bad > checkconf.out$n 2>&1
    if [ $? != 1 ]; then ret=1; fi
-    grep "^$bad:[0-9]*: " checkconf.out > /dev/null || ret=1
+    grep "^$bad:[0-9]*: " < checkconf.out$n > /dev/null || ret=1
    case $bad in
    bad-update-policy[123].conf)
 	pat="identity and name fields are not the same"
-	grep "$pat" checkconf.out > /dev/null || ret=1
+	grep "$pat" < checkconf.out$n > /dev/null || ret=1
 	;;
    bad-update-policy[4589].conf|bad-update-policy1[01].conf)
 	pat="name field not set to placeholder value"
-	grep "$pat" checkconf.out > /dev/null || ret=1
+	grep "$pat" < checkconf.out$n > /dev/null || ret=1
 	;;
    bad-update-policy[67].conf|bad-update-policy1[2345].conf)
 	pat="missing name field type '.*' found"
-	grep "$pat" checkconf.out > /dev/null || ret=1
+	grep "$pat" < checkconf.out$n > /dev/null || ret=1
 	;;
    esac
    if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -72,7 +74,7 @@ do
 	n=`expr $n + 1`
 	echo_i "checking that named-checkconf detects no error in $good ($n)"
 	ret=0
-	$CHECKCONF $good > /dev/null 2>&1
+	$CHECKCONF $good > checkconf.out$n 2>&1
 	if [ $? != 0 ]; then echo_i "failed"; ret=1; fi
 	status=`expr $status + $ret`
 done
@@ -96,14 +98,15 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking that named-checkconf catches range errors ($n)"
 ret=0
-$CHECKCONF range.conf > /dev/null 2>&1 && ret=1
+$CHECKCONF range.conf > checkconf.out$n 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf warns of notify inconsistencies ($n)"
 ret=0
-warnings=`$CHECKCONF notify.conf 2>&1 | grep "'notify' is disabled" | wc -l`
+$CHECKCONF notify.conf > checkconf.out$n 2>&1
+warnings=`grep "'notify' is disabled" < checkconf.out$n | wc -l`
 [ $warnings -eq 3 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -112,11 +115,14 @@ n=`expr $n + 1`
 echo_i "checking named-checkconf dnssec warnings ($n)"
 ret=0
 # dnssec.1: dnssec-enable is obsolete
-$CHECKCONF dnssec.1 2>&1 | grep "'dnssec-enable' is obsolete and should be removed" > /dev/null || ret=1
+$CHECKCONF dnssec.1 > checkconf.out$n.1 2>&1
+grep "'dnssec-enable' is obsolete and should be removed" < checkconf.out$n.1 > /dev/null || ret=1
 # dnssec.2: auto-dnssec warning
-$CHECKCONF dnssec.2 2>&1 | grep 'auto-dnssec may only be ' > /dev/null || ret=1
+$CHECKCONF dnssec.2 > checkconf.out$n.2 2>&1
+grep 'auto-dnssec may only be ' < checkconf.out$n.2 > /dev/null || ret=1
 # dnssec.3: should have no warnings
-$CHECKCONF dnssec.3 2>&1 | grep '.*' && ret=1
+$CHECKCONF dnssec.3 > checkconf.out$n.3 2>&1
+grep '.*' < checkconf.out$n.3 > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -129,14 +135,14 @@ options {
    $field 0;
 };
 EOF
-    $CHECKCONF badzero.conf > /dev/null 2>&1
+    $CHECKCONF badzero.conf > checkconf.out$n.1 2>&1
    [ $? -eq 1 ] || { echo_i "options $field failed" ; ret=1; }
    cat > badzero.conf << EOF
 view dummy {
    $field 0;
 };
 EOF
-    $CHECKCONF badzero.conf > /dev/null 2>&1
+    $CHECKCONF badzero.conf > checkconf.out$n.2 2>&1
    [ $? -eq 1 ] || { echo_i "view $field failed" ; ret=1; }
    cat > badzero.conf << EOF
 options {
@@ -145,7 +151,7 @@ options {
 view dummy {
 };
 EOF
-    $CHECKCONF badzero.conf > /dev/null 2>&1
+    $CHECKCONF badzero.conf > checkconf.out$n.3 2>&1
    [ $? -eq 1 ] || { echo_i "options + view $field failed" ; ret=1; }
    cat > badzero.conf << EOF
 zone dummy {
@@ -154,7 +160,7 @@ zone dummy {
    $field 0;
 };
 EOF
-    $CHECKCONF badzero.conf > /dev/null 2>&1
+    $CHECKCONF badzero.conf > checkconf.out$n.4 2>&1
    [ $? -eq 1 ] || { echo_i "zone $field failed" ; ret=1; }
 done
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -163,22 +169,28 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking options allowed in inline-signing slaves ($n)"
 ret=0
-l=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-dnskey-kskonly.*requires inline" | wc -l`
+$CHECKCONF bad-dnssec.conf > checkconf.out$n.1 2>&1
+l=`grep "dnssec-dnskey-kskonly.*requires inline" < checkconf.out$n.1 | wc -l`
 [ $l -eq 1 ] || ret=1
-l=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-loadkeys-interval.*requires inline" | wc -l`
+$CHECKCONF bad-dnssec.conf > checkconf.out$n.2 2>&1
+l=`grep "dnssec-loadkeys-interval.*requires inline" < checkconf.out$n.2 | wc -l`
 [ $l -eq 1 ] || ret=1
-l=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "update-check-ksk.*requires inline" | wc -l`
+$CHECKCONF bad-dnssec.conf > checkconf.out$n.3 2>&1
+l=`grep "update-check-ksk.*requires inline" < checkconf.out$n.3 | wc -l`
 [ $l -eq 1 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "check file + inline-signing for slave zones ($n)"
-l=`$CHECKCONF inline-no.conf 2>&1 | grep "missing 'file' entry" | wc -l`
+$CHECKCONF inline-no.conf > checkconf.out$n.1 2>&1
+l=`grep "missing 'file' entry" < checkconf.out$n.1 | wc -l`
 [ $l -eq 0 ] || ret=1
-l=`$CHECKCONF inline-good.conf 2>&1 | grep "missing 'file' entry" | wc -l`
+$CHECKCONF inline-good.conf > checkconf.out$n.2 2>&1
+l=`grep "missing 'file' entry" < checkconf.out$n.2 | wc -l`
 [ $l -eq 0 ] || ret=1
-l=`$CHECKCONF inline-bad.conf 2>&1 | grep "missing 'file' entry" | wc -l`
+$CHECKCONF inline-bad.conf > checkconf.out$n.3 2>&1
+l=`grep "missing 'file' entry" < checkconf.out$n.3 | wc -l`
 [ $l -eq 1 ] || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -186,7 +198,8 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking named-checkconf DLZ warnings ($n)"
 ret=0
-$CHECKCONF dlz-bad.conf 2>&1 | grep "'dlz' and 'database'" > /dev/null || ret=1
+$CHECKCONF dlz-bad.conf > checkconf.out$n 2>&1
+grep "'dlz' and 'database'" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -194,14 +207,17 @@ n=`expr $n + 1`
 echo_i "checking for missing key directory warning ($n)"
 ret=0
 rm -rf test.keydir
-l=`$CHECKCONF warn-keydir.conf 2>&1 | grep "'test.keydir' does not exist" | wc -l`
+$CHECKCONF warn-keydir.conf > checkconf.out$n.1 2>&1
+l=`grep "'test.keydir' does not exist" < checkconf.out$n.1 | wc -l`
 [ $l -eq 1 ] || ret=1
 touch test.keydir
-l=`$CHECKCONF warn-keydir.conf 2>&1 | grep "'test.keydir' is not a directory" | wc -l`
+$CHECKCONF warn-keydir.conf > checkconf.out$n.2 2>&1
+l=`grep "'test.keydir' is not a directory" < checkconf.out$n.2 | wc -l`
 [ $l -eq 1 ] || ret=1
 rm -f test.keydir
 mkdir test.keydir
-l=`$CHECKCONF warn-keydir.conf 2>&1 | grep "key-directory" | wc -l`
+$CHECKCONF warn-keydir.conf > checkconf.out$n.3 2>&1
+l=`grep "key-directory" < checkconf.out$n.3 | wc -l`
 [ $l -eq 0 ] || ret=1
 rm -rf test.keydir
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -219,49 +235,49 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z catches invalid max-ttl ($n)"
 ret=0
-$CHECKCONF -z max-ttl-bad.conf > /dev/null 2>&1 && ret=1
+$CHECKCONF -z max-ttl-bad.conf > checkconf.out$n 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z skips zone check with alternate databases ($n)"
 ret=0
-$CHECKCONF -z altdb.conf > /dev/null 2>&1 || ret=1
+$CHECKCONF -z altdb.conf > checkconf.out$n 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z skips zone check with DLZ ($n)"
 ret=0
-$CHECKCONF -z altdlz.conf > /dev/null 2>&1 || ret=1
+$CHECKCONF -z altdlz.conf > checkconf.out$n 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z fails on view with ANY class ($n)"
 ret=0
-$CHECKCONF -z view-class-any1.conf > /dev/null 2>&1 && ret=1
+$CHECKCONF -z view-class-any1.conf > checkconf.out$n 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z fails on view with CLASS255 class ($n)"
 ret=0
-$CHECKCONF -z view-class-any2.conf > /dev/null 2>&1 && ret=1
+$CHECKCONF -z view-class-any2.conf > checkconf.out$n 2>&1 && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z passes on view with IN class ($n)"
 ret=0
-$CHECKCONF -z view-class-in1.conf > /dev/null 2>&1 || ret=1
+$CHECKCONF -z view-class-in1.conf > checkconf.out$n 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking that named-checkconf -z passes on view with CLASS1 class ($n)"
 ret=0
-$CHECKCONF -z view-class-in2.conf > /dev/null 2>&1 || ret=1
+$CHECKCONF -z view-class-in2.conf > checkconf.out$n 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

@@ -269,7 +285,7 @@ n=`expr $n + 1`
 echo_i "check that check-names fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-names-fail.conf > checkconf.out$n 2>&1 && ret=1
-grep "near '_underscore': bad name (check-names)" checkconf.out$n > /dev/null || ret=1
+grep "near '_underscore': bad name (check-names)" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-names/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
@@ -278,7 +294,7 @@ n=`expr $n + 1`
 echo_i "check that check-mx fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-mx-fail.conf > checkconf.out$n 2>&1 && ret=1
-grep "near '10.0.0.1': MX is an address" checkconf.out$n > /dev/null || ret=1
+grep "near '10.0.0.1': MX is an address" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
@@ -287,7 +303,7 @@ n=`expr $n + 1`
 echo_i "check that check-dup-records fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-dup-records-fail.conf > checkconf.out$n 2>&1 && ret=1
-grep "has semantically identical records" checkconf.out$n > /dev/null || ret=1
+grep "has semantically identical records" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-dup-records/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
@@ -296,7 +312,7 @@ n=`expr $n + 1`
 echo_i "check that check-mx fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-mx-fail.conf > checkconf.out$n 2>&1 && ret=1
-grep "failed: MX is an address" checkconf.out$n > /dev/null || ret=1
+grep "failed: MX is an address" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
@@ -305,7 +321,7 @@ n=`expr $n + 1`
 echo_i "check that check-mx-cname fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-mx-cname-fail.conf > checkconf.out$n 2>&1 && ret=1
-grep "MX.* is a CNAME (illegal)" checkconf.out$n > /dev/null || ret=1
+grep "MX.* is a CNAME (illegal)" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx-cname/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
@@ -314,7 +330,7 @@ n=`expr $n + 1`
 echo_i "check that check-srv-cname fails as configured ($n)"
 ret=0
 $CHECKCONF -z check-srv-cname-fail.conf > checkconf.out$n 2>&1 && ret=1
-grep "SRV.* is a CNAME (illegal)" checkconf.out$n > /dev/null || ret=1
+grep "SRV.* is a CNAME (illegal)" < checkconf.out$n > /dev/null || ret=1
 grep "zone check-mx-cname/IN: loaded serial" < checkconf.out$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
@@ -323,7 +339,7 @@ n=`expr $n + 1`
 echo_i "check that named-checkconf -p properly print a port range ($n)"
 ret=0
 $CHECKCONF -p portrange-good.conf > checkconf.out$n 2>&1 || ret=1
-grep "range 8610 8614;" checkconf.out$n > /dev/null || ret=1
+grep "range 8610 8614;" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

@@ -339,7 +355,7 @@ n=`expr $n + 1`
 echo_i "check that named-checkconf prints max-cache-size <percentage> correctly ($n)"
 ret=0
 $CHECKCONF -p max-cache-size-good.conf > checkconf.out$n 2>&1 || ret=1
-grep "max-cache-size 60%;" checkconf.out$n > /dev/null || ret=1
+grep "max-cache-size 60%;" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

@@ -350,7 +366,7 @@ $CHECKCONF -l good.conf |
 grep -v "is not implemented" |
 grep -v "no longer exists" |
 grep -v "is obsolete" > checkconf.out$n || ret=1
-diff good.zonelist checkconf.out$n  > diff.out$n || ret=1
+diff good.zonelist checkconf.out$n > diff.out$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

@@ -358,7 +374,7 @@ n=`expr $n + 1`
 echo_i "check that 'dnssec-lookaside auto;' generates a warning ($n)"
 ret=0
 $CHECKCONF warn-dlv-auto.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "dnssec-lookaside 'auto' is no longer supported" checkconf.out$n > /dev/null || ret=1
+grep "dnssec-lookaside 'auto' is no longer supported" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

@@ -366,12 +382,12 @@ n=`expr $n + 1`
 echo_i "check that 'dnssec-lookaside . trust-anchor dlv.isc.org;' generates a warning ($n)"
 ret=0
 $CHECKCONF warn-dlv-dlv.isc.org.conf > checkconf.out$n 2>/dev/null || ret=1
-grep "dlv.isc.org has been shut down" checkconf.out$n > /dev/null || ret=1
+grep "dlv.isc.org has been shut down" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo_i "check that 'dnssec-lookaside . trust-anchor dlv.example.com;' doesn't generates a warning ($n)"
+echo_i "check that 'dnssec-lookaside . trust-anchor dlv.example.com;' does not generate a warning ($n)"
 ret=0
 $CHECKCONF good-dlv-dlv.example.com.conf > checkconf.out$n 2>/dev/null || ret=1
 [ -s checkconf.out$n ] && ret=1
@@ -383,7 +399,7 @@ echo_i "check that the 2010 ICANN ROOT KSK without the 2017 ICANN ROOT KSK gener
 ret=0
 $CHECKCONF check-root-ksk-2010.conf > checkconf.out$n 2>/dev/null || ret=1
 [ -s checkconf.out$n ] || ret=1
-grep "trusted-key for root from 2010 without updated" checkconf.out$n > /dev/null || ret=1
+grep "key without the updated" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

@@ -395,18 +411,39 @@ $CHECKCONF check-root-ksk-both.conf > checkconf.out$n 2>/dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

-echo_i "check that the 2017 ICANN ROOT KSK alone does not warning ($n)"
+echo_i "check that the 2017 ICANN ROOT KSK alone does not generate a warning ($n)"
 ret=0
 $CHECKCONF check-root-ksk-2017.conf > checkconf.out$n 2>/dev/null || ret=1
 [ -s checkconf.out$n ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

+echo_i "check that a static root key generates a warning ($n)"
+ret=0
+$CHECKCONF check-root-static-key.conf > checkconf.out$n 2>/dev/null || ret=1
+grep "static-key entry for the root zone WILL FAIL" checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+status=`expr $status + $ret`
+
+echo_i "check that a trusted-keys entry for root generates a warning ($n)"
+ret=0
+$CHECKCONF check-root-trusted-key.conf > checkconf.out$n 2>/dev/null || ret=1
+grep "trusted-keys entry for the root zone WILL FAIL" checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+status=`expr $status + $ret`
+
+echo_i "check that using dnssec-keys and managed-keys generates an error ($n)"
+ret=0
+$CHECKCONF check-mixed-keys.conf > checkconf.out$n 2>/dev/null && ret=1
+grep "use of managed-keys is not allowed" checkconf.out$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
+status=`expr $status + $ret`
+
 echo_i "check that the dlv.isc.org KSK generates a warning ($n)"
 ret=0
 $CHECKCONF check-dlv-ksk-key.conf > checkconf.out$n 2>/dev/null || ret=1
 [ -s checkconf.out$n ] || ret=1
-grep "trusted-key for dlv.isc.org still present" checkconf.out$n > /dev/null || ret=1
+grep "trust anchor for dlv.isc.org is present" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

@@ -414,7 +451,7 @@ echo_i "check that 'geoip-use-ecs no' generates a warning ($n)"
 ret=0
 $CHECKCONF warn-geoip-use-ecs.conf > checkconf.out$n 2>/dev/null || ret=1
 [ -s checkconf.out$n ] || ret=1
-grep "'geoip-use-ecs' is obsolete" checkconf.out$n > /dev/null || ret=1
+grep "'geoip-use-ecs' is obsolete" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`

@@ -21,7 +21,7 @@ else
 	TESTSOCK6=false
 fi

-TESTSOCK6="$TESTSOCK6"
+export LANG=C

 . ${TOP}/version

@@ -40,7 +40,7 @@ TESTSOCK6="$TESTSOCK6"
 # SEQUENTIAL_UNIX in conf.sh.in; those that only run on windows should
 # be added to SEQUENTIAL_WINDOWS in conf.sh.win32.
 #
-SEQUENTIAL_COMMON="ecdsa eddsa @PKCS11_TEST@ tkey"
+SEQUENTIAL_COMMON="ecdsa eddsa tkey"

 #
 # These tests can use ports assigned by the caller (other than 5300
@@ -216,7 +216,7 @@ keyfile_to_keys_section() {
    for keyname in $*; do
 	awk '!/^; /{
 	    printf "\t\""$1"\" "
-	    printf "'"$key_prefix"'"
+	    printf "'"$key_prefix "'"
 	    printf $4 " " $5 " " $6 " \""
 	    for (i=7; i<=NF; i++) printf $i
 	    printf "\";\n"
@@ -225,18 +225,18 @@ keyfile_to_keys_section() {
    echo "};"
 }

-# keyfile_to_trusted_keys: convert key data contained in the keyfile(s)
-# provided to a "trusted-keys" section suitable for including in a
+# keyfile_to_static_keys: convert key data contained in the keyfile(s)
+# provided to a *static* "dnssec-keys" section suitable for including in a
 # resolver's configuration file
-keyfile_to_trusted_keys() {
-    keyfile_to_keys_section "trusted-keys" "" $*
+keyfile_to_static_keys() {
+    keyfile_to_keys_section "dnssec-keys" "static-key" $*
 }

-# keyfile_to_managed_keys: convert key data contained in the keyfile(s)
-# provided to a "managed-keys" section suitable for including in a
-# resolver's configuration file
-keyfile_to_managed_keys() {
-    keyfile_to_keys_section "managed-keys" "initial-key " $*
+# keyfile_to_initial_keys: convert key data contained in the keyfile(s)
+# provided to an *initialzing* "dnssec-keys" section suitable for including
+# in a resolver's configuration file
+keyfile_to_initial_keys() {
+    keyfile_to_keys_section "dnssec-keys" "initial-key" $*
 }

 # nextpart*() - functions for reading files incrementally
@@ -75,7 +75,7 @@ KRB5_CONFIG=/dev/null
 #
 # Construct the lists of tests to run
 #
-SEQUENTIAL_UNIX=""
+SEQUENTIAL_UNIX="@PKCS11_TEST@"
 SEQUENTIALDIRS="$SEQUENTIAL_COMMON $SEQUENTIAL_UNIX"

 PARALLEL_UNIX="@CHECKDS@ @COVERAGE@ @DNSTAP@ @KEYMGR@ logfileconfig"
@@ -112,6 +112,7 @@ PYTHON=@PYTHON@
 # Determine if we support various optional features.
 #
 HAVEXMLSTATS=@XMLSTATS@
-HAVEJSONSTATS=@JSONSTATS@
+JSON_C_LIBS="@JSON_C_LIBS@"
+HAVEJSONSTATS=${JSON_C_LIBS:+1}
 ZLIB=@ZLIB@
 NZD=@NZD_TOOLS@
@@ -32,7 +32,7 @@ $SIGNER -g -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signe

 echo_i "signed $zone"

-keyfile_to_trusted_keys $keyname2 > trusted.conf
+keyfile_to_static_keys $keyname2 > trusted.conf
 cp trusted.conf ../ns5
 cp trusted.conf ../ns7
 cp trusted.conf ../ns8
@@ -378,18 +378,18 @@ do
 	case $zone in
 	"dlv.utld")
 		$SIGNER -O full -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
-	        keyfile_to_trusted_keys $keyname2 > ../ns5/trusted-dlv.conf
+	        keyfile_to_static_keys $keyname2 > ../ns5/trusted-dlv.conf
 		;;
 	"disabled-algorithm-dlv.utld")
 		$SIGNER -O full -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
-		keyfile_to_trusted_keys $keyname2 > ../ns8/trusted-dlv-disabled.conf
+		keyfile_to_static_keys $keyname2 > ../ns8/trusted-dlv-disabled.conf
 		;;
 	"unsupported-algorithm-dlv.utld")
 		cp ${keyname2}.key ${keyname2}.tmp
 		$SIGNER -O full -o $zone -f ${outfile}.tmp $zonefile > /dev/null 2> signer.err || cat signer.err
 		awk '$4 == "DNSKEY" { $7 = 255 } $4 == "RRSIG" { $6 = 255 } { print }' ${outfile}.tmp > $outfile
 		awk '$3 == "DNSKEY" { $6 = 255 } { print }' ${keyname2}.tmp > ${keyname2}.key
-		keyfile_to_trusted_keys $keyname2 > ../ns7/trusted-dlv-unsupported.conf
+		keyfile_to_static_keys $keyname2 > ../ns7/trusted-dlv-unsupported.conf
 		;;
 	esac

@@ -37,8 +37,8 @@ cat "$infile" "$keyname.key" > "$zonefile"

 "$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1

-# Configure the resolving server with a trusted key.
-keyfile_to_trusted_keys "$keyname" > trusted.conf
+# Configure the resolving server with a staitc key.
+keyfile_to_static_keys "$keyname" > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf
@@ -46,8 +46,8 @@ cp trusted.conf ../ns6/trusted.conf
 cp trusted.conf ../ns7/trusted.conf
 cp trusted.conf ../ns9/trusted.conf

-# ...or with a managed key.
-keyfile_to_managed_keys "$keyname" > managed.conf
+# ...or with an initializing key.
+keyfile_to_initial_keys "$keyname" > managed.conf
 cp managed.conf ../ns4/managed.conf

 #
@@ -66,10 +66,10 @@ do

 	case $tld in
 	"managed")
-		keyfile_to_managed_keys $keyname1 $keyname2 $keyname3 $keyname4 $keyname5 > ../ns8/managed.conf
+		keyfile_to_initial_keys $keyname1 $keyname2 $keyname3 $keyname4 $keyname5 > ../ns8/managed.conf
 		;;
 	"trusted")
-		keyfile_to_trusted_keys $keyname1 $keyname2 $keyname3 $keyname4 $keyname5 > ../ns8/trusted.conf
+		keyfile_to_static_keys $keyname1 $keyname2 $keyname3 $keyname4 $keyname5 > ../ns8/trusted.conf
 		;;
 	esac
 done
@@ -23,7 +23,7 @@ zonefile=root.db.signed
 keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone")

 # copy the KSK out first, then revoke it
-keyfile_to_managed_keys "$keyname" > revoked.conf
+keyfile_to_initial_keys "$keyname" > revoked.conf

 "$SETTIME" -R now "${keyname}.key" > /dev/null

@@ -34,4 +34,4 @@ keyfile_to_managed_keys "$keyname" > revoked.conf

 keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone ".")

-keyfile_to_trusted_keys "$keyname" > trusted.conf
+keyfile_to_static_keys "$keyname" > trusted.conf
@@ -1774,7 +1774,7 @@ ret=0
 rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
 keyid=$(cat ns1/managed.key.id)
 cp ns4/named.secroots named.secroots.test$n
-linecount=$(grep -c "./${DEFAULT_ALGORITHM}/$keyid ; trusted" named.secroots.test$n || true)
+linecount=$(grep -c "./${DEFAULT_ALGORITHM}/$keyid ; static" named.secroots.test$n || true)
 [ "$linecount" -eq 1 ] || ret=1
 linecount=$(< named.secroots.test$n wc -l)
 [ "$linecount" -eq 10 ] || ret=1
@@ -3759,12 +3759,12 @@ status=$((status+ret))
 # lines in the logfile.
 echo_i "checking that keys with unsupported algorithms and disabled algorithms are ignored ($n)"
 ret=0
-grep -q "ignoring trusted key for 'disabled\.trusted\.': algorithm is disabled" ns8/named.run || ret=1
-grep -q "ignoring trusted key for 'unsupported\.trusted\.': algorithm is unsupported" ns8/named.run || ret=1
-grep -q "ignoring trusted key for 'revoked\.trusted\.': bad key type" ns8/named.run || ret=1
-grep -q "ignoring managed key for 'disabled\.managed\.': algorithm is disabled" ns8/named.run || ret=1
-grep -q "ignoring managed key for 'unsupported\.managed\.': algorithm is unsupported" ns8/named.run || ret=1
-grep -q "ignoring trusted key for 'revoked\.trusted\.': bad key type" ns8/named.run || ret=1
+grep -q "ignoring static-key for 'disabled\.trusted\.': algorithm is disabled" ns8/named.run || ret=1
+grep -q "ignoring static-key for 'unsupported\.trusted\.': algorithm is unsupported" ns8/named.run || ret=1
+grep -q "ignoring static-key for 'revoked\.trusted\.': bad key type" ns8/named.run || ret=1
+grep -q "ignoring initial-key for 'disabled\.managed\.': algorithm is disabled" ns8/named.run || ret=1
+grep -q "ignoring initial-key for 'unsupported\.managed\.': algorithm is unsupported" ns8/named.run || ret=1
+grep -q "ignoring initial-key for 'revoked\.managed\.': bad key type" ns8/named.run || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -28,8 +28,8 @@ cat $infile $key1.key $key2.key > $zonefile

 $SIGNER -P -g -o $zone $zonefile > /dev/null

-# Configure the resolving server with a trusted key.
-keyfile_to_trusted_keys $key2 > trusted.conf
+# Configure the resolving server with a static key.
+keyfile_to_static_keys $key2 > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf
@@ -13,7 +13,7 @@ top_srcdir =	@top_srcdir@

@BIND9_MAKE_INCLUDES@

-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =
 CWARNINGS =
@@ -78,10 +78,9 @@ dyndb_init(isc_mem_t *mctx, const char *name, const char *parameters,
 		isc_lib_register();
 		isc_log_setcontext(dctx->lctx);
 		dns_log_setcontext(dctx->lctx);
+		isc_hash_set_initializer(dctx->hashinit);
 	}

-	isc_hash_set_initializer(dctx->hashinit);
-
 	s = isc_mem_strdup(mctx, parameters);
 	if (s == NULL) {
 		result = ISC_R_NOMEMORY;
@@ -24,6 +24,6 @@ cat $infile $key1.key $key2.key > $zonefile

 $SIGNER -P -g -o $zone $zonefile > /dev/null 2> signer.err || cat signer.err

-# Configure the resolving server with a trusted key.
-keyfile_to_trusted_keys $key1 > trusted.conf
+# Configure the resolving server with a static key.
+keyfile_to_static_keys $key1 > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
@@ -25,8 +25,8 @@ cat $infile $key1.key $key2.key > $zonefile

 $SIGNER -P -g -o $zone $zonefile > /dev/null 2> signer.err || cat signer.err

-# Configure the resolving server with a trusted key.
-keyfile_to_trusted_keys $key1 > trusted.conf
+# Configure the resolving server with a static key.
+keyfile_to_static_keys $key1 > trusted.conf
 cp trusted.conf ../ns2/trusted.conf

 cd ../ns2 && $SHELL sign.sh
@@ -0,0 +1 @@
+example.com. IN DNSKEY 257 3 16 3kgROaDjrh0H2iuixWBrc8g2EpBBLCdGzHmn+G2MpTPhpj/OiBVHHSfPodx1FYYUcJKm1MDpJtIA
@@ -0,0 +1,3 @@
+Private-key-format: v1.2
+Algorithm: 16 (ED448)
+PrivateKey: xZ+5Cgm463xugtkY5B0Jx6erFTXp13rYegst0qRtNsOYnaVpMx0Z/c5EiA9x8wWbDDct/U3FhYWA
@@ -0,0 +1 @@
+example.com. IN DNSKEY 257 3 16 kkreGWoccSDmUBGAe7+zsbG6ZAFQp+syPmYUurBRQc3tDjeMCJcVMRDmgcNLp5HlHAMy12VoISsA
@@ -0,0 +1,3 @@
+Private-key-format: v1.2
+Algorithm: 16 (ED448)
+PrivateKey: WEykD3ht3MHkU8iH4uVOLz8JLwtRBSqiBoM6fF72+Mrp/u5gjxuB1DV6NnPO2BlZdz4hdSTkOdOA
@@ -21,3 +21,5 @@ ns.example.com.		A	10.53.0.3
 ;
 $INCLUDE Kexample.com.+015+03613.key
 $INCLUDE Kexample.com.+015+35217.key
+$INCLUDE Kexample.com.+016+09713.key
+$INCLUDE Kexample.com.+016+38353.key
@@ -18,7 +18,9 @@ starttime=20150729220000
 endtime=20150819220000

 for i in Xexample.com.+015+03613.key Xexample.com.+015+03613.private \
-	 Xexample.com.+015+35217.key Xexample.com.+015+35217.private
+	 Xexample.com.+015+35217.key Xexample.com.+015+35217.private \
+	 Xexample.com.+016+09713.key Xexample.com.+016+09713.private \
+	 Xexample.com.+016+38353.key Xexample.com.+016+38353.private
 do
 	cp $i `echo $i | sed s/X/K/`
 done
@@ -13,7 +13,7 @@ SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

 status=0
-n=0
+n=1

 rm -f dig.out.*

@@ -33,7 +33,7 @@ status=`expr $status + $ret`

 # Check test vectors (RFC 8080 + errata)

-echo "I:checking that test vectors match ($n)"
+echo "I:checking that Ed25519 test vectors match ($n)"
 ret=0
 grep 'oL9krJun7xfBOIWcGHi7mag5/hdZrKWw15jP' ns2/example.com.db.signed > /dev/null || ret=1
 grep 'VrbpMngwcrqNAg==' ns2/example.com.db.signed > /dev/null || ret=1
@@ -43,5 +43,23 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+echo "I:checking that Ed448 test vectors match ($n)"
+ret=0
+grep '3cPAHkmlnxcDHMyg7vFC34l0blBhuG1qpwLm' ns2/example.com.db.signed > /dev/null || ret=1
+grep 'jInI8w1CMB29FkEAIJUA0amxWndkmnBZ6SKi' ns2/example.com.db.signed > /dev/null || ret=1
+grep 'wZSAxGILn/NBtOXft0+Gj7FSvOKxE/07+4RQ' ns2/example.com.db.signed > /dev/null || ret=1
+grep 'vE581N3Aj/JtIyaiYVdnYtyMWbSNyGEY2213' ns2/example.com.db.signed > /dev/null || ret=1
+grep 'WKsJlwEA' ns2/example.com.db.signed > /dev/null || ret=1
+
+grep 'E1/oLjSGIbmLny/4fcgM1z4oL6aqo+izT3ur' ns2/example.com.db.signed > /dev/null || ret=1
+grep 'CyHyvEp4Sp8Syg1eI+lJ57CSnZqjJP41O/9l' ns2/example.com.db.signed > /dev/null || ret=1
+grep '4m0AsQ4f7qI1gVnML8vWWiyW2KXhT9kuAICU' ns2/example.com.db.signed > /dev/null || ret=1
+grep 'Sxv5OWbf81Rq7Yu60npabODB0QFPb/rkW3kU' ns2/example.com.db.signed > /dev/null || ret=1
+grep 'ZmQ0YQUA' ns2/example.com.db.signed > /dev/null || ret=1
+
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -26,7 +26,7 @@ $KEYGEN -f KSK -a $DEFAULT_ALGORITHM $zone 2>&1 > keygen.out | cat_i
 keyname=`cat keygen.out`
 rm -f keygen.out

-keyfile_to_trusted_keys $keyname > trusted.conf
+keyfile_to_static_keys $keyname > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns5/trusted.conf
@@ -487,7 +487,7 @@ dlv			DLV	30795 1 1 (

 ; type 65280-65534 (private use)

-; keydata (internal type used for managed-keys)
+; keydata (internal type used for managed keys)
 keydata			TYPE65533	\# 0
 keydata			TYPE65533	\# 6 010203040506 
 keydata			TYPE65533	\# 18 010203040506010203040506010203040506
@@ -92,13 +92,7 @@ case "$1" in
 				[ "$ipv6" ] && ifconfig lo0 inet6 \
 					fd92:7065:b8e:${ipv6}ff::$ns alias
 				;;
-			    *-unknown-netbsd*)
-				ifconfig lo0 10.53.$i.$ns alias \
-					netmask 255.255.255.0
-				[ "$ipv6" ] && ifconfig lo0 inet6 \
-					fd92:7065:b8e:${ipv6}ff::$ns alias
-				;;
-			    *-unknown-openbsd*)
+			    *-unknown-dragonfly*|*-unknown-netbsd*|*-unknown-openbsd*)
 				ifconfig lo0 10.53.$i.$ns alias \
 					netmask 255.255.255.0
 				[ "$ipv6" ] && ifconfig lo0 inet6 \
@@ -20,5 +20,5 @@ keyname=`$KEYGEN -q -a RSASHA1 -b 1024 -n zone -f KSK $zone`
 $SIGNER -S -x -T 1200 -o ${zone} root.db > signer.out 2>&1
 [ $? = 0 ] || cat signer.out

-keyfile_to_trusted_keys $keyname > trusted.conf
+keyfile_to_static_keys $keyname > trusted.conf
 cp trusted.conf ../ns6/trusted.conf
@@ -1,3 +1,3 @@
-trusted-keys {
-    "edns512-notcp." 257 3 10 "AwEAAcEBkn/cuVhdRTWMHt19O7h9F4Hx2t68u1JUZg7swLLvwfljqnNYjsKYk9EzUhIaYOAHtVe7//cYwoVU4BFhY2DGbx1YE1LnKIGxfqpopFxDZC34TTl6jpoTP6kvj+XpeO0HfF2+DcyNgnQcMGgHXyLWeRUJFt1As6o9tmsBiInGIZMTE3/rANhtAGMLNzhRLN7CS/Tc5GhKaL66uebyEYenEOAyDVgsuhr8Q9D5ka6xZmxzXFVswy2KvsSxu9aoxVq4nACjIeTZ4GJy0v83zclV7hA+5jlPDXMFtIpvwux5XALrNkUUPq+Fb5sc5/u141LcvdASnlk58I77HbsnfausvDxdYYxEns7K9e9N85dwyreM/OGTmm8p4hNDngZESAea7MrSCsJpOGn9XLkVe6gZnBgB1cra+ezzTSWn+4QH17lIhFXYNjMV83df2h/gH3Gmthqnr9RgknZga8B/Czc7TeX6iy2gAOshKGyb6w12eJim1L8tS5T138V8d6SigzxZz1raiJNolVhXyA8SbbDpgBrcoEXN/WjwvWI+2ol5gzlqMeNw/F9SMoWdpGIWkkNCNWBbhLWhp6qfhpRLUFwVys54LGOIGSVRd9uJmc2hPdXoP8ephnCIeNJb8Zp6DnpssyN0JaF815dKkOHff9GEjaiRLj0xWvtZSqNFaGoB";
+dnssec-keys {
+    "edns512-notcp." static-key 257 3 10 "AwEAAcEBkn/cuVhdRTWMHt19O7h9F4Hx2t68u1JUZg7swLLvwfljqnNYjsKYk9EzUhIaYOAHtVe7//cYwoVU4BFhY2DGbx1YE1LnKIGxfqpopFxDZC34TTl6jpoTP6kvj+XpeO0HfF2+DcyNgnQcMGgHXyLWeRUJFt1As6o9tmsBiInGIZMTE3/rANhtAGMLNzhRLN7CS/Tc5GhKaL66uebyEYenEOAyDVgsuhr8Q9D5ka6xZmxzXFVswy2KvsSxu9aoxVq4nACjIeTZ4GJy0v83zclV7hA+5jlPDXMFtIpvwux5XALrNkUUPq+Fb5sc5/u141LcvdASnlk58I77HbsnfausvDxdYYxEns7K9e9N85dwyreM/OGTmm8p4hNDngZESAea7MrSCsJpOGn9XLkVe6gZnBgB1cra+ezzTSWn+4QH17lIhFXYNjMV83df2h/gH3Gmthqnr9RgknZga8B/Czc7TeX6iy2gAOshKGyb6w12eJim1L8tS5T138V8d6SigzxZz1raiJNolVhXyA8SbbDpgBrcoEXN/WjwvWI+2ol5gzlqMeNw/F9SMoWdpGIWkkNCNWBbhLWhp6qfhpRLUFwVys54LGOIGSVRd9uJmc2hPdXoP8ephnCIeNJb8Zp6DnpssyN0JaF815dKkOHff9GEjaiRLj0xWvtZSqNFaGoB";
 };
@@ -10,15 +10,3 @@
@	60	SOA	ns marka.isc.org. 1 0 0 0 0
@	60	NS	ns
 ns	60	A	10.53.0.6
-txt500	60 	TXT	( "01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789" )
@@ -10,15 +10,3 @@
@	60	SOA	ns marka.isc.org. 1 0 0 0 0
@	60	NS	ns
 ns	60	A	10.53.0.7
-txt500	60 	TXT	( "01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789"
-			"01234567890123456789012345678901234567890123456789" )
@@ -28,5 +28,5 @@ cat $infile $keyname1.key $keyname2.key >$zonefile

 $SIGNER -g -o $zone -f $outfile -e +30y $zonefile > /dev/null 2> signer.err || cat signer.err

-keyfile_to_trusted_keys $keyname2 > trusted.conf
+keyfile_to_static_keys $keyname2 > trusted.conf
 cp trusted.conf ../ns1
@@ -12,7 +12,34 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-DIGOPTS="-p ${PORT} +tries=3 +time=5"
+DIGOPTS="-p ${PORT} +tries=1 +time=2"
+
+# Check whether the SOA record for the name provided in $1 can be resolved by
+# ns1.  Return 0 if resolution succeeds as expected; return 1 otherwise.
+resolution_succeeds() {
+	_ret=0
+	$DIG $DIGOPTS +tcp +tries=3 +time=5 @10.53.0.1 ${1} SOA > dig.out.test$n || _ret=1
+	grep "status: NOERROR" dig.out.test$n > /dev/null || _ret=1
+	return $_ret
+}
+
+# Check whether the SOA record for the name provided in $1 can be resolved by
+# ns1.  Return 0 if resolution fails as expected; return 1 otherwise.  Note that
+# both a SERVFAIL response and timing out mean resolution failed, so the exit
+# code of dig does not influence the result (the exit code for a SERVFAIL
+# response is 0 while the exit code for not getting a response at all is not 0).
+resolution_fails() {
+	_servfail=0
+	_timeout=0
+	$DIG $DIGOPTS +tcp +tries=3 +time=5 @10.53.0.1 ${1} SOA > dig.out.test$n
+	grep "status: SERVFAIL" dig.out.test$n > /dev/null && _servfail=1
+	grep "connection timed out" dig.out.test$n > /dev/null && _timeout=1
+	if [ $_servfail -eq 1 ] || [ $_timeout -eq 1 ]; then
+		return 0
+	else
+		return 1
+	fi
+}

 status=0
 n=0
@@ -22,16 +49,17 @@ echo_i "checking formerr edns server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.8 ednsformerr soa > dig.out.1.test$n || ret=1
 grep "status: FORMERR" dig.out.1.test$n > /dev/null || ret=1
+grep "EDNS: version:" dig.out.1.test$n > /dev/null && ret=1
 $DIG $DIGOPTS +noedns @10.53.0.8 ednsformerr soa > dig.out.2.test$n || ret=1
 grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
+grep "EDNS: version:" dig.out.2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking recursive lookup to formerr edns server succeeds ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 ednsformerr soa > dig.out.test$n || ret=1
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+resolution_succeeds ednsformerr. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -40,16 +68,17 @@ echo_i "checking notimp edns server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.9 ednsnotimp soa > dig.out.1.test$n || ret=1
 grep "status: NOTIMP" dig.out.1.test$n > /dev/null || ret=1
+grep "EDNS: version:" dig.out.1.test$n > /dev/null && ret=1
 $DIG $DIGOPTS +noedns @10.53.0.9 ednsnotimp soa > dig.out.2.test$n || ret=1
 grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
+grep "EDNS: version:" dig.out.2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking recursive lookup to notimp edns server fails ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 ednsnotimp soa > dig.out.test$n
-grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
+resolution_fails ednsnotimp. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -58,23 +87,24 @@ echo_i "checking refused edns server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.10 ednsrefused soa > dig.out.1.test$n || ret=1
 grep "status: REFUSED" dig.out.1.test$n > /dev/null || ret=1
+grep "EDNS: version:" dig.out.1.test$n > /dev/null && ret=1
 $DIG $DIGOPTS +noedns @10.53.0.10 ednsrefused soa > dig.out.2.test$n || ret=1
 grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
+grep "EDNS: version:" dig.out.2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking recursive lookup to refused edns server fails ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 ednsrefused soa > dig.out.test$n
-grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
+resolution_fails ednsrefused. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking drop edns server setup ($n)"
 ret=0
-$DIG $DIGOPTS +edns @10.53.0.2 dropedns soa > dig.out.1.test$n
+$DIG $DIGOPTS +edns @10.53.0.2 dropedns soa > dig.out.1.test$n && ret=1
 grep "connection timed out; no servers could be reached" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +noedns @10.53.0.2 dropedns soa > dig.out.2.test$n || ret=1
 grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
@@ -82,7 +112,7 @@ grep "EDNS: version:" dig.out.2.test$n > /dev/null && ret=1
 $DIG $DIGOPTS +noedns +tcp @10.53.0.2 dropedns soa > dig.out.3.test$n || ret=1
 grep "status: NOERROR" dig.out.3.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.3.test$n > /dev/null && ret=1
-$DIG $DIGOPTS +edns +tcp @10.53.0.2 dropedns soa > dig.out.4.test$n
+$DIG $DIGOPTS +edns +tcp @10.53.0.2 dropedns soa > dig.out.4.test$n && ret=1
 grep "connection timed out; no servers could be reached" dig.out.4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -90,18 +120,17 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking recursive lookup to drop edns server fails ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 dropedns soa > dig.out.test$n
-grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
+resolution_fails dropedns. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking drop edns + no tcp server setup ($n)"
 ret=0
-$DIG $DIGOPTS +edns @10.53.0.3 dropedns-notcp soa > dig.out.1.test$n
+$DIG $DIGOPTS +edns @10.53.0.3 dropedns-notcp soa > dig.out.1.test$n && ret=1
 grep "connection timed out; no servers could be reached" dig.out.1.test$n > /dev/null || ret=1
-$DIG $DIGOPTS +noedns +tcp @10.53.0.3 dropedns-notcp soa > dig.out.2.test$n
-grep "connection timed out; no servers could be reached" dig.out.2.test$n > /dev/null
+$DIG $DIGOPTS +noedns +tcp @10.53.0.3 dropedns-notcp soa > dig.out.2.test$n && ret=1
+grep "connection refused" dig.out.2.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +noedns @10.53.0.3 dropedns-notcp soa > dig.out.3.test$n || ret=1
 grep "status: NOERROR" dig.out.3.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.3.test$n > /dev/null && ret=1
@@ -111,8 +140,7 @@ status=`expr $status + $ret`
 n=`expr $n + 1`
 echo_i "checking recursive lookup to drop edns + no tcp server fails ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 dropedns-notcp soa > dig.out.test$n
-grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
+resolution_fails dropedns-notcp. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -122,14 +150,16 @@ ret=0
 $DIG $DIGOPTS +edns @10.53.0.4 plain soa > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.1.test$n > /dev/null && ret=1
+$DIG $DIGOPTS +edns +tcp @10.53.0.4 plain soa > dig.out.2.test$n
+grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
+grep "EDNS: version:" dig.out.2.test$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking recursive lookup to plain dns server succeeds ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 plain soa > dig.out.test$n || ret=1
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+resolution_succeeds plain. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -140,15 +170,14 @@ $DIG $DIGOPTS +edns @10.53.0.5 plain-notcp soa > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
 grep "EDNS: version:" dig.out.1.test$n > /dev/null && ret=1
 $DIG $DIGOPTS +edns +tcp @10.53.0.5 plain-notcp soa > dig.out.2.test$n
-grep "connection timed out; no servers could be reached" dig.out.2.test$n > /dev/null
+grep "connection refused" dig.out.2.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking recursive lookup to plain dns + no tcp server succeeds ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 plain-notcp soa > dig.out.test$n || ret=1
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+resolution_succeeds plain-notcp. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`
@@ -157,42 +186,47 @@ echo_i "checking edns 512 server setup ($n)"
 ret=0
 $DIG $DIGOPTS +edns @10.53.0.6 edns512 soa > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
+grep "EDNS: version:" dig.out.1.test$n > /dev/null || ret=1
 $DIG $DIGOPTS +edns +tcp @10.53.0.6 edns512 soa > dig.out.2.test$n || ret=1
-grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
-$DIG $DIGOPTS +edns @10.53.0.6 txt500.edns512 txt > dig.out.3.test$n
-grep "connection timed out; no servers could be reached" dig.out.3.test$n > /dev/null
-$DIG $DIGOPTS +edns +bufsize=512 +ignor @10.53.0.6 txt500.edns512 txt > dig.out.4.test$n
+grep "status: NOERROR" dig.out.2.test$n > /dev/null || ret=1
+grep "EDNS: version:" dig.out.2.test$n > /dev/null || ret=1
+$DIG $DIGOPTS +edns +dnssec @10.53.0.6 edns512 soa > dig.out.3.test$n && ret=1
+grep "connection timed out; no servers could be reached" dig.out.3.test$n > /dev/null || ret=1
+$DIG $DIGOPTS +edns +dnssec +bufsize=512 +ignore @10.53.0.6 edns512 soa > dig.out.4.test$n || ret=1
 grep "status: NOERROR" dig.out.4.test$n > /dev/null || ret=1
+grep "EDNS: version:" dig.out.4.test$n > /dev/null || ret=1
+grep "flags:.* tc[ ;]" dig.out.4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking recursive lookup to edns 512 server succeeds ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 txt500.edns512 txt > dig.out.test$n || ret=1
-grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+resolution_succeeds edns512. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking edns 512 + no tcp server setup ($n)"
 ret=0
-$DIG $DIGOPTS +noedns @10.53.0.7 edns512-notcp soa > dig.out.1.test$n || ret=1
+$DIG $DIGOPTS +edns @10.53.0.7 edns512-notcp soa > dig.out.1.test$n || ret=1
 grep "status: NOERROR" dig.out.1.test$n > /dev/null || ret=1
-$DIG $DIGOPTS +noedns +tcp @10.53.0.7 edns512-notcp soa > dig.out.2.test$n
-grep "connection timed out; no servers could be reached" dig.out.2.test$n > /dev/null
-$DIG $DIGOPTS +edns @10.53.0.7 edns512-notcp soa > dig.out.3.test$n
-grep "connection timed out; no servers could be reached" dig.out.3.test$n > /dev/null
-$DIG $DIGOPTS +edns +bufsize=512 +ignor @10.53.0.7 edns512-notcp soa > dig.out.4.test$n
+grep "EDNS: version:" dig.out.1.test$n > /dev/null || ret=1
+$DIG $DIGOPTS +edns +tcp @10.53.0.7 edns512-notcp soa > dig.out.2.test$n && ret=1
+grep "connection refused" dig.out.2.test$n > /dev/null || ret=1
+$DIG $DIGOPTS +edns +dnssec @10.53.0.7 edns512-notcp soa > dig.out.3.test$n && ret=1
+grep "connection timed out; no servers could be reached" dig.out.3.test$n > /dev/null || ret=1
+$DIG $DIGOPTS +edns +dnssec +bufsize=512 +ignore @10.53.0.7 edns512-notcp soa > dig.out.4.test$n || ret=1
 grep "status: NOERROR" dig.out.4.test$n > /dev/null || ret=1
+grep "EDNS: version:" dig.out.4.test$n > /dev/null || ret=1
+grep "flags:.* tc[ ;]" dig.out.4.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
 echo_i "checking recursive lookup to edns 512 + no tcp server fails ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 edns512-notcp soa > dig.out.test$n || ret=1
-grep "status: NOERROR" dig.out.test$n > /dev/null && ret=1
+resolution_fails edns512-notcp. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -203,9 +237,7 @@ $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} legacy ns1
 n=`expr $n + 1`
 echo_i "checking recursive lookup to edns 512 + no tcp + trust anchor fails ($n)"
 ret=0
-$DIG $DIGOPTS +tcp @10.53.0.1 edns512-notcp soa > dig.out.test$n
-grep "status: SERVFAIL" dig.out.test$n > /dev/null ||
-    grep "connection timed out;" dig.out.test$n > /dev/null || ret=1
+resolution_fails edns512-notcp. || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -33,4 +33,4 @@ $SIGNER -P -g -o $zone $zonefile > /dev/null
 # irrelevant here, so just reuse the root zone key generated above.
 sed "s/^\./nonexistent./;" $keyname1.key > $keyname1.modified.key

-keyfile_to_trusted_keys $keyname1 $keyname1.modified > trusted.conf
+keyfile_to_static_keys $keyname1 $keyname1.modified > trusted.conf
@@ -75,4 +75,4 @@ for variant in addzone axfr ixfr load reconfig untrusted; do
 	fi
 done

-keyfile_to_trusted_keys $keys_to_trust > trusted-mirror.conf
+keyfile_to_static_keys $keys_to_trust > trusted-mirror.conf
@@ -2,17 +2,16 @@ Copyright (C) Internet Systems Consortium, Inc. ("ISC")

 See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.

-This is for testing managed-keys, in particular with problems
-with RFC 5011 Automated Updates of DNSSEC Trust Anchors.
+This is for testing RFC 5011 Automated Updates of DNSSEC Trust Anchors.

 ns1 is the root server that offers new KSKs and hosts one record for
 testing. The TTL for the zone's records is 2 seconds.

-ns2 is a validator that uses managed-keys.  "-T mkeytimers=2/20/40"
+ns2 is a validator that uses managed keys.  "-T mkeytimers=2/20/40"
 is used so it will attempt do automated updates frequently. "-T tat=1"
 is used so it will send TAT queries once per second.

-ns3 is a validator with a broken key in managed-keys.
+ns3 is a validator with a broken initializing key in dnssec-keys.

 ns4 is a validator with a deliberately broken managed-keys.bind and
 managed-keys.jnl, causing RFC 5011 initialization to fail.
@@ -20,14 +20,14 @@ zskkeyname=`$KEYGEN -a rsasha256 -q $zone`

 $SIGNER -Sg -o $zone $zonefile > /dev/null 2>/dev/null

-# Configure the resolving server with a managed trusted key.
-keyfile_to_managed_keys $keyname > managed.conf
+# Configure the resolving server with an initializing key.
+keyfile_to_initial_keys $keyname > managed.conf
 cp managed.conf ../ns2/managed.conf
 cp managed.conf ../ns4/managed.conf
 cp managed.conf ../ns5/managed.conf

-# Configure a trusted key statement (used by delv).
-keyfile_to_trusted_keys $keyname > trusted.conf
+# Configure a static key to be used by delv.
+keyfile_to_static_keys $keyname > trusted.conf

 # Prepare an unsupported algorithm key.
 unsupportedkey=Kunknown.+255+00000
@@ -41,6 +41,6 @@ zone "." {
 };

 # purposely broken key for testing
-managed-keys {
+dnssec-keys {
    "." initial-key 257 3 5 "PURPOSELYBROKEN/xs9iVj7QekClcpzjCf0JrvXW1z07hNMqMm6Q2FtIXMbRgfvTtHF3/ZNvcewT9hpfczC+JACHsQSYYdr7UI8oe4nJfal9+2F3pz4a+HR6CqkgrR6WLWQI1Q==";
 };
@@ -26,5 +26,5 @@ cp unsupported-managed.key "${unsupportedkey}.key"
 rootkey=`cat ../ns1/managed.key`
 cp "../ns1/${rootkey}.key" .

-# Configure the resolving server with a managed trusted key.
-keyfile_to_managed_keys $unsupportedkey $rsakey $rootkey > managed.conf
+# Configure the resolving server with an initializing key.
+keyfile_to_initial_keys $unsupportedkey $rsakey $rootkey > managed.conf
@@ -301,7 +301,7 @@ status=`expr $status + $ret`
 echo_i "reinitialize trust anchors, add second key to bind.keys"
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} mkeys ns2
 rm -f ns2/managed-keys.bind*
-keyfile_to_managed_keys ns1/$original ns1/$standby1 > ns2/managed.conf
+keyfile_to_initial_keys ns1/$original ns1/$standby1 > ns2/managed.conf
 nextpart ns2/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mkeys ns2

@@ -763,7 +763,7 @@ rm -f ns6/managed-keys.bind*
 nextpart ns6/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mkeys ns6
 # log when an unsupported algorithm is encountered during startup
-wait_for_log "ignoring managed key for 'unsupported\.': algorithm is unsupported" ns6/named.run
+wait_for_log "ignoring initial-key for 'unsupported\.': algorithm is unsupported" ns6/named.run
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -230,6 +230,8 @@ do
 done
 grep "test string" dig.out.b.ns5.test$n > /dev/null || ret=1
 grep "test string" dig.out.c.ns5.test$n > /dev/null || ret=1
+grep "sending notify to 10.53.0.5#[0-9]* : TSIG (b)" ns5/named.run > /dev/null || ret=1
+grep "sending notify to 10.53.0.5#[0-9]* : TSIG (c)" ns5/named.run > /dev/null || ret=1

 [ $ret = 0 ] || echo_i "failed"
 status=`expr $ret + $status`
@@ -27,8 +27,8 @@ cat $infile $keyname1.key $keyname2.key > $zonefile

 $SIGNER -g -o $zone $zonefile > /dev/null 2>&1

-# Configure the resolving server with a trusted key.
-keyfile_to_trusted_keys $keyname2 > trusted.conf
+# Configure the resolving server with a static key.
+keyfile_to_static_keys $keyname2 > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf
@@ -15,7 +15,7 @@ VERSION=@BIND9_VERSION@

@BIND9_MAKE_INCLUDES@

-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =
 CWARNINGS =
@@ -28,7 +28,7 @@ ISCDEPLIBS =	../../../../lib/isc/libisc.@A@

 DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}

-LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+LIBS =		${DNSLIBS} ${ISCLIBS} @JSON_C_LIBS@ @LIBS@

 TARGETS =	pipequeries@EXEEXT@

@@ -98,7 +98,7 @@ def create_response(msg):
            r.set_rcode(NXDOMAIN)
        if ugly:
            r.set_rcode(FORMERR)
-    elif "zoop.boing.".endswith(lqname):
+    elif lqname.endswith("zoop.boing."):
        r.authority.append(dns.rrset.from_text("zoop.boing." + suffix, 1, IN, SOA, "ns3." + suffix + " hostmaster.arpa. 2018050100 1 1 1 1"))
        r.set_rcode(NXDOMAIN)
    else:
@@ -109,7 +109,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 n=`expr $n + 1`
-echo_i "query for .good is properly minimized when qname-minimization is on ($n)"
+echo_i "query for .good is properly minimized when qname-minimization is in strict mode ($n)"
 ret=0
 $CLEANQL
 $RNDCCMD 10.53.0.6 flush
@@ -142,6 +142,37 @@ for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo_i "query for .good is properly minimized when qname-minimization is in relaxed mode ($n)"
+ret=0
+$CLEANQL
+$RNDCCMD 10.53.0.7 flush
+$DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.good. @10.53.0.7 > dig.out.test$n
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+grep "icky.icky.icky.ptang.zoop.boing.good. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
+sleep 1
+sort ans2/query.log > ans2/query.log.sorted
+cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+ADDR _.boing.good.
+ADDR _.zoop.boing.good.
+ADDR a.bit.longer.ns.name.good.
+ADDR a.bit.longer.ns.name.good.
+ADDR ns2.good.
+ADDR ns3.good.
+ADDR ns3.good.
+__EOF
+cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
+ADDR _.ptang.zoop.boing.good.
+ADDR _.icky.ptang.zoop.boing.good.
+__EOF
+cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
+ADDR _.icky.icky.ptang.zoop.boing.good.
+ADDR icky.icky.icky.ptang.zoop.boing.good.
+__EOF
+for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "query for .bad fails when qname-minimization is in strict mode ($n)"
 ret=0
@@ -171,17 +202,22 @@ grep "icky.icky.icky.ptang.zoop.boing.bad. 1 IN A	192.0.2.1" dig.out.test$n > /d
 sleep 1
 sort ans2/query.log > ans2/query.log.sorted
 cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+ADDR _.boing.bad.
+ADDR _.zoop.boing.bad.
 ADDR a.bit.longer.ns.name.bad.
 ADDR a.bit.longer.ns.name.bad.
-ADDR icky.icky.icky.ptang.zoop.boing.bad.
 ADDR ns2.bad.
 ADDR ns3.bad.
 ADDR ns3.bad.
-NS bad.
-NS boing.bad.
 __EOF
-echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | $DIFF ans3/query.log - > /dev/null || ret=1
-echo "ADDR icky.icky.icky.ptang.zoop.boing.bad." | $DIFF ans4/query.log - > /dev/null || ret=1
+cat << __EOF | $DIFF ans3/query.log - > /dev/null || ret=1
+ADDR _.ptang.zoop.boing.bad.
+ADDR _.icky.ptang.zoop.boing.bad.
+__EOF
+cat << __EOF | $DIFF ans4/query.log - > /dev/null || ret=1
+ADDR _.icky.icky.ptang.zoop.boing.bad.
+ADDR icky.icky.icky.ptang.zoop.boing.bad.
+__EOF
 for ans in ans2 ans3 ans4; do mv -f $ans/query.log query-$ans-$n.log 2>/dev/null || true; done
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -215,17 +251,17 @@ $DIG $DIGOPTS icky.icky.icky.ptang.zoop.boing.ugly. @10.53.0.7 > dig.out.test$n
 grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
 grep "icky.icky.icky.ptang.zoop.boing.ugly. 1	IN A	192.0.2.1" dig.out.test$n > /dev/null || ret=1
 sleep 1
+
 sort ans2/query.log > ans2/query.log.sorted
-cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || ret=1
+cat << __EOF | $DIFF ans2/query.log.sorted - > /dev/null || cat ans2/query.log.sorted
+ADDR _.boing.ugly.
+ADDR _.boing.ugly.
 ADDR a.bit.longer.ns.name.ugly.
 ADDR a.bit.longer.ns.name.ugly.
 ADDR icky.icky.icky.ptang.zoop.boing.ugly.
 ADDR ns2.ugly.
 ADDR ns3.ugly.
 ADDR ns3.ugly.
-NS boing.ugly.
-NS boing.ugly.
-NS ugly.
 __EOF
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans3/query.log - > /dev/null || ret=1
 echo "ADDR icky.icky.icky.ptang.zoop.boing.ugly." | $DIFF ans4/query.log - > /dev/null || ret=1
@@ -30,5 +30,5 @@ zsk=`$KEYGEN -q -a rsasha256 $zone`
 cat $ksk.key $zsk.key dsset-ds.example.net$TP >> $zonefile
 $SIGNER -P -o $zone $zonefile > /dev/null 2>&1

-# Configure a trusted key statement (used by delv)
-keyfile_to_trusted_keys $ksk > ../ns5/trusted.conf
+# Configure a static key to be used by delv
+keyfile_to_static_keys $ksk > ../ns5/trusted.conf
@@ -27,8 +27,8 @@ cat $infile $keyname.key > $zonefile

 $SIGNER -P -g -o $zone $zonefile > /dev/null

-# Configure the resolving server with a trusted key.
-keyfile_to_trusted_keys $keyname > trusted.conf
+# Configure the resolving server with a static key.
+keyfile_to_static_keys $keyname > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf
@@ -81,7 +81,7 @@ signzone () {
    KEYNAME=`$KEYGEN -q -a rsasha256 -K $1 $2`
    cat $1/$3 $1/$KEYNAME.key > $1/tmp
    $SIGNER -P -K $1 -o $2 -f $1/$4 $1/tmp >/dev/null
-    sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/trusted-keys {"\1" \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf
+    sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/dnssec-keys {"\1" static-key \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf
    DSFILENAME=dsset-${2}${TP}
    rm $DSFILENAME $1/tmp
 }
@@ -15,7 +15,7 @@ VERSION=@BIND9_VERSION@

@BIND9_MAKE_INCLUDES@

-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =
 CWARNINGS =
@@ -28,7 +28,7 @@ ISCDEPLIBS =	../../../../lib/isc/libisc.@A@

 DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}

-LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+LIBS =		${DNSLIBS} ${ISCLIBS} @JSON_C_LIBS@ @LIBS@

 TARGETS =	bigkey@EXEEXT@

@@ -24,8 +24,8 @@ cat $infile $keyname.key > $zonefile

 $SIGNER -P -g -o $zone $zonefile > /dev/null

-# Configure the resolving server with a trusted key.
-keyfile_to_trusted_keys $keyname > trusted.conf
+# Configure the resolving server with a static key.
+keyfile_to_static_keys $keyname > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf

@@ -28,9 +28,9 @@ cat "$infile" "$keyname.key" > "$zonefile"

 $SIGNER -P -g -o $zone $zonefile > /dev/null

-# Configure the resolving server with a trusted key.
-keyfile_to_trusted_keys "$keyname" > trusted.conf
+# Configure the resolving server with a static key.
+keyfile_to_static_keys "$keyname" > trusted.conf
 cp trusted.conf ../ns2/trusted.conf

-# ...or with a managed key.
-keyfile_to_managed_keys "$keyname" > managed.conf
+# ...or with an initializing key.
+keyfile_to_initial_keys "$keyname" > managed.conf
@@ -16,4 +16,4 @@ set -e

 keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone ".")

-keyfile_to_trusted_keys "$keyname" > trusted.conf
+keyfile_to_static_keys "$keyname" > trusted.conf
@@ -343,8 +343,8 @@ status=`expr $status + $ret`

 echo_i "checking sync record publication"
 ret=0
-grep -w CDNSKEY $cfile.signed > /dev/null || ret=1
-grep -w CDS $cfile.signed > /dev/null || ret=1
+awk 'BEGIN { r=1 } $2 == "CDNSKEY" { r=0 } END { exit r }' $cfile.signed || ret=1
+awk 'BEGIN { r=1 } $2 == "CDS" { r=0 } END { exit r }' $cfile.signed || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -353,8 +353,8 @@ ret=0
 $SETTIME -P now -A now -Dsync now ${cksk5} > /dev/null
 $SIGNER -Sg -o $czone -f $cfile.new $cfile.signed > /dev/null 2>&1
 mv $cfile.new $cfile.signed
-grep -w CDNSKEY $cfile.signed > /dev/null && ret=1
-grep -w CDS $cfile.signed > /dev/null && ret=1
+awk 'BEGIN { r=1 } $2 == "CDNSKEY" { r=0 } END { exit r }' $cfile.signed && ret=1
+awk 'BEGIN { r=1 } $2 == "CDS" { r=0 } END { exit r }' $cfile.signed && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -27,7 +27,7 @@ cat $infile $keyname1.key $keyname2.key > $zonefile
 $SIGNER -g -o $zone $zonefile > /dev/null 2>&1

 # Configure the resolving server with a trusted key.
-keyfile_to_trusted_keys $keyname2 > trusted.conf
+keyfile_to_static_keys $keyname2 > trusted.conf

 zone=undelegated
 infile=undelegated.db.in
@@ -38,5 +38,5 @@ cat $infile $keyname1.key $keyname2.key > $zonefile

 $SIGNER -g -o $zone $zonefile > /dev/null 2>&1

-keyfile_to_trusted_keys $keyname2 >> trusted.conf
+keyfile_to_static_keys $keyname2 >> trusted.conf
 cp trusted.conf ../ns2/trusted.conf
@@ -39,5 +39,5 @@ cat "$infile" "$keyname.key" > "$zonefile"

 $SIGNER -P -g -o $zone $zonefile > /dev/null 2>&1

-# Configure the resolving server with a trusted key.
-keyfile_to_trusted_keys "$keyname" > trusted.conf
+# Configure the resolving server with a static key.
+keyfile_to_static_keys "$keyname" > trusted.conf
@@ -15,7 +15,7 @@ VERSION=@BIND9_VERSION@

@BIND9_MAKE_INCLUDES@

-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =
 CWARNINGS =
@@ -28,7 +28,7 @@ ISCDEPLIBS =	../../../../lib/isc/libisc.@A@

 DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}

-LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
+LIBS =		${DNSLIBS} ${ISCLIBS} @JSON_C_LIBS@ @LIBS@

 TARGETS =	keycreate@EXEEXT@ keydelete@EXEEXT@

@@ -57,7 +57,7 @@ cat $infile $keyname1.key $keyname2.key > $zonefile
 $SIGNER -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo_i "signed $zone"

-keyfile_to_trusted_keys $keyname2 > private.nsec.conf
+keyfile_to_static_keys $keyname2 > private.nsec.conf

 zone=nsec3
 infile=nsec3.db.in
@@ -86,7 +86,7 @@ cat $infile $keyname1.key $keyname2.key > $zonefile
 $SIGNER -3 - -H 10 -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo_i "signed $zone"

-keyfile_to_trusted_keys $keyname2 > private.nsec3.conf
+keyfile_to_static_keys $keyname2 > private.nsec3.conf

 zone=.
 infile=root.db.in
@@ -101,4 +101,4 @@ cat $infile $keyname1.key $keyname2.key $dssets >$zonefile
 $SIGNER -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo_i "signed $zone"

-keyfile_to_trusted_keys $keyname2 > trusted.conf
+keyfile_to_static_keys $keyname2 > trusted.conf
@@ -16,7 +16,7 @@ VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@

 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
-		${BIND9_INCLUDES} @OPENSSL_INCLUDES@
+		${BIND9_INCLUDES} @OPENSSL_INCLUDES@ @JSON_C_CFLAGS@

 CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =
@@ -32,8 +32,8 @@ BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 ISCCFGDEPLIBS = ../../lib/isccfg/libisccfg.@A@

-LIBS =		${ISCLIBS} @LIBS@
-NOSYMLIBS =	${ISCNOSYMLIBS} @LIBS@
+LIBS =		${ISCLIBS} @JSON_C_LIBS@ @LIBS@
+NOSYMLIBS =	${ISCNOSYMLIBS} @JSON_C_LIBS@ @LIBS@

 SUBDIRS =

--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`example.com. IN DNSKEY 257 3 16 3kgROaDjrh0H2iuixWBrc8g2EpBBLCdGzHmn+G2MpTPhpj/OiBVHHSfPodx1FYYUcJKm1MDpJtIA`
				`@@ -0,0 +1 @@`
				`example.com. IN DNSKEY 257 3 16 kkreGWoccSDmUBGAe7+zsbG6ZAFQp+syPmYUurBRQc3tDjeMCJcVMRDmgcNLp5HlHAMy12VoISsA`