Experiments

Tiny small improvements to system test scripts.

See merge request isc-projects/bind9!1166

CHANGES

@@ -1,3 +1,18 @@
+5104.	[cleanup]	Log clearer informational message when a catz zone
+			is overridden by a zone in named.conf.
+			Thanks to Tony Finch. [GL !1157]
+
+5103.	[bug]		Add missing design by contract tests to dns_catz*.
+			[GL #748]
+
+5102.	[bug]		dnssec-coverage failed to use the default TTL when
+			checking KSK deletion times leading to a exception.
+			[GL #585]
+
+5101.	[bug]		Fix default installation path for Python modules and
+			remove the dnspython dependency accidentally introduced
+			by change 4970. [GL #730]
+
 5100.	[func]		Pin resolver tasks to specific task queues. [GL !1117]
 
 5099.	[func]		Failed mutex and conditional creations are always

bin/named/server.c

@@ -2551,7 +2551,15 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 		}
 
 	} else {
-		if (result != ISC_R_NOTFOUND && result != DNS_R_PARTIALMATCH) {
+		if (result == ISC_R_SUCCESS) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "catz: zone \"%s\" is overridden "
+				      "by explicitly configured zone",
+				      nameb);
+			goto cleanup;
+		} else if (result != ISC_R_NOTFOUND &&
+			   result != DNS_R_PARTIALMATCH) {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 				      "catz: error \"%s\" while trying to "

bin/python/isc/dnskey.py.in

@@ -452,6 +452,10 @@ class dnskey:
         if timespan is None:
             timespan = self.ttl
 
+        if timespan is None:
+            output("WARNING: Key %s using default TTL." % repr(self))
+            timespan = (60*60*24)
+
         now = time.time()
         d = self.delete()
         i = self.inactive()

bin/tests/system/conf.sh.in

@@ -22,6 +22,11 @@ DEFAULT_ALGORITHM=ECDSAP256SHA256
 DEFAULT_ALGORITHM_NUMBER=13
 DEFAULT_BITS=256
 
+# must be different from DEFAULT_ALGORITHM
+ALTERNATIVE_ALGORITHM=RSASHA256
+ALTERNATIVE_ALGORITHM_NUMBER=8
+ALTERNATIVE_BITS=1280
+
 ARPANAME=$TOP/bin/tools/arpaname
 CDS=$TOP/bin/dnssec/dnssec-cds
 CHECKCONF=$TOP/bin/check/named-checkconf
@@ -397,6 +402,9 @@ copy_setports() {
 	-e "s/@DEFAULT_ALGORITHM@/${DEFAULT_ALGORITHM}/g" \
 	-e "s/@DEFAULT_ALGORITHM_NUMBER@/${DEFAULT_ALGORITHM_NUMBER}/g" \
 	-e "s/@DEFAULT_BITS@/${DEFAULT_BITS}/g" \
+	-e "s/@ALTERNATIVE_ALGORITHM@/${ALTERNATIVE_ALGORITHM}/g" \
+	-e "s/@ALTERNATIVE_ALGORITHM_NUMBER@/${ALTERNATIVE_ALGORITHM_NUMBER}/g" \
+	-e "s/@ALTERNATIVE_BITS@/${ALTERNATIVE_BITS}/g" \
 	$1 > $2
 }
 

bin/tests/system/conf.sh.win32

@@ -370,6 +370,9 @@ copy_setports() {
 	-e "s/${atsign}DEFAULT_ALGORITM${atsign}/${DEFAULT_ALGORITHM}/g" \
 	-e "s/${atsign}DEFAULT_ALGORITHM_NUMBER${atsign}/${DEFAULT_ALGORITHM_NUMBER}/g" \
 	-e "s/${atsign}DEFAULT_BITS${atsign}/${DEFAULT_BITS}/g" \
+	-e "s/${atsign}ALTERNATIVE_ALGORITM${atsign}/${ALTERNATIVE_ALGORITHM}/g" \
+	-e "s/${atsign}ALTERNATIVE_ALGORITHM_NUMBER${atsign}/${ALTERNATIVE_ALGORITHM_NUMBER}/g" \
+	-e "s/${atsign}ALTERNATIVE_BITS${atsign}/${ALTERNATIVE_BITS}/g" \
 	$1 > $2
 }
 

bin/tests/system/coverage/12-ksk-deletion/expect

@@ -0,0 +1,6 @@
+args=
+warn=4
+error=1
+ok=1
+retcode=1
+match=0

bin/tests/system/coverage/setup.sh

@@ -127,3 +127,8 @@ $SETTIME -K $dir -I +18mo -D +2y $zsk1 > /dev/null 2>&1
 zsk2=`$KEYGEN -K $dir -S $zsk1`
 $SETTIME -K $dir -I +16mo $zsk1 > /dev/null 2>&1
 ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
+
+# Test 12: Too early KSK deletion
+dir=12-ksk-deletion
+ksk1=`$KEYGEN -K $dir -f KSK -a 8 -b 2048 -I +40d -D +40d example.com`
+ksk2=`$KEYGEN -K $dir -S $ksk1.key example.com`

bin/tests/system/coverage/tests.sh

@@ -70,6 +70,12 @@ for dir in [0-9][0-9]-*; do
             ret=1
         fi
 
+        found=`grep Traceback coverage.$n | wc -l`
+        if [ $found -ne 0 ]; then
+            echo "python exception detected"
+            ret=1
+        fi
+
         n=`expr $n + 1`
         if [ $ret != 0 ]; then echo_i "failed"; fi
         status=`expr $status + $ret`

bin/tests/system/run.sh

@@ -13,9 +13,11 @@
 # Run a system test.
 #
 
-SYSTEMTESTTOP=.
+SYSTEMTESTTOP=$(realpath .)
 . $SYSTEMTESTTOP/conf.sh
 
+export SYSTEMTESTTOP
+
 stopservers=true
 baseport=5300
 
@@ -45,7 +47,7 @@ if [ $# -eq 0 ]; then
     exit 1
 fi
 
-systest=$1
+systest=${1%%/}
 shift
 
 if [ ! -d $systest ]; then

configure

@@ -842,6 +842,7 @@ infodir
 docdir
 oldincludedir
 includedir
+runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -1001,6 +1002,7 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
+runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1253,6 +1255,15 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
+  -runstatedir | --runstatedir | --runstatedi | --runstated \
+  | --runstate | --runstat | --runsta | --runst | --runs \
+  | --run | --ru | --r)
+    ac_prev=runstatedir ;;
+  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
+  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
+  | --run=* | --ru=* | --r=*)
+    runstatedir=$ac_optarg ;;
+
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1390,7 +1401,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir
+		libdir localedir mandir runstatedir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1543,6 +1554,7 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
+  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -1628,7 +1640,7 @@ Optional Packages:
   --with-gnu-ld           assume the C compiler uses GNU ld [default=no]
   --with-sysroot[=DIR]    Search for dependent libraries within DIR (or the
                           compiler's sysroot if not specified).
-  --with-python=PATH      specify path to python interpreter
+  --with-python=PATH      specify path to Python interpreter
   --with-python-install-dir=PATH
                           installation directory for Python modules
   --with-geoip=PATH       Build with GeoIP support (yes|no|path)
@@ -12167,57 +12179,53 @@ done
 
 
 #
-# Python is also optional; it is used by the tools in bin/python.
-# If python is unavailable, we simply don't build those.
+# Python is also optional but required by default so that dnssec-keymgr gets
+# installed unless explicitly prevented by the user using --without-python.
 #
+testminvers='import sys
+if (sys.version_info < (2,7)) or (sys.version_info < (3,2) and sys.version_info >= (3,0)):
+   exit(1)'
+
+testargparse='try: import argparse
+except: exit(1)'
+
+testply='try: import ply
+except: exit(1)'
+
 
 # Check whether --with-python was given.
 if test "${with_python+set}" = set; then :
-  withval=$with_python; use_python="$withval"
+  withval=$with_python;
 else
-  use_python="yes"
+  with_python="python python3 python3.7 python3.6 python3.5 python3.4 python3.3 python3.2 python2 python2.7"
 fi
 
 
 # Check whether --with-python-install-dir was given.
 if test "${with_python_install_dir+set}" = set; then :
-  withval=$with_python_install_dir; use_python_install_dir="$withval"
+  withval=$with_python_install_dir;
 else
-  use_python_install_dir="unspec"
+  with_python_install_dir=""
 fi
 
 
-python="python python3 python3.5 python3.4 python3.3 python3.2 python2 python2.7"
-
-testargparse='try: import argparse
-except: exit(1)'
-
-testply='try: from ply import *
-except: exit(1)'
-
-testdnspython='try: import dns.message
-except: exit(1)'
-
-testminvers='import sys
-if (sys.version_info < (2,7)) or (sys.version_info < (3,2) and sys.version_info >= (3,0)):
-   exit(1)'
-
-case "$use_python" in
-	no)
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for python support" >&5
-$as_echo_n "checking for python support... " >&6; }
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: disabled" >&5
+if test "$with_python" = "no"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python support" >&5
+$as_echo_n "checking for Python support... " >&6; }
+       { $as_echo "$as_me:${as_lineno-$LINENO}: result: disabled" >&5
 $as_echo "disabled" >&6; }
-		;;
-	yes|*)
-		case "$use_python" in
-		yes|'')
-			for p in $python
-			do
-				for ac_prog in $p
-do
-  # Extract the first word of "$ac_prog", so it can be a program name with args.
-set dummy $ac_prog; ac_word=$2
+else
+  for p in $with_python
+       do
+	 case $p in #(
+  /*) :
+    PYTHON="$p" ;; #(
+  *) :
+     ;;
+esac
+
+	 # Extract the first word of "$p", so it can be a program name with args.
+set dummy $p; ac_word=$2
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
 $as_echo_n "checking for $ac_word... " >&6; }
 if ${ac_cv_path_PYTHON+:} false; then :
@@ -12256,166 +12264,80 @@ $as_echo "no" >&6; }
 fi
 
 
-  test -n "$PYTHON" && break
-done
+	 # Do not cache the result of the check from the previous line.  If the
+	 # first found Python interpreter has missing module dependencies and
+	 # the result of the above check is cached, subsequent module checks
+	 # will erroneously keep on using the cached path to the first found
+	 # Python interpreter instead of different ones.
+	 unset ac_cv_path_PYTHON
 
-				if test "X$PYTHON" = "X"; then
-					continue;
-				fi
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python2 version >= 2.7 or python3 version >= 3.2" >&5
-$as_echo_n "checking python2 version >= 2.7 or python3 version >= 3.2... " >&6; }
-				if ${PYTHON:-false} -c "$testminvers"; then
-					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found" >&5
-$as_echo "found" >&6; }
-				else
-					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
-$as_echo "not found" >&6; }
-					unset ac_cv_path_PYTHON
-					unset PYTHON
-					continue
-				fi
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'argparse'" >&5
-$as_echo_n "checking python module 'argparse'... " >&6; }
-				if ${PYTHON:-false} -c "$testargparse"; then
-					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found" >&5
-$as_echo "found" >&6; }
-				else
-					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
-$as_echo "not found" >&6; }
-					unset ac_cv_path_PYTHON
-					unset PYTHON
-					continue
-				fi
+	 if test -z "$PYTHON"; then :
+  continue
+fi
 
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'ply'" >&5
-$as_echo_n "checking python module 'ply'... " >&6; }
-				if ${PYTHON:-false} -c "$testply"; then
-					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found" >&5
-$as_echo "found" >&6; }
-				else
-					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
-$as_echo "not found" >&6; }
-					unset ac_cv_path_PYTHON
-					unset PYTHON
-					continue
-				fi
-
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'dnspython'" >&5
-$as_echo_n "checking python module 'dnspython'... " >&6; }
-				if ${PYTHON:-false} -c "$testdnspython"; then
-					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found" >&5
-$as_echo "found" >&6; }
-					break
-				else
-					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: not found" >&5
-$as_echo "not found" >&6; }
-					unset ac_cv_path_PYTHON
-					unset PYTHON
-				fi
-			done
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for python support" >&5
-$as_echo_n "checking for python support... " >&6; }
-			if test "X$PYTHON" != "X"
-			then
-				PYTHON_INSTALL_DIR="$use_python_install_dir"
-				PYTHON_INSTALL_LIB="--install-lib=$use_python_install_dir"
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+	 { $as_echo "$as_me:${as_lineno-$LINENO}: checking if $PYTHON is python2 version >= 2.7 or python3 version >= 3.2" >&5
+$as_echo_n "checking if $PYTHON is python2 version >= 2.7 or python3 version >= 3.2... " >&6; }
+	 if "$PYTHON" -c "$testminvers" 2>/dev/null; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-			else
-				as_fn_error $? "no; python required for dnssec-keymgr" "$LINENO" 5
-			fi
-			;;
-		*)
-			case "$use_python" in
-			/*)
-				PYTHON="$use_python"
-				;;
-			*)
-				for ac_prog in $use_python
-do
-  # Extract the first word of "$ac_prog", so it can be a program name with args.
-set dummy $ac_prog; ac_word=$2
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
-$as_echo_n "checking for $ac_word... " >&6; }
-if ${ac_cv_path_PYTHON+:} false; then :
-  $as_echo_n "(cached) " >&6
-else
-  case $PYTHON in
-  [\\/]* | ?:[\\/]*)
-  ac_cv_path_PYTHON="$PYTHON" # Let the user override the test with a path.
-  ;;
-  *)
-  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
-for as_dir in $PATH
-do
-  IFS=$as_save_IFS
-  test -z "$as_dir" && as_dir=.
-    for ac_exec_ext in '' $ac_executable_extensions; do
-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
-    ac_cv_path_PYTHON="$as_dir/$ac_word$ac_exec_ext"
-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
-    break 2
-  fi
-done
-  done
-IFS=$as_save_IFS
-
-  ;;
-esac
-fi
-PYTHON=$ac_cv_path_PYTHON
-if test -n "$PYTHON"; then
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $PYTHON" >&5
-$as_echo "$PYTHON" >&6; }
 else
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
+		unset PYTHON
+		continue
 fi
 
+	 { $as_echo "$as_me:${as_lineno-$LINENO}: checking Python module 'argparse'" >&5
+$as_echo_n "checking Python module 'argparse'... " >&6; }
+	 if "$PYTHON" -c "$testargparse" 2>/dev/null; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+		unset PYTHON
+		continue
+fi
 
-  test -n "$PYTHON" && break
-done
+	 { $as_echo "$as_me:${as_lineno-$LINENO}: checking Python module 'ply'" >&5
+$as_echo_n "checking Python module 'ply'... " >&6; }
+	 if "$PYTHON" -c "$testply" 2>/dev/null; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+		unset PYTHON
+		continue
+fi
 
-				;;
-			esac
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python2 version >= 2.7 or python3 version >= 3.2" >&5
-$as_echo_n "checking python2 version >= 2.7 or python3 version >= 3.2... " >&6; }
-			if ${PYTHON:-false} -c "$testminvers"; then
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found" >&5
-$as_echo "found" >&6; }
-			else
-				as_fn_error $? "not found" "$LINENO" 5
-			fi
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'argparse'" >&5
-$as_echo_n "checking python module 'argparse'... " >&6; }
-			if ${PYTHON:-false} -c "$testargparse"; then
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found, using $PYTHON" >&5
-$as_echo "found, using $PYTHON" >&6; }
-			else
-				as_fn_error $? "not found" "$LINENO" 5
-			fi
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'ply'" >&5
-$as_echo_n "checking python module 'ply'... " >&6; }
-			if ${PYTHON:-false} -c "$testply"; then
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found, using $PYTHON" >&5
-$as_echo "found, using $PYTHON" >&6; }
-			else
-				as_fn_error $? "not found" "$LINENO" 5
-			fi
-			;;
-		esac
-		;;
-esac
+	 # Stop looking any further once we find a Python interpreter
+	 # satisfying all requirements.
+	 break
+       done
+
+       if test "X$PYTHON" = "X"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for Python support" >&5
+$as_echo_n "checking for Python support... " >&6; }
+	      { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+	      as_fn_error $? "Python required for dnssec-keymgr" "$LINENO" 5
+fi
+fi
 
 PYTHON_TOOLS=''
 CHECKDS=''
 COVERAGE=''
 KEYMGR=''
-if test "X$PYTHON" != "X"; then
-	PYTHON_TOOLS=python
-	CHECKDS=checkds
-	COVERAGE=coverage
-	KEYMGR=keymgr
+if test "X$PYTHON" != "X"; then :
+  PYTHON_TOOLS=python
+       CHECKDS=checkds
+       COVERAGE=coverage
+       KEYMGR=keymgr
+       PYTHON_INSTALL_DIR="$with_python_install_dir"
+       if test -n "$with_python_install_dir"; then :
+  PYTHON_INSTALL_LIB="--install-lib=$with_python_install_dir"
+fi
 fi
 
 
@@ -20319,6 +20241,7 @@ if test "$with_dlopen" = "yes"; then :
   *-linux*|*-gnu*) :
 
 		 SO_CFLAGS="-fPIC"
+                 LDFLAGS="${LDFLAGS} -Wl,--export-dynamic"
 		 SO_LDFLAGS=""
 		 if test "$use_libtool" = "yes"; then :
 

configure.ac

@@ -178,138 +178,89 @@ AC_PATH_PROGS(PERL, perl5 perl)
 AC_SUBST(PERL)
 
 #
-# Python is also optional; it is used by the tools in bin/python.
-# If python is unavailable, we simply don't build those.
+# Python is also optional but required by default so that dnssec-keymgr gets
+# installed unless explicitly prevented by the user using --without-python.
 #
-AC_ARG_WITH(python,
-	    AS_HELP_STRING([--with-python=PATH],
-			   [specify path to python interpreter]),
-    use_python="$withval", use_python="yes")
-AC_ARG_WITH(python-install-dir,
-	    AS_HELP_STRING([--with-python-install-dir=PATH],
-			   [installation directory for Python modules]),
-	    use_python_install_dir="$withval", use_python_install_dir="unspec")
-
-python="python python3 python3.5 python3.4 python3.3 python3.2 python2 python2.7"
-
-testargparse='try: import argparse
-except: exit(1)'
-
-testply='try: from ply import *
-except: exit(1)'
-
-testdnspython='try: import dns.message
-except: exit(1)'
-
 testminvers='import sys
 if (sys.version_info < (2,7)) or (sys.version_info < (3,2) and sys.version_info >= (3,0)):
    exit(1)'
 
-case "$use_python" in
-	no)
-		AC_MSG_CHECKING([for python support])
-		AC_MSG_RESULT([disabled])
-		;;
-	yes|*)
-		case "$use_python" in
-		yes|'')
-			for p in $python
-			do
-				AC_PATH_PROGS(PYTHON, $p)
-				if test "X$PYTHON" = "X"; then
-					continue;
-				fi
-				AC_MSG_CHECKING([python2 version >= 2.7 or python3 version >= 3.2])
-				if ${PYTHON:-false} -c "$testminvers"; then
-					AC_MSG_RESULT([found])
-				else
-					AC_MSG_RESULT([not found])
-					unset ac_cv_path_PYTHON
-					unset PYTHON
-					continue
-				fi
-				AC_MSG_CHECKING([python module 'argparse'])
-				if ${PYTHON:-false} -c "$testargparse"; then
-					AC_MSG_RESULT([found])
-				else
-					AC_MSG_RESULT([not found])
-					unset ac_cv_path_PYTHON
-					unset PYTHON
-					continue
-				fi
+testargparse='try: import argparse
+except: exit(1)'
 
-				AC_MSG_CHECKING([python module 'ply'])
-				if ${PYTHON:-false} -c "$testply"; then
-					AC_MSG_RESULT([found])
-				else
-					AC_MSG_RESULT([not found])
-					unset ac_cv_path_PYTHON
-					unset PYTHON
-					continue
-				fi
+testply='try: import ply
+except: exit(1)'
 
-				AC_MSG_CHECKING([python module 'dnspython'])
-				if ${PYTHON:-false} -c "$testdnspython"; then
-					AC_MSG_RESULT([found])
-					break
-				else
-					AC_MSG_RESULT([not found])
-					unset ac_cv_path_PYTHON
-					unset PYTHON
-				fi
-			done
-			AC_MSG_CHECKING([for python support])
-			if test "X$PYTHON" != "X"
-			then
-				PYTHON_INSTALL_DIR="$use_python_install_dir"
-				PYTHON_INSTALL_LIB="--install-lib=$use_python_install_dir"
-				AC_MSG_RESULT([yes])
-			else
-				AC_MSG_ERROR([no; python required for dnssec-keymgr])
-			fi
-			;;
-		*)
-			case "$use_python" in
-			/*)
-				PYTHON="$use_python"
-				;;
-			*)
-				AC_PATH_PROGS(PYTHON, $use_python)
-				;;
-			esac
-			AC_MSG_CHECKING([python2 version >= 2.7 or python3 version >= 3.2])
-			if ${PYTHON:-false} -c "$testminvers"; then
-				AC_MSG_RESULT([found])
-			else
-				AC_MSG_ERROR([not found])
-			fi
-			AC_MSG_CHECKING([python module 'argparse'])
-			if ${PYTHON:-false} -c "$testargparse"; then
-				AC_MSG_RESULT([found, using $PYTHON])
-			else
-				AC_MSG_ERROR([not found])
-			fi
-			AC_MSG_CHECKING([python module 'ply'])
-			if ${PYTHON:-false} -c "$testply"; then
-				AC_MSG_RESULT([found, using $PYTHON])
-			else
-				AC_MSG_ERROR([not found])
-			fi
-			;;
-		esac
-		;;
-esac
+AC_ARG_WITH([python],
+	    AS_HELP_STRING([--with-python=PATH],
+			   [specify path to Python interpreter]),
+	    [], [with_python="python python3 python3.7 python3.6 python3.5 python3.4 python3.3 python3.2 python2 python2.7"])
+AC_ARG_WITH([python-install-dir],
+	    AS_HELP_STRING([--with-python-install-dir=PATH],
+			   [installation directory for Python modules]),
+	    [], with_python_install_dir="")
+
+AS_IF([test "$with_python" = "no"],
+      [AC_MSG_CHECKING([for Python support])
+       AC_MSG_RESULT([disabled])],
+      [for p in $with_python
+       do
+	 AS_CASE([$p],
+		 [/*],[PYTHON="$p"])
+
+	 AC_PATH_PROG([PYTHON], [$p])
+	 # Do not cache the result of the check from the previous line.  If the
+	 # first found Python interpreter has missing module dependencies and
+	 # the result of the above check is cached, subsequent module checks
+	 # will erroneously keep on using the cached path to the first found
+	 # Python interpreter instead of different ones.
+	 unset ac_cv_path_PYTHON
+
+	 AS_IF([test -z "$PYTHON"], [continue])
+
+	 AC_MSG_CHECKING([if $PYTHON is python2 version >= 2.7 or python3 version >= 3.2])
+	 AS_IF(["$PYTHON" -c "$testminvers" 2>/dev/null],
+	       [AC_MSG_RESULT([yes])],
+	       [AC_MSG_RESULT([no])
+		unset PYTHON
+		continue])
+
+	 AC_MSG_CHECKING([Python module 'argparse'])
+	 AS_IF(["$PYTHON" -c "$testargparse" 2>/dev/null],
+	       [AC_MSG_RESULT([yes])],
+	       [AC_MSG_RESULT([no])
+		unset PYTHON
+		continue])
+
+	 AC_MSG_CHECKING([Python module 'ply'])
+	 AS_IF(["$PYTHON" -c "$testply" 2>/dev/null],
+	       [AC_MSG_RESULT([yes])],
+	       [AC_MSG_RESULT([no])
+		unset PYTHON
+		continue])
+
+	 # Stop looking any further once we find a Python interpreter
+	 # satisfying all requirements.
+	 break
+       done
+
+       AS_IF([test "X$PYTHON" = "X"],
+	     [AC_MSG_CHECKING([for Python support])
+	      AC_MSG_RESULT([no])
+	      AC_MSG_ERROR([Python required for dnssec-keymgr])])])
 
 PYTHON_TOOLS=''
 CHECKDS=''
 COVERAGE=''
 KEYMGR=''
-if test "X$PYTHON" != "X"; then
-	PYTHON_TOOLS=python
-	CHECKDS=checkds
-	COVERAGE=coverage
-	KEYMGR=keymgr
-fi
+AS_IF([test "X$PYTHON" != "X"],
+      [PYTHON_TOOLS=python
+       CHECKDS=checkds
+       COVERAGE=coverage
+       KEYMGR=keymgr
+       PYTHON_INSTALL_DIR="$with_python_install_dir"
+       AS_IF([test -n "$with_python_install_dir"],
+	     [PYTHON_INSTALL_LIB="--install-lib=$with_python_install_dir"])])
 AC_SUBST(CHECKDS)
 AC_SUBST(COVERAGE)
 AC_SUBST(KEYMGR)
@@ -2688,6 +2639,7 @@ AS_IF([test "$with_dlopen" = "yes"],
       [AS_CASE([$host],
 	       [*-linux*|*-gnu*],[
 		 SO_CFLAGS="-fPIC"
+                 LDFLAGS="${LDFLAGS} -Wl,--export-dynamic"
 		 SO_LDFLAGS=""
 		 AS_IF([test "$use_libtool" = "yes"],[
 			 SO_LDFLAGS="-Xcompiler -shared"

lib/bind9/check.c

@@ -563,7 +563,7 @@ check_dns64(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
 				continue;
 			}
 			nbytes = prefixlen / 8 + 4;
-			if (prefixlen >= 32 && prefixlen <= 64)
+			if (prefixlen <= 64)
 				nbytes++;
 			if (memcmp(sa.type.in6.s6_addr, zeros, nbytes) != 0) {
 				char netaddrbuf[ISC_NETADDR_FORMATSIZE];

lib/dns/catz.c

@@ -32,11 +32,19 @@
 #include <dns/view.h>
 #include <dns/zone.h>
 
+#define DNS_CATZ_ZONE_MAGIC ISC_MAGIC('c', 'a', 't', 'z')
+#define DNS_CATZ_ZONES_MAGIC ISC_MAGIC('c', 'a', 't', 's')
+#define DNS_CATZ_ENTRY_MAGIC ISC_MAGIC('c', 'a', 't', 'e')
+
+#define DNS_CATZ_ZONE_VALID(catz) ISC_MAGIC_VALID(catz, DNS_CATZ_ZONE_MAGIC)
+#define DNS_CATZ_ZONES_VALID(catzs) ISC_MAGIC_VALID(catzs, DNS_CATZ_ZONES_MAGIC)
+#define DNS_CATZ_ENTRY_VALID(entry) ISC_MAGIC_VALID(entry, DNS_CATZ_ENTRY_MAGIC)
 
 /*%
  * Single member zone in a catalog
  */
 struct dns_catz_entry {
+	unsigned int		magic;
 	dns_name_t		name;
 	dns_catz_options_t	opts;
 	isc_refcount_t		refs;
@@ -46,6 +54,7 @@ struct dns_catz_entry {
  * Catalog zone
  */
 struct dns_catz_zone {
+	unsigned int		magic;
 	dns_name_t		name;
 	dns_catz_zones_t	*catzs;
 	dns_rdata_t		soa;
@@ -58,7 +67,7 @@ struct dns_catz_zone {
 	dns_catz_options_t	defoptions;
 	dns_catz_options_t	zoneoptions;
 	isc_time_t		lastupdated;
-	bool		updatepending;
+	bool			updatepending;
 	uint32_t		version;
 
 	dns_db_t		*db;
@@ -67,8 +76,8 @@ struct dns_catz_zone {
 	isc_timer_t		*updatetimer;
 	isc_event_t		updateevent;
 
-	bool		active;
-	bool		db_registered;
+	bool			active;
+	bool			db_registered;
 
 	isc_refcount_t		refs;
 };
@@ -84,6 +93,7 @@ catz_process_zones_suboption(dns_catz_zone_t *zone, dns_rdataset_t *value,
  * Collection of catalog zones for a view
  */
 struct dns_catz_zones {
+	unsigned int			magic;
 	isc_ht_t			*zones;
 	isc_mem_t			*mctx;
 	isc_refcount_t			refs;
@@ -97,6 +107,9 @@ struct dns_catz_zones {
 
 void
 dns_catz_options_init(dns_catz_options_t *options) {
+
+	REQUIRE(options != NULL);
+
 	dns_ipkeylist_init(&options->masters);
 
 	options->allow_query = NULL;
@@ -112,6 +125,10 @@ dns_catz_options_init(dns_catz_options_t *options) {
 
 void
 dns_catz_options_free(dns_catz_options_t *options, isc_mem_t *mctx) {
+
+	REQUIRE(options != NULL);
+	REQUIRE(mctx != NULL);
+
 	if (options->masters.count != 0)
 		dns_ipkeylist_clear(mctx, &options->masters);
 	if (options->zonedir != NULL) {
@@ -128,6 +145,7 @@ isc_result_t
 dns_catz_options_copy(isc_mem_t *mctx, const dns_catz_options_t *src,
 		      dns_catz_options_t *dst)
 {
+	REQUIRE(mctx != NULL);
 	REQUIRE(src != NULL);
 	REQUIRE(dst != NULL);
 	REQUIRE(dst->masters.count == 0);
@@ -158,6 +176,10 @@ isc_result_t
 dns_catz_options_setdefault(isc_mem_t *mctx, const dns_catz_options_t *defaults,
 			    dns_catz_options_t *opts)
 {
+	REQUIRE(mctx != NULL);
+	REQUIRE(defaults != NULL);
+	REQUIRE(opts != NULL);
+
 	if (opts->masters.count == 0 && defaults->masters.count != 0)
 		dns_ipkeylist_copy(mctx, &defaults->masters, &opts->masters);
 
@@ -182,6 +204,7 @@ dns_catz_entry_new(isc_mem_t *mctx, const dns_name_t *domain,
 	dns_catz_entry_t *nentry;
 	isc_result_t result;
 
+	REQUIRE(mctx != NULL);
 	REQUIRE(nentryp != NULL && *nentryp == NULL);
 
 	nentry = isc_mem_get(mctx, sizeof(dns_catz_entry_t));
@@ -197,6 +220,7 @@ dns_catz_entry_new(isc_mem_t *mctx, const dns_name_t *domain,
 
 	dns_catz_options_init(&nentry->opts);
 	isc_refcount_init(&nentry->refs, 1);
+	nentry->magic = DNS_CATZ_ENTRY_MAGIC;
 	*nentryp = nentry;
 	return (ISC_R_SUCCESS);
 
@@ -207,6 +231,7 @@ cleanup:
 
 dns_name_t *
 dns_catz_entry_getname(dns_catz_entry_t *entry) {
+	REQUIRE(DNS_CATZ_ENTRY_VALID(entry));
 	return (&entry->name);
 }
 
@@ -217,6 +242,10 @@ dns_catz_entry_copy(dns_catz_zone_t *zone, const dns_catz_entry_t *entry,
 	isc_result_t result;
 	dns_catz_entry_t *nentry = NULL;
 
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+	REQUIRE(DNS_CATZ_ENTRY_VALID(entry));
+	REQUIRE(nentryp != NULL && *nentryp == NULL);
+
 	result = dns_catz_entry_new(zone->catzs->mctx, &entry->name, &nentry);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -232,20 +261,28 @@ dns_catz_entry_copy(dns_catz_zone_t *zone, const dns_catz_entry_t *entry,
 
 void
 dns_catz_entry_attach(dns_catz_entry_t *entry, dns_catz_entry_t **entryp) {
+	REQUIRE(DNS_CATZ_ENTRY_VALID(entry));
 	REQUIRE(entryp != NULL && *entryp == NULL);
+
 	isc_refcount_increment(&entry->refs);
 	*entryp = entry;
 }
 
 void
 dns_catz_entry_detach(dns_catz_zone_t *zone, dns_catz_entry_t **entryp) {
-	REQUIRE(entryp != NULL && *entryp != NULL);
-	dns_catz_entry_t *entry = *entryp;
+	dns_catz_entry_t *entry;
+
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+	REQUIRE(entryp != NULL);
+	entry = *entryp;
+	REQUIRE(DNS_CATZ_ENTRY_VALID(entry));
+
 	*entryp = NULL;
 
 	if (isc_refcount_decrement(&entry->refs) == 1) {
-		isc_refcount_destroy(&entry->refs);
 		isc_mem_t *mctx = zone->catzs->mctx;
+		entry->magic = 0;
+		isc_refcount_destroy(&entry->refs);
 		dns_catz_options_free(&entry->opts, mctx);
 		if (dns_name_dynamic(&entry->name))
 			dns_name_free(&entry->name, mctx);
@@ -255,6 +292,7 @@ dns_catz_entry_detach(dns_catz_zone_t *zone, dns_catz_entry_t **entryp) {
 
 bool
 dns_catz_entry_validate(const dns_catz_entry_t *entry) {
+	REQUIRE(DNS_CATZ_ENTRY_VALID(entry));
 	UNUSED(entry);
 
 	return (true);
@@ -264,6 +302,9 @@ bool
 dns_catz_entry_cmp(const dns_catz_entry_t *ea, const dns_catz_entry_t *eb) {
 	isc_region_t ra, rb;
 
+	REQUIRE(DNS_CATZ_ENTRY_VALID(ea));
+	REQUIRE(DNS_CATZ_ENTRY_VALID(eb));
+
 	if (ea == eb)
 		return (true);
 
@@ -304,21 +345,21 @@ dns_catz_entry_cmp(const dns_catz_entry_t *ea, const dns_catz_entry_t *eb) {
 
 dns_name_t *
 dns_catz_zone_getname(dns_catz_zone_t *zone) {
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
 
 	return (&zone->name);
 }
 
 dns_catz_options_t *
 dns_catz_zone_getdefoptions(dns_catz_zone_t *zone) {
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
 
 	return (&zone->defoptions);
 }
 
 void
 dns_catz_zone_resetdefoptions(dns_catz_zone_t *zone) {
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
 
 	dns_catz_options_free(&zone->defoptions, zone->catzs->mctx);
 	dns_catz_options_init(&zone->defoptions);
@@ -335,8 +376,8 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 	char zname[DNS_NAME_FORMATSIZE];
 	dns_catz_zoneop_fn_t addzone, modzone, delzone;
 
-	REQUIRE(target != NULL);
-	REQUIRE(newzone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(newzone));
+	REQUIRE(DNS_CATZ_ZONE_VALID(target));
 
 	/* TODO verify the new zone first! */
 
@@ -391,9 +432,9 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 	     result = delcur ? isc_ht_iter_delcurrent_next(iter1) :
 			     isc_ht_iter_next(iter1))
 	{
-		dns_catz_entry_t *nentry;
-		dns_catz_entry_t *oentry;
-		unsigned char * key;
+		dns_catz_entry_t *nentry = NULL;
+		dns_catz_entry_t *oentry = NULL;
+		unsigned char * key = NULL;
 		size_t keysize;
 		delcur = false;
 
@@ -464,7 +505,7 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 	     result == ISC_R_SUCCESS;
 	     result = isc_ht_iter_delcurrent_next(iter2))
 	{
-		dns_catz_entry_t *entry;
+		dns_catz_entry_t *entry = NULL;
 		isc_ht_iter_current(iter2, (void **) &entry);
 
 		dns_name_format(&entry->name, zname, DNS_NAME_FORMATSIZE);
@@ -487,7 +528,7 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 	     result == ISC_R_SUCCESS;
 	     result = isc_ht_iter_delcurrent_next(iteradd))
 	{
-		dns_catz_entry_t *entry;
+		dns_catz_entry_t *entry = NULL;
 		isc_ht_iter_current(iteradd, (void **) &entry);
 
 		dns_name_format(&entry->name, zname, DNS_NAME_FORMATSIZE);
@@ -506,8 +547,10 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {
 	     result == ISC_R_SUCCESS;
 	     result = isc_ht_iter_delcurrent_next(itermod))
 	{
-		dns_catz_entry_t *entry;
+		dns_catz_entry_t *entry = NULL;
 		isc_ht_iter_current(itermod, (void **) &entry);
+
+		dns_name_format(&entry->name, zname, DNS_NAME_FORMATSIZE);
 		result = modzone(entry, target, target->catzs->view,
 				 target->catzs->taskmgr,
 				 target->catzs->zmm->udata);
@@ -538,7 +581,6 @@ cleanup:
 	if (tomod != NULL)
 		isc_ht_destroy(&tomod);
 	return (result);
-
 }
 
 isc_result_t
@@ -573,6 +615,7 @@ dns_catz_new_zones(dns_catz_zones_t **catzsp, dns_catz_zonemodmethods_t *zmm,
 	result = isc_task_create(taskmgr, 0, &new_zones->updater);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_ht;
+	new_zones->magic = DNS_CATZ_ZONES_MAGIC;
 
 	*catzsp = new_zones;
 	return (ISC_R_SUCCESS);
@@ -589,7 +632,7 @@ dns_catz_new_zones(dns_catz_zones_t **catzsp, dns_catz_zonemodmethods_t *zmm,
 
 void
 dns_catz_catzs_set_view(dns_catz_zones_t *catzs, dns_view_t *view) {
-	REQUIRE(catzs != NULL);
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 	REQUIRE(view != NULL);
 	/* Either it's a new one or it's being reconfigured. */
 	REQUIRE(catzs->view == NULL || !strcmp(catzs->view->name, view->name));
@@ -604,7 +647,9 @@ dns_catz_new_zone(dns_catz_zones_t *catzs, dns_catz_zone_t **zonep,
 	isc_result_t result;
 	dns_catz_zone_t *new_zone;
 
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 	REQUIRE(zonep != NULL && *zonep == NULL);
+	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
 	new_zone = isc_mem_get(catzs->mctx, sizeof(*new_zone));
 	if (new_zone == NULL)
@@ -641,6 +686,7 @@ dns_catz_new_zone(dns_catz_zones_t *catzs, dns_catz_zone_t **zonep,
 	new_zone->db_registered = false;
 	new_zone->version = (uint32_t)(-1);
 	isc_refcount_init(&new_zone->refs, 1);
+	new_zone->magic = DNS_CATZ_ZONE_MAGIC;
 
 	*zonep = new_zone;
 
@@ -664,9 +710,10 @@ dns_catz_add_zone(dns_catz_zones_t *catzs, const dns_name_t *name,
 	isc_result_t result, tresult;
 	char zname[DNS_NAME_FORMATSIZE];
 
-	REQUIRE(catzs != NULL);
-	REQUIRE(name != NULL);
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
+	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 	REQUIRE(zonep != NULL && *zonep == NULL);
+
 	dns_name_format(name, zname, DNS_NAME_FORMATSIZE);
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 		      DNS_LOGMODULE_MASTER, ISC_LOG_DEBUG(3),
@@ -704,7 +751,10 @@ dns_catz_add_zone(dns_catz_zones_t *catzs, const dns_name_t *name,
 dns_catz_zone_t *
 dns_catz_get_zone(dns_catz_zones_t *catzs, const dns_name_t *name) {
 	isc_result_t result;
-	dns_catz_zone_t *found;
+	dns_catz_zone_t *found = NULL;
+
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
+	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
 	result = isc_ht_find(catzs->zones, name->ndata, name->length,
 			     (void **) &found);
@@ -716,6 +766,7 @@ dns_catz_get_zone(dns_catz_zones_t *catzs, const dns_name_t *name) {
 
 void
 dns_catz_catzs_attach(dns_catz_zones_t *catzs, dns_catz_zones_t **catzsp) {
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 	REQUIRE(catzsp != NULL && *catzsp == NULL);
 
 	isc_refcount_increment(&catzs->refs);
@@ -737,6 +788,7 @@ dns_catz_zone_detach(dns_catz_zone_t **zonep) {
 	*zonep = NULL;
 
 	if (isc_refcount_decrement(&zone->refs) == 1) {
+		isc_mem_t *mctx = zone->catzs->mctx;
 		isc_refcount_destroy(&zone->refs);
 		if (zone->entries != NULL) {
 			isc_ht_iter_t *iter = NULL;
@@ -747,7 +799,7 @@ dns_catz_zone_detach(dns_catz_zone_t **zonep) {
 			     result == ISC_R_SUCCESS;
 			     result = isc_ht_iter_delcurrent_next(iter))
 			{
-				dns_catz_entry_t *entry;
+				dns_catz_entry_t *entry = NULL;
 
 				isc_ht_iter_current(iter, (void **) &entry);
 				dns_catz_entry_detach(zone, &entry);
@@ -759,7 +811,7 @@ dns_catz_zone_detach(dns_catz_zone_t **zonep) {
 			INSIST(isc_ht_count(zone->entries) == 0);
 			isc_ht_destroy(&zone->entries);
 		}
-		isc_mem_t *mctx = zone->catzs->mctx;
+		zone->magic = 0;
 		isc_timer_detach(&zone->updatetimer);
 		if (zone->db_registered == true) {
 			INSIST(dns_db_updatenotify_unregister(
@@ -792,6 +844,7 @@ dns_catz_catzs_detach(dns_catz_zones_t **catzsp) {
 	*catzsp = NULL;
 
 	if (isc_refcount_decrement(&catzs->refs) == 1) {
+		catzs->magic = 0;
 		isc_task_destroy(&catzs->updater);
 		isc_mutex_destroy(&catzs->lock);
 		if (catzs->zones != NULL) {
@@ -802,7 +855,7 @@ dns_catz_catzs_detach(dns_catz_zones_t **catzsp) {
 			for (result = isc_ht_iter_first(iter);
 			     result == ISC_R_SUCCESS;)
 			{
-				dns_catz_zone_t *zone;
+				dns_catz_zone_t *zone = NULL;
 				isc_ht_iter_current(iter, (void **) &zone);
 				result = isc_ht_iter_delcurrent_next(iter);
 				dns_catz_zone_detach(&zone);
@@ -859,9 +912,9 @@ catz_process_zones(dns_catz_zone_t *zone, dns_rdataset_t *value,
 	dns_label_t mhash;
 	dns_name_t opt;
 
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
 	REQUIRE(DNS_RDATASET_VALID(value));
-	REQUIRE(name != NULL);
+	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
 	if (value->rdclass != dns_rdataclass_in)
 		return (ISC_R_FAILURE);
@@ -952,7 +1005,7 @@ catz_process_version(dns_catz_zone_t *zone, dns_rdataset_t *value) {
 	uint32_t tversion;
 	char t[16];
 
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
 	REQUIRE(DNS_RDATASET_VALID(value));
 
 	if (value->rdclass != dns_rdataclass_in ||
@@ -1017,11 +1070,11 @@ catz_process_masters(dns_catz_zone_t *zone, dns_ipkeylist_t *ipkl,
 	unsigned int rcount;
 	unsigned int i;
 
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
 	REQUIRE(ipkl != NULL);
 	REQUIRE(DNS_RDATASET_VALID(value));
 	REQUIRE(dns_rdataset_isassociated(value));
-	REQUIRE(name != NULL);
+	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
 	mctx = zone->catzs->mctx;
 	memset(&rdata_a, 0, sizeof(rdata_a));
@@ -1201,7 +1254,7 @@ catz_process_apl(dns_catz_zone_t *zone, isc_buffer_t **aclbp,
 	isc_buffer_t *aclb = NULL;
 	unsigned char buf[256]; /* larger than INET6_ADDRSTRLEN */
 
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
 	REQUIRE(aclbp != NULL);
 	REQUIRE(*aclbp == NULL);
 	REQUIRE(DNS_RDATASET_VALID(value));
@@ -1278,9 +1331,10 @@ catz_process_zones_suboption(dns_catz_zone_t *zone, dns_rdataset_t *value,
 	dns_name_t prefix;
 	catz_opt_t opt;
 
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
 	REQUIRE(mhash != NULL);
 	REQUIRE(DNS_RDATASET_VALID(value));
+	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
 	if (name->labels == 0)
 		return (ISC_R_FAILURE);
@@ -1336,8 +1390,8 @@ catz_process_value(dns_catz_zone_t *zone, dns_name_t *name,
 	dns_name_t prefix;
 	catz_opt_t opt;
 
-	REQUIRE(zone != NULL);
-	REQUIRE(name != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 
 	dns_name_getlabel(name, name->labels - 1, &option);
@@ -1382,8 +1436,9 @@ dns_catz_update_process(dns_catz_zones_t *catzs, dns_catz_zone_t *zone,
 	dns_rdata_soa_t soa;
 	dns_name_t prefix;
 
-	REQUIRE(catzs != NULL);
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
+	REQUIRE(ISC_MAGIC_VALID(src_name, DNS_NAME_MAGIC));
 
 	nrres = dns_name_fullcompare(src_name, &zone->name, &order, &nlabels);
 	if (nrres == dns_namereln_equal) {
@@ -1442,7 +1497,7 @@ dns_catz_generate_masterfilename(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 	isc_result_t result;
 	size_t rlen;
 
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
 	REQUIRE(entry != NULL);
 	REQUIRE(buffer != NULL && *buffer != NULL);
 
@@ -1528,7 +1583,7 @@ dns_catz_generate_zonecfg(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
 	char pbuf[sizeof("65535")]; /* used both for port number and DSCP */
 	char zname[DNS_NAME_FORMATSIZE];
 
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
 	REQUIRE(entry != NULL);
 	REQUIRE(buf != NULL && *buf == NULL);
 
@@ -1640,7 +1695,7 @@ dns_catz_update_taskaction(isc_task_t *task, isc_event_t *event) {
 
 	REQUIRE(event != NULL);
 	zone = event->ev_arg;
-	REQUIRE(zone != NULL);
+	REQUIRE(DNS_CATZ_ZONE_VALID(zone));
 
 	LOCK(&zone->catzs->lock);
 	zone->updatepending = false;
@@ -1752,7 +1807,7 @@ dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs) {
 	uint32_t vers;
 
 	REQUIRE(DNS_DB_VALID(db));
-	REQUIRE(catzs != NULL);
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 
 	/*
 	 * Create a new catz in the same context as current catz.
@@ -1925,9 +1980,8 @@ void
 dns_catz_prereconfig(dns_catz_zones_t *catzs) {
 	isc_result_t result;
 	isc_ht_iter_t *iter = NULL;
-	dns_catz_zone_t *zone;
 
-	REQUIRE(catzs != NULL);
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 
 	result = isc_ht_iter_create(catzs->zones, &iter);
 	INSIST(result == ISC_R_SUCCESS);
@@ -1935,6 +1989,7 @@ dns_catz_prereconfig(dns_catz_zones_t *catzs) {
 	     result == ISC_R_SUCCESS;
 	     result = isc_ht_iter_next(iter))
 	{
+		dns_catz_zone_t *zone = NULL;
 		isc_ht_iter_current(iter, (void **) &zone);
 		zone->active = false;
 	}
@@ -1947,7 +2002,8 @@ dns_catz_postreconfig(dns_catz_zones_t *catzs) {
 	isc_result_t result;
 	dns_catz_zone_t *newzone = NULL;
 	isc_ht_iter_t *iter = NULL;
-	dns_catz_zone_t *zone;
+
+	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));
 
 	LOCK(&catzs->lock);
 	result = isc_ht_iter_create(catzs->zones, &iter);
@@ -1955,6 +2011,8 @@ dns_catz_postreconfig(dns_catz_zones_t *catzs) {
 	for (result = isc_ht_iter_first(iter);
 	     result == ISC_R_SUCCESS;)
 	{
+		dns_catz_zone_t *zone = NULL;
+
 		isc_ht_iter_current(iter, (void **) &zone);
 		if (zone->active == false) {
 			char cname[DNS_NAME_FORMATSIZE];
@@ -1990,5 +2048,6 @@ dns_catz_postreconfig(dns_catz_zones_t *catzs) {
 
 isc_result_t
 dns_catz_get_iterator(dns_catz_zone_t *catz, isc_ht_iter_t **itp) {
+	REQUIRE(DNS_CATZ_ZONE_VALID(catz));
 	return (isc_ht_iter_create(catz->entries, itp));
 }

lib/dns/dnsrps.c

@@ -126,7 +126,6 @@ dnsrps_log_fnc(librpz_log_level_t level, void *ctxt, const char *buf) {
 isc_result_t
 dns_dnsrps_server_create(void) {
 	librpz_emsg_t emsg;
-	isc_result_t result;
 
 	INSIST(clist == NULL);
 	INSIST(librpz == NULL);

lib/dns/include/dns/catz.h

@@ -78,7 +78,7 @@ dns_catz_options_init(dns_catz_options_t *options);
  * Initialize 'options' to NULL values.
  *
  * Requires:
- * \li	options to be non NULL
+ * \li	'options' to be non NULL.
  */
 
 void
@@ -87,20 +87,20 @@ dns_catz_options_free(dns_catz_options_t *options, isc_mem_t *mctx);
  * Free 'options' contents into 'mctx'. ('options' itself is not freed.)
  *
  * Requires:
- * \li	options to be non NULL
- * \li	mctx to be a valid memory context
+ * \li	'options' to be non NULL.
+ * \li	'mctx' to be a valid memory context.
  */
 
 isc_result_t
 dns_catz_options_copy(isc_mem_t *mctx, const dns_catz_options_t *opts,
 		      dns_catz_options_t *nopts);
 /*%<
- * Duplicate 'opts' into 'nopts', allocating space from 'mctx'
+ * Duplicate 'opts' into 'nopts', allocating space from 'mctx'.
  *
  * Requires:
- * \li	'mctx' to be a valid memory context
- * \li	'options' to be non NULL and valid options
- * \li	'nopts' to be non NULL
+ * \li	'mctx' to be a valid memory context.
+ * \li	'options' to be non NULL and valid options.
+ * \li	'nopts' to be non NULL.
  */
 
 isc_result_t
@@ -110,9 +110,9 @@ dns_catz_options_setdefault(isc_mem_t *mctx, const dns_catz_options_t *defaults,
  * Replace empty values in 'opts' with values from 'defaults'
  *
  * Requires:
- * \li	mctx to be a valid memory context
- * \li	defaults to be non NULL and valid options
- * \li	opts to be non NULL
+ * \li	'mctx' to be a valid memory context.
+ * \li	'defaults' to be non NULL and valid options.
+ * \li	'opts' to be non NULL.
  */
 
 dns_name_t *
@@ -121,10 +121,10 @@ dns_catz_entry_getname(dns_catz_entry_t *entry);
  * Get domain name for 'entry'
  *
  * Requires:
- * \li	entry to be non NULL
+ * \li	'entry' to be non NULL.
  *
  * Returns:
- * \li	domain name for entry
+ * \li	domain name for entry.
  */
 
 isc_result_t
@@ -134,9 +134,9 @@ dns_catz_entry_new(isc_mem_t *mctx, const dns_name_t *domain,
  * Allocate a new catz_entry on 'mctx', with the name 'domain'
  *
  * Requires:
- * \li	mctx to be a valid memory context
- * \li	domain to be valid dns_name or NULL
- * \li	nentryp to be non NULL, *nentryp to be NULL
+ * \li	'mctx' to be a valid memory context.
+ * \li	'domain' to be valid dns_name or NULL.
+ * \li	'nentryp' to be non NULL, *nentryp to be NULL.
  *
  * Returns:
  * \li	ISC_R_SUCCESS on success
@@ -150,9 +150,9 @@ dns_catz_entry_copy(dns_catz_zone_t *zone, const dns_catz_entry_t *entry,
  * Allocate a new catz_entry and deep copy 'entry' into 'nentryp'.
  *
  * Requires:
- * \li	mctx to be a valid memory context
- * \li	entry to be non NULL
- * \li	nentryp to be non NULL, *nentryp to be NULL
+ * \li	'mctx' to be a valid memory context.
+ * \li	'entry' to be non NULL.
+ * \li	'nentryp' to be non NULL, *nentryp to be NULL.
  *
  * Returns:
  * \li	ISC_R_SUCCESS on success
@@ -165,8 +165,8 @@ dns_catz_entry_attach(dns_catz_entry_t *entry, dns_catz_entry_t **entryp);
  * Attach an entry
  *
  * Requires:
- * \li	entry is not NULL
- * \li	entryp is not NULL, *entryp is NULL
+ * \li	'entry' is a valid dns_catz_entry_t.
+ * \li	'entryp' is not NULL and '*entryp' is NULL.
  */
 
 void
@@ -175,8 +175,8 @@ dns_catz_entry_detach(dns_catz_zone_t *zone, dns_catz_entry_t **entryp);
  * Detach an entry, free if no further references
  *
  * Requires:
- * \li	zone is not NULL
- * \li	entryp is not NULL, *entryp is not NULL
+ * \li	'zone' is a valid dns_catz_zone_t.
+ * \li	'entryp' is not NULL and '*entryp' is not NULL.
  */
 
 bool
@@ -184,6 +184,9 @@ dns_catz_entry_validate(const dns_catz_entry_t *entry);
 /*%<
  * Validate whether entry is correct.
  * (NOT YET IMPLEMENTED: always returns true)
+ *
+ * Requires:
+ *\li	'entry' is a valid dns_catz_entry_t.
  */
 
 bool
@@ -192,12 +195,12 @@ dns_catz_entry_cmp(const dns_catz_entry_t *ea, const dns_catz_entry_t *eb);
  * Deep compare two entries
  *
  * Requires:
- * \li	ea is not NULL
- * \li	eb is not NULL
+ * \li	'ea' is a valid dns_catz_entry_t.
+ * \li	'eb' is a valid dns_catz_entry_t.
  *
  * Returns:
- * \li true if entries are the same
- * \li false if the entries differ
+ * \li 'true' if entries are the same.
+ * \li 'false' if the entries differ.
  */
 
 void
@@ -206,8 +209,8 @@ dns_catz_zone_attach(dns_catz_zone_t *zone, dns_catz_zone_t **zonep);
  * Attach a catzone
  *
  * Requires:
- * \li	zone is not NULL
- * \li	zonep is not NULL, *zonep is NULL
+ * \li	'zone' is a valid dns_catz_zone_t.
+ * \li	'zonep' is not NULL and '*zonep' is NULL.
  */
 
 void
@@ -216,7 +219,7 @@ dns_catz_zone_detach(dns_catz_zone_t** zonep);
  * Detach a zone, free if no further references
  *
  * Requires:
- * \li	zonep is not NULL, *zonep is not NULL
+ * \li	'zonep' is not NULL and '*zonep' is not NULL.
  */
 
 isc_result_t
@@ -226,9 +229,9 @@ dns_catz_new_zone(dns_catz_zones_t *catzs, dns_catz_zone_t **zonep,
  * Allocate a new catz zone on catzs mctx
  *
  * Requires:
- * \li	catzs is not NULL
- * \li	zonep is not NULL, *zonep is NULL
- * \li	name is not NULL
+ * \li	'catzs' is a valid dns_catz_zones_t.
+ * \li	'zonep' is not NULL and '*zonep' is NULL.
+ * \li	'name' is a valid dns_name_t.
  *
  */
 
@@ -238,7 +241,7 @@ dns_catz_zone_getname(dns_catz_zone_t *zone);
  * Get catalog zone name
  *
  * Requires:
- * \li	zone is not NULL
+ * \li	'zone' is a valid dns_catz_zone_t.
  */
 
 dns_catz_options_t *
@@ -247,7 +250,7 @@ dns_catz_zone_getdefoptions(dns_catz_zone_t *zone);
  * Get default member zone options for catalog zone 'zone'
  *
  * Requires:
- * \li	zone is not NULL
+ * \li	'zone' is a valid dns_catz_zone_t.
  */
 
 void
@@ -257,7 +260,7 @@ dns_catz_zone_resetdefoptions(dns_catz_zone_t *zone);
  * the default values.
  *
  * Requires:
- * \li	zone is not NULL
+ * \li	'zone' is a valid dns_catz_zone_t.
  */
 
 isc_result_t
@@ -267,8 +270,8 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone);
  * (from zone->catzs->zmm) for appropriate member zones.
  *
  * Requires:
- * \li	orig is not NULL
- * \li	newzone is not NULL, *newzone is not NULL
+ * \li	'orig' is a valid dns_catz_zone_t.
+ * \li	'newzone' is not NULL and '*newzone' is not NULL.
  *
  */
 
@@ -280,10 +283,10 @@ dns_catz_update_process(dns_catz_zones_t *catzs, dns_catz_zone_t *zone,
  * record name.
  *
  * Requires:
- * \li	catzs is not NULL
- * \li	zone is not NULL
- * \li	src_name is not NULL
- * \li	rdataset is valid
+ * \li	'catzs' is a valid dns_catz_zones_t.
+ * \li	'zone' is a valid dns_catz_zone_t.
+ * \li	'src_name' is a valid dns_name_t.
+ * \li	'rdataset' is valid rdataset.
  */
 
 isc_result_t
@@ -297,9 +300,9 @@ dns_catz_generate_masterfilename(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
  * __catz__unique_hash_generated_from_the_above.db
  *
  * Requires:
- * \li	zone is not NULL
- * \li	entry is not NULL
- * \li	buffer is not NULL and *buffer is not NULL
+ * \li	'zone' is a valid dns_catz_zone_t.
+ * \li	'entry' is a valid dns_catz_entry_t.
+ * \li	'buffer' is not NULL and '*buffer' is not NULL.
  */
 
 isc_result_t
@@ -310,10 +313,9 @@ dns_catz_generate_zonecfg(dns_catz_zone_t *zone, dns_catz_entry_t *entry,
  * it into *buf. buf might be reallocated.
  *
  * Requires:
- * \li	zone is not NULL
- * \li	entry is not NULL
- * \li	buf is not NULL
- * \li	*buf is NULL
+ * \li	'zone' is a valid dns_catz_zone_t.
+ * \li	'entry' is a valid dns_catz_entry_t.
+ * \li	'buf' is not NULL and '*buf' is NULL.
  *
  */
 
@@ -340,8 +342,8 @@ dns_catz_new_zones(dns_catz_zones_t **catzsp, dns_catz_zonemodmethods_t *zmm,
  * for a view.
  *
  * Requires:
- * \li catzsp is not NULL, *catzsp is NULL
- * \li zmm is not NULL
+ * \li 'catzsp' is not NULL and '*catzsp' is NULL.
+ * \li 'zmm' is not NULL.
  *
  */
 
@@ -352,9 +354,9 @@ dns_catz_add_zone(dns_catz_zones_t *catzs, const dns_name_t *name,
  * Allocate a new catz named 'name' and put it in 'catzs' collection.
  *
  * Requires:
- * \li	catzs is not NULL
- * \li	name is not NULL
- * \li	zonep is not NULL, *zonep is NULL
+ * \li	'catzs' is a valid dns_catz_zones_t.
+ * \li	'name' is a valid dns_name_t.
+ * \li	'zonep' is not NULL and *zonep is NULL.
  *
  */
 
@@ -364,37 +366,37 @@ dns_catz_get_zone(dns_catz_zones_t *catzs, const dns_name_t *name);
  * Returns a zone named 'name' from collection 'catzs'
  *
  * Requires:
- * \li	catzs is not NULL
- * \li	name is not NULL
+ * \li	'catzs' is a valid dns_catz_zones_t.
+ * \li	'name' is a valid dns_name_t.
  */
 
 void
 dns_catz_catzs_attach(dns_catz_zones_t *catzs, dns_catz_zones_t **catzsp);
 /*%<
- * Attach 'catzs' to 'catzsp'
+ * Attach 'catzs' to 'catzsp'.
  *
  * Requires:
- * \li	catzs is not NULL
- * \li	catzsp is not NULL, *catzsp is NULL
+ * \li	'catzs' is a valid dns_catz_zones_t.
+ * \li	'catzsp' is not NULL and *catzsp is NULL.
  */
 
 void
 dns_catz_catzs_detach(dns_catz_zones_t **catzsp);
 /*%<
- * Detach 'catzsp', free if no further references
+ * Detach 'catzsp', free if no further references.
  *
  * Requires:
- * \li	catzsp is not NULL, *catzsp is not NULL
+ * \li	'catzsp' is not NULL and *catzsp is not NULL.
  */
 
 void
 dns_catz_catzs_set_view(dns_catz_zones_t *catzs, dns_view_t *view);
 /*%<
- * Set a view for catzs
+ * Set a view for 'catzs'.
  *
  * Requires:
- * \li	catzs is not NULL
- * \li	catzs->view is NULL or catzs->view == view
+ * \li	'catzs' is a valid dns_catz_zones_t.
+ * \li	'catzs->view' is NULL or 'catzs->view' == 'view'.
  */
 
 
@@ -409,17 +411,17 @@ dns_catz_dbupdate_callback(dns_db_t *db, void *fn_arg);
  * If there is an update scheduled it replaces old db version with a new one.
  *
  * Requires:
- * \li	db is a valid database
- * \li	fn_arg is not NULL (casted to dns_catz_zones_t*)
+ * \li	'db' is a valid database.
+ * \li	'fn_arg' is not NULL (casted to dns_catz_zones_t*).
  */
 
 void
 dns_catz_update_taskaction(isc_task_t *task, isc_event_t *event);
 /*%<
- * Task that launches dns_catz_update_from_db
+ * Task that launches dns_catz_update_from_db.
  *
  * Requires:
- * \li	event is not NULL
+ * \li	'event' is not NULL.
  */
 
 void
@@ -430,8 +432,8 @@ dns_catz_update_from_db(dns_db_t *db, dns_catz_zones_t *catzs);
  * then merges new catz into old catz.
  *
  * Requires:
- * \li	db is a valid DB
- * \li	catzs is not NULL
+ * \li	'db' is a valid DB.
+ * \li	'catzs' is a valid dns_catz_zones_t.
  *
  */
 
@@ -441,7 +443,7 @@ dns_catz_prereconfig(dns_catz_zones_t *catzs);
  * Called before reconfig, clears 'active' flag on all the zones in set
  *
  * Requires:
- * \li	catzs is not NULL
+ * \li	'catzs' is a valid dns_catz_zones_t.
  *
  */
 
@@ -452,7 +454,7 @@ dns_catz_postreconfig(dns_catz_zones_t *catzs);
  * inactive and force reload of those with changed configuration.
  *
  * Requires:
- * \li	catzs is not NULL
+ * \li	'catzs' is a valid dns_catz_zones_t.
  */
 
 isc_result_t
@@ -460,6 +462,10 @@ dns_catz_get_iterator(dns_catz_zone_t *catz, isc_ht_iter_t **itp);
 /*%<
  * Get the hashtable iterator on catalog zone members, point '*itp' to it.
  *
+ * Requires:
+ * \li	'catzs' is a valid dns_catz_zones_t.
+ * \li	'itp' is not NULL and '*itp' is NULL.
+ *
  * Returns:
  * \li #ISC_R_SUCCESS		-- success
  * \li Any other value		-- failure

lib/dns/rpz.c

@@ -1779,7 +1779,7 @@ finish_update(dns_rpz_zone_t *rpz) {
 	     result = isc_ht_iter_delcurrent_next(iter))
 	{
 		isc_region_t region;
-		unsigned char *key;
+		unsigned char *key = NULL;
 		size_t keysize;
 
 		isc_ht_iter_currentkey(iter, &key, &keysize);

lib/dns/tests/Makefile.in

@@ -16,7 +16,7 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 
 CINCLUDES =	-I. -Iinclude ${DNS_INCLUDES} ${ISC_INCLUDES} \
-		@OPENSSL_INCLUDES@
+		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
 CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
 
 ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
@@ -25,7 +25,6 @@ DNSLIBS =	../libdns.@A@ @DNS_CRYPTO_LIBS@
 DNSDEPLIBS =	../libdns.@A@
 
 LIBS =		@LIBS@ @CMOCKA_LIBS@
-CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 
 OBJS =		dnstest.@O@
 SRCS =		acl_test.c \

lib/irs/tests/Makefile.in

@@ -15,7 +15,7 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =	-I. -Iinclude -I../include ${ISC_INCLUDES} ${IRS_INCLUDES}
+CINCLUDES =	-I. -Iinclude -I../include ${ISC_INCLUDES} ${IRS_INCLUDES} @CMOCKA_CFLAGS@
 CDEFINES =	-DTESTS="\"${top_builddir}/lib/irs/tests/\""
 
 CFGLIBS =	../../isccfg/libisccfg.@A@
@@ -27,7 +27,6 @@ ISCDEPLIBS =	../../isc/libisc.@A@
 IRSLIBS =	../libirs.@A@
 IRSDEPLIBS =	../libirs.@A@
 
-CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 LIBS =		${IRSLIBS} ${CFGLIBS} ${DNSLIBS} ${ISCLIBS} @LIBS@ @CMOCKA_LIBS@
 
 OBJS =

lib/isc/ht.c

@@ -162,6 +162,7 @@ isc_ht_find(const isc_ht_t *ht, const unsigned char *key,
 
 	REQUIRE(ISC_HT_VALID(ht));
 	REQUIRE(key != NULL && keysize > 0);
+	REQUIRE(valuep == NULL || *valuep == NULL);
 
 	hash = isc_hash_function(key, keysize, true, NULL);
 	node = ht->table[hash & ht->mask];
@@ -327,6 +328,8 @@ void
 isc_ht_iter_current(isc_ht_iter_t *it, void **valuep) {
 	REQUIRE(it != NULL);
 	REQUIRE(it->cur != NULL);
+	REQUIRE(valuep != NULL && *valuep == NULL);
+
 	*valuep = it->cur->value;
 }
 
@@ -335,6 +338,8 @@ isc_ht_iter_currentkey(isc_ht_iter_t *it, unsigned char **key, size_t *keysize)
 {
 	REQUIRE(it != NULL);
 	REQUIRE(it->cur != NULL);
+	REQUIRE(key != NULL && *key == NULL);
+
 	*key = it->cur->key;
 	*keysize = it->cur->keysize;
 }

lib/isc/include/isc/ht.h

@@ -27,10 +27,9 @@ typedef struct isc_ht_iter isc_ht_iter_t;
  * Initialize hashtable at *htp, using memory context and size of (1<<bits)
  *
  * Requires:
- *\li	htp is not NULL
- *\li	*htp is NULL
- *\li	mctx is a valid memory context
- *\li	bits >=1 && bits <=32
+ *\li	'htp' is not NULL and '*htp' is NULL.
+ *\li	'mctx' is a valid memory context.
+ *\li	'bits' >=1 and 'bits' <=32
  *
  * Returns:
  *\li	#ISC_R_NOMEMORY		-- not enough memory to create pool
@@ -43,7 +42,7 @@ isc_ht_init(isc_ht_t **htp, isc_mem_t *mctx, uint8_t bits);
  * Destroy hashtable, freeing everything
  *
  * Requires:
- * \li	*htp is valid hashtable
+ * \li	'*htp' is valid hashtable
  */
 void
 isc_ht_destroy(isc_ht_t **htp);
@@ -53,7 +52,7 @@ isc_ht_destroy(isc_ht_t **htp);
  * set its value to 'value'
  *
  * Requires:
- *\li	ht is a valid hashtable
+ *\li	'ht' is a valid hashtable
  *
  * Returns:
  *\li	#ISC_R_NOMEMORY		-- not enough memory to create pool
@@ -83,6 +82,7 @@ isc_ht_find(const isc_ht_t *ht, const unsigned char *key,
 
 /*%
  * Delete node from hashtable
+ *
  * Requires:
  *\li	ht is a valid hashtable
  *
@@ -95,12 +95,19 @@ isc_ht_delete(isc_ht_t *ht, const unsigned char *key, uint32_t keysize);
 
 /*%
  * Create an iterator for the hashtable; point '*itp' to it.
+ *
+ * Requires:
+ *\li	'ht' is a valid hashtable
+ *\li	'itp' is non NULL and '*itp' is NULL.
  */
 isc_result_t
 isc_ht_iter_create(isc_ht_t *ht, isc_ht_iter_t **itp);
 
 /*%
  * Destroy the iterator '*itp', set it to NULL
+ *
+ * Requires:
+ *\li	'itp' is non NULL and '*itp' is non NULL.
  */
 void
 isc_ht_iter_destroy(isc_ht_iter_t **itp);
@@ -108,6 +115,9 @@ isc_ht_iter_destroy(isc_ht_iter_t **itp);
 /*%
  * Set an iterator to the first entry.
  *
+ * Requires:
+ *\li	'it' is non NULL.
+ *
  * Returns:
  * \li 	#ISC_R_SUCCESS	-- success
  * \li	#ISC_R_NOMORE	-- no data in the hashtable
@@ -118,6 +128,9 @@ isc_ht_iter_first(isc_ht_iter_t *it);
 /*%
  * Set an iterator to the next entry.
  *
+ * Requires:
+ *\li	'it' is non NULL.
+ *
  * Returns:
  * \li 	#ISC_R_SUCCESS	-- success
  * \li	#ISC_R_NOMORE	-- end of hashtable reached
@@ -128,6 +141,9 @@ isc_ht_iter_next(isc_ht_iter_t *it);
 /*%
  * Delete current entry and set an iterator to the next entry.
  *
+ * Requires:
+ *\li	'it' is non NULL.
+ *
  * Returns:
  * \li 	#ISC_R_SUCCESS	-- success
  * \li	#ISC_R_NOMORE	-- end of hashtable reached
@@ -138,6 +154,10 @@ isc_ht_iter_delcurrent_next(isc_ht_iter_t *it);
 
 /*%
  * Set 'value' to the current value under the iterator
+ *
+ * Requires:
+ *\li	'it' is non NULL.
+ *\li   'valuep' is non NULL and '*valuep' is NULL.
  */
 void
 isc_ht_iter_current(isc_ht_iter_t *it, void **valuep);
@@ -145,6 +165,11 @@ isc_ht_iter_current(isc_ht_iter_t *it, void **valuep);
 /*%
  * Set 'key' and 'keysize to the current key and keysize for the value
  * under the iterator
+ *
+ * Requires:
+ *\li	'it' is non NULL.
+ *\li   'key' is non NULL and '*key' is NULL.
+ *\li	'keysize' is non NULL.
  */
 void
 isc_ht_iter_currentkey(isc_ht_iter_t *it, unsigned char **key, size_t *keysize);

lib/isc/random.c

@@ -79,13 +79,17 @@ static isc_once_t isc_random_once = ISC_ONCE_INIT;
 
 static void
 isc_random_initialize(void) {
+	int useed[4] = {0,0,0,1};
 #if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
-	memset(seed, 0, sizeof(seed));
+	/*
+	 * Set a constant seed to help in problem reproduction should fuzzing
+	 * find a crash or a hang.  The seed array must be non-zero else
+	 * xoshiro128starstar will generate an infinite series of zeroes.
+	 */
 #else
-	int useed[4] = {0,0,0,0};
 	isc_entropy_get(useed, sizeof(useed));
-	memcpy(seed, useed, sizeof(seed));
 #endif
+	memcpy(seed, useed, sizeof(seed));
 }
 
 uint8_t

lib/isc/tests/Makefile.in

@@ -15,14 +15,13 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+CINCLUDES =	-I. -Iinclude ${ISC_INCLUDES} @OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
 CDEFINES =	-DTESTS="\"${top_builddir}/lib/isc/tests/\""
 
 ISCLIBS =	../libisc.@A@ @OPENSSL_LIBS@
 ISCDEPLIBS =	../libisc.@A@
 
 LIBS =		@LIBS@ @CMOCKA_LIBS@
-CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 
 OBJS =		isctest.@O@
 

lib/isc/tests/ht_test.c

@@ -203,11 +203,9 @@ test_ht_iterator() {
 	isc_mem_t *mctx = NULL;
 	isc_ht_iter_t * iter = NULL;
 	uintptr_t i;
-	void *v;
 	uintptr_t count = 10000;
 	uint32_t walked;
 	unsigned char key[16];
-	unsigned char *tkey;
 	size_t tksize;
 
 	result = isc_mem_createx(0, 0, default_memalloc, default_memfree,
@@ -236,6 +234,9 @@ test_ht_iterator() {
 	     result == ISC_R_SUCCESS;
 	     result = isc_ht_iter_next(iter))
 	{
+		unsigned char *tkey = NULL;
+		void *v = NULL;
+
 		isc_ht_iter_current(iter, &v);
 		isc_ht_iter_currentkey(iter, &tkey, &tksize);
 		assert_int_equal(tksize, 16);
@@ -252,6 +253,9 @@ test_ht_iterator() {
 	walked = 0;
 	result = isc_ht_iter_first(iter);
 	while (result == ISC_R_SUCCESS) {
+		unsigned char *tkey = NULL;
+		void *v = NULL;
+
 		isc_ht_iter_current(iter, &v);
 		isc_ht_iter_currentkey(iter, &tkey, &tksize);
 		assert_int_equal(tksize, 16);
@@ -273,6 +277,9 @@ test_ht_iterator() {
 	walked = 0;
 	result = isc_ht_iter_first(iter);
 	while (result == ISC_R_SUCCESS) {
+		unsigned char *tkey = NULL;
+		void *v = NULL;
+
 		isc_ht_iter_current(iter, &v);
 		isc_ht_iter_currentkey(iter, &tkey, &tksize);
 		assert_int_equal(tksize, 16);

lib/isccc/tests/Makefile.in

@@ -19,7 +19,7 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =	-I. -Iinclude ${ISCCC_INCLUDES} ${ISC_INCLUDES}
+CINCLUDES =	-I. -Iinclude ${ISCCC_INCLUDES} ${ISC_INCLUDES} @CMOCKA_CFLAGS@
 CDEFINES =
 
 ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
@@ -27,7 +27,6 @@ ISCDEPLIBS =	../../isc/libisc.@A@
 ISCCCLIBS =	../libisccc.@A@
 ISCCCDEPLIBS =	../libisccc.@A@
 
-CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 LIBS =		@LIBS@ @CMOCKA_LIBS@
 
 OBJS =

lib/isccfg/tests/Makefile.in

@@ -17,7 +17,7 @@ VERSION=@BIND9_VERSION@
 
 CINCLUDES =	-I. -Iinclude \
 		${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
-		@OPENSSL_INCLUDES@
+		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
 CDEFINES =	-DTESTS="\"${top_builddir}/lib/dns/tests/\""
 
 ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
@@ -27,7 +27,6 @@ DNSDEPLIBS =	../../dns/libdns.@A@
 ISCCFGLIBS = 	../libisccfg.@A@
 ISCCFGDEPLIBS = ../libisccfg.@A@
 
-CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 LIBS =		@LIBS@ @CMOCKA_LIBS@
 
 OBJS =

lib/ns/client.c

@@ -930,8 +930,6 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 	isc_region_t r;
 	isc_sockaddr_t *address;
 	isc_socket_t *sock;
-	isc_netaddr_t netaddr;
-	int match;
 	unsigned int sockflags = ISC_SOCKFLAG_IMMEDIATE;
 	isc_dscp_t dispdscp = -1;
 
@@ -939,21 +937,8 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 		sock = client->tcpsocket;
 		address = NULL;
 	} else {
-		dns_aclenv_t *env =
-			ns_interfacemgr_getaclenv(client->interface->mgr);
-
 		sock = client->udpsocket;
 		address = &client->peeraddr;
-
-		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
-		if (client->sctx->blackholeacl != NULL &&
-		    (dns_acl_match(&netaddr, NULL, client->sctx->blackholeacl,
-				   env, &match, NULL) == ISC_R_SUCCESS) &&
-		    match > 0)
-		{
-			return (DNS_R_BLACKHOLED);
-		}
-		sockflags |= ISC_SOCKFLAG_NORETRY;
 	}
 
 	if ((client->attributes & NS_CLIENTATTR_PKTINFO) != 0 &&

lib/ns/tests/Makefile.in

@@ -16,7 +16,7 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 
 CINCLUDES =	-I. -Iinclude ${NS_INCLUDES} ${DNS_INCLUDES} ${ISC_INCLUDES} \
-		@OPENSSL_INCLUDES@
+		@OPENSSL_INCLUDES@ @CMOCKA_CFLAGS@
 CDEFINES =	-DTESTS="\"${top_builddir}/lib/ns/tests/\""
 
 ISCLIBS =	../../isc/libisc.@A@ @OPENSSL_LIBS@
@@ -26,7 +26,6 @@ DNSDEPLIBS =	../../dns/libdns.@A@
 NSLIBS =	../libns.@A@
 NSDEPLIBS =	../libns.@A@
 
-CFLAGS =	@CFLAGS@ @CMOCKA_CFLAGS@
 LIBS =		@LIBS@ @CMOCKA_LIBS@
 
 

util/copyrights

@@ -473,6 +473,7 @@
 ./bin/tests/system/coverage/10-check-ksk/expect	X	2014,2018
 ./bin/tests/system/coverage/11-cutoff/README	X	2014,2018
 ./bin/tests/system/coverage/11-cutoff/expect	X	2014,2018
+./bin/tests/system/coverage/12-ksk-deletion/expect	X	2018
 ./bin/tests/system/coverage/clean.sh		SH	2013,2014,2016,2018
 ./bin/tests/system/coverage/setup.sh		SH	2013,2014,2016,2017,2018
 ./bin/tests/system/coverage/tests.sh		SH	2013,2014,2016,2018