- Use TIME_NOW to verify the result

- Verify the result of isc_task_create

.gitattributes

@@ -1,10 +1,2 @@
 *.sln.in eol=crlf
 *.vcxproj.* eol=crlf
-
-.gitignore			 export-ignore
-/conftools			 export-ignore
-/doc/design			 export-ignore
-/doc/dev			 export-ignore
-/util/**			 export-ignore
-/util/bindkeys.pl		-export-ignore
-/util/mksymtbl.pl		-export-ignore

.gitignore

@@ -60,4 +60,3 @@ timestamp
 /compile_commands.json
 /cppcheck_html/
 /cppcheck.results
-/tsan

.gitlab-ci.yml

@@ -18,13 +18,6 @@ variables:
   MAKE: make
   CONFIGURE: ./configure
   SCAN_BUILD: scan-build-9
-  SYMBOLIZER: /usr/lib/llvm-9/bin/llvm-symbolizer
-  ASAN_SYMBOLIZER_PATH: "$SYMBOLIZER"
-
-  CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls -O1 -g -Wall -Wextra 
-
-  TARBALL_COMPRESSOR: xz
-  TARBALL_EXTENSION: xz
 
 stages:
   - precheck
@@ -34,7 +27,6 @@ stages:
   - docs
   - push
   - postcheck
-  - release
 
 ### Runner Tag Templates
 
@@ -110,8 +102,8 @@ stages:
 
 # Fedora
 
-.fedora-31-amd64: &fedora_31_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-31-amd64"
+.fedora-30-amd64: &fedora_30_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-30-amd64"
   <<: *linux_amd64
 
 # Ubuntu
@@ -139,14 +131,12 @@ stages:
     - merge_requests
     - tags
     - web
-    - schedules
 
 .release-branch-triggering-rules: &release_branch_triggering_rules
   only:
     - merge_requests
     - tags
     - web
-    - schedules
     - master@isc-projects/bind9
     - /^v9_[1-9][0-9]$/@isc-projects/bind9
 
@@ -182,7 +172,7 @@ stages:
     --without-make-clean \
     $EXTRA_CONFIGURE \
     || cat config.log
-
+    
 .build: &build_job
   <<: *default_triggering_rules
   stage: build
@@ -200,36 +190,6 @@ stages:
     untracked: true
     expire_in: "1 week"
 
-.windows_build: &windows_build_job
-  stage: build
-  tags:
-    - windows
-    - amd64
-  script:
-    - 'Push-Location "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Auxiliary/Build"'
-    - '& cmd.exe /C "vcvarsall.bat x64 & set" | Foreach-Object { if ($_ -match "(.*?)=(.*)") { Set-Item -force -path "Env:\$($matches[1])" -value "$($matches[2])" } }'
-    - 'Pop-Location'
-    - 'Set-Location win32utils'
-    - '& "C:/Strawberry/perl/bin/perl.exe" Configure
-         "with-tools-version=15.0"
-         "with-platform-toolset=v141"
-         "with-platform-version=10.0.17763.0"
-         "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
-         "with-openssl=C:/OpenSSL"
-         "with-libxml2=C:/libxml2"
-         "with-libuv=C:/libuv"
-         "without-python"
-         "with-system-tests"
-         x64'
-    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
-    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
-  dependencies: []
-  needs:
-    - autoreconf:sid:amd64
-  artifacts:
-    untracked: true
-    expire_in: "1 week"
-
 .setup_interfaces: &setup_interfaces |
     if [ "$(id -u)" -eq "0" ]; then
       sh -x bin/tests/system/ifconfig.sh up;
@@ -238,7 +198,7 @@ stages:
     fi
 
 .setup_softhsm: &setup_softhsm |
-    sh -x bin/tests/prepare-softhsm2.sh
+    sh -x util/prepare-softhsm2.sh
 
 .system_test: &system_test_job
   <<: *default_triggering_rules
@@ -261,30 +221,6 @@ stages:
        --results-filter "" \
        --output kyua_html
 
-.windows_system_test: &windows_system_test_job
-  stage: system
-  tags:
-    - windows
-    - amd64
-  script:
-    - 'Push-Location bin/tests/system'
-    - '$ifIndex = Get-NetIPInterface -AddressFamily IPv4 -InterfaceMetric 75 | Select-Object -ExpandProperty ifIndex'
-    - '& C:/tools/cygwin/bin/sed.exe -i "s/^exit.*/netsh interface ipv4 set dnsservers $ifIndex dhcp/; s/\(name\|interface\)=Loopback/$ifIndex/;" ifconfig.bat'
-    - '& C:/tools/cygwin/bin/sed.exe -i "s/kill -f/kill -W/;" conf.sh stop.pl'
-    - '& cmd.exe /C ifconfig.bat up; ""'
-    - 'Start-Sleep 2'
-    - '$Env:Path = "C:/tools/cygwin/bin;$Env:Path"'
-    - '& sh.exe runall.sh $TEST_PARALLEL_JOBS'
-    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
-  artifacts:
-    untracked: true
-    expire_in: "1 week"
-    when: on_failure
-  only:
-    - schedules
-    - tags
-    - web
-
 .unit_test: &unit_test_job
   <<: *default_triggering_rules
   stage: unit
@@ -373,28 +309,10 @@ misc:sid:amd64:
 
 🐞:sid:amd64:
   <<: *precheck_job
-  <<: *debian_buster_amd64_image
   script:
     - util/check-cocci
     - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
 
-tarball-create:sid:amd64:
-  <<: *debian_sid_amd64_image
-  stage: precheck
-  script:
-    - source version
-    - export BIND_DIRECTORY="bind-${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
-    - git archive --prefix="${BIND_DIRECTORY}/" --output="${BIND_DIRECTORY}.tar" HEAD
-    - mkdir "${BIND_DIRECTORY}"
-    - echo "SRCID=$(git rev-list --max-count=1 HEAD | cut -b1-7)" > "${BIND_DIRECTORY}/srcid"
-    - tar --append --file="${BIND_DIRECTORY}.tar" "${BIND_DIRECTORY}/srcid"
-    - ${TARBALL_COMPRESSOR} "${BIND_DIRECTORY}.tar"
-  artifacts:
-    paths:
-      - bind-*.tar.${TARBALL_EXTENSION}
-  only:
-    - tags
-
 # Jobs for doc builds on Debian Sid (amd64)
 
 docs:sid:amd64:
@@ -429,7 +347,7 @@ push:docs:sid:amd64:
 gcc:alpine3.10:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--enable-dnstap"
   <<: *alpine_3_10_amd64_image
   <<: *build_job
@@ -453,7 +371,7 @@ unit:gcc:alpine3.10:amd64:
 gcc:centos6:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--with-libidn2 --disable-warn-error"
   <<: *centos_centos6_amd64_image
   <<: *build_job
@@ -477,7 +395,7 @@ unit:gcc:centos6:amd64:
 gcc:centos7:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
   <<: *centos_centos7_amd64_image
   <<: *build_job
@@ -501,7 +419,7 @@ unit:gcc:centos7:amd64:
 gcc:centos8:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--with-libidn2"
   <<: *centos_centos8_amd64_image
   <<: *build_job
@@ -525,7 +443,7 @@ unit:gcc:centos8:amd64:
 gcc:jessie:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O2"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--without-cmocka --with-python --disable-geoip"
   <<: *debian_jessie_amd64_image
   <<: *build_job
@@ -549,7 +467,7 @@ unit:gcc:jessie:amd64:
 gcc:stretch:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O2"
+    CFLAGS: "-Wall -Wextra -O2 -g"
   <<: *debian_stretch_amd64_image
   <<: *build_job
 
@@ -572,7 +490,7 @@ unit:gcc:stretch:amd64:
 gcc:buster:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
   <<: *debian_buster_amd64_image
   <<: *build_job
 
@@ -606,7 +524,7 @@ scan-build:buster:amd64:
   stage: postcheck
   variables:
     CC: clang-9
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     CONFIGURE: "${SCAN_BUILD} ./configure"
     EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
   script:
@@ -627,7 +545,7 @@ scan-build:buster:amd64:
 gcc:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O3"
+    CFLAGS: "-Wall -Wextra -O3 -g"
     EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
     RUN_MAKE_INSTALL: 1
     MAKE: bear make
@@ -655,54 +573,12 @@ cppcheck:gcc:sid:amd64:
     - gcc:sid:amd64
   needs: ["gcc:sid:amd64"]
 
-# Jobs for tarball GCC builds on Debian Sid (amd64)
-
-tarball:sid:amd64:
-  variables:
-    CC: gcc
-    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
-    RUN_MAKE_INSTALL: 1
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-  before_script:
-    - tar --extract --file bind-*.tar.${TARBALL_EXTENSION}
-    - rm -f bind-*.tar.${TARBALL_EXTENSION}
-    - cd bind-*
-  dependencies:
-    - tarball-create:sid:amd64
-  needs: ["tarball-create:sid:amd64"]
-  only:
-    - tags
-
-system:tarball:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *system_test_job
-  before_script:
-    - cd bind-*
-    - *setup_interfaces
-  dependencies:
-    - tarball:sid:amd64
-  needs: ["tarball:sid:amd64"]
-  only:
-    - tags
-
-unit:tarball:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  before_script:
-    - cd bind-*
-  dependencies:
-    - tarball:sid:amd64
-  needs: ["tarball:sid:amd64"]
-  only:
-    - tags
-
 # Jobs for regular GCC builds on Debian Sid (i386)
 
 gcc:sid:i386:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O3 -g"
     EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 --without-python"
   <<: *debian_sid_i386_image
   <<: *build_job
@@ -721,36 +597,36 @@ unit:gcc:sid:i386:
     - gcc:sid:i386
   needs: ["gcc:sid:i386"]
 
-# Jobs for regular GCC builds on Fedora 31 (amd64)
+# Jobs for regular GCC builds on Fedora 30 (amd64)
 
-gcc:fedora31:amd64:
+gcc:fedora30:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O1"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *fedora_31_amd64_image
+  <<: *fedora_30_amd64_image
   <<: *build_job
 
-system:gcc:fedora31:amd64:
-  <<: *fedora_31_amd64_image
+system:gcc:fedora30:amd64:
+  <<: *fedora_30_amd64_image
   <<: *system_test_job
   dependencies:
-    - gcc:fedora31:amd64
-  needs: ["gcc:fedora31:amd64"]
+    - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]
 
-unit:gcc:fedora31:amd64:
-  <<: *fedora_31_amd64_image
+unit:gcc:fedora30:amd64:
+  <<: *fedora_30_amd64_image
   <<: *unit_test_job
   dependencies:
-    - gcc:fedora31:amd64
-  needs: ["gcc:fedora31:amd64"]
+    - gcc:fedora30:amd64
+  needs: ["gcc:fedora30:amd64"]
 
 # Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)
 
 gcc:xenial:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -O2"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--disable-geoip"
   <<: *ubuntu_xenial_amd64_image
   <<: *build_job
@@ -774,7 +650,7 @@ unit:gcc:xenial:amd64:
 gcc:bionic:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--with-libidn2"
   <<: *ubuntu_bionic_amd64_image
   <<: *build_job
@@ -798,7 +674,8 @@ unit:gcc:bionic:amd64:
 asan:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    ASAN_OPTIONS: "detect_leaks=0"
+    CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
     LDFLAGS: "-fsanitize=address,undefined"
     EXTRA_CONFIGURE: "--with-libidn2"
   <<: *debian_sid_amd64_image
@@ -818,67 +695,10 @@ unit:asan:sid:amd64:
     - asan:sid:amd64
   needs: ["asan:sid:amd64"]
 
-# Jobs for GCC builds with TSAN enabled on Debian Sid (amd64)
-
-tsan:buster:amd64:
-  <<: *debian_buster_amd64_image
-  <<: *build_job
-  variables:
-    CC: clang-9
-    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread -DISC_MEM_USE_INTERNAL_MALLOC=0"
-    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
-
-system:tsan:buster:amd64:
-  variables:
-    TSAN_OPTIONS: "second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=$SYMBOLIZER exitcode=0"
-  before_script:
-    - *setup_interfaces
-    - echo $TSAN_OPTIONS
-  <<: *debian_buster_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - tsan:buster:amd64
-  needs: ["tsan:buster:amd64"]
-  allow_failure: true
-  after_script:
-    - find bin -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
-  artifacts:
-    expire_in: "1 week"
-    paths:
-      - bin/tests/system/*/tsan.*
-      - bin/tests/system/*/*/tsan.*
-      - tsan/
-    when: on_failure
-
-unit:tsan:buster:amd64:
-  variables:
-    TSAN_OPTIONS: "second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=$SYMBOLIZER"
-  before_script:
-    - echo $TSAN_OPTIONS
-    - lib/isc/tests/result_test
-  <<: *debian_buster_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - tsan:buster:amd64
-  needs: ["tsan:buster:amd64"]
-  allow_failure: true
-  after_script:
-    - find lib -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
-  artifacts:
-    expire_in: "1 week"
-    paths:
-      - lib/*/tests/tsan.*
-      - tsan/
-      - kyua.log
-      - kyua.results
-      - kyua_html/
-    when: on_failure
-
 rwlock:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    CFLAGS: "-Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
     EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
   <<: *debian_sid_amd64_image
   <<: *build_job
@@ -901,7 +721,7 @@ unit:rwlock:sid:amd64:
 mutexatomics:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    CFLAGS: "-Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
     EXTRA_CONFIGURE: "--with-libidn2 --enable-mutex-atomics"
   <<: *debian_sid_amd64_image
   <<: *build_job
@@ -926,7 +746,7 @@ mutexatomics:sid:amd64:
 clang:stretch:amd64:
   variables:
     CC: clang
-    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
     EXTRA_CONFIGURE: "--with-python=python3"
   <<: *debian_stretch_amd64_image
   <<: *build_job
@@ -943,7 +763,7 @@ unit:clang:stretch:amd64:
 clang:stretch:i386:
   variables:
     CC: clang
-    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
     EXTRA_CONFIGURE: "--with-python=python2"
   <<: *debian_stretch_i386_image
   <<: *build_job
@@ -953,7 +773,7 @@ clang:stretch:i386:
 pkcs11:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--enable-native-pkcs11 --with-pkcs11=/usr/lib/softhsm/libsofthsm2.so"
   <<: *debian_sid_amd64_image
   <<: *build_job
@@ -976,7 +796,7 @@ unit:pkcs11:sid:amd64:
 
 clang:freebsd11.3:amd64:
   variables:
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
   <<: *freebsd_amd64
   <<: *build_job
 
@@ -998,7 +818,7 @@ unit:clang:freebsd11.3:amd64:
 
 clang:freebsd12.0:amd64:
   variables:
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -O2 -g"
     EXTRA_CONFIGURE: "--enable-dnstap"
   <<: *freebsd_amd64
   <<: *build_job
@@ -1032,7 +852,6 @@ system:clang:openbsd6.5:amd64:
     - clang:openbsd6.5:amd64
   needs: ["clang:openbsd6.5:amd64"]
   only:
-    - schedules
     - tags
     - web
 
@@ -1041,7 +860,7 @@ system:clang:openbsd6.5:amd64:
 nolibtool:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
+    CFLAGS: "-Wall -Wextra -Og -g"
     EXTRA_CONFIGURE: "--with-libidn2 --without-libtool --with-dlopen"
   <<: *debian_sid_amd64_image
   <<: *build_job
@@ -1063,74 +882,62 @@ unit:nolibtool:sid:amd64:
 # Jobs for Visual Studio 2017 builds on Windows (amd64)
 
 msvc:windows:amd64:
-  <<: *windows_build_job
   <<: *default_triggering_rules
+  stage: build
+  tags:
+    - windows
+    - amd64
   variables:
     VSCONF: Release
+  script:
+    - 'Push-Location "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Auxiliary/Build"'
+    - '& cmd.exe /C "vcvarsall.bat x64 & set" | Foreach-Object { if ($_ -match "(.*?)=(.*)") { Set-Item -force -path "Env:\$($matches[1])" -value "$($matches[2])" } }'
+    - 'Pop-Location'
+    - 'Set-Location win32utils'
+    - '& "C:/Strawberry/perl/bin/perl.exe" Configure
+         "with-tools-version=15.0"
+         "with-platform-toolset=v141"
+         "with-platform-version=10.0.17763.0"
+         "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
+         "with-openssl=C:/OpenSSL"
+         "with-libxml2=C:/libxml2"
+         "with-libuv=C:/libuv"
+         "without-python"
+         "with-system-tests"
+         x64'
+    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
+    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
+  dependencies: []
+  needs:
+    - autoreconf:sid:amd64
+  artifacts:
+    untracked: true
+    expire_in: "1 week"
 
 system:msvc:windows:amd64:
-  <<: *windows_system_test_job
+  stage: system
+  tags:
+    - windows
+    - amd64
   variables:
     VSCONF: Release
+  script:
+    - 'Push-Location bin/tests/system'
+    - '$ifIndex = Get-NetIPInterface -AddressFamily IPv4 -InterfaceMetric 75 | Select-Object -ExpandProperty ifIndex'
+    - '& C:/tools/cygwin/bin/sed.exe -i "s/^exit.*/netsh interface ipv4 set dnsservers $ifIndex dhcp/; s/\(name\|interface\)=Loopback/$ifIndex/;" ifconfig.bat'
+    - '& C:/tools/cygwin/bin/sed.exe -i "s/kill -f/kill -W/;" conf.sh stop.pl'
+    - '& cmd.exe /C ifconfig.bat up; ""'
+    - 'Start-Sleep 2'
+    - '$Env:Path = "C:/tools/cygwin/bin;$Env:Path"'
+    - '& sh.exe runall.sh $TEST_PARALLEL_JOBS'
+    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
   dependencies:
     - msvc:windows:amd64
   needs: ["msvc:windows:amd64"]
-
-msvc-debug:windows:amd64:
-  <<: *windows_build_job
-  variables:
-    VSCONF: Debug
+  artifacts:
+    untracked: true
+    expire_in: "1 week"
+    when: on_failure
   only:
-    - schedules
     - tags
     - web
-
-system:msvc-debug:windows:amd64:
-  <<: *windows_system_test_job
-  variables:
-    VSCONF: Debug
-  dependencies:
-    - msvc-debug:windows:amd64
-  needs: ["msvc-debug:windows:amd64"]
-
-# Job producing a release tarball
-
-release:sid:amd64:
-  <<: *debian_sid_amd64_image
-  stage: release
-  script:
-    # Determine BIND version
-    - source version
-    - export BIND_DIRECTORY="bind-${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
-    # Remove redundant files and system test utilities from Windows build artifacts
-    - find Build/Release/ -name "*.pdb" -print -delete
-    - find Build/Debug/ \( -name "*.bsc" -o -name "*.idb" \) -print -delete
-    - find Build/ -regextype posix-extended -regex "Build/.*/($(find bin/tests/ -type f | sed -nE "s|^bin/tests(/system)?/win32/(.*)\.vcxproj$|\2|p" | paste -d"|" -s))\..*" -print -delete
-    # Create Windows zips
-    - openssl dgst -sha256 "${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" | tee Build/Release/SHA256 Build/Debug/SHA256
-    - ( cd Build/Release; zip "../../BIND${BIND_DIRECTORY#bind-}.x64.zip" * )
-    - ( cd Build/Debug; zip "../../BIND${BIND_DIRECTORY#bind-}.debug.x64.zip" * )
-    # Prepare release tarball contents (tarballs + zips + documentation)
-    - mkdir -p release/doc/arm
-    - pushd release
-    - mv "../${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" ../BIND*.zip .
-    - tar --extract --file="${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}"
-    - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README,srcid} .
-    - mv "${BIND_DIRECTORY}"/doc/arm/{Bv9ARM{*.html,.pdf},man.*,notes.{html,pdf,txt}} doc/arm/
-    - rm -rf "${BIND_DIRECTORY}"
-    - cp doc/arm/notes.html "RELEASE-NOTES-${BIND_DIRECTORY}.html"
-    - cp doc/arm/notes.pdf "RELEASE-NOTES-${BIND_DIRECTORY}.pdf"
-    - cp doc/arm/notes.txt "RELEASE-NOTES-${BIND_DIRECTORY}.txt"
-    - popd
-    # Create release tarball
-    - tar --create --file="${CI_COMMIT_TAG}.tar.gz" --gzip release/
-  dependencies:
-    - tarball-create:sid:amd64
-    - msvc:windows:amd64
-    - msvc-debug:windows:amd64
-  only:
-    - tags
-  artifacts:
-    paths:
-      - "*.tar.gz"
-    expire_in: "1 week"

.gitlab/issue_templates/Release.md

@@ -2,6 +2,8 @@
 
 **Tagging Deadline:**
 
+**ASN Deadline:**
+
 **Public Release:**
 
 ## Release Checklist
@@ -10,7 +12,6 @@
 
  - [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
  - [ ] ***(QA)*** Ensure that there are no outstanding merge requests in the private repository[^1] (Subscription Edition only).
- - [ ] ***(QA)*** Ensure all merge requests marked for backporting have been indeed backported.
 
 ## Before the Tagging Deadline
 
@@ -32,22 +33,21 @@
 
 ## Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
 
- - [ ] ***(QA)*** Verify GitLab CI results for the tags created and prepare a QA report for the releases to be published.
- - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums.
- - [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
- - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again.
+ - [ ] ***(QA)*** Run the `make release` Jenkins jobs to produce the tarballs and zips.
+ - [ ] ***(QA)*** Verify the results of `make release` Jenkins jobs and prepare a QA report for the releases to be published.
+ - [ ] ***(QA)*** Request signatures for the tarballs.
+ - [ ] ***(Signers)*** Sign the tarballs.
+ - [ ] ***(QA)*** Check tarball signatures.
+ - [ ] ***(QA)*** Notify Support that the releases are ready for publication.
  - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
  - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages.
- - [ ] ***(QA)*** Notify Support that the releases have been prepared.
  - [ ] ***(Support)*** Send out ASNs (if applicable).
 
 ## On the Day of Public Release
 
- - [ ] ***(Support)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
- - [ ] ***(Support)*** Place tarballs in public location on FTP site.
- - [ ] ***(Support)*** Publish links to downloads on ISC website.
- - [ ] ***(Support)*** Write release email to *bind-announce*.
- - [ ] ***(Support)*** Write email to *bind-users* (if a major release).
+ - [ ] ***(Support)*** Publish the releases according to the release schedule.
+ - [ ] ***(Support)*** Write release email to *bind9-announce*.
+ - [ ] ***(Support)*** Write email to *bind9-users* (if a major release).
  - [ ] ***(Support)*** Update tickets in case of waiting support customers.
  - [ ] ***(QA)*** Build and test any outstanding private packages.
  - [ ] ***(QA)*** Build public packages (`*.deb`, RPMs).

.uncrustify.cfg

@@ -642,7 +642,7 @@ align_with_tabs                          = true     # false/true
 align_on_tabstop                         = false    # false/true
 
 # Whether to left-align numbers
-align_number_left                        = false    # false/true
+#align_number_left                        = false    # false/true
 
 # Align variable definitions in prototypes and functions
 align_func_params                        = false    # false/true

CHANGES

@@ -1,103 +1,3 @@
-5335.	[func]		Make TCP listening code multithreaded. [GL !2659]
-
-5334.	[doc]		Update documentation with dnssec-policy clarifications.
-			Also change some defaults.
-
-5333.	[bug]		Fix duration printing on Solaris when value is not
-			an ISO 8601 duration. [GL #1460]
-
-5332.	[func]		Renamed "dnssec-keys" configuration statement
-			to the more descriptive "trust-anchors".
-
-5331.	[func]		Use compiler-provided mechanisms for thread local
-			storage, and make the requirement for such mechanisms
-			explicit in configure. [GL #1444]
-
-5330.	[bug]		'configure --without-python' was ineffective if
-			PYTHON was set in the environment. [GL #1434]
-
-5329.	[bug]		Reconfiguring named caused memory to be leaked when any
-			GeoIP2 database was in use. [GL #1445]
-
-5328.	[bug]		rbtdb.c:rdataset_{get,set}ownercase failed to obtain
-			a node lock. [GL #1417]
-
-5327.	[func]		Added a statistics counter to track queries
-			dropped because the recursive-clients quota was
-			exceeded. [GL #1399]
-
-5326.	[bug]		Add python dependancy on 'distutils.core' to configure.
-			'distutils.core' is required for installation.
-			[GL #1397]
-
-5325.	[bug]		Addressed several issues with TCP connections in
-			the netmgr: restored support for TCP connection
-			timeouts, restored TCP backlog support, actively
-			close all open sockets during shutdown. [GL #1312]
-
-5324.	[bug]		Change the category of some log messages from general
-			to the more appopriate catergory of xfer-in. [GL #1394]
-
-5323.	[bug]		Fix a bug in DNSSEC trust anchor verification.
-			[GL !2609]
-
-5322.	[placeholder]
-
-5321.	[bug]		Obtain write lock before updating version->records
-			and version->bytes. [GL #1341]
-
-5320.	[cleanup]	Silence TSAN on header->count. [GL #1344]
-
-	--- 9.15.6 released ---
-
-5319.	[func]		Trust anchors can now be configured using DS
-			format to represent a key digest, by using the
-			new "initial-ds" or "static-ds" keywords in
-			the "dnssec-keys" statement.
-
-			Note: DNSKEY-format and DS-format trust anchors
-			cannot both be used for the same domain name.
-			[GL #622]
-
-5318.	[cleanup]	The DNSSEC validation code has been refactored
-			for clarity and to reduce code duplication.
-			[GL #622]
-
-5317.	[func]		A new asynchronous network communications system
-			based on libuv is now used for listening for
-			incoming requests and responding to them. (The
-			old isc_socket API remains in use for sending
-			iterative queries and processing responses; this
-			will be changed too in a later release.)
-
-			This change will make it easier to improve
-			performance and implement new protocol layers
-			(e.g., DNS over TLS) in the future. [GL #29]
-
-5316.	[func]		A new "dnssec-policy" option has been added to
-			named.conf to implement a key and signing policy
-			(KASP) for zones. When this option is in use,
-			named can generate new keys as needed and
-			automatically roll both ZSK and KSK keys. (Note
-			that the syntax for this statement differs from
-			the dnssec policy used by dnssec-keymgr.)
-
-			See the ARM for configuration details. [GL #1134]
-
-5315.	[bug]		Apply the inital RRSIG expiration spread fixed
-			to all dynamically created records in the zone
-			including NSEC3. Also fix the signature clusters
-			when the server has been offline for prolonged
-			period of times. [GL #1256]
-
-5314.	[func]		Added a new statistics variable "tcp-highwater"
-			that reports the maximum number of simultaneous TCP
-			clients BIND has handled while running. [GL #1206]
-
-5313.	[bug]		The default GeoIP2 database location did not match
-			the ARM.  'named -V' now reports the default
-			location. [GL #1301]
-
 5312.	[bug]		Do not flush the cache for `rndc validation status`.
 			Thanks to Tony Finch. [GL !2462]
 
@@ -114,8 +14,7 @@
 5307.	[bug]		Fix hang when named-compilezone output is sent to pipe.
 			Thanks to Tony Finch. [GL !2481]
 
-5306.	[security]	Set a limit on number of simultaneous pipelined TCP
-			queries. (CVE-2019-6477) [GL #1264]
+5306.	[placeholder]
 
 5305.	[bug]		NSEC Aggressive Cache ("synth-from-dnssec") has been
 			disabled by default because it was found to have

PLATFORMS

@@ -4,29 +4,16 @@ Supported platforms
 
 In general, this version of BIND will build and run on any POSIX-compliant
 system with a C11-compliant C compiler, BSD-style sockets with
-RFC-compliant IPv6 support, POSIX-compliant threads, the libuv
-asynchronous I/O library, and the OpenSSL cryptography library.
+RFC-compliant IPv6 support, POSIX-compliant threads, and the OpenSSL
+cryptography library. Atomic operations support from the compiler is
+needed, either in the form of builtin operations, C11 atomics or the
+Interlocked family of functions on Windows.
 
-The following C11 features are used in BIND 9:
-
-  * Atomic operations support from the compiler is needed, either in the
-    form of builtin operations, C11 atomics, or the Interlocked family of
-    functions on Windows.
-
-  * Thread Local Storage support from the compiler is needed, either in
-    the form of C11 _Thread_local/thread_local, the __thread GCC
-    extension, or the __declspec(thread) MSVC extension on Windows.
-
-BIND 9.15 requires a fairly recent version of libuv (at least 1.x). For
-some of the older systems listed below, you will have to install an
-updated libuv package from sources such as EPEL, PPA, or other native
-sources for updated packages. The other option is to build and install
-libuv from source.
-
-Certain optional BIND features have additional library dependencies. These
-include libxml2 and libjson-c for statistics, libmaxminddb for
-geolocation, libfstrm and libprotobuf-c for DNSTAP, and libidn2 for
-internationalized domain name conversion.
+BIND 9.15 requires fairly recent version of libuv library to run (>= 1.x).
+For some of the older systems listed below, you will have to install
+updated libuv package from sources such as EPEL, PPA and other native
+sources for updated packages. The other option is to install libuv from
+sources.
 
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -39,7 +26,7 @@ following systems:
 
   * Debian 9, 10
   * Ubuntu LTS 16.04, 18.04
-  * Fedora 31
+  * Fedora 30
   * Red Hat Enterprise Linux / CentOS 7, 8
   * FreeBSD 11.3, 12.0
   * OpenBSD 6.5
@@ -70,10 +57,10 @@ Server 2012 R2, none of these are tested regularly by ISC.
 
 Community maintained
 
-These systems may not all have the required dependencies for building BIND
-easily available, although it will be possible in many cases to compile
+These systems may not all have easily available the required dependencies
+for building BIND although it will be possible in many cases to compile
 those directly from source. The community and interested parties may wish
-to help with maintenance, and we welcome patch contributions, although we
+to help with maintenance and we welcome patch contributions, although we
 cannot guarantee that we will accept them. All contributions will be
 assessed against the risk of adverse effect on officially supported
 platforms.
@@ -96,4 +83,6 @@ These are platforms on which BIND 9.15 is known not to build or run:
   * Platforms that don't support atomic operations (via compiler or
     library)
   * Linux without NPTL (Native POSIX Thread Library)
-  * Platforms on which libuv cannot be compiled
+  * Platforms where libuv cannot be compiled
+
+Platform quirks

PLATFORMS.md

@@ -12,29 +12,15 @@
 
 In general, this version of BIND will build and run on any POSIX-compliant
 system with a C11-compliant C compiler, BSD-style sockets with RFC-compliant
-IPv6 support, POSIX-compliant threads, the `libuv` asynchronous I/O library,
-and the OpenSSL cryptography library.
+IPv6 support, POSIX-compliant threads, and the OpenSSL cryptography library.
+Atomic operations support from the compiler is needed, either in the form of
+builtin operations, C11 atomics or the Interlocked family of functions on
+Windows.
 
-The following C11 features are used in BIND 9:
-
-* Atomic operations support from the compiler is needed, either in the form of
-  builtin operations, C11 atomics, or the `Interlocked` family of functions on
-  Windows.
-
-* Thread Local Storage support from the compiler is needed, either in the form
-  of C11 `_Thread_local`/`thread_local`, the `__thread` GCC extension, or
-  the `__declspec(thread)` MSVC extension on Windows.
-
-BIND 9.15 requires a fairly recent version of `libuv` (at least 1.x).  For
-some of the older systems listed below, you will have to install an updated
-`libuv` package from sources such as EPEL, PPA, or other native sources for
-updated packages. The other option is to build and install `libuv` from
-source.
-
-Certain optional BIND features have additional library dependencies.
-These include `libxml2` and `libjson-c` for statistics, `libmaxminddb` for
-geolocation, `libfstrm` and `libprotobuf-c` for DNSTAP, and `libidn2` for
-internationalized domain name conversion.
+BIND 9.15 requires fairly recent version of libuv library to run (>= 1.x).  For
+some of the older systems listed below, you will have to install updated libuv
+package from sources such as EPEL, PPA and other native sources for updated
+packages.  The other option is to install libuv from sources.
 
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -47,7 +33,7 @@ following systems:
 
 * Debian 9, 10
 * Ubuntu LTS 16.04, 18.04
-* Fedora 31
+* Fedora 30
 * Red Hat Enterprise Linux / CentOS 7, 8
 * FreeBSD 11.3, 12.0
 * OpenBSD 6.5
@@ -77,13 +63,12 @@ Server 2012 R2, none of these are tested regularly by ISC.
 
 ### Community maintained
 
-These systems may not all have the required dependencies for building BIND
-easily available, although it will be possible in many cases to compile
-those directly from source. The community and interested parties may wish
-to help with maintenance, and we welcome patch contributions, although we
-cannot guarantee that we will accept them.  All contributions will be
-assessed against the risk of adverse effect on officially supported
-platforms.
+These systems may not all have easily available the required dependencies for
+building BIND although it will be possible in many cases to compile those
+directly from source. The community and interested parties may wish to help with
+maintenance and we welcome patch contributions, although we cannot guarantee
+that we will accept them.  All contributions will be assessed against the risk
+of adverse effect on officially supported platforms.
 
 * Platforms past or close to their respective EOL dates, such as:
     * Ubuntu 14.04, 18.10
@@ -102,4 +87,6 @@ These are platforms on which BIND 9.15 is known *not* to build or run:
 * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
 * Platforms that don't support atomic operations (via compiler or library)
 * Linux without NPTL (Native POSIX Thread Library)
-* Platforms on which `libuv` cannot be compiled
+* Platforms where libuv cannot be compiled
+
+## Platform quirks

README

@@ -48,8 +48,8 @@ the file HISTORY.
 For a detailed list of changes made throughout the history of BIND 9, see
 the file CHANGES. See below for details on the CHANGES file format.
 
-For up-to-date versions and release notes, see https://www.isc.org/
-download/.
+For up-to-date release notes and errata, see http://www.isc.org/software/
+bind9/releasenotes
 
 For information about supported platforms, see PLATFORMS.
 
@@ -111,30 +111,25 @@ BIND 9.15 features
 BIND 9.15 is the newest development branch of BIND 9. It includes a number
 of changes from BIND 9.14 and earlier releases. New features include:
 
-  * New "dnssec-policy" statement to configure a key and signing policy
-    for zones, enabling automatic key regeneration and rollover.
-  * New new network manager based on libuv.
   * Support for the new GeoIP2 geolocation API
-  * Improved DNSSEC trust anchor configuration using dnssec-keys,
-    permitting configuration of trust anchors in DS as well as DNSKEY
-    format.
+  * Improved DNSSEC key configuration using dnssec-keys
   * YAML output for dig, mdig, and delv.
 
 Building BIND
 
 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
-basic POSIX support, and a 64-bit integer type. BIND also requires the
-libuv asynchronous I/O library, and a cryptography provider library such
-as OpenSSL or a hardware service module supporting PKCS#11. On Linux, BIND
-requires the libcap library to set process privileges, though this
-requirement can be overridden by disabling capability support at compile
-time. See Compile-time options below for details on other libraries that
-may be required to support optional features.
+basic POSIX support, and a 64-bit integer type. Successful builds have
+been observed on many versions of Linux and UNIX, including RHEL/CentOS,
+Fedora, Debian, Ubuntu, SLES, openSUSE, Slackware, Alpine, FreeBSD,
+NetBSD, OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE, HP-UX, and
+OpenWRT.
 
-Successful builds have been observed on many versions of Linux and UNIX,
-including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE, Slackware,
-Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE,
-HP-UX, and OpenWRT.
+BIND requires a cryptography provider library such as OpenSSL or a
+hardware service module supporting PKCS#11. On Linux, BIND requires the
+libcap library to set process privileges, though this requirement can be
+overridden by disabling capability support at compile time. See
+Compile-time options below for details on other libraries that may be
+required to support optional features.
 
 BIND is also available for Windows Server 2008 and higher. See win32utils/
 build.txt for details on building for Windows systems.

README.md

@@ -57,8 +57,8 @@ For a detailed list of changes made throughout the history of BIND 9, see
 the file [CHANGES](CHANGES). See [below](#changes) for details on the
 CHANGES file format.
 
-For up-to-date versions and release notes, see
-[https://www.isc.org/download/](https://www.isc.org/download/).
+For up-to-date release notes and errata, see
+[http://www.isc.org/software/bind9/releasenotes](http://www.isc.org/software/bind9/releasenotes)
 
 For information about supported platforms, see [PLATFORMS](PLATFORMS.md).
 
@@ -127,31 +127,24 @@ BIND 9.15 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.14 and earlier releases. New features
 include:
 
-* New "dnssec-policy" statement to configure a key and signing policy
-  for zones, enabling automatic key regeneration and rollover.
-* New new network manager based on libuv.
 * Support for the new GeoIP2 geolocation API
-* Improved DNSSEC trust anchor configuration using the `trust-anchors`
-  statement, permitting configuration of trust anchors in DS as well as
-  DNSKEY format.
+* Improved DNSSEC key configuration using `dnssec-keys`
 * YAML output for `dig`, `mdig`, and `delv`.
 
 ### <a name="build"/> Building BIND
 
 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
-basic POSIX support, and a 64-bit integer type.  BIND also requires the
-`libuv` asynchronous I/O library, and a cryptography provider library
-such as OpenSSL or a hardware service module supporting PKCS#11. On
-Linux, BIND requires the `libcap` library to set process privileges,
-though this requirement can be overridden by disabling capability
-support at compile time. See [Compile-time options](#opts) below
-for details on other libraries that may be required to support
-optional features.
+basic POSIX support, and a 64-bit integer type. Successful builds have been
+observed on many versions of Linux and UNIX, including RHEL/CentOS, Fedora,
+Debian, Ubuntu, SLES, openSUSE, Slackware, Alpine, FreeBSD, NetBSD,
+OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
 
-Successful builds have been observed on many versions of Linux and
-UNIX, including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE,
-Slackware, Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris,
-OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
+BIND requires a cryptography provider library such as OpenSSL or a
+hardware service module supporting PKCS#11. On Linux, BIND requires
+the `libcap` library to set process privileges, though this requirement
+can be overridden by disabling capability support at compile time.
+See [Compile-time options](#opts) below for details on other libraries
+that may be required to support optional features.
 
 BIND is also available for Windows Server 2008 and higher.  See
 `win32utils/build.txt` for details on building for Windows
@@ -191,11 +184,9 @@ or if you have Xcode already installed you can run `xcode-select --install`.
 
 Portions of BIND that are written in Python, including
 `dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
-system tests, require the `argparse`, `ply` and `distutils.core` modules
-to be available.
+system tests, require the `argparse` and `ply` modules to be available.
 `argparse` is a standard module as of Python 2.7 and Python 3.2.
 `ply` is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
-`distutils.core` is required for installation.
 
 #### <a name="opts"/> Compile-time options
 

bin/check/named-checkconf.c

@@ -421,7 +421,7 @@ configure_zone(const char *vclass, const char *view,
 
 	obj = NULL;
 	if (get_maps(maps, "max-zone-ttl", &obj)) {
-		maxttl = cfg_obj_asduration(obj);
+		maxttl = cfg_obj_asuint32(obj);
 		zone_options |= DNS_ZONEOPT_CHECKTTL;
 	}
 
@@ -709,6 +709,8 @@ main(int argc, char **argv) {
 
 	cfg_parser_destroy(&parser);
 
+	dns_name_destroy();
+
 	isc_log_destroy(&logc);
 
 	isc_mem_destroy(&mctx);

bin/check/named-checkzone.c

@@ -85,9 +85,9 @@ usage(void) {
 
 static void
 destroy(void) {
-	if (zone != NULL) {
+	if (zone != NULL)
 		dns_zone_detach(&zone);
-	}
+	dns_name_destroy();
 }
 
 /*% main processing routine */

bin/delv/delv.c

@@ -33,10 +33,8 @@
 #include <isc/app.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/hex.h>
 #include <isc/lib.h>
 #include <isc/log.h>
-#include <isc/md.h>
 #include <isc/mem.h>
 #ifdef WIN32
 #include <isc/ntpaths.h>
@@ -140,7 +138,7 @@ static dns_fixedname_t afn;
 static dns_name_t *anchor_name = NULL;
 
 /* Default bind.keys contents */
-static char anchortext[] = TRUST_ANCHORS;
+static char anchortext[] = DNSSEC_KEYS;
 
 /*
  * Static function prototypes
@@ -160,44 +158,43 @@ usage(void) {
 "        q-class  is one of (in,hs,ch,...) [default: in]\n"
 "        q-type   is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n"
 "        q-opt    is one of:\n"
-"                 -4                  (use IPv4 query transport only)\n"
-"                 -6                  (use IPv6 query transport only)\n"
+"                 -x dot-notation     (shortcut for reverse lookups)\n"
+"                 -d level            (set debugging level)\n"
 "                 -a anchor-file      (specify root trust anchor)\n"
 "                 -b address[#port]   (bind to source address/port)\n"
-"                 -c class            (option included for compatibility;\n"
-"                 -d level            (set debugging level)\n"
-"                 -h                  (print help and exit)\n"
-"                 -i                  (disable DNSSEC validation)\n"
-"                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
 "                 -q name             (specify query name)\n"
 "                 -t type             (specify query type)\n"
+"                 -c class            (option included for compatibility;\n"
 "                                      only IN is supported)\n"
-"                 -v                  (print version and exit)\n"
-"                 -x dot-notation     (shortcut for reverse lookups)\n"
+"                 -4                  (use IPv4 query transport only)\n"
+"                 -6                  (use IPv6 query transport only)\n"
+"                 -i                  (disable DNSSEC validation)\n"
+"                 -m                  (enable memory usage debugging)\n"
 "        d-opt    is of the form +keyword[=value], where keyword is:\n"
 "                 +[no]all            (Set or clear all display flags)\n"
 "                 +[no]class          (Control display of class)\n"
-"                 +[no]comments       (Control display of comment lines)\n"
 "                 +[no]crypto         (Control display of cryptographic\n"
 "                                      fields in records)\n"
-"                 +[no]dlv            (Obsolete)\n"
-"                 +[no]dnssec         (Display DNSSEC records)\n"
-"                 +[no]mtrace         (Trace messages received)\n"
 "                 +[no]multiline      (Print records in an expanded format)\n"
-"                 +[no]root           (DNSSEC validation trust anchor)\n"
+"                 +[no]comments       (Control display of comment lines)\n"
 "                 +[no]rrcomments     (Control display of per-record "
 				       "comments)\n"
-"                 +[no]rtrace         (Trace resolver fetches)\n"
+"                 +[no]unknownformat  (Print RDATA in RFC 3597 "
+					"\"unknown\" format)\n"
 "                 +[no]short          (Short form answer)\n"
 "                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
 "                 +[no]tcp            (TCP mode)\n"
 "                 +[no]ttl            (Control display of ttls in records)\n"
 "                 +[no]trust          (Control display of trust level)\n"
-"                 +[no]unknownformat  (Print RDATA in RFC 3597 "
-					"\"unknown\" format)\n"
+"                 +[no]rtrace         (Trace resolver fetches)\n"
+"                 +[no]mtrace         (Trace messages received)\n"
 "                 +[no]vtrace         (Trace validation process)\n"
-"                 +[no]yaml           (Present the results as YAML)\n",
+"                 +[no]dlv            (Obsolete)\n"
+"                 +[no]root           (DNSSEC validation trust anchor)\n"
+"                 +[no]dnssec         (Display DNSSEC records)\n"
+"        -h                           (print help and exit)\n"
+"        -v                           (print version and exit)\n",
 	stderr);
 	exit(1);
 }
@@ -498,17 +495,14 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 				dns_rdata_reset(&rdata);
 			}
 		} else {
-			dns_indent_t indent = { "  ", 2 };
 			if (!yaml && (rdataset->attributes &
 				      DNS_RDATASETATTR_NEGATIVE) != 0)
 			{
 				isc_buffer_putstr(&target, "; ");
 			}
+
 			result = dns_master_rdatasettotext(owner, rdataset,
-							   style,
-							   yaml ? &indent :
-								  NULL,
-							   &target);
+							   style, &target);
 		}
 
 		if (result == ISC_R_NOSPACE) {
@@ -540,6 +534,8 @@ setup_style(dns_master_style_t **stylep) {
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
 		styleflags |= DNS_STYLEFLAG_YAML;
+		dns_master_indentstr = "  ";
+		dns_master_indent = 2;
 	} else {
 		if (showcomments) {
 			styleflags |= DNS_STYLEFLAG_COMMENT;
@@ -612,12 +608,11 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 
 static isc_result_t
 key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
-	dns_rdata_dnskey_t dnskey;
-	dns_rdata_ds_t ds;
-	uint32_t rdata1, rdata2, rdata3;
-	const char *datastr = NULL, *keynamestr = NULL, *atstr = NULL;
-	unsigned char data[4096];
-	isc_buffer_t databuf;
+	dns_rdata_dnskey_t keystruct;
+	uint32_t flags, proto, alg;
+	const char *keystr, *keynamestr;
+	unsigned char keydata[4096];
+	isc_buffer_t keydatabuf;
 	unsigned char rrdata[4096];
 	isc_buffer_t rrdatabuf;
 	isc_region_t r;
@@ -625,13 +620,6 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	dns_name_t *keyname;
 	isc_result_t result;
 	bool match_root = false;
-	enum {
-		INITIAL_KEY,
-		STATIC_KEY,
-		INITIAL_DS,
-		STATIC_DS,
-		TRUSTED
-	} anchortype;
 
 	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));
@@ -654,118 +642,46 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 
 	delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s", trust_anchor);
 
-	/* if DNSKEY, flags; if DS, key tag */
-	rdata1 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata1"));
+	flags = cfg_obj_asuint32(cfg_tuple_get(key, "flags"));
+	proto = cfg_obj_asuint32(cfg_tuple_get(key, "protocol"));
+	alg = cfg_obj_asuint32(cfg_tuple_get(key, "algorithm"));
 
-	/* if DNSKEY, protocol; if DS, algorithm */
-	rdata2 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata2"));
+	keystruct.common.rdclass = dns_rdataclass_in;
+	keystruct.common.rdtype = dns_rdatatype_dnskey;
+	/*
+	 * The key data in keystruct is not dynamically allocated.
+	 */
+	keystruct.mctx = NULL;
 
-	/* if DNSKEY, algorithm; if DS, digest type */
-	rdata3 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata3"));
+	ISC_LINK_INIT(&keystruct.common, link);
 
-	/* What type of trust anchor is this? */
-	atstr = cfg_obj_asstring(cfg_tuple_get(key, "anchortype"));
-	if (strcasecmp(atstr, "static-key") == 0) {
-		anchortype = STATIC_KEY;
-	} else if (strcasecmp(atstr, "static-ds") == 0) {
-		anchortype = STATIC_DS;
-	} else if (strcasecmp(atstr, "initial-key") == 0) {
-		anchortype = INITIAL_KEY;
-	} else if (strcasecmp(atstr, "initial-ds") == 0) {
-		anchortype = INITIAL_DS;
-	} else {
-		delv_log(ISC_LOG_ERROR,
-			 "key '%s': invalid initialization method '%s'",
-			 keynamestr, atstr);
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
+	if (flags > 0xffff)
+		CHECK(ISC_R_RANGE);
+	if (proto > 0xff)
+		CHECK(ISC_R_RANGE);
+	if (alg > 0xff)
+		CHECK(ISC_R_RANGE);
 
-	isc_buffer_init(&databuf, data, sizeof(data));
+	keystruct.flags = (uint16_t)flags;
+	keystruct.protocol = (uint8_t)proto;
+	keystruct.algorithm = (uint8_t)alg;
+
+	isc_buffer_init(&keydatabuf, keydata, sizeof(keydata));
 	isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));
 
-	if (rdata1 > 0xffff) {
-		CHECK(ISC_R_RANGE);
-	}
-	if (rdata2 > 0xff) {
-		CHECK(ISC_R_RANGE);
-	}
-	if (rdata3 > 0xff) {
-		CHECK(ISC_R_RANGE);
-	}
+	keystr = cfg_obj_asstring(cfg_tuple_get(key, "key"));
+	CHECK(isc_base64_decodestring(keystr, &keydatabuf));
+	isc_buffer_usedregion(&keydatabuf, &r);
+	keystruct.datalen = r.length;
+	keystruct.data = r.base;
 
-	switch (anchortype) {
-	case STATIC_KEY:
-	case INITIAL_KEY:
-	case TRUSTED:
-		dnskey.common.rdclass = dns_rdataclass_in;
-		dnskey.common.rdtype = dns_rdatatype_dnskey;
-		dnskey.mctx = NULL;
-
-		ISC_LINK_INIT(&dnskey.common, link);
-
-		dnskey.flags = (uint16_t)rdata1;
-		dnskey.protocol = (uint8_t)rdata2;
-		dnskey.algorithm = (uint8_t)rdata3;
-
-		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
-		CHECK(isc_base64_decodestring(datastr, &databuf));
-		isc_buffer_usedregion(&databuf, &r);
-		dnskey.datalen = r.length;
-		dnskey.data = r.base;
-
-		CHECK(dns_rdata_fromstruct(NULL, dnskey.common.rdclass,
-					   dnskey.common.rdtype,
-					   &dnskey, &rrdatabuf));
-		CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
-					       dns_rdatatype_dnskey,
-					       keyname, &rrdatabuf));
-		break;
-	case INITIAL_DS:
-	case STATIC_DS:
-		ds.common.rdclass = dns_rdataclass_in;
-		ds.common.rdtype = dns_rdatatype_ds;
-		ds.mctx = NULL;
-
-		ISC_LINK_INIT(&ds.common, link);
-
-		ds.key_tag = (uint16_t)rdata1;
-		ds.algorithm = (uint8_t)rdata2;
-		ds.digest_type = (uint8_t)rdata3;
-
-		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
-		CHECK(isc_hex_decodestring(datastr, &databuf));
-		isc_buffer_usedregion(&databuf, &r);
-
-		switch (ds.digest_type) {
-		case DNS_DSDIGEST_SHA1:
-			if (r.length != ISC_SHA1_DIGESTLENGTH) {
-				CHECK(ISC_R_UNEXPECTEDEND);
-			}
-			break;
-		case DNS_DSDIGEST_SHA256:
-			if (r.length != ISC_SHA256_DIGESTLENGTH) {
-				CHECK(ISC_R_UNEXPECTEDEND);
-			}
-			break;
-		case DNS_DSDIGEST_SHA384:
-			if (r.length != ISC_SHA384_DIGESTLENGTH) {
-				CHECK(ISC_R_UNEXPECTEDEND);
-			}
-			break;
-		}
-
-		ds.length = r.length;
-		ds.digest = r.base;
-
-		CHECK(dns_rdata_fromstruct(NULL, ds.common.rdclass,
-					   ds.common.rdtype,
-					   &ds, &rrdatabuf));
-		CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
-					       dns_rdatatype_ds,
-					       keyname, &rrdatabuf));
-	};
+	CHECK(dns_rdata_fromstruct(NULL,
+				   keystruct.common.rdclass,
+				   keystruct.common.rdtype,
+				   &keystruct, &rrdatabuf));
 
+	CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
+				       keyname, &rrdatabuf));
 	num_keys++;
 
  cleanup:
@@ -819,7 +735,7 @@ setup_dnsseckeys(dns_client_t *client) {
 	cfg_parser_t *parser = NULL;
 	const cfg_obj_t *trusted_keys = NULL;
 	const cfg_obj_t *managed_keys = NULL;
-	const cfg_obj_t *trust_anchors = NULL;
+	const cfg_obj_t *dnssec_keys = NULL;
 	cfg_obj_t *bindkeys = NULL;
 	const char *filename = anchorfile;
 
@@ -878,7 +794,7 @@ setup_dnsseckeys(dns_client_t *client) {
 	INSIST(bindkeys != NULL);
 	cfg_map_get(bindkeys, "trusted-keys", &trusted_keys);
 	cfg_map_get(bindkeys, "managed-keys", &managed_keys);
-	cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
+	cfg_map_get(bindkeys, "dnssec-keys", &dnssec_keys);
 
 	if (trusted_keys != NULL) {
 		CHECK(load_keys(trusted_keys, client));
@@ -886,8 +802,8 @@ setup_dnsseckeys(dns_client_t *client) {
 	if (managed_keys != NULL) {
 		CHECK(load_keys(managed_keys, client));
 	}
-	if (trust_anchors != NULL) {
-		CHECK(load_keys(trust_anchors, client));
+	if (dnssec_keys != NULL) {
+		CHECK(load_keys(dnssec_keys, client));
 	}
 	result = ISC_R_SUCCESS;
 

bin/delv/delv.docbook

@@ -215,7 +215,7 @@
 	  </para>
 	  <para>
 	    Note: When reading the trust anchor file,
-	    <command>delv</command> treats <option>trust-anchors</option>
+	    <command>delv</command> treats <option>dnssec-keys</option>
 	    <option>initial-key</option> and <option>static-key</option>
 	    entries identically.  That is, even if a key is configured
 	    with <command>initial-key</command>, indicating that it is

bin/dig/dig.c

@@ -239,7 +239,6 @@ help(void) {
 "                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" "
 					"format)\n"
 "                 +[no]vc             (TCP mode (+[no]tcp))\n"
-"                 +[no]yaml           (Present the results as YAML)\n"
 "                 +[no]zflag          (Set Z flag in query)\n"
 "        global d-opts and servers (before host name) affect all queries.\n"
 "        local d-opts and servers (after host name) affect only that lookup.\n"
@@ -487,8 +486,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
 
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
-		msg->indent.string = "  ";
-		msg->indent.count = 3;
+		dns_master_indentstr = "  ";
+		dns_master_indent = 3;
 		styleflags |= DNS_STYLEFLAG_YAML;
 	} else {
 		if (query->lookup->comments) {

bin/dig/dighost.c

@@ -4252,6 +4252,7 @@ destroy_libs(void) {
 	result = dns_name_settotextfilter(NULL);
 	check_result(result, "dns_name_settotextfilter");
 #endif /* HAVE_LIBIDN2 */
+	dns_name_destroy();
 
 	if (commctx != NULL) {
 		debug("freeing commctx");

bin/dnssec/Makefile.in

@@ -15,26 +15,24 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} \
 		${OPENSSL_CFLAGS}
 
-CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
+CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =
 
 DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
 
 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
-ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
 
-DEPLIBS =	${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}
+DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
 
-LIBS =		${DNSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @LIBS@
+LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
 
-NOSYMLIBS =	${DNSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
+NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
 
 # Alphabetically
 TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
@@ -50,7 +48,7 @@ SRCS =		dnssec-cds.c dnssec-dsfromkey.c dnssec-importkey.c \
 		dnssec-settime.c dnssec-signzone.c dnssec-verify.c \
 		dnssectool.c
 
-MANPAGES =	dnssec-cds.8 dnssec-dsfromkey.8 dnssec-importkey.8 \
+MANPAGES =	dnssec-cds.8 dnssec-dsfromkey.8  dnssec-importkey.8 \
 		dnssec-keyfromlabel.8 dnssec-keygen.8 dnssec-revoke.8 \
 		dnssec-settime.8 dnssec-signzone.8 dnssec-verify.8
 

bin/dnssec/dnssec-cds.c

@@ -372,7 +372,7 @@ formatset(dns_rdataset_t *rdataset) {
 
 	result = isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
 	check_result(result, "printing DS records");
-	result = dns_master_rdatasettotext(name, rdataset, style, NULL, buf);
+	result = dns_master_rdatasettotext(name, rdataset, style, buf);
 
 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
 		result = ISC_R_NOSPACE;

bin/dnssec/dnssec-dsfromkey.c

@@ -517,6 +517,7 @@ main(int argc, char **argv) {
 	}
 	cleanup_logging(&log);
 	dst_lib_destroy();
+	dns_name_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}

bin/dnssec/dnssec-importkey.c

@@ -439,6 +439,7 @@ main(int argc, char **argv) {
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
 	dst_lib_destroy();
+	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);

bin/dnssec/dnssec-keyfromlabel.c

@@ -694,6 +694,7 @@ main(int argc, char **argv) {
 
 	cleanup_logging(&log);
 	dst_lib_destroy();
+	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_free(mctx, label);

bin/dnssec/dnssec-keygen.8

@@ -39,7 +39,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-d\ \fR\fB\fIbits\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIpolicy\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-l\ \fR\fB\fIfile\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-T\ \fR\fB\fIrrtype\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -109,11 +109,6 @@ option suppresses them\&.
 Indicates that the DNS record containing the key should have the specified class\&. If not specified, class IN is used\&.
 .RE
 .PP
-\-d \fIbits\fR
-.RS 4
-Key size in bits\&. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256 and RSASHA512 the key size must be in range 1024\-4096\&. DH size is between 128 and 4096\&. This option is ignored for algorithms ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448\&.
-.RE
-.PP
 \-E \fIengine\fR
 .RS 4
 Specifies the cryptographic hardware to use, when applicable\&.
@@ -147,17 +142,6 @@ Prints a short summary of the options and arguments to
 Sets the directory in which the key files are to be written\&.
 .RE
 .PP
-\-k \fIpolicy\fR
-.RS 4
-Create keys for a specific dnssec\-policy\&. If a policy uses multiple keys,
-\fBdnssec\-keygen\fR
-will generate multiple keys\&. This will also create a "\&.state" file to keep track of the key state\&.
-.sp
-This option creates keys according to the dnssec\-policy configuration, hence it cannot be used together with many of the other options that
-\fBdnssec\-keygen\fR
-provides\&.
-.RE
-.PP
 \-L \fIttl\fR
 .RS 4
 Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL\&. Setting the default TTL to
@@ -167,12 +151,6 @@ none
 is the same as leaving it unset\&.
 .RE
 .PP
-\-l \fIfile\fR
-.RS 4
-Provide a configuration file that contains a dnssec\-policy statement (matching the policy set with
-\fB\-k\fR)\&.
-.RE
-.PP
 \-n \fInametype\fR
 .RS 4
 Specifies the owner type of the key\&. The value of

bin/dnssec/dnssec-keygen.docbook

@@ -66,7 +66,6 @@
       <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">bits</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">flag</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-G</option></arg>
@@ -75,9 +74,8 @@
       <arg choice="opt" rep="norepeat"><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-k <replaceable class="parameter">policy</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-k</option></arg>
       <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">file</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
@@ -86,7 +84,6 @@
       <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">rrtype</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
       <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
@@ -210,18 +207,6 @@
 	</listitem>
       </varlistentry>
 
-      <varlistentry>
-	<term>-d <replaceable class="parameter">bits</replaceable></term>
-	<listitem>
-	  <para>
-	    Key size in bits. For the algorithms RSASHA1, NSEC3RSASA1,
-	    RSASHA256 and RSASHA512 the key size must be in range 1024-4096.
-	    DH size is between 128 and 4096. This option is ignored for
-	    algorithms ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448.
-	  </para>
-	</listitem>
-      </varlistentry>
-
       <varlistentry>
 	<term>-E <replaceable class="parameter">engine</replaceable></term>
 	<listitem>
@@ -290,24 +275,6 @@
 	</listitem>
       </varlistentry>
 
-      <varlistentry>
-	<term>-k <replaceable class="parameter">policy</replaceable></term>
-	<listitem>
-	  <para>
-	    Create keys for a specific dnssec-policy.  If a policy uses
-	    multiple keys, <command>dnssec-keygen</command> will generate
-	    multiple keys.  This will also create a ".state" file to keep
-	    track of the key state.
-	  </para>
-	  <para>
-	    This option creates keys according to the dnssec-policy
-	    configuration, hence it cannot be used together with many of
-	    the other options that <command>dnssec-keygen</command>
-	    provides.
-	  </para>
-	</listitem>
-      </varlistentry>
-
       <varlistentry>
 	<term>-L <replaceable class="parameter">ttl</replaceable></term>
 	<listitem>
@@ -324,16 +291,6 @@
 	</listitem>
       </varlistentry>
 
-      <varlistentry>
-	<term>-l <replaceable class="parameter">file</replaceable></term>
-	<listitem>
-	  <para>
-	    Provide a configuration file that contains a dnssec-policy
-	    statement (matching the policy set with <command>-k</command>).
-	  </para>
-	</listitem>
-      </varlistentry>
-
       <varlistentry>
 	<term>-n <replaceable class="parameter">nametype</replaceable></term>
 	<listitem>

bin/dnssec/dnssec-keygen.html

@@ -41,7 +41,6 @@
        [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
        [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
        [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>]
-       [<code class="option">-d <em class="replaceable"><code>bits</code></em></code>]
        [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
        [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>]
        [<code class="option">-G</code>]
@@ -50,9 +49,8 @@
        [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>]
        [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>]
        [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
-       [<code class="option">-k <em class="replaceable"><code>policy</code></em></code>]
+       [<code class="option">-k</code>]
        [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
-       [<code class="option">-l <em class="replaceable"><code>file</code></em></code>]
        [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
        [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
        [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>]
@@ -61,7 +59,6 @@
        [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>]
        [<code class="option">-S <em class="replaceable"><code>key</code></em></code>]
        [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>]
-       [<code class="option">-T <em class="replaceable"><code>rrtype</code></em></code>]
        [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
        [<code class="option">-V</code>]
        [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
@@ -171,15 +168,6 @@
 	    the specified class.  If not specified, class IN is used.
 	  </p>
 	</dd>
-<dt><span class="term">-d <em class="replaceable"><code>bits</code></em></span></dt>
-<dd>
-	  <p>
-	    Key size in bits. For the algorithms RSASHA1, NSEC3RSASA1,
-	    RSASHA256 and RSASHA512 the key size must be in range 1024-4096.
-	    DH size is between 128 and 4096. This option is ignored for
-	    algorithms ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448.
-	  </p>
-	</dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
 <dd>
 	  <p>
@@ -230,21 +218,6 @@
 	    Sets the directory in which the key files are to be written.
 	  </p>
 	</dd>
-<dt><span class="term">-k <em class="replaceable"><code>policy</code></em></span></dt>
-<dd>
-	  <p>
-	    Create keys for a specific dnssec-policy.  If a policy uses
-	    multiple keys, <span class="command"><strong>dnssec-keygen</strong></span> will generate
-	    multiple keys.  This will also create a ".state" file to keep
-	    track of the key state.
-	  </p>
-	  <p>
-	    This option creates keys according to the dnssec-policy
-	    configuration, hence it cannot be used together with many of
-	    the other options that <span class="command"><strong>dnssec-keygen</strong></span>
-	    provides.
-	  </p>
-	</dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
 <dd>
 	  <p>
@@ -258,13 +231,6 @@
 	    or <code class="literal">none</code> is the same as leaving it unset.
 	  </p>
 	</dd>
-<dt><span class="term">-l <em class="replaceable"><code>file</code></em></span></dt>
-<dd>
-	  <p>
-	    Provide a configuration file that contains a dnssec-policy
-	    statement (matching the policy set with <span class="command"><strong>-k</strong></span>).
-	  </p>
-	</dd>
 <dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
 <dd>
 	  <p>

bin/dnssec/dnssec-settime.8

@@ -39,7 +39,7 @@
 dnssec-settime \- set the key timing metadata for a DNSSEC key
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-settime\fR\ 'u
-\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-h\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-s\fR] [\fB\-g\ \fR\fB\fIstate\fR\fR] [\fB\-d\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] [\fB\-k\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] [\fB\-z\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] {keyfile}
+\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-h\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-settime\fR
@@ -59,25 +59,7 @@ simply prints the key timing metadata already stored in the key\&.
 .PP
 When key metadata fields are changed, both files of a key pair (Knnnn\&.+aaa+iiiii\&.key
 and
-Knnnn\&.+aaa+iiiii\&.private) are regenerated\&.
-.PP
-Metadata fields are stored in the private file\&. A human\-readable description of the metadata is also placed in comments in the key file\&. The private file\*(Aqs permissions are always set to be inaccessible to anyone other than the owner (mode 0600)\&.
-.PP
-When working with state files, it is possible to update the timing metadata in those files as well with
-\fB\-s\fR\&. If this option is used you can also update key states with
-\fB\-d\fR
-(DS),
-\fB\-k\fR
-(DNSKEY),
-\fB\-r\fR
-(RRSIG of KSK), or
-\fB\-z\fR
-(RRSIG of ZSK)\&. Allowed states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE\&.
-.PP
-You can also set the goal state of the key with
-\fB\-g\fR\&. This should be either HIDDEN or OMNIPRESENT (representing whether the key should be removed from the zone, or published)\&.
-.PP
-It is NOT RECOMMENDED to manipulate state files manually except for testing purposes\&.
+Knnnn\&.+aaa+iiiii\&.private) are regenerated\&. Metadata fields are stored in the private file\&. A human\-readable description of the metadata is also placed in comments in the key file\&. The private file\*(Aqs permissions are always set to be inaccessible to anyone other than the owner (mode 0600)\&.
 .SH "OPTIONS"
 .PP
 \-f
@@ -174,39 +156,6 @@ If the key is being set to be an explicit successor to another key, then the def
 .sp
 As with date offsets, if the argument is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the interval is measured in years, months, weeks, days, hours, or minutes, respectively\&. Without a suffix, the interval is measured in seconds\&.
 .RE
-.SH "KEY STATE OPTIONS"
-.PP
-Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE\&. These should not be set manually except for testing purposes\&.
-.PP
-\-s
-.RS 4
-When setting key timing data, also update the state file\&.
-.RE
-.PP
-\-g
-.RS 4
-Set the goal state for this key\&. Must be HIDDEN or OMNIPRESENT\&.
-.RE
-.PP
-\-d
-.RS 4
-Set the DS state for this key, and when it was last changed\&.
-.RE
-.PP
-\-k
-.RS 4
-Set the DNSKEY state for this key, and when it was last changed\&.
-.RE
-.PP
-\-r
-.RS 4
-Set the RRSIG (KSK) state for this key, and when it was last changed\&.
-.RE
-.PP
-\-z
-.RS 4
-Set the RRSIG (ZSK) state for this key, and when it was last changed\&.
-.RE
 .SH "PRINTING OPTIONS"
 .PP
 \fBdnssec\-settime\fR

bin/dnssec/dnssec-settime.c

@@ -88,15 +88,6 @@ usage(void) {
 	fprintf(stderr, "    -i <interval>: prepublication interval for "
 					   "successor key "
 					   "(default: 30 days)\n");
-	fprintf(stderr, "Key state options:\n");
-	fprintf(stderr, "    -s: update key state file (default no)\n");
-	fprintf(stderr, "    -g state: set the goal state for this key\n");
-	fprintf(stderr, "    -d state date/[+-]offset: set the DS state\n");
-	fprintf(stderr, "    -k state date/[+-]offset: set the DNSKEY state\n");
-	fprintf(stderr, "    -r state date/[+-]offset: set the RRSIG (KSK) "
-						      "state\n");
-	fprintf(stderr, "    -z state date/[+-]offset: set the RRSIG (ZSK) "
-						      "state\n");
 	fprintf(stderr, "Printing options:\n");
 	fprintf(stderr, "    -p C/P/Psync/A/R/I/D/Dsync/all: print a "
 					"particular time value or values\n");
@@ -132,87 +123,29 @@ printtime(dst_key_t *key, int type, const char *tag, bool epoch,
 	}
 }
 
-static void
-writekey(dst_key_t *key, const char *directory, bool write_state)
-{
-	char newname[1024];
-	char keystr[DST_KEY_FORMATSIZE];
-	isc_buffer_t buf;
-	isc_result_t result;
-	int options = DST_TYPE_PUBLIC|DST_TYPE_PRIVATE;
-
-	if (write_state) {
-		options |= DST_TYPE_STATE;
-	}
-
-	isc_buffer_init(&buf, newname, sizeof(newname));
-	result = dst_key_buildfilename(key, DST_TYPE_PUBLIC, directory, &buf);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Failed to build public key filename: %s",
-		      isc_result_totext(result));
-	}
-
-	result = dst_key_tofile(key, options, directory);
-	if (result != ISC_R_SUCCESS) {
-		dst_key_format(key, keystr, sizeof(keystr));
-		fatal("Failed to write key %s: %s", keystr,
-		      isc_result_totext(result));
-	}
-	printf("%s\n", newname);
-
-	isc_buffer_clear(&buf);
-	result = dst_key_buildfilename(key, DST_TYPE_PRIVATE, directory, &buf);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Failed to build private key filename: %s",
-		      isc_result_totext(result));
-	}
-	printf("%s\n", newname);
-
-	if (write_state) {
-		isc_buffer_clear(&buf);
-		result = dst_key_buildfilename(key, DST_TYPE_STATE, directory,
-					       &buf);
-		if (result != ISC_R_SUCCESS) {
-			fatal("Failed to build key state filename: %s",
-			      isc_result_totext(result));
-		}
-		printf("%s\n", newname);
-	}
-}
-
 int
 main(int argc, char **argv) {
 	isc_result_t	result;
 	const char	*engine = NULL;
 	const char 	*filename = NULL;
 	char		*directory = NULL;
+	char		newname[1024];
 	char		keystr[DST_KEY_FORMATSIZE];
 	char		*endp, *p;
 	int		ch;
 	const char	*predecessor = NULL;
 	dst_key_t	*prevkey = NULL;
 	dst_key_t	*key = NULL;
+	isc_buffer_t	buf;
 	dns_name_t	*name = NULL;
 	dns_secalg_t 	alg = 0;
 	unsigned int 	size = 0;
 	uint16_t	flags = 0;
 	int		prepub = -1;
-	int		options;
 	dns_ttl_t	ttl = 0;
 	isc_stdtime_t	now;
-	isc_stdtime_t	dstime = 0, dnskeytime = 0;
-	isc_stdtime_t	krrsigtime = 0, zrrsigtime = 0;
 	isc_stdtime_t	pub = 0, act = 0, rev = 0, inact = 0, del = 0;
 	isc_stdtime_t	prevact = 0, previnact = 0, prevdel = 0;
-	dst_key_state_t	goal = DST_KEY_STATE_NA;
-	dst_key_state_t	ds = DST_KEY_STATE_NA;
-	dst_key_state_t	dnskey = DST_KEY_STATE_NA;
-	dst_key_state_t	krrsig = DST_KEY_STATE_NA;
-	dst_key_state_t	zrrsig = DST_KEY_STATE_NA;
-	bool	setgoal = false, setds = false, setdnskey = false;
-	bool	setkrrsig = false, setzrrsig = false;
-	bool	setdstime = false, setdnskeytime = false;
-	bool	setkrrsigtime = false, setzrrsigtime = false;
 	bool	setpub = false, setact = false;
 	bool	setrev = false, setinact = false;
 	bool	setdel = false, setttl = false;
@@ -223,17 +156,14 @@ main(int argc, char **argv) {
 	bool	printact = false,  printrev = false;
 	bool	printinact = false, printdel = false;
 	bool	force = false;
-	bool	epoch = false;
-	bool	changed = false;
-	bool	write_state = false;
+	bool   epoch = false;
+	bool   changed = false;
 	isc_log_t       *log = NULL;
 	isc_stdtime_t	syncadd = 0, syncdel = 0;
 	bool	unsetsyncadd = false, setsyncadd = false;
 	bool	unsetsyncdel = false, setsyncdel = false;
 	bool	printsyncadd = false, printsyncdel = false;
 
-	options = DST_TYPE_PUBLIC|DST_TYPE_PRIVATE|DST_TYPE_STATE;
-
 	if (argc == 1)
 		usage();
 
@@ -250,9 +180,109 @@ main(int argc, char **argv) {
 
 	isc_stdtime_get(&now);
 
-#define CMDLINE_FLAGS "A:D:d:E:fg:hI:i:K:k:L:P:p:R:r:S:suv:Vz:"
+#define CMDLINE_FLAGS "A:D:E:fhI:i:K:L:P:p:R:S:uv:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
+		case 'E':
+			engine = isc_commandline_argument;
+			break;
+		case 'f':
+			force = true;
+			break;
+		case 'p':
+			p = isc_commandline_argument;
+			if (!strcasecmp(p, "all")) {
+				printcreate = true;
+				printpub = true;
+				printact = true;
+				printrev = true;
+				printinact = true;
+				printdel = true;
+				printsyncadd = true;
+				printsyncdel = true;
+				break;
+			}
+
+			do {
+				switch (*p++) {
+				case 'C':
+					printcreate = true;
+					break;
+				case 'P':
+					if (!strncmp(p, "sync", 4)) {
+						p += 4;
+						printsyncadd = true;
+						break;
+					}
+					printpub = true;
+					break;
+				case 'A':
+					printact = true;
+					break;
+				case 'R':
+					printrev = true;
+					break;
+				case 'I':
+					printinact = true;
+					break;
+				case 'D':
+					if (!strncmp(p, "sync", 4)) {
+						p += 4;
+						printsyncdel = true;
+						break;
+					}
+					printdel = true;
+					break;
+				case ' ':
+					break;
+				default:
+					usage();
+					break;
+				}
+			} while (*p != '\0');
+			break;
+		case 'u':
+			epoch = true;
+			break;
+		case 'K':
+			/*
+			 * We don't have to copy it here, but do it to
+			 * simplify cleanup later
+			 */
+			directory = isc_mem_strdup(mctx,
+						   isc_commandline_argument);
+			break;
+		case 'L':
+			ttl = strtottl(isc_commandline_argument);
+			setttl = true;
+			break;
+		case 'v':
+			verbose = strtol(isc_commandline_argument, &endp, 0);
+			if (*endp != '\0')
+				fatal("-v must be followed by a number");
+			break;
+		case 'P':
+			/* -Psync ? */
+			if (isoptarg("sync", argv, usage)) {
+				if (unsetsyncadd || setsyncadd)
+					fatal("-P sync specified more than "
+					      "once");
+
+				changed = true;
+				syncadd = strtotime(isc_commandline_argument,
+						   now, now, &setsyncadd);
+				unsetsyncadd = !setsyncadd;
+				break;
+			}
+			(void)isoptarg("dnskey", argv, usage);
+			if (setpub || unsetpub)
+				fatal("-P specified more than once");
+
+			changed = true;
+			pub = strtotime(isc_commandline_argument,
+					now, now, &setpub);
+			unsetpub = !setpub;
+			break;
 		case 'A':
 			if (setact || unsetact)
 				fatal("-A specified more than once");
@@ -262,6 +292,24 @@ main(int argc, char **argv) {
 					now, now, &setact);
 			unsetact = !setact;
 			break;
+		case 'R':
+			if (setrev || unsetrev)
+				fatal("-R specified more than once");
+
+			changed = true;
+			rev = strtotime(isc_commandline_argument,
+					now, now, &setrev);
+			unsetrev = !setrev;
+			break;
+		case 'I':
+			if (setinact || unsetinact)
+				fatal("-I specified more than once");
+
+			changed = true;
+			inact = strtotime(isc_commandline_argument,
+					now, now, &setinact);
+			unsetinact = !setinact;
+			break;
 		case 'D':
 			/* -Dsync ? */
 			if (isoptarg("sync", argv, usage)) {
@@ -285,37 +333,11 @@ main(int argc, char **argv) {
 					now, now, &setdel);
 			unsetdel = !setdel;
 			break;
-		case 'd':
-			if (setds) {
-				fatal("-d specified more than once");
-			}
-
-			ds = strtokeystate(isc_commandline_argument);
-			setds = true;
-			/* time */
-			(void)isoptarg(isc_commandline_argument, argv, usage);
-			dstime = strtotime(isc_commandline_argument,
-					   now, now, &setdstime);
+		case 'S':
+			predecessor = isc_commandline_argument;
 			break;
-		case 'E':
-			engine = isc_commandline_argument;
-			break;
-		case 'f':
-			force = true;
-			break;
-		case 'g':
-			if (setgoal) {
-				fatal("-g specified more than once");
-			}
-
-			goal = strtokeystate(isc_commandline_argument);
-			if (goal != DST_KEY_STATE_NA &&
-			    goal != DST_KEY_STATE_HIDDEN &&
-			    goal != DST_KEY_STATE_OMNIPRESENT) {
-				fatal("-g must be either none, hidden, or "
-				      "omnipresent");
-			}
-			setgoal = true;
+		case 'i':
+			prepub = strtottl(isc_commandline_argument);
 			break;
 		case '?':
 			if (isc_commandline_option != '?')
@@ -325,165 +347,10 @@ main(int argc, char **argv) {
 		case 'h':
 			/* Does not return. */
 			usage();
-		case 'I':
-			if (setinact || unsetinact)
-				fatal("-I specified more than once");
 
-			changed = true;
-			inact = strtotime(isc_commandline_argument,
-					now, now, &setinact);
-			unsetinact = !setinact;
-			break;
-		case 'i':
-			prepub = strtottl(isc_commandline_argument);
-			break;
-		case 'K':
-			/*
-			 * We don't have to copy it here, but do it to
-			 * simplify cleanup later
-			 */
-			directory = isc_mem_strdup(mctx,
-						   isc_commandline_argument);
-			break;
-		case 'k':
-			if (setdnskey) {
-				fatal("-k specified more than once");
-			}
-
-			dnskey = strtokeystate(isc_commandline_argument);
-			setdnskey = true;
-			/* time */
-			(void)isoptarg(isc_commandline_argument, argv, usage);
-			dnskeytime = strtotime(isc_commandline_argument,
-					       now, now, &setdnskeytime);
-			break;
-		case 'L':
-			ttl = strtottl(isc_commandline_argument);
-			setttl = true;
-			break;
-		case 'P':
-			/* -Psync ? */
-			if (isoptarg("sync", argv, usage)) {
-				if (unsetsyncadd || setsyncadd)
-					fatal("-P sync specified more than "
-					      "once");
-
-				changed = true;
-				syncadd = strtotime(isc_commandline_argument,
-						   now, now, &setsyncadd);
-				unsetsyncadd = !setsyncadd;
-				break;
-			}
-			(void)isoptarg("dnskey", argv, usage);
-			if (setpub || unsetpub)
-				fatal("-P specified more than once");
-
-			changed = true;
-			pub = strtotime(isc_commandline_argument,
-					now, now, &setpub);
-			unsetpub = !setpub;
-			break;
-		case 'p':
-			p = isc_commandline_argument;
-			if (!strcasecmp(p, "all")) {
-				printcreate = true;
-				printpub = true;
-				printact = true;
-				printrev = true;
-				printinact = true;
-				printdel = true;
-				printsyncadd = true;
-				printsyncdel = true;
-				break;
-			}
-
-			do {
-				switch (*p++) {
-				case 'A':
-					printact = true;
-					break;
-				case 'C':
-					printcreate = true;
-					break;
-				case 'D':
-					if (!strncmp(p, "sync", 4)) {
-						p += 4;
-						printsyncdel = true;
-						break;
-					}
-					printdel = true;
-					break;
-				case 'I':
-					printinact = true;
-					break;
-				case 'P':
-					if (!strncmp(p, "sync", 4)) {
-						p += 4;
-						printsyncadd = true;
-						break;
-					}
-					printpub = true;
-					break;
-				case 'R':
-					printrev = true;
-					break;
-				case ' ':
-					break;
-				default:
-					usage();
-					break;
-				}
-			} while (*p != '\0');
-			break;
-		case 'R':
-			if (setrev || unsetrev)
-				fatal("-R specified more than once");
-
-			changed = true;
-			rev = strtotime(isc_commandline_argument,
-					now, now, &setrev);
-			unsetrev = !setrev;
-			break;
-		case 'r':
-			if (setkrrsig) {
-				fatal("-r specified more than once");
-			}
-
-			krrsig = strtokeystate(isc_commandline_argument);
-			setkrrsig = true;
-			/* time */
-			(void)isoptarg(isc_commandline_argument, argv, usage);
-			krrsigtime = strtotime(isc_commandline_argument,
-					       now, now, &setkrrsigtime);
-			break;
-		case 'S':
-			predecessor = isc_commandline_argument;
-			break;
-		case 's':
-			write_state = true;
-			break;
-		case 'u':
-			epoch = true;
-			break;
 		case 'V':
 			/* Does not return. */
 			version(program);
-		case 'v':
-			verbose = strtol(isc_commandline_argument, &endp, 0);
-			if (*endp != '\0')
-				fatal("-v must be followed by a number");
-			break;
-		case 'z':
-			if (setzrrsig) {
-				fatal("-z specified more than once");
-			}
-
-			zrrsig = strtokeystate(isc_commandline_argument);
-			setzrrsig = true;
-			(void)isoptarg(isc_commandline_argument, argv, usage);
-			zrrsigtime = strtotime(isc_commandline_argument,
-					       now, now, &setzrrsigtime);
-			break;
 
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n",
@@ -498,12 +365,6 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("Extraneous arguments");
 
-	if ((setgoal || setds || setdnskey || setkrrsig || setzrrsig) &&
-	    !write_state)
-	{
-		fatal("Options -g, -d, -k, -r and -z require -s to be set");
-	}
-
 	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS)
 		fatal("Could not initialize dst: %s",
@@ -520,7 +381,9 @@ main(int argc, char **argv) {
 		if (setact || unsetact)
 			fatal("-S and -A cannot be used together");
 
-		result = dst_key_fromnamedfile(predecessor, directory, options,
+		result = dst_key_fromnamedfile(predecessor, directory,
+					       DST_TYPE_PUBLIC |
+					       DST_TYPE_PRIVATE,
 					       mctx, &prevkey);
 		if (result != ISC_R_SUCCESS)
 			fatal("Invalid keyfile %s: %s",
@@ -612,8 +475,9 @@ main(int argc, char **argv) {
 			      isc_result_totext(result));
 	}
 
-	result = dst_key_fromnamedfile(filename, directory, options, mctx,
-				       &key);
+	result = dst_key_fromnamedfile(filename, directory,
+				       DST_TYPE_PUBLIC | DST_TYPE_PRIVATE,
+				       mctx, &key);
 	if (result != ISC_R_SUCCESS)
 		fatal("Invalid keyfile %s: %s",
 		      filename, isc_result_totext(result));
@@ -714,11 +578,6 @@ main(int argc, char **argv) {
 	if (setttl)
 		dst_key_setttl(key, ttl);
 
-	if (predecessor != NULL && prevkey != NULL) {
-		dst_key_setnum(prevkey, DST_NUM_SUCCESSOR, dst_key_id(key));
-		dst_key_setnum(key, DST_NUM_PREDECESSOR, dst_key_id(prevkey));
-	}
-
 	/*
 	 * No metadata changes were made but we're forcing an upgrade
 	 * to the new format anyway: use "-P now -A now" as the default
@@ -729,63 +588,6 @@ main(int argc, char **argv) {
 		changed = true;
 	}
 
-	/*
-	 * Make sure the key state goals are written.
-	 */
-	if (write_state) {
-		if (setgoal) {
-			if (goal == DST_KEY_STATE_NA) {
-				dst_key_unsetstate(key, DST_KEY_GOAL);
-			} else {
-				dst_key_setstate(key, DST_KEY_GOAL, goal);
-			}
-			changed = true;
-		}
-		if (setds) {
-			if (ds == DST_KEY_STATE_NA) {
-				dst_key_unsetstate(key, DST_KEY_DS);
-				dst_key_unsettime(key, DST_TIME_DS);
-			} else {
-				dst_key_setstate(key, DST_KEY_DS, ds);
-				dst_key_settime(key, DST_TIME_DS, dstime);
-			}
-			changed = true;
-		}
-		if (setdnskey) {
-			if (dnskey == DST_KEY_STATE_NA) {
-				dst_key_unsetstate(key, DST_KEY_DNSKEY);
-				dst_key_unsettime(key, DST_TIME_DNSKEY);
-			} else {
-				dst_key_setstate(key, DST_KEY_DNSKEY, dnskey);
-				dst_key_settime(key, DST_TIME_DNSKEY,
-						dnskeytime);
-			}
-			changed = true;
-		}
-		if (setkrrsig) {
-			if (krrsig == DST_KEY_STATE_NA) {
-				dst_key_unsetstate(key, DST_KEY_KRRSIG);
-				dst_key_unsettime(key, DST_TIME_KRRSIG);
-			} else {
-				dst_key_setstate(key, DST_KEY_KRRSIG, krrsig);
-				dst_key_settime(key, DST_TIME_KRRSIG,
-						krrsigtime);
-			}
-			changed = true;
-		}
-		if (setzrrsig) {
-			if (zrrsig == DST_KEY_STATE_NA) {
-				dst_key_unsetstate(key, DST_KEY_ZRRSIG);
-				dst_key_unsettime(key, DST_TIME_ZRRSIG);
-			} else {
-				dst_key_setstate(key, DST_KEY_ZRRSIG, zrrsig);
-				dst_key_settime(key, DST_TIME_ZRRSIG,
-						zrrsigtime);
-			}
-			changed = true;
-		}
-	}
-
 	if (!changed && setttl)
 		changed = true;
 
@@ -819,10 +621,32 @@ main(int argc, char **argv) {
 			  epoch, stdout);
 
 	if (changed) {
-		writekey(key, directory, write_state);
-		if (predecessor != NULL && prevkey != NULL) {
-			writekey(prevkey, directory, write_state);
+		isc_buffer_init(&buf, newname, sizeof(newname));
+		result = dst_key_buildfilename(key, DST_TYPE_PUBLIC, directory,
+					       &buf);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Failed to build public key filename: %s",
+			      isc_result_totext(result));
 		}
+
+		result = dst_key_tofile(key, DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
+					directory);
+		if (result != ISC_R_SUCCESS) {
+			dst_key_format(key, keystr, sizeof(keystr));
+			fatal("Failed to write key %s: %s", keystr,
+			      isc_result_totext(result));
+		}
+
+		printf("%s\n", newname);
+
+		isc_buffer_clear(&buf);
+		result = dst_key_buildfilename(key, DST_TYPE_PRIVATE, directory,
+					       &buf);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Failed to build private key filename: %s",
+			      isc_result_totext(result));
+		}
+		printf("%s\n", newname);
 	}
 
 	if (prevkey != NULL)

bin/dnssec/dnssec-settime.docbook

@@ -64,12 +64,6 @@
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
       <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-s</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-g <replaceable class="parameter">state</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-k <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-z <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="req" rep="norepeat">keyfile</arg>
     </cmdsynopsis>
   </refsynopsisdiv>
@@ -94,30 +88,11 @@
       When key metadata fields are changed, both files of a key
       pair (<filename>Knnnn.+aaa+iiiii.key</filename> and
       <filename>Knnnn.+aaa+iiiii.private</filename>) are regenerated.
-    </para>
-    <para>
       Metadata fields are stored in the private file.  A human-readable
       description of the metadata is also placed in comments in the key
       file.  The private file's permissions are always set to be
       inaccessible to anyone other than the owner (mode 0600).
     </para>
-    <para>
-      When working with state files, it is possible to update the timing
-      metadata in those files as well with <option>-s</option>.  If this
-      option is used you can also update key states with <option>-d</option>
-      (DS), <option>-k</option> (DNSKEY), <option>-r</option> (RRSIG of KSK),
-      or <option>-z</option> (RRSIG of ZSK). Allowed states are HIDDEN,
-      RUMOURED, OMNIPRESENT, and UNRETENTIVE.
-    </para>
-    <para>
-      You can also set the goal state of the key with <option>-g</option>.
-      This should be either HIDDEN or OMNIPRESENT (representing whether the
-      key should be removed from the zone, or published).
-    </para>
-    <para>
-      It is NOT RECOMMENDED to manipulate state files manually except for
-      testing purposes.
-    </para>
   </refsection>
 
   <refsection><info><title>OPTIONS</title></info>
@@ -344,74 +319,6 @@
     </variablelist>
   </refsection>
 
-  <refsection><info><title>KEY STATE OPTIONS</title></info>
-
-    <para>
-      Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE.
-      These should not be set manually except for testing purposes.
-    </para>
-
-    <variablelist>
-
-      <varlistentry>
-        <term>-s</term>
-        <listitem>
-          <para>
-	    When setting key timing data, also update the state file.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-g</term>
-        <listitem>
-          <para>
-	    Set the goal state for this key. Must be HIDDEN or OMNIPRESENT.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-d</term>
-        <listitem>
-          <para>
-	    Set the DS state for this key, and when it was last changed.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-k</term>
-        <listitem>
-          <para>
-	    Set the DNSKEY state for this key, and when it was last changed.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-r</term>
-        <listitem>
-          <para>
-	    Set the RRSIG (KSK) state for this key, and when it was last
-	    changed.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-z</term>
-        <listitem>
-          <para>
-	    Set the RRSIG (ZSK) state for this key, and when it was last
-	    changed.
-          </para>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-  </refsection>
-
   <refsection><info><title>PRINTING OPTIONS</title></info>
 
     <para>

bin/dnssec/dnssec-settime.html

@@ -49,12 +49,6 @@
        [<code class="option">-V</code>]
        [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
        [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
-       [<code class="option">-s</code>]
-       [<code class="option">-g <em class="replaceable"><code>state</code></em></code>]
-       [<code class="option">-d <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
-       [<code class="option">-k <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
-       [<code class="option">-r <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
-       [<code class="option">-z <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
        {keyfile}
     </p></div>
   </div>
@@ -80,30 +74,11 @@
       When key metadata fields are changed, both files of a key
       pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
       <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
-    </p>
-    <p>
       Metadata fields are stored in the private file.  A human-readable
       description of the metadata is also placed in comments in the key
       file.  The private file's permissions are always set to be
       inaccessible to anyone other than the owner (mode 0600).
     </p>
-    <p>
-      When working with state files, it is possible to update the timing
-      metadata in those files as well with <code class="option">-s</code>.  If this
-      option is used you can also update key states with <code class="option">-d</code>
-      (DS), <code class="option">-k</code> (DNSKEY), <code class="option">-r</code> (RRSIG of KSK),
-      or <code class="option">-z</code> (RRSIG of ZSK). Allowed states are HIDDEN,
-      RUMOURED, OMNIPRESENT, and UNRETENTIVE.
-    </p>
-    <p>
-      You can also set the goal state of the key with <code class="option">-g</code>.
-      This should be either HIDDEN or OMNIPRESENT (representing whether the
-      key should be removed from the zone, or published).
-    </p>
-    <p>
-      It is NOT RECOMMENDED to manipulate state files manually except for
-      testing purposes.
-    </p>
   </div>
 
   <div class="refsection">
@@ -287,57 +262,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.10"></a><h2>KEY STATE OPTIONS</h2>
-
-    <p>
-      Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE.
-      These should not be set manually except for testing purposes.
-    </p>
-
-    <div class="variablelist"><dl class="variablelist">
-<dt><span class="term">-s</span></dt>
-<dd>
-          <p>
-	    When setting key timing data, also update the state file.
-          </p>
-        </dd>
-<dt><span class="term">-g</span></dt>
-<dd>
-          <p>
-	    Set the goal state for this key. Must be HIDDEN or OMNIPRESENT.
-          </p>
-        </dd>
-<dt><span class="term">-d</span></dt>
-<dd>
-          <p>
-	    Set the DS state for this key, and when it was last changed.
-          </p>
-        </dd>
-<dt><span class="term">-k</span></dt>
-<dd>
-          <p>
-	    Set the DNSKEY state for this key, and when it was last changed.
-          </p>
-        </dd>
-<dt><span class="term">-r</span></dt>
-<dd>
-          <p>
-	    Set the RRSIG (KSK) state for this key, and when it was last
-	    changed.
-          </p>
-        </dd>
-<dt><span class="term">-z</span></dt>
-<dd>
-          <p>
-	    Set the RRSIG (ZSK) state for this key, and when it was last
-	    changed.
-          </p>
-        </dd>
-</dl></div>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.11"></a><h2>PRINTING OPTIONS</h2>
+<a name="id-1.10"></a><h2>PRINTING OPTIONS</h2>
 
     <p>
       <span class="command"><strong>dnssec-settime</strong></span> can also be used to print the
@@ -373,7 +298,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.11"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">dnssec-keygen</span>(8)

bin/dnssec/dnssec-signzone.c

@@ -246,8 +246,7 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 
 		for (;;) {
 			result = dns_master_rdatasettotext(name, &rds,
-							   masterstyle, NULL,
-							   buffer);
+							   masterstyle, buffer);
 			if (result != ISC_R_NOSPACE)
 				break;
 
@@ -2718,7 +2717,7 @@ build_final_keylist(void) {
 	 * Update keylist with information from from the key repository.
 	 */
 	dns_dnssec_updatekeys(&keylist, &matchkeys, NULL, gorigin, keyttl,
-			      &diff, mctx, report);
+			      &diff, ignore_kskflag, mctx, report);
 
 	/*
 	 * Update keylist with sync records.
@@ -3922,6 +3921,7 @@ main(int argc, char *argv[]) {
 
 	cleanup_logging(&log);
 	dst_lib_destroy();
+	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);

bin/dnssec/dnssec-verify.c

@@ -335,6 +335,7 @@ main(int argc, char *argv[]) {
 
 	cleanup_logging(&log);
 	dst_lib_destroy();
+	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);

bin/dnssec/dnssectool.c

@@ -57,11 +57,6 @@
 
 #include "dnssectool.h"
 
-#define KEYSTATES_NVALUES 4
-static const char *keystates[KEYSTATES_NVALUES] = {
-	"hidden", "rumoured", "omnipresent", "unretentive",
-};
-
 int verbose = 0;
 bool quiet = false;
 uint8_t dtype[8];
@@ -249,21 +244,6 @@ strtottl(const char *str) {
 	return (ttl);
 }
 
-dst_key_state_t
-strtokeystate(const char *str) {
-	if (isnone(str)) {
-		return (DST_KEY_STATE_NA);
-	}
-
-	for (int i = 0; i < KEYSTATES_NVALUES; i++) {
-		if (keystates[i] != NULL &&
-		    strcasecmp(str, keystates[i]) == 0) {
-			return (dst_key_state_t) i;
-		}
-	}
-	fatal("unknown key state");
-}
-
 isc_stdtime_t
 strtotime(const char *str, int64_t now, int64_t base,
 	  bool *setp)

bin/dnssec/dnssectool.h

@@ -17,11 +17,14 @@
 #include <stdbool.h>
 
 #include <isc/log.h>
-#include <isc/platform.h>
 #include <isc/stdtime.h>
 #include <dns/rdatastruct.h>
 #include <dst/dst.h>
 
+#ifndef PATH_MAX
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#endif
+
 /*! verbosity: set by -v and -q option in each program, defined in dnssectool.c */
 extern int verbose;
 extern bool quiet;
@@ -68,8 +71,6 @@ cleanup_logging(isc_log_t **logp);
 
 dns_ttl_t strtottl(const char *str);
 
-dst_key_state_t strtokeystate(const char *str);
-
 isc_stdtime_t
 strtotime(const char *str, int64_t now, int64_t base,
 	  bool *setp);

bin/dnssec/win32/keygen.vcxproj.in

@@ -66,15 +66,15 @@
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
       <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\win32;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -94,7 +94,7 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\win32;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
@@ -104,8 +104,8 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/named/config.c

@@ -58,7 +58,6 @@ options {\n\
 "\
 #	deallocate-on-exit <obsolete>;\n\
 #	directory <none>\n\
-	dnssec-policy \"none\";\n\
 	dump-file \"named_dump.db\";\n\
 	edns-udp-size 4096;\n\
 #	fake-iquery <obsolete>;\n"
@@ -66,7 +65,7 @@ options {\n\
 "	files unlimited;\n"
 #endif
 #if defined(HAVE_GEOIP2) && !defined(WIN32)
-"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
+"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
 #elif defined(HAVE_GEOIP2)
 "	geoip-directory \".\";\n"
 #endif
@@ -296,7 +295,7 @@ view \"_bind\" chaos {\n\
 # BEGIN DNSSEC KEYS\n"
 
 /* Imported from bind.keys.h: */
-TRUST_ANCHORS
+DNSSEC_KEYS
 
 "# END MANAGED KEYS\n\
 \n\
@@ -800,7 +799,10 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 					   dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
-		dns_name_dup(dns_fixedname_name(&fname), mctx, keys[i - 1]);
+		result = dns_name_dup(dns_fixedname_name(&fname), mctx,
+				      keys[i - 1]);
+		if (result != ISC_R_SUCCESS)
+			goto cleanup;
 	}
 	if (pushed != 0) {
 		pushed--;

bin/named/geoip.c

@@ -113,7 +113,8 @@ named_geoip_load(char *dir) {
 #endif
 }
 
-void named_geoip_unload(void) {
+void
+named_geoip_shutdown(void) {
 #ifdef HAVE_GEOIP2
 	if (named_g_geoip->country != NULL) {
 		MMDB_close(named_g_geoip->country);
@@ -135,12 +136,7 @@ void named_geoip_unload(void) {
 		MMDB_close(named_g_geoip->domain);
 		named_g_geoip->domain = NULL;
 	}
-#endif
-}
-
-void
-named_geoip_shutdown(void) {
-#ifdef HAVE_GEOIP2
-	named_geoip_unload();
 #endif /* HAVE_GEOIP2 */
+
+	dns_geoip_shutdown();
 }

bin/named/include/named/geoip.h

@@ -19,8 +19,5 @@ named_geoip_init(void);
 void
 named_geoip_load(char *dir);
 
-void
-named_geoip_unload(void);
-
 void
 named_geoip_shutdown(void);

bin/named/include/named/server.h

@@ -64,7 +64,6 @@ struct named_server {
 	dns_loadmgr_t *		loadmgr;
 	dns_zonemgr_t *		zonemgr;
 	dns_viewlist_t		viewlist;
-	dns_kasplist_t		kasplist;
 	ns_interfacemgr_t *	interfacemgr;
 	dns_db_t *		in_roothints;
 

bin/named/include/named/zoneconf.h

@@ -27,18 +27,19 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
-		     dns_kasplist_t* kasplist, dns_zone_t *zone,
-		     dns_zone_t *raw);
+		     dns_zone_t *zone, dns_zone_t *raw);
 /*%<
  * Configure or reconfigure a zone according to the named.conf
- * data.
+ * data in 'cctx' and 'czone'.
  *
  * The zone origin is not configured, it is assumed to have been set
  * at zone creation time.
  *
  * Require:
+ * \li	'lctx' to be initialized or NULL.
+ * \li	'cctx' to be initialized or NULL.
  * \li	'ac' to point to an initialized cfg_aclconfctx_t.
- * \li	'kasplist' to be initialized.
+ * \li	'czone' to be initialized.
  * \li	'zone' to be initialized.
  */
 

bin/named/main.c

@@ -68,7 +68,6 @@
 #include <ns/interfacemgr.h>
 
 #include <named/builtin.h>
-#include <named/config.h>
 #include <named/control.h>
 #include <named/fuzz.h>
 #include <named/globals.h>	/* Explicit, though named/log.h includes it. */
@@ -116,7 +115,7 @@ LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_month;
 static bool	want_stats = false;
 static char		program_name[NAME_MAX] = "named";
 static char		absolute_conffile[PATH_MAX];
-static char		saved_command_line[4096] = { 0 };
+static char		saved_command_line[8192] =  { 0 };
 static char		ellipsis[5] = { 0 };
 static char		version[512];
 static unsigned int	maxsocks = 0;
@@ -484,12 +483,6 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
-#if defined(HAVE_GEOIP2)
-	isc_mem_t *mctx = NULL;
-	cfg_parser_t *parser = NULL;
-	cfg_obj_t *config = NULL;
-	const cfg_obj_t *defaults = NULL, *obj = NULL;
-#endif
 
 	printf("%s %s%s%s <id:%s>\n",
 	       named_g_product, named_g_version,
@@ -576,20 +569,7 @@ OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	printf("  nsupdate session key: %s\n", named_g_defaultsessionkeyfile);
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
 	printf("  named lock file:      %s\n", named_g_defaultlockfile);
-#if defined(HAVE_GEOIP2)
-#define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
-	isc_mem_create(&mctx);
-	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
-	RTC(named_config_parsedefaults(parser, &config));
-	RTC(cfg_map_get(config, "options", &defaults));
-	RTC(cfg_map_get(defaults, "geoip-directory", &obj));
-	if (cfg_obj_isstring(obj)) {
-		printf("  geoip-directory:      %s\n", cfg_obj_asstring(obj));
-	}
-	cfg_obj_destroy(parser, &config);
-	cfg_parser_destroy(&parser);
-	isc_mem_detach(&mctx);
-#endif /* HAVE_GEOIP2 */
+
 }
 
 static void
@@ -939,24 +919,12 @@ create_managers(void) {
 static void
 destroy_managers(void) {
 	/*
-	 * isc_nm_closedown() closes all active connections, freeing
-	 * attached clients and other resources and preventing new
-	 * connections from being established, but it not does not
-	 * stop all processing or destroy the netmgr yet.
-	 */
-	isc_nm_closedown(named_g_nm);
-
-	/*
-	 * isc_taskmgr_destroy() will block until all tasks have exited.
+	 * isc_taskmgr_destroy() will block until all tasks have exited,
 	 */
 	isc_taskmgr_destroy(&named_g_taskmgr);
 	isc_timermgr_destroy(&named_g_timermgr);
 	isc_socketmgr_destroy(&named_g_socketmgr);
-
-	/*
-	 * At this point is safe to destroy the netmgr.
-	 */
-	isc_nm_destroy(&named_g_nm);
+	isc_nm_detach(&named_g_nm);
 }
 
 static void
@@ -1329,6 +1297,8 @@ cleanup(void) {
 	dlz_dlopen_clear();
 #endif
 
+	dns_name_destroy();
+
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN,
 		      ISC_LOG_NOTICE, "exiting");
@@ -1441,10 +1411,6 @@ main(int argc, char *argv[]) {
 	setvbuf(stderr, NULL, _IOFBF, BUFSIZ);
 #endif
 
-#ifdef HAVE_LIBXML2
-	xmlInitThreads();
-#endif /* HAVE_LIBXML2 */
-
 	/*
 	 * Record version in core image.
 	 * strings named.core | grep "named version:"
@@ -1577,10 +1543,6 @@ main(int argc, char *argv[]) {
 
 	named_os_shutdown();
 
-#ifdef HAVE_LIBXML2
-	xmlCleanupThreads();
-#endif /* HAVE_LIBXML2 */
-
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif

bin/named/named.conf.5

@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2019-08-12
+.\"      Date: 2019-08-07
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2019\-08\-12" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2019\-08\-07" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -104,8 +104,7 @@ dlz \fIstring\fR {
 .\}
 .nf
 dnssec\-keys { \fIstring\fR ( static\-key |
-    initial\-key | static\-ds | initial\-ds )
-    \fIinteger\fR \fIinteger\fR \fIinteger\fR
+    initial\-key ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
     \fIquoted_string\fR; \&.\&.\&. };
 .fi
 .if n \{\
@@ -171,9 +170,9 @@ Deprecated \- see DNSSEC\-KEYS\&.
 .\}
 .nf
 managed\-keys { \fIstring\fR ( static\-key
-    | initial\-key | static\-ds |
-    initial\-ds ) \fIinteger\fR \fIinteger\fR
-    \fIinteger\fR \fIquoted_string\fR; \&.\&.\&. }; deprecated
+    | initial\-key ) \fIinteger\fR
+    \fIinteger\fR \fIinteger\fR
+    \fIquoted_string\fR; \&.\&.\&. }; deprecated
 .fi
 .if n \{\
 .RE
@@ -231,7 +230,7 @@ options {
 	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
 	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
-	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIduration\fR ]; \&.\&.\&. };
+	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
@@ -313,18 +312,18 @@ options {
 	fstrm\-set\-output\-notify\-threshold \fIinteger\fR;
 	fstrm\-set\-output\-queue\-model ( mpsc | spsc );
 	fstrm\-set\-output\-queue\-size \fIinteger\fR;
-	fstrm\-set\-reopen\-interval \fIduration\fR;
+	fstrm\-set\-reopen\-interval \fIttlval\fR;
 	geoip\-directory ( \fIquoted_string\fR | none );
 	glue\-cache \fIboolean\fR;
 	heartbeat\-interval \fIinteger\fR;
 	hostname ( \fIquoted_string\fR | none );
 	inline\-signing \fIboolean\fR;
-	interface\-interval \fIduration\fR;
+	interface\-interval \fIttlval\fR;
 	ixfr\-from\-differences ( primary | master | secondary | slave |
 	    \fIboolean\fR );
 	keep\-response\-order { \fIaddress_match_element\fR; \&.\&.\&. };
 	key\-directory \fIquoted_string\fR;
-	lame\-ttl \fIduration\fR;
+	lame\-ttl \fIttlval\fR;
 	listen\-on [ port \fIinteger\fR ] [ dscp
 	    \fIinteger\fR ] {
 	    \fIaddress_match_element\fR; \&.\&.\&. };
@@ -338,28 +337,28 @@ options {
 	masterfile\-style ( full | relative );
 	match\-mapped\-addresses \fIboolean\fR;
 	max\-cache\-size ( default | unlimited | \fIsizeval\fR | \fIpercentage\fR );
-	max\-cache\-ttl \fIduration\fR;
+	max\-cache\-ttl \fIttlval\fR;
 	max\-clients\-per\-query \fIinteger\fR;
 	max\-journal\-size ( default | unlimited | \fIsizeval\fR );
-	max\-ncache\-ttl \fIduration\fR;
+	max\-ncache\-ttl \fIttlval\fR;
 	max\-records \fIinteger\fR;
 	max\-recursion\-depth \fIinteger\fR;
 	max\-recursion\-queries \fIinteger\fR;
 	max\-refresh\-time \fIinteger\fR;
 	max\-retry\-time \fIinteger\fR;
 	max\-rsa\-exponent\-size \fIinteger\fR;
-	max\-stale\-ttl \fIduration\fR;
+	max\-stale\-ttl \fIttlval\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;
 	max\-transfer\-idle\-out \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-udp\-size \fIinteger\fR;
-	max\-zone\-ttl ( unlimited | \fIduration\fR );
+	max\-zone\-ttl ( unlimited | \fIttlval\fR );
 	memstatistics \fIboolean\fR;
 	memstatistics\-file \fIquoted_string\fR;
 	message\-compression \fIboolean\fR;
-	min\-cache\-ttl \fIduration\fR;
-	min\-ncache\-ttl \fIduration\fR;
+	min\-cache\-ttl \fIttlval\fR;
+	min\-ncache\-ttl \fIttlval\fR;
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	minimal\-any \fIboolean\fR;
@@ -376,8 +375,8 @@ options {
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]
 	    [ dscp \fIinteger\fR ];
 	notify\-to\-soa \fIboolean\fR;
-	nta\-lifetime \fIduration\fR;
-	nta\-recheck \fIduration\fR;
+	nta\-lifetime \fIttlval\fR;
+	nta\-recheck \fIttlval\fR;
 	nxdomain\-redirect \fIstring\fR;
 	pid\-file ( \fIquoted_string\fR | none );
 	port \fIinteger\fR;
@@ -424,13 +423,13 @@ options {
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
 	response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
-	    \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [ min\-update\-interval
-	    \fIduration\fR ] [ policy ( cname | disabled | drop | given | no\-op |
+	    \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
+	    \fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
 	    nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
 	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [
-	    min\-update\-interval \fIduration\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
+	    min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
 	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
 	    [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
@@ -444,7 +443,7 @@ options {
 	serial\-query\-rate \fIinteger\fR;
 	serial\-update\-method ( date | increment | unixtime );
 	server\-id ( \fIquoted_string\fR | none | hostname );
-	servfail\-ttl \fIduration\fR;
+	servfail\-ttl \fIttlval\fR;
 	session\-keyalg \fIstring\fR;
 	session\-keyfile ( \fIquoted_string\fR | none );
 	session\-keyname \fIstring\fR;
@@ -455,7 +454,7 @@ options {
 	sortlist { \fIaddress_match_element\fR; \&.\&.\&. };
 	stacksize ( default | unlimited | \fIsizeval\fR );
 	stale\-answer\-enable \fIboolean\fR;
-	stale\-answer\-ttl \fIduration\fR;
+	stale\-answer\-ttl \fIttlval\fR;
 	startup\-notify\-rate \fIinteger\fR;
 	statistics\-file \fIquoted_string\fR;
 	synth\-from\-dnssec \fIboolean\fR;
@@ -613,7 +612,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
 	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
-	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIduration\fR ]; \&.\&.\&. };
+	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
@@ -656,9 +655,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	dnssec\-accept\-expired \fIboolean\fR;
 	dnssec\-dnskey\-kskonly \fIboolean\fR;
 	dnssec\-keys { \fIstring\fR ( static\-key |
-	    initial\-key | static\-ds | initial\-ds
-	    ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
-	    \fIquoted_string\fR; \&.\&.\&. };
+	    initial\-key ) \fIinteger\fR \fIinteger\fR
+	    \fIinteger\fR \fIquoted_string\fR; \&.\&.\&. };
 	dnssec\-loadkeys\-interval \fIinteger\fR;
 	dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
@@ -692,11 +690,10 @@ view \fIstring\fR [ \fIclass\fR ] {
 		secret \fIstring\fR;
 	};
 	key\-directory \fIquoted_string\fR;
-	lame\-ttl \fIduration\fR;
+	lame\-ttl \fIttlval\fR;
 	lmdb\-mapsize \fIsizeval\fR;
 	managed\-keys { \fIstring\fR (
 	    static\-key | initial\-key
-	    | static\-ds | initial\-ds
 	    ) \fIinteger\fR \fIinteger\fR
 	    \fIinteger\fR
 	    \fIquoted_string\fR; \&.\&.\&. }; deprecated
@@ -706,25 +703,25 @@ view \fIstring\fR [ \fIclass\fR ] {
 	match\-destinations { \fIaddress_match_element\fR; \&.\&.\&. };
 	match\-recursive\-only \fIboolean\fR;
 	max\-cache\-size ( default | unlimited | \fIsizeval\fR | \fIpercentage\fR );
-	max\-cache\-ttl \fIduration\fR;
+	max\-cache\-ttl \fIttlval\fR;
 	max\-clients\-per\-query \fIinteger\fR;
 	max\-journal\-size ( default | unlimited | \fIsizeval\fR );
-	max\-ncache\-ttl \fIduration\fR;
+	max\-ncache\-ttl \fIttlval\fR;
 	max\-records \fIinteger\fR;
 	max\-recursion\-depth \fIinteger\fR;
 	max\-recursion\-queries \fIinteger\fR;
 	max\-refresh\-time \fIinteger\fR;
 	max\-retry\-time \fIinteger\fR;
-	max\-stale\-ttl \fIduration\fR;
+	max\-stale\-ttl \fIttlval\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;
 	max\-transfer\-idle\-out \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-udp\-size \fIinteger\fR;
-	max\-zone\-ttl ( unlimited | \fIduration\fR );
+	max\-zone\-ttl ( unlimited | \fIttlval\fR );
 	message\-compression \fIboolean\fR;
-	min\-cache\-ttl \fIduration\fR;
-	min\-ncache\-ttl \fIduration\fR;
+	min\-cache\-ttl \fIttlval\fR;
+	min\-ncache\-ttl \fIttlval\fR;
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	minimal\-any \fIboolean\fR;
@@ -740,8 +737,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]
 	    [ dscp \fIinteger\fR ];
 	notify\-to\-soa \fIboolean\fR;
-	nta\-lifetime \fIduration\fR;
-	nta\-recheck \fIduration\fR;
+	nta\-lifetime \fIttlval\fR;
+	nta\-recheck \fIttlval\fR;
 	nxdomain\-redirect \fIstring\fR;
 	plugin ( query ) \fIstring\fR [ {
 	    \fIunspecified\-text\fR } ];
@@ -783,13 +780,13 @@ view \fIstring\fR [ \fIclass\fR ] {
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
 	response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
-	    \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [ min\-update\-interval
-	    \fIduration\fR ] [ policy ( cname | disabled | drop | given | no\-op |
+	    \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
+	    \fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
 	    nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
 	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [
-	    min\-update\-interval \fIduration\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
+	    min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
 	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
 	    [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
@@ -834,14 +831,14 @@ view \fIstring\fR [ \fIclass\fR ] {
 		    \fIinteger\fR | * ) ] [ dscp \fIinteger\fR ];
 		transfers \fIinteger\fR;
 	};
-	servfail\-ttl \fIduration\fR;
+	servfail\-ttl \fIttlval\fR;
 	sig\-signing\-nodes \fIinteger\fR;
 	sig\-signing\-signatures \fIinteger\fR;
 	sig\-signing\-type \fIinteger\fR;
 	sig\-validity\-interval \fIinteger\fR [ \fIinteger\fR ];
 	sortlist { \fIaddress_match_element\fR; \&.\&.\&. };
 	stale\-answer\-enable \fIboolean\fR;
-	stale\-answer\-ttl \fIduration\fR;
+	stale\-answer\-ttl \fIttlval\fR;
 	synth\-from\-dnssec \fIboolean\fR;
 	transfer\-format ( many\-answers | one\-answer );
 	transfer\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ] [
@@ -893,7 +890,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 		dnskey\-sig\-validity \fIinteger\fR;
 		dnssec\-dnskey\-kskonly \fIboolean\fR;
 		dnssec\-loadkeys\-interval \fIinteger\fR;
-		dnssec\-policy \fIstring\fR;
 		dnssec\-secure\-to\-insecure \fIboolean\fR;
 		dnssec\-update\-mode ( maintain | no\-resign );
 		file \fIquoted_string\fR;
@@ -919,7 +915,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		max\-transfer\-idle\-out \fIinteger\fR;
 		max\-transfer\-time\-in \fIinteger\fR;
 		max\-transfer\-time\-out \fIinteger\fR;
-		max\-zone\-ttl ( unlimited | \fIduration\fR );
+		max\-zone\-ttl ( unlimited | \fIttlval\fR );
 		min\-refresh\-time \fIinteger\fR;
 		min\-retry\-time \fIinteger\fR;
 		multi\-master \fIboolean\fR;
@@ -1000,7 +996,6 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	dnskey\-sig\-validity \fIinteger\fR;
 	dnssec\-dnskey\-kskonly \fIboolean\fR;
 	dnssec\-loadkeys\-interval \fIinteger\fR;
-	dnssec\-policy \fIstring\fR;
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	file \fIquoted_string\fR;
@@ -1025,7 +1020,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	max\-transfer\-idle\-out \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
-	max\-zone\-ttl ( unlimited | \fIduration\fR );
+	max\-zone\-ttl ( unlimited | \fIttlval\fR );
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	multi\-master \fIboolean\fR;
@@ -1067,30 +1062,6 @@ zone \fIstring\fR [ \fIclass\fR ] {
 .if n \{\
 .RE
 .\}
-.SH "DNSSEC-POLICY"
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-dnssec\-policy \fIstring\fR {
-	dnskey\-ttl \fIttlval\fR;
-	keys { ( csk | ksk | zsk ) key\-directory lifetime \fIduration\fR algorithm \fIinteger\fR [ \fIinteger\fR ] ; \&.\&.\&. };
-	parent\-ds\-ttl \fIduration\fR;
-	parent\-propagation\-delay \fIduration\fR;
-	parent\-registration\-delay \fIduration\fR;
-	publish\-safety \fIduration\fR;
-	retire\-safety \fIduration\fR;
-	signatures\-refresh \fIduration\fR;
-	signatures\-validity \fIduration\fR;
-	signatures\-validity\-dnskey \fIduration\fR;
-	zone\-max\-ttl \fIduration\fR;
-	zone\-propagation\-delay \fIduration\fR;
-};
-.fi
-.if n \{\
-.RE
-.\}
 .SH "FILES"
 .PP
 /etc/named\&.conf

bin/named/named.conf.docbook

@@ -13,7 +13,7 @@
 
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
   <info>
-    <date>2019-08-12</date>
+    <date>2019-08-07</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -110,6 +110,14 @@ dlz <replaceable>string</replaceable> {
 </literallayout>
   </refsection>
 
+  <refsection><info><title>DNSSEC-KEYS</title></info>
+    <literallayout class="normal">
+dnssec-keys { <replaceable>string</replaceable> ( static-key |
+    initial-key ) <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+    <replaceable>quoted_string</replaceable>; ... };
+</literallayout>
+  </refsection>
+
   <refsection><info><title>DYNDB</title></info>
     <literallayout class="normal">
 dyndb <replaceable>string</replaceable> <replaceable>quoted_string</replaceable> {
@@ -147,12 +155,12 @@ logging {
   </refsection>
 
   <refsection><info><title>MANAGED-KEYS</title></info>
-  <para>Deprecated - see TRUST-ANCHORS.</para>
+  <para>Deprecated - see DNSSEC-KEYS.</para>
     <literallayout class="normal">
 managed-keys { <replaceable>string</replaceable> ( static-key
-    | initial-key | static-ds |
-    initial-ds ) <replaceable>integer</replaceable> <replaceable>integer</replaceable>
-    <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; ... }; deprecated
+    | initial-key ) <replaceable>integer</replaceable>
+    <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+    <replaceable>quoted_string</replaceable>; ... }; deprecated
 </literallayout>
   </refsection>
 
@@ -200,7 +208,7 @@ options {
 	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
-	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>duration</replaceable> ]; ... };
+	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
@@ -282,18 +290,18 @@ options {
 	fstrm-set-output-notify-threshold <replaceable>integer</replaceable>;
 	fstrm-set-output-queue-model ( mpsc | spsc );
 	fstrm-set-output-queue-size <replaceable>integer</replaceable>;
-	fstrm-set-reopen-interval <replaceable>duration</replaceable>;
+	fstrm-set-reopen-interval <replaceable>ttlval</replaceable>;
 	geoip-directory ( <replaceable>quoted_string</replaceable> | none );
 	glue-cache <replaceable>boolean</replaceable>;
 	heartbeat-interval <replaceable>integer</replaceable>;
 	hostname ( <replaceable>quoted_string</replaceable> | none );
 	inline-signing <replaceable>boolean</replaceable>;
-	interface-interval <replaceable>duration</replaceable>;
+	interface-interval <replaceable>ttlval</replaceable>;
 	ixfr-from-differences ( primary | master | secondary | slave |
 	    <replaceable>boolean</replaceable> );
 	keep-response-order { <replaceable>address_match_element</replaceable>; ... };
 	key-directory <replaceable>quoted_string</replaceable>;
-	lame-ttl <replaceable>duration</replaceable>;
+	lame-ttl <replaceable>ttlval</replaceable>;
 	listen-on [ port <replaceable>integer</replaceable> ] [ dscp
 	    <replaceable>integer</replaceable> ] {
 	    <replaceable>address_match_element</replaceable>; ... };
@@ -307,28 +315,28 @@ options {
 	masterfile-style ( full | relative );
 	match-mapped-addresses <replaceable>boolean</replaceable>;
 	max-cache-size ( default | unlimited | <replaceable>sizeval</replaceable> | <replaceable>percentage</replaceable> );
-	max-cache-ttl <replaceable>duration</replaceable>;
+	max-cache-ttl <replaceable>ttlval</replaceable>;
 	max-clients-per-query <replaceable>integer</replaceable>;
 	max-journal-size ( default | unlimited | <replaceable>sizeval</replaceable> );
-	max-ncache-ttl <replaceable>duration</replaceable>;
+	max-ncache-ttl <replaceable>ttlval</replaceable>;
 	max-records <replaceable>integer</replaceable>;
 	max-recursion-depth <replaceable>integer</replaceable>;
 	max-recursion-queries <replaceable>integer</replaceable>;
 	max-refresh-time <replaceable>integer</replaceable>;
 	max-retry-time <replaceable>integer</replaceable>;
 	max-rsa-exponent-size <replaceable>integer</replaceable>;
-	max-stale-ttl <replaceable>duration</replaceable>;
+	max-stale-ttl <replaceable>ttlval</replaceable>;
 	max-transfer-idle-in <replaceable>integer</replaceable>;
 	max-transfer-idle-out <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
 	max-udp-size <replaceable>integer</replaceable>;
-	max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	memstatistics <replaceable>boolean</replaceable>;
 	memstatistics-file <replaceable>quoted_string</replaceable>;
 	message-compression <replaceable>boolean</replaceable>;
-	min-cache-ttl <replaceable>duration</replaceable>;
-	min-ncache-ttl <replaceable>duration</replaceable>;
+	min-cache-ttl <replaceable>ttlval</replaceable>;
+	min-ncache-ttl <replaceable>ttlval</replaceable>;
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
@@ -345,8 +353,8 @@ options {
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ]
 	    [ dscp <replaceable>integer</replaceable> ];
 	notify-to-soa <replaceable>boolean</replaceable>;
-	nta-lifetime <replaceable>duration</replaceable>;
-	nta-recheck <replaceable>duration</replaceable>;
+	nta-lifetime <replaceable>ttlval</replaceable>;
+	nta-recheck <replaceable>ttlval</replaceable>;
 	nxdomain-redirect <replaceable>string</replaceable>;
 	pid-file ( <replaceable>quoted_string</replaceable> | none );
 	port <replaceable>integer</replaceable>;
@@ -393,13 +401,13 @@ options {
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
 	response-policy { zone <replaceable>string</replaceable> [ add-soa <replaceable>boolean</replaceable> ] [ log
-	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [ min-update-interval
-	    <replaceable>duration</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
+	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval
+	    <replaceable>ttlval</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
 	    nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
 	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ add-soa <replaceable>boolean</replaceable> ] [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [
-	    min-update-interval <replaceable>duration</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
+	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
 	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
 	    [ recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ] [ dnsrps-enable <replaceable>boolean</replaceable> ] [
@@ -413,7 +421,7 @@ options {
 	serial-query-rate <replaceable>integer</replaceable>;
 	serial-update-method ( date | increment | unixtime );
 	server-id ( <replaceable>quoted_string</replaceable> | none | hostname );
-	servfail-ttl <replaceable>duration</replaceable>;
+	servfail-ttl <replaceable>ttlval</replaceable>;
 	session-keyalg <replaceable>string</replaceable>;
 	session-keyfile ( <replaceable>quoted_string</replaceable> | none );
 	session-keyname <replaceable>string</replaceable>;
@@ -424,7 +432,7 @@ options {
 	sortlist { <replaceable>address_match_element</replaceable>; ... };
 	stacksize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	stale-answer-enable <replaceable>boolean</replaceable>;
-	stale-answer-ttl <replaceable>duration</replaceable>;
+	stale-answer-ttl <replaceable>ttlval</replaceable>;
 	startup-notify-rate <replaceable>integer</replaceable>;
 	statistics-file <replaceable>quoted_string</replaceable>;
 	synth-from-dnssec <replaceable>boolean</replaceable>;
@@ -518,17 +526,8 @@ statistics-channels {
 </literallayout>
   </refsection>
 
-  <refsection><info><title>TRUST-ANCHORS</title></info>
-    <literallayout class="normal">
-trust-anchors { <replaceable>string</replaceable> ( static-key |
-    initial-key | static-ds | initial-ds )
-    <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
-    <replaceable>quoted_string</replaceable>; ... };
-</literallayout>
-  </refsection>
-
   <refsection><info><title>TRUSTED-KEYS</title></info>
-  <para>Deprecated - see TRUST-ANCHORS.</para>
+  <para>Deprecated - see DNSSEC-KEYS.</para>
     <literallayout class="normal">
 trusted-keys { <replaceable>string</replaceable> <replaceable>integer</replaceable>
     <replaceable>integer</replaceable> <replaceable>integer</replaceable>
@@ -565,7 +564,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
-	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>duration</replaceable> ]; ... };
+	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
@@ -607,6 +606,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnsrps-options { <replaceable>unspecified-text</replaceable> };
 	dnssec-accept-expired <replaceable>boolean</replaceable>;
 	dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
+	dnssec-keys { <replaceable>string</replaceable> ( static-key |
+	    initial-key ) <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+	    <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; ... };
 	dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 	dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
@@ -640,11 +642,10 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		secret <replaceable>string</replaceable>;
 	};
 	key-directory <replaceable>quoted_string</replaceable>;
-	lame-ttl <replaceable>duration</replaceable>;
+	lame-ttl <replaceable>ttlval</replaceable>;
 	lmdb-mapsize <replaceable>sizeval</replaceable>;
 	managed-keys { <replaceable>string</replaceable> (
 	    static-key | initial-key
-	    | static-ds | initial-ds
 	    ) <replaceable>integer</replaceable> <replaceable>integer</replaceable>
 	    <replaceable>integer</replaceable>
 	    <replaceable>quoted_string</replaceable>; ... }; deprecated
@@ -654,25 +655,25 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	match-destinations { <replaceable>address_match_element</replaceable>; ... };
 	match-recursive-only <replaceable>boolean</replaceable>;
 	max-cache-size ( default | unlimited | <replaceable>sizeval</replaceable> | <replaceable>percentage</replaceable> );
-	max-cache-ttl <replaceable>duration</replaceable>;
+	max-cache-ttl <replaceable>ttlval</replaceable>;
 	max-clients-per-query <replaceable>integer</replaceable>;
 	max-journal-size ( default | unlimited | <replaceable>sizeval</replaceable> );
-	max-ncache-ttl <replaceable>duration</replaceable>;
+	max-ncache-ttl <replaceable>ttlval</replaceable>;
 	max-records <replaceable>integer</replaceable>;
 	max-recursion-depth <replaceable>integer</replaceable>;
 	max-recursion-queries <replaceable>integer</replaceable>;
 	max-refresh-time <replaceable>integer</replaceable>;
 	max-retry-time <replaceable>integer</replaceable>;
-	max-stale-ttl <replaceable>duration</replaceable>;
+	max-stale-ttl <replaceable>ttlval</replaceable>;
 	max-transfer-idle-in <replaceable>integer</replaceable>;
 	max-transfer-idle-out <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
 	max-udp-size <replaceable>integer</replaceable>;
-	max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	message-compression <replaceable>boolean</replaceable>;
-	min-cache-ttl <replaceable>duration</replaceable>;
-	min-ncache-ttl <replaceable>duration</replaceable>;
+	min-cache-ttl <replaceable>ttlval</replaceable>;
+	min-ncache-ttl <replaceable>ttlval</replaceable>;
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
@@ -688,8 +689,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ]
 	    [ dscp <replaceable>integer</replaceable> ];
 	notify-to-soa <replaceable>boolean</replaceable>;
-	nta-lifetime <replaceable>duration</replaceable>;
-	nta-recheck <replaceable>duration</replaceable>;
+	nta-lifetime <replaceable>ttlval</replaceable>;
+	nta-recheck <replaceable>ttlval</replaceable>;
 	nxdomain-redirect <replaceable>string</replaceable>;
 	plugin ( query ) <replaceable>string</replaceable> [ {
 	    <replaceable>unspecified-text</replaceable> } ];
@@ -731,13 +732,13 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
 	response-policy { zone <replaceable>string</replaceable> [ add-soa <replaceable>boolean</replaceable> ] [ log
-	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [ min-update-interval
-	    <replaceable>duration</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
+	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval
+	    <replaceable>ttlval</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
 	    nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
 	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ add-soa <replaceable>boolean</replaceable> ] [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [
-	    min-update-interval <replaceable>duration</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
+	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
 	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
 	    [ recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ] [ dnsrps-enable <replaceable>boolean</replaceable> ] [
@@ -782,14 +783,14 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		    <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
 		transfers <replaceable>integer</replaceable>;
 	};
-	servfail-ttl <replaceable>duration</replaceable>;
+	servfail-ttl <replaceable>ttlval</replaceable>;
 	sig-signing-nodes <replaceable>integer</replaceable>;
 	sig-signing-signatures <replaceable>integer</replaceable>;
 	sig-signing-type <replaceable>integer</replaceable>;
 	sig-validity-interval <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	sortlist { <replaceable>address_match_element</replaceable>; ... };
 	stale-answer-enable <replaceable>boolean</replaceable>;
-	stale-answer-ttl <replaceable>duration</replaceable>;
+	stale-answer-ttl <replaceable>ttlval</replaceable>;
 	synth-from-dnssec <replaceable>boolean</replaceable>;
 	transfer-format ( many-answers | one-answer );
 	transfer-source ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [
@@ -797,10 +798,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	trust-anchor-telemetry <replaceable>boolean</replaceable>; // experimental
-	trust-anchors { <replaceable>string</replaceable> ( static-key |
-	    initial-key | static-ds | initial-ds
-	    ) <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
-	    <replaceable>quoted_string</replaceable>; ... };
 	trusted-keys { <replaceable>string</replaceable>
 	    <replaceable>integer</replaceable> <replaceable>integer</replaceable>
 	    <replaceable>integer</replaceable>
@@ -845,7 +842,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		dnskey-sig-validity <replaceable>integer</replaceable>;
 		dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
 		dnssec-loadkeys-interval <replaceable>integer</replaceable>;
-		dnssec-policy <replaceable>string</replaceable>;
 		dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 		dnssec-update-mode ( maintain | no-resign );
 		file <replaceable>quoted_string</replaceable>;
@@ -871,7 +867,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		max-transfer-idle-out <replaceable>integer</replaceable>;
 		max-transfer-time-in <replaceable>integer</replaceable>;
 		max-transfer-time-out <replaceable>integer</replaceable>;
-		max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+		max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 		min-refresh-time <replaceable>integer</replaceable>;
 		min-retry-time <replaceable>integer</replaceable>;
 		multi-master <replaceable>boolean</replaceable>;
@@ -947,7 +943,6 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnskey-sig-validity <replaceable>integer</replaceable>;
 	dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
 	dnssec-loadkeys-interval <replaceable>integer</replaceable>;
-	dnssec-policy <replaceable>string</replaceable>;
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	file <replaceable>quoted_string</replaceable>;
@@ -972,7 +967,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	max-transfer-idle-out <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
-	max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
@@ -1013,26 +1008,6 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 </literallayout>
   </refsection>
 
-  <refsection><info><title>DNSSEC-POLICY</title></info>
-
-    <literallayout class="normal">
-dnssec-policy <replaceable>string</replaceable> {
-	dnskey-ttl <replaceable>duration</replaceable>;
-	keys { ( csk | ksk | zsk ) key-directory lifetime <replaceable>duration</replaceable> algorithm <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ] ; ... };
-	parent-ds-ttl <replaceable>duration</replaceable>;
-	parent-propagation-delay <replaceable>duration</replaceable>;
-	parent-registration-delay <replaceable>duration</replaceable>;
-	publish-safety <replaceable>duration</replaceable>;
-	retire-safety <replaceable>duration</replaceable>;
-	signatures-refresh <replaceable>duration</replaceable>;
-	signatures-validity <replaceable>duration</replaceable>;
-	signatures-validity-dnskey <replaceable>duration</replaceable>;
-	zone-max-ttl <replaceable>duration</replaceable>;
-	zone-propagation-delay <replaceable>duration</replaceable>;
-};
-</literallayout>
-  </refsection>
-
   <refsection><info><title>FILES</title></info>
 
     <para><filename>/etc/named.conf</filename>

bin/named/named.conf.html

@@ -95,8 +95,7 @@ dlz
 <a name="id-1.11"></a><h2>DNSSEC-KEYS</h2>
     <div class="literallayout"><p><br>
 dnssec-keys { <em class="replaceable"><code>string</code></em> ( static-key |<br>
-    initial-key | static-ds | initial-ds )<br>
-    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+    initial-key ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
     <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 </p></div>
   </div>
@@ -145,9 +144,9 @@ logging
   <p>Deprecated - see DNSSEC-KEYS.</p>
     <div class="literallayout"><p><br>
 managed-keys { <em class="replaceable"><code>string</code></em> ( static-key<br>
-    | initial-key | static-ds |<br>
-    initial-ds ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
-    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>quoted_string</code></em>; ... }; deprecated<br>
+    | initial-key ) <em class="replaceable"><code>integer</code></em><br>
+    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+    <em class="replaceable"><code>quoted_string</code></em>; ... }; deprecated<br>
 </p></div>
   </div>
 
@@ -197,7 +196,7 @@ options
 	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
-	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>duration</code></em> ]; ... };<br>
+	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
@@ -279,18 +278,18 @@ options
 	fstrm-set-output-notify-threshold <em class="replaceable"><code>integer</code></em>;<br>
 	fstrm-set-output-queue-model ( mpsc | spsc );<br>
 	fstrm-set-output-queue-size <em class="replaceable"><code>integer</code></em>;<br>
-	fstrm-set-reopen-interval <em class="replaceable"><code>duration</code></em>;<br>
+	fstrm-set-reopen-interval <em class="replaceable"><code>ttlval</code></em>;<br>
 	geoip-directory ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	glue-cache <em class="replaceable"><code>boolean</code></em>;<br>
 	heartbeat-interval <em class="replaceable"><code>integer</code></em>;<br>
 	hostname ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	inline-signing <em class="replaceable"><code>boolean</code></em>;<br>
-	interface-interval <em class="replaceable"><code>duration</code></em>;<br>
+	interface-interval <em class="replaceable"><code>ttlval</code></em>;<br>
 	ixfr-from-differences ( primary | master | secondary | slave |<br>
 	    <em class="replaceable"><code>boolean</code></em> );<br>
 	keep-response-order { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	key-directory <em class="replaceable"><code>quoted_string</code></em>;<br>
-	lame-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	lame-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	listen-on [ port <em class="replaceable"><code>integer</code></em> ] [ dscp<br>
 	    <em class="replaceable"><code>integer</code></em> ] {<br>
 	    <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -304,28 +303,28 @@ options
 	masterfile-style ( full | relative );<br>
 	match-mapped-addresses <em class="replaceable"><code>boolean</code></em>;<br>
 	max-cache-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> | <em class="replaceable"><code>percentage</code></em> );<br>
-	max-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
 	max-journal-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
-	max-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-records <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-depth <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-queries <em class="replaceable"><code>integer</code></em>;<br>
 	max-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	max-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	max-rsa-exponent-size <em class="replaceable"><code>integer</code></em>;<br>
-	max-stale-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-stale-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
-	max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
+	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	memstatistics <em class="replaceable"><code>boolean</code></em>;<br>
 	memstatistics-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	message-compression <em class="replaceable"><code>boolean</code></em>;<br>
-	min-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
-	min-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -342,8 +341,8 @@ options
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ]<br>
 	    [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
-	nta-lifetime <em class="replaceable"><code>duration</code></em>;<br>
-	nta-recheck <em class="replaceable"><code>duration</code></em>;<br>
+	nta-lifetime <em class="replaceable"><code>ttlval</code></em>;<br>
+	nta-recheck <em class="replaceable"><code>ttlval</code></em>;<br>
 	nxdomain-redirect <em class="replaceable"><code>string</code></em>;<br>
 	pid-file ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	port <em class="replaceable"><code>integer</code></em>;<br>
@@ -390,13 +389,13 @@ options
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
 	response-policy { zone <em class="replaceable"><code>string</code></em> [ add-soa <em class="replaceable"><code>boolean</code></em> ] [ log<br>
-	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [ min-update-interval<br>
-	    <em class="replaceable"><code>duration</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
+	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval<br>
+	    <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
 	    nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
 	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ add-soa <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [<br>
-	    min-update-interval <em class="replaceable"><code>duration</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
 	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
 	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
@@ -410,7 +409,7 @@ options
 	serial-query-rate <em class="replaceable"><code>integer</code></em>;<br>
 	serial-update-method ( date | increment | unixtime );<br>
 	server-id ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );<br>
-	servfail-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	servfail-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	session-keyalg <em class="replaceable"><code>string</code></em>;<br>
 	session-keyfile ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	session-keyname <em class="replaceable"><code>string</code></em>;<br>
@@ -421,7 +420,7 @@ options
 	sortlist { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	stacksize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
 	stale-answer-enable <em class="replaceable"><code>boolean</code></em>;<br>
-	stale-answer-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	stale-answer-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	startup-notify-rate <em class="replaceable"><code>integer</code></em>;<br>
 	statistics-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	synth-from-dnssec <em class="replaceable"><code>boolean</code></em>;<br>
@@ -558,7 +557,7 @@ view
 	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
-	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>duration</code></em> ]; ... };<br>
+	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
@@ -601,9 +600,8 @@ view
 	dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-keys { <em class="replaceable"><code>string</code></em> ( static-key |<br>
-	    initial-key | static-ds | initial-ds<br>
-	    ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
-	    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
+	    initial-key ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+	    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 	dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
 	dnssec-must-be-secure <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
@@ -637,11 +635,10 @@ view
 		secret <em class="replaceable"><code>string</code></em>;<br>
 	};<br>
 	key-directory <em class="replaceable"><code>quoted_string</code></em>;<br>
-	lame-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	lame-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	lmdb-mapsize <em class="replaceable"><code>sizeval</code></em>;<br>
 	managed-keys { <em class="replaceable"><code>string</code></em> (<br>
 	    static-key | initial-key<br>
-	    | static-ds | initial-ds<br>
 	    ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>quoted_string</code></em>; ... }; deprecated<br>
@@ -651,25 +648,25 @@ view
 	match-destinations { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	match-recursive-only <em class="replaceable"><code>boolean</code></em>;<br>
 	max-cache-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> | <em class="replaceable"><code>percentage</code></em> );<br>
-	max-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
 	max-journal-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
-	max-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-records <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-depth <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-queries <em class="replaceable"><code>integer</code></em>;<br>
 	max-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	max-retry-time <em class="replaceable"><code>integer</code></em>;<br>
-	max-stale-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	max-stale-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
-	max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
+	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	message-compression <em class="replaceable"><code>boolean</code></em>;<br>
-	min-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
-	min-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -685,8 +682,8 @@ view
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ]<br>
 	    [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
-	nta-lifetime <em class="replaceable"><code>duration</code></em>;<br>
-	nta-recheck <em class="replaceable"><code>duration</code></em>;<br>
+	nta-lifetime <em class="replaceable"><code>ttlval</code></em>;<br>
+	nta-recheck <em class="replaceable"><code>ttlval</code></em>;<br>
 	nxdomain-redirect <em class="replaceable"><code>string</code></em>;<br>
 	plugin ( query ) <em class="replaceable"><code>string</code></em> [ {<br>
 	    <em class="replaceable"><code>unspecified-text</code></em> } ];<br>
@@ -728,13 +725,13 @@ view
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
 	response-policy { zone <em class="replaceable"><code>string</code></em> [ add-soa <em class="replaceable"><code>boolean</code></em> ] [ log<br>
-	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [ min-update-interval<br>
-	    <em class="replaceable"><code>duration</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
+	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval<br>
+	    <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
 	    nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
 	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ add-soa <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [<br>
-	    min-update-interval <em class="replaceable"><code>duration</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
+	    min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
 	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
 	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
@@ -779,14 +776,14 @@ view
 		    <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		transfers <em class="replaceable"><code>integer</code></em>;<br>
 	};<br>
-	servfail-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	servfail-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-type <em class="replaceable"><code>integer</code></em>;<br>
 	sig-validity-interval <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
 	sortlist { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	stale-answer-enable <em class="replaceable"><code>boolean</code></em>;<br>
-	stale-answer-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	stale-answer-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
 	synth-from-dnssec <em class="replaceable"><code>boolean</code></em>;<br>
 	transfer-format ( many-answers | one-answer );<br>
 	transfer-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [<br>
@@ -838,7 +835,6 @@ view
 		dnskey-sig-validity <em class="replaceable"><code>integer</code></em>;<br>
 		dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
 		dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
-		dnssec-policy <em class="replaceable"><code>string</code></em>;<br>
 		dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 		dnssec-update-mode ( maintain | no-resign );<br>
 		file <em class="replaceable"><code>quoted_string</code></em>;<br>
@@ -864,7 +860,7 @@ view
 		max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 		max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 		max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
-		max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
+		max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 		min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 		min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 		multi-master <em class="replaceable"><code>boolean</code></em>;<br>
@@ -941,7 +937,6 @@ zone
 	dnskey-sig-validity <em class="replaceable"><code>integer</code></em>;<br>
 	dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
-	dnssec-policy <em class="replaceable"><code>string</code></em>;<br>
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	file <em class="replaceable"><code>quoted_string</code></em>;<br>
@@ -966,7 +961,7 @@ zone
 	max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
-	max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
+	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	multi-master <em class="replaceable"><code>boolean</code></em>;<br>
@@ -1008,35 +1003,14 @@ zone
   </div>
 
   <div class="refsection">
-<a name="id-1.24"></a><h2>DNSSEC-POLICY</h2>
-
-    <div class="literallayout"><p><br>
-dnssec-policy <em class="replaceable"><code>string</code></em> {<br>
-	dnskey-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
-	keys { ( csk | ksk | zsk ) key-directory lifetime <em class="replaceable"><code>duration</code></em> algorithm <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ] ; ... };<br>
-	parent-ds-ttl <em class="replaceable"><code>duration</code></em>;<br>
-	parent-propagation-delay <em class="replaceable"><code>duration</code></em>;<br>
-	parent-registration-delay <em class="replaceable"><code>duration</code></em>;<br>
-	publish-safety <em class="replaceable"><code>duration</code></em>;<br>
-	retire-safety <em class="replaceable"><code>duration</code></em>;<br>
-	signatures-refresh <em class="replaceable"><code>duration</code></em>;<br>
-	signatures-validity <em class="replaceable"><code>duration</code></em>;<br>
-	signatures-validity-dnskey <em class="replaceable"><code>duration</code></em>;<br>
-	zone-max-ttl <em class="replaceable"><code>duration</code></em>;<br>
-	zone-propagation-delay <em class="replaceable"><code>duration</code></em>;<br>
-};<br>
-</p></div>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.25"></a><h2>FILES</h2>
+<a name="id-1.24"></a><h2>FILES</h2>
 
     <p><code class="filename">/etc/named.conf</code>
     </p>
   </div>
 
   <div class="refsection">
-<a name="id-1.26"></a><h2>SEE ALSO</h2>
+<a name="id-1.25"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
 	<span class="refentrytitle">ddns-confgen</span>(8)

bin/named/statschannel.c

@@ -241,8 +241,6 @@ init_desc(void) {
 	SET_NSSTATDESC(invalidsig, "requests with invalid signature",
 		       "ReqBadSIG");
 	SET_NSSTATDESC(requesttcp, "TCP requests received", "ReqTCP");
-	SET_NSSTATDESC(tcphighwater, "TCP connection high-water",
-		       "TCPConnHighWater");
 	SET_NSSTATDESC(authrej, "auth queries rejected", "AuthQryRej");
 	SET_NSSTATDESC(recurserej, "recursive queries rejected", "RecQryRej");
 	SET_NSSTATDESC(xfrrej, "transfer requests rejected", "XfrRej");
@@ -324,10 +322,6 @@ init_desc(void) {
 		       "QryUsedStale");
 	SET_NSSTATDESC(prefetch, "queries triggered prefetch", "Prefetch");
 	SET_NSSTATDESC(keytagopt, "Keytag option received", "KeyTagOpt");
-	SET_NSSTATDESC(reclimitdropped,
-		       "queries dropped due to recursive client limit",
-		       "RecLimitDropped");
-
 	INSIST(i == ns_statscounter_max);
 
 	/* Initialize resolver statistics */
@@ -3593,6 +3587,10 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 
 	ISC_LIST_INIT(new_listeners);
 
+#ifdef HAVE_LIBXML2
+	xmlInitThreads();
+#endif /* HAVE_LIBXML2 */
+
 	/*
 	 * Get the list of named.conf 'statistics-channels' statements.
 	 */
@@ -3725,6 +3723,10 @@ named_statschannels_shutdown(named_server_t *server) {
 		ISC_LIST_UNLINK(server->statschannels, listener, link);
 		shutdown_listener(listener);
 	}
+
+#ifdef HAVE_LIBXML2
+	xmlCleanupThreads();
+#endif /* HAVE_LIBXML2 */
 }
 
 isc_result_t

bin/named/tkeyconf.c

@@ -85,7 +85,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 		tctx->domain = isc_mem_get(mctx, sizeof(dns_name_t));
 		dns_name_init(tctx->domain, NULL);
-		dns_name_dup(name, mctx, tctx->domain);
+		RETERR(dns_name_dup(name, mctx, tctx->domain));
 	}
 
 	obj = NULL;
@@ -114,3 +114,4 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	dns_tkeyctx_destroy(&tctx);
 	return (result);
 }
+

bin/named/zoneconf.c

@@ -25,7 +25,6 @@
 #include <dns/ipkeylist.h>
 #include <dns/fixedname.h>
 #include <dns/journal.h>
-#include <dns/kasp.h>
 #include <dns/log.h>
 #include <dns/name.h>
 #include <dns/masterdump.h>
@@ -841,9 +840,8 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
-		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
-		     dns_kasplist_t *kasplist, dns_zone_t *zone,
-		     dns_zone_t *raw)
+		  const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
+		  dns_zone_t *zone, dns_zone_t *raw)
 {
 	isc_result_t result;
 	const char *zname;
@@ -855,7 +853,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const cfg_obj_t *options = NULL;
 	const cfg_obj_t *obj;
 	const char *filename = NULL;
-	const char *kaspname = NULL;
 	const char *dupcheck;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
 	uint32_t count;
@@ -871,8 +868,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	int32_t journal_size;
 	bool multi;
 	bool alt;
-	dns_view_t *view = NULL;
-	dns_kasp_t *kasp = NULL;
+	dns_view_t *view;
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
 	bool ixfrdiff;
@@ -1049,8 +1045,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	} else if (result == ISC_R_SUCCESS) {
 		dns_ttl_t maxttl = 0;	/* unlimited */
 
-		if (cfg_obj_isduration(obj))
-			maxttl = cfg_obj_asduration(obj);
+		if (cfg_obj_isuint32(obj))
+			maxttl = cfg_obj_asuint32(obj);
 		dns_zone_setmaxttl(zone, maxttl);
 		if (raw != NULL)
 			dns_zone_setmaxttl(raw, maxttl);
@@ -1196,24 +1192,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	 */
 	if (ztype != dns_zone_stub && ztype != dns_zone_staticstub &&
 	    ztype != dns_zone_redirect) {
-		obj = NULL;
-		result = named_config_get(maps, "dnssec-policy", &obj);
-		if (result == ISC_R_SUCCESS) {
-			kaspname = cfg_obj_asstring(obj);
-			if (strcmp(kaspname, "none") != 0) {
-				result = dns_kasplist_find(kasplist, kaspname,
-							   &kasp);
-				if (result != ISC_R_SUCCESS) {
-					cfg_obj_log(obj, named_g_lctx,
-						    ISC_LOG_ERROR,
-						    "'dnssec-policy '%s' not "
-						    "found ", kaspname);
-					RETERR(result);
-				}
-				dns_zone_setkasp(zone, kasp);
-			}
-		}
-
 		obj = NULL;
 		result = named_config_get(maps, "notify", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1503,52 +1481,38 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		bool allow = false, maint = false;
 		bool sigvalinsecs;
 
-		if (kasp) {
-			seconds = (uint32_t) dns_kasp_sigvalidity_dnskey(kasp);
-		} else {
-			obj = NULL;
-			result = named_config_get(maps, "dnskey-sig-validity",
-						  &obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
-			seconds = cfg_obj_asuint32(obj) * 86400;
-		}
+		obj = NULL;
+		result = named_config_get(maps, "dnskey-sig-validity", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		seconds = cfg_obj_asuint32(obj) * 86400;
 		dns_zone_setkeyvalidityinterval(zone, seconds);
 
-		if (kasp) {
-			seconds = (uint32_t) dns_kasp_sigvalidity(kasp);
-			dns_zone_setsigvalidityinterval(zone, seconds);
-			seconds = (uint32_t) dns_kasp_sigrefresh(kasp);
-			dns_zone_setsigresigninginterval(zone, seconds);
-		} else {
-			obj = NULL;
-			result = named_config_get(maps, "sig-validity-interval",
-							&obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		obj = NULL;
+		result = named_config_get(maps, "sig-validity-interval", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 
-			sigvalinsecs = ns_server_getoption(named_g_server->sctx,
-							NS_SERVER_SIGVALINSECS);
-			validity = cfg_tuple_get(obj, "validity");
-			seconds = cfg_obj_asuint32(validity);
-			if (!sigvalinsecs) {
-				seconds *= 86400;
-			}
-			dns_zone_setsigvalidityinterval(zone, seconds);
-
-			resign = cfg_tuple_get(obj, "re-sign");
-			if (cfg_obj_isvoid(resign)) {
-				seconds /= 4;
-			} else if (!sigvalinsecs) {
-				seconds = cfg_obj_asuint32(resign);
-				if (seconds > 7 * 86400) {
-					seconds *= 86400;
-				} else {
-					seconds *= 3600;
-				}
-			} else {
-				seconds = cfg_obj_asuint32(resign);
-			}
-			dns_zone_setsigresigninginterval(zone, seconds);
+		sigvalinsecs = ns_server_getoption(named_g_server->sctx,
+						   NS_SERVER_SIGVALINSECS);
+		validity = cfg_tuple_get(obj, "validity");
+		seconds = cfg_obj_asuint32(validity);
+		if (!sigvalinsecs) {
+			seconds *= 86400;
 		}
+		dns_zone_setsigvalidityinterval(zone, seconds);
+
+		resign = cfg_tuple_get(obj, "re-sign");
+		if (cfg_obj_isvoid(resign)) {
+			seconds /= 4;
+		} else if (!sigvalinsecs) {
+			if (seconds > 7 * 86400) {
+				seconds = cfg_obj_asuint32(resign) * 86400;
+			} else {
+				seconds = cfg_obj_asuint32(resign) * 3600;
+			}
+		} else {
+			seconds = cfg_obj_asuint32(resign);
+		}
+		dns_zone_setsigresigninginterval(zone, seconds);
 
 		obj = NULL;
 		result = named_config_get(maps, "key-directory", &obj);
@@ -1577,20 +1541,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
 				   cfg_obj_asboolean(obj));
-		/*
-		 * This setting will be ignored if dnssec-policy is used.
-		 * named-checkconf will error if both are configured.
-		 */
 
 		obj = NULL;
 		result = named_config_get(maps, "dnssec-dnskey-kskonly", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_DNSKEYKSKONLY,
 				   cfg_obj_asboolean(obj));
-		/*
-		 * This setting will be ignored if dnssec-policy is used.
-		 * named-checkconf will error if both are configured.
-		 */
 
 		obj = NULL;
 		result = named_config_get(maps, "dnssec-loadkeys-interval",
@@ -1601,11 +1557,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 
 		obj = NULL;
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
-		if (dns_zone_getkasp(zone) != NULL) {
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, true);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, true);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, true);
-		} else if (result == ISC_R_SUCCESS) {
+		if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
 			if (strcasecmp(arg, "allow") == 0) {
 				allow = true;
@@ -1618,7 +1570,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				ISC_UNREACHABLE();
 			}
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
 		}
 	}

bin/nsupdate/nsupdate.c

@@ -3210,6 +3210,9 @@ cleanup(void) {
 	ddebug("Shutting down timer manager");
 	isc_timermgr_destroy(&timermgr);
 
+	ddebug("Destroying name state");
+	dns_name_destroy();
+
 	ddebug("Removing log context");
 	isc_log_destroy(&glctx);
 

bin/rndc/rndc.8

@@ -276,8 +276,7 @@ See also
 Fetch all DNSSEC keys for the given zone from the key directory\&. If they are within their publication period, merge them into the zone\*(Aqs DNSKEY RRset\&. Unlike
 \fBrndc sign\fR, however, the zone is not immediately re\-signed by the new keys, but is allowed to incrementally re\-sign over time\&.
 .sp
-This command requires that the zone is configured with a
-\fBdnssec\-policy\fR, or that the
+This command requires that the
 \fBauto\-dnssec\fR
 zone option be set to
 maintain, and also requires the zone to be configured to allow dynamic DNS\&. (See "Dynamic Update Policies" in the Administrator Reference Manual for more details\&.)
@@ -567,8 +566,7 @@ Fetch all DNSSEC keys for the given zone from the key directory (see the
 \fBkey\-directory\fR
 option in the BIND 9 Administrator Reference Manual)\&. If they are within their publication period, merge them into the zone\*(Aqs DNSKEY RRset\&. If the DNSKEY RRset is changed, then the zone is automatically re\-signed with the new key set\&.
 .sp
-This command requires that the zone is configured with a
-\fBdnssec\-policy\fR, or that the
+This command requires that the
 \fBauto\-dnssec\fR
 zone option be set to
 allow
@@ -704,7 +702,7 @@ in each view\&. The list includes both statically configured keys and dynamic TK
 .PP
 \fBvalidation ( on | off | status ) \fR\fB[\fIview \&.\&.\&.\fR]\fR\fB \fR
 .RS 4
-Enable, disable, or check the current status of DNSSEC validation\&. By default, validation is enabled\&. The cache is flushed when validation is turned on or off to avoid using data that might differ between states\&.
+Enable, disable, or check the current status of DNSSEC validation\&. By default, validation is enabled\&.
 .RE
 .PP
 \fBzonestatus \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR

bin/rndc/rndc.c

@@ -936,14 +936,12 @@ main(int argc, char **argv) {
 	serial = isc_random32();
 
 	isc_mem_create(&rndc_mctx);
-	DO("create socket manager", isc_socketmgr_create(rndc_mctx,
-							 &socketmgr));
-	DO("create task manager", isc_taskmgr_create(rndc_mctx, 1, 0,
-						     NULL, &taskmgr));
+	DO("create socket manager", isc_socketmgr_create(rndc_mctx, &socketmgr));
+	DO("create task manager",
+	   isc_taskmgr_create(rndc_mctx, 1, 0, NULL, &taskmgr));
 	DO("create task", isc_task_create(taskmgr, 0, &task));
 
-	DO("create logging context", isc_log_create(rndc_mctx, &log,
-						    &logconfig));
+	DO("create logging context", isc_log_create(rndc_mctx, &log, &logconfig));
 	isc_log_setcontext(log);
 	DO("setting log tag", isc_log_settag(logconfig, progname));
 	logdest.file.stream = stderr;
@@ -1022,6 +1020,8 @@ main(int argc, char **argv) {
 	isc_mem_put(rndc_mctx, args, argslen);
 	isccc_ccmsg_invalidate(&ccmsg);
 
+	dns_name_destroy();
+
 	isc_buffer_free(&databuf);
 
 	if (show_final_mem)

bin/rndc/rndc.docbook

@@ -443,8 +443,7 @@
 	    allowed to incrementally re-sign over time.
 	  </para>
 	  <para>
-	    This command requires that the zone is configured with a
-	    <command>dnssec-policy</command>, or that the
+	    This command requires that the
 	    <command>auto-dnssec</command> zone option
 	    be set to <literal>maintain</literal>,
 	    and also requires the zone to be configured to
@@ -773,7 +772,7 @@
 	<listitem>
 	  <para>
 	    Dump the security roots (i.e., trust anchors
-	    configured via <command>trust-anchors</command> statements, or the
+	    configured via <command>dnssec-keys</command> statements, or the
 	    managed-keys or trusted-keys statements (both deprecated), or
 	    via <command>dnssec-validation auto</command>) and negative trust
 	    anchors for the specified views.  If no view is specified, all
@@ -850,8 +849,7 @@
 	    re-signed with the new key set.
 	  </para>
 	  <para>
-	    This command requires that the zone is configured with a
-	    <command>dnssec-policy</command>, or that the
+	    This command requires that the
 	    <command>auto-dnssec</command> zone option be set
 	    to <literal>allow</literal> or
 	    <literal>maintain</literal>,

bin/rndc/rndc.html

@@ -366,8 +366,7 @@
 	    allowed to incrementally re-sign over time.
 	  </p>
 	  <p>
-	    This command requires that the zone is configured with a
-	    <span class="command"><strong>dnssec-policy</strong></span>, or that the
+	    This command requires that the
 	    <span class="command"><strong>auto-dnssec</strong></span> zone option
 	    be set to <code class="literal">maintain</code>,
 	    and also requires the zone to be configured to
@@ -722,8 +721,7 @@
 	    re-signed with the new key set.
 	  </p>
 	  <p>
-	    This command requires that the zone is configured with a
-	    <span class="command"><strong>dnssec-policy</strong></span>, or that the
+	    This command requires that the
 	    <span class="command"><strong>auto-dnssec</strong></span> zone option be set
 	    to <code class="literal">allow</code> or
 	    <code class="literal">maintain</code>,
@@ -916,8 +914,6 @@
 	  <p>
 	    Enable, disable, or check the current status of
 	    DNSSEC validation.  By default, validation is enabled.
-	    The cache is flushed when validation is turned on or off
-	    to avoid using data that might differ between states.
 	  </p>
 	</dd>
 <dt><span class="term"><strong class="userinput"><code>zonestatus <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>

bin/tests/optional/adb_test.c

@@ -244,7 +244,8 @@ lookup(const char *target) {
 	result = dns_name_fromtext(&name, &t, dns_rootname, 0, &namebuf);
 	check_result(result, "dns_name_fromtext %s", target);
 
-	dns_name_dup(&name, mctx, &client->name);
+	result = dns_name_dup(&name, mctx, &client->name);
+	check_result(result, "dns_name_dup %s", target);
 
 	options = 0;
 	options |= DNS_ADBFIND_INET;

bin/tests/system/.gitignore

@@ -5,7 +5,7 @@ named.lock
 named.pid
 named.run
 /feature-test
-/test.output.*
+**/test.output
 /systests.output
 /random.data
 parallel.mk

bin/tests/system/Makefile.in

@@ -64,7 +64,7 @@ parallel.mk:
 
 test: parallel.mk subdirs
 	@$(MAKE) -f parallel.mk check
-	@$(SHELL) ./runsequential.sh
+	@$(SHELL) ./runsequential.sh -r
 	@$(SHELL) ./testsummary.sh
 
 check: test

bin/tests/system/README

@@ -98,6 +98,19 @@ Optional flags are:
                     ports 7900 through 7999).  If not specified, the test will
                     have ports 5000 to 5099 available to it.
 
+    -r              The "runall" flag.  This is related to cleaning up after
+                    the tests (see "Maintenance Notes" below).  If specified,
+                    it prevents a copy of the test's output listing from being
+                    deleted when the directory is cleaned up after the test
+                    completes.  (The test's output listing comprises messages
+                    produced by the test during its execution; it does not
+                    include the output files produced by utilities such as
+                    "dig" or "rndc", nor any logging output from named itself.)
+                    It is usually only used when "run.sh" is being called
+                    during a run of the entire test suite.  Note that if "-n"
+                    is specified on the "run.sh" command line, the test output
+                    is retained even if this option is omitted.
+
 Arguments are:
 
     test-name       Mandatory.  The name of the test, which is the name of the
@@ -240,12 +253,22 @@ Re-Running the Tests
 ---
 If there is a requirement to re-run a test (or the entire test suite), the
 files produced by the tests should be deleted first.  Normally, these files are
-deleted if the test succeeds but are retained on error.  The run.sh script
-automatically calls a given test's clean.sh script before invoking its setup.sh
-script.
+deleted if the test succeeds but are retained on error.
+
+Deletion of files produced by an individual test can be done with the command:
+
+    sh clean.sh [-r] <test-name>
+
+The optional flag is:
+
+    -r              The "runall" flag.  This is related to cleaning up after
+                    the tests (see "Maintenance Notes" below).  If specified,
+                    it prevents a copy of the test's output listing from being
+                    deleted when the directory is cleaned after the test
+                    completes.
 
 Deletion of the files produced by the set of tests (e.g. after the execution
-of "runall.sh") can be carried out using the command:
+of "runall.sh") can be deleted by the command:
 
     sh cleanall.sh
 
@@ -686,7 +709,7 @@ the ports are assigned when the tests are run.  This is achieved by having the
 when "make check" is run, and contains a target for each test of the form:
 
     <test-name>:
-        @$(SHELL) run.sh -p <baseport> <test-name>
+        @$(SHELL) run.sh -r -p <baseport> <test-name>
 
 The <baseport> is unique and the values of <baseport> for each test are
 separated by at least 100 ports.
@@ -694,27 +717,52 @@ separated by at least 100 ports.
 
 Cleaning Up From Tests
 ---
-When a test is run, up to three different types of files are created:
+When a test is run, files are created in the test directory.  These files fall
+into three categories:
 
-1. Files generated by the test itself, e.g. output from "dig" and "rndc", are
-stored in the test directory.
+1. Files generated by the test itself, e.g. output from "dig" and "rndc".
 
 2. Files produced by named which may not be cleaned up if named exits
-abnormally, e.g. core files, PID files etc., are stored in the test directory.
+abnormally, e.g. core files, PID files etc.
 
-3. A file "test.output.<test-name>" containing the text written to stdout by the
-test is written to bin/tests/system/.  This file is only produced when the test
-is run as part of the entire test suite (e.g. via "runall.sh").
+3. The file "test.output" containing the text written to stdout by the test.
+This is only produced when the test is run as part of the entire test suite
+(e.g. via "runall.sh").
 
 If the test fails, all these files are retained.  But if the test succeeds,
 they are cleaned up at different times:
 
 1. Files generated by the test itself are cleaned up by the test's own
-"clean.sh", which is called from "run.sh".
+"clean.sh".  This is called from the system's "clean.sh", which in turn is
+called from "run.sh".
 
-2. Files that may not be cleaned up if named exits abnormally can be removed
-using the "cleanall.sh" script.
+2. Files that may not be cleaned up if named exits abnormally are removed
+by the system's "clean.sh".
 
-3. "test.output.*" files are deleted when the test suite ends.  At this point,
-the file "testsummary.sh" is called which concatenates all the "test.output.*"
-files into a single "systests.output" file before deleting them.
+3. "test.output" files are deleted when the test suite ends.  At this point,
+the file "testsummary.sh" is called which concatenates all the "test.output"
+files into a single "systest.output" file before deleting them.
+
+A complication arises with the "test.output" file however:
+
+1. "clean.sh" is called by "run.sh" if the test ends successfully.  For
+this reason, "clean.sh" cannot delete "test.output" as, if the test is
+being run as part of a test suite, the file must be retained.
+
+2. If the deletion of "test.output" were to be solely the responsibility of
+"testsummary.sh", should a test suite terminate abnormally, cleaning up a test
+directory with "sh clean.sh <test-directory>" would leave the file present.
+
+3. An additional step could be added to "cleanall.sh" (which calls the
+system's "clean.sh" for each test) to remove the "test.output" file.  However,
+although the file would be deleted should all test directories be cleaned,
+it would still mean that running "clean.sh" on a particular test directory
+could leave the file present.
+
+To get round this, the system's "clean.sh" script takes an optional flag, "-r"
+(the "runall" flag).  When the test suite is run, each invocation of "run.sh"
+is passed the runall flag.  In turn, "run.sh" passes the flag to "clean.sh",
+which causes that script not to delete the "tests.output" file.  In other
+words, when the system's "clean.sh" is invoked standalone on a test directory
+(or as part of a run of "cleanall.sh"), it will delete the "test.output" if it
+is present.  When invoked during a run of the entire test suite, it won't.

bin/tests/system/addzone/clean.sh

@@ -9,34 +9,32 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f ./dig.out.*
-rm -f ./rndc.out*
-rm -f ./showzone.out*
-rm -f ./zonestatus.out*
-rm -f ./*/named.conf
-rm -f ./*/named.memstats
-rm -f ./ns1/*.nzf ./ns1/*.nzf~
-rm -f ./ns1/*.nzd ./ns1/*.nzd-lock
-rm -f ./ns2/*.nzf ./ns2/*.nzf~
-rm -f ./ns2/*.nzd ./ns2/*.nzd-lock
-rm -f ./ns3/*.nzf ./ns3/*.nzf~
-rm -f ./ns3/*.nzd ./ns3/*.nzd-lock
-rm -f ./ns2/core*
-rm -f ./ns2/inline.db.jbk
-rm -f ./ns2/inline.db.signed
-rm -f ./ns2/inlineslave.bk*
-rm -rf ./ns2/new-zones
-rm -f ./ns*/named.lock
-rm -f ./ns*/named.run ./ns*/named.run.prev
-rm -f ./ns2/nzf-*
-rm -f ./ns3/named.conf
-rm -f ./ns3/*.nzf ./ns3/*.nzf~
-rm -f ./ns3/*.nzd ns3/*.nzd-lock
-rm -f ./ns3/inlineslave.db
-rm -f ./ns1/redirect.db
-rm -f ./ns2/redirect.db
-rm -f ./ns2/redirect.bk
-rm -f ./ns3/redirect.db
-rm -f ./ns*/managed-keys.bind* ns*/*.mkeys*
-rm -f ./nzd2nzf.out.*
-rm -f ./wait_for_message.*
+rm -f dig.out.*
+rm -f rndc.out*
+rm -f showzone.out*
+rm -f zonestatus.out*
+rm -f */named.conf
+rm -f */named.memstats
+rm -f ns1/*.nzf ns1/*.nzf~
+rm -f ns1/*.nzd ns1/*.nzd-lock
+rm -f ns2/*.nzf ns2/*.nzf~
+rm -f ns2/*.nzd ns2/*.nzd-lock
+rm -f ns3/*.nzf ns3/*.nzf~
+rm -f ns3/*.nzd ns3/*.nzd-lock
+rm -f ns2/core*
+rm -f ns2/inline.db.jbk
+rm -f ns2/inline.db.signed
+rm -f ns2/inlineslave.bk*
+rm -rf ns2/new-zones
+rm -f ns*/named.lock
+rm -f ns*/named.run
+rm -f ns2/nzf-*
+rm -f ns3/named.conf
+rm -f ns3/*.nzf ns3/*.nzf~
+rm -f ns3/*.nzd ns3/*.nzd-lock
+rm -f ns3/inlineslave.db
+rm -f ns1/redirect.db
+rm -f ns2/redirect.db
+rm -f ns2/redirect.bk
+rm -f ns3/redirect.db
+rm -f ns*/managed-keys.bind* ns*/*.mkeys*

bin/tests/system/addzone/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 cp -f ns1/redirect.db.1 ns1/redirect.db
 cp -f ns2/redirect.db.1 ns2/redirect.db
 cp -f ns3/redirect.db.1 ns3/redirect.db

bin/tests/system/addzone/tests.sh

@@ -15,12 +15,6 @@ SYSTEMTESTTOP=..
 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"
 RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
 
-check_zonestatus() (
-    $RNDCCMD "10.53.0.$1" zonestatus -redirect > "zonestatus.out.ns$1.$n" &&
-    grep "type: redirect" "zonestatus.out.ns$1.$n" > /dev/null &&
-    grep "serial: 1" "zonestatus.out.ns$1.$n" > /dev/null
-)
-
 status=0
 n=0
 
@@ -55,30 +49,25 @@ fi
 echo_i "adding new zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'added.example { type master; file "added.db"; };' 2>&1 | sed 's/^/I:ns2 /'
-_check_adding_new_zone () (
-	$DIG $DIGOPTS @10.53.0.2 a.added.example a > dig.out.ns2.$n &&
-	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null &&
-	grep '^a.added.example' dig.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_adding_new_zone || ret=1
+$DIG $DIGOPTS @10.53.0.2 a.added.example a > dig.out.ns2.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
+grep '^a.added.example' dig.out.ns2.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-nextpart ns2/named.run >/dev/null
 echo_i "checking addzone errors are logged correctly"
 ret=0
 $RNDCCMD 10.53.0.2 addzone bad.example '{ type mister; };' 2>&1 | grep 'unexpected token' > /dev/null 2>&1 || ret=1
-wait_for_log_peek 20 "addzone: 'mister' unexpected" ns2/named.run || ret=1
+grep "addzone: 'mister' unexpected" ns2/named.run >/dev/null 2>&1 || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-nextpart ns2/named.run >/dev/null
 echo_i "checking modzone errors are logged correctly"
 ret=0
 $RNDCCMD 10.53.0.2 modzone added.example '{ type mister; };' 2>&1 | grep 'unexpected token' > /dev/null 2>&1 || ret=1
-wait_for_log_peek 20 "modzone: 'mister' unexpected" ns2/named.run || ret=1
+grep "modzone: 'mister' unexpected" ns2/named.run >/dev/null 2>&1 || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -86,12 +75,9 @@ status=`expr $status + $ret`
 echo_i "adding a zone that requires quotes ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone '"32/1.0.0.127-in-addr.added.example" { check-names ignore; type master; file "added.db"; };' 2>&1 | sed 's/^/I:ns2 /'
-_check_zone_that_requires_quotes() (
-	$DIG $DIGOPTS @10.53.0.2 "a.32/1.0.0.127-in-addr.added.example" a > dig.out.ns2.$n &&
-	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null &&
-	grep '^a.32/1.0.0.127-in-addr.added.example' dig.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_zone_that_requires_quotes || ret=1
+$DIG $DIGOPTS @10.53.0.2 "a.32/1.0.0.127-in-addr.added.example" a > dig.out.ns2.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
+grep '^a.32/1.0.0.127-in-addr.added.example' dig.out.ns2.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -99,12 +85,9 @@ status=`expr $status + $ret`
 echo_i "adding a zone with a quote in the name ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone '"foo\"bar.example" { check-names ignore; type master; file "added.db"; };' 2>&1 | sed 's/^/I:ns2 /'
-_check_zone_with_a_quote() (
-	$DIG $DIGOPTS @10.53.0.2 "a.foo\"bar.example" a > dig.out.ns2.$n &&
-	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null &&
-	grep '^a.foo\\"bar.example' dig.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_zone_with_a_quote || ret=1
+$DIG $DIGOPTS @10.53.0.2 "a.foo\"bar.example" a > dig.out.ns2.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
+grep '^a.foo\\"bar.example' dig.out.ns2.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -152,24 +135,21 @@ fi
 echo_i "deleting previously added zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone previous.example 2>&1 | sed 's/^/I:ns2 /'
-_check_deleting_previously_added_zone() (
-	$DIG $DIGOPTS @10.53.0.2 a.previous.example a > dig.out.ns2.$n &&
-	grep 'status: REFUSED' dig.out.ns2.$n > /dev/null &&
-	! grep '^a.previous.example' dig.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_deleting_previously_added_zone || ret=1
+$DIG $DIGOPTS @10.53.0.2 a.previous.example a > dig.out.ns2.$n
+grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep '^a.previous.example' dig.out.ns2.$n > /dev/null && ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-check_nzd2nzf() (
-	$NZD2NZF ns2/_default.nzd > nzd2nzf.out.$n &&
-	! grep previous.example nzd2nzf.out.$n > /dev/null
-)
-
 if [ -n "$NZD" ]; then
     echo_i "checking zone was deleted from NZD ($n)"
-    retry_quiet 10 check_nzd2nzf || ret=1
+    for i in 0 1 2 3 4 5 6 7 8 9; do
+        ret=0
+        $NZD2NZF ns2/_default.nzd | grep previous.example > /dev/null && ret=1
+        [ $ret = 0 ] && break
+        sleep 1
+    done
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=`expr $status + $ret`
 fi
@@ -187,12 +167,9 @@ fi
 echo_i "deleting newly added zone added.example ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone added.example 2>&1 | sed 's/^/I:ns2 /'
-_check_deleting_newly_added_zone() (
-	$DIG $DIGOPTS @10.53.0.2 a.added.example a > dig.out.ns2.$n &&
-	grep 'status: REFUSED' dig.out.ns2.$n > /dev/null &&
-	! grep '^a.added.example' dig.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_deleting_newly_added_zone || ret=1
+$DIG $DIGOPTS @10.53.0.2 a.added.example a > dig.out.ns2.$n
+grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep '^a.added.example' dig.out.ns2.$n > /dev/null && ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -200,12 +177,9 @@ status=`expr $status + $ret`
 echo_i "deleting newly added zone with escaped quote ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone "foo\\\"bar.example" 2>&1 | sed 's/^/I:ns2 /'
-_check_deleting_newly_added_zone_quote() (
-	$DIG $DIGOPTS @10.53.0.2 "a.foo\"bar.example" a > dig.out.ns2.$n &&
-	grep 'status: REFUSED' dig.out.ns2.$n > /dev/null &&
-	! grep "^a.foo\"bar.example" dig.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_deleting_newly_added_zone_quote || ret=1
+$DIG $DIGOPTS @10.53.0.2 "a.foo\"bar.example" a > dig.out.ns2.$n
+grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep "^a.foo\"bar.example" dig.out.ns2.$n > /dev/null && ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -251,7 +225,9 @@ ret=0
 sleep 1
 cp -f ns1/redirect.db.2 ns1/redirect.db
 $RNDCCMD 10.53.0.1 reload -redirect > rndc.out.ns1.$n
-retry_quiet 5 check_zonestatus 1 || ret=1
+$RNDCCMD 10.53.0.1 zonestatus -redirect > zonestatus.out.ns1.$n
+grep "type: redirect" zonestatus.out.ns1.$n > /dev/null || ret=1
+grep "serial: 1" zonestatus.out.ns1.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -259,27 +235,27 @@ status=`expr $status + $ret`
 echo_i "delete a normally-loaded zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone normal.example > rndc.out.ns2.$n 2>&1
-grep "is no longer active and will be deleted" rndc.out.ns2.$n > /dev/null || ret=11
+$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n
+grep "is no longer active and will be deleted" rndc.out.ns2.$n > /dev/null || ret=1
 grep "To keep it from returning when the server is restarted" rndc.out.ns2.$n > /dev/null || ret=1
 grep "must also be removed from named.conf." rndc.out.ns2.$n > /dev/null || ret=1
-_check_delete_normally_loaded_zone() (
-	$DIG $DIGOPTS @10.53.0.2 a.normal.example a > dig.out.ns2.$n &&
-	grep 'status: REFUSED' dig.out.ns2.$n > /dev/null
-)
-retry_quiet 5 _check_delete_normally_loaded_zone || ret=1
 
+grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 echo_i "attempting to add master zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inline.example { type master; file "inline.db"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
-_check_add_master_zone_with_inline() (
-	$DIG $DIGOPTS @10.53.0.2 a.inline.example a > dig.out.ns2.$n &&
-	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null &&
-	grep '^a.inline.example' dig.out.ns2.$n > /dev/null
-)
-retry_quiet 5 _check_add_master_zone_with_inline || ret=1
+for i in 1 2 3 4 5
+do
+ret=0
+$DIG $DIGOPTS @10.53.0.2 a.inline.example a > dig.out.ns2.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
+grep '^a.inline.example' dig.out.ns2.$n > /dev/null || ret=1
+[ $ret = 0 ] && break
+sleep 1
+done
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -294,20 +270,27 @@ status=`expr $status + $ret`
 
 echo_i "attempting to add slave zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inlineslave.example { type slave; masters { 10.53.0.1; }; file "inlineslave.bk"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
-_check_add_slave_with_inline() (
-	$DIG $DIGOPTS @10.53.0.2 a.inlineslave.example a > dig.out.ns2.$n &&
-	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null &&
-	grep '^a.inlineslave.example' dig.out.ns2.$n > /dev/null
-)
-retry_quiet 5 _check_add_slave_with_inline || ret=1
+for i in 1 2 3 4 5
+do
+ret=0
+$DIG $DIGOPTS @10.53.0.2 a.inlineslave.example a > dig.out.ns2.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
+grep '^a.inlineslave.example' dig.out.ns2.$n > /dev/null || ret=1
+[ $ret = 0 ] && break
+sleep 1
+done
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 echo_i "attempting to delete slave zone with inline signing ($n)"
 ret=0
-retry_quiet 10 test -f ns2/inlineslave.bk.signed -a -f ns2/inlineslave.bk || ret=1
-$RNDCCMD 10.53.0.2 delzone inlineslave.example > rndc.out2.test$n 2>&1 || ret=1
+for i in 0 1 2 3 4 5 6 7 8 9
+do
+	test -f ns2/inlineslave.bk.signed -a -f ns2/inlineslave.bk && break
+	sleep 1
+done
+$RNDCCMD 10.53.0.2 delzone inlineslave.example 2>&1 > rndc.out2.test$n
 test -f inlineslave.bk ||
 grep '^inlineslave.bk$' rndc.out2.test$n > /dev/null || {
 	echo_i "failed to report inlineslave.bk"; ret=1;
@@ -321,30 +304,43 @@ status=`expr $status + $ret`
 
 echo_i "restoring slave zone with inline signing ($n)"
 $RNDCCMD 10.53.0.2 addzone 'inlineslave.example { type slave; masters { 10.53.0.1; }; file "inlineslave.bk"; inline-signing yes; };' 2>&1 | sed 's/^/I:ns2 /'
-_check_restoring_slave_with_inline() (
-	$DIG $DIGOPTS @10.53.0.2 a.inlineslave.example a > dig.out.ns2.$n &&
-	grep 'status: NOERROR' dig.out.ns2.$n > /dev/null &&
-	grep '^a.inlineslave.example' dig.out.ns2.$n > /dev/null
-)
-retry_quiet 5 _check_restoring_slave_with_inline || ret=1
+for i in 1 2 3 4 5
+do
+ret=0
+$DIG $DIGOPTS @10.53.0.2 a.inlineslave.example a > dig.out.ns2.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
+grep '^a.inlineslave.example' dig.out.ns2.$n > /dev/null || ret=1
+[ $ret = 0 ] && break
+sleep 1
+done
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 echo_i "deleting slave zone with automatic zone file removal ($n)"
 ret=0
-retry_quiet 10 test -f ns2/inlineslave.bk.signed -a -f ns2/inlineslave.bk || ret=1
-$RNDCCMD 10.53.0.2 delzone -clean inlineslave.example > /dev/null 2>&1
-retry_quiet 10 test ! -f ns2/inlineslave.bk.signed -a ! -f ns2/inlineslave.bk
+for i in 0 1 2 3 4 5 6 7 8 9
+do
+	test -f ns2/inlineslave.bk.signed -a -f ns2/inlineslave.bk && break
+	sleep 1
+done
+$RNDCCMD 10.53.0.2 delzone -clean inlineslave.example 2>&1 > /dev/null
+for i in 0 1 2 3 4 5 6 7 8 9
+do
+        ret=0
+	test -f ns2/inlineslave.bk.signed -a -f ns2/inlineslave.bk && ret=1
+        [ $ret = 0 ] && break
+	sleep 1
+done
 n=`expr $n + 1`
 status=`expr $status + $ret`
 
 echo_i "modifying zone configuration ($n)"
 ret=0
-$RNDCCMD 10.53.0.2 addzone 'mod.example { type master; file "added.db"; };' 2>&1 | sed 's/^/ns2 /' | cat_i
+$RNDCCMD 10.53.0.2 addzone 'mod.example { type master; file "added.db"; };' 2>&1 | sed 's/^/I:ns2 /'
 $DIG +norec $DIGOPTS @10.53.0.2 mod.example ns > dig.out.ns2.1.$n || ret=1
 grep 'status: NOERROR' dig.out.ns2.1.$n > /dev/null || ret=1
-$RNDCCMD 10.53.0.2 modzone 'mod.example { type master; file "added.db"; allow-query { none; }; };' 2>&1 | sed 's/^/ns2 /' | cat_i
+$RNDCCMD 10.53.0.2 modzone 'mod.example { type master; file "added.db"; allow-query { none; }; };' 2>&1 | sed 's/^/I:ns2 /'
 $DIG +norec $DIGOPTS @10.53.0.2 mod.example ns > dig.out.ns2.2.$n || ret=1
 $RNDCCMD 10.53.0.2 showzone mod.example | grep 'allow-query { "none"; };' > /dev/null 2>&1 || ret=1
 n=`expr $n + 1`
@@ -368,14 +364,11 @@ status=`expr $status + $ret`
 echo_i "check that adding a 'master redirect' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone '"." { type redirect; file "redirect.db"; };' > rndc.out.ns2.$n 2>&1 || ret=1
-_check_add_master_redirect() (
-	$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1 &&
-	grep "type redirect;" showzone.out.ns2.$n > /dev/null &&
-	$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 &&
-	grep "type: redirect" zonestatus.out.ns2.$n > /dev/null &&
-	grep "serial: 0" zonestatus.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_add_master_redirect || ret=1
+$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1 || ret=1
+grep "type redirect;" showzone.out.ns2.$n > /dev/null || ret=1
+$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || ret=1
+grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || ret=1
+grep "serial: 0" zonestatus.out.ns2.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -385,7 +378,9 @@ ret=0
 sleep 1
 cp -f ns2/redirect.db.2 ns2/redirect.db
 $RNDCCMD 10.53.0.2 reload -redirect > rndc.out.ns2.$n
-retry_quiet 10 check_zonestatus 2 || ret=1
+$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || ret=1
+grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || ret=1
+grep "serial: 1" zonestatus.out.ns2.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -400,11 +395,8 @@ status=`expr $status + $ret`
 echo_i "check that deleting a 'master redirect' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone -redirect > rndc.out.ns2.$n 2>&1 || ret=1
-_check_deleting_master_redirect() (
-	$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1 || true
-	grep 'not found' showzone.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_deleting_master_redirect || ret=1
+$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1
+grep 'not found' showzone.out.ns2.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -412,14 +404,12 @@ status=`expr $status + $ret`
 echo_i "check that adding a 'slave redirect' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone '"." { type redirect; masters { 10.53.0.3;}; file "redirect.bk"; };' > rndc.out.ns2.$n 2>&1 || ret=1
-_check_adding_slave_redirect() (
-	$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1 &&
-	grep "type redirect;" showzone.out.ns2.$n > /dev/null &&
-	$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 &&
-	grep "type: redirect" zonestatus.out.ns2.$n > /dev/null &&
-	grep "serial: 0" zonestatus.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_adding_slave_redirect || ret=1
+$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1 || ret=1
+grep "type redirect;" showzone.out.ns2.$n > /dev/null || ret=1
+sleep 1
+$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || ret=1
+grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || ret=1
+grep "serial: 0" zonestatus.out.ns2.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -428,13 +418,12 @@ echo_i "check that retransfering a added 'slave redirect' zone works ($n)"
 ret=0
 cp -f ns3/redirect.db.2 ns3/redirect.db
 $RNDCCMD 10.53.0.3 reload . > showzone.out.ns3.$n 2>&1 || ret=1
-_check_retransfering_slave_redirect() (
-	$RNDCCMD 10.53.0.2 retransfer -redirect > rndc.out.ns2.$n 2>&1 &&
-	$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 &&
-	grep "type: redirect" zonestatus.out.ns2.$n > /dev/null &&
-	grep "serial: 1" zonestatus.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_retransfering_slave_redirect || ret=1
+sleep 1
+$RNDCCMD 10.53.0.2 retransfer -redirect > rndc.out.ns2.$n 2>&1 || ret=1
+sleep 1
+$RNDCCMD 10.53.0.2 zonestatus -redirect > zonestatus.out.ns2.$n 2>&1 || ret=1
+grep "type: redirect" zonestatus.out.ns2.$n > /dev/null || ret=1
+grep "serial: 1" zonestatus.out.ns2.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -442,11 +431,8 @@ status=`expr $status + $ret`
 echo_i "check that deleting a 'slave redirect' zone works ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone -redirect > rndc.out.ns2.$n 2>&1 || ret=1
-_check_deleting_slave_redirect() (
-	$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1 || true
-	grep 'not found' showzone.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_deleting_slave_redirect || ret=1
+$RNDCCMD 10.53.0.2 showzone -redirect > showzone.out.ns2.$n 2>&1
+grep 'not found' showzone.out.ns2.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -531,30 +517,31 @@ fi
 
 echo_i "checking rndc reload causes named to reload the external view's new zone config ($n)"
 ret=0
-$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/ns2 /' | cat_i
-_check_rndc_reload_external_view_config() (
-	$DIG +norec $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.int.$n &&
-	grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null &&
-	$DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n &&
-	grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null &&
-	grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null
-)
-retry_quiet 10 _check_rndc_reload_external_view_config || ret=1
+$RNDCCMD 10.53.0.2 reload 2>&1 | sed 's/^/I:ns2 /'
+$DIG +norec $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.int.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null || ret=1
+$DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null || ret=1
+grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 echo_i "checking rndc showzone with newly added zone ($n)"
-_check_rndc_showzone_newly_added() (
-	if [ -z "$NZD" ]; then
-		expected='zone "added.example" in external { type master; file "added.db"; };'
-	else
-		expected='zone "added.example" { type master; file "added.db"; };'
-	fi
-	$RNDCCMD 10.53.0.2 showzone added.example in external > rndc.out.ns2.$n 2>/dev/null &&
-	[ "`cat rndc.out.ns2.$n`" = "$expected" ]
-)
-retry_quiet 10  _check_rndc_showzone_newly_added || ret=1
+# loop because showzone may complain if zones are still being
+# loaded from the NZDB at this point.
+for try in 0 1 2 3 4 5; do
+    ret=0
+$RNDCCMD 10.53.0.2 showzone added.example in external > rndc.out.ns2.$n 2>/dev/null
+    if [ -z "$NZD" ]; then
+      expected='zone "added.example" in external { type master; file "added.db"; };'
+    else
+      expected='zone "added.example" { type master; file "added.db"; };'
+    fi
+    [ "`cat rndc.out.ns2.$n`" = "$expected" ] || ret=1
+    [ $ret -eq 0 ] && break
+    sleep 1
+done
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -562,12 +549,9 @@ status=`expr $status + $ret`
 echo_i "deleting newly added zone ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 delzone 'added.example in external' 2>&1 | sed 's/^/I:ns2 /'
-_check_deleting_newly_added_zone() (
-	$DIG $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.$n &&
-	grep 'status: REFUSED' dig.out.ns2.$n > /dev/null &&
-	! grep '^a.added.example' dig.out.ns2.$n > /dev/null
-)
-retry_quiet 10 _check_deleting_newly_added_zone || ret=1
+$DIG $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.$n || ret=1
+grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
+grep '^a.added.example' dig.out.ns2.$n > /dev/null && ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -597,14 +581,11 @@ status=`expr $status + $ret`
 echo_i "adding new zone again to external view ($n)"
 ret=0
 $RNDCCMD 10.53.0.2 addzone 'added.example in external { type master; file "added.db"; };' 2>&1 | sed 's/^/I:ns2 /'
-_check_adding_new_zone_again_external() (
-	$DIG +norec $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.int.$n &&
-	grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null &&
-	$DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n &&
-	grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null &&
-	grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null
-)
-retry_quiet 10 _check_adding_new_zone_again_external || ret=1
+$DIG +norec $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.added.example a > dig.out.ns2.int.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.int.$n > /dev/null || ret=1
+$DIG +norec $DIGOPTS @10.53.0.4 -b 10.53.0.4 a.added.example a > dig.out.ns2.ext.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.ext.$n > /dev/null || ret=1
+grep '^a.added.example' dig.out.ns2.ext.$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -709,18 +690,20 @@ then
     status=`expr $status + $ret`
 fi
 
-_check_version_bind() (
-	$DIG $DIGOPTS @10.53.0.3 version.bind txt ch > dig.out.test$n &&
-	grep "status: NOERROR" dig.out.test$n > /dev/null
-)
-
 echo_i "check that named restarts with multiple added zones ($n)"
 ret=0
 $RNDCCMD 10.53.0.3 addzone "test4.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.3 addzone "test5.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $PERL $SYSTEMTESTTOP/stop.pl addzone ns3
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} addzone ns3 || ret=1
-retry_quiet 10 _check_version_bind || ret=1
+for try in 0 1 2 3 4 5 6 7 8 9; do
+    iret=0
+    $DIG $DIGOPTS @10.53.0.3 version.bind txt ch > dig.out.test$n || iret=1
+    grep "status: NOERROR" dig.out.test$n > /dev/null || iret=1
+    [ "$iret" -eq 0 ] && break
+    sleep 1
+done
+[ "$iret" -ne 0 ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`

bin/tests/system/allow-query/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 copy_setports ../common/controls.conf.in ns2/controls.conf
 copy_setports  ns1/named.conf.in ns1/named.conf
 copy_setports  ns2/named01.conf.in ns2/named.conf

bin/tests/system/auth/setup.sh

@@ -12,5 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf

bin/tests/system/autosign/clean.sh

@@ -14,7 +14,7 @@ rm -f */core
 rm -f */example.bk
 rm -f */named.conf
 rm -f */named.memstats
-rm -f */named.run*
+rm -f */named.run
 rm -f */trusted.conf */private.conf
 rm -f activate-now-publish-1day.key
 rm -f active.key inact.key del.key delzsk.key unpub.key standby.key rev.key
@@ -39,7 +39,6 @@ rm -f ns3/inacksk2.example.db
 rm -f ns3/inacksk3.example.db
 rm -f ns3/inaczsk2.example.db
 rm -f ns3/inaczsk3.example.db
-rm -f ns3/jitter.nsec3.example.db
 rm -f ns3/kg.out ns3/s.out ns3/st.out
 rm -f ns3/kskonly.example.db
 rm -f ns3/nozsk.example.db ns3/inaczsk.example.db
@@ -63,7 +62,6 @@ rm -f ns3/secure.nsec3.example.db
 rm -f ns3/secure.optout.example.db
 rm -f ns3/sync.example.db
 rm -f ns3/ttl*.db
-rm -f ns3/settime.out.*
 rm -f nsupdate.out
 rm -f settime.out.*
 rm -f signing.out.*

bin/tests/system/autosign/ns1/keygen.sh

@@ -33,12 +33,12 @@ rm $zsknopriv.private
 ksksby=`$KEYGEN -3 -a RSASHA1 -q -P now -A now+15s -fk $zone`
 kskrev=`$KEYGEN -3 -a RSASHA1 -q -R now+15s -fk $zone`
 
-keyfile_to_static_ds $ksksby > trusted.conf
+keyfile_to_static_keys $ksksby > trusted.conf
 cp trusted.conf ../ns2/trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf
 
-keyfile_to_static_ds $kskrev > trusted.conf
+keyfile_to_static_keys $kskrev > trusted.conf
 cp trusted.conf ../ns5/trusted.conf
 
 echo $zskact > ../active.key

bin/tests/system/autosign/ns2/keygen.sh

@@ -37,7 +37,7 @@ zonefile="${zone}.db"
 infile="${zonefile}.in"
 ksk=`$KEYGEN -a RSASHA1 -3 -q -fk $zone`
 $KEYGEN -a RSASHA1 -3 -q $zone > /dev/null
-keyfile_to_static_ds $ksk > private.conf
+keyfile_to_static_keys $ksk > private.conf
 cp private.conf ../ns4/private.conf
 $SIGNER -S -3 beef -A -o $zone -f $zonefile $infile > /dev/null
 

bin/tests/system/autosign/ns3/jitter.nsec3.example.db.in

@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				2000042407 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-

bin/tests/system/autosign/ns3/keygen.sh

@@ -52,21 +52,6 @@ ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
 $DSFROMKEY $ksk.key > dsset-${zone}$TP
 
-#
-#  Jitter/NSEC3 test zone
-#
-setup jitter.nsec3.example
-cp $infile $zonefile
-count=1
-while [ $count -le 1000 ]
-do
-    echo "label${count} IN TXT label${count}" >> $zonefile
-    count=`expr $count + 1`
-done
-# Don't create keys just yet, because the scenario we want to test
-# is an unsigned zone that has a NSEC3PARAM record added with
-# dynamic update before the keys are generated.
-
 #
 #  OPTOUT/NSEC3 test zone
 #
@@ -165,16 +150,9 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
 #
 setup oldsigs.example
 cp $infile $zonefile
-count=1
-while [ $count -le 1000 ]
-do
-    echo "label${count} IN TXT label${count}" >> $zonefile
-    count=`expr $count + 1`
-done
 $KEYGEN -q -a RSASHA1 -fk $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -q -a RSASHA1 $zone > kg.out 2>&1 || dumpit kg.out
-$SIGNER -PS -s now-1y -e now-6mo -o $zone -f $zonefile.signed $zonefile > s.out || dumpit s.out
-mv $zonefile.signed $zonefile
+$SIGNER -PS -s now-1y -e now-6mo -o $zone -f $zonefile $infile > s.out || dumpit s.out
 
 #
 # NSEC3->NSEC transition test zone.

bin/tests/system/autosign/ns3/named.conf.in

@@ -95,16 +95,6 @@ zone "nsec3.nsec3.example" {
 	auto-dnssec maintain;
 };
 
-zone "jitter.nsec3.example" {
-	type master;
-	file "jitter.nsec3.example.db";
-	allow-update { any; };
-	auto-dnssec maintain;
-	sig-validity-interval 10 2;
-	sig-signing-nodes 1000;
-	sig-signing-signatures 100;
-};
-
 zone "secure.nsec3.example" {
 	type master;
 	file "secure.nsec3.example.db";
@@ -188,9 +178,6 @@ zone "oldsigs.example" {
 	file "oldsigs.example.db";
 	allow-update { any; };
 	auto-dnssec maintain;
-	sig-validity-interval 10 2;
-	sig-signing-nodes 1000;
-	sig-signing-signatures 100;
 };
 
 zone "prepub.example" {

bin/tests/system/autosign/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf

bin/tests/system/autosign/tests.sh

@@ -50,82 +50,6 @@ checkprivate () {
     return 1
 }
 
-# wait until notifies for zone $1 are sent by server $2. This is an indication
-# that the zone is signed with the active keys, and the changes have been
-# committed.
-wait_for_notifies () {
-	wait_for_log 10 "zone ${1}/IN: sending notifies" "${2}/named.run" || return 1
-}
-
-freq() {
-	_file=$1
-	# remove first and last line that has incomplete set and skews the distribution
-	awk '$4 == "RRSIG" {print substr($9,1,8)}' < "$_file" | sort | uniq -c | sed '1d;$d'
-}
-# Check the signatures expiration times.  First check how many signatures
-# there are in total ($rrsigs).  Then see what the distribution of signature
-# expiration times is ($expiretimes).  Ignore the time part for a better
-# modelled distribution.
-checkjitter () {
-	_file=$1
-	_ret=0
-
-	if ! command -v bc >/dev/null 2>&1; then
-		echo_i "skip: bc not available"
-		return 0
-	fi
-
-	freq "$_file" | cat_i
-	_expiretimes=$(freq "$_file" | awk '{print $1}')
-
-	_count=0
-	# Check if we have at least 5 days
-	# This number has been tuned for `sig-validity-interval 10 2`, as
-	# 1. 1. signature expiration dates should be spread out across at most 8 (10-2) days
-	# 2. we remove first and last day to remove frequency outlier, we are left with 6 (8-2) days
-	# 3. we substract one more day to allow test pass on day boundaries, etc. leaving us with 5 (6-1) days
-	for _num in $_expiretimes
-	do
-		_count=$((_count+1))
-	done
-	if [ "$_count" -lt 5 ]; then
-		echo_i "error: not enough categories"
-		return 1
-	fi
-
-	# Calculate mean
-	_total=0
-	for _num in $_expiretimes
-	do
-		_total=$((_total+_num))
-	done
-	_mean=$(($_total / $_count))
-
-	# Calculate stddev
-	_stddev=0
-	for _num in $_expiretimes
-	do
-		_stddev=$(echo "$_stddev + (($_num - $_mean) * ($_num - $_mean))" | bc)
-	done
-	_stddev=$(echo "sqrt($_stddev/$_count)" | bc)
-
-	# We expect the number of signatures not to exceed the mean +- 3 * stddev.
-	_limit=$((_stddev*3))
-	_low=$((_mean-_limit))
-	_high=$((_mean+_limit))
-	# Find outliers.
-	echo_i "checking whether all frequencies fall into <$_low;$_high> range"
-	for _num in $_expiretimes
-	do
-		if [ $_num -gt $_high ] || [ $_num -lt $_low ]; then
-			echo_i "error: too many RRSIG records ($_num) with the same expiration time"
-			_ret=1
-		fi
-	done
-
-	return $_ret
-}
-
 #
 #  The NSEC record at the apex of the zone and its RRSIG records are
 #  added as part of the last step in signing a zone.  We wait for the
@@ -184,9 +108,6 @@ do
 	$DIG $DIGOPTS $z @10.53.0.3 axfr | awk '$4 == "RRSIG" {print $9}' | sort | uniq -c | cat_i
 done
 
-# Set logfile offset for wait_for_log usage.
-nextpartreset ns3/named.run
-
 #
 # Check that DNSKEY is initially signed with a KSK and not a ZSK.
 #
@@ -217,8 +138,8 @@ test $count -eq 3 || ret=1
 awk='$4 == "RRSIG" && $5 == "DNSKEY" { printf "%05u\n", $11 }'
 id=`awk "${awk}" dig.out.ns3.test$n`
 
-$SETTIME -D now+5 ns3/Kinacksk3.example.+007+${id} > settime.out.test$n || ret=1
-($RNDCCMD 10.53.0.3 loadkeys inacksk3.example 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+$SETTIME -D now+5 ns3/Kinacksk3.example.+007+${id} > /dev/null 2>&1
+$RNDCCMD 10.53.0.3 loadkeys inacksk3.example 2>&1 | sed 's/^/ns3 /' | cat_i
 
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -245,8 +166,8 @@ count=`awk 'BEGIN { count = 0 }
        END {print count}' dig.out.ns3.test$n`
 test $count -eq 3 || ret=1
 id=`awk '$4 == "RRSIG" && $5 == "CNAME" { printf "%05u\n", $11 }' dig.out.ns3.test$n`
-$SETTIME -D now+5 ns3/Kinaczsk3.example.+007+${id} > settime.out.test$n || ret=1
-($RNDCCMD 10.53.0.3 loadkeys inaczsk3.example 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+$SETTIME -D now+5 ns3/Kinaczsk3.example.+007+${id} > /dev/null 2>&1
+$RNDCCMD 10.53.0.3 loadkeys inaczsk3.example 2>&1 | sed 's/^/ns3 /' | cat_i
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -342,9 +263,9 @@ status=`expr $status + $ret`
 echo_i "signing preset nsec3 zone"
 zsk=`cat autozsk.key`
 ksk=`cat autoksk.key`
-$SETTIME -K ns3 -P now -A now $zsk > settime.out.test$n.zsk || ret=1
-$SETTIME -K ns3 -P now -A now $ksk > settime.out.test$n.ksk || ret=1
-($RNDCCMD 10.53.0.3 loadkeys autonsec3.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+$SETTIME -K ns3 -P now -A now $zsk > /dev/null 2>&1
+$SETTIME -K ns3 -P now -A now $ksk > /dev/null 2>&1
+$RNDCCMD 10.53.0.3 loadkeys autonsec3.example. 2>&1 | sed 's/^/ns3 /' | cat_i
 
 echo_i "waiting for changes to take effect"
 sleep 3
@@ -397,37 +318,22 @@ status=`expr $status + $ret`
 # Send rndc sync command to ns1, ns2 and ns3, to force the dynamically
 # signed zones to be dumped to their zone files
 echo_i "dumping zone files"
-($RNDCCMD 10.53.0.1 sync 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
-($RNDCCMD 10.53.0.2 sync 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1
-($RNDCCMD 10.53.0.3 sync 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
-
-now="$(TZ=UTC date +%Y%m%d%H%M%S)"
-check_expiry() (
-	$DIG $DIGOPTS AXFR oldsigs.example @10.53.0.3 > dig.out.test$n
-	nearest_expiration="$(awk '$4 == "RRSIG" { print $9 }' < dig.out.test$n | sort -n | head -1)"
-	if [ "$nearest_expiration" -le "$now" ]; then
-		echo_i "failed: $nearest_expiration <= $now"
-		return 1
-	fi
-)
+$RNDCCMD 10.53.0.1 sync 2>&1 | sed 's/^/ns1 /' | cat_i
+$RNDCCMD 10.53.0.2 sync 2>&1 | sed 's/^/ns2 /' | cat_i
+$RNDCCMD 10.53.0.3 sync 2>&1 | sed 's/^/ns3 /' | cat_i
 
 echo_i "checking expired signatures were updated ($n)"
-retry 10 check_expiry || ret=1
-$DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
-$DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
-digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+for i in 1 2 3 4 5 6 7 8 9
+do
+	ret=0
+	$DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+	$DIG $DIGOPTS +noauth a.oldsigs.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
+        digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
+	grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
+	[ $ret = 0 ] && break
+	sleep 1
+done
 n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-# Check jitter distribution.
-echo_i "checking expired signatures were jittered correctly ($n)"
-ret=0
-$DIG $DIGOPTS axfr oldsigs.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-checkjitter dig.out.ns3.test$n || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 echo_i "checking NSEC->NSEC3 conversion succeeded ($n)"
@@ -498,7 +404,7 @@ echo_i "checking TTLs of imported DNSKEYs (no default) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +noall +answer dnskey ttl1.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
 [ -s dig.out.ns3.test$n ] || ret=1
-(awk 'BEGIN {r=0} $2 != 300 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
+awk 'BEGIN {r=0} $2 != 300 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n || ret=1 | cat_i
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -507,7 +413,7 @@ echo_i "checking TTLs of imported DNSKEYs (with default) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +noall +answer dnskey ttl2.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
 [ -s dig.out.ns3.test$n ] || ret=1
-(awk 'BEGIN {r=0} $2 != 60 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
+awk 'BEGIN {r=0} $2 != 60 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n || ret=1 | cat_i
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -516,7 +422,7 @@ echo_i "checking TTLs of imported DNSKEYs (mismatched) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +noall +answer dnskey ttl3.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
 [ -s dig.out.ns3.test$n ] || ret=1
-(awk 'BEGIN {r=0} $2 != 30 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
+awk 'BEGIN {r=0} $2 != 30 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n || ret=1 | cat_i
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -525,7 +431,7 @@ echo_i "checking TTLs of imported DNSKEYs (existing RRset) ($n)"
 ret=0
 $DIG $DIGOPTS +tcp +noall +answer dnskey ttl4.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
 [ -s dig.out.ns3.test$n ] || ret=1
-(awk 'BEGIN {r=0} $2 != 30 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n | cat_i) || ret=1
+awk 'BEGIN {r=0} $2 != 30 {r=1; print "found TTL " $2} END {exit r}' dig.out.ns3.test$n || ret=1 | cat_i
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
@@ -1016,10 +922,10 @@ status=`expr $status + $ret`
 echo_i "checking secure-to-insecure transition, scheduled ($n)"
 ret=0
 file="ns3/`cat del1.key`.key"
-$SETTIME -I now -D now $file > settime.out.test$n.1 || ret=1
+$SETTIME -I now -D now $file > /dev/null
 file="ns3/`cat del2.key`.key"
-$SETTIME -I now -D now $file > settime.out.test$n.2 || ret=1
-($RNDCCMD 10.53.0.3 sign secure-to-insecure2.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+$SETTIME -I now -D now $file > /dev/null
+$RNDCCMD 10.53.0.3 sign secure-to-insecure2.example. 2>&1 | sed 's/^/ns3 /' | cat_i
 for i in 0 1 2 3 4 5 6 7 8 9; do
 	ret=0
 	$DIG $DIGOPTS axfr secure-to-insecure2.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
@@ -1032,33 +938,6 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-echo_i "checking jitter in a newly signed NSEC3 zone ($n)"
-ret=0
-# Use DNS UPDATE to add an NSEC3PARAM record into the zone.
-$NSUPDATE > nsupdate.out.test$n 2>&1 <<END || ret=1
-server 10.53.0.3 ${PORT}
-zone jitter.nsec3.example.
-update add jitter.nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
-send
-END
-[ $ret != 0 ] && echo_i "error: dynamic update add NSEC3PARAM failed"
-# Create DNSSEC keys in the zone directory.
-$KEYGEN -a rsasha1 -3 -q -K ns3 jitter.nsec3.example > /dev/null
-# Trigger zone signing.
-($RNDCCMD 10.53.0.3 sign jitter.nsec3.example. 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
-# Wait until zone has been signed.
-check_if_nsec3param_exists() {
-	$DIG $DIGOPTS NSEC3PARAM jitter.nsec3.example @10.53.0.3 > dig.out.ns3.1.test$n || return 1
-	grep -q "^jitter\.nsec3\.example\..*NSEC3PARAM" dig.out.ns3.1.test$n || return 1
-}
-retry_quiet 20 check_if_nsec3param_exists || ret=1
-$DIG $DIGOPTS AXFR jitter.nsec3.example @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
-# Check jitter distribution.
-checkjitter dig.out.ns3.2.test$n || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "checking that serial number and RRSIGs are both updated (rt21045) ($n)"
 ret=0
 oldserial=`$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '$0 !~ /SOA/ {print $3}'`
@@ -1066,7 +945,7 @@ oldinception=`$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '/SOA/ {p
 
 $KEYGEN -a rsasha1 -3 -q -K ns3 -P 0 -A +6d -I +38d -D +45d prepub.example > /dev/null
 
-($RNDCCMD 10.53.0.3 sign prepub.example 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
+$RNDCCMD 10.53.0.3 sign prepub.example 2>&1 | sed 's/^/ns1 /' | cat_i
 newserial=$oldserial
 try=0
 while [ $oldserial -eq $newserial -a $try -lt 42 ]
@@ -1097,19 +976,19 @@ oldfile=`cat active.key`
 oldid=$(keyfile_to_key_id "$(cat active.key)")
 newfile=`cat standby.key`
 newid=$(keyfile_to_key_id "$(cat standby.key)")
-$SETTIME -K ns1 -I now+2s -D now+25 $oldfile > settime.out.test$n.1 || ret=1
-$SETTIME -K ns1 -i 0 -S $oldfile $newfile > settime.out.test$n.2 || ret=1
+$SETTIME -K ns1 -I now+2s -D now+25 $oldfile > /dev/null
+$SETTIME -K ns1 -i 0 -S $oldfile $newfile > /dev/null
 
 # note previous zone serial number
 oldserial=`$DIG $DIGOPTS +short soa . @10.53.0.1 | awk '{print $3}'`
 
-($RNDCCMD 10.53.0.1 loadkeys . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
+$RNDCCMD 10.53.0.1 loadkeys . 2>&1 | sed 's/^/ns1 /' | cat_i
 sleep 4
 
 echo_i "revoking key to duplicated key ID"
-$SETTIME -R now -K ns2 Kbar.+005+30676.key > settime.out.test$n.3 || ret=1
+$SETTIME -R now -K ns2 Kbar.+005+30676.key > /dev/null 2>&1
 
-($RNDCCMD 10.53.0.2 loadkeys bar. 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1
+$RNDCCMD 10.53.0.2 loadkeys bar. 2>&1 | sed 's/^/ns2 /' | cat_i
 
 echo_i "waiting for changes to take effect"
 sleep 5
@@ -1162,7 +1041,7 @@ n=`expr $n + 1`
 status=`expr $status + $ret`
 
 echo_i "forcing full sign"
-($RNDCCMD 10.53.0.1 sign . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
+$RNDCCMD 10.53.0.1 sign . 2>&1 | sed 's/^/ns1 /' | cat_i
 
 echo_i "waiting for change to take effect"
 sleep 5
@@ -1188,10 +1067,8 @@ ret=0
 zsk=`cat delayzsk.key`
 ksk=`cat delayksk.key`
 # publication and activation times should be unset
-$SETTIME -K ns3 -pA -pP $zsk > settime.out.test$n.zsk || ret=1
-grep -v UNSET settime.out.test$n.zsk >/dev/null && ret=1
-$SETTIME -K ns3 -pA -pP $ksk > settime.out.test$n.ksk || ret=1
-grep -v UNSET settime.out.test$n.ksk >/dev/null && ret=1
+$SETTIME -K ns3 -pA -pP $zsk | grep -v UNSET > /dev/null 2>&1 && ret=1
+$SETTIME -K ns3 -pA -pP $ksk | grep -v UNSET > /dev/null 2>&1 && ret=1
 $DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
 # DNSKEY not expected:
 awk 'BEGIN {r=1} $4=="DNSKEY" {r=0} END {exit r}' dig.out.ns3.test$n && ret=1
@@ -1201,14 +1078,12 @@ status=`expr $status + $ret`
 
 echo_i "checking scheduled key publication, not activation ($n)"
 ret=0
-# Ensure initial zone is loaded.
-wait_for_notifies "delay.example" "ns3" || ret=1
-$SETTIME -K ns3 -P now+3s -A none $zsk > settime.out.test$n.zsk || ret=1
-$SETTIME -K ns3 -P now+3s -A none $ksk > settime.out.test$n.ksk || ret=1
-($RNDCCMD 10.53.0.3 loadkeys delay.example. 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1
+$SETTIME -K ns3 -P now+3s -A none $zsk > /dev/null 2>&1
+$SETTIME -K ns3 -P now+3s -A none $ksk > /dev/null 2>&1
+$RNDCCMD 10.53.0.3 loadkeys delay.example. 2>&1 | sed 's/^/ns2 /' | cat_i
+
 echo_i "waiting for changes to take effect"
-sleep 3
-wait_for_notifies "delay.example" "ns3" || ret=1
+sleep 5
 
 $DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
 # DNSKEY expected:
@@ -1221,12 +1096,13 @@ status=`expr $status + $ret`
 
 echo_i "checking scheduled key activation ($n)"
 ret=0
-$SETTIME -K ns3 -A now+3s $zsk > settime.out.test$n.zsk || ret=1
-$SETTIME -K ns3 -A now+3s $ksk > settime.out.test$n.ksk || ret=1
-($RNDCCMD 10.53.0.3 loadkeys delay.example. 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1
+$SETTIME -K ns3 -A now+3s $zsk > /dev/null 2>&1
+$SETTIME -K ns3 -A now+3s $ksk > /dev/null 2>&1
+$RNDCCMD 10.53.0.3 loadkeys delay.example. 2>&1 | sed 's/^/ns2 /' | cat_i
+
 echo_i "waiting for changes to take effect"
-sleep 3
-wait_for_notifies "delay.example" "ns3" || ret=1
+sleep 5
+
 $DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.1.test$n || ret=1
 # DNSKEY expected:
 awk 'BEGIN {r=1} $4=="DNSKEY" {r=0} END {exit r}' dig.out.ns3.1.test$n || ret=1
@@ -1336,7 +1212,7 @@ status=`expr $status + $ret`
 echo_i "forcing full sign with unreadable keys ($n)"
 ret=0
 chmod 0 ns1/K.+*+*.key ns1/K.+*+*.private || ret=1
-($RNDCCMD 10.53.0.1 sign . 2>&1 | sed 's/^/ns1 /' | cat_i) || ret=1
+$RNDCCMD 10.53.0.1 sign . 2>&1 | sed 's/^/ns1 /' | cat_i
 $DIG $DIGOPTS . @10.53.0.1 dnskey > dig.out.ns1.test$n || ret=1
 grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1
 n=`expr $n + 1`
@@ -1346,11 +1222,11 @@ status=`expr $status + $ret`
 echo_i "test turning on auto-dnssec during reconfig ($n)"
 ret=0
 # first create a zone that doesn't have auto-dnssec
-($RNDCCMD 10.53.0.3 addzone reconf.example '{ type master; file "reconf.example.db"; };' 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+$RNDCCMD 10.53.0.3 addzone reconf.example '{ type master; file "reconf.example.db"; };' 2>&1 | sed 's/^/ns3 /' | cat_i
 rekey_calls=`grep "zone reconf.example.*next key event" ns3/named.run | wc -l`
 [ "$rekey_calls" -eq 0 ] || ret=1
 # ...then we add auto-dnssec and reconfigure
-($RNDCCMD 10.53.0.3 modzone reconf.example '{ type master; file "reconf.example.db"; allow-update { any; }; auto-dnssec maintain; };' 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+$RNDCCMD 10.53.0.3 modzone reconf.example '{ type master; file "reconf.example.db"; allow-update { any; }; auto-dnssec maintain; };' 2>&1 | sed 's/^/ns3 /' | cat_i
 rndc_reconfig ns3 10.53.0.3
 for i in 0 1 2 3 4 5 6 7 8 9; do
     lret=0
@@ -1372,6 +1248,7 @@ $DIG $DIGOPTS @10.53.0.3 sync.example cdnskey > dig.out.ns3.cdnskeytest$n
 grep -i "sync.example.*in.cds.*[1-9][0-9]* " dig.out.ns3.cdstest$n > /dev/null || ret=1
 grep -i "sync.example.*in.cdnskey.*257 " dig.out.ns3.cdnskeytest$n > /dev/null || ret=1
 n=`expr $n + 1`
+if [ "$lret" != 0 ]; then ret=$lret; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -1406,35 +1283,37 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 echo_i "setting CDS and CDNSKEY deletion times and calling 'rndc loadkeys'"
-$SETTIME -D sync now `cat sync.key` > settime.out.test$n || ret=1
-($RNDCCMD 10.53.0.3 loadkeys sync.example | sed 's/^/ns3 /' | cat_i) || ret=1
+$SETTIME -D sync now+2 `cat sync.key` > /dev/null
+$RNDCCMD 10.53.0.3 loadkeys sync.example | sed 's/^/ns3 /' | cat_i
+echo_i "waiting for deletion to occur"
+sleep 3
 
 echo_i "checking that the CDS and CDNSKEY are deleted ($n)"
 ret=0
-ensure_cds_and_cdnskey_are_deleted() {
-	$DIG $DIGOPTS @10.53.0.3 sync.example. CDS > dig.out.ns3.cdstest$n || return 1
-	awk '$1 == "sync.example." && $4 == "CDS" { exit 1; }' dig.out.ns3.cdstest$n || return 1
-	$DIG $DIGOPTS @10.53.0.3 sync.example. CDNSKEY > dig.out.ns3.cdnskeytest$n || return 1
-	awk '$1 == "sync.example." && $4 == "CDNSKEY" { exit 1; }' dig.out.ns3.cdnskeytest$n || return 1
-}
-retry 10 ensure_cds_and_cdnskey_are_deleted || ret=1
+$DIG $DIGOPTS @10.53.0.3 sync.example cds > dig.out.ns3.cdstest$n
+$DIG $DIGOPTS @10.53.0.3 sync.example cdnskey > dig.out.ns3.cdnskeytest$n
+grep -i "sync.example.*in.cds.*[1-9][0-9]* " dig.out.ns3.cdstest$n > /dev/null && ret=1
+grep -i "sync.example.*in.cdnskey.*257 " dig.out.ns3.cdnskeytest$n > /dev/null && ret=1
 n=`expr $n + 1`
+if [ "$lret" != 0 ]; then ret=$lret; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 echo_i "check that dnssec-settime -p Dsync works ($n)"
 ret=0
-$SETTIME -p Dsync `cat sync.key` > settime.out.test$n || ret=1
-grep "SYNC Delete:" settime.out.test$n >/dev/null || ret=1
+$SETTIME -p Dsync `cat sync.key` > settime.out.$n|| ret=0
+grep "SYNC Delete:" settime.out.$n >/dev/null || ret=0
 n=`expr $n + 1`
+if [ "$lret" != 0 ]; then ret=$lret; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 echo_i "check that dnssec-settime -p Psync works ($n)"
 ret=0
-$SETTIME -p Psync `cat sync.key` > settime.out.test$n || ret=1
-grep "SYNC Publish:" settime.out.test$n >/dev/null || ret=1
+$SETTIME -p Psync `cat sync.key` > settime.out.$n|| ret=0
+grep "SYNC Publish:" settime.out.$n >/dev/null || ret=0
 n=`expr $n + 1`
+if [ "$lret" != 0 ]; then ret=$lret; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -1540,9 +1419,9 @@ if [ $_ret -ne 0 ]; then
 fi
 # Mark the inactive ZSK as pending removal.
 file="ns3/`cat delzsk.key`.key"
-$SETTIME -D now-1h $file > settime.out.test$n || ret=1
+$SETTIME -D now-1h $file > settime.out.test$n 2>&1 || ret=1
 # Trigger removal of the inactive ZSK and wait until its completion.
-($RNDCCMD 10.53.0.3 loadkeys delzsk.example 2>&1 | sed 's/^/ns3 /' | cat_i) || ret=1
+$RNDCCMD 10.53.0.3 loadkeys delzsk.example 2>&1 | sed 's/^/ns3 /' | cat_i
 for i in 0 1 2 3 4 5 6 7 8 9; do
 	_ret=1
 	$RNDCCMD 10.53.0.3 signing -list delzsk.example > signing.out.3.test$n 2>&1

bin/tests/system/builtin/setup.sh

@@ -12,6 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf

bin/tests/system/cacheclean/setup.sh

@@ -12,5 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf

bin/tests/system/case/setup.sh

@@ -10,6 +10,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 cp -f ns1/dynamic.db.in ns1/dynamic.db
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf

bin/tests/system/catz/clean.sh

@@ -14,7 +14,6 @@ rm -f ns*/named.lock
 rm -f ns*/named.memstats
 rm -f ns*/named.conf
 rm -f ns*/named.run
-rm -f ns*/named.run.prev
 rm -f ns1/*dom*example.db
 rm -f ns2/__catz__*db
 rm -f ns2/named.conf.tmp
@@ -24,4 +23,3 @@ rm -f ns[123]/catalog[1234].example.db
 rm -rf ns2/zonedir
 rm -f ns*/*.nzd ns*/*.nzd-lock
 rm -f ns*/managed-keys.bind*
-rm -f wait_for_message.*

bin/tests/system/cds/setup.sh

@@ -14,6 +14,8 @@ set -eu
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 touch empty
 
 Z=cds.test

bin/tests/system/chain/setup.sh

@@ -12,6 +12,8 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
+$SHELL clean.sh
+
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf

bin/tests/system/checkconf/bad-ds-key-1.conf

@@ -1,15 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-trust-anchors {
-	example. initial-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
-        example. initial-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
-};

bin/tests/system/checkconf/bad-ds-key-2.conf

@@ -1,15 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-trust-anchors {
-	example. static-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
-        example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
-};

bin/tests/system/checkconf/bad-duplicate-key.conf

@@ -13,7 +13,7 @@ options {
 	dnssec-validation yes;
 };
 
-trust-anchors {
+dnssec-keys {
 	example. initial-key 257 3 8 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl
 		25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafG
 		tURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJY
@@ -23,7 +23,7 @@ trust-anchors {
 		NQyrszHhWUU=";
 };
 
-trust-anchors {
+dnssec-keys {
 	example. static-key 257 3 8 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbod
 		y0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQ
 		YfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX

bin/tests/system/checkconf/bad-duplicate-root-key.conf

@@ -13,7 +13,7 @@ options {
 	dnssec-validation yes;
 };
 
-trust-anchors {
+dnssec-keys {
 	. initial-key 257 3 8 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl
 		25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafG
 		tURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJY

bin/tests/system/checkconf/bad-kasp1.conf

@@ -1,22 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// Using the keyword 'default' is not allowed.
-dnssec-policy "default" {
-	signatures-refresh P5D;
-};
-
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "default";
-};
-

bin/tests/system/checkconf/bad-kasp2.conf

@@ -1,22 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-include "good-kasp.conf";
-
-// Bad zone configuration because this has dnssec-policy and other DNSSEC sign
-// configuration options (auto-dnssec).
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "test";
-	auto-dnssec maintain;
-	allow-update { any; };
-};

bin/tests/system/checkconf/bad-kasp3.conf

@@ -1,22 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-include "good-kasp.conf";
-
-// Bad zone configuration because this has dnssec-policy with no matching
-// dnssec-policy configuration (good-kasp.conf has "test", zone refers to
-// "nosuchpolicy".
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "nosuchpolicy";
-};
-

bin/tests/system/checkconf/bad-kasp4.conf

@@ -1,23 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// Bad kasp configuration because this has an invalid duration for
-// signatures-refresh.
-dnssec-policy "badduration" {
-	signatures-refresh PT20Sabcd;
-};
-
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "badduration";
-};
-

bin/tests/system/checkconf/bad-kasp5.conf

@@ -1,22 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// Using the keyword 'none' is not allowed.
-dnssec-policy "none" {
-	signatures-refresh P5D;
-};
-
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "none";
-};
-

bin/tests/system/checkconf/bad-root-mixed-key.conf

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-trust-anchors {
+dnssec-keys {
 	# This key (19036) is to be phased out starting in 2017. It will
 	# remain in the root zone for some time after its successor key
 	# has been added. It will remain this file until it is removed from

bin/tests/system/checkconf/bad-static-initial-1.conf

@@ -1,15 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-trust-anchors {
-	example. initial-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
-	example. static-ds 60724 5 2 "29E79B9064EE1A11DF3BFF19581DDFED7952C22CC204ACE17B6007EB1437E9E6";
-};

bin/tests/system/checkconf/bad-static-initial-2.conf

@@ -1,15 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-trust-anchors {
-	example. initial-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
-        example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
-};

bin/tests/system/checkconf/bad-static-initial-3.conf

@@ -1,15 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-trust-anchors {
-	example. static-ds 60724 5 1 "D74CF845955A0DFE604AF215E948E67D2EA94FF3";
-        example. initial-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
-};

bin/tests/system/checkconf/bad-static-initial-4.conf

@@ -1,15 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-trust-anchors {
-        example. initial-key 257 3 5 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafGtURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJYkYrFYGLzYAgl/JtMyVVYlBl9pqxQuAPKYPOuO1axaad/wLN3+wTy/hcJfpvJpqzXlDF9bI5RmpoX/7geZ06vpcYJEoT0xkkmPlEl0ZjEDrm/WIaSWG0/CEDpHcOXFz4OEczMVpY+lnuFfKybwF1WHFn2BwVEOS6cMM6ukIjINQyrszHhWUU=";
-        example. static-key 257 3 5 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbody0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQYfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX2STtkE0hNJ/R6JYKmD2EH7k1nyqJd08ibrEt55DuV4BiUjyyERdVbsuwE60jVqAwCKyVBYXb2sI+zv1yPNDBIANd6KTgnq6YWzx5ZodQP3W4K7Z/Bk3EKmVCvrTKZK/ADLAKaL0/6DD07+1jXA4BiNyoZTLTapkudkGad+Rn6zqCkwuMmrU=";
-};

bin/tests/system/checkconf/bad-validation-auto-key.conf

@@ -13,7 +13,7 @@ options {
 	dnssec-validation auto;
 };
 
-trust-anchors {
+dnssec-keys {
 	. static-key 257 3 8 "AwEAAZtP9+RAA+W33A97e+HnnH8WTXzCWiEICyWj1B6rvZ9hd50ysbod
 		y0NLx7b3vZ1bzMLxLSRAr/n3Wi0TDZ1fvCKZhennfW8Wlc7ulCvHntSQ
 		YfKHUP0YWEo84sQAqIi850N1aiddj6CidwFo9JNW/HQ+8yarfrnGMFhX

bin/tests/system/checkconf/check-mixed-keys.conf

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-trust-anchors {
+dnssec-keys {
 	# This key (19036) is to be phased out starting in 2017. It will
 	# remain in the root zone for some time after its successor key
 	# has been added. It will remain this file until it is removed from

bin/tests/system/checkconf/check-root-ksk-2010.conf

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-trust-anchors {
+dnssec-keys {
 	# This key (19036) is to be phased out starting in 2017. It will
 	# remain in the root zone for some time after its successor key
 	# has been added. It will remain this file until it is removed from

bin/tests/system/checkconf/check-root-ksk-2017.conf

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-trust-anchors {
+dnssec-keys {
 	# This key (20326) was published in the root zone in 2017.
 	# Servers which were already using the old key (19036) should
 	# roll seamlessly to this new one via RFC 5011 rollover. Servers

bin/tests/system/checkconf/check-root-ksk-both.conf

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-trust-anchors {
+dnssec-keys {
 	# This key (19036) is to be phased out starting in 2017. It will
 	# remain in the root zone for some time after its successor key
 	# has been added. It will remain this file until it is removed from

bin/tests/system/checkconf/check-root-static-ds.conf

@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-trust-anchors {
-        . static-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D";
-};

bin/tests/system/checkconf/check-root-static-key.conf

@@ -9,7 +9,7 @@
  * information regarding copyright ownership.
  */
 
-trust-anchors {
+dnssec-keys {
 	# This key (20326) was published in the root zone in 2017.
 	# Servers which were already using the old key (19036) should
 	# roll seamlessly to this new one via RFC 5011 rollover. Servers

bin/tests/system/checkconf/clean.sh

@@ -10,7 +10,6 @@
 # information regarding copyright ownership.
 
 rm -f good.conf.in good.conf.out badzero.conf *.out
-rm -f good-kasp.conf.in
 rm -rf test.keydir
 rm -f checkconf.out*
 rm -f diff.out*

bin/tests/system/checkconf/good-dup-managed-key.conf

@@ -13,7 +13,7 @@ options {
 	dnssec-validation yes;
 };
 
-trust-anchors {
+dnssec-keys {
 	example. initial-key 257 3 8 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl
 		25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafG
 		tURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJY

bin/tests/system/checkconf/good-initial-ds.conf

@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-trust-anchors {
-	example. initial-ds 60724 5 2 "29E79B9064EE1A11DF3BFF19581DDFED7952C22CC204ACE17B6007EB1437E9E6";
-};