xxx

allow DS with key trust anchors

See merge request isc-projects/bind9!2892

.gitlab-ci.yml

@@ -23,6 +23,9 @@ variables:
 
   CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls -O1 -g -Wall -Wextra 
 
+  # Pass run-time flags to AddressSanitizer to get core dumps on error.
+  ASAN_OPTIONS_COMMON: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
+
   TARBALL_COMPRESSOR: xz
   TARBALL_EXTENSION: xz
 
@@ -64,8 +67,8 @@ stages:
 
 # Alpine Linux
 
-.alpine-3.10-amd64: &alpine_3_10_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.10-amd64"
+.alpine-3.11-amd64: &alpine_3_11_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.11-amd64"
   <<: *linux_amd64
 
 # CentOS
@@ -108,6 +111,12 @@ stages:
   image: "$CI_REGISTRY_IMAGE:debian-sid-i386"
   <<: *linux_i386
 
+# openSUSE Tumbleweed
+
+.tumbleweed-latest-amd64: &tumbleweed_latest_amd64_image
+  image: "$CI_REGISTRY_IMAGE:tumbleweed-latest-amd64"
+  <<: *linux_amd64
+
 # Fedora
 
 .fedora-31-amd64: &fedora_31_amd64_image
@@ -188,6 +197,7 @@ stages:
   stage: build
   before_script:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
+    - test -n "${OOT_BUILD_WORKSPACE}" && mkdir "${OOT_BUILD_WORKSPACE}" && cd "${OOT_BUILD_WORKSPACE}"
   script:
     - *configure
     - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
@@ -424,29 +434,29 @@ push:docs:sid:amd64:
     - master@isc-projects/bind9
     - /^v9_[1-9][0-9]$/@isc-projects/bind9
 
-# Jobs for regular GCC builds on Alpine Linux 3.10 (amd64)
+# Jobs for regular GCC builds on Alpine Linux 3.11 (amd64)
 
-gcc:alpine3.10:amd64:
+gcc:alpine3.11:amd64:
   variables:
     CC: gcc
     CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--enable-dnstap"
-  <<: *alpine_3_10_amd64_image
+  <<: *alpine_3_11_amd64_image
   <<: *build_job
 
-system:gcc:alpine3.10:amd64:
-  <<: *alpine_3_10_amd64_image
+system:gcc:alpine3.11:amd64:
+  <<: *alpine_3_11_amd64_image
   <<: *system_test_job
   dependencies:
-    - gcc:alpine3.10:amd64
-  needs: ["gcc:alpine3.10:amd64"]
+    - gcc:alpine3.11:amd64
+  needs: ["gcc:alpine3.11:amd64"]
 
-unit:gcc:alpine3.10:amd64:
-  <<: *alpine_3_10_amd64_image
+unit:gcc:alpine3.11:amd64:
+  <<: *alpine_3_11_amd64_image
   <<: *unit_test_job
   dependencies:
-    - gcc:alpine3.10:amd64
-  needs: ["gcc:alpine3.10:amd64"]
+    - gcc:alpine3.11:amd64
+  needs: ["gcc:alpine3.11:amd64"]
 
 # Jobs for regular GCC builds on CentOS 6 (amd64)
 
@@ -655,6 +665,19 @@ cppcheck:gcc:sid:amd64:
     - gcc:sid:amd64
   needs: ["gcc:sid:amd64"]
 
+# Job for out-of-tree GCC build on Debian Sid (amd64)
+
+oot:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -O3"
+    CONFIGURE: ../configure
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
+    RUN_MAKE_INSTALL: 1
+    OOT_BUILD_WORKSPACE: workspace
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
 # Jobs for tarball GCC builds on Debian Sid (amd64)
 
 tarball:sid:amd64:
@@ -721,6 +744,30 @@ unit:gcc:sid:i386:
     - gcc:sid:i386
   needs: ["gcc:sid:i386"]
 
+# Jobs for regular GCC builds on openSUSE Tumbleweed (amd64)
+
+gcc:tumbleweed:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *tumbleweed_latest_amd64_image
+  <<: *build_job
+
+system:gcc:tumbleweed:amd64:
+  <<: *tumbleweed_latest_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:tumbleweed:amd64
+  needs: ["gcc:tumbleweed:amd64"]
+
+unit:gcc:tumbleweed:amd64:
+  <<: *tumbleweed_latest_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:tumbleweed:amd64
+  needs: ["gcc:tumbleweed:amd64"]
+
 # Jobs for regular GCC builds on Fedora 31 (amd64)
 
 gcc:fedora31:amd64:
@@ -805,6 +852,8 @@ asan:sid:amd64:
   <<: *build_job
 
 system:asan:sid:amd64:
+  variables:
+    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
   <<: *debian_sid_amd64_image
   <<: *system_test_job
   dependencies:
@@ -812,6 +861,8 @@ system:asan:sid:amd64:
   needs: ["asan:sid:amd64"]
 
 unit:asan:sid:amd64:
+  variables:
+    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:

CHANGES

@@ -1,13 +1,47 @@
+5345.	[func]		Key-style trust anchors and DS-style trust anchors
+			can now both be used for the same name. [GL !2892]
+
+5344.	[bug]		Handle accept() errors properly in netmgr. [GL !2880]
+
+5343.	[func]		Add statistics counters to the netmgr. [GL #1311]
+
+5342.	[bug]		Disable pktinfo for ipv6 - bind to all interfaces
+			explicitly as libuv doesn't pass us pktinfo structure,
+			[GL #1558]
+
+5341.	[func]		Simplify passing the bound TCP socket to child
+			threads by using isc_uv_export/import functions.
+			[GL !2825]
+
+5340.	[bug]		Don't deadlock when binding to a TCP socket fails.
+			[GL #1499]
+
+5339.	[bug]		With some libmaxminddb versions, named could erroneously
+			match an IP address not belonging to any subnet defined
+			in a given GeoIP2 database to one of the existing
+			entries in that database. [GL #1552]
+
+5338.	[bug]		Fix line spacing in `rndc secroots`.
+			Thanks to Tony Finch. [GL !2478]
+
+5337.	[func]		'named -V' now reports maxminddb and protobuf-c
+			versions. [GL !2686]
+
+	--- 9.15.7 released ---
+
+5336.	[bug]		The TCP high-water statistic could report an
+			incorrect value on startup. [GL #1392]
+
 5335.	[func]		Make TCP listening code multithreaded. [GL !2659]
 
 5334.	[doc]		Update documentation with dnssec-policy clarifications.
-			Also change some defaults.
+			Also change some defaults. [GL !2711]
 
 5333.	[bug]		Fix duration printing on Solaris when value is not
 			an ISO 8601 duration. [GL #1460]
 
 5332.	[func]		Renamed "dnssec-keys" configuration statement
-			to the more descriptive "trust-anchors".
+			to the more descriptive "trust-anchors". [GL !2702]
 
 5331.	[func]		Use compiler-provided mechanisms for thread local
 			storage, and make the requirement for such mechanisms
@@ -26,7 +60,7 @@
 			dropped because the recursive-clients quota was
 			exceeded. [GL #1399]
 
-5326.	[bug]		Add python dependancy on 'distutils.core' to configure.
+5326.	[bug]		Add Python dependency on 'distutils.core' to configure.
 			'distutils.core' is required for installation.
 			[GL #1397]
 

COPYRIGHT

@@ -1,4 +1,4 @@
-Copyright (C) 1996-2019  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2020  Internet Systems Consortium, Inc. ("ISC")
 
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this

README

@@ -115,9 +115,9 @@ of changes from BIND 9.14 and earlier releases. New features include:
     for zones, enabling automatic key regeneration and rollover.
   * New new network manager based on libuv.
   * Support for the new GeoIP2 geolocation API
-  * Improved DNSSEC trust anchor configuration using dnssec-keys,
-    permitting configuration of trust anchors in DS as well as DNSKEY
-    format.
+  * Improved DNSSEC trust anchor configuration using the trust-anchors
+    statement, permitting configuration of trust anchors in DS as well as
+    DNSKEY format.
   * YAML output for dig, mdig, and delv.
 
 Building BIND
@@ -136,7 +136,7 @@ including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE, Slackware,
 Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE,
 HP-UX, and OpenWRT.
 
-BIND is also available for Windows Server 2008 and higher. See win32utils/
+BIND is also available for Windows Server 2012 R2 and higher. See win32utils/
 build.txt for details on building for Windows systems.
 
 To build on a UNIX or Linux system, use:
@@ -180,9 +180,10 @@ Dependencies
 
 Portions of BIND that are written in Python, including dnssec-keymgr,
 dnssec-coverage, dnssec-checkds, and some of the system tests, require the
-argparse and ply modules to be available. argparse is a standard module as
-of Python 2.7 and Python 3.2. ply is available from https://
-pypi.python.org/pypi/ply.
+argparse, ply and distutils.core modules to be available. argparse is a
+standard module as of Python 2.7 and Python 3.2. ply is available from
+https://pypi.python.org/pypi/ply. distutils.core is required for
+installation.
 
 Compile-time options
 

README.md

@@ -153,7 +153,7 @@ UNIX, including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE,
 Slackware, Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris,
 OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
 
-BIND is also available for Windows Server 2008 and higher.  See
+BIND is also available for Windows Server 2012 R2 and higher.  See
 `win32utils/build.txt` for details on building for Windows
 systems.
 

bin/check/named-checkconf.docbook

@@ -41,6 +41,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/check/named-checkzone.docbook

@@ -44,6 +44,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/confgen/ddns-confgen.docbook

@@ -38,6 +38,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/confgen/rndc-confgen.docbook

@@ -45,6 +45,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/delv/delv.1

@@ -144,7 +144,7 @@ options\&.
 Note: When reading the trust anchor file,
 \fBdelv\fR
 treats
-\fBdnssec\-keys\fR\fBinitial\-key\fR
+\fBtrust\-anchors\fR\fBinitial\-key\fR
 and
 \fBstatic\-key\fR
 entries identically\&. That is, even if a key is configured with

bin/delv/delv.docbook

@@ -40,6 +40,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/delv/delv.html

@@ -197,7 +197,7 @@
 	  </p>
 	  <p>
 	    Note: When reading the trust anchor file,
-	    <span class="command"><strong>delv</strong></span> treats <code class="option">dnssec-keys</code>
+	    <span class="command"><strong>delv</strong></span> treats <code class="option">trust-anchors</code>
 	    <code class="option">initial-key</code> and <code class="option">static-key</code>
 	    entries identically.  That is, even if a key is configured
 	    with <span class="command"><strong>initial-key</strong></span>, indicating that it is

bin/dig/dig.c

@@ -54,7 +54,7 @@
 
 dig_lookup_t *default_lookup = NULL;
 
-static char *batchname = NULL;
+static atomic_uintptr_t batchname = ATOMIC_VAR_INIT(0);
 static FILE *batchfp = NULL;
 static char *argv0;
 static int addresscount = 0;
@@ -1874,7 +1874,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				value);
 		return (value_from_next);
 	case 'f':
-		batchname = value;
+		atomic_store(&batchname, (uintptr_t)value);
 		return (value_from_next);
 	case 'k':
 		strlcpy(keyfile, value, sizeof(keyfile));
@@ -2327,13 +2327,15 @@ parse_args(bool is_batchfile, bool config_only,
 	 * first entry, then trust the callback in dighost_shutdown
 	 * to get the rest
 	 */
-	if ((batchname != NULL) && !(is_batchfile)) {
-		if (strcmp(batchname, "-") == 0)
+	char *filename = (char *)atomic_load(&batchname);
+	if ((filename != NULL) && !(is_batchfile)) {
+		if (strcmp(filename, "-") == 0) {
 			batchfp = stdin;
-		else
-			batchfp = fopen(batchname, "r");
+		} else {
+			batchfp = fopen(filename, "r");
+		}
 		if (batchfp == NULL) {
-			perror(batchname);
+			perror(filename);
 			if (exitcode < 8)
 				exitcode = 8;
 			fatal("couldn't open specified batch file");
@@ -2388,14 +2390,14 @@ query_finished(void) {
 	int bargc;
 	char *bargv[16];
 
-	if (batchname == NULL) {
+	if (atomic_load(&batchname) == 0) {
 		isc_app_shutdown();
 		return;
 	}
 
 	fflush(stdout);
 	if (feof(batchfp)) {
-		batchname = NULL;
+		atomic_store(&batchname, 0);
 		isc_app_shutdown();
 		if (batchfp != stdin)
 			fclose(batchfp);
@@ -2409,7 +2411,7 @@ query_finished(void) {
 		parse_args(true, false, bargc, (char **)bargv);
 		start_lookup();
 	} else {
-		batchname = NULL;
+		atomic_store(&batchname, 0);
 		if (batchfp != stdin)
 			fclose(batchfp);
 		isc_app_shutdown();
@@ -2539,10 +2541,11 @@ void dig_query_start()
 void
 dig_shutdown() {
 	destroy_lookup(default_lookup);
-	if (batchname != NULL) {
-		if (batchfp != stdin)
+	if (atomic_load(&batchname) != 0) {
+		if (batchfp != stdin) {
 			fclose(batchfp);
-		batchname = NULL;
+		}
+		atomic_store(&batchname, 0);
 	}
 	cancel_all();
 	destroy_libs();

bin/dig/dig.docbook

@@ -53,6 +53,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dig/host.docbook

@@ -48,6 +48,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dig/nslookup.docbook

@@ -72,6 +72,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-cds.docbook

@@ -41,6 +41,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-dsfromkey.docbook

@@ -42,6 +42,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-importkey.docbook

@@ -39,6 +39,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-keyfromlabel.docbook

@@ -44,6 +44,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-keygen.docbook

@@ -51,6 +51,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-revoke.docbook

@@ -39,6 +39,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-settime.docbook

@@ -41,6 +41,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-signzone.docbook

@@ -51,6 +51,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-verify.docbook

@@ -38,6 +38,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/named/main.c

@@ -59,6 +59,10 @@
 #include <json_c_version.h>
 #endif /* HAVE_JSON_C */
 
+#ifdef HAVE_GEOIP2
+#include <maxminddb.h>
+#endif
+
 /*
  * Defining NAMED_MAIN provides storage declarations (rather than extern)
  * for variables in named/globals.h.
@@ -548,6 +552,17 @@ OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	       ZLIB_VERSION);
 	printf("linked to zlib version: %s\n",
 	       zlibVersion());
+#endif
+#if defined(HAVE_GEOIP2)
+	/* Unfortunately, no version define on link time */
+	printf("linked to maxminddb version: %s\n",
+	       MMDB_lib_version());
+#endif
+#if defined(HAVE_DNSTAP)
+	printf("compiled with protobuf-c version: %s\n",
+	       PROTOBUF_C_VERSION);
+	printf("linked to protobuf-c version: %s\n",
+	       protobuf_c_version());
 #endif
 	printf("threads support is enabled\n\n");
 

bin/named/named.conf.5

@@ -97,20 +97,6 @@ dlz \fIstring\fR {
 .if n \{\
 .RE
 .\}
-.SH "DNSSEC-KEYS"
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-dnssec\-keys { \fIstring\fR ( static\-key |
-    initial\-key | static\-ds | initial\-ds )
-    \fIinteger\fR \fIinteger\fR \fIinteger\fR
-    \fIquoted_string\fR; \&.\&.\&. };
-.fi
-.if n \{\
-.RE
-.\}
 .SH "DYNDB"
 .sp
 .if n \{\
@@ -164,7 +150,7 @@ logging {
 .\}
 .SH "MANAGED-KEYS"
 .PP
-Deprecated \- see DNSSEC\-KEYS\&.
+Deprecated \- see TRUST\-ANCHORS\&.
 .sp
 .if n \{\
 .RS 4
@@ -565,9 +551,23 @@ statistics\-channels {
 .if n \{\
 .RE
 .\}
+.SH "TRUST-ANCHORS"
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+trust\-anchors { \fIstring\fR ( static\-key |
+    initial\-key | static\-ds | initial\-ds )
+    \fIinteger\fR \fIinteger\fR \fIinteger\fR
+    \fIquoted_string\fR; \&.\&.\&. };
+.fi
+.if n \{\
+.RE
+.\}
 .SH "TRUSTED-KEYS"
 .PP
-Deprecated \- see DNSSEC\-KEYS\&.
+Deprecated \- see TRUST\-ANCHORS\&.
 .sp
 .if n \{\
 .RS 4
@@ -655,10 +655,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 	dnsrps\-options { \fIunspecified\-text\fR };
 	dnssec\-accept\-expired \fIboolean\fR;
 	dnssec\-dnskey\-kskonly \fIboolean\fR;
-	dnssec\-keys { \fIstring\fR ( static\-key |
-	    initial\-key | static\-ds | initial\-ds
-	    ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
-	    \fIquoted_string\fR; \&.\&.\&. };
 	dnssec\-loadkeys\-interval \fIinteger\fR;
 	dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
@@ -849,6 +845,10 @@ view \fIstring\fR [ \fIclass\fR ] {
 	transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * )
 	    ] [ dscp \fIinteger\fR ];
 	trust\-anchor\-telemetry \fIboolean\fR; // experimental
+	trust\-anchors { \fIstring\fR ( static\-key |
+	    initial\-key | static\-ds | initial\-ds
+	    ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
+	    \fIquoted_string\fR; \&.\&.\&. };
 	trusted\-keys { \fIstring\fR
 	    \fIinteger\fR \fIinteger\fR
 	    \fIinteger\fR
@@ -1074,7 +1074,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 .\}
 .nf
 dnssec\-policy \fIstring\fR {
-	dnskey\-ttl \fIttlval\fR;
+	dnskey\-ttl \fIduration\fR;
 	keys { ( csk | ksk | zsk ) key\-directory lifetime \fIduration\fR algorithm \fIinteger\fR [ \fIinteger\fR ] ; \&.\&.\&. };
 	parent\-ds\-ttl \fIduration\fR;
 	parent\-propagation\-delay \fIduration\fR;

bin/named/named.conf.docbook

@@ -49,6 +49,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/named/named.conf.html

@@ -92,17 +92,7 @@ dlz
   </div>
 
   <div class="refsection">
-<a name="id-1.11"></a><h2>DNSSEC-KEYS</h2>
-    <div class="literallayout"><p><br>
-dnssec-keys { <em class="replaceable"><code>string</code></em> ( static-key |<br>
-    initial-key | static-ds | initial-ds )<br>
-    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
-    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
-</p></div>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.12"></a><h2>DYNDB</h2>
+<a name="id-1.11"></a><h2>DYNDB</h2>
     <div class="literallayout"><p><br>
 dyndb <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>quoted_string</code></em> {<br>
     <em class="replaceable"><code>unspecified-text</code></em> };<br>
@@ -110,7 +100,7 @@ dyndb
   </div>
 
   <div class="refsection">
-<a name="id-1.13"></a><h2>KEY</h2>
+<a name="id-1.12"></a><h2>KEY</h2>
     <div class="literallayout"><p><br>
 key <em class="replaceable"><code>string</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -120,7 +110,7 @@ key
   </div>
 
   <div class="refsection">
-<a name="id-1.14"></a><h2>LOGGING</h2>
+<a name="id-1.13"></a><h2>LOGGING</h2>
     <div class="literallayout"><p><br>
 logging {<br>
 	category <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>; ... };<br>
@@ -141,8 +131,8 @@ logging
   </div>
 
   <div class="refsection">
-<a name="id-1.15"></a><h2>MANAGED-KEYS</h2>
-  <p>Deprecated - see DNSSEC-KEYS.</p>
+<a name="id-1.14"></a><h2>MANAGED-KEYS</h2>
+  <p>Deprecated - see TRUST-ANCHORS.</p>
     <div class="literallayout"><p><br>
 managed-keys { <em class="replaceable"><code>string</code></em> ( static-key<br>
     | initial-key | static-ds |<br>
@@ -152,7 +142,7 @@ managed-keys
   </div>
 
   <div class="refsection">
-<a name="id-1.16"></a><h2>MASTERS</h2>
+<a name="id-1.15"></a><h2>MASTERS</h2>
     <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [ port <em class="replaceable"><code>integer</code></em> ] [ dscp<br>
     <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
@@ -162,7 +152,7 @@ masters
   </div>
 
   <div class="refsection">
-<a name="id-1.17"></a><h2>OPTIONS</h2>
+<a name="id-1.16"></a><h2>OPTIONS</h2>
     <div class="literallayout"><p><br>
 options {<br>
 	allow-new-zones <em class="replaceable"><code>boolean</code></em>;<br>
@@ -461,7 +451,7 @@ options
   </div>
 
   <div class="refsection">
-<a name="id-1.18"></a><h2>PLUGIN</h2>
+<a name="id-1.17"></a><h2>PLUGIN</h2>
     <div class="literallayout"><p><br>
 plugin ( query ) <em class="replaceable"><code>string</code></em> [ { <em class="replaceable"><code>unspecified-text</code></em><br>
     } ];<br>
@@ -469,7 +459,7 @@ plugin
   </div>
 
   <div class="refsection">
-<a name="id-1.19"></a><h2>SERVER</h2>
+<a name="id-1.18"></a><h2>SERVER</h2>
     <div class="literallayout"><p><br>
 server <em class="replaceable"><code>netprefix</code></em> {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -507,7 +497,7 @@ server
   </div>
 
   <div class="refsection">
-<a name="id-1.20"></a><h2>STATISTICS-CHANNELS</h2>
+<a name="id-1.19"></a><h2>STATISTICS-CHANNELS</h2>
     <div class="literallayout"><p><br>
 statistics-channels {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> |<br>
@@ -518,9 +508,19 @@ statistics-channels
 </p></div>
   </div>
 
+  <div class="refsection">
+<a name="id-1.20"></a><h2>TRUST-ANCHORS</h2>
+    <div class="literallayout"><p><br>
+trust-anchors { <em class="replaceable"><code>string</code></em> ( static-key |<br>
+    initial-key | static-ds | initial-ds )<br>
+    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
+</p></div>
+  </div>
+
   <div class="refsection">
 <a name="id-1.21"></a><h2>TRUSTED-KEYS</h2>
-  <p>Deprecated - see DNSSEC-KEYS.</p>
+  <p>Deprecated - see TRUST-ANCHORS.</p>
     <div class="literallayout"><p><br>
 trusted-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em><br>
     <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
@@ -600,10 +600,6 @@ view
 	dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> };<br>
 	dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
-	dnssec-keys { <em class="replaceable"><code>string</code></em> ( static-key |<br>
-	    initial-key | static-ds | initial-ds<br>
-	    ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
-	    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 	dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
 	dnssec-must-be-secure <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
@@ -794,6 +790,10 @@ view
 	transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * )<br>
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	trust-anchor-telemetry <em class="replaceable"><code>boolean</code></em>; // experimental<br>
+	trust-anchors { <em class="replaceable"><code>string</code></em> ( static-key |<br>
+	    initial-key | static-ds | initial-ds<br>
+	    ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+	    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 	trusted-keys { <em class="replaceable"><code>string</code></em><br>
 	    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>integer</code></em><br>
@@ -1012,7 +1012,7 @@ zone
 
     <div class="literallayout"><p><br>
 dnssec-policy <em class="replaceable"><code>string</code></em> {<br>
-	dnskey-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	dnskey-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	keys { ( csk | ksk | zsk ) key-directory lifetime <em class="replaceable"><code>duration</code></em> algorithm <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ] ; ... };<br>
 	parent-ds-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	parent-propagation-delay <em class="replaceable"><code>duration</code></em>;<br>

bin/named/named.docbook

@@ -49,6 +49,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/named/server.c

@@ -700,11 +700,12 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 }
 
 static isc_result_t
-ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
-	      dns_rdata_ds_t **dsp, const char **namestrp, isc_mem_t *mctx)
+ta_fromconfig(const cfg_obj_t *key, bool *initialp, const char **namestrp,
+	      unsigned char *digest, dns_rdata_ds_t *ds)
 {
+	isc_result_t result;
 	dns_rdata_dnskey_t keystruct;
-	dns_rdata_ds_t *ds = NULL;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
 	uint32_t rdata1, rdata2, rdata3;
 	const char *datastr = NULL, *namestr = NULL;
 	unsigned char data[4096];
@@ -715,8 +716,6 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 	dns_fixedname_t fname;
 	dns_name_t *name = NULL;
 	isc_buffer_t namebuf;
-	isc_result_t result;
-	dst_key_t *dstkey = NULL;
 	const char *atstr = NULL;
 	enum {
 		INIT_DNSKEY,
@@ -726,9 +725,8 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 		TRUSTED
 	} anchortype;
 
-	REQUIRE(keyp != NULL && *keyp == NULL);
-	REQUIRE(dsp != NULL && *dsp == NULL);
 	REQUIRE(namestrp != NULL && *namestrp == NULL);
+	REQUIRE(ds != NULL);
 
 	/* if DNSKEY, flags; if DS, key tag */
 	rdata1 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata1"));
@@ -775,6 +773,13 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 	isc_buffer_init(&databuf, data, sizeof(data));
 	isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));
 
+	*ds = (dns_rdata_ds_t){
+		.common.rdclass = dns_rdataclass_in,
+		.common.rdtype = dns_rdatatype_ds
+	};
+
+	ISC_LINK_INIT(&ds->common, link);
+
 	switch(anchortype) {
 	case INIT_DNSKEY:
 	case STATIC_DNSKEY:
@@ -802,7 +807,7 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 		if (rdata2 > 0xff) {
 			CHECKM(ISC_R_RANGE, "key protocol");
 		}
-		if (rdata3> 0xff) {
+		if (rdata3 > 0xff) {
 			CHECKM(ISC_R_RANGE, "key algorithm");
 		}
 
@@ -810,30 +815,25 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 		keystruct.protocol = (uint8_t)rdata2;
 		keystruct.algorithm = (uint8_t)rdata3;
 
+		if (!dst_algorithm_supported(keystruct.algorithm)) {
+			CHECK(DST_R_UNSUPPORTEDALG);
+		}
+
 		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
 		CHECK(isc_base64_decodestring(datastr, &databuf));
 		isc_buffer_usedregion(&databuf, &r);
 		keystruct.datalen = r.length;
 		keystruct.data = r.base;
 
-		CHECK(dns_rdata_fromstruct(NULL, keystruct.common.rdclass,
+		CHECK(dns_rdata_fromstruct(&rdata, keystruct.common.rdclass,
 					   keystruct.common.rdtype,
 					   &keystruct, &rrdatabuf));
-		CHECK(dst_key_fromdns(name, dns_rdataclass_in,
-				      &rrdatabuf, mctx, &dstkey));
-
-		*keyp = dstkey;
+		CHECK(dns_ds_fromkeyrdata(name, &rdata, DNS_DSDIGEST_SHA256,
+					  digest, ds));
 		break;
 
 	case INIT_DS:
 	case STATIC_DS:
-		ds = isc_mem_get(mctx, sizeof(*ds));
-		ds->common.rdclass = dns_rdataclass_in;
-		ds->common.rdtype = dns_rdatatype_ds;
-		ds->mctx = NULL;
-
-		ISC_LINK_INIT(&ds->common, link);
-
 		if (rdata1 > 0xffff) {
 			CHECKM(ISC_R_RANGE, "key tag");
 		}
@@ -878,13 +878,10 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 			break;
 		}
 
-		ds->mctx = mctx;
 		ds->length = r.length;
-		ds->digest = isc_mem_allocate(mctx, r.length);
+		ds->digest = digest;
 		memmove(ds->digest, r.base, r.length);
 
-		*dsp = ds;
-		ds = NULL;
 		break;
 
 	default:
@@ -895,15 +892,6 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 	return (ISC_R_SUCCESS);
 
  cleanup:
-	if (dstkey != NULL) {
-		dst_key_free(&dstkey);
-	}
-
-	if (ds != NULL) {
-		dns_rdata_freestruct(ds);
-		isc_mem_put(mctx, ds, sizeof(*ds));
-	}
-
 	return (result);
 }
 
@@ -921,46 +909,30 @@ ta_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **keyp,
 static isc_result_t
 process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 	    const dns_name_t *keyname_match, dns_resolver_t *resolver,
-	    bool managed, isc_mem_t *mctx)
+	    bool managed)
 {
 	dns_fixedname_t fkeyname;
 	dns_name_t *keyname = NULL;
 	const char *namestr = NULL;
-	dst_key_t *dstkey = NULL;
-	dns_rdata_ds_t *ds = NULL;
-	unsigned int keyalg;
+	dns_rdata_ds_t ds;
 	isc_result_t result;
 	bool initializing = managed;
+	unsigned char digest[ISC_MAX_MD_SIZE];
+	isc_buffer_t b;
 
-	result = ta_fromconfig(key, &initializing, &dstkey, &ds,
-			       &namestr, mctx);
+	result = ta_fromconfig(key, &initializing, &namestr, digest, &ds);
 
 	switch (result) {
 	case ISC_R_SUCCESS:
 		/*
-		 * Trust anchor was parsed correctly. If dstkey is
-		 * not NULL, then it was a key anchor, its algorithm
-		 * is supported by the crypto library, and it is not
-		 * revoked. If dstkey is NULL, then it was a DS
-		 * trust anchor instead.
+		 * Trust anchor was parsed correctly.
 		 */
-		if (dstkey != NULL) {
-			keyname = dst_key_name(dstkey);
-			keyalg = dst_key_alg(dstkey);
-		} else {
-			isc_buffer_t b;
-
-			INSIST(ds != NULL);
-
-			isc_buffer_constinit(&b, namestr, strlen(namestr));
-			isc_buffer_add(&b, strlen(namestr));
-			keyname = dns_fixedname_initname(&fkeyname);
-			result = dns_name_fromtext(keyname, &b,
-						   dns_rootname, 0, NULL);
-			if (result != ISC_R_SUCCESS) {
-				return (result);
-			}
-			keyalg = ds->algorithm;
+		isc_buffer_constinit(&b, namestr, strlen(namestr));
+		isc_buffer_add(&b, strlen(namestr));
+		keyname = dns_fixedname_initname(&fkeyname);
+		result = dns_name_fromtext(keyname, &b, dns_rootname, 0, NULL);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
 		}
 		break;
 	case DST_R_UNSUPPORTEDALG:
@@ -1011,7 +983,8 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 	 * its owner name.  If it does not, do not load the key and log a
 	 * warning, but do not prevent further keys from being processed.
 	 */
-	if (!dns_resolver_algorithm_supported(resolver, keyname, keyalg)) {
+	if (!dns_resolver_algorithm_supported(resolver, keyname, ds.algorithm))
+	{
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "ignoring %s for '%s': algorithm is disabled",
 			    initializing ? "initial-key" : "static-key",
@@ -1026,29 +999,10 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 	 * managed, so we use 'initializing' twice here, for both the
 	 * 'managed' and 'initializing' arguments to dns_keytable_add().
 	 */
-	result = dns_keytable_add(secroots, initializing,
-				  initializing, keyname,
-				  dstkey != NULL ? &dstkey : NULL,
-				  ds);
+	result = dns_keytable_add(secroots, initializing, initializing,
+				  keyname, &ds);
 
  done:
-	/*
-	 * Ensure 'dstkey' does not leak.  Note that if dns_keytable_add()
-	 * succeeds, ownership of the key structure is transferred to the key
-	 * table, i.e. 'dstkey' is set to NULL.
-	 */
-	if (dstkey != NULL) {
-		dst_key_free(&dstkey);
-	}
-
-	/*
-	 * Free 'ds'.
-	 */
-	if (ds != NULL) {
-		dns_rdata_freestruct(ds);
-		isc_mem_put(mctx, ds, sizeof(*ds));
-	}
-
 	return (result);
 }
 
@@ -1059,7 +1013,7 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
  */
 static isc_result_t
 load_view_keys(const cfg_obj_t *keys, dns_view_t *view, bool managed,
-	       const dns_name_t *keyname, isc_mem_t *mctx)
+	       const dns_name_t *keyname)
 {
 	const cfg_listelt_t *elt, *elt2;
 	const cfg_obj_t *keylist;
@@ -1078,9 +1032,8 @@ load_view_keys(const cfg_obj_t *keys, dns_view_t *view, bool managed,
 		     elt2 != NULL;
 		     elt2 = cfg_list_next(elt2))
 		{
-			CHECK(process_key(cfg_listelt_value(elt2),
-					  secroots, keyname, view->resolver,
-					  managed, mctx));
+			CHECK(process_key(cfg_listelt_value(elt2), secroots,
+					  keyname, view->resolver, managed));
 		}
 	}
 
@@ -1238,7 +1191,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 
 		if (builtin_keys != NULL) {
 			CHECK(load_view_keys(builtin_keys, view, true,
-					     dns_rootname, mctx));
+					     dns_rootname));
 		}
 
 		if (!keyloaded(view, dns_rootname)) {
@@ -1251,17 +1204,13 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	}
 
 	if (view->rdclass == dns_rdataclass_in) {
-		CHECK(load_view_keys(view_keys, view, false, NULL, mctx));
-		CHECK(load_view_keys(view_trust_anchors, view, true, NULL,
-				     mctx));
-		CHECK(load_view_keys(view_managed_keys, view, true, NULL,
-				     mctx));
+		CHECK(load_view_keys(view_keys, view, false, NULL));
+		CHECK(load_view_keys(view_trust_anchors, view, true, NULL));
+		CHECK(load_view_keys(view_managed_keys, view, true, NULL));
 
-		CHECK(load_view_keys(global_keys, view, false, NULL, mctx));
-		CHECK(load_view_keys(global_trust_anchors, view, true,
-				     NULL, mctx));
-		CHECK(load_view_keys(global_managed_keys, view, true,
-				     NULL, mctx));
+		CHECK(load_view_keys(global_keys, view, false, NULL));
+		CHECK(load_view_keys(global_trust_anchors, view, true, NULL));
+		CHECK(load_view_keys(global_managed_keys, view, true, NULL));
 	}
 
 	/*
@@ -6835,11 +6784,7 @@ struct dotat_arg {
  * reported in the TAT query.
  */
 static isc_result_t
-get_tat_qname(dns_name_t *target, dns_name_t *keyname,
-	      dns_keytable_t *keytable, dns_keynode_t *keynode)
-{
-	dns_keynode_t *firstnode = keynode;
-	dns_keynode_t *nextnode = NULL;
+get_tat_qname(dns_name_t *target, dns_name_t *keyname, dns_keynode_t *keynode) {
 	dns_rdataset_t *dsset = NULL;
 	unsigned int i, n = 0;
 	uint16_t ids[12];
@@ -6866,23 +6811,6 @@ get_tat_qname(dns_name_t *target, dns_name_t *keyname,
 				n++;
 			}
 		}
-	} else {
-		do {
-			dst_key_t *key = dns_keynode_key(keynode);
-			if (key != NULL) {
-				if (n < (sizeof(ids)/sizeof(ids[0]))) {
-					ids[n] = dst_key_id(key);
-					n++;
-				}
-			}
-			nextnode = NULL;
-			(void)dns_keytable_nextkeynode(keytable, keynode,
-						       &nextnode);
-			if (keynode != firstnode) {
-				dns_keytable_detachkeynode(keytable, &keynode);
-			}
-			keynode = nextnode;
-		} while (keynode != NULL);
 	}
 
 	if (n == 0) {
@@ -6938,7 +6866,7 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode,
 	task = dotat_arg->task;
 
 	tatname = dns_fixedname_initname(&fixed);
-	result = get_tat_qname(tatname, keyname, keytable, keynode);
+	result = get_tat_qname(tatname, keyname, keynode);
 	if (result != ISC_R_SUCCESS) {
 		return;
 	}
@@ -9941,6 +9869,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 				    isc_sockstatscounter_max),
 		   "isc_stats_create");
 	isc_socketmgr_setstats(named_g_socketmgr, server->sockstats);
+	isc_nm_setstats(named_g_nm, server->sockstats);
 
 	CHECKFATAL(isc_stats_create(named_g_mctx, &server->zonestats,
 				    dns_zonestatscounter_max),
@@ -11118,17 +11047,20 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 	FILE *fp = NULL;
 	isc_time_t now;
 	char tbuf[64];
+	unsigned int used = isc_buffer_usedlength(*text);
+	bool first = true;
 
 	/* Skip the command name. */
 	ptr = next_token(lex, text);
-	if (ptr == NULL)
+	if (ptr == NULL) {
 		return (ISC_R_UNEXPECTEDEND);
+	}
 
 	/* "-" here means print the output instead of dumping to file */
 	ptr = next_token(lex, text);
-	if (ptr != NULL && strcmp(ptr, "-") == 0)
+	if (ptr != NULL && strcmp(ptr, "-") == 0) {
 		ptr = next_token(lex, text);
-	else {
+	} else {
 		result = isc_stdio_open(server->secrootsfile, "w", &fp);
 		if (result != ISC_R_SUCCESS) {
 			(void) putstr(text, "could not open ");
@@ -11143,66 +11075,85 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 	CHECK(putstr(text, "secure roots as of "));
 	CHECK(putstr(text, tbuf));
 	CHECK(putstr(text, ":\n"));
+	used = isc_buffer_usedlength(*text);
 
 	do {
 		for (view = ISC_LIST_HEAD(server->viewlist);
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link))
 		{
-			if (ptr != NULL && strcmp(view->name, ptr) != 0)
+			if (ptr != NULL && strcmp(view->name, ptr) != 0) {
 				continue;
-			if (secroots != NULL)
+			}
+			if (secroots != NULL) {
 				dns_keytable_detach(&secroots);
+			}
 			result = dns_view_getsecroots(view, &secroots);
 			if (result == ISC_R_NOTFOUND) {
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			CHECK(putstr(text, "\n Start view "));
+			if (first || used != isc_buffer_usedlength(*text)) {
+				CHECK(putstr(text, "\n"));
+				first = false;
+			}
+			CHECK(putstr(text, " Start view "));
 			CHECK(putstr(text, view->name));
 			CHECK(putstr(text, "\n   Secure roots:\n\n"));
+			used = isc_buffer_usedlength(*text);
 			CHECK(dns_keytable_totext(secroots, text));
 
-			if (ntatable != NULL)
+			if (ntatable != NULL) {
 				dns_ntatable_detach(&ntatable);
+			}
 			result = dns_view_getntatable(view, &ntatable);
 			if (result == ISC_R_NOTFOUND) {
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			CHECK(putstr(text, "\n   Negative trust anchors:\n\n"));
+			if (used != isc_buffer_usedlength(*text)) {
+				CHECK(putstr(text, "\n"));
+			}
+			CHECK(putstr(text, "   Negative trust anchors:\n\n"));
+			used = isc_buffer_usedlength(*text);
 			CHECK(dns_ntatable_totext(ntatable, NULL, text));
 		}
-		if (ptr != NULL)
+
+		if (ptr != NULL) {
 			ptr = next_token(lex, text);
+		}
 	} while (ptr != NULL);
 
  cleanup:
-	if (isc_buffer_usedlength(*text) > 0) {
-		if (fp != NULL)
-			(void)putstr(text, "\n");
-		else
-			(void)putnull(text);
-	}
-	if (secroots != NULL)
+	if (secroots != NULL) {
 		dns_keytable_detach(&secroots);
-	if (ntatable != NULL)
+	}
+	if (ntatable != NULL) {
 		dns_ntatable_detach(&ntatable);
+	}
+
 	if (fp != NULL) {
+		if (used != isc_buffer_usedlength(*text)) {
+			(void)putstr(text, "\n");
+		}
 		fprintf(fp, "%.*s", (int) isc_buffer_usedlength(*text),
 			(char *) isc_buffer_base(*text));
 		isc_buffer_clear(*text);
 		(void)isc_stdio_close(fp);
+	} else if (isc_buffer_usedlength(*text) > 0) {
+		(void)putnull(text);
 	}
-	if (result == ISC_R_SUCCESS)
+
+	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "dumpsecroots complete");
-	else
+	} else {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "dumpsecroots failed: %s",
 			      dns_result_totext(result));
+	}
 	return (result);
 }
 

bin/nsupdate/nsupdate.docbook

@@ -50,6 +50,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/pkcs11/pkcs11-destroy.c

@@ -124,7 +124,7 @@ main(int argc, char *argv[]) {
 	if (errflg || (id && (label != NULL))) {
 		fprintf(stderr, "Usage:\n");
 		fprintf(stderr, "\tpkcs11-destroy [-m module] [-s slot] "
-				"[-i id | -l label] [-p pin] [-w waittime]\n");
+				"{-i id | -l label} [-p pin] [-w waittime]\n");
 		exit(1);
 	}
 

bin/pkcs11/pkcs11-destroy.docbook

@@ -38,6 +38,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/pkcs11/pkcs11-keygen.docbook

@@ -39,6 +39,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/pkcs11/pkcs11-list.docbook

@@ -38,6 +38,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/pkcs11/pkcs11-tokens.docbook

@@ -37,6 +37,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/plugins/filter-aaaa.docbook

@@ -33,6 +33,7 @@
     <copyright>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/python/dnssec-checkds.docbook

@@ -40,6 +40,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/python/dnssec-coverage.docbook

@@ -38,6 +38,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/python/dnssec-keymgr.docbook

@@ -35,6 +35,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/rndc/rndc.8

@@ -516,7 +516,7 @@ timer\&.
 \fBsecroots \fR\fB[\-]\fR\fB \fR\fB[\fIview \&.\&.\&.\fR]\fR
 .RS 4
 Dump the security roots (i\&.e\&., trust anchors configured via
-\fBdnssec\-keys\fR
+\fBtrust\-anchors\fR
 statements, or the managed\-keys or trusted\-keys statements (both deprecated), or via
 \fBdnssec\-validation auto\fR) and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&. Security roots will indicate whether they are configured as trusted keys, managed keys, or initializing managed keys (managed keys that have not yet been updated by a successful key refresh query)\&.
 .sp

bin/rndc/rndc.c

@@ -75,7 +75,9 @@ static isccc_region_t secret;
 static bool failed = false;
 static bool c_flag = false;
 static isc_mem_t *rndc_mctx;
-static isc_refcount_t sends, recvs, connects;
+static atomic_uint_fast32_t sends = ATOMIC_VAR_INIT(0);
+static atomic_uint_fast32_t recvs = ATOMIC_VAR_INIT(0);
+static atomic_uint_fast32_t connects = ATOMIC_VAR_INIT(0);
 static char *command;
 static char *args;
 static char program[256];
@@ -277,8 +279,8 @@ rndc_senddone(isc_task_t *task, isc_event_t *event) {
 		fatal("send failed: %s", isc_result_totext(sevent->result));
 	}
 	isc_event_free(&event);
-	if (isc_refcount_decrement(&sends) == 1 &&
-	    isc_refcount_current(&recvs) == 0)
+	if (atomic_fetch_sub_release(&sends, 1) == 1 &&
+	    atomic_load_acquire(&recvs) == 0)
 	{
 		isc_socket_detach(&sock);
 		isc_task_shutdown(task);
@@ -295,7 +297,7 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) {
 	char *textmsg = NULL;
 	isc_result_t result;
 
-	isc_refcount_decrement(&recvs);
+	atomic_fetch_sub_release(&recvs, 1);
 
 	if (ccmsg.result == ISC_R_EOF)
 		fatal("connection to remote host closed\n"
@@ -348,8 +350,8 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) {
 
 	isc_event_free(&event);
 	isccc_sexpr_free(&response);
-	if (isc_refcount_current(&sends) == 0
-	    && isc_refcount_current(&recvs) == 0) {
+	if (atomic_load_acquire(&sends) == 0
+	    && atomic_load_acquire(&recvs) == 0) {
 		isc_socket_detach(&sock);
 		isc_task_shutdown(task);
 		isc_app_shutdown();
@@ -369,7 +371,7 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) {
 	isccc_sexpr_t *data;
 	isc_buffer_t b;
 
-	isc_refcount_decrement(&recvs);
+	atomic_fetch_sub_release(&recvs, 1);
 
 	if (ccmsg.result == ISC_R_EOF)
 		fatal("connection to remote host closed\n"
@@ -430,10 +432,10 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) {
 	isccc_ccmsg_cancelread(&ccmsg);
 	DO("schedule recv", isccc_ccmsg_readmessage(&ccmsg, task,
 						    rndc_recvdone, NULL));
-	isc_refcount_increment(&recvs);
+	atomic_fetch_add_relaxed(&recvs, 1);
 	DO("send message", isc_socket_send(sock, &r, task, rndc_senddone,
 					   NULL));
-	isc_refcount_increment(&sends);
+	atomic_fetch_add_relaxed(&sends, 1);
 
 	isc_event_free(&event);
 	isccc_sexpr_free(&response);
@@ -452,7 +454,7 @@ rndc_connected(isc_task_t *task, isc_event_t *event) {
 	isc_buffer_t b;
 	isc_result_t result;
 
-	isc_refcount_decrement(&connects);
+	atomic_fetch_sub_release(&connects, 1);
 
 	if (sevent->result != ISC_R_SUCCESS) {
 		isc_sockaddr_format(&serveraddrs[currentaddr], socktext,
@@ -498,10 +500,10 @@ rndc_connected(isc_task_t *task, isc_event_t *event) {
 
 	DO("schedule recv", isccc_ccmsg_readmessage(&ccmsg, task,
 						    rndc_recvnonce, NULL));
-	isc_refcount_increment(&recvs);
+	atomic_fetch_add_relaxed(&recvs, 1);
 	DO("send message", isc_socket_send(sock, &r, task, rndc_senddone,
 					   NULL));
-	isc_refcount_increment(&sends);
+	atomic_fetch_add_relaxed(&sends, 1);
 	isc_event_free(&event);
 	isccc_sexpr_free(&request);
 }
@@ -536,7 +538,7 @@ rndc_startconnect(isc_sockaddr_t *addr, isc_task_t *task) {
 	}
 	DO("connect", isc_socket_connect(sock, addr, task, rndc_connected,
 					 NULL));
-	isc_refcount_increment(&connects);
+	atomic_fetch_add_relaxed(&connects, 1);
 }
 
 static void
@@ -1003,9 +1005,9 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("isc_app_run() failed: %s", isc_result_totext(result));
 
-	if (isc_refcount_current(&connects) > 0 ||
-	    isc_refcount_current(&sends) > 0 ||
-	    isc_refcount_current(&recvs) > 0)
+	if (atomic_load_acquire(&connects) > 0 ||
+	    atomic_load_acquire(&sends) > 0 ||
+	    atomic_load_acquire(&recvs) > 0)
 	{
 		isc_socket_cancel(sock, task, ISC_SOCKCANCEL_ALL);
 	}

bin/rndc/rndc.conf.docbook

@@ -43,6 +43,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/rndc/rndc.docbook

@@ -44,6 +44,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/rndc/rndc.html

@@ -654,7 +654,7 @@
 <dd>
 	  <p>
 	    Dump the security roots (i.e., trust anchors
-	    configured via <span class="command"><strong>dnssec-keys</strong></span> statements, or the
+	    configured via <span class="command"><strong>trust-anchors</strong></span> statements, or the
 	    managed-keys or trusted-keys statements (both deprecated), or
 	    via <span class="command"><strong>dnssec-validation auto</strong></span>) and negative trust
 	    anchors for the specified views.  If no view is specified, all

bin/tests/prepare-softhsm2.sh

@@ -1,4 +1,14 @@
 #!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
 if [ -n "${SOFTHSM2_CONF}" ] && command -v softhsm2-util >/dev/null; then
     SOFTHSM2_DIR=$(dirname "$SOFTHSM2_CONF")
     mkdir -p "${SOFTHSM2_DIR}/tokens"

bin/tests/system/autosign/tests.sh

@@ -117,8 +117,12 @@ checkjitter () {
 	echo_i "checking whether all frequencies fall into <$_low;$_high> range"
 	for _num in $_expiretimes
 	do
-		if [ $_num -gt $_high ] || [ $_num -lt $_low ]; then
-			echo_i "error: too many RRSIG records ($_num) with the same expiration time"
+		if [ $_num -gt $_high ]; then
+			echo_i "error: too many RRSIG records ($_num) in expiration bucket"
+			_ret=1
+		fi
+		if [ $_num -lt $_low ]; then
+			echo_i "error: too few RRSIG records ($_num) in expiration bucket"
 			_ret=1
 		fi
 	done
@@ -1051,7 +1055,10 @@ check_if_nsec3param_exists() {
 	$DIG $DIGOPTS NSEC3PARAM jitter.nsec3.example @10.53.0.3 > dig.out.ns3.1.test$n || return 1
 	grep -q "^jitter\.nsec3\.example\..*NSEC3PARAM" dig.out.ns3.1.test$n || return 1
 }
-retry_quiet 20 check_if_nsec3param_exists || ret=1
+retry_quiet 40 check_if_nsec3param_exists || {
+	echo_i "error: NSEC3PARAM not present yet"
+	ret=1
+}
 $DIG $DIGOPTS AXFR jitter.nsec3.example @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
 # Check jitter distribution.
 checkjitter dig.out.ns3.2.test$n || ret=1

bin/tests/system/dnssec/tests.sh

@@ -101,6 +101,21 @@ stripns () {
     awk '($4 == "NS") || ($4 == "RRSIG" && $5 == "NS") { next} { print }' "$1"
 }
 
+#
+# Ensure there is not multiple consecutive blank lines.
+# Ensure there is a blank line before "Start view" and
+# "Negative trust anchors:".
+# Ensure there is not a blank line before "Secure roots:".
+#
+check_secroots_layout () {
+	awk '$0 == "" { if (empty) exit(1); empty=1; next }
+	     /Start view/ { if (!empty) exit(1) }
+	     /Secure roots:/ { if (empty) exit(1) }
+	     /Negative trust anchors:/ { if (!empty) exit(1) }
+	     { empty=0 }' $1
+	return $?
+}
+
 # Check that for a query against a validating resolver where the
 # authoritative zone is unsigned (insecure delegation), glue is returned
 # in the additional section
@@ -1703,13 +1718,14 @@ status=$((status+ret))
 # Test that "rndc secroots" is able to dump trusted keys
 echo_i "checking rndc secroots ($n)"
 ret=0
-rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
 keyid=$(cat ns1/managed.key.id)
+rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
 cp ns4/named.secroots named.secroots.test$n
+check_secroots_layout named.secroots.test$n || ret=1
 linecount=$(grep -c "./${DEFAULT_ALGORITHM}/$keyid ; static" named.secroots.test$n || true)
 [ "$linecount" -eq 1 ] || ret=1
 linecount=$(< named.secroots.test$n wc -l)
-[ "$linecount" -eq 10 ] || ret=1
+[ "$linecount" -eq 9 ] || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
@@ -1860,10 +1876,12 @@ dig_with_opts a.fakenode.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.7 ||
 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.7 > /dev/null && ret=1
 echo_i "dumping secroots"
 rndccmd 10.53.0.4 secroots | sed 's/^/ns4 /' | cat_i
-grep "bogus.example: expiry" ns4/named.secroots > /dev/null || ret=1
-grep "badds.example: expiry" ns4/named.secroots > /dev/null || ret=1
-grep "secure.example: expiry" ns4/named.secroots > /dev/null || ret=1
-grep "fakenode.secure.example: expiry" ns4/named.secroots > /dev/null || ret=1
+cp ns4/named.secroots named.secroots.test$n
+check_secroots_layout named.secroots.test$n || ret=1
+grep "bogus.example: expiry" named.secroots.test$n > /dev/null || ret=1
+grep "badds.example: expiry" named.secroots.test$n > /dev/null || ret=1
+grep "secure.example: expiry" named.secroots.test$n > /dev/null || ret=1
+grep "fakenode.secure.example: expiry" named.secroots.test$n > /dev/null || ret=1
 
 if [ "$ret" -ne 0 ]; then echo_i "failed - with NTA's in place failed"; fi
 status=$((status+ret))
@@ -3682,12 +3700,12 @@ status=$((status+ret))
 # DNSSEC tests related to unsupported, disabled and revoked trust anchors.
 #
 
-# This nameserver (ns8) is loaded with a bunch of trust anchors.  Some of them
-# are good (enabled.managed, enabled.trusted, secure.managed, secure.trusted),
-# and some of them are bad (disabled.managed, revoked.managed, unsupported.managed,
-# disabled.trusted, revoked.trusted, unsupported.trusted).  Make sure that the bad
-# trust anchors are ignored.  This is tested by looking for the corresponding
-# lines in the logfile.
+# This nameserver (ns8) is loaded with a bunch of trust anchors.  Some of
+# them are good (enabled.managed, enabled.trusted, secure.managed,
+# secure.trusted), and some of them are bad (disabled.managed,
+# revoked.managed, unsupported.managed, disabled.trusted, revoked.trusted,
+# unsupported.trusted).  Make sure that the bad trust anchors are ignored.
+# This is tested by looking for the corresponding lines in the logfile.
 echo_i "checking that keys with unsupported algorithms and disabled algorithms are ignored ($n)"
 ret=0
 grep -q "ignoring static-key for 'disabled\.trusted\.': algorithm is disabled" ns8/named.run || ret=1
@@ -4051,5 +4069,13 @@ do
   status=$((status+ret))
 done
 
+echo_i "checking secroots output with multiple views ($n)"
+rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
+cp ns4/named.secroots named.secroots.test$n
+check_secroots_layout named.secroots.test$n || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/inline/tests.sh

@@ -15,6 +15,12 @@ SYSTEMTESTTOP=..
 DIGOPTS="+tcp +dnssec -p ${PORT}"
 RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
 
+wait_for_serial() (
+    $DIG $DIGOPTS "@$1" "$2" SOA > "$4"
+    serial=$(awk '$4 == "SOA" { print $7 }' "$4")
+    [ "$3" -eq "${serial:--1}" ]
+)
+
 status=0
 n=0
 
@@ -1014,10 +1020,7 @@ ret=0
 $DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n
 newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n`
 $RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1
-sleep 1
-$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.ns3.post.test$n
-serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
-[ ${newserial:-0} -eq ${serial:-1} ] || ret=1
+retry_quiet 5 wait_for_serial 10.53.0.3 nsec3. "${newserial:-0}" dig.out.ns3.post.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -1047,10 +1050,7 @@ newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n",
 $RNDCCMD 10.53.0.3 freeze nsec3 > /dev/null 2>&1
 $RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1
 $RNDCCMD 10.53.0.3 thaw nsec3 > /dev/null 2>&1
-sleep 1
-$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.ns3.post.test$n
-serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
-[ ${newserial:-0} -eq ${serial:-1} ] || ret=1
+retry_quiet 5 wait_for_serial 10.53.0.3 nsec3. "${newserial:-0}" dig.out.ns3.post1.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -1060,10 +1060,7 @@ ret=0
 $DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n
 newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n`
 $RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
-sleep 1
-$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.post.test$n
-serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.post.test$n`
-[ ${newserial:-0} -eq ${serial:-1} ] || ret=1
+retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-0}" dig.out.ns2.post.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -1074,10 +1071,8 @@ $DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n
 oldserial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n`
 newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n`
 $RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
-sleep 1
-$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.post.test$n
-serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.post.test$n`
-[ ${oldserial:-0} -eq ${serial:-1} ] || ret=1
+retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-1}" dig.out.ns2.post1.test$n && ret=1
+retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${oldserial:-1}" dig.out.ns2.post2.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -1090,10 +1085,8 @@ newserial=`$PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n",
 $RNDCCMD 10.53.0.2 freeze bits > /dev/null 2>&1
 $RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1
 $RNDCCMD 10.53.0.2 thaw bits > /dev/null 2>&1
-sleep 1
-$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.post.test$n
-serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.post.test$n`
-[ ${oldserial:-0} -eq ${serial:-1} ] || ret=1
+retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-1}" dig.out.ns2.post1.test$n && ret=1
+retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${oldserial:-1}" dig.out.ns2.post2.test$n || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
@@ -1339,18 +1332,12 @@ ret=0
 mv Kdelayedkeys* ns3/
 $RNDCCMD 10.53.0.3 loadkeys delayedkeys > rndc.out.ns3.pre.test$n 2>&1 || ret=1
 # Wait until the zone is signed.
-ans=1
-for i in 1 2 3 4 5 6 7 8 9 10
-do
-	$RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n 2>&1
-	num=`grep "Done signing with" signing.out.test$n | wc -l`
-	if [ $num -eq 2 ]; then
-		ans=0
-		break
-	fi
-	sleep 1
-done
-if [ $ans != 0 ]; then ret=1; fi
+check_done_signing () (
+    $RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n 2>&1
+    num=`grep "Done signing with" signing.out.test$n | wc -l`
+    [ $num -eq 2 ]
+)
+retry_quiet 10 check_done_signing || ret=1
 # Halt rather than stopping the server to prevent the master file from being
 # flushed upon shutdown since we specifically want to avoid it.
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --halt --port ${CONTROLPORT} inline ns3
@@ -1369,6 +1356,7 @@ $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} inline ns3
 # unless the records contained in it were scheduled for resigning, no resigning
 # event will be scheduled at all since the secure zone master file contains no
 # DNSSEC records.
+wait_for_log 20 "all zones loaded" ns3/named.run || ret=1
 $RNDCCMD 10.53.0.3 zonestatus delayedkeys > rndc.out.ns3.post.test$n 2>&1 || ret=1
 grep "next resign node:" rndc.out.ns3.post.test$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi

bin/tests/system/statistics/tests.sh

@@ -71,7 +71,7 @@ $RNDCCMD -s 10.53.0.3 stats > /dev/null 2>&1
 [ -f ns3/named.stats ] || ret=1
 if [ ! "$CYGWIN" ]; then
     nsock0nstat=`grep "UDP/IPv4 sockets active" ns3/named.stats | awk '{print $1}'`
-    [ 0 -eq ${nsock0nstat:-0} ] || ret=1
+    [ 0 -ne ${nsock0nstat:-0} ] || ret=1
 fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

bin/tests/system/tcp/tests.sh

@@ -105,6 +105,10 @@ echo_i "TCP high-water: check initial statistics ($n)"
 ret=0
 refresh_tcp_stats
 assert_int_equal "${TCP_CUR}" 0 "current TCP clients count" || ret=1
+# We compare initial tcp-highwater value with 1 because as part of the
+# system test startup, the script start.pl executes dig to check if target
+# named is running, and that increments tcp-quota by one.
+assert_int_equal "${TCP_HIGH}" 1 "tcp-highwater count" || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 

bin/tests/system/xfer/tests.sh

@@ -18,11 +18,41 @@ RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
 status=0
 n=0
 
-n=`expr $n + 1`
-echo_i "testing basic zone transfer functionality"
+n=$((n+1))
+echo_i "testing basic zone transfer functionality (from primary) ($n)"
+tmp=0
 $DIG $DIGOPTS example. \
-	@10.53.0.2 axfr > dig.out.ns2 || status=1
-grep "^;" dig.out.ns2 | cat_i
+	@10.53.0.2 axfr > dig.out.ns2.test$n || tmp=1
+grep "^;" dig.out.ns2.test$n | cat_i
+
+digcomp dig1.good dig.out.ns2.test$n || tmp=1
+
+if test $tmp != 0 ; then echo_i "failed"; fi
+status=$((status+tmp))
+
+n=$((n+1))
+echo_i "testing basic zone transfer functionality (from secondary) ($n)"
+#
+# Spin to allow the zone to tranfer.
+#
+for i in 1 2 3 4 5
+do
+    tmp=0
+    $DIG $DIGOPTS example. \
+	@10.53.0.3 axfr > dig.out.ns3.test$n || tmp=1
+    grep "^;" dig.out.ns3.test$n > /dev/null || break
+    echo_i "plain zone re-transfer"
+    sleep 5
+done
+grep "^;" dig.out.ns3.test$n | cat_i
+digcomp dig1.good dig.out.ns3.test$n || tmp=1
+if test $tmp != 0 ; then echo_i "failed"; fi
+status=$((status+tmp))
+
+n=$((n+1))
+echo_i "testing TSIG signed zone transfers ($n)"
+$DIG $DIGOPTS tsigzone. @10.53.0.2 axfr -y tsigzone.:1234abcd8765 > dig.out.ns2.test$n || status=1
+grep "^;" dig.out.ns2.test$n | cat_i
 
 #
 # Spin to allow the zone to tranfer.
@@ -30,41 +60,16 @@ grep "^;" dig.out.ns2 | cat_i
 for i in 1 2 3 4 5
 do
 tmp=0
-$DIG $DIGOPTS example. \
-	@10.53.0.3 axfr > dig.out.ns3 || tmp=1
-	grep "^;" dig.out.ns3 > /dev/null
+	$DIG $DIGOPTS tsigzone. @10.53.0.3 axfr -y tsigzone.:1234abcd8765 > dig.out.ns3.test$n || tmp=1
+	grep "^;" dig.out.ns3.test$n > /dev/null
 	if test $? -ne 0 ; then break; fi
 	echo_i "plain zone re-transfer"
 	sleep 5
 done
 if test $tmp -eq 1 ; then status=1; fi
-grep "^;" dig.out.ns3 | cat_i
+grep "^;" dig.out.ns3.test$n | cat_i
 
-digcomp dig1.good dig.out.ns2 || status=1
-
-digcomp dig1.good dig.out.ns3 || status=1
-
-n=`expr $n + 1`
-echo_i "testing TSIG signed zone transfers"
-$DIG $DIGOPTS tsigzone. @10.53.0.2 axfr -y tsigzone.:1234abcd8765 > dig.out.ns2 || status=1
-grep "^;" dig.out.ns2 | cat_i
-
-#
-# Spin to allow the zone to tranfer.
-#
-for i in 1 2 3 4 5
-do
-tmp=0
-	$DIG $DIGOPTS tsigzone. @10.53.0.3 axfr -y tsigzone.:1234abcd8765 > dig.out.ns3 || tmp=1
-	grep "^;" dig.out.ns3 > /dev/null
-	if test $? -ne 0 ; then break; fi
-	echo_i "plain zone re-transfer"
-	sleep 5
-done
-if test $tmp -eq 1 ; then status=1; fi
-grep "^;" dig.out.ns3 | cat_i
-
-digcomp dig.out.ns2 dig.out.ns3 || status=1
+digcomp dig.out.ns2.test$n dig.out.ns3.test$n || status=1
 
 echo_i "reload servers for in preparation for ixfr-from-differences tests"
 
@@ -108,28 +113,29 @@ rndc_reload ns7 10.53.0.7
 
 sleep 3
 
-echo_i "testing zone is dumped after successful transfer"
+n=$((n+1))
+echo_i "testing zone is dumped after successful transfer ($n)"
 $DIG $DIGOPTS +noall +answer +multi @10.53.0.2 \
-	slave. soa > dig.out.ns2 || tmp=1
-grep "1397051952 ; serial" dig.out.ns2 > /dev/null 2>&1 || tmp=1
+	slave. soa > dig.out.ns2.test$n || tmp=1
+grep "1397051952 ; serial" dig.out.ns2.test$n > /dev/null 2>&1 || tmp=1
 grep "1397051952 ; serial" ns2/slave.db > /dev/null 2>&1 || tmp=1
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
-n=`expr $n + 1`
-echo_i "testing ixfr-from-differences yes;"
+n=$((n+1))
+echo_i "testing ixfr-from-differences yes; ($n)"
 tmp=0
 
 for i in 0 1 2 3 4 5 6 7 8 9
 do
 	a=0 b=0 c=0 d=0
 	echo_i "wait for reloads..."
-	$DIG $DIGOPTS @10.53.0.6 +noall +answer soa master > dig.out.soa1.ns6
-	grep "1397051953" dig.out.soa1.ns6 > /dev/null && a=1
-	$DIG $DIGOPTS @10.53.0.1 +noall +answer soa slave  > dig.out.soa2.ns1
-	grep "1397051953" dig.out.soa2.ns1 > /dev/null && b=1
-	$DIG $DIGOPTS @10.53.0.2 +noall +answer soa example > dig.out.soa3.ns2
-	grep "1397051953" dig.out.soa3.ns2 > /dev/null && c=1
+	$DIG $DIGOPTS @10.53.0.6 +noall +answer soa master > dig.out.soa1.ns6.test$n
+	grep "1397051953" dig.out.soa1.ns6.test$n > /dev/null && a=1
+	$DIG $DIGOPTS @10.53.0.1 +noall +answer soa slave  > dig.out.soa2.ns1.test$n
+	grep "1397051953" dig.out.soa2.ns1.test$n > /dev/null && b=1
+	$DIG $DIGOPTS @10.53.0.2 +noall +answer soa example > dig.out.soa3.ns2.test$n
+	grep "1397051953" dig.out.soa3.ns2.test$n > /dev/null && c=1
 	[ $a -eq 1 -a $b -eq 1 -a $c -eq 1 ] && break
 	sleep 2
 done
@@ -138,12 +144,12 @@ for i in 0 1 2 3 4 5 6 7 8 9
 do
 	a=0 b=0 c=0 d=0
 	echo_i "wait for transfers..."
-	$DIG $DIGOPTS @10.53.0.3 +noall +answer soa example > dig.out.soa1.ns3
-	grep "1397051953" dig.out.soa1.ns3 > /dev/null && a=1
-	$DIG $DIGOPTS @10.53.0.3 +noall +answer soa master > dig.out.soa2.ns3
-	grep "1397051953" dig.out.soa2.ns3 > /dev/null && b=1
-	$DIG $DIGOPTS @10.53.0.6 +noall +answer soa slave  > dig.out.soa3.ns6
-	grep "1397051953" dig.out.soa3.ns6 > /dev/null && c=1
+	$DIG $DIGOPTS @10.53.0.3 +noall +answer soa example > dig.out.soa1.ns3.test$n
+	grep "1397051953" dig.out.soa1.ns3.test$n > /dev/null && a=1
+	$DIG $DIGOPTS @10.53.0.3 +noall +answer soa master > dig.out.soa2.ns3.test$n
+	grep "1397051953" dig.out.soa2.ns3.test$n > /dev/null && b=1
+	$DIG $DIGOPTS @10.53.0.6 +noall +answer soa slave  > dig.out.soa3.ns6.test$n
+	grep "1397051953" dig.out.soa3.ns6.test$n > /dev/null && c=1
 	[ $a -eq 1 -a $b -eq 1 -a $c -eq 1 ] && break
 
 	# re-notify if necessary
@@ -154,62 +160,62 @@ do
 done
 
 $DIG $DIGOPTS example. \
-	@10.53.0.3 axfr > dig.out.ns3 || tmp=1
-grep "^;" dig.out.ns3 | cat_i
+	@10.53.0.3 axfr > dig.out.ns3.test$n || tmp=1
+grep "^;" dig.out.ns3.test$n | cat_i
 
-digcomp dig2.good dig.out.ns3 || tmp=1
+digcomp dig2.good dig.out.ns3.test$n || tmp=1
 
 # ns3 has a journal iff it received an IXFR.
 test -f ns3/example.bk || tmp=1
 test -f ns3/example.bk.jnl || tmp=1
 
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
-n=`expr $n + 1`
-echo_i "testing ixfr-from-differences master; (master zone)"
+n=$((n+1))
+echo_i "testing ixfr-from-differences master; (master zone) ($n)"
 tmp=0
 
 $DIG $DIGOPTS master. \
-	@10.53.0.6 axfr > dig.out.ns6 || tmp=1
-grep "^;" dig.out.ns6 | cat_i
+	@10.53.0.6 axfr > dig.out.ns6.test$n || tmp=1
+grep "^;" dig.out.ns6.test$n | cat_i
 
 $DIG $DIGOPTS master. \
-	@10.53.0.3 axfr > dig.out.ns3 || tmp=1
-grep "^;" dig.out.ns3 > /dev/null && cat_i dig.out.ns3
+	@10.53.0.3 axfr > dig.out.ns3.test$n || tmp=1
+grep "^;" dig.out.ns3.test$n > /dev/null && cat_i dig.out.ns3.test$n
 
-digcomp dig.out.ns6 dig.out.ns3 || tmp=1
+digcomp dig.out.ns6.test$n dig.out.ns3.test$n || tmp=1
 
 # ns3 has a journal iff it received an IXFR.
 test -f ns3/master.bk || tmp=1
 test -f ns3/master.bk.jnl || tmp=1
 
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
-n=`expr $n + 1`
-echo_i "testing ixfr-from-differences master; (slave zone)"
+n=$((n+1))
+echo_i "testing ixfr-from-differences master; (slave zone) ($n)"
 tmp=0
 
 $DIG $DIGOPTS slave. \
-	@10.53.0.6 axfr > dig.out.ns6 || tmp=1
-grep "^;" dig.out.ns6 | cat_i
+	@10.53.0.6 axfr > dig.out.ns6.test$n || tmp=1
+grep "^;" dig.out.ns6.test$n | cat_i
 
 $DIG $DIGOPTS slave. \
-	@10.53.0.1 axfr > dig.out.ns1 || tmp=1
-grep "^;" dig.out.ns1 | cat_i
+	@10.53.0.1 axfr > dig.out.ns1.test$n || tmp=1
+grep "^;" dig.out.ns1.test$n | cat_i
 
-digcomp dig.out.ns6 dig.out.ns1 || tmp=1
+digcomp dig.out.ns6.test$n dig.out.ns1.test$n || tmp=1
 
 # ns6 has a journal iff it received an IXFR.
 test -f ns6/slave.bk || tmp=1
 test -f ns6/slave.bk.jnl && tmp=1
 
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
-n=`expr $n + 1`
-echo_i "testing ixfr-from-differences slave; (master zone)"
+n=$((n+1))
+echo_i "testing ixfr-from-differences slave; (master zone) ($n)"
 tmp=0
 
 # ns7 has a journal iff it generates an IXFR.
@@ -217,35 +223,36 @@ test -f ns7/master2.db || tmp=1
 test -f ns7/master2.db.jnl && tmp=1
 
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
-n=`expr $n + 1`
-echo_i "testing ixfr-from-differences slave; (slave zone)"
+n=$((n+1))
+echo_i "testing ixfr-from-differences slave; (slave zone) ($n)"
 tmp=0
 
 $DIG $DIGOPTS slave. \
-	@10.53.0.1 axfr > dig.out.ns1 || tmp=1
-grep "^;" dig.out.ns1 | cat_i
+	@10.53.0.1 axfr > dig.out.ns1.test$n || tmp=1
+grep "^;" dig.out.ns1.test$n | cat_i
 
 $DIG $DIGOPTS slave. \
-	@10.53.0.7 axfr > dig.out.ns7 || tmp=1
-grep "^;" dig.out.ns1 | cat_i
+	@10.53.0.7 axfr > dig.out.ns7.test$n || tmp=1
+grep "^;" dig.out.ns7.test$n | cat_i
 
-digcomp dig.out.ns7 dig.out.ns1 || tmp=1
+digcomp dig.out.ns7.test$n dig.out.ns1.test$n || tmp=1
 
 # ns7 has a journal iff it generates an IXFR.
 test -f ns7/slave.bk || tmp=1
 test -f ns7/slave.bk.jnl || tmp=1
 
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
-echo_i "check that a multi-message uncompressable zone transfers"
+n=$((n+1))
+echo_i "check that a multi-message uncompressable zone transfers ($n)"
 $DIG axfr . -p ${PORT} @10.53.0.4 | grep SOA > axfr.out
 if test `wc -l < axfr.out` != 2
 then
 	 echo_i "failed"
-	 status=`expr $status + 1`
+         status=$((status+1))
 fi
 
 # now we test transfers with assorted TSIG glitches
@@ -276,20 +283,20 @@ rndc_reload ns4 10.53.0.4
 
 for i in 0 1 2 3 4 5 6 7 8 9
 do
-	$DIGCMD nil. SOA > dig.out.ns4
-	grep SOA dig.out.ns4 > /dev/null && break
+	$DIGCMD nil. SOA > dig.out.ns4.test$n
+	grep SOA dig.out.ns4.test$n > /dev/null && break
 	sleep 1
 done
 
 sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: success" > /dev/null || {
     echo_i "failed: expected status was not logged"
-    status=1
+    status=$((status+1))
 }
 cur=`awk 'END {print NR}' ns4/named.run`
 
 $DIGCMD nil. TXT | grep 'initial AXFR' >/dev/null || {
     echo_i "failed"
-    status=1
+    status=$((status+1))
 }
 
 echo_i "unsigned transfer"
@@ -303,13 +310,13 @@ sleep 2
 
 sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: expected a TSIG or SIG(0)" > /dev/null || {
     echo_i "failed: expected status was not logged"
-    status=1
+    status=$((status+1))
 }
 cur=`awk 'END {print NR}' ns4/named.run`
 
 $DIGCMD nil. TXT | grep 'unsigned AXFR' >/dev/null && {
     echo_i "failed"
-    status=1
+    status=$((status+1))
 }
 
 echo_i "bad keydata"
@@ -323,13 +330,13 @@ sleep 2
 
 sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: tsig verify failure" > /dev/null || {
     echo_i "failed: expected status was not logged"
-    status=1
+    status=$((status+1))
 }
 cur=`awk 'END {print NR}' ns4/named.run`
 
 $DIGCMD nil. TXT | grep 'bad keydata AXFR' >/dev/null && {
     echo_i "failed"
-    status=1
+    status=$((status+1))
 }
 
 echo_i "partially-signed transfer"
@@ -343,13 +350,13 @@ sleep 2
 
 sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: expected a TSIG or SIG(0)" > /dev/null || {
     echo_i "failed: expected status was not logged"
-    status=1
+    status=$((status+1))
 }
 cur=`awk 'END {print NR}' ns4/named.run`
 
 $DIGCMD nil. TXT | grep 'partially signed AXFR' >/dev/null && {
     echo_i "failed"
-    status=1
+    status=$((status+1))
 }
 
 echo_i "unknown key"
@@ -363,13 +370,13 @@ sleep 2
 
 sed -n "$cur,\$p" < ns4/named.run | grep "tsig key 'tsig_key': key name and algorithm do not match" > /dev/null || {
     echo_i "failed: expected status was not logged"
-    status=1
+    status=$((status+1))
 }
 cur=`awk 'END {print NR}' ns4/named.run`
 
 $DIGCMD nil. TXT | grep 'unknown key AXFR' >/dev/null && {
     echo_i "failed"
-    status=1
+    status=$((status+1))
 }
 
 echo_i "incorrect key"
@@ -383,16 +390,16 @@ sleep 2
 
 sed -n "$cur,\$p" < ns4/named.run | grep "tsig key 'tsig_key': key name and algorithm do not match" > /dev/null || {
     echo_i "failed: expected status was not logged"
-    status=1
+    status=$((status+1))
 }
 cur=`awk 'END {print NR}' ns4/named.run`
 
 $DIGCMD nil. TXT | grep 'incorrect key AXFR' >/dev/null && {
     echo_i "failed"
-    status=1
+    status=$((status+1))
 }
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "check that we ask for and get a EDNS EXPIRE response ($n)"
 # force a refresh query
 $RNDCCMD 10.53.0.7 refresh edns-expire 2>&1 | sed 's/^/ns7 /' | cat_i
@@ -402,56 +409,59 @@ sleep 10
 expire=`awk '/edns-expire\/IN: got EDNS EXPIRE of/ { x=$9 } END { print x }' ns7/named.run`
 test ${expire:-0} -gt 0 -a ${expire:-0} -lt 1814400 || {
     echo_i "failed (expire=${expire:-0})"
-    status=1
+    status=$((status+1))
 }
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "test smaller transfer TCP message size ($n)"
 $DIG $DIGOPTS example. @10.53.0.8 axfr \
-	-y key1.:1234abcd8765 > dig.out.msgsize || status=1
+	-y key1.:1234abcd8765 > dig.out.msgsize.test$n || status=1
 
-$DOS2UNIX dig.out.msgsize >/dev/null 2>&1
+$DOS2UNIX dig.out.msgsize.test$n >/dev/null 2>&1
 
-bytes=`wc -c < dig.out.msgsize`
+bytes=`wc -c < dig.out.msgsize.test$n`
 if [ $bytes -ne 459357 ]; then
 	echo_i "failed axfr size check"
-	status=1
+        status=$((status+1))
 fi
 
 num_messages=`cat ns8/named.run | grep "sending TCP message of" | wc -l`
 if [ $num_messages -le 300 ]; then
 	echo_i "failed transfer message count check"
-	status=1
+        status=$((status+1))
 fi
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "test mapped zone with out of zone data ($n)"
 tmp=0
-$DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.1.$n
-grep "status: NOERROR," dig.out.1.$n > /dev/null || tmp=1
+$DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.1.test$n
+grep "status: NOERROR," dig.out.1.test$n > /dev/null || tmp=1
 $PERL $SYSTEMTESTTOP/stop.pl xfer ns3
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} xfer ns3
 for try in 0 1 2 3 4 5 6 7 8 9; do
     iret=0
-    $DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.2.$n
-    grep "status: NOERROR," dig.out.2.$n > /dev/null || iret=1
-    $DIG -p ${PORT} axfr mapped @10.53.0.3 > dig.out.3.$n
-    digcomp knowngood.mapped dig.out.3.$n || iret=1
+    $DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.2.test$n
+    grep "status: NOERROR," dig.out.2.test$n > /dev/null || iret=1
+    if [ "$iret" -eq 0 ]
+    then
+        $DIG -p ${PORT} axfr mapped @10.53.0.3 > dig.out.3.test$n
+        digcomp knowngood.mapped dig.out.3.test$n || iret=1
+    fi
     [ "$iret" -eq 0 ] && break
     sleep 1
 done
 [ "$iret" -eq 0 ] || tmp=1
 [ "$tmp" -ne 0 ] && echo_i "failed"
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "test that a zone with too many records is rejected (AXFR) ($n)"
 tmp=0
 grep "'axfr-too-big/IN'.*: too many records" ns6/named.run >/dev/null || tmp=1
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
-n=`expr $n + 1`
+n=$((n+1))
 echo_i "test that a zone with too many records is rejected (IXFR) ($n)"
 tmp=0
 grep "'ixfr-too-big./IN.*: too many records" ns6/named.run >/dev/null && tmp=1
@@ -468,18 +478,18 @@ do
 done
 grep "'ixfr-too-big/IN'.*: too many records" ns6/named.run >/dev/null || tmp=1
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
-n=`expr $n + 1`
-echo_i "checking whether dig calculates AXFR statistics correctly"
+n=$((n+1))
+echo_i "checking whether dig calculates AXFR statistics correctly ($n)"
 # Loop until the secondary server manages to transfer the "xfer-stats" zone so
 # that we can both check dig output and immediately proceed with the next test.
 # Use -b so that we can discern between incoming and outgoing transfers in ns3
 # logs later on.
 tmp=1
 for i in 1 2 3 4 5 6 7 8 9 10; do
-	$DIG $DIGOPTS +noedns +stat -b 10.53.0.2 @10.53.0.3 xfer-stats. AXFR > dig.out.ns3.$n
-	if grep "; Transfer failed" dig.out.ns3.$n > /dev/null; then
+	$DIG $DIGOPTS +noedns +stat -b 10.53.0.2 @10.53.0.3 xfer-stats. AXFR > dig.out.ns3.test$n
+	if grep "; Transfer failed" dig.out.ns3.test$n > /dev/null; then
 		sleep 1
 	else
 		tmp=0
@@ -489,25 +499,25 @@ done
 if [ $tmp -ne 0 ]; then
 	echo_i "timed out waiting for zone transfer"
 else
-	get_dig_xfer_stats dig.out.ns3.$n > stats.dig
+	get_dig_xfer_stats dig.out.ns3.test$n > stats.dig
 	diff axfr-stats.good stats.dig || tmp=1
 fi
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
 # Note: in the next two tests, we use ns3 logs for checking both incoming and
 # outgoing transfer statistics as ns3 is both a secondary server (for ns1) and a
 # primary server (for dig queries from the previous test) for "xfer-stats".
-n=`expr $n + 1`
-echo_i "checking whether named calculates incoming AXFR statistics correctly"
+n=$((n+1))
+echo_i "checking whether named calculates incoming AXFR statistics correctly ($n)"
 tmp=0
 get_named_xfer_stats ns3/named.run 10.53.0.1 xfer-stats "Transfer completed" > stats.incoming
 diff axfr-stats.good stats.incoming || tmp=1
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
-n=`expr $n + 1`
-echo_i "checking whether named calculates outgoing AXFR statistics correctly"
+n=$((n+1))
+echo_i "checking whether named calculates outgoing AXFR statistics correctly ($n)"
 tmp=1
 for i in 0 1 2 3 4 5 6 7 8 9; do
 	get_named_xfer_stats ns3/named.run 10.53.0.2 xfer-stats "AXFR ended" > stats.outgoing
@@ -518,7 +528,7 @@ for i in 0 1 2 3 4 5 6 7 8 9; do
 	sleep 1
 done
 if test $tmp != 0 ; then echo_i "failed"; fi
-status=`expr $status + $tmp`
+status=$((status+tmp))
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tools/arpaname.docbook

@@ -37,6 +37,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/tools/dnstap-read.docbook

@@ -37,6 +37,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/tools/mdig.docbook

@@ -37,6 +37,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/tools/named-journalprint.docbook

@@ -39,6 +39,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/tools/named-nzd2nzf.docbook

@@ -35,6 +35,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/tools/named-rrchecker.docbook

@@ -36,6 +36,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/tools/nsec3hash.docbook

@@ -39,6 +39,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

configure

@@ -12216,6 +12216,9 @@ $as_echo "no" >&6; }
 		PKG_CONFIG=""
 	fi
 fi
+if test -z "$PKG_CONFIG"; then :
+  as_fn_error $? "The pkg-config script could not be found or is too old." "$LINENO" 5
+fi
 
 # Check whether --enable-buffer_useinline was given.
 if test "${enable_buffer_useinline+set}" = set; then :

configure.ac

@@ -61,6 +61,8 @@ AC_SUBST(BACKTRACECFLAGS)
 #
 
 PKG_PROG_PKG_CONFIG
+AS_IF([test -z "$PKG_CONFIG"],
+      [AC_MSG_ERROR([The pkg-config script could not be found or is too old.])])
 
 AC_ARG_ENABLE(buffer_useinline,
 	      AS_HELP_STRING([--enable-buffer-useinline],

doc/arm/.gitattributes

@@ -0,0 +1,7 @@
+
+Bv9ARM.ch* -diff -merge
+Bv9ARM.pdf -diff -merge
+Bv9ARM.xml   text
+Bv9ARM.conf  text
+
+*.xml auto=text

doc/arm/Bv9ARM-book.xml

@@ -35,6 +35,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <!-- insert copyright end -->
@@ -582,7 +583,7 @@
     <section xml:id="cpu_req"><info><title>CPU Requirements</title></info>
       <para>
 	CPU requirements for <acronym>BIND</acronym> 9 range from
-	i486-class machines
+	i386-class machines
 	for serving of static zones without caching, to enterprise-class
 	machines if you intend to process many dynamic updates and DNSSEC
 	signed zones, serving many thousands of queries per second.
@@ -632,9 +633,9 @@
 	ISC <acronym>BIND</acronym> 9 compiles and runs on a large
 	number
 	of Unix-like operating systems and on
-	Microsoft Windows Server 2003 and 2008, and Windows XP and Vista.
+	Microsoft Windows Server 2012 R2, 2016 and Windows 10.
 	For an up-to-date
-	list of supported systems, see the README file in the top level
+	list of supported systems, see the PLATFORMS file in the top level
 	directory
 	of the BIND 9 source distribution.
       </para>
@@ -747,7 +748,7 @@ zone "eng.example.com" {
       </para>
 
       <para>
-	For example, if you have three WWW servers with network addresses
+	For example, if you have three HTTP servers with network addresses
 	of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
 	following means that clients will connect to each machine one third
 	of the time:
@@ -10985,8 +10986,7 @@ example.com                 CNAME   rpz-tcp-only.
 	  </para>
 	  <para>
 	    It is not possible to mix static with initial trust anchors
-	    for the same domain name. It is also not possible to mix
-	    <command>key</command> with <command>ds</command> trust anchors.
+	    for the same domain name.
 	  </para>
 	  <para>
 	    The first time <command>named</command> runs with an

doc/arm/Bv9ARM.ch01.html

@@ -614,6 +614,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch02.html

@@ -68,7 +68,7 @@
 <a name="cpu_req"></a>CPU Requirements</h2></div></div></div>
       <p>
         CPU requirements for <acronym class="acronym">BIND</acronym> 9 range from
-        i486-class machines
+        i386-class machines
         for serving of static zones without caching, to enterprise-class
         machines if you intend to process many dynamic updates and DNSSEC
         signed zones, serving many thousands of queries per second.
@@ -121,9 +121,9 @@
         ISC <acronym class="acronym">BIND</acronym> 9 compiles and runs on a large
         number
         of Unix-like operating systems and on
-        Microsoft Windows Server 2003 and 2008, and Windows XP and Vista.
+        Microsoft Windows Server 2012 R2, 2016 and Windows 10.
         For an up-to-date
-        list of supported systems, see the README file in the top level
+        list of supported systems, see the PLATFORMS file in the top level
         directory
         of the BIND 9 source distribution.
       </p>
@@ -146,6 +146,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch03.html

@@ -164,7 +164,7 @@ zone "eng.example.com" {
       </p>
 
       <p>
-        For example, if you have three WWW servers with network addresses
+        For example, if you have three HTTP servers with network addresses
         of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
         following means that clients will connect to each machine one third
         of the time:
@@ -856,6 +856,6 @@ controls {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch04.html

@@ -1042,7 +1042,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
           <strong class="userinput"><code>yes</code></strong>, DNSSEC validation will only occur
           if at least one trust anchor has been explicitly configured
           in <code class="filename">named.conf</code>
-          using a <span class="command"><strong>dnssec-keys</strong></span> statement (or the
+          using a <span class="command"><strong>trust-anchors</strong></span> statement (or the
           <span class="command"><strong>managed-keys</strong></span> and <span class="command"><strong>trusted-keys</strong></span>
           statements, both deprecated).
         </p>
@@ -1057,7 +1057,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
         </p>
 
         <p>
-          The keys specified in <span class="command"><strong>dnssec-keys</strong></span>
+          The keys specified in <span class="command"><strong>trust-anchors</strong></span>
           copies of DNSKEY RRs for zones that are used to form the
           first link in the cryptographic chain of trust.  Keys configured
           with the keyword <span class="command"><strong>static-key</strong></span> or
@@ -1071,7 +1071,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
         </p>
 
         <p>
-          <span class="command"><strong>dnssec-keys</strong></span> is described in more detail
+          <span class="command"><strong>trust-anchors</strong></span> is described in more detail
           later in this document.
         </p>
 
@@ -1094,7 +1094,7 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
         </p>
 
 <pre class="programlisting">
-dnssec-keys {
+trust-anchors {
         /* Root Key */
         "." initial-key 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwS
                                  JxrGkxJWoZu6I7PzJu/E9gx4UC1zGAHlXKdE4zYIpRh
@@ -1586,10 +1586,10 @@ options {
     
     <p>To configure a validating resolver to use RFC 5011 to
     maintain a trust anchor, configure the trust anchor using a
-    <span class="command"><strong>dnssec-keys</strong></span> statement and the
+    <span class="command"><strong>trust-anchors</strong></span> statement and the
     <span class="command"><strong>initial-key</strong></span> or <span class="command"><strong>initial-ds</strong></span>
     keyword. Information about this can be found in
-    <a class="xref" href="Bv9ARM.ch05.html#dnssec-keys" title="dnssec-keys Statement Definition and Usage">the section called &#8220;<span class="command"><strong>dnssec-keys</strong></span> Statement Definition
+    <a class="xref" href="Bv9ARM.ch05.html#trust-anchors" title="trust-anchors Statement Definition and Usage">the section called &#8220;<span class="command"><strong>trust-anchors</strong></span> Statement Definition
             and Usage&#8221;</a>.</p>
   </div>
   <div class="section">
@@ -2915,6 +2915,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch05.html

@@ -67,8 +67,8 @@
 <dt><span class="section"><a href="Bv9ARM.ch05.html#statschannels"><span class="command"><strong>statistics-channels</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#statistics_channels"><span class="command"><strong>statistics-channels</strong></span> Statement Definition and
               Usage</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_keys"><span class="command"><strong>dnssec-keys</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec-keys"><span class="command"><strong>dnssec-keys</strong></span> Statement Definition
+<dt><span class="section"><a href="Bv9ARM.ch05.html#trust_anchors"><span class="command"><strong>trust-anchors</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch05.html#trust-anchors"><span class="command"><strong>trust-anchors</strong></span> Statement Definition
             and Usage</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_policy_grammar"><span class="command"><strong>dnssec-policy</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_policy"><span class="command"><strong>dnssec-policy</strong></span> Statement Definition
@@ -899,7 +899,7 @@
 </tr>
 <tr>
 <td>
-                <p><span class="command"><strong>dnssec-keys</strong></span></p>
+                <p><span class="command"><strong>trust-anchors</strong></span></p>
               </td>
 <td>
                 <p>
@@ -920,9 +920,9 @@
               </td>
 <td>
                 <p>
-                  is identical to <span class="command"><strong>dnssec-keys</strong></span>;
+                  is identical to <span class="command"><strong>trust-anchors</strong></span>;
                   this option is deprecated in favor
-                  of <span class="command"><strong>dnssec-keys</strong></span> with
+                  of <span class="command"><strong>trust-anchors</strong></span> with
                   the <span class="command"><strong>initial-key</strong></span> keyword,
                   and may be removed in a future release.
                 </p>
@@ -936,7 +936,7 @@
                 <p>
                   defines permanent trusted DNSSEC keys;
                   this option is deprecated in favor
-                  of <span class="command"><strong>dnssec-keys</strong></span> with
+                  of <span class="command"><strong>trust-anchors</strong></span> with
                   the <span class="command"><strong>static-key</strong></span> keyword,
                   and may be removed in a future release.
                 </p>
@@ -2950,9 +2950,9 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                     The number of seconds to wait between attempts to
                     reopen a closed output stream. The minimum is 1 second,
                     the maximum is 600 seconds (10 minutes), and the default
-                    is 5 seconds.
-                    For convenience, TTL-style time unit suffixes may be
-                    used to specify the value.
+                    is 5 seconds.  For convenience, TTL-style time unit
+                    suffixes may be used to specify the value.  It also
+                    accepts ISO 8601 duration formats.
                   
                 </li>
 </ul></div>
@@ -3087,7 +3087,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                 track managed DNSSEC keys (i.e., those configured using
                 the <span class="command"><strong>initial-key</strong></span> or
                 <span class="command"><strong>initial-ds</strong></span> keywords in a
-                <span class="command"><strong>dnssec-keys</strong></span> statement).  By default,
+                <span class="command"><strong>trust-anchors</strong></span> statement).  By default,
                 this is the working directory.  The directory
                 <span class="emphasis"><em>must</em></span> be writable by the effective
                 user ID of the <span class="command"><strong>named</strong></span> process.
@@ -3455,7 +3455,7 @@ options {
                 as insecure.
               </p>
               <p>
-                Configured trust anchors in <span class="command"><strong>dnssec-keys</strong></span>
+                Configured trust anchors in <span class="command"><strong>trust-anchors</strong></span>
                 (or <span class="command"><strong>managed-keys</strong></span> or
                 <span class="command"><strong>trusted-keys</strong></span>, both deprecated)
                 that match a disabled algorithm will be ignored and treated
@@ -3487,7 +3487,7 @@ options {
                 they are secure.  If <strong class="userinput"><code>no</code></strong>, then normal
                 DNSSEC validation applies allowing for insecure answers to
                 be accepted.  The specified domain must be defined as a
-                trust anchor, for instance in a <span class="command"><strong>dnssec-keys</strong></span>
+                trust anchor, for instance in a <span class="command"><strong>trust-anchors</strong></span>
                 statement, or <span class="command"><strong>dnssec-validation auto</strong></span> must
                 be active.
               </p>
@@ -3646,8 +3646,11 @@ options {
                 <p>
                   For convenience, TTL-style time unit suffixes can be
                   used to specify the NTA lifetime in seconds, minutes
-                  or hours.  <code class="option">nta-lifetime</code> defaults to
-                  one hour.  It cannot exceed one week.
+                  or hours.  It also accepts ISO 8601 duration formats.
+                </p>
+                <p>
+                 <code class="option">nta-lifetime</code> defaults to one hour.  It
+                 cannot exceed one week.
                 </p>
             </dd>
 <dt><span class="term"><span class="command"><strong>nta-recheck</strong></span></span></dt>
@@ -3677,9 +3680,13 @@ options {
                 <p>
                   For convenience, TTL-style time unit suffixes can be
                   used to specify the NTA recheck interval in seconds,
-                  minutes or hours.  The default is five minutes.  It
-                  cannot be longer than <code class="option">nta-lifetime</code>
-                  (which cannot be longer than a week).
+                  minutes or hours.  It also accepts ISO 8601 duration
+                  formats.
+                </p>
+                <p>
+                  The default is five minutes.  It cannot be longer than
+                  <code class="option">nta-lifetime</code> (which cannot be longer
+                  than a week).
                 </p>
             </dd>
 <dt><span class="term"><span class="command"><strong>max-zone-ttl</strong></span></span></dt>
@@ -3687,7 +3694,10 @@ options {
               <p>
                 Specifies a maximum permissible TTL value in seconds.
                 For convenience, TTL-style time unit suffixes may be
-                used to specify the maximum value.
+                used to specify the maximum value. It also
+                accepts ISO 8601 duration formats.
+              </p>
+              <p>
                 When loading a zone file using a
                 <code class="option">masterfile-format</code> of
                 <code class="constant">text</code> or <code class="constant">raw</code>,
@@ -4500,7 +4510,7 @@ options {
                   Causes <span class="command"><strong>named</strong></span> to send specially-formed
                   queries once per day to domains for which trust anchors
                   have been configured via, e.g.,
-                  <span class="command"><strong>dnssec-keys</strong></span> or
+                  <span class="command"><strong>trust-anchors</strong></span> or
                   <span class="command"><strong>dnssec-validation auto</strong></span>.
                 </p>
                 <p>
@@ -4691,7 +4701,7 @@ options {
                 <p>
                   If set to <strong class="userinput"><code>yes</code></strong>, DNSSEC validation is
                   enabled, but a trust anchor must be manually configured
-                  using a <span class="command"><strong>dnssec-keys</strong></span> statement (or
+                  using a <span class="command"><strong>trust-anchors</strong></span> statement (or
                   the <span class="command"><strong>managed-keys</strong></span> or the
                   <span class="command"><strong>trusted-keys</strong></span> statements, both deprecated).
                   If there is no configured trust anchor, validation will
@@ -6515,7 +6525,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   <span class="command"><strong>listen-on</strong></span> configuration), and
                   will stop listening on interfaces that have gone away.
                   For convenience, TTL-style time unit suffixes may be
-                  used to specify the value.
+                  used to specify the value.  It also accepts ISO 8601
+                  duration formats.
                 </p>
               </dd>
 </dl></div>
@@ -6795,9 +6806,13 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   stores negative answers. <span class="command"><strong>min-ncache-ttl</strong></span> is
                   used to set a minimum retention time for these answers in the
                   server in seconds.  For convenience, TTL-style time unit
-                  suffixes may be used to specify the value.  The default
-                  <span class="command"><strong>min-ncache-ttl</strong></span> is <code class="literal">0</code>
-                  seconds.  <span class="command"><strong>min-ncache-ttl</strong></span> cannot exceed 90
+                  suffixes may be used to specify the value.  It also
+                  accepts ISO 8601 duration formats.
+                </p>
+                <p>
+                  The default <span class="command"><strong>min-ncache-ttl</strong></span> is
+                  <code class="literal">0</code> seconds.
+                  <span class="command"><strong>min-ncache-ttl</strong></span> cannot exceed 90
                   seconds and will be truncated to 90 seconds if set to a
                   greater value.
                 </p>
@@ -6806,10 +6821,14 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 <dd>
                 <p>
                   Sets the minimum time for which the server will cache ordinary
-                  (positive) answers in seconds. For convenience, TTL-style time
-                  unit suffixes may be used to specify the value. The default
-                  <span class="command"><strong>min-cache-ttl</strong></span> is <code class="literal">0</code>
-                  seconds. <span class="command"><strong>min-cache-ttl</strong></span> cannot exceed 90
+                  (positive) answers in seconds.  For convenience, TTL-style
+                  time unit suffixes may be used to specify the value.  It also
+                  accepts ISO 8601 duration formats.
+                </p>
+                <p>
+                  The default <span class="command"><strong>min-cache-ttl</strong></span> is
+                  <code class="literal">0</code> seconds.
+                  <span class="command"><strong>min-cache-ttl</strong></span> cannot exceed 90
                   seconds and will be truncated to 90 seconds if set to a
                   greater value.
                 </p>
@@ -6818,15 +6837,19 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 <dd>
                 <p>
                   To reduce network traffic and increase performance,
-                  the server stores negative answers. <span class="command"><strong>max-ncache-ttl</strong></span> is
+                  the server stores negative answers.
+                  <span class="command"><strong>max-ncache-ttl</strong></span> is
                   used to set a maximum retention time for these answers in
-                  the server in seconds.
-                  For convenience, TTL-style time unit suffixes may be
-                  used to specify the value.  The default
-                  <span class="command"><strong>max-ncache-ttl</strong></span> is <code class="literal">10800</code> seconds (3 hours).
-                  <span class="command"><strong>max-ncache-ttl</strong></span> cannot exceed
-                  7 days and will
-                  be silently truncated to 7 days if set to a greater value.
+                  the server in seconds.  For convenience, TTL-style time unit
+                  suffixes may be used to specify the value.  It also accepts
+                  ISO 8601 duration formats.
+                </p>
+                <p>
+                  The default <span class="command"><strong>max-ncache-ttl</strong></span> is
+                  <code class="literal">10800</code> seconds (3 hours).
+                  <span class="command"><strong>max-ncache-ttl</strong></span> cannot exceed 7 days and
+                  will be silently truncated to 7 days if set to a greater
+                  value.
                 </p>
               </dd>
 <dt><span class="term"><span class="command"><strong>max-cache-ttl</strong></span></span></dt>
@@ -6835,7 +6858,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   Sets the maximum time for which the server will
                   cache ordinary (positive) answers in seconds.
                   For convenience, TTL-style time unit suffixes may be
-                  used to specify the value.
+                  used to specify the value.  It also accepts ISO 8601
+                  duration formats.
+                </p>
+                <p>
                   The default is 604800 (one week).
                   A value of zero may cause all queries to return
                   SERVFAIL, because of lost caches of intermediate
@@ -8043,7 +8069,9 @@ deny-answer-aliases { "example.net"; };
             The <span class="command"><strong>max-policy-ttl</strong></span> clause changes the
             maximum seconds from its default of 5.
             For convenience, TTL-style time unit suffixes may be
-            used to specify the value.
+            used to specify the value.  It also accepts ISO 8601 duration
+            formats.
+
           </p>
 
           <p>
@@ -8139,7 +8167,8 @@ example.com                 CNAME   rpz-tcp-only.
             recent update, then the changes will not be carried out until this
             interval has elapsed.  The default is <code class="literal">60</code> seconds.
             For convenience, TTL-style time unit suffixes may be
-            used to specify the value.
+            used to specify the value.  It also accepts ISO 8601 duration
+            formats.
           </p>
         </div>
 
@@ -8849,9 +8878,9 @@ example.com                 CNAME   rpz-tcp-only.
 
         <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="dnssec_keys"></a><span class="command"><strong>dnssec-keys</strong></span> Statement Grammar</h3></div></div></div>
+<a name="trust_anchors"></a><span class="command"><strong>trust-anchors</strong></span> Statement Grammar</h3></div></div></div>
         <pre class="programlisting">
-<span class="command"><strong>dnssec-keys</strong></span> { <em class="replaceable"><code>string</code></em> ( static-key |
+<span class="command"><strong>trust-anchors</strong></span> { <em class="replaceable"><code>string</code></em> ( static-key |
     <span class="command"><strong>initial-key</strong></span> | static-ds | initial-ds )
     <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em>
     <em class="replaceable"><code>quoted_string</code></em>; ... };
@@ -8859,11 +8888,11 @@ example.com                 CNAME   rpz-tcp-only.
         </div>
         <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="dnssec-keys"></a><span class="command"><strong>dnssec-keys</strong></span> Statement Definition
+<a name="trust-anchors"></a><span class="command"><strong>trust-anchors</strong></span> Statement Definition
             and Usage</h3></div></div></div>
 
           <p>
-            The <span class="command"><strong>dnssec-keys</strong></span> statement defines DNSSEC
+            The <span class="command"><strong>trust-anchors</strong></span> statement defines DNSSEC
             trust anchors.  DNSSEC is described in <a class="xref" href="Bv9ARM.ch04.html#DNSSEC" title="DNSSEC">the section called &#8220;DNSSEC&#8221;</a>.
           </p>
           <p>
@@ -8882,21 +8911,21 @@ example.com                 CNAME   rpz-tcp-only.
             the <span class="command"><strong>validate-except</strong></span> option).
           </p>
           <p>
-            All keys listed in <span class="command"><strong>dnssec-keys</strong></span>, and
+            All keys listed in <span class="command"><strong>trust-anchors</strong></span>, and
             their corresponding zones, are deemed to exist regardless
             of what parent zones say.  Only keys configured as trust anchors
             are used to validate the DNSKEY RRset for the corresponding
             name. The parent's DS RRset will not be used.
           </p>
           <p>
-            <span class="command"><strong>dnssec-keys</strong></span> may be set at the top level
+            <span class="command"><strong>trust-anchors</strong></span> may be set at the top level
             of <code class="filename">named.conf</code> or within a view.  If it is
             set in both places, the configurations are additive: keys
             defined at the top level are inherited by all views, but keys
             defined in a view are only used within that view.
           </p>
           <p>
-            The <span class="command"><strong>dnssec-keys</strong></span> statement can contain
+            The <span class="command"><strong>trust-anchors</strong></span> statement can contain
             multiple trust anchor entries, each consisting of a
             domain name, followed by an "anchor type" keyword indicating
             the trust anchor's format, followed by the key or digest data.
@@ -8936,7 +8965,7 @@ example.com                 CNAME   rpz-tcp-only.
             <span class="command"><strong>static-ds</strong></span> would be unable to validate
             this zone any longer; it would reply with a SERVFAIL response
             code.  This would continue until the resolver operator had
-            updated the <span class="command"><strong>dnssec-keys</strong></span> statement with
+            updated the <span class="command"><strong>trust-anchors</strong></span> statement with
             the new key.
           </p>
           <p>
@@ -8972,7 +9001,7 @@ example.com                 CNAME   rpz-tcp-only.
             <span class="command"><strong>initial-key</strong></span> or <span class="command"><strong>initial-ds</strong></span>
             configured in <code class="filename">named.conf</code>, it fetches the
             DNSKEY RRset directly from the zone apex, and validates it
-            using the trust anchor specified in <span class="command"><strong>dnssec-keys</strong></span>.
+            using the trust anchor specified in <span class="command"><strong>trust-anchors</strong></span>.
             If the DNSKEY RRset is validly signed by a key matching
             the trust anchor, then it is used as the basis for a new
             managed keys database.
@@ -8981,10 +9010,10 @@ example.com                 CNAME   rpz-tcp-only.
             From that point on, whenever <span class="command"><strong>named</strong></span> runs, it
             sees the <span class="command"><strong>initial-key</strong></span> or
             <span class="command"><strong>initial-ds</strong></span> listed in
-            <span class="command"><strong>dnssec-keys</strong></span>, checks to
+            <span class="command"><strong>trust-anchors</strong></span>, checks to
             make sure RFC 5011 key maintenance has already been initialized
             for the specified domain, and if so, it simply moves on.  The
-            key specified in the <span class="command"><strong>dnssec-keys</strong></span>
+            key specified in the <span class="command"><strong>trust-anchors</strong></span>
             statement is not used to validate answers; it is
             superseded by the key or keys stored in the managed keys
             database.
@@ -8993,7 +9022,7 @@ example.com                 CNAME   rpz-tcp-only.
             The next time <span class="command"><strong>named</strong></span> runs after an
             <span class="command"><strong>initial-key</strong></span> or <span class="command"><strong>initial-ds</strong></span>
             trust anchor has been <span class="emphasis"><em>removed</em></span> from the
-            <span class="command"><strong>dnssec-keys</strong></span> statement (or changed to
+            <span class="command"><strong>trust-anchors</strong></span> statement (or changed to
             a <span class="command"><strong>static-key</strong></span> or <span class="command"><strong>static-ds</strong></span>),
             the corresponding keys will be removed from the managed keys
             database, and RFC 5011 key maintenance will no longer be used
@@ -9045,8 +9074,8 @@ example.com                 CNAME   rpz-tcp-only.
 <a name="dnssec_policy_grammar"></a><span class="command"><strong>dnssec-policy</strong></span> Statement Grammar</h3></div></div></div>
         <pre class="programlisting">
 <span class="command"><strong>dnssec-policy</strong></span> <em class="replaceable"><code>string</code></em> {
-    <span class="command"><strong>dnskey-ttl</strong></span> <em class="replaceable"><code>ttlval</code></em>;
-    <span class="command"><strong>keys</strong></span> { ( csk | ksk | zsk ) key-directory <em class="replaceable"><code>duration</code></em> <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ] ; ... };
+    <span class="command"><strong>dnskey-ttl</strong></span> <em class="replaceable"><code>duration</code></em>;
+    <span class="command"><strong>keys</strong></span> { ( csk | ksk | zsk ) key-directory lifetime <em class="replaceable"><code>duration</code></em> algorithm <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ] ; ... };
     <span class="command"><strong>parent-ds-ttl</strong></span> <em class="replaceable"><code>duration</code></em>;
     <span class="command"><strong>parent-propagation-delay</strong></span> <em class="replaceable"><code>duration</code></em>;
     <span class="command"><strong>parent-registration-delay</strong></span> <em class="replaceable"><code>duration</code></em>;
@@ -9136,8 +9165,8 @@ example.com                 CNAME   rpz-tcp-only.
                 <p>
                   A margin that is added to the publish interval in key
                   timing equations to give some extra time to cover
-                  unforeseen events.  Default is <code class="constant">PT5M</code>
-                  (5 minutes).
+                  unforeseen events.  Default is <code class="constant">PT1H</code>
+                  (1 hour).
                 </p>
               </dd>
 <dt><span class="term"><span class="command"><strong>retire-safety</strong></span></span></dt>
@@ -9145,8 +9174,8 @@ example.com                 CNAME   rpz-tcp-only.
                 <p>
                   A margin that is added to the retire interval in key
                   timing equations to give some extra time to cover
-                  unforeseen events.  Default is <code class="constant">PT5M</code>
-                  (5 minutes).
+                  unforeseen events.  Default is <code class="constant">PT1H</code>
+                  (1 hour).
                 </p>
               </dd>
 <dt><span class="term"><span class="command"><strong>signatures-refresh</strong></span></span></dt>
@@ -9220,7 +9249,7 @@ example.com                 CNAME   rpz-tcp-only.
 <dd>
                 <p>
                   The TTL of the DS RRset that the parent uses.  Default is
-                  <code class="constant">PT1H</code> (1 hour).
+                  <code class="constant">P1D</code> (1 day).
                 </p>
               </dd>
 <dt><span class="term"><span class="command"><strong>parent-propagation-delay</strong></span></span></dt>
@@ -9261,7 +9290,7 @@ example.com                 CNAME   rpz-tcp-only.
 
           <p>
             The <span class="command"><strong>managed-keys</strong></span> statement has been
-            deprecated in favor of <a class="xref" href="Bv9ARM.ch05.html#dnssec_keys" title="dnssec-keys Statement Grammar">the section called &#8220;<span class="command"><strong>dnssec-keys</strong></span> Statement Grammar&#8221;</a>
+            deprecated in favor of <a class="xref" href="Bv9ARM.ch05.html#trust_anchors" title="trust-anchors Statement Grammar">the section called &#8220;<span class="command"><strong>trust-anchors</strong></span> Statement Grammar&#8221;</a>
             with the <span class="command"><strong>initial-key</strong></span> keyword.
           </p>
         </div>
@@ -9282,7 +9311,7 @@ example.com                 CNAME   rpz-tcp-only.
 
           <p>
             The <span class="command"><strong>trusted-keys</strong></span> statement has been
-            deprecated in favor of <a class="xref" href="Bv9ARM.ch05.html#dnssec_keys" title="dnssec-keys Statement Grammar">the section called &#8220;<span class="command"><strong>dnssec-keys</strong></span> Statement Grammar&#8221;</a>
+            deprecated in favor of <a class="xref" href="Bv9ARM.ch05.html#trust_anchors" title="trust-anchors Statement Grammar">the section called &#8220;<span class="command"><strong>trust-anchors</strong></span> Statement Grammar&#8221;</a>
             with the <span class="command"><strong>static-key</strong></span> keyword.
           </p>
         </div>
@@ -9919,7 +9948,7 @@ view "external" {
                         (KSK) for the zone must be configured as a trust
                         anchor in <code class="filename">named.conf</code>: that
                         is, a key for the zone must be specified in
-                        <span class="command"><strong>dnssec-keys</strong></span>.  In the case
+                        <span class="command"><strong>trust-anchors</strong></span>.  In the case
                         of the root zone, you may also rely on the
                         built-in root trust anchor, which is enabled
                         when <a class="xref" href="Bv9ARM.ch05.html#dnssec_validation"><span class="command"><strong>dnssec-validation</strong></span></a> is set to the
@@ -10338,9 +10367,13 @@ view "external" {
 <dt><span class="term"><span class="command"><strong>dnssec-policy</strong></span></span></dt>
 <dd>
                   <p>
-                    The key and signing policy for this zone.  Set to
-                    <strong class="userinput"><code>"default"</code></strong> if you want to make use
-                    of the default policy.
+                    The key and signing policy for this zone.  This is a string
+                    referring to a <span class="command"><strong>dnssec-policy</strong></span> statement.
+                    There are two built-in policies:
+                    <strong class="userinput"><code>"default"</code></strong> allows you to use the
+                    default policy, and <strong class="userinput"><code>"none"</code></strong> means
+                    not to use any DNSSEC policy, keeping the zone unsigned.
+                    The default is <strong class="userinput"><code>"none"</code></strong>.
                   </p>
                 </dd>
 <dt><span class="term"><span class="command"><strong>dnssec-update-mode</strong></span></span></dt>
@@ -15188,6 +15221,6 @@ HOST-127.EXAMPLE. MX 0 .
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch06.html

@@ -360,6 +360,6 @@ allow-query { !{ !10/8; any; }; key example; };
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch07.html

@@ -191,6 +191,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch08.html

@@ -36,12 +36,13 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl class="toc">
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.6</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.7</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_platforms">Supported Platforms</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.7">Notes for BIND 9.15.7</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.6">Notes for BIND 9.15.6</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.5">Notes for BIND 9.15.5</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.4">Notes for BIND 9.15.4</a></span></dt>
@@ -57,7 +58,7 @@
 </div>
       <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.9.2"></a>Release Notes for BIND Version 9.15.6</h2></div></div></div>
+<a name="id-1.9.2"></a>Release Notes for BIND Version 9.15.7</h2></div></div></div>
   
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
@@ -101,11 +102,12 @@
     C compiler.
   </p>
   <p>
-    The OpenSSL cryptography library must be available for the target
-    platform.  A PKCS#11 provider can be used instead for Public Key
-    cryptography (i.e., DNSSEC signing and validation), but OpenSSL is
-    still required for general cryptography operations such as hashing
-    and random number generation.
+    The <code class="filename">libuv</code> asynchronous I/O library and the
+    OpenSSL cryptography library must be available for the target
+    platform.  A PKCS#11 provider can be used instead of OpenSSL for
+    Public Key cryptography (i.e., DNSSEC signing and validation),
+    but OpenSSL is still required for general cryptography operations
+    such as hashing and random number generation.
   </p>
   <p>
     More information can be found in the <code class="filename">PLATFORMS.md</code>
@@ -130,10 +132,73 @@
 
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
+<a name="relnotes-9.15.7"></a>Notes for BIND 9.15.7</h3></div></div></div>
+
+  <div class="section">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.15.7-changes"></a>Feature Changes</h4></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+        <p>
+          The <span class="command"><strong>dnssec-keys</strong></span> configuration statement,
+          which was introduced in 9.15.1 and revised in 9.15.6, has now
+          been renamed to the more descriptive
+          <span class="command"><strong>trust-anchors</strong></span>. [GL !2702]
+        </p>
+        <p>
+          (See release notes for
+          <a class="xref" href="Bv9ARM.ch08.html#relnotes-9.15.1-new" title="New Features">BIND 9.15.1</a>
+          and
+          <a class="xref" href="Bv9ARM.ch08.html#relnotes-9.15.6-new" title="New Features">BIND 9.15.6</a>
+          for prior discussion of this feature.)
+        </p>
+      </li>
+<li class="listitem">
+        <p>
+          Added support for multithreaded listening for TCP connections
+	  in the network manager [GL !2659]
+        </p>
+      </li>
+</ul></div>
+  </div>
+
+  <div class="section">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.15.7-bugs"></a>Bug Fixes</h4></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+        <p>
+          Fixed a bug that caused <span class="command"><strong>named</strong></span> to leak memory
+          on reconfiguration when any GeoIP2 database was in use. [GL #1445]
+        </p>
+      </li>
+<li class="listitem">
+        <p>
+          Fixed several possible race conditions discovered by Thread
+          Sanitizer.
+        </p>
+      </li>
+</ul></div>
+  </div>
+
+</div>
+  <div class="section">
+<div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes-9.15.6"></a>Notes for BIND 9.15.6</h3></div></div></div>
 
   <div class="section">
 <div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.15.6-security"></a>Security Fixes</h4></div></div></div>
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+        <p>
+          Set a limit on the number of concurrently served pipelined TCP
+          queries. This flaw is disclosed in CVE-2019-6477. [GL #1264]
+        </p>
+      </li></ul></div>
+  </div>
+
+  <div class="section">
+<div class="titlepage"><div><div><h4 class="title">
 <a name="relnotes-9.15.6-new"></a>New Features</h4></div></div></div>
     <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem">
@@ -157,25 +222,32 @@
         </p>
       </li>
 <li class="listitem">
-	<p>
-	  Two new keywords have been added to the
-	  <span class="command"><strong>dnssec-keys</strong></span> statement:
-	  <span class="command"><strong>initial-ds</strong></span> and <span class="command"><strong>static-ds</strong></span>.
-	  These allow the use of trust anchors in DS format instead of
-	  DNSKEY format.  DS format allows trust anchors to be configured
-	  for keys that have not yet been published; this is the format
-	  used by IANA when announcing future root keys.
-	</p>
-	<p>
-	  As with the <span class="command"><strong>initial-key</strong></span> and
-	  <span class="command"><strong>static-key</strong></span> keywords, <span class="command"><strong>initial-ds</strong></span>
-	  configures a dynamic trust anchor to be maintained via RFC 5011, and
-	  <span class="command"><strong>static-ds</strong></span> configures a permanent trust anchor.
-	</p>
-	<p>
-	  (Note: Currently, DNSKEY-format and DS-format trust anchors
-	  cannot both be used for the same domain name.) [GL #6] [GL #622]
-	</p>
+        <p>
+          Two new keywords have been added to the
+          <span class="command"><strong>dnssec-keys</strong></span> statement:
+          <span class="command"><strong>initial-ds</strong></span> and <span class="command"><strong>static-ds</strong></span>.
+          These allow the use of trust anchors in DS format instead of
+          DNSKEY format.  DS format allows trust anchors to be configured
+          for keys that have not yet been published; this is the format
+          used by IANA when announcing future root keys.
+        </p>
+        <p>
+          As with the <span class="command"><strong>initial-key</strong></span> and
+          <span class="command"><strong>static-key</strong></span> keywords, <span class="command"><strong>initial-ds</strong></span>
+          configures a dynamic trust anchor to be maintained via RFC 5011, and
+          <span class="command"><strong>static-ds</strong></span> configures a permanent trust anchor.
+        </p>
+        <p>
+          (Note: Currently, DNSKEY-format and DS-format trust anchors
+          cannot both be used for the same domain name.) [GL #6] [GL #622]
+        </p>
+      </li>
+<li class="listitem">
+        <p>
+          Added a new statistics variable <span class="command"><strong>tcp-highwater</strong></span>
+          that reports the maximum number of simultaneous TCP clients BIND
+          has handled while running. [GL #1206]
+        </p>
       </li>
 </ul></div>
   </div>
@@ -193,27 +265,14 @@
         </p>
       </li>
 <li class="listitem">
-	<p>
-	  The DNSSEC validation code has been refactored for clarity and to
-	  reduce code duplication.  [GL #622]
-	</p>
+        <p>
+          The DNSSEC validation code has been refactored for clarity and to
+          reduce code duplication.  [GL #622]
+        </p>
       </li>
 </ul></div>
   </div>
 
-  <div class="section">
-<div class="titlepage"><div><div><h4 class="title">
-<a name="relnotes-9.15.6-security"></a>Security Fixes</h4></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
-	<p>
-	  Too many simultaneous pipelined TCP queries could cause
-	  resource overuse. We now prevent this by enforcing a limit
-	  on the number of simultaneous requests per active connection.
-	  This flaw`is disclosed in CVE-2019-6477. [GL #1264]
-	</p>
-      </li></ul></div>
-  </div>
-
 </div>
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
@@ -719,9 +778,6 @@
 <a name="relnotes_thanks"></a>Thank You</h3></div></div></div>
   <p>
     Thank you to everyone who assisted us in making this release possible.
-    If you would like to contribute to ISC to assist us in continuing to
-    make quality open source software, please visit our donations page at
-    <a class="link" href="https://www.isc.org/donate/" target="_top">https://www.isc.org/donate/</a>.
   </p>
 </div>
 </div>
@@ -744,6 +800,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch09.html

@@ -148,6 +148,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch10.html

@@ -914,6 +914,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch11.html

@@ -538,6 +538,6 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch12.html

@@ -210,6 +210,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Bv9ARM.html

@@ -32,7 +32,7 @@
 <div>
 <div><h1 class="title">
 <a name="id-1"></a>BIND 9 Administrator Reference Manual</h1></div>
-<div><p class="releaseinfo">BIND Version 9.15.6</p></div>
+<div><p class="releaseinfo">BIND Version 9.15.7</p></div>
 <div><p class="copyright">Copyright © 2000-2019 Internet Systems Consortium, Inc. ("ISC")</p></div>
 </div>
 <hr>
@@ -192,8 +192,8 @@
 <dt><span class="section"><a href="Bv9ARM.ch05.html#statschannels"><span class="command"><strong>statistics-channels</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#statistics_channels"><span class="command"><strong>statistics-channels</strong></span> Statement Definition and
               Usage</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_keys"><span class="command"><strong>dnssec-keys</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec-keys"><span class="command"><strong>dnssec-keys</strong></span> Statement Definition
+<dt><span class="section"><a href="Bv9ARM.ch05.html#trust_anchors"><span class="command"><strong>trust-anchors</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch05.html#trust-anchors"><span class="command"><strong>trust-anchors</strong></span> Statement Definition
             and Usage</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_policy_grammar"><span class="command"><strong>dnssec-policy</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch05.html#dnssec_policy"><span class="command"><strong>dnssec-policy</strong></span> Statement Definition
@@ -248,12 +248,13 @@
 </dl></dd>
 <dt><span class="appendix"><a href="Bv9ARM.ch08.html">A. Release Notes</a></span></dt>
 <dd><dl>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.6</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.15.7</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_platforms">Supported Platforms</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.7">Notes for BIND 9.15.7</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.6">Notes for BIND 9.15.6</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.5">Notes for BIND 9.15.5</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes-9.15.4">Notes for BIND 9.15.4</a></span></dt>
@@ -448,6 +449,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/Makefile.in

@@ -54,10 +54,16 @@ notes.pdf: notes-wrapper.xml ${NOTESXML} releaseinfo.xml pkgversion.xml notevers
 	${XSLTPROC} ${top_srcdir}/doc/xsl/pre-latex.xsl notes-wrapper.xml | \
 	${DBLATEX} -c notes.conf -Pdoc.layout="mainmatter" -o notes.pdf -
 
+# Produce notes.txt from notes.html using w3m, with some post-processing:
+#
+#  - remove trailing spaces from every line,
+#  - remove empty lines from the end of the document,
+#  - prevent GitLab issue/MR identifiers from being split across two lines.
 notes.txt: notes.html
 	${W3M} -dump -cols 75 -O ascii -T text/html < notes.html | \
 		sed 's/  *$$//' | \
-		sed -e :a -e '/^\n*$$/{$$d;N;};/\n$$/ba' > notes.txt
+		sed -e :a -e '/^\n*$$/{$$d;N;};/\n$$/ba' | \
+		sed '/ [!#]$$/{N;s| \([!#]\)\(\n\s*\)\([0-9][0-9]*\)|\2\1\3|;};' > notes.txt
 
 # use xmllint to process include
 Bv9ARM.html: Bv9ARM-book.xml ${NOTESXML} releaseinfo.xml pkgversion.xml noteversion.xml

doc/arm/man.arpaname.html

@@ -90,6 +90,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.ddns-confgen.html

@@ -220,6 +220,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.delv.html

@@ -215,7 +215,7 @@
 	  </p>
 	  <p>
 	    Note: When reading the trust anchor file,
-	    <span class="command"><strong>delv</strong></span> treats <code class="option">dnssec-keys</code>
+	    <span class="command"><strong>delv</strong></span> treats <code class="option">trust-anchors</code>
 	    <code class="option">initial-key</code> and <code class="option">static-key</code>
 	    entries identically.  That is, even if a key is configured
 	    with <span class="command"><strong>initial-key</strong></span>, indicating that it is
@@ -621,6 +621,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dig.html

@@ -1188,6 +1188,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-cds.html

@@ -376,6 +376,6 @@ nsupdate -l
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-checkds.html

@@ -156,6 +156,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-coverage.html

@@ -270,6 +270,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-dsfromkey.html

@@ -341,6 +341,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-importkey.html

@@ -250,6 +250,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-keyfromlabel.html

@@ -498,6 +498,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-keygen.html

@@ -589,6 +589,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-keymgr.html

@@ -405,6 +405,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-revoke.html

@@ -171,6 +171,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-settime.html

@@ -424,6 +424,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-signzone.html

@@ -707,6 +707,6 @@ db.example.com.signed
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnssec-verify.html

@@ -214,6 +214,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.dnstap-read.html

@@ -143,6 +143,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.filter-aaaa.html

@@ -168,6 +168,6 @@ plugin query "/usr/local/lib/filter-aaaa.so" {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>

doc/arm/man.host.html

@@ -366,6 +366,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.6 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.15.7 (Development Release)</p>
 </body>
 </html>