xxx

2020-01-15 12:16:03 +01:00
280 changed files with 1720 additions and 3048 deletions
@@ -60,7 +60,7 @@ stages:

 .openbsd-amd64: &openbsd_amd64
  tags:
-    - libvirt
+    - openbsd
    - amd64

 ### Docker Image Templates
@@ -176,7 +176,7 @@ stages:
      - configure
      - ltmain.sh
      - m4/libtool.m4
-    expire_in: "1 day"
+    expire_in: "1 week"

 .configure: &configure |
    ${CONFIGURE} \
@@ -208,7 +208,7 @@ stages:
    - autoreconf:sid:amd64
  artifacts:
    untracked: true
-    expire_in: "1 day"
+    expire_in: "1 week"

 .windows_build: &windows_build_job
  stage: build
@@ -238,7 +238,7 @@ stages:
    - autoreconf:sid:amd64
  artifacts:
    untracked: true
-    expire_in: "1 day"
+    expire_in: "1 week"

 .setup_interfaces: &setup_interfaces |
    if [ "$(id -u)" -eq "0" ]; then
@@ -261,7 +261,7 @@ stages:
    - test -s bin/tests/system/systests.output
  artifacts:
    untracked: true
-    expire_in: "1 day"
+    expire_in: "1 week"
    when: on_failure

 .kyua_report: &kyua_report_html |
@@ -288,7 +288,7 @@ stages:
    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
  artifacts:
    untracked: true
-    expire_in: "1 day"
+    expire_in: "1 week"
    when: on_failure
  only:
    - schedules
@@ -309,7 +309,7 @@ stages:
      - kyua.log
      - kyua.results
      - kyua_html/
-    expire_in: "1 day"
+    expire_in: "1 week"
    when: on_failure

 .cppcheck_args: &run_cppcheck |
@@ -347,7 +347,7 @@ stages:
      - compile_commands.json
      - cppcheck.results
      - cppcheck_html/
-    expire_in: "1 day"
+    expire_in: "1 week"
    when: on_failure

 ### Job Definitions
@@ -364,11 +364,8 @@ misc:sid:amd64:
    - sh util/checklibs.sh > checklibs.out
    - sh util/tabify-changes < CHANGES > CHANGES.tmp
    - diff -urNap CHANGES CHANGES.tmp
-    - perl util/check-changes CHANGES
-    - test ! -f CHANGES.SE || sh util/tabify-changes < CHANGES.SE > CHANGES.tmp
-    - test ! -f CHANGES.SE || diff -urNap CHANGES.SE CHANGES.tmp
-    - test ! -f CHANGES.SE || perl util/check-changes master=0 CHANGES.SE
    - rm CHANGES.tmp
+    - perl util/check-changes CHANGES
    - perl -w util/merge_copyrights
    - diff -urNap util/copyrights util/newcopyrights
    - rm util/newcopyrights
@@ -381,7 +378,7 @@ misc:sid:amd64:
    paths:
      - util/newcopyrights
      - checklibs.out
-    expire_in: "1 day"
+    expire_in: "1 week"
    when: on_failure

 🐞:sid:amd64:
@@ -425,7 +422,7 @@ docs:sid:amd64:
  artifacts:
    paths:
      - doc/arm/
-    expire_in: "1 day"
+    expire_in: "1 month"

 push:docs:sid:amd64:
  <<: *debian_sid_amd64_image
@@ -632,7 +629,7 @@ scan-build:buster:amd64:
  artifacts:
    paths:
      - scan-build.reports/
-    expire_in: "1 day"
+    expire_in: "1 week"
    when: on_failure

 # Jobs for regular GCC builds on Debian Sid (amd64)
@@ -898,7 +895,7 @@ system:tsan:buster:amd64:
  after_script:
    - find bin -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
  artifacts:
-    expire_in: "1 day"
+    expire_in: "1 week"
    paths:
      - bin/tests/system/*/tsan.*
      - bin/tests/system/*/*/tsan.*
@@ -920,7 +917,7 @@ unit:tsan:buster:amd64:
  after_script:
    - find lib -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
  artifacts:
-    expire_in: "1 day"
+    expire_in: "1 week"
    paths:
      - lib/*/tests/tsan.*
      - tsan/
@@ -1071,23 +1068,20 @@ unit:clang:freebsd12.0:amd64:
    - clang:freebsd12.0:amd64
  needs: ["clang:freebsd12.0:amd64"]

-# Jobs for Clang builds on OpenBSD 6.6 (amd64)
+# Jobs for Clang builds on OpenBSD 6.5 (amd64)

-clang:openbsd6.6:amd64:
+clang:openbsd6.5:amd64:
  variables:
    CC: clang
-    USER: gitlab-runner
  <<: *openbsd_amd64
  <<: *build_job

-system:clang:openbsd6.6:amd64:
+system:clang:openbsd6.5:amd64:
  <<: *openbsd_amd64
  <<: *system_test_job
-  variables:
-    USER: gitlab-runner
  dependencies:
-    - clang:openbsd6.6:amd64
-  needs: ["clang:openbsd6.6:amd64"]
+    - clang:openbsd6.5:amd64
+  needs: ["clang:openbsd6.5:amd64"]
  only:
    - schedules
    - tags
@@ -1190,4 +1184,4 @@ release:sid:amd64:
  artifacts:
    paths:
      - "*.tar.gz"
-    expire_in: "1 day"
+    expire_in: "1 week"
@@ -1,47 +1,13 @@
-5354.	[bug]		dnssec-policy created new KSK keys when zone is in
-			initial stage of signing (the DS is not yet in
-			rumoured or omnipresent state).  Fix by checking
-			key goals rather than active state when determining
-			new keys are needed. [GL #1593]
-
-5353.	[doc]		Document port and dscp parameters in forwarders
-			configuration option. [GL !914]
-
-5352.	[bug]		Correctly handle catalog zone entries containing
-			characters that aren't legal in filenames. [GL #1592]
-
-5351.	[bug]		CDS / CDNSKEY consistency checks failed to handle
-			removal records. [GL #1554]
-
-5350.	[bug]		When a view was configured with class CHAOS, the
-			server could crash while processing a query for a
-			non-existent record. [GL #1540]
-
-5349.	[bug]		Fix a race in task_pause/unpause. [GL #1571]
-
-5348.	[bug]		dnssec-settime -Psync was not being honoured.
-			[GL !2893]
-
-	--- 9.15.8 released ---
-
-5347.	[bug]		Fixed a bug that could cause an intermittent crash
-			in validator.c when validating a negative cache
-			entry. [GL #1561]
-
-5346.	[bug]		Make hazard pointer array allocations dynamic, fixing
-			a bug that caused named to crash on machines with more
-			than 40 cores. [GL #1493]
-
 5345.	[func]		Key-style trust anchors and DS-style trust anchors
-			can now both be used for the same name. [GL #1237]
+			can now both be used for the same name. [GL !2892]

 5344.	[bug]		Handle accept() errors properly in netmgr. [GL !2880]

 5343.	[func]		Add statistics counters to the netmgr. [GL #1311]

-5342.	[bug]		Disable pktinfo for IPv6 and bind to each interface
-			explicitly instead, because libuv doesn't support
-			pktinfo control messages. [GL #1558]
+5342.	[bug]		Disable pktinfo for ipv6 - bind to all interfaces
+			explicitly as libuv doesn't pass us pktinfo structure,
+			[GL #1558]

 5341.	[func]		Simplify passing the bound TCP socket to child
 			threads by using isc_uv_export/import functions.
@@ -150,7 +150,7 @@ releases.  New features include:
 - "rndc modzone" reconfigures a single zone, without requiring the entire
  server to be reconfigured.
 - "rndc showzone" displays the current configuration of a zone.
- "rndc managed-keys" can be used to check the status of RFC 5011 managed
+- "rndc managed-keys" can be used to check the status of RFC 5001 managed
  trust anchors, or to force trust anchors to be refreshed.
 - "max-cache-size" can now be set to a percentage of available memory. The
  default is 90%.
@@ -34,7 +34,7 @@ offer support on a "best effort" basis for some.

 Regularly tested platforms

-As of Feb 2020, BIND 9.15 is fully supported and regularly tested on the
+As of Dec 2019, BIND 9.15 is fully supported and regularly tested on the
 following systems:

  * Debian 9, 10
@@ -42,7 +42,7 @@ following systems:
  * Fedora 31
  * Red Hat Enterprise Linux / CentOS 7, 8
  * FreeBSD 11.3, 12.0
-  * OpenBSD 6.6
+  * OpenBSD 6.5
  * Alpine Linux

 The amd64, i386, armhf and arm64 CPU architectures are all fully
@@ -42,7 +42,7 @@ offer support on a "best effort" basis for some.

 ### Regularly tested platforms

-As of Feb 2020, BIND 9.15 is fully supported and regularly tested on the
+As of Dec 2019, BIND 9.15 is fully supported and regularly tested on the
 following systems:

 * Debian 9, 10
@@ -50,7 +50,7 @@ following systems:
 * Fedora 31
 * Red Hat Enterprise Linux / CentOS 7, 8
 * FreeBSD 11.3, 12.0
-* OpenBSD 6.6
+* OpenBSD 6.5
 * Alpine Linux

 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
@@ -111,10 +111,10 @@ BIND 9.15 features
 BIND 9.15 is the newest development branch of BIND 9. It includes a number
 of changes from BIND 9.14 and earlier releases. New features include:

-  * New dnssec-policy statement to configure a key and signing policy for
-    zones, enabling automatic key regeneration and rollover.
-  * New network manager based on libuv.
-  * Added support for the new GeoIP2 geolocation API, libmaxminddb.
+  * New "dnssec-policy" statement to configure a key and signing policy
+    for zones, enabling automatic key regeneration and rollover.
+  * New new network manager based on libuv.
+  * Support for the new GeoIP2 geolocation API
  * Improved DNSSEC trust anchor configuration using the trust-anchors
    statement, permitting configuration of trust anchors in DS as well as
    DNSKEY format.
@@ -136,8 +136,8 @@ including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE, Slackware,
 Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE,
 HP-UX, and OpenWRT.

-BIND is also available for Windows Server 2012 R2 and higher. See
-win32utils/build.txt for details on building for Windows systems.
+BIND is also available for Windows Server 2012 R2 and higher. See win32utils/
+build.txt for details on building for Windows systems.

 To build on a UNIX or Linux system, use:

@@ -127,10 +127,10 @@ BIND 9.15 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.14 and earlier releases. New features
 include:

-* New `dnssec-policy` statement to configure a key and signing policy
+* New "dnssec-policy" statement to configure a key and signing policy
  for zones, enabling automatic key regeneration and rollover.
-* New network manager based on libuv.
-* Added support for the new GeoIP2 geolocation API, `libmaxminddb`.
+* New new network manager based on libuv.
+* Support for the new GeoIP2 geolocation API
 * Improved DNSSEC trust anchor configuration using the `trust-anchors`
  statement, permitting configuration of trust anchors in DS as well as
  DNSKEY format.
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -148,5 +148,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -325,5 +325,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -144,5 +144,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -206,5 +206,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -433,5 +433,5 @@ RFC5155\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -849,5 +849,5 @@ There are probably too many query options\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -568,7 +568,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
 	if (!query->lookup->comments)
 		flags |= DNS_MESSAGETEXTFLAG_NOCOMMENTS;

-	isc_buffer_allocate(mctx, &buf, len);
+	result = isc_buffer_allocate(mctx, &buf, len);
+	check_result(result, "isc_buffer_allocate");

 	if (yaml) {
 		enum { Q = 0x1, R = 0x2 }; /* Q:query; R:ecursive */
@@ -741,8 +742,11 @@ repopulate_buffer:
 buftoosmall:
 			len += OUTPUTBUF;
 			isc_buffer_free(&buf);
-			isc_buffer_allocate(mctx, &buf, len);
-			goto repopulate_buffer;
+			result = isc_buffer_allocate(mctx, &buf, len);
+			if (result == ISC_R_SUCCESS)
+				goto repopulate_buffer;
+			else
+				goto cleanup;
 		}
 		check_result(result,
 		     "dns_message_pseudosectiontotext");
@@ -823,6 +827,7 @@ buftoosmall:
 	       (char *)isc_buffer_base(buf));
 	isc_buffer_free(&buf);

+cleanup:
 	if (style != NULL)
 		dns_master_styledestroy(&style, mctx);
 	return (result);
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -883,8 +883,10 @@ setup_text_key(void) {
 	unsigned char *secretstore;

 	debug("setup_text_key()");
-	isc_buffer_allocate(mctx, &namebuf, MXNAME);
+	result = isc_buffer_allocate(mctx, &namebuf, MXNAME);
+	check_result(result, "isc_buffer_allocate");
 	dns_name_init(&keyname, NULL);
+	check_result(result, "dns_name_init");
 	isc_buffer_putstr(namebuf, keynametext);
 	secretsize = (unsigned int) strlen(keysecret) * 3 / 4;
 	secretstore = isc_mem_allocate(mctx, secretsize);
@@ -1394,7 +1396,8 @@ setup_libs(void) {
 	check_result(result, "dst_lib_init");
 	is_dst_up = true;

-	isc_mempool_create(mctx, COMMSIZE, &commctx);
+	result = isc_mempool_create(mctx, COMMSIZE, &commctx);
+	check_result(result, "isc_mempool_create");
 	isc_mempool_setname(commctx, "COMMPOOL");
 	/*
 	 * 6 and 2 set as reasonable parameters for 3 or 4 nameserver
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -269,5 +269,5 @@ runs\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -199,7 +199,8 @@ say_message(dns_name_t *name, const char *msg, dns_rdata_t *rdata,

 	dns_name_format(name, namestr, sizeof(namestr));
 retry:
-	isc_buffer_allocate(mctx, &b, bufsize);
+	result = isc_buffer_allocate(mctx, &b, bufsize);
+	check_result(result, "isc_buffer_allocate");
 	result = dns_rdata_totext(rdata, NULL, b);
 	if (result == ISC_R_NOSPACE) {
 		isc_buffer_free(&b);
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -301,5 +301,5 @@ runs or when the standard output is not a tty\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -221,7 +221,9 @@ printrdata(dns_rdata_t *rdata) {
 		printf("rdata_%d = ", rdata->type);

 	while (!done) {
-		isc_buffer_allocate(mctx, &b, size);
+		result = isc_buffer_allocate(mctx, &b, size);
+		if (result != ISC_R_SUCCESS)
+			check_result(result, "isc_buffer_allocate");
 		result = dns_rdata_totext(rdata, NULL, b);
 		if (result == ISC_R_SUCCESS) {
 			printf("%.*s\n", (int)isc_buffer_usedlength(b),
@@ -308,7 +308,7 @@ nslookup -query=hinfo  -timeout=10
                    The class specifies the protocol group of the information.

                  </para>
-                  <para>
+		  <para>
                    (Default = IN; abbreviation = cl)
                  </para>
                </listitem>
@@ -318,10 +318,10 @@ nslookup -query=hinfo  -timeout=10
                <term><constant><replaceable><optional>no</optional></replaceable>debug</constant></term>
                <listitem>
                  <para>
-                    Turn on or off the display of the full response packet and
-                    any intermediate response packets when searching.
+		    Turn on or off the display of the full response packet and
+		    any intermediate response packets when searching.
                  </para>
-                  <para>
+		  <para>
                    (Default = nodebug; abbreviation = <optional>no</optional>deb)
                  </para>
                </listitem>
@@ -332,9 +332,9 @@ nslookup -query=hinfo  -timeout=10
                <listitem>
                  <para>
                    Turn debugging mode on or off.  This displays more about
-                    what nslookup is doing.
+	            what nslookup is doing.
                  </para>
-                  <para>
+		  <para>
                    (Default = nod2)
                  </para>
                </listitem>
@@ -358,7 +358,7 @@ nslookup -query=hinfo  -timeout=10
                    names in the domain search list to the request until an
                    answer is received.
                  </para>
-                  <para>
+		  <para>
                    (Default = search)
                  </para>
                </listitem>
@@ -370,7 +370,7 @@ nslookup -query=hinfo  -timeout=10
                  <para>
                    Change the default TCP/UDP name server port to <replaceable>value</replaceable>.
                  </para>
-                  <para>
+		  <para>
                    (Default = 53; abbreviation = po)
                  </para>
                </listitem>
@@ -389,15 +389,9 @@ nslookup -query=hinfo  -timeout=10
                  <para>
                    Change the type of the information query.
                  </para>
-                  <para>
-                    (Default = A and then AAAA; abbreviations = q, ty)
+		  <para>
+                    (Default = A; abbreviations = q, ty)
                  </para>
-                    <para>
-                      <emphasis role="bold">Note:</emphasis> It is
-                      only possible to specify one query type, only
-                      the default behavior looks up both when an
-                      alternative is not specified.
-                    </para>
                </listitem>
              </varlistentry>

@@ -409,7 +403,7 @@ nslookup -query=hinfo  -timeout=10
                    have the
                    information.
                  </para>
-                  <para>
+		  <para>
                    (Default = recurse; abbreviation = [no]rec)
                  </para>
                </listitem>
@@ -419,9 +413,9 @@ nslookup -query=hinfo  -timeout=10
                <term><constant>ndots=</constant><replaceable>number</replaceable></term>
                <listitem>
                  <para>
-                    Set the number of dots (label separators) in a domain
-                    that will disable searching.  Absolute names always
-                    stop searching.
+		    Set the number of dots (label separators) in a domain
+		    that will disable searching.  Absolute names always
+		    stop searching.
                  </para>
                </listitem>
              </varlistentry>
@@ -452,7 +446,7 @@ nslookup -query=hinfo  -timeout=10
                    Always use a virtual circuit when sending requests to the
                    server.
                  </para>
-                  <para>
+		  <para>
                    (Default = novc)
                  </para>
                </listitem>
@@ -462,15 +456,15 @@ nslookup -query=hinfo  -timeout=10
                <term><constant><replaceable><optional>no</optional></replaceable>fail</constant></term>
                <listitem>
                  <para>
-                    Try the next nameserver if a nameserver responds with
-                    SERVFAIL or a referral (nofail) or terminate query
-                    (fail) on such a response.
-                  </para>
-                  <para>
+		    Try the next nameserver if a nameserver responds with
+		    SERVFAIL or a referral (nofail) or terminate query
+		    (fail) on such a response.
+		  </para>
+		  <para>
                    (Default = nofail)
                  </para>
-                </listitem>
-              </varlistentry>
+	        </listitem>
+	      </varlistentry>

            </variablelist>
          </para>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2017-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -293,5 +293,5 @@ RFC 7344\&.
 .RE
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2017-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2017-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -370,7 +370,8 @@ formatset(dns_rdataset_t *rdataset) {
 					mctx);
 	check_result(result, "dns_master_stylecreate2 failed");

-	isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
+	result = isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
+	check_result(result, "printing DS records");
 	result = dns_master_rdatasettotext(name, rdataset, style, NULL, buf);

 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
@@ -833,7 +834,8 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata,
 		result = dns_rdatalist_tordataset(dslist, &new_ds_set);
 		check_result(result, "dns_rdatalist_tordataset(dslist)");

-		isc_buffer_allocate(mctx, &new_ds_buf, size);
+		result = isc_buffer_allocate(mctx, &new_ds_buf, size);
+		check_result(result, "building new DS records");

 		for (result = dns_rdataset_first(rdset);
 		     result == ISC_R_SUCCESS;
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2017-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -222,5 +222,5 @@ RFC 7344
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -134,5 +134,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -307,5 +307,5 @@ The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13)\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -374,5 +374,5 @@ RFC 4034\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -99,5 +99,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -251,5 +251,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -470,5 +470,5 @@ RFC 4641\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -226,7 +226,8 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {

 	dns_rdataset_init(&rds);

-	isc_buffer_allocate(mctx, &buffer, bufsize);
+	result = isc_buffer_allocate(mctx, &buffer, bufsize);
+	check_result(result, "isc_buffer_allocate");

 	for (result = dns_rdatasetiter_first(iter);
 	     result == ISC_R_SUCCESS;
@@ -252,7 +253,8 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {

 			bufsize <<= 1;
 			isc_buffer_free(&buffer);
-			isc_buffer_allocate(mctx, &buffer, bufsize);
+			result = isc_buffer_allocate(mctx, &buffer, bufsize);
+			check_result(result, "isc_buffer_allocate");
 		}
 		check_result(result, "dns_master_rdatasettotext");

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -120,5 +120,5 @@ RFC 4033\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -445,7 +445,9 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		goto cleanup_request;
 	}

-	isc_buffer_allocate(listener->mctx, &text, 2 * 2048);
+	result = isc_buffer_allocate(listener->mctx, &text, 2 * 2048);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup_request;

 	/*
 	 * Establish nonce.
@@ -491,7 +493,10 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		goto cleanup_response;

 	if (conn->buffer == NULL) {
-		isc_buffer_allocate(listener->mctx, &conn->buffer, 2 * 2048);
+		result = isc_buffer_allocate(listener->mctx,
+					     &conn->buffer, 2 * 2048);
+		if (result != ISC_R_SUCCESS)
+			goto cleanup_response;
 	}

 	isc_buffer_clear(conn->buffer);
@@ -23,7 +23,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/hp.h>
 #include <isc/httpd.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
@@ -141,6 +140,7 @@ static bool nonearest = false;
 static bool nosoa = false;
 static bool notcp = false;
 static bool sigvalinsecs = false;
+static unsigned int delay = 0;

 /*
 * -4 and -6
@@ -637,10 +637,14 @@ parse_T_opt(char *option) {
 	/*
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
+	 * delay=xxxx: delay client responses by xxxx ms to
+	 *	       simulate remote servers.
 	 * dscp=x:     check that dscp values are as
 	 * 	       expected and assert otherwise.
 	 */
-	if (!strcmp(option, "dropedns")) {
+	if (!strncmp(option, "delay=", 6)) {
+		delay = atoi(option + 6);
+	} else if (!strcmp(option, "dropedns")) {
 		dropedns = true;
 	} else if (!strncmp(option, "dscp=", 5)) {
 		isc_dscp_check_value = atoi(option + 5);
@@ -903,12 +907,6 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface",
 		      named_g_udpdisp, named_g_udpdisp == 1 ? "" : "s");

-	/*
-	 * We have ncpus network threads, ncpus worker threads, ncpus
-	 * old network threads - make it 4x just to be safe. The memory
-	 * impact is neglible.
-	 */
-	isc_hp_init(4*named_g_cpus);
 	named_g_nm = isc_nm_start(named_g_mctx, named_g_cpus);
 	if (named_g_nm == NULL) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
@@ -1313,6 +1311,8 @@ setup(void) {
 		ns_server_setoption(sctx, NS_SERVER_NOTCP, true);
 	if (sigvalinsecs)
 		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);
+
+	named_g_server->sctx->delay = delay;
 }

 static void
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -378,5 +378,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1107,5 +1107,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1344,7 +1344,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		break;
 	}
 	if (isc_sockaddr_getport(&sa) == 0) {
-//		attrs |= DNS_DISPATCHATTR_EXCLUSIVE;
+		attrs |= DNS_DISPATCHATTR_EXCLUSIVE;
 		maxdispatchbuffers = EXCLBUFFERS;
 	} else {
 		INSIST(obj != NULL);
@@ -7694,7 +7694,9 @@ data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data,
 	REQUIRE(zoneconfig != NULL && *zoneconfig == NULL);

 	if (*text == NULL) {
-		isc_buffer_allocate(view->mctx, text, 256);
+		result = isc_buffer_allocate(view->mctx, text, 256);
+		if (result != ISC_R_SUCCESS)
+			goto cleanup;
 	} else {
 		isc_buffer_clear(*text);
 	}
@@ -9544,7 +9546,7 @@ run_server(isc_task_t *task, isc_event_t *event) {
 					  named_g_nm,
 					  named_g_dispatchmgr,
 					  server->task, named_g_udpdisp, geoip,
-					  named_g_cpus, &server->interfacemgr),
+					  &server->interfacemgr),
 		   "creating interface manager");

 	CHECKFATAL(isc_timer_create(named_g_timermgr, isc_timertype_inactive,
@@ -10065,7 +10067,8 @@ named_add_reserved_dispatch(named_server_t *server,
 	return;

 cleanup:
-	isc_mem_put(server->mctx, dispatch, sizeof(*dispatch));
+	if (dispatch != NULL)
+		isc_mem_put(server->mctx, dispatch, sizeof(*dispatch));
 	isc_sockaddr_format(addr, addrbuf, sizeof(addrbuf));
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
@@ -11027,7 +11030,8 @@ named_server_dumpdb(named_server_t *server, isc_lex_t *lex,
 	return (ISC_R_SUCCESS);

 cleanup:
-	dumpcontext_destroy(dctx);
+	if (dctx != NULL)
+		dumpcontext_destroy(dctx);
 	return (result);
 }

@@ -12390,7 +12394,17 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 		/* We're creating or overwriting the zone */
 		const cfg_obj_t *zoptions;

-		isc_buffer_allocate(view->mctx, &text, 256);
+		result = isc_buffer_allocate(view->mctx, &text, 256);
+		if (result != ISC_R_SUCCESS) {
+			isc_log_write(named_g_lctx,
+				      NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER,
+				      ISC_LOG_ERROR,
+				      "Unable to allocate buffer in "
+				      "nzd_save(): %s",
+				      isc_result_totext(result));
+			goto cleanup;
+		}

 		zoptions = cfg_tuple_get(zconfig, "options");
 		if (zoptions == NULL) {
@@ -12415,7 +12429,7 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 				      ISC_LOG_ERROR,
 				      "Error writing zone config to "
 				      "buffer in nzd_save(): %s",
-				      isc_result_totext(dzarg.result));
+				      isc_result_totext(result));
 			result = dzarg.result;
 			goto cleanup;
 		}
@@ -12747,7 +12761,7 @@ migrate_nzf(dns_view_t *view) {

 	CHECK(nzd_open(view, 0, &txn, &dbi));

-	isc_buffer_allocate(view->mctx, &text, 256);
+	CHECK(isc_buffer_allocate(view->mctx, &text, 256));

 	for (element = cfg_list_first(zonelist);
 	     element != NULL;
@@ -13833,6 +13847,10 @@ named_server_delzone(named_server_t *server, isc_lex_t *lex,
 		dns_zone_detach(&raw);
 	if (zone != NULL)
 		dns_zone_detach(&zone);
+	if (dz != NULL) {
+		dns_zone_detach(&dz->zone);
+		isc_mem_put(named_g_mctx, dz, sizeof(*dz));
+	}

 	return (result);
 }
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -519,5 +519,5 @@ The TSIG key is redundantly stored in two separate files\&. This is a consequenc
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1238,7 +1238,8 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {

 	result = dns_message_gettempname(msg, namep);
 	check_result(result, "dns_message_gettempname");
-	isc_buffer_allocate(gmctx, &namebuf, DNS_NAME_MAXWIRE);
+	result = isc_buffer_allocate(gmctx, &namebuf, DNS_NAME_MAXWIRE);
+	check_result(result, "isc_buffer_allocate");
 	dns_name_init(*namep, NULL);
 	dns_name_setbuffer(*namep, namebuf);
 	dns_message_takebuffer(msg, &namebuf);
@@ -1283,14 +1284,16 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 		isc_buffer_add(&source, strlen(cmdline));
 		result = isc_lex_openbuffer(lex, &source);
 		check_result(result, "isc_lex_openbuffer");
-		isc_buffer_allocate(gmctx, &buf, MAXWIRE);
+		result = isc_buffer_allocate(gmctx, &buf, MAXWIRE);
+		check_result(result, "isc_buffer_allocate");
 		result = dns_rdata_fromtext(NULL, rdataclass, rdatatype, lex,
 					    dns_rootname, 0, gmctx, buf,
 					    &callbacks);
 		isc_lex_destroy(&lex);
 		if (result == ISC_R_SUCCESS) {
 			isc_buffer_usedregion(buf, &r);
-			isc_buffer_allocate(gmctx, &newbuf, r.length);
+			result = isc_buffer_allocate(gmctx, &newbuf, r.length);
+			check_result(result, "isc_buffer_allocate");
 			isc_buffer_putmem(newbuf, r.base, r.length);
 			isc_buffer_usedregion(newbuf, &r);
 			dns_rdata_fromregion(rdata, rdataclass, rdatatype, &r);
@@ -2038,7 +2041,8 @@ show_message(FILE *stream, dns_message_t *msg, const char *description) {
 		}
 		if (buf != NULL)
 			isc_buffer_free(&buf);
-		isc_buffer_allocate(gmctx, &buf, bufsz);
+		result = isc_buffer_allocate(gmctx, &buf, bufsz);
+		check_result(result, "isc_buffer_allocate");
 		result = dns_message_totext(msg, style, 0, buf);
 		bufsz *= 2;
 	} while (result == ISC_R_NOSPACE);
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -93,5 +93,5 @@ Specify how long to pause before carrying out key destruction\&. The default is
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -116,5 +116,5 @@ Open the session with the given PKCS#11 slot\&. The default is slot 0\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -94,5 +94,5 @@ will prompt for it\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -65,5 +65,5 @@ Make the PKCS#11 libisc initialization verbose\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -112,5 +112,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -374,8 +374,8 @@ plugin_register(const char *parameters,
 				       cfg_line, mctx, lctx, actx));
 	}

-	isc_mempool_create(mctx, sizeof(filter_data_t),
-				 &inst->datapool);
+	CHECK(isc_mempool_create(mctx, sizeof(filter_data_t),
+				 &inst->datapool));
 	CHECK(isc_ht_init(&inst->ht, mctx, 16));
 	isc_mutex_init(&inst->hlock);

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2012-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -91,5 +91,5 @@ binary\&. Used for testing\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2012-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2012-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -152,5 +152,5 @@ binary\&. Used for testing\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2016-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2016-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -294,5 +294,5 @@ Allow configuration of standby keys and use of the REVOKE bit, for keys that use
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2016-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2016-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2016-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2016-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -745,5 +745,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -965,7 +965,8 @@ main(int argc, char **argv) {

 	command = *argv;

-	isc_buffer_allocate(rndc_mctx, &databuf, 2048);
+	DO("allocate data buffer",
+	   isc_buffer_allocate(rndc_mctx, &databuf, 2048));

 	/*
 	 * Convert argc/argv into a space-delimited command string
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -230,5 +230,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -297,8 +297,8 @@ main(int argc, char **argv) {
 	isc_mem_create(&mctx);

 	cmp = NULL;
-	isc_mempool_create(mctx, sizeof(client_t), &cmp)
-		      ;
+	RUNTIME_CHECK(isc_mempool_create(mctx, sizeof(client_t), &cmp)
+		      == ISC_R_SUCCESS);
 	isc_mempool_setname(cmp, "adb test clients");

 	result = isc_log_create(mctx, &lctx, &lcfg);
@@ -34,10 +34,10 @@ main(int argc, char *argv[]) {
 	isc_mem_create(&mctx);

 	mp1 = NULL;
-	isc_mempool_create(mctx, 24, &mp1);
+	RUNTIME_CHECK(isc_mempool_create(mctx, 24, &mp1) == ISC_R_SUCCESS);

 	mp2 = NULL;
-	isc_mempool_create(mctx, 31, &mp2);
+	RUNTIME_CHECK(isc_mempool_create(mctx, 31, &mp2) == ISC_R_SUCCESS);

 	isc_mempool_associatelock(mp1, &lock);
 	isc_mempool_associatelock(mp2, &lock);
@@ -14,12 +14,6 @@ SYSTEMTESTTOP=..

 DIGOPTS="+tcp +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"

-wait_for_serial() (
-    $DIG $DIGOPTS "@$1" "$2" SOA > "$4"
-    serial=$(awk '$4 == "SOA" { print $7 }' "$4")
-    [ "$3" -eq "${serial:--1}" ]
-)
-
 status=0
 n=0

@@ -97,13 +91,11 @@ digcomp dig.ns1.test$n postupdate.good || ret=1
 test $ret -eq 0 || echo_i "failed"
 status=`expr $status + $ret`

-n=`expr $n + 1`
-ret=0
-echo_i "wait for zone to transfer ($n)"
-retry_quiet 20 wait_for_serial 10.53.0.2 dynamic 2000042408 dig.ns2.test$n || ret=1
-
-test $ret -eq 0 || echo_i "failed"
-status=`expr $status + $ret`
+for i in 1 2 3 4 5 6 7 8 9
+do
+	$DIG $DIGOPTS soa dynamic @10.53.0.2 | grep 2000042408 > /dev/null && break
+	sleep 1
+done

 n=`expr $n + 1`
 echo_i "check SOA owner case is transfered to slave ($n)"
@@ -129,13 +121,11 @@ digcomp dig.ns1.test$n postns1.good || ret=1
 test $ret -eq 0 || echo_i "failed"
 status=`expr $status + $ret`

-n=`expr $n + 1`
-ret=0
-echo_i "wait for zone to transfer ($n)"
-retry_quiet 20 wait_for_serial 10.53.0.2 dynamic 2000042409 dig.ns2.test$n || ret=1
-
-test $ret -eq 0 || echo_i "failed"
-status=`expr $status + $ret`
+for i in 1 2 3 4 5 6 7 8 9
+do
+	$DIG $DIGOPTS soa dynamic @10.53.0.2 | grep 2000042409 > /dev/null && break
+	sleep 1
+done

 n=`expr $n + 1`
 echo_i "check A owner case is transfered to slave ($n)"
@@ -378,7 +378,7 @@ ret=0
 $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
    server 10.53.0.1 ${PORT}
    update add masters.catalog1.example. 3600 IN A 10.53.0.3
-    update add masters.catalog1.example. 3600 IN AAAA fd92:7065:b8e:ffff::3
+    update add masters.catalog1.example. 3600 IN AAAA  fd92:7065:b8e:ffff::3
    update add 4346f565b4d63ddb99e5d2497ff22d04e878e8f8.zones.catalog1.example. 3600 IN PTR dom6.example.
    send
 END
@@ -759,127 +759,96 @@ if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

 ##########################################################################
-echo_i "Testing catalog entries that can't be represented as filenames"
-# note: we need 4 backslashes in the shell to get 2 backslashes in DNS
-# presentation format, which is 1 backslash on the wire.
-for special in \
-       this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example \
-       this.zone/domain.has.a.slash.dom10.example \
-       this.zone\\\\domain.has.backslash.dom10.example \
-       this.zone:domain.has.a.colon.dom.10.example
-do
-    # hashes below are generated by:
-    # python ${TOP}/contrib/scripts/catzhash.py "${special}"
+echo_i "Testing very long domain in catalog"
+n=$((n+1))
+echo_i "checking that this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. is not served by master ($n)"
+ret=0
+wait_for_no_soa @10.53.0.1 this.is.aery.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

-    case "$special" in
-    this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example)
-        hash=825f48b1ce1b4cf5a041d20255a0c8e98d114858
-        db=__catz__4d70696f2335687069467f11f5d5378c480383f97782e553fb2d04a7bb2a23ed.db
-        ;;
-    this.zone/domain.has.a.slash.dom10.example)
-        hash=e64cc64c99bf52d0a77fb16dd7ed57cf925a36aa
-        db=__catz__46ba3e1b28d5955e5313d5fee61bedc78c71d08035aa7ea2f7bf0b8228ab3acc.db
-        ;;
-    this.zone\\\\domain.has.backslash.dom10.example)
-        hash=91e27e02153d38cf656a9b376d7747fbcd19f985
-        db=__catz__b667f7ff802c0895e0506699951cff9a1cab68c5ef8546aa0d07425f244ed870.db
-        ;;
-    this.zone:domain.has.a.colon.dom.10.example)
-        hash=8b7238bf4c34045834c573ba4116557ebb24d33c
-        db=__catz__5c721f7872913a4e7fa8ad42589cce5dd6e551a4c9e6ab3f86e77c0bbc7c2ca6.db
-        ;;
-    esac
+n=$((n+1))
+echo_i "Adding a domain this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. to master via RNDC ($n)"
+ret=0
+echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom10.example.db
+echo "@ IN NS invalid." >> ns1/dom10.example.db
+rndccmd 10.53.0.1 addzone this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. '{type master; file "dom10.example.db";};' || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

-    n=$((n+1))
-    echo_i "checking that ${special}. is not served by master ($n)"
-    ret=0
-    wait_for_no_soa @10.53.0.1 "${special}" dig.out.test$n || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
+n=$((n+1))
+echo_i "checking that this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. is now served by master ($n)"
+ret=0
+wait_for_soa @10.53.0.1 this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

-    n=$((n+1))
-    echo_i "Adding a domain ${special}. to master via RNDC ($n)"
-    ret=0
-    echo "@ 3600 IN SOA . . 1 3600 3600 3600 3600" > ns1/dom10.example.db
-    echo "@ IN NS invalid." >> ns1/dom10.example.db
-    rndccmd 10.53.0.1 addzone '"'"${special}"'"' '{type master; file "dom10.example.db";};' || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
+nextpart ns2/named.run >/dev/null

-    n=$((n+1))
-    echo_i "checking that ${special}. is now served by master ($n)"
-    ret=0
-    wait_for_soa @10.53.0.1 "${special}." dig.out.test$n || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-
-    nextpart ns2/named.run >/dev/null
-
-    n=$((n+1))
-    echo_i "Adding domain ${special}. to catalog1 zone ($n)"
-    ret=0
-    $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-      server 10.53.0.1 ${PORT}
-      update add ${hash}.zones.catalog1.example 3600 IN PTR ${special}.
-      send
+n=$((n+1))
+echo_i "Adding domain this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. to catalog1 zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+    server 10.53.0.1 ${PORT}
+    update add 825f48b1ce1b4cf5a041d20255a0c8e98d114858.zones.catalog1.example 3600 IN PTR this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example.
+    send
 END
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

-    n=$((n+1))
-    echo_i "waiting for slave to sync up ($n)"
-    ret=0
-    wait_for_message ns2/named.run  "catz: adding zone '$special' from catalog 'catalog1.example'" &&
-    wait_for_message ns2/named.run  "transfer of '$special/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
+n=$((n+1))
+echo_i "waiting for slave to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "catz: adding zone 'this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example' from catalog 'catalog1.example'" &&
+wait_for_message ns2/named.run  "transfer of 'this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example/IN' from 10.53.0.1#${PORT}: Transfer status: success" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

-    n=$((n+1))
-    echo_i "checking that ${special}. is served by slave ($n)"
-    ret=0
-    wait_for_soa @10.53.0.2 "${special}." dig.out.test$n || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
+n=$((n+1))
+echo_i "checking that this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. is served by slave ($n)"
+ret=0
+wait_for_soa @10.53.0.2 this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

-    n=$((n+1))
-    echo_i "checking that zone-directory is populated with a hashed filename ($n)"
-    ret=0
-    wait_for_zonefile "ns2/zonedir/$db" || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
+n=$((n+1))
+echo_i "checking that zone-directory is populated with a hashed filename ($n)"
+ret=0
+wait_for_zonefile "ns2/zonedir/__catz__4d70696f2335687069467f11f5d5378c480383f97782e553fb2d04a7bb2a23ed.db" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

-    n=$((n+1))
-    echo_i "removing domain ${special}. from catalog1 zone ($n)"
-    ret=0
-    $NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
-      server 10.53.0.1 ${PORT}
-      update delete ${hash}.zones.catalog1.example
-      send
+n=$((n+1))
+echo_i "removing domain this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example.  from catalog1 zone ($n)"
+ret=0
+$NSUPDATE -d <<END >> nsupdate.out.test$n 2>&1 || ret=1
+   server 10.53.0.1 ${PORT}
+   update delete 825f48b1ce1b4cf5a041d20255a0c8e98d114858.zones.catalog1.example
+   send
 END
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

-    n=$((n+1))
-    echo_i "waiting for slave to sync up ($n)"
-    ret=0
-    wait_for_message ns2/named.run  "zone_shutdown: zone ${special}/IN: shutting down" || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
+n=$((n+1))
+echo_i "waiting for slave to sync up ($n)"
+ret=0
+wait_for_message ns2/named.run  "zone_shutdown: zone this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example/IN: shutting down" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

-    n=$((n+1))
-    echo_i "checking that ${special}. is not served by slave ($n)"
-    ret=0
-    wait_for_no_soa @10.53.0.2 "${special}." dig.out.test$n || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
+n=$((n+1))
+echo_i "checking that this.is.a.very.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. is not served by slave ($n)"
+ret=0
+wait_for_no_soa @10.53.0.2 this.is.aery.very.long.long.long.domain.that.will.cause.catalog.zones.to.generate.hash.instead.of.using.regular.filename.dom10.example. dig.out.test$n || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

-    n=$((n+1))
-    echo_i "checking that zone-directory is emptied ($n)"
-    ret=0
-    wait_for_no_zonefile "ns2/zonedir/$db" || ret=1
-    if [ $ret -ne 0 ]; then echo_i "failed"; fi
-    status=$((status+ret))
-done
+n=$((n+1))
+echo_i "checking that zone-directory is emptied ($n)"
+ret=0
+wait_for_no_zonefile "ns2/zonedir/__catz__4d70696f2335687069467f11f5d5378c480383f97782e553fb2d04a7bb2a23ed.db" || ret=1
+if [ $ret -ne 0 ]; then echo_i "failed"; fi
+status=$((status+ret))

 ##########################################################################
 echo_i "Testing adding a domain and a subdomain of it"
@@ -985,6 +954,8 @@ wait_for_soa @10.53.0.2 subdomain.of.dom11.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

+
+
 n=$((n+1))
 echo_i "removing domain dom11.example. from catalog1 zone ($n)"
 ret=0
@@ -1042,6 +1013,7 @@ wait_for_no_soa @10.53.0.2 subdomain.of.d11.example. dig.out.test$n || ret=1
 if [ $ret -ne 0 ]; then echo_i "failed"; fi
 status=$((status+ret))

+
 ##########################################################################
 echo_i "Testing adding a catalog zone at runtime with rndc reconfig"
 n=$((n+1))
@@ -95,8 +95,6 @@ else
    COLOR_WARN=''
 fi

-SYSTESTDIR="`basename $PWD`"
-
 if type printf > /dev/null 2>&1
 then
 	echofail () {
@@ -117,23 +115,6 @@ then
 	echoend () {
 		printf "${COLOR_END}%s${COLOR_NONE}\n" "$*"
 	}
-	echo_i() {
-	    printf '%s\n' "$*" | while read -r __LINE ; do
-	       echoinfo "I:$SYSTESTDIR:$__LINE"
-	    done
-	}
-
-	echo_ic() {
-	    printf '%s\n' "$*" | while read -r __LINE ; do
-	       echoinfo "I:$SYSTESTDIR:  $__LINE"
-	    done
-	}
-
-	echo_d() {
-	    printf '%s\n' "$*" | while read -r __LINE ; do
-	       echoinfo "D:$SYSTESTDIR:$__LINE"
-	    done
-	}
 else
 	echofail () {
 		echo "$*"
@@ -153,34 +134,36 @@ else
 	echoend () {
 		echo "$*"
 	}
-
-	echo_i() {
-	    echo "$@" | while read -r __LINE ; do
-	       echoinfo "I:$SYSTESTDIR:$__LINE"
-	    done
-	}
-
-	echo_ic() {
-	    echo "$@" | while read -r __LINE ; do
-	       echoinfo "I:$SYSTESTDIR:  $__LINE"
-	    done
-	}
-
-	echo_d() {
-	    echo "$@" | while read -r __LINE ; do
-	       echoinfo "D:$SYSTESTDIR:$__LINE"
-	    done
-	}
 fi

-cat_i() {
-    while read -r __LINE ; do
+SYSTESTDIR="`basename $PWD`"
+
+echo_i() {
+    echo "$@" | while read __LINE ; do
       echoinfo "I:$SYSTESTDIR:$__LINE"
    done
 }

+echo_ic() {
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:  $__LINE"
+    done
+}
+
+cat_i() {
+    while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
+    done
+}
+
+echo_d() {
+    echo "$@" | while read __LINE ; do
+       echoinfo "D:$SYSTESTDIR:$__LINE"
+    done
+}
+
 cat_d() {
-    while read -r __LINE ; do
+    while read __LINE ; do
       echoinfo "D:$SYSTESTDIR:$__LINE"
    done
 }
@@ -395,14 +378,14 @@ nextpartpeek() {
 _search_log() (
 	msg="$1"
 	file="$2"
-	nextpart "$file" | grep -F -e "$msg" > /dev/null
+	nextpart "$file" | grep -F "$msg" > /dev/null
 )

 # _search_log_peek: look for message $1 in file $2 with nextpartpeek().
 _search_log_peek() (
 	msg="$1"
 	file="$2"
-	nextpartpeek "$file" | grep -F -e "$msg" > /dev/null
+	nextpartpeek "$file" | grep -F "$msg" > /dev/null
 )

 # wait_for_log: wait until message $2 in file $3 appears.  Bail out after
@@ -24,9 +24,9 @@ rm -f ./canonical?.*
 rm -f ./delv.out*
 rm -f ./delve.out*
 rm -f ./dig.out.*
-rm -f ./dnssectools.out*
 rm -f ./dsfromkey.out.*
 rm -f ./keygen.err
+rm -f ./dnssectools.out*
 rm -f ./named.secroots.test*
 rm -f ./nosign.before
 rm -f ./ns*/*.nta
@@ -37,19 +37,19 @@ rm -f ./ns1/root.db ./ns2/example.db ./ns2/managed.db ./ns2/trusted.db
 rm -f ./ns2/algroll.db
 rm -f ./ns2/badparam.db ./ns2/badparam.db.bad
 rm -f ./ns2/cdnskey-kskonly.secure.db
-rm -f ./ns2/cdnskey-kskonly.secure.id
 rm -f ./ns2/cdnskey-update.secure.db
 rm -f ./ns2/cdnskey-x.secure.db
 rm -f ./ns2/cdnskey.secure.db
 rm -f ./ns2/cds-auto.secure.db ./ns2/cds-auto.secure.db.jnl
 rm -f ./ns2/cds-kskonly.secure.db
-rm -f ./ns2/cds-kskonly.secure.id
 rm -f ./ns2/cds-update.secure.db ./ns2/cds-update.secure.db.jnl
 rm -f ./ns2/cds.secure.db ./ns2/cds-x.secure.db
 rm -f ./ns2/in-addr.arpa.db
 rm -f ./ns2/nsec3chain-test.db
 rm -f ./ns2/single-nsec3.db
 rm -f ./ns2/updatecheck-kskonly.secure.*
+rm -f ./ns3/secure.example.db ./ns3/*.managed.db ./ns3/*.trusted.db
+rm -f ./ns3/unsupported.managed.db.tmp ./ns3/unsupported.trusted.db.tmp
 rm -f ./ns3/auto-nsec.example.db ./ns3/auto-nsec3.example.db
 rm -f ./ns3/badds.example.db
 rm -f ./ns3/dname-at-apex-nsec3.example.db
@@ -57,10 +57,10 @@ rm -f ./ns3/dnskey-nsec3-unknown.example.db
 rm -f ./ns3/dnskey-nsec3-unknown.example.db.tmp
 rm -f ./ns3/dnskey-unknown.example.db
 rm -f ./ns3/dnskey-unknown.example.db.tmp
-rm -f ./ns3/dnskey-unsupported-2.example.db
-rm -f ./ns3/dnskey-unsupported-2.example.db.tmp
 rm -f ./ns3/dnskey-unsupported.example.db
 rm -f ./ns3/dnskey-unsupported.example.db.tmp
+rm -f ./ns3/dnskey-unsupported-2.example.db
+rm -f ./ns3/dnskey-unsupported-2.example.db.tmp
 rm -f ./ns3/dynamic.example.db ./ns3/dynamic.example.db.signed.jnl
 rm -f ./ns3/expired.example.db ./ns3/update-nsec3.example.db
 rm -f ./ns3/expiring.example.db ./ns3/nosign.example.db
@@ -80,7 +80,6 @@ rm -f ./ns3/publish-inactive.example.db
 rm -f ./ns3/revkey.example.db
 rm -f ./ns3/rsasha256.example.db ./ns3/rsasha512.example.db
 rm -f ./ns3/secure.below-cname.example.db
-rm -f ./ns3/secure.example.db ./ns3/*.managed.db ./ns3/*.trusted.db
 rm -f ./ns3/secure.nsec3.example.db
 rm -f ./ns3/secure.optout.example.db
 rm -f ./ns3/siginterval.conf
@@ -90,7 +89,6 @@ rm -f ./ns3/split-smart.example.db
 rm -f ./ns3/ttlpatch.example.db ./ns3/ttlpatch.example.db.signed
 rm -f ./ns3/ttlpatch.example.db.patched
 rm -f ./ns3/unsecure.example.db ./ns3/bogus.example.db ./ns3/keyless.example.db
-rm -f ./ns3/unsupported.managed.db.tmp ./ns3/unsupported.trusted.db.tmp
 rm -f ./ns4/managed-keys.bind*
 rm -f ./ns4/named_dump.db*
 rm -f ./ns6/optout-tld.db
@@ -238,7 +238,6 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
 "$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
-keyfile_to_key_id "$key1" > cds-kskonly.secure.id

 zone=cds-auto.secure
 infile=cds-auto.secure.db.in
@@ -282,7 +281,6 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
 "$SIGNER" -P -g -o "$zone" "$zonefile" > /dev/null 2>&1
-keyfile_to_key_id "$key1" > cdnskey-kskonly.secure.id

 zone=cdnskey-auto.secure
 infile=cdnskey-auto.secure.db.in
@@ -108,12 +108,11 @@ stripns () {
 # Ensure there is not a blank line before "Secure roots:".
 #
 check_secroots_layout () {
-	tr -d '\r' < "$1" | \
 	awk '$0 == "" { if (empty) exit(1); empty=1; next }
 	     /Start view/ { if (!empty) exit(1) }
 	     /Secure roots:/ { if (empty) exit(1) }
 	     /Negative trust anchors:/ { if (!empty) exit(1) }
-	     { empty=0 }'
+	     { empty=0 }' $1
 	return $?
 }

@@ -1074,23 +1073,6 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

-echo_i "checking insecurity proof works using negative cache ($n)"
-ret=0
-rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i
-dig_with_opts +cd @10.53.0.4 insecure.example. ds > dig.out.ns4.test$n.1 || ret=1
-for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
-do
-        dig_with_opts @10.53.0.4 nonexistent.insecure.example. > dig.out.ns4.test$n.2 || ret=1
-	if grep "status: NXDOMAIN" dig.out.ns4.test$n.2 >/dev/null; then
-		break
-	fi
-	sleep 1
-done
-grep "status: NXDOMAIN" dig.out.ns4.test$n.2 >/dev/null || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "checking positive validation RSASHA256 NSEC ($n)"
 ret=0
 dig_with_opts +noauth a.rsasha256.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
@@ -3317,24 +3299,6 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

-echo_i "check that a CDS deletion record is accepted ($n)"
-ret=0
-(
-echo zone cds-update.secure
-echo server 10.53.0.2 "$PORT"
-echo update delete cds-update.secure CDS
-echo update add cds-update.secure 0 CDS 0 0 0 00
-echo send
-) | $NSUPDATE > nsupdate.out.test$n 2>&1
-dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n
-lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
-test "${lines:-10}" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' | wc -l)
-test "$lines" -eq 1 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "check that CDS records are signed using KSK when added by nsupdate ($n)"
 ret=0
 (
@@ -3360,7 +3324,6 @@ status=$((status+ret))
 echo_i "check that CDS records are signed only using KSK when added by"
 echo_i "   nsupdate when dnssec-dnskey-kskonly is yes ($n)"
 ret=0
-keyid=$(cat ns2/cds-kskonly.secure.id)
 (
 echo zone cds-kskonly.secure
 echo server 10.53.0.2 "$PORT"
@@ -3375,38 +3338,12 @@ echo send
 dig_with_opts +noall +answer @10.53.0.2 cds cds-kskonly.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
-lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDS" && $11 == id {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 2 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

-echo_i "check that CDS deletion records are signed only using KSK when added by"
-echo_i "   nsupdate when dnssec-dnskey-kskonly is yes ($n)"
-ret=0
-keyid=$(cat ns2/cds-kskonly.secure.id)
-(
-echo zone cds-kskonly.secure
-echo server 10.53.0.2 "$PORT"
-echo update delete cds-kskonly.secure CDS
-echo update add cds-kskonly.secure 0 CDS 0 0 0 00
-echo send
-) | $NSUPDATE
-dig_with_opts +noall +answer @10.53.0.2 cds cds-kskonly.secure > dig.out.test$n
-lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
-lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDS" && $11 == id {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
-lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' | wc -l)
-test "$lines" -eq 1 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "checking that positive unknown NSEC3 hash algorithm with OPTOUT does validate ($n)"
 ret=0
 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 optout-unknown.example SOA > dig.out.ns3.test$n
@@ -3542,24 +3479,6 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

-echo_i "check that a CDNSKEY deletion record is accepted ($n)"
-ret=0
-(
-echo zone cdnskey-update.secure
-echo server 10.53.0.2 "$PORT"
-echo update delete cdnskey-update.secure CDNSKEY
-echo update add cdnskey-update.secure 0 CDNSKEY 0 3 0 AA==
-echo send
-) | $NSUPDATE > nsupdate.out.test$n 2>&1
-dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n
-lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "${lines:-10}" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' | wc -l)
-test "${lines:-10}" -eq 1 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "checking that unknown DNSKEY algorithm + unknown NSEC3 has algorithm validates as insecure ($n)"
 ret=0
 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-nsec3-unknown.example A > dig.out.ns3.test$n
@@ -3593,7 +3512,6 @@ status=$((status+ret))
 echo_i "check that CDNSKEY records are signed only using KSK when added by"
 echo_i "   nsupdate when dnssec-dnskey-kskonly is yes ($n)"
 ret=0
-keyid=$(cat ns2/cdnskey-kskonly.secure.id)
 (
 echo zone cdnskey-kskonly.secure
 echo server 10.53.0.2 "$PORT"
@@ -3605,38 +3523,12 @@ echo send
 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-kskonly.secure > dig.out.test$n
 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
-lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDNSKEY" && $11 == id {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
 test "$lines" -eq 1 || ret=1
 n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

-echo_i "check that CDNSKEY deletion records are signed only using KSK when added by"
-echo_i "   nsupdate when dnssec-dnskey-kskonly is yes ($n)"
-ret=0
-keyid=$(cat ns2/cdnskey-kskonly.secure.id)
-(
-echo zone cdnskey-kskonly.secure
-echo server 10.53.0.2 "$PORT"
-echo update delete cdnskey-kskonly.secure CDNSKEY
-echo update add cdnskey-kskonly.secure 0 CDNSKEY 0 3 0 AA==
-echo send
-) | $NSUPDATE
-dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-kskonly.secure > dig.out.test$n
-lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
-lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDNSKEY" && $11 == id {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
-lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l)
-test "$lines" -eq 1 || ret=1
-lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' | wc -l)
-test "${lines:-10}" -eq 1 || ret=1
-n=$((n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "checking initialization with a revoked managed key ($n)"
 ret=0
 copy_setports ns5/named2.conf.in ns5/named.conf
@@ -3761,19 +3653,11 @@ dig_with_opts . dnskey +ednsopt=KEY-TAG:fffe +ednsopt=KEY-TAG:fffd @10.53.0.1 >
 grep "trust-anchor-telemetry './IN' from .* 65534" ns1/named.run > /dev/null || ret=1
 grep "trust-anchor-telemetry './IN' from .* 65533" ns1/named.run > /dev/null && ret=1
 $PERL $SYSTEMTESTTOP/stop.pl dnssec ns1 || ret=1
-nextpart ns1/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns1 || ret=1
 n=$(($n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))

-echo_i "waiting for root server to finish reloading ($n)"
-ret=0
-wait_for_log 20 "all zones loaded" ns1/named.run || ret=1
-n=$(($n+1))
-test "$ret" -eq 0 || echo_i "failed"
-status=$((status+ret))
-
 echo_i "check that the view is logged in messages from the validator when using views ($n)"
 ret=0
 grep "view rec: *validat" ns4/named.run > /dev/null || ret=1
@@ -12,7 +12,6 @@
 rm -f */named.conf
 rm -f */named.memstats
 rm -f */named.run
-rm -f */named.run.prev
 rm -f */named.stats
 rm -f dig.out*
 rm -f dnstap.out dnstap.hex
@@ -35,21 +35,7 @@ do
 	status=`expr $status + $ret`
 done

-echo_i "wait for servers to finish loading"
-ret=0
-wait_for_log 20 "all zones loaded" ns1/named.run || ret=1
-wait_for_log 20 "all zones loaded" ns2/named.run || ret=1
-wait_for_log 20 "all zones loaded" ns3/named.run || ret=1
-wait_for_log 20 "all zones loaded" ns4/named.run || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-# both the 'a.example/A' lookup and the './NS' lookup to ns1
-# need tocomplete before reopening/rolling for the counts to
-# be correct.
-
 $DIG $DIGOPTS @10.53.0.3 a.example > dig.out
-wait_for_log 20 "(./NS): query_reset" ns1/named.run || true

 # check three different dnstap reopen/roll methods:
 # ns1: dnstap-reopen; ns2: dnstap -reopen; ns3: dnstap -roll
@@ -85,7 +71,6 @@ EOF
 $RNDCCMD -s 10.53.0.1 stop | sed 's/^/ns1 /' | cat_i
 $RNDCCMD -s 10.53.0.2 stop | sed 's/^/ns2 /' | cat_i
 $RNDCCMD -s 10.53.0.3 stop | sed 's/^/ns3 /' | cat_i
-
 sleep 1

 echo_i "checking initial message counts"
@@ -120,7 +120,8 @@ dyndb_init(isc_mem_t *mctx, const char *name, const char *parameters,
 	*instp = sample_inst;

 cleanup:
-	isc_mem_free(mctx, s);
+	if (s != NULL)
+		isc_mem_free(mctx, s);
 	if (argv != NULL)
 		isc_mem_put(mctx, argv, argc * sizeof(*argv));

@@ -1351,7 +1351,6 @@ $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} inline ns3
 # receive_secure_serial() should refrain from introducing any zone changes.
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --halt --port ${CONTROLPORT} inline ns3
 ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed
-nextpart ns3/named.run > /dev/null
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} inline ns3
 # We can now test whether the secure zone journal was correctly processed:
 # unless the records contained in it were scheduled for resigning, no resigning
@@ -107,16 +107,6 @@ zone "pregenerated.kasp" {
 	dnssec-policy "rsasha1";
 };

-/*
- * A configured dnssec-policy with one rumoured key.
- * Bugfix case for GL #1593.
- */
-zone "rumoured.kasp" {
-	type master;
-	file "rumoured.kasp.db";
-	dnssec-policy "rsasha1";
-};
-
 /*
 * Different algorithms.
 */
@@ -43,7 +43,7 @@ U="UNRETENTIVE"
 # Set up zones that will be initially signed.
 #
 for zn in default rsasha1 dnssec-keygen some-keys legacy-keys pregenerated \
-	  rumoured rsasha1-nsec3 rsasha256 rsasha512 ecdsa256 ecdsa384 inherit
+	  rsasha1-nsec3 rsasha256 rsasha512 ecdsa256 ecdsa384 inherit
 do
 	setup "${zn}.kasp"
 	cp template.db.in "$zonefile"
@@ -72,16 +72,6 @@ zone="pregenerated.kasp"
 $KEYGEN -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1
 $KEYGEN -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.2 2>&1

-zone="rumoured.kasp"
-Tpub="now"
-Tact="now+1d"
-KSK=$($KEYGEN  -a RSASHA1 -f KSK  -L 1234 $zone 2> keygen.out.$zone.1)
-ZSK1=$($KEYGEN -a RSASHA1 -b 2000 -L 1234 $zone 2> keygen.out.$zone.2)
-ZSK2=$($KEYGEN -a RSASHA1         -L 1234 $zone 2> keygen.out.$zone.3)
-$SETTIME -s -P $Tpub -A $Tact -g $O -k $R $Tpub -r $R $Tpub -d $H $Tpub  "$KSK"  > settime.out.$zone.1 2>&1
-$SETTIME -s -P $Tpub -A $Tact -g $O -k $R $Tpub -z $R $Tpub              "$ZSK1" > settime.out.$zone.2 2>&1
-$SETTIME -s -P $Tpub -A $Tact -g $O -k $R $Tpub -z $R $Tpub              "$ZSK2" > settime.out.$zone.2 2>&1
-
 #
 # Set up zones that are already signed.
 #
@@ -855,7 +855,7 @@ check_signatures() {
 response_has_cds_for_key() (
 	awk -v zone="${ZONE%%.}." \
 	    -v ttl="${DNSKEY_TTL}" \
-	    -v qtype="CDS" \
+	    -v qtype="${_qtype}" \
 	    -v keyid="$(key_get "${1}" ID)" \
 	    -v keyalg="${_key_algnum}" \
 	    -v hashalg="2" \
@@ -865,70 +865,37 @@ response_has_cds_for_key() (
 	    "$2"
 )

-response_has_cdnskey_for_key() (
-	awk -v zone="${ZONE%%.}." \
-	    -v ttl="${DNSKEY_TTL}" \
-	    -v qtype="CDNSKEY" \
-	    -v flags="257" \
-	    -v keyalg="${_key_algnum}" \
-	    'BEGIN { ret=1; }
-	     $1 == zone && $2 == ttl && $4 == qtype && $5 == flags && $7 == keyalg { ret=0; exit; }
-	     END { exit ret; }' \
-	    "$2"
-)
-
 # Test CDS and CDNSKEY publication.
 check_cds() {

+	_qtype="CDS"
 	_key_algnum="$(key_get KEY1 ALG_NUM)"

 	n=$((n+1))
-	echo_i "check CDS and CDNSKEY rrset are signed correctly for zone ${ZONE} ($n)"
+	echo_i "check ${_qtype} rrset is signed correctly for zone ${ZONE} ($n)"
 	ret=0
-
-	dig_with_opts "$ZONE" "@${SERVER}" "CDS" > "dig.out.$DIR.test$n.cds" || log_error "dig ${ZONE} CDS failed"
-	grep "status: NOERROR" "dig.out.$DIR.test$n.cds" > /dev/null || log_error "mismatch status in DNS response"
-
-	dig_with_opts "$ZONE" "@${SERVER}" "CDNSKEY" > "dig.out.$DIR.test$n.cdnskey" || log_error "dig ${ZONE} CDNSKEY failed"
-	grep "status: NOERROR" "dig.out.$DIR.test$n.cdnskey" > /dev/null || log_error "mismatch status in DNS response"
+	dig_with_opts "$ZONE" "@${SERVER}" $_qtype > "dig.out.$DIR.test$n" || log_error "dig ${ZONE} ${_qtype} failed"
+	grep "status: NOERROR" "dig.out.$DIR.test$n" > /dev/null || log_error "mismatch status in DNS response"

 	if [ "$(key_get KEY1 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY1 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n.cds" || log_error "missing CDS record in response for key $(key_get KEY1 ID)"
-		check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
-		response_has_cdnskey_for_key KEY1 "dig.out.$DIR.test$n.cdnskey" || log_error "missing CDNSKEY record in response for key $(key_get KEY1 ID)"
-		check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
+		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n" || log_error "missing ${_qtype} record in response for key $(key_get KEY1 ID)"
+		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
 	elif [ "$(key_get KEY1 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n.cds" && log_error "unexpected CDS record in response for key $(key_get KEY1 ID)"
-		# KEY1 should not have an associated CDNSKEY, but there may be
-		# one for another key.  Since the CDNSKEY has no field for key
-		# id, it is hard to check what key the CDNSKEY may belong to
-		# so let's skip this check for now.
+		response_has_cds_for_key KEY1 "dig.out.$DIR.test$n" && log_error "unexpected ${_qtype} record in response for key $(key_get KEY1 ID)"
 	fi

 	if [ "$(key_get KEY2 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY2 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n.cds" || log_error "missing CDS record in response for key $(key_get KEY2 ID)"
-		check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
-		response_has_cdnskey_for_key KEY2 "dig.out.$DIR.test$n.cdnskey" || log_error "missing CDNSKEY record in response for key $(key_get KEY2 ID)"
-		check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
+		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n" || log_error "missing ${_qtype} record in response for key $(key_get KEY2 ID)"
+		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
 	elif [ "$(key_get KEY2 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n.cds" && log_error "unexpected CDS record in response for key $(key_get KEY2 ID)"
-		# KEY2 should not have an associated CDNSKEY, but there may be
-		# one for another key.  Since the CDNSKEY has no field for key
-		# id, it is hard to check what key the CDNSKEY may belong to
-		# so let's skip this check for now.
+		response_has_cds_for_key KEY2 "dig.out.$DIR.test$n" && log_error "unexpected ${_qtype} record in response for key $(key_get KEY2 ID)"
 	fi

 	if [ "$(key_get KEY3 STATE_DS)" = "rumoured" ] || [ "$(key_get KEY3 STATE_DS)" = "omnipresent" ]; then
-		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n.cds" || log_error "missing CDS record in response for key $(key_get KEY3 ID)"
-		check_signatures "CDS" "dig.out.$DIR.test$n.cds" "KSK"
-		response_has_cdnskey_for_key KEY3 "dig.out.$DIR.test$n.cdnskey" || log_error "missing CDNSKEY record in response for key $(key_get KEY3 ID)"
-		check_signatures "CDNSKEY" "dig.out.$DIR.test$n.cdnskey" "KSK"
+		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n" || log_error "missing ${_qtype} record in response for key $(key_get KEY3 ID)"
+		check_signatures $_qtype "dig.out.$DIR.test$n" "KSK"
 	elif [ "$(key_get KEY3 EXPECT)" = "yes" ]; then
-		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n.cds" && log_error "unexpected CDS record in response for key $(key_get KEY3 ID)"
-		# KEY3 should not have an associated CDNSKEY, but there may be
-		# one for another key.  Since the CDNSKEY has no field for key
-		# id, it is hard to check what key the CDNSKEY may belong to
-		# so let's skip this check for now.
+		response_has_cds_for_key KEY3 "dig.out.$DIR.test$n" && log_error "unexpected ${_qtype} record in response for key $(key_get KEY3 ID)"
 	fi

 	test "$ret" -eq 0 || echo_i "failed"
@@ -990,7 +957,7 @@ check_apex() {
 	test "$ret" -eq 0 || echo_i "failed"
 	status=$((status+ret))

-	# Test CDS and CDNSKEY publication.
+	# Test CDS publication.
 	check_cds
 }

@@ -1089,17 +1056,6 @@ check_apex
 check_subdomain
 dnssec_verify

-#
-# Zone: rumoured.kasp.
-#
-# There are three keys in rumoured state.
-zone_properties "ns3" "rumoured.kasp" "rsasha1" "1234" "3" "10.53.0.3"
-# key_properties, key_timings and key_states same as above.
-check_keys
-check_apex
-check_subdomain
-dnssec_verify
-
 #
 # Zone: secondary.kasp.
 #
@@ -540,9 +540,7 @@ n=`expr $n + 1`
 echo_i "checking that a mirror zone can be deleted using rndc ($n)"
 ret=0
 # Remove the mirror zone added in the previous test.
-nextpart ns3/named.run > /dev/null
 $RNDCCMD 10.53.0.3 delzone verify-addzone > rndc.out.ns3.test$n 2>&1 || ret=1
-wait_for_log 20 "zone verify-addzone/IN: mirror zone is no longer in use; reverting to normal recursion" ns3/named.run || ret=1
 # Check whether the mirror zone was removed.
 $DIG $DIGOPTS @10.53.0.3 +norec verify-addzone SOA > dig.out.ns3.test$n 2>&1 || ret=1
 grep "NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1
@@ -172,7 +172,7 @@ n=$((n+1))
 echo_i "remove untrusted standby key, check timer restarts ($n)"
 ret=0
 mkeys_sync_on 2 || ret=1
-t1=$(grep "trust pending" ns2/managed-keys.bind) || true
+t1=$(grep "trust pending" ns2/managed-keys.bind)
 $SETTIME -D now -K ns1 "$standby1" > /dev/null
 mkeys_loadkeys_on 1 || ret=1
 # Less than a second may have passed since the last time ns2 received a
@@ -182,7 +182,7 @@ mkeys_loadkeys_on 1 || ret=1
 sleep 1
 mkeys_refresh_on 2 || ret=1
 mkeys_sync_on 2 || ret=1
-t2=$(grep "trust pending" ns2/managed-keys.bind) || true
+t2=$(grep "trust pending" ns2/managed-keys.bind)
 # trust pending date must be different
 [ -n "$t2" ] || ret=1
 [ "$t1" = "$t2" ] && ret=1
@@ -220,7 +220,7 @@ count=$(grep -c "remove at" rndc.out.$n) || true
 count=$(grep -c "trust pending" rndc.out.$n) || true
 [ "$count" -eq 1 ] || ret=1
 # pending date moved forward for the standby key
-t2=$(grep "trust pending" ns2/managed-keys.bind) || true
+t2=$(grep "trust pending" ns2/managed-keys.bind)
 [ -n "$t2" ] || ret=1
 [ "$t1" = "$t2" ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -254,7 +254,7 @@ count=$(grep -c "remove at" rndc.out.$n) || true
 count=$(grep -c "trust pending" rndc.out.$n) || true
 [ "$count" -eq 1 ] || ret=1
 # pending date moved forward for the standby key
-t2=$(grep "trust pending" ns2/managed-keys.bind) || true
+t2=$(grep "trust pending" ns2/managed-keys.bind)
 [ -n "$t2" ] || ret=1
 [ "$t1" = "$t2" ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -292,7 +292,7 @@ count=$(grep -c "remove at" rndc.out.$n) || true
 count=$(grep -c "trust pending" rndc.out.$n) || true
 [ "$count" -eq 1 ] || ret=1
 # pending date moved forward for the standby key
-t2=$(grep "trust pending" ns2/managed-keys.bind) || true
+t2=$(grep "trust pending" ns2/managed-keys.bind)
 [ -n "$t2" ] || ret=1
 [ "$t1" = "$t2" ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -571,7 +571,7 @@ ret=0
 # set using -T mkeytimers).
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.1.$n 2>&1 || ret=1
-t1=$(grep 'next refresh:' rndc.out.1.$n) || true
+t1=$(grep 'next refresh:' rndc.out.1.$n)
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns1
 rm -f ns1/root.db.signed.jnl
 cp ns1/root.db ns1/root.db.signed
@@ -594,7 +594,7 @@ count=$(grep -c "trust" rndc.out.2.$n) || true
 [ "$count" -eq 1 ] || ret=1
 count=$(grep -c "trusted since" rndc.out.2.$n) || true
 [ "$count" -eq 1 ] || ret=1
-t2=$(grep 'next refresh:' rndc.out.2.$n) || true
+t2=$(grep 'next refresh:' rndc.out.2.$n)
 [ "$t1" = "$t2" ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -605,7 +605,7 @@ ret=0
 # Refresh keys first to prevent previous checks from influencing this one
 mkeys_refresh_on 2 || ret=1
 mkeys_status_on 2 > rndc.out.1.$n 2>&1 || ret=1
-t1=$(grep 'next refresh:' rndc.out.1.$n) || true
+t1=$(grep 'next refresh:' rndc.out.1.$n)
 $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port "${CONTROLPORT}" mkeys ns1
 rm -f ns1/root.db.signed.jnl
 cat ns1/K*.key >> ns1/root.db.signed
@@ -632,7 +632,7 @@ count=$(grep -c "trust" rndc.out.2.$n) || true
 [ "$count" -eq 1 ] || ret=1
 count=$(grep -c "trusted since" rndc.out.2.$n) || true
 [ "$count" -eq 1 ] || ret=1
-t2=$(grep 'next refresh:' rndc.out.2.$n) || true
+t2=$(grep 'next refresh:' rndc.out.2.$n)
 [ "$t1" = "$t2" ] && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status+ret))
@@ -682,7 +682,7 @@ echo_i "check that trust-anchor-telemetry queries contain the correct key ($n)"
 ret=0
 # convert the hexadecimal key from the TAT query into decimal and
 # compare against the known key.
-tathex=$(grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/') || true
+tathex=$(grep "query '_ta-[0-9a-f][0-9a-f]*/NULL/IN' approved" ns1/named.run | awk '{print $6; exit 0}' | sed -e 's/(_ta-\([0-9a-f][0-9a-f]*\)):/\1/')
 tatkey=$($PERL -e 'printf("%d\n", hex(@ARGV[0]));' "$tathex")
 realkey=$(rndccmd 10.53.0.2 secroots - | sed -n 's#.*SHA256/\([0-9][0-9]*\) ; .*managed.*#\1#p')
 [ "$tatkey" -eq "$realkey" ] || ret=1
@@ -11,7 +11,6 @@ rm -f dig.out.*
 rm -f ns*/named.memstats
 rm -f ns*/named.run
 rm -f ns*/named.stats
-rm -f ns*/named.stats.prev
 rm -f ns*/named.lock
 rm -f ns*/named.conf
 rm -f ns*/managed-keys.bind*
@@ -12,11 +12,7 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

-$SHELL ./clean.sh
-
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
 copy_setports ns4/named.conf.in ns4/named.conf
-
-touch ns2/named.stats
@@ -36,11 +36,8 @@ status=`expr $status + $ret`
 echo_i "checking that dig added padding ($n)"
 ret=0
 n=`expr $n + 1`
-nextpart ns2/named.stats > /dev/null
 $RNDCCMD 10.53.0.2 stats
-wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-nextpart ns2/named.stats | grep "EDNS padding option received" > /dev/null || ret=1
-
+grep "EDNS padding option received" ns2/named.stats > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

@@ -91,30 +88,28 @@ status=`expr $status + $ret`
 echo_i "checking that a TCP and padding server config enables padding ($n)"
 ret=0
 n=`expr $n + 1`
-nextpart ns2/named.stats > /dev/null
 $RNDCCMD 10.53.0.2 stats
-wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-opad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
+opad=`grep  "EDNS padding option received" ns2/named.stats | \
+    tail -1 | awk '{ print $1}'`
 $DIG $DIGOPTS foo.example @10.53.0.3 > dig.out.test$n
 $RNDCCMD 10.53.0.2 stats
-wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-npad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
-if [ "$opad" -eq "$npad" ]; then echo_i "error: opad ($opad) == npad ($npad)"; ret=1; fi
+npad=`grep  "EDNS padding option received" ns2/named.stats | \
+    tail -1 | awk '{ print $1}'`
+if [ "$opad" -eq "$npad" ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 echo_i "checking that a padding server config should enforce TCP ($n)"
 ret=0
 n=`expr $n + 1`
-nextpart ns2/named.stats > /dev/null
 $RNDCCMD 10.53.0.2 stats
-wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-opad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
+opad=`grep  "EDNS padding option received" ns2/named.stats | \
+    tail -1 | awk '{ print $1}'`
 $DIG $DIGOPTS foo.example @10.53.0.4 > dig.out.test$n
 $RNDCCMD 10.53.0.2 stats
-wait_for_log_peek 5 "--- Statistics Dump ---" ns2/named.stats || ret=1
-npad=`nextpart ns2/named.stats | awk '/EDNS padding option received/ { print $1}'`
-if [ "$opad" -ne "$npad" ]; then echo_i "error: opad ($opad) != npad ($npad)"; ret=1; fi
+npad=`grep  "EDNS padding option received" ns2/named.stats | \
+    tail -1 | awk '{ print $1}'`
+if [ "$opad" -ne "$npad" ]; then ret=1; fi
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

--- a/Show More
+++ b/Show More