Added a isc_glob() function that wraps glob() calls for POSIX systems

and implement a custom glob() function on Windows systems.

.gitignore

@@ -10,7 +10,6 @@
 *.rej
 *.so
 *_test
-*.ipch # vscode/intellisense precompiled header
 *~
 .ccache/
 .cproject

.gitlab-ci.yml

@@ -16,8 +16,6 @@ variables:
   TEST_PARALLEL_JOBS: 6
 
   MAKE: make
-  CONFIGURE: ./configure
-  SCAN_BUILD: scan-build-9
 
 stages:
   - precheck
@@ -70,10 +68,6 @@ stages:
   image: "$CI_REGISTRY_IMAGE:centos-centos7-amd64"
   <<: *linux_amd64
 
-.centos-centos8-amd64: &centos_centos8_amd64_image
-  image: "$CI_REGISTRY_IMAGE:centos-centos8-amd64"
-  <<: *linux_amd64
-
 # Debian
 
 .debian-jessie-amd64: &debian_jessie_amd64_image
@@ -90,7 +84,7 @@ stages:
 
 .debian-buster-amd64: &debian_buster_amd64_image
   image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
-  <<: *linux_amd64
+  <<: *linux_i386
 
 .debian-sid-amd64: &debian_sid_amd64_image
   image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
@@ -160,7 +154,7 @@ stages:
     expire_in: "1 week"
 
 .configure: &configure |
-    ${CONFIGURE} \
+    ./configure \
     --disable-maintainer-mode \
     --enable-developer \
     --with-libtool \
@@ -415,30 +409,6 @@ unit:gcc:centos7:amd64:
     - gcc:centos7:amd64
   needs: ["gcc:centos7:amd64"]
 
-# Jobs for regular GCC builds on CentOS 8 (amd64)
-
-gcc:centos8:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *centos_centos8_amd64_image
-  <<: *build_job
-
-system:gcc:centos8:amd64:
-  <<: *centos_centos8_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - gcc:centos8:amd64
-  needs: ["gcc:centos8:amd64"]
-
-unit:gcc:centos8:amd64:
-  <<: *centos_centos8_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - gcc:centos8:amd64
-  needs: ["gcc:centos8:amd64"]
-
 # Jobs for regular GCC builds on Debian 8 Jessie (amd64)
 
 gcc:jessie:amd64:
@@ -509,38 +479,6 @@ unit:gcc:buster:amd64:
     - gcc:buster:amd64
   needs: ["gcc:buster:amd64"]
 
-# Jobs for scan-build builds on Debian Buster (amd64)
-
-.scan_build: &scan_build |
-  ${SCAN_BUILD} --html-title="BIND 9 ($CI_COMMIT_SHORT_SHA)" \
-                --keep-cc \
-                --status-bugs \
-                --keep-going \
-                -o scan-build.reports \
-                make -j${BUILD_PARALLEL_JOBS:-1} all V=1
-
-scan-build:buster:amd64:
-  <<: *default_triggering_rules
-  <<: *debian_buster_amd64_image
-  stage: postcheck
-  variables:
-    CC: clang-9
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    CONFIGURE: "${SCAN_BUILD} ./configure"
-    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
-  script:
-    - *configure
-    - *scan_build
-  dependencies:
-    - autoreconf:sid:amd64
-  needs:
-    - autoreconf:sid:amd64
-  artifacts:
-    paths:
-      - scan-build.reports/
-    expire_in: "1 week"
-    when: on_failure
-
 # Jobs for regular GCC builds on Debian Sid (amd64)
 
 gcc:sid:amd64:
@@ -675,7 +613,6 @@ unit:gcc:bionic:amd64:
 asan:sid:amd64:
   variables:
     CC: gcc
-    ASAN_OPTIONS: "detect_leaks=0"
     CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
     LDFLAGS: "-fsanitize=address,undefined"
     EXTRA_CONFIGURE: "--with-libidn2"
@@ -902,7 +839,6 @@ msvc:windows:amd64:
          "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
          "with-openssl=C:/OpenSSL"
          "with-libxml2=C:/libxml2"
-         "with-libuv=C:/libuv"
          "without-python"
          "with-system-tests"
          x64'

.gitlab/issue_templates/Release.md

@@ -1,65 +0,0 @@
-## Release Schedule
-
-**Tagging Deadline:**
-
-**ASN Deadline:**
-
-**Public Release:**
-
-## Release Checklist
-
-## 2 Working Days Before the Tagging Deadline
-
- - [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
- - [ ] ***(QA)*** Ensure that there are no outstanding merge requests in the private repository[^1] (Subscription Edition only).
-
-## Before the Tagging Deadline
-
- - [ ] ***(QA)*** Inform Support/Marketing of impending release (and give estimated release dates).
- - [ ] ***(QA)*** Check Perflab to ensure there has been no unexplained drop in performance for the versions being released.
- - [ ] ***(SwEng)*** Update API files for libraries with new version information.
- - [ ] ***(SwEng)*** Change software version and library versions in `configure.ac` (new major release only).
- - [ ] ***(SwEng)*** Rebuild `configure` using Autoconf on `docs.isc.org`.
- - [ ] ***(SwEng)*** Update `CHANGES`.
- - [ ] ***(SwEng)*** Update `CHANGES.SE` (Subscription Edition only).
- - [ ] ***(SwEng)*** Update `README.md`.
- - [ ] ***(SwEng)*** Update `version`.
- - [ ] ***(SwEng)*** Build documentation on `docs.isc.org`.
- - [ ] ***(QA)*** Check that all the above steps were performed correctly.
- - [ ] ***(QA)*** Check that the contents of release notes match the merge requests comprising the releases.
- - [ ] ***(QA)*** Check that the formatting is correct for text, PDF, and HTML versions of release notes.
- - [ ] ***(SwEng)*** Tag the releases[^2].  (Tags may only be pushed to the public repository for releases which are *not* security releases.)
- - [ ] ***(SwEng)*** If this is the first tag for a release (e.g. beta), create a release branch named `release_v9_X_Y` to allow development to continue on the maintenance branch whilst release engineering continues.
-
-## Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
-
- - [ ] ***(QA)*** Run the `make release` Jenkins jobs to produce the tarballs and zips.
- - [ ] ***(QA)*** Verify the results of `make release` Jenkins jobs and prepare a QA report for the releases to be published.
- - [ ] ***(QA)*** Request signatures for the tarballs.
- - [ ] ***(Signers)*** Sign the tarballs.
- - [ ] ***(QA)*** Check tarball signatures.
- - [ ] ***(QA)*** Notify Support that the releases are ready for publication.
- - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
- - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages.
- - [ ] ***(Support)*** Send out ASNs (if applicable).
-
-## On the Day of Public Release
-
- - [ ] ***(Support)*** Publish the releases according to the release schedule.
- - [ ] ***(Support)*** Write release email to *bind9-announce*.
- - [ ] ***(Support)*** Write email to *bind9-users* (if a major release).
- - [ ] ***(Support)*** Update tickets in case of waiting support customers.
- - [ ] ***(QA)*** Build and test any outstanding private packages.
- - [ ] ***(QA)*** Build public packages (`*.deb`, RPMs).
- - [ ] ***(QA)*** Inform Marketing of the release.
- - [ ] ***(QA)*** Update the internal [BIND release dates wiki page](https://wiki.isc.org/bin/view/Main/BindReleaseDates) when public announcement has been made.
- - [ ] ***(Marketing)*** Post short note to Twitter.
- - [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
- - [ ] ***(Marketing)*** Write blog article (if a major release).
- - [ ] ***(QA)*** Ensure all new tags are annotated and signed.
- - [ ] ***(SwEng)*** Push tags for the published releases to the public repository.
- - [ ] ***(SwEng)*** Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`).
-
-[^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
-
-[^2]: Preferred command line: `git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]`, where `[alphatag]` is an optional string such as `b1`, `rc1`, etc.

.gitlab/issue_templates/release.md

@@ -0,0 +1,44 @@
+## Release Checklist
+
+ - [ ] (Manager) Check for the presence of a milestone for the release:
+    - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist).
+ - [ ] (Manager) Inform Support/Marketing of impending release (and give estimated release dates).
+ - (SwEng) Prepare the sources for tarball generation:
+   - [ ] Check perflab to ensure there has been no unexplained drop in performance for the version being released.
+   - [ ] Ensure that there are no outstanding merge requests in the private repository (subscription version only).
+   - [ ] Update API files for libraries with new version information.
+   - [ ] Change software version and library versions in configure.in (new major release only).
+   - [ ] Rebuild configure using autoconf on docs.isc.org.
+   - [ ] Update CHANGES.
+   - [ ] Update CHANGES.SE (subscription branch only).
+   - [ ] Update "version".
+   - [ ] Update "readme.md".
+   - Check the release notes are correct:
+     - [ ] Compare content with merge requests for the release.
+     - [ ] Check formatting.
+   - [ ] Build documentation on docs.isc.org.
+   - [ ] Commit changes and make sure the gitlab-ci tests are passing.
+   - [ ] Push the changes and tag ("alphatag" is an optional string such as "b1", "rc1" etc.). (```git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]```)
+   - [ ] If this is the first tag for a release (e.g. beta), create a release branch named `release_v9_X_Y` (this allows development to continue on the release branch whilst release engineering continues).
+ - [ ] (SwEng) Run the "make release" Jenkins job to produce the tarballs and zips.
+ - [ ] (SwEng) Ask QA to sanity check the tarball and zips (passing to them the number of the Jenkins job).
+ - [ ] (QA) Sanity check the tarballs.
+ - [ ] (QA) Request the signature on the tarballs.
+ - [ ] (QA) Check signatures on tarballs.
+ - [ ] (QA) Tell Support to handle notification of release.
+ - [ ] (Manager) Inform Marketing of the release
+ - [ ] (Manager) Update the internal [BIND release dates wiki page](https://wiki.isc.org/bin/view/Main/BindReleaseDates) when public announcement has been made.
+ - [ ] (SwEng) Push tags for the published releases to the public repository.
+ - [ ] (SwEng) Update DEB and RPM packages.
+ - [ ] (SwEng) Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`).
+
+## Support
+ - [ ] Make tarballs and signatures available to download.
+ - [ ] Write release email to bind9-announce.
+ - [ ] Write email to bind9-users (if a major release).
+ - [ ] Update tickets in case of waiting support customers.
+
+## Marketing
+ - [ ] Post short note to Twitter.
+ - [ ] Update [Wikipedia entry for BIND](http://en.wikipedia.org/wiki/BIND).
+ - [ ] Write blog article (if a major release).

CHANGES

@@ -1,68 +1,5 @@
-5317.	[func]		A new asynchronous network communications system
-			based on libuv is now used for listening for
-			incoming requests and responding to them. (The
-			old isc_socket API remains in use for sending
-			iterative queries and processing responses; this
-			will be changed too in a later release.)
-
-			This change will make it easier to improve
-			performance and implement new protocol layers
-			(e.g., DNS over TLS) in the future. [GL #29]
-
-5316.	[func]		A new "dnssec-policy" option has been added to
-			named.conf to implement a key and signing policy
-			(KASP) for zones. When this option is in use,
-			named can generate new keys as needed and
-			automatically roll both ZSK and KSK keys. (Note
-			that the syntax for this statement differs from
-			the dnssec policy used by dnssec-keymgr.)
-
-			See the ARM for configuration details. [GL #1134]
-
-5315.	[bug]		Apply the inital RRSIG expiration spread fixed
-			to all dynamically created records in the zone
-			including NSEC3. Also fix the signature clusters
-			when the server has been offline for prolonged
-			period of times. [GL #1256]
-
-5314.	[func]		Added a new statistics variable "tcp-highwater"
-			that reports the maximum number of simultaneous TCP
-			clients BIND has handled while running. [GL #1206]
-
-5313.	[bug]		The default GeoIP2 database location did not match
-			the ARM.  'named -V' now reports the default
-			location. [GL #1301]
-
-5312.	[bug]		Do not flush the cache for `rndc validation status`.
-			Thanks to Tony Finch. [GL !2462]
-
-5311.	[cleanup]	Include all views in output of `rndc validation status`.
-			Thanks to Tony Finch. [GL !2461]
-
-5310.	[bug]		TCP failures were affecting EDNS statistics. [GL #1059]
-
-5309.	[placeholder]
-
-5308.	[bug]		Don't log DNS_R_UNCHANGED from sync_secure_journal()
-			at ERROR level in receive_secure_serial(). [GL #1288]
-
-5307.	[bug]		Fix hang when named-compilezone output is sent to pipe.
-			Thanks to Tony Finch. [GL !2481]
-
-5306.	[placeholder]
-
-5305.	[bug]		NSEC Aggressive Cache ("synth-from-dnssec") has been
-			disabled by default because it was found to have
-			a significant performance impact on the recursive
-			service. [GL #1265]
-
-5304.	[bug]		"dnskey-sig-validity 0;" was not being accepted.
-			[GL #876]
-
-5303.	[placeholder]
-
 5302.	[bug]		Fix checking that "dnstap-output" is defined when
-			"dnstap" is specified in a view. [GL #1281]
+			"dnstap" is specified" in a view. [GL #1281]
 
 5301.	[bug]		Detect partial prefixes / incomplete IPv4 address in
 			acls. [GL #1143]

PLATFORMS

@@ -3,34 +3,27 @@ PLATFORMS
 Supported platforms
 
 In general, this version of BIND will build and run on any POSIX-compliant
-system with a C11-compliant C compiler, BSD-style sockets with
+system with a C99-compliant C compiler, BSD-style sockets with
 RFC-compliant IPv6 support, POSIX-compliant threads, and the OpenSSL
 cryptography library. Atomic operations support from the compiler is
 needed, either in the form of builtin operations, C11 atomics or the
 Interlocked family of functions on Windows.
 
-BIND 9.15 requires fairly recent version of libuv library to run (>= 1.x).
-For some of the older systems listed below, you will have to install
-updated libuv package from sources such as EPEL, PPA and other native
-sources for updated packages. The other option is to install libuv from
-sources.
-
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
 offer support on a "best effort" basis for some.
 
 Regularly tested platforms
 
-As of Dec 2019, BIND 9.15 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.15 is fully supported and regularly tested on the
 following systems:
 
-  * Debian 9, 10
-  * Ubuntu LTS 16.04, 18.04
-  * Fedora 30
-  * Red Hat Enterprise Linux / CentOS 7, 8
-  * FreeBSD 11.3, 12.0
-  * OpenBSD 6.5
-  * Alpine Linux
+  * Debian 8, 9, 10
+  * Ubuntu 16.04, 18.04
+  * Fedora 28, 29
+  * Red Hat Enterprise Linux / CentOS 6, 7
+  * FreeBSD 11.x
+  * OpenBSD 6.2, 6.3
 
 The amd64, i386, armhf and arm64 CPU architectures are all fully
 supported.
@@ -47,30 +40,17 @@ Server 2012 R2, none of these are tested regularly by ISC.
   * Windows 10 / x64
   * macOS 10.12+
   * Solaris 11
+  * FreeBSD 10.x, 12.0+
+  * OpenBSD 6.4+
   * NetBSD
   * Other Linux distributions still supported by their vendors, such as:
-      + Ubuntu 19.04+
+      + Ubuntu 14.04, 18.10+
       + Gentoo
       + Arch Linux
+      + Alpine Linux
   * OpenWRT/LEDE 17.01+
   * Other CPU architectures (mips, mipsel, sparc, ...)
 
-Community maintained
-
-These systems may not all have easily available the required dependencies
-for building BIND although it will be possible in many cases to compile
-those directly from source. The community and interested parties may wish
-to help with maintenance and we welcome patch contributions, although we
-cannot guarantee that we will accept them. All contributions will be
-assessed against the risk of adverse effect on officially supported
-platforms.
-
-  * Platforms past or close to their respective EOL dates, such as:
-      + Ubuntu 14.04, 18.10
-      + CentOS 6
-      + Debian Jessie
-      + FreeBSD 10.x
-
 Unsupported platforms
 
 These are platforms on which BIND 9.15 is known not to build or run:
@@ -83,6 +63,13 @@ These are platforms on which BIND 9.15 is known not to build or run:
   * Platforms that don't support atomic operations (via compiler or
     library)
   * Linux without NPTL (Native POSIX Thread Library)
-  * Platforms where libuv cannot be compiled
 
 Platform quirks
+
+NetBSD 6 i386
+
+The i386 build of NetBSD requires the libatomic library, available from
+the gcc5-libs package. Because this library is in a non-standard path, its
+location must be specified in the configure command line:
+
+LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure

PLATFORMS.md

@@ -11,33 +11,27 @@
 ## Supported platforms
 
 In general, this version of BIND will build and run on any POSIX-compliant
-system with a C11-compliant C compiler, BSD-style sockets with RFC-compliant
+system with a C99-compliant C compiler, BSD-style sockets with RFC-compliant
 IPv6 support, POSIX-compliant threads, and the OpenSSL cryptography library.
 Atomic operations support from the compiler is needed, either in the form of
 builtin operations, C11 atomics or the Interlocked family of functions on
 Windows.
 
-BIND 9.15 requires fairly recent version of libuv library to run (>= 1.x).  For
-some of the older systems listed below, you will have to install updated libuv
-package from sources such as EPEL, PPA and other native sources for updated
-packages.  The other option is to install libuv from sources.
-
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
 offer support on a "best effort" basis for some.
 
 ### Regularly tested platforms
 
-As of Dec 2019, BIND 9.15 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.15 is fully supported and regularly tested on the
 following systems:
 
-* Debian 9, 10
-* Ubuntu LTS 16.04, 18.04
-* Fedora 30
-* Red Hat Enterprise Linux / CentOS 7, 8
-* FreeBSD 11.3, 12.0
-* OpenBSD 6.5
-* Alpine Linux
+* Debian 8, 9, 10
+* Ubuntu 16.04, 18.04
+* Fedora 28, 29
+* Red Hat Enterprise Linux / CentOS 6, 7
+* FreeBSD 11.x
+* OpenBSD 6.2, 6.3
 
 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
 
@@ -53,29 +47,17 @@ Server 2012 R2, none of these are tested regularly by ISC.
 * Windows 10 / x64
 * macOS 10.12+
 * Solaris 11
+* FreeBSD 10.x, 12.0+
+* OpenBSD 6.4+
 * NetBSD
 * Other Linux distributions still supported by their vendors, such as:
-    * Ubuntu 19.04+
+    * Ubuntu 14.04, 18.10+
     * Gentoo
     * Arch Linux
+    * Alpine Linux
 * OpenWRT/LEDE 17.01+
 * Other CPU architectures (mips, mipsel, sparc, ...)
 
-### Community maintained
-
-These systems may not all have easily available the required dependencies for
-building BIND although it will be possible in many cases to compile those
-directly from source. The community and interested parties may wish to help with
-maintenance and we welcome patch contributions, although we cannot guarantee
-that we will accept them.  All contributions will be assessed against the risk
-of adverse effect on officially supported platforms.
-
-* Platforms past or close to their respective EOL dates, such as:
-    * Ubuntu 14.04, 18.10
-    * CentOS 6
-    * Debian Jessie
-    * FreeBSD 10.x
-
 ## Unsupported platforms
 
 These are platforms on which BIND 9.15 is known *not* to build or run:
@@ -87,6 +69,15 @@ These are platforms on which BIND 9.15 is known *not* to build or run:
 * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
 * Platforms that don't support atomic operations (via compiler or library)
 * Linux without NPTL (Native POSIX Thread Library)
-* Platforms where libuv cannot be compiled
 
 ## Platform quirks
+
+### NetBSD 6 i386
+
+The i386 build of NetBSD requires the `libatomic` library, available from
+the `gcc5-libs` package.  Because this library is in a non-standard path,
+its location must be specified in the `configure` command line:
+
+```
+LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
+```

README.md

@@ -127,11 +127,8 @@ BIND 9.15 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.14 and earlier releases. New features
 include:
 
-* New "dnssec-policy" statement to configure a key and signing policy
-  for zones, enabling automatic key regeneration and rollover.
-* A new network manager based on libuv.
 * Support for the new GeoIP2 geolocation API
-* Improved DNSSEC trust anchor configuration using `dnssec-keys`
+* Improved DNSSEC key configuration using `dnssec-keys`
 * YAML output for `dig`, `mdig`, and `delv`.
 
 ### <a name="build"/> Building BIND

bin/check/check-tool.c

@@ -716,7 +716,7 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 	FILE *output = stdout;
 	const char *flags;
 
-	flags = (fileformat == dns_masterformat_text) ? "w" : "wb";
+	flags = (fileformat == dns_masterformat_text) ? "w+" : "wb+";
 
 	if (debug) {
 		if (filename != NULL && strcmp(filename, "-") != 0)

bin/check/named-checkconf.c

@@ -421,7 +421,7 @@ configure_zone(const char *vclass, const char *view,
 
 	obj = NULL;
 	if (get_maps(maps, "max-zone-ttl", &obj)) {
-		maxttl = cfg_obj_asduration(obj);
+		maxttl = cfg_obj_asuint32(obj);
 		zone_options |= DNS_ZONEOPT_CHECKTTL;
 	}
 

bin/dig/dighost.c

@@ -1379,7 +1379,7 @@ setup_libs(void) {
 
 	isc_log_setdebuglevel(lctx, 0);
 
-	result = isc_taskmgr_create(mctx, 1, 0, NULL, &taskmgr);
+	result = isc_taskmgr_create(mctx, 1, 0, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 
 	result = isc_task_create(taskmgr, 0, &global_task);

bin/dnssec/Makefile.in

@@ -15,26 +15,24 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} \
 		${OPENSSL_CFLAGS}
 
-CDEFINES =	-DVERSION=\"${VERSION}\" -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
+CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =
 
 DNSLIBS =	../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
-ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCLIBS =	../../lib/isc/libisc.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
 ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ ${OPENSSL_LIBS} ${JSON_C_LIBS} ${LIBXML2_LIBS}
 
 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
-ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
 
-DEPLIBS =	${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${ISCDEPLIBS}
+DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
 
-LIBS =		${DNSLIBS} ${ISCCFGLIBS} ${ISCLIBS} @LIBS@
+LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
 
-NOSYMLIBS =	${DNSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
+NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
 
 # Alphabetically
 TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
@@ -50,7 +48,7 @@ SRCS =		dnssec-cds.c dnssec-dsfromkey.c dnssec-importkey.c \
 		dnssec-settime.c dnssec-signzone.c dnssec-verify.c \
 		dnssectool.c
 
-MANPAGES =	dnssec-cds.8 dnssec-dsfromkey.8 dnssec-importkey.8 \
+MANPAGES =	dnssec-cds.8 dnssec-dsfromkey.8  dnssec-importkey.8 \
 		dnssec-keyfromlabel.8 dnssec-keygen.8 dnssec-revoke.8 \
 		dnssec-settime.8 dnssec-signzone.8 dnssec-verify.8
 

bin/dnssec/dnssec-keygen.docbook

@@ -66,7 +66,6 @@
       <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">bits</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">flag</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-G</option></arg>
@@ -75,9 +74,8 @@
       <arg choice="opt" rep="norepeat"><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-k <replaceable class="parameter">policy</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-k</option></arg>
       <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">file</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
@@ -86,7 +84,6 @@
       <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">rrtype</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
       <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
@@ -210,18 +207,6 @@
 	</listitem>
       </varlistentry>
 
-      <varlistentry>
-	<term>-d <replaceable class="parameter">bits</replaceable></term>
-	<listitem>
-	  <para>
-	    Key size in bits. For the algorithms RSASHA1, NSEC3RSASA1,
-	    RSASHA256 and RSASHA512 the key size must be in range 1024-4096.
-	    DH size is between 128 and 4096. This option is ignored for
-	    algorithms ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448.
-	  </para>
-	</listitem>
-      </varlistentry>
-
       <varlistentry>
 	<term>-E <replaceable class="parameter">engine</replaceable></term>
 	<listitem>
@@ -290,24 +275,6 @@
 	</listitem>
       </varlistentry>
 
-      <varlistentry>
-	<term>-k <replaceable class="parameter">policy</replaceable></term>
-	<listitem>
-	  <para>
-	    Create keys for a specific dnssec-policy.  If a policy uses
-	    multiple keys, <command>dnssec-keygen</command> will generate
-	    multiple keys.  This will also create a ".state" file to keep
-	    track of the key state.
-	  </para>
-	  <para>
-	    This option creates keys according to the dnssec-policy
-	    configuration, hence it cannot be used together with many of
-	    the other options that <command>dnssec-keygen</command>
-	    provides.
-	  </para>
-	</listitem>
-      </varlistentry>
-
       <varlistentry>
 	<term>-L <replaceable class="parameter">ttl</replaceable></term>
 	<listitem>
@@ -324,16 +291,6 @@
 	</listitem>
       </varlistentry>
 
-      <varlistentry>
-	<term>-l <replaceable class="parameter">file</replaceable></term>
-	<listitem>
-	  <para>
-	    Provide a configuration file that contains a dnssec-policy
-	    statement (matching the policy set with <command>-k</command>).
-	  </para>
-	</listitem>
-      </varlistentry>
-
       <varlistentry>
 	<term>-n <replaceable class="parameter">nametype</replaceable></term>
 	<listitem>

bin/dnssec/dnssec-settime.c

@@ -88,15 +88,6 @@ usage(void) {
 	fprintf(stderr, "    -i <interval>: prepublication interval for "
 					   "successor key "
 					   "(default: 30 days)\n");
-	fprintf(stderr, "Key state options:\n");
-	fprintf(stderr, "    -s: update key state file (default no)\n");
-	fprintf(stderr, "    -g state: set the goal state for this key\n");
-	fprintf(stderr, "    -d state date/[+-]offset: set the DS state\n");
-	fprintf(stderr, "    -k state date/[+-]offset: set the DNSKEY state\n");
-	fprintf(stderr, "    -r state date/[+-]offset: set the RRSIG (KSK) "
-						      "state\n");
-	fprintf(stderr, "    -z state date/[+-]offset: set the RRSIG (ZSK) "
-						      "state\n");
 	fprintf(stderr, "Printing options:\n");
 	fprintf(stderr, "    -p C/P/Psync/A/R/I/D/Dsync/all: print a "
 					"particular time value or values\n");
@@ -132,87 +123,29 @@ printtime(dst_key_t *key, int type, const char *tag, bool epoch,
 	}
 }
 
-static void
-writekey(dst_key_t *key, const char *directory, bool write_state)
-{
-	char newname[1024];
-	char keystr[DST_KEY_FORMATSIZE];
-	isc_buffer_t buf;
-	isc_result_t result;
-	int options = DST_TYPE_PUBLIC|DST_TYPE_PRIVATE;
-
-	if (write_state) {
-		options |= DST_TYPE_STATE;
-	}
-
-	isc_buffer_init(&buf, newname, sizeof(newname));
-	result = dst_key_buildfilename(key, DST_TYPE_PUBLIC, directory, &buf);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Failed to build public key filename: %s",
-		      isc_result_totext(result));
-	}
-
-	result = dst_key_tofile(key, options, directory);
-	if (result != ISC_R_SUCCESS) {
-		dst_key_format(key, keystr, sizeof(keystr));
-		fatal("Failed to write key %s: %s", keystr,
-		      isc_result_totext(result));
-	}
-	printf("%s\n", newname);
-
-	isc_buffer_clear(&buf);
-	result = dst_key_buildfilename(key, DST_TYPE_PRIVATE, directory, &buf);
-	if (result != ISC_R_SUCCESS) {
-		fatal("Failed to build private key filename: %s",
-		      isc_result_totext(result));
-	}
-	printf("%s\n", newname);
-
-	if (write_state) {
-		isc_buffer_clear(&buf);
-		result = dst_key_buildfilename(key, DST_TYPE_STATE, directory,
-					       &buf);
-		if (result != ISC_R_SUCCESS) {
-			fatal("Failed to build key state filename: %s",
-			      isc_result_totext(result));
-		}
-		printf("%s\n", newname);
-	}
-}
-
 int
 main(int argc, char **argv) {
 	isc_result_t	result;
 	const char	*engine = NULL;
 	const char 	*filename = NULL;
 	char		*directory = NULL;
+	char		newname[1024];
 	char		keystr[DST_KEY_FORMATSIZE];
 	char		*endp, *p;
 	int		ch;
 	const char	*predecessor = NULL;
 	dst_key_t	*prevkey = NULL;
 	dst_key_t	*key = NULL;
+	isc_buffer_t	buf;
 	dns_name_t	*name = NULL;
 	dns_secalg_t 	alg = 0;
 	unsigned int 	size = 0;
 	uint16_t	flags = 0;
 	int		prepub = -1;
-	int		options;
 	dns_ttl_t	ttl = 0;
 	isc_stdtime_t	now;
-	isc_stdtime_t	dstime = 0, dnskeytime = 0;
-	isc_stdtime_t	krrsigtime = 0, zrrsigtime = 0;
 	isc_stdtime_t	pub = 0, act = 0, rev = 0, inact = 0, del = 0;
 	isc_stdtime_t	prevact = 0, previnact = 0, prevdel = 0;
-	dst_key_state_t	goal = DST_KEY_STATE_NA;
-	dst_key_state_t	ds = DST_KEY_STATE_NA;
-	dst_key_state_t	dnskey = DST_KEY_STATE_NA;
-	dst_key_state_t	krrsig = DST_KEY_STATE_NA;
-	dst_key_state_t	zrrsig = DST_KEY_STATE_NA;
-	bool	setgoal = false, setds = false, setdnskey = false;
-	bool	setkrrsig = false, setzrrsig = false;
-	bool	setdstime = false, setdnskeytime = false;
-	bool	setkrrsigtime = false, setzrrsigtime = false;
 	bool	setpub = false, setact = false;
 	bool	setrev = false, setinact = false;
 	bool	setdel = false, setttl = false;
@@ -223,17 +156,14 @@ main(int argc, char **argv) {
 	bool	printact = false,  printrev = false;
 	bool	printinact = false, printdel = false;
 	bool	force = false;
-	bool	epoch = false;
-	bool	changed = false;
-	bool	write_state = false;
+	bool   epoch = false;
+	bool   changed = false;
 	isc_log_t       *log = NULL;
 	isc_stdtime_t	syncadd = 0, syncdel = 0;
 	bool	unsetsyncadd = false, setsyncadd = false;
 	bool	unsetsyncdel = false, setsyncdel = false;
 	bool	printsyncadd = false, printsyncdel = false;
 
-	options = DST_TYPE_PUBLIC|DST_TYPE_PRIVATE|DST_TYPE_STATE;
-
 	if (argc == 1)
 		usage();
 
@@ -250,7 +180,7 @@ main(int argc, char **argv) {
 
 	isc_stdtime_get(&now);
 
-#define CMDLINE_FLAGS "A:D:d:E:fg:hI:i:K:k:L:P:p:R:r:S:suv:Vz:"
+#define CMDLINE_FLAGS "A:D:E:fhI:i:K:L:P:p:R:S:uv:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case 'E':
@@ -409,70 +339,6 @@ main(int argc, char **argv) {
 		case 'i':
 			prepub = strtottl(isc_commandline_argument);
 			break;
-		case 's':
-			write_state = true;
-			break;
-		case 'g':
-			if (setgoal) {
-				fatal("-g specified more than once");
-			}
-
-			goal = strtokeystate(isc_commandline_argument);
-			if (goal != DST_KEY_STATE_NA &&
-			    goal != DST_KEY_STATE_HIDDEN &&
-			    goal != DST_KEY_STATE_OMNIPRESENT) {
-				fatal("-g must be either none, hidden, or "
-				      "omnipresent");
-			}
-			setgoal = true;
-			break;
-		case 'd':
-			if (setds) {
-				fatal("-d specified more than once");
-			}
-
-			ds = strtokeystate(isc_commandline_argument);
-			setds = true;
-			/* time */
-			(void)isoptarg(isc_commandline_argument, argv, usage);
-			dstime = strtotime(isc_commandline_argument,
-					   now, now, &setdstime);
-			break;
-		case 'k':
-			if (setdnskey) {
-				fatal("-k specified more than once");
-			}
-
-			dnskey = strtokeystate(isc_commandline_argument);
-			setdnskey = true;
-			/* time */
-			(void)isoptarg(isc_commandline_argument, argv, usage);
-			dnskeytime = strtotime(isc_commandline_argument,
-					       now, now, &setdnskeytime);
-			break;
-		case 'r':
-			if (setkrrsig) {
-				fatal("-r specified more than once");
-			}
-
-			krrsig = strtokeystate(isc_commandline_argument);
-			setkrrsig = true;
-			/* time */
-			(void)isoptarg(isc_commandline_argument, argv, usage);
-			krrsigtime = strtotime(isc_commandline_argument,
-					       now, now, &setkrrsigtime);
-			break;
-		case 'z':
-			if (setzrrsig) {
-				fatal("-z specified more than once");
-			}
-
-			zrrsig = strtokeystate(isc_commandline_argument);
-			setzrrsig = true;
-			(void)isoptarg(isc_commandline_argument, argv, usage);
-			zrrsigtime = strtotime(isc_commandline_argument,
-					       now, now, &setzrrsigtime);
-			break;
 		case '?':
 			if (isc_commandline_option != '?')
 				fprintf(stderr, "%s: invalid argument -%c\n",
@@ -499,12 +365,6 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("Extraneous arguments");
 
-	if ((setgoal || setds || setdnskey || setkrrsig || setzrrsig) &&
-	    !write_state)
-	{
-		fatal("Options -g, -d, -k, -r and -z require -s to be set");
-	}
-
 	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS)
 		fatal("Could not initialize dst: %s",
@@ -521,7 +381,9 @@ main(int argc, char **argv) {
 		if (setact || unsetact)
 			fatal("-S and -A cannot be used together");
 
-		result = dst_key_fromnamedfile(predecessor, directory, options,
+		result = dst_key_fromnamedfile(predecessor, directory,
+					       DST_TYPE_PUBLIC |
+					       DST_TYPE_PRIVATE,
 					       mctx, &prevkey);
 		if (result != ISC_R_SUCCESS)
 			fatal("Invalid keyfile %s: %s",
@@ -613,8 +475,9 @@ main(int argc, char **argv) {
 			      isc_result_totext(result));
 	}
 
-	result = dst_key_fromnamedfile(filename, directory, options, mctx,
-				       &key);
+	result = dst_key_fromnamedfile(filename, directory,
+				       DST_TYPE_PUBLIC | DST_TYPE_PRIVATE,
+				       mctx, &key);
 	if (result != ISC_R_SUCCESS)
 		fatal("Invalid keyfile %s: %s",
 		      filename, isc_result_totext(result));
@@ -715,11 +578,6 @@ main(int argc, char **argv) {
 	if (setttl)
 		dst_key_setttl(key, ttl);
 
-	if (predecessor != NULL && prevkey != NULL) {
-		dst_key_setnum(prevkey, DST_NUM_SUCCESSOR, dst_key_id(key));
-		dst_key_setnum(key, DST_NUM_PREDECESSOR, dst_key_id(prevkey));
-	}
-
 	/*
 	 * No metadata changes were made but we're forcing an upgrade
 	 * to the new format anyway: use "-P now -A now" as the default
@@ -730,63 +588,6 @@ main(int argc, char **argv) {
 		changed = true;
 	}
 
-	/*
-	 * Make sure the key state goals are written.
-	 */
-	if (write_state) {
-		if (setgoal) {
-			if (goal == DST_KEY_STATE_NA) {
-				dst_key_unsetstate(key, DST_KEY_GOAL);
-			} else {
-				dst_key_setstate(key, DST_KEY_GOAL, goal);
-			}
-			changed = true;
-		}
-		if (setds) {
-			if (ds == DST_KEY_STATE_NA) {
-				dst_key_unsetstate(key, DST_KEY_DS);
-				dst_key_unsettime(key, DST_TIME_DS);
-			} else {
-				dst_key_setstate(key, DST_KEY_DS, ds);
-				dst_key_settime(key, DST_TIME_DS, dstime);
-			}
-			changed = true;
-		}
-		if (setdnskey) {
-			if (dnskey == DST_KEY_STATE_NA) {
-				dst_key_unsetstate(key, DST_KEY_DNSKEY);
-				dst_key_unsettime(key, DST_TIME_DNSKEY);
-			} else {
-				dst_key_setstate(key, DST_KEY_DNSKEY, dnskey);
-				dst_key_settime(key, DST_TIME_DNSKEY,
-						dnskeytime);
-			}
-			changed = true;
-		}
-		if (setkrrsig) {
-			if (krrsig == DST_KEY_STATE_NA) {
-				dst_key_unsetstate(key, DST_KEY_KRRSIG);
-				dst_key_unsettime(key, DST_TIME_KRRSIG);
-			} else {
-				dst_key_setstate(key, DST_KEY_KRRSIG, krrsig);
-				dst_key_settime(key, DST_TIME_KRRSIG,
-						krrsigtime);
-			}
-			changed = true;
-		}
-		if (setzrrsig) {
-			if (zrrsig == DST_KEY_STATE_NA) {
-				dst_key_unsetstate(key, DST_KEY_ZRRSIG);
-				dst_key_unsettime(key, DST_TIME_ZRRSIG);
-			} else {
-				dst_key_setstate(key, DST_KEY_ZRRSIG, zrrsig);
-				dst_key_settime(key, DST_TIME_ZRRSIG,
-						zrrsigtime);
-			}
-			changed = true;
-		}
-	}
-
 	if (!changed && setttl)
 		changed = true;
 
@@ -820,10 +621,32 @@ main(int argc, char **argv) {
 			  epoch, stdout);
 
 	if (changed) {
-		writekey(key, directory, write_state);
-		if (predecessor != NULL && prevkey != NULL) {
-			writekey(prevkey, directory, write_state);
+		isc_buffer_init(&buf, newname, sizeof(newname));
+		result = dst_key_buildfilename(key, DST_TYPE_PUBLIC, directory,
+					       &buf);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Failed to build public key filename: %s",
+			      isc_result_totext(result));
 		}
+
+		result = dst_key_tofile(key, DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
+					directory);
+		if (result != ISC_R_SUCCESS) {
+			dst_key_format(key, keystr, sizeof(keystr));
+			fatal("Failed to write key %s: %s", keystr,
+			      isc_result_totext(result));
+		}
+
+		printf("%s\n", newname);
+
+		isc_buffer_clear(&buf);
+		result = dst_key_buildfilename(key, DST_TYPE_PRIVATE, directory,
+					       &buf);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Failed to build private key filename: %s",
+			      isc_result_totext(result));
+		}
+		printf("%s\n", newname);
 	}
 
 	if (prevkey != NULL)

bin/dnssec/dnssec-settime.docbook

@@ -64,12 +64,6 @@
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
       <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-s</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-g <replaceable class="parameter">state</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-d <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-k <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-z <replaceable class="parameter">state</replaceable> <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="req" rep="norepeat">keyfile</arg>
     </cmdsynopsis>
   </refsynopsisdiv>
@@ -94,30 +88,11 @@
       When key metadata fields are changed, both files of a key
       pair (<filename>Knnnn.+aaa+iiiii.key</filename> and
       <filename>Knnnn.+aaa+iiiii.private</filename>) are regenerated.
-    </para>
-    <para>
       Metadata fields are stored in the private file.  A human-readable
       description of the metadata is also placed in comments in the key
       file.  The private file's permissions are always set to be
       inaccessible to anyone other than the owner (mode 0600).
     </para>
-    <para>
-      When working with state files, it is possible to update the timing
-      metadata in those files as well with <option>-s</option>.  If this
-      option is used you can also update key states with <option>-d</option>
-      (DS), <option>-k</option> (DNSKEY), <option>-r</option> (RRSIG of KSK),
-      or <option>-z</option> (RRSIG of ZSK). Allowed states are HIDDEN,
-      RUMOURED, OMNIPRESENT, and UNRETENTIVE.
-    </para>
-    <para>
-      You can also set the goal state of the key with <option>-g</option>.
-      This should be either HIDDEN or OMNIPRESENT (representing whether the
-      key should be removed from the zone, or published).
-    </para>
-    <para>
-      It is NOT RECOMMENDED to manipulate state files manually except for
-      testing purposes.
-    </para>
   </refsection>
 
   <refsection><info><title>OPTIONS</title></info>
@@ -344,74 +319,6 @@
     </variablelist>
   </refsection>
 
-  <refsection><info><title>KEY STATE OPTIONS</title></info>
-
-    <para>
-      Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE.
-      These should not be set manually except for testing purposes.
-    </para>
-
-    <variablelist>
-
-      <varlistentry>
-        <term>-s</term>
-        <listitem>
-          <para>
-	    When setting key timing data, also update the state file.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-g</term>
-        <listitem>
-          <para>
-	    Set the goal state for this key. Must be HIDDEN or OMNIPRESENT.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-d</term>
-        <listitem>
-          <para>
-	    Set the DS state for this key, and when it was last changed.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-k</term>
-        <listitem>
-          <para>
-	    Set the DNSKEY state for this key, and when it was last changed.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-r</term>
-        <listitem>
-          <para>
-	    Set the RRSIG (KSK) state for this key, and when it was last
-	    changed.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-z</term>
-        <listitem>
-          <para>
-	    Set the RRSIG (ZSK) state for this key, and when it was last
-	    changed.
-          </para>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-  </refsection>
-
   <refsection><info><title>PRINTING OPTIONS</title></info>
 
     <para>

bin/dnssec/dnssec-signzone.c

@@ -787,10 +787,7 @@ hashlist_comp(const void *a, const void *b) {
 
 static void
 hashlist_sort(hashlist_t *l) {
-	INSIST(l->hashbuf != NULL || l->length == 0);
-	if (l->length > 0) {
-		qsort(l->hashbuf, l->entries, l->length, hashlist_comp);
-	}
+	qsort(l->hashbuf, l->entries, l->length, hashlist_comp);
 }
 
 static bool
@@ -2717,7 +2714,7 @@ build_final_keylist(void) {
 	 * Update keylist with information from from the key repository.
 	 */
 	dns_dnssec_updatekeys(&keylist, &matchkeys, NULL, gorigin, keyttl,
-			      &diff, mctx, report);
+			      &diff, ignore_kskflag, mctx, report);
 
 	/*
 	 * Update keylist with sync records.
@@ -3797,7 +3794,7 @@ main(int argc, char *argv[]) {
 	print_time(outfp);
 	print_version(outfp);
 
-	result = isc_taskmgr_create(mctx, ntasks, 0, NULL, &taskmgr);
+	result = isc_taskmgr_create(mctx, ntasks, 0, &taskmgr);
 	if (result != ISC_R_SUCCESS)
 		fatal("failed to create task manager: %s",
 		      isc_result_totext(result));

bin/dnssec/dnssectool.c

@@ -57,11 +57,6 @@
 
 #include "dnssectool.h"
 
-#define KEYSTATES_NVALUES 4
-static const char *keystates[KEYSTATES_NVALUES] = {
-	"hidden", "rumoured", "omnipresent", "unretentive",
-};
-
 int verbose = 0;
 bool quiet = false;
 uint8_t dtype[8];
@@ -249,21 +244,6 @@ strtottl(const char *str) {
 	return (ttl);
 }
 
-dst_key_state_t
-strtokeystate(const char *str) {
-	if (isnone(str)) {
-		return (DST_KEY_STATE_NA);
-	}
-
-	for (int i = 0; i < KEYSTATES_NVALUES; i++) {
-		if (keystates[i] != NULL &&
-		    strcasecmp(str, keystates[i]) == 0) {
-			return (dst_key_state_t) i;
-		}
-	}
-	fatal("unknown key state");
-}
-
 isc_stdtime_t
 strtotime(const char *str, int64_t now, int64_t base,
 	  bool *setp)

bin/dnssec/dnssectool.h

@@ -17,11 +17,14 @@
 #include <stdbool.h>
 
 #include <isc/log.h>
-#include <isc/platform.h>
 #include <isc/stdtime.h>
 #include <dns/rdatastruct.h>
 #include <dst/dst.h>
 
+#ifndef PATH_MAX
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#endif
+
 /*! verbosity: set by -v and -q option in each program, defined in dnssectool.c */
 extern int verbose;
 extern bool quiet;
@@ -68,8 +71,6 @@ cleanup_logging(isc_log_t **logp);
 
 dns_ttl_t strtottl(const char *str);
 
-dst_key_state_t strtokeystate(const char *str);
-
 isc_stdtime_t
 strtotime(const char *str, int64_t now, int64_t base,
 	  bool *setp);

bin/dnssec/win32/keygen.vcxproj.in

@@ -66,15 +66,15 @@
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
       <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\win32;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -94,7 +94,7 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\win32;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
       <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
@@ -104,8 +104,8 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>

bin/named/config.c

@@ -58,7 +58,6 @@ options {\n\
 "\
 #	deallocate-on-exit <obsolete>;\n\
 #	directory <none>\n\
-	dnssec-policy \"none\";\n\
 	dump-file \"named_dump.db\";\n\
 	edns-udp-size 4096;\n\
 #	fake-iquery <obsolete>;\n"
@@ -66,7 +65,7 @@ options {\n\
 "	files unlimited;\n"
 #endif
 #if defined(HAVE_GEOIP2) && !defined(WIN32)
-"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
+"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
 #elif defined(HAVE_GEOIP2)
 "	geoip-directory \".\";\n"
 #endif
@@ -194,7 +193,7 @@ options {\n\
 #	sortlist <none>\n\
 	stale-answer-enable false;\n\
 	stale-answer-ttl 1; /* 1 second */\n\
-	synth-from-dnssec no;\n\
+	synth-from-dnssec yes;\n\
 #	topology <none>\n\
 	transfer-format many-answers;\n\
 	v6-bias 50;\n\

bin/named/include/named/globals.h

@@ -19,7 +19,6 @@
 #include <isc/rwlock.h>
 #include <isc/log.h>
 #include <isc/net.h>
-#include <isc/netmgr.h>
 
 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
@@ -63,7 +62,6 @@ EXTERN bool		named_g_run_done	INIT(false);
  */
 EXTERN isc_timermgr_t *		named_g_timermgr	INIT(NULL);
 EXTERN isc_socketmgr_t *	named_g_socketmgr	INIT(NULL);
-EXTERN isc_nm_t *		named_g_nm		INIT(NULL);
 EXTERN cfg_parser_t *		named_g_parser		INIT(NULL);
 EXTERN cfg_parser_t *		named_g_addparser	INIT(NULL);
 EXTERN const char *		named_g_version		INIT(VERSION);
@@ -137,6 +135,14 @@ EXTERN const char *		named_g_defaultpidfile 	INIT(NAMED_LOCALSTATEDIR
 							     "/run/named.pid");
 #endif
 
+#ifdef HAVE_DNSTAP
+EXTERN const char *		named_g_defaultdnstap
+					INIT(NAMED_LOCALSTATEDIR "/run/named/"
+							      "dnstap.sock");
+#else
+EXTERN const char *		named_g_defaultdnstap	INIT(NULL);
+#endif /* HAVE_DNSTAP */
+
 EXTERN const char *		named_g_username	INIT(NULL);
 
 EXTERN const char *		named_g_engine		INIT(NULL);

bin/named/include/named/server.h

@@ -64,7 +64,6 @@ struct named_server {
 	dns_loadmgr_t *		loadmgr;
 	dns_zonemgr_t *		zonemgr;
 	dns_viewlist_t		viewlist;
-	dns_kasplist_t		kasplist;
 	ns_interfacemgr_t *	interfacemgr;
 	dns_db_t *		in_roothints;
 

bin/named/include/named/zoneconf.h

@@ -27,18 +27,19 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
-		     dns_kasplist_t* kasplist, dns_zone_t *zone,
-		     dns_zone_t *raw);
+		     dns_zone_t *zone, dns_zone_t *raw);
 /*%<
  * Configure or reconfigure a zone according to the named.conf
- * data.
+ * data in 'cctx' and 'czone'.
  *
  * The zone origin is not configured, it is assumed to have been set
  * at zone creation time.
  *
  * Require:
+ * \li	'lctx' to be initialized or NULL.
+ * \li	'cctx' to be initialized or NULL.
  * \li	'ac' to point to an initialized cfg_aclconfctx_t.
- * \li	'kasplist' to be initialized.
+ * \li	'czone' to be initialized.
  * \li	'zone' to be initialized.
  */
 

bin/named/main.c

@@ -24,7 +24,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
-#include <isc/netmgr.h>
 #include <isc/os.h>
 #include <isc/platform.h>
 #include <isc/print.h>
@@ -68,7 +67,6 @@
 #include <ns/interfacemgr.h>
 
 #include <named/builtin.h>
-#include <named/config.h>
 #include <named/control.h>
 #include <named/fuzz.h>
 #include <named/globals.h>	/* Explicit, though named/log.h includes it. */
@@ -125,6 +123,7 @@ static int		maxudp = 0;
 /*
  * -T options:
  */
+static bool clienttest = false;
 static bool dropedns = false;
 static bool ednsformerr = false;
 static bool ednsnotimp = false;
@@ -484,12 +483,6 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
-#if defined(HAVE_GEOIP2)
-	isc_mem_t *mctx = NULL;
-	cfg_parser_t *parser = NULL;
-	cfg_obj_t *config = NULL;
-	const cfg_obj_t *defaults = NULL, *obj = NULL;
-#endif
 
 	printf("%s %s%s%s <id:%s>\n",
 	       named_g_product, named_g_version,
@@ -576,20 +569,7 @@ OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	printf("  nsupdate session key: %s\n", named_g_defaultsessionkeyfile);
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
 	printf("  named lock file:      %s\n", named_g_defaultlockfile);
-#if defined(HAVE_GEOIP2)
-#define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
-	isc_mem_create(&mctx);
-	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
-	RTC(named_config_parsedefaults(parser, &config));
-	RTC(cfg_map_get(config, "options", &defaults));
-	RTC(cfg_map_get(defaults, "geoip-directory", &obj));
-	if (cfg_obj_isstring(obj)) {
-		printf("  geoip-directory:      %s\n", cfg_obj_asstring(obj));
-	}
-	cfg_obj_destroy(parser, &config);
-	cfg_parser_destroy(&parser);
-	isc_mem_detach(&mctx);
-#endif /* HAVE_GEOIP2 */
+
 }
 
 static void
@@ -622,12 +602,17 @@ parse_T_opt(char *option) {
 	/*
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
+	 *
+	 * clienttest: make clients single shot with their
+	 * 	       own memory context.
 	 * delay=xxxx: delay client responses by xxxx ms to
 	 *	       simulate remote servers.
 	 * dscp=x:     check that dscp values are as
 	 * 	       expected and assert otherwise.
 	 */
-	if (!strncmp(option, "delay=", 6)) {
+	if (!strcmp(option, "clienttest")) {
+		clienttest = true;
+	} else if (!strncmp(option, "delay=", 6)) {
 		delay = atoi(option + 6);
 	} else if (!strcmp(option, "dropedns")) {
 		dropedns = true;
@@ -892,15 +877,8 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface",
 		      named_g_udpdisp, named_g_udpdisp == 1 ? "" : "s");
 
-	named_g_nm = isc_nm_start(named_g_mctx, named_g_cpus);
-	if (named_g_nm == NULL) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				"isc_nm_start() failed");
-		return (ISC_R_UNEXPECTED);
-	}
-
 	result = isc_taskmgr_create(named_g_mctx, named_g_cpus, 0,
-				    named_g_nm, &named_g_taskmgr);
+				    &named_g_taskmgr);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_taskmgr_create() failed: %s",
@@ -925,7 +903,6 @@ create_managers(void) {
 		return (ISC_R_UNEXPECTED);
 	}
 	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
-	isc_nm_maxudp(named_g_nm, maxudp);
 	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -944,7 +921,6 @@ destroy_managers(void) {
 	isc_taskmgr_destroy(&named_g_taskmgr);
 	isc_timermgr_destroy(&named_g_timermgr);
 	isc_socketmgr_destroy(&named_g_socketmgr);
-	isc_nm_destroy(&named_g_nm);
 }
 
 static void
@@ -1258,6 +1234,8 @@ setup(void) {
 	/*
 	 * Modify server context according to command line options
 	 */
+	if (clienttest)
+		ns_server_setoption(sctx, NS_SERVER_CLIENTTEST, true);
 	if (disable4)
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	if (disable6)

bin/named/named.conf.docbook

@@ -208,7 +208,7 @@ options {
 	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
-	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>duration</replaceable> ]; ... };
+	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
@@ -290,18 +290,18 @@ options {
 	fstrm-set-output-notify-threshold <replaceable>integer</replaceable>;
 	fstrm-set-output-queue-model ( mpsc | spsc );
 	fstrm-set-output-queue-size <replaceable>integer</replaceable>;
-	fstrm-set-reopen-interval <replaceable>duration</replaceable>;
+	fstrm-set-reopen-interval <replaceable>ttlval</replaceable>;
 	geoip-directory ( <replaceable>quoted_string</replaceable> | none );
 	glue-cache <replaceable>boolean</replaceable>;
 	heartbeat-interval <replaceable>integer</replaceable>;
 	hostname ( <replaceable>quoted_string</replaceable> | none );
 	inline-signing <replaceable>boolean</replaceable>;
-	interface-interval <replaceable>duration</replaceable>;
+	interface-interval <replaceable>ttlval</replaceable>;
 	ixfr-from-differences ( primary | master | secondary | slave |
 	    <replaceable>boolean</replaceable> );
 	keep-response-order { <replaceable>address_match_element</replaceable>; ... };
 	key-directory <replaceable>quoted_string</replaceable>;
-	lame-ttl <replaceable>duration</replaceable>;
+	lame-ttl <replaceable>ttlval</replaceable>;
 	listen-on [ port <replaceable>integer</replaceable> ] [ dscp
 	    <replaceable>integer</replaceable> ] {
 	    <replaceable>address_match_element</replaceable>; ... };
@@ -315,28 +315,28 @@ options {
 	masterfile-style ( full | relative );
 	match-mapped-addresses <replaceable>boolean</replaceable>;
 	max-cache-size ( default | unlimited | <replaceable>sizeval</replaceable> | <replaceable>percentage</replaceable> );
-	max-cache-ttl <replaceable>duration</replaceable>;
+	max-cache-ttl <replaceable>ttlval</replaceable>;
 	max-clients-per-query <replaceable>integer</replaceable>;
 	max-journal-size ( default | unlimited | <replaceable>sizeval</replaceable> );
-	max-ncache-ttl <replaceable>duration</replaceable>;
+	max-ncache-ttl <replaceable>ttlval</replaceable>;
 	max-records <replaceable>integer</replaceable>;
 	max-recursion-depth <replaceable>integer</replaceable>;
 	max-recursion-queries <replaceable>integer</replaceable>;
 	max-refresh-time <replaceable>integer</replaceable>;
 	max-retry-time <replaceable>integer</replaceable>;
 	max-rsa-exponent-size <replaceable>integer</replaceable>;
-	max-stale-ttl <replaceable>duration</replaceable>;
+	max-stale-ttl <replaceable>ttlval</replaceable>;
 	max-transfer-idle-in <replaceable>integer</replaceable>;
 	max-transfer-idle-out <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
 	max-udp-size <replaceable>integer</replaceable>;
-	max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	memstatistics <replaceable>boolean</replaceable>;
 	memstatistics-file <replaceable>quoted_string</replaceable>;
 	message-compression <replaceable>boolean</replaceable>;
-	min-cache-ttl <replaceable>duration</replaceable>;
-	min-ncache-ttl <replaceable>duration</replaceable>;
+	min-cache-ttl <replaceable>ttlval</replaceable>;
+	min-ncache-ttl <replaceable>ttlval</replaceable>;
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
@@ -353,8 +353,8 @@ options {
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ]
 	    [ dscp <replaceable>integer</replaceable> ];
 	notify-to-soa <replaceable>boolean</replaceable>;
-	nta-lifetime <replaceable>duration</replaceable>;
-	nta-recheck <replaceable>duration</replaceable>;
+	nta-lifetime <replaceable>ttlval</replaceable>;
+	nta-recheck <replaceable>ttlval</replaceable>;
 	nxdomain-redirect <replaceable>string</replaceable>;
 	pid-file ( <replaceable>quoted_string</replaceable> | none );
 	port <replaceable>integer</replaceable>;
@@ -401,13 +401,13 @@ options {
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
 	response-policy { zone <replaceable>string</replaceable> [ add-soa <replaceable>boolean</replaceable> ] [ log
-	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [ min-update-interval
-	    <replaceable>duration</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
+	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval
+	    <replaceable>ttlval</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
 	    nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
 	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ add-soa <replaceable>boolean</replaceable> ] [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [
-	    min-update-interval <replaceable>duration</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
+	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
 	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
 	    [ recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ] [ dnsrps-enable <replaceable>boolean</replaceable> ] [
@@ -421,7 +421,7 @@ options {
 	serial-query-rate <replaceable>integer</replaceable>;
 	serial-update-method ( date | increment | unixtime );
 	server-id ( <replaceable>quoted_string</replaceable> | none | hostname );
-	servfail-ttl <replaceable>duration</replaceable>;
+	servfail-ttl <replaceable>ttlval</replaceable>;
 	session-keyalg <replaceable>string</replaceable>;
 	session-keyfile ( <replaceable>quoted_string</replaceable> | none );
 	session-keyname <replaceable>string</replaceable>;
@@ -432,7 +432,7 @@ options {
 	sortlist { <replaceable>address_match_element</replaceable>; ... };
 	stacksize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	stale-answer-enable <replaceable>boolean</replaceable>;
-	stale-answer-ttl <replaceable>duration</replaceable>;
+	stale-answer-ttl <replaceable>ttlval</replaceable>;
 	startup-notify-rate <replaceable>integer</replaceable>;
 	statistics-file <replaceable>quoted_string</replaceable>;
 	synth-from-dnssec <replaceable>boolean</replaceable>;
@@ -564,7 +564,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    [ dscp <replaceable>integer</replaceable> ] { ( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port <replaceable>integer</replaceable> ] ) [ key
 	    <replaceable>string</replaceable> ]; ... } ] [ zone-directory <replaceable>quoted_string</replaceable> ] [
-	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>duration</replaceable> ]; ... };
+	    in-memory <replaceable>boolean</replaceable> ] [ min-update-interval <replaceable>ttlval</replaceable> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
@@ -642,7 +642,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		secret <replaceable>string</replaceable>;
 	};
 	key-directory <replaceable>quoted_string</replaceable>;
-	lame-ttl <replaceable>duration</replaceable>;
+	lame-ttl <replaceable>ttlval</replaceable>;
 	lmdb-mapsize <replaceable>sizeval</replaceable>;
 	managed-keys { <replaceable>string</replaceable> (
 	    static-key | initial-key
@@ -655,25 +655,25 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	match-destinations { <replaceable>address_match_element</replaceable>; ... };
 	match-recursive-only <replaceable>boolean</replaceable>;
 	max-cache-size ( default | unlimited | <replaceable>sizeval</replaceable> | <replaceable>percentage</replaceable> );
-	max-cache-ttl <replaceable>duration</replaceable>;
+	max-cache-ttl <replaceable>ttlval</replaceable>;
 	max-clients-per-query <replaceable>integer</replaceable>;
 	max-journal-size ( default | unlimited | <replaceable>sizeval</replaceable> );
-	max-ncache-ttl <replaceable>duration</replaceable>;
+	max-ncache-ttl <replaceable>ttlval</replaceable>;
 	max-records <replaceable>integer</replaceable>;
 	max-recursion-depth <replaceable>integer</replaceable>;
 	max-recursion-queries <replaceable>integer</replaceable>;
 	max-refresh-time <replaceable>integer</replaceable>;
 	max-retry-time <replaceable>integer</replaceable>;
-	max-stale-ttl <replaceable>duration</replaceable>;
+	max-stale-ttl <replaceable>ttlval</replaceable>;
 	max-transfer-idle-in <replaceable>integer</replaceable>;
 	max-transfer-idle-out <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
 	max-udp-size <replaceable>integer</replaceable>;
-	max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	message-compression <replaceable>boolean</replaceable>;
-	min-cache-ttl <replaceable>duration</replaceable>;
-	min-ncache-ttl <replaceable>duration</replaceable>;
+	min-cache-ttl <replaceable>ttlval</replaceable>;
+	min-ncache-ttl <replaceable>ttlval</replaceable>;
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
@@ -689,8 +689,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ]
 	    [ dscp <replaceable>integer</replaceable> ];
 	notify-to-soa <replaceable>boolean</replaceable>;
-	nta-lifetime <replaceable>duration</replaceable>;
-	nta-recheck <replaceable>duration</replaceable>;
+	nta-lifetime <replaceable>ttlval</replaceable>;
+	nta-recheck <replaceable>ttlval</replaceable>;
 	nxdomain-redirect <replaceable>string</replaceable>;
 	plugin ( query ) <replaceable>string</replaceable> [ {
 	    <replaceable>unspecified-text</replaceable> } ];
@@ -732,13 +732,13 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	response-padding { <replaceable>address_match_element</replaceable>; ... } block-size
 	    <replaceable>integer</replaceable>;
 	response-policy { zone <replaceable>string</replaceable> [ add-soa <replaceable>boolean</replaceable> ] [ log
-	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [ min-update-interval
-	    <replaceable>duration</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
+	    <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [ min-update-interval
+	    <replaceable>ttlval</replaceable> ] [ policy ( cname | disabled | drop | given | no-op |
 	    nodata | nxdomain | passthru | tcp-only <replaceable>quoted_string</replaceable> ) ] [
 	    recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ]; ... } [ add-soa <replaceable>boolean</replaceable> ] [
-	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>duration</replaceable> ] [
-	    min-update-interval <replaceable>duration</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
+	    break-dnssec <replaceable>boolean</replaceable> ] [ max-policy-ttl <replaceable>ttlval</replaceable> ] [
+	    min-update-interval <replaceable>ttlval</replaceable> ] [ min-ns-dots <replaceable>integer</replaceable> ] [
 	    nsip-wait-recurse <replaceable>boolean</replaceable> ] [ qname-wait-recurse <replaceable>boolean</replaceable> ]
 	    [ recursive-only <replaceable>boolean</replaceable> ] [ nsip-enable <replaceable>boolean</replaceable> ] [
 	    nsdname-enable <replaceable>boolean</replaceable> ] [ dnsrps-enable <replaceable>boolean</replaceable> ] [
@@ -783,14 +783,14 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		    <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
 		transfers <replaceable>integer</replaceable>;
 	};
-	servfail-ttl <replaceable>duration</replaceable>;
+	servfail-ttl <replaceable>ttlval</replaceable>;
 	sig-signing-nodes <replaceable>integer</replaceable>;
 	sig-signing-signatures <replaceable>integer</replaceable>;
 	sig-signing-type <replaceable>integer</replaceable>;
 	sig-validity-interval <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	sortlist { <replaceable>address_match_element</replaceable>; ... };
 	stale-answer-enable <replaceable>boolean</replaceable>;
-	stale-answer-ttl <replaceable>duration</replaceable>;
+	stale-answer-ttl <replaceable>ttlval</replaceable>;
 	synth-from-dnssec <replaceable>boolean</replaceable>;
 	transfer-format ( many-answers | one-answer );
 	transfer-source ( <replaceable>ipv4_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * ) ] [
@@ -842,7 +842,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		dnskey-sig-validity <replaceable>integer</replaceable>;
 		dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
 		dnssec-loadkeys-interval <replaceable>integer</replaceable>;
-		dnssec-policy <replaceable>string</replaceable>;
 		dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 		dnssec-update-mode ( maintain | no-resign );
 		file <replaceable>quoted_string</replaceable>;
@@ -868,7 +867,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		max-transfer-idle-out <replaceable>integer</replaceable>;
 		max-transfer-time-in <replaceable>integer</replaceable>;
 		max-transfer-time-out <replaceable>integer</replaceable>;
-		max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+		max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 		min-refresh-time <replaceable>integer</replaceable>;
 		min-retry-time <replaceable>integer</replaceable>;
 		multi-master <replaceable>boolean</replaceable>;
@@ -944,7 +943,6 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnskey-sig-validity <replaceable>integer</replaceable>;
 	dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
 	dnssec-loadkeys-interval <replaceable>integer</replaceable>;
-	dnssec-policy <replaceable>string</replaceable>;
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	file <replaceable>quoted_string</replaceable>;
@@ -969,7 +967,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	max-transfer-idle-out <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
-	max-zone-ttl ( unlimited | <replaceable>duration</replaceable> );
+	max-zone-ttl ( unlimited | <replaceable>ttlval</replaceable> );
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
@@ -1010,26 +1008,6 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 </literallayout>
   </refsection>
 
-  <refsection><info><title>DNSSEC-POLICY</title></info>
-
-    <literallayout class="normal">
-dnssec-policy <replaceable>string</replaceable> {
-	dnskey-ttl <replaceable>ttlval</replaceable>;
-	keys { ( csk | ksk | zsk ) key-directory lifetime <replaceable>duration</replaceable> algorithm <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ] ; ... };
-	parent-ds-ttl <replaceable>duration</replaceable>;
-	parent-propagation-delay <replaceable>duration</replaceable>;
-	parent-registration-delay <replaceable>duration</replaceable>;
-	publish-safety <replaceable>duration</replaceable>;
-	retire-safety <replaceable>duration</replaceable>;
-	signatures-refresh <replaceable>duration</replaceable>;
-	signatures-validity <replaceable>duration</replaceable>;
-	signatures-validity-dnskey <replaceable>duration</replaceable>;
-	zone-max-ttl <replaceable>duration</replaceable>;
-	zone-propagation-delay <replaceable>duration</replaceable>;
-};
-</literallayout>
-  </refsection>
-
   <refsection><info><title>FILES</title></info>
 
     <para><filename>/etc/named.conf</filename>

bin/named/server.c

@@ -50,7 +50,6 @@
 #include <isc/util.h>
 
 #include <isccfg/grammar.h>
-#include <isccfg/kaspconf.h>
 #include <isccfg/namedconf.h>
 
 #include <bind9/check.h>
@@ -69,7 +68,6 @@
 #include <dns/forward.h>
 #include <dns/fixedname.h>
 #include <dns/journal.h>
-#include <dns/kasp.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
 #include <dns/lib.h>
@@ -136,6 +134,10 @@
 #define dumpzone dumpzone_file
 #endif /* HAVE_LMDB */
 
+#ifndef PATH_MAX
+#define PATH_MAX 1024
+#endif
+
 #ifndef SIZE_MAX
 #define SIZE_MAX ((size_t)-1)
 #endif
@@ -457,8 +459,8 @@ configure_alternates(const cfg_obj_t *config, dns_view_t *view,
 static isc_result_t
 configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	       const cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
-	       dns_viewlist_t *viewlist, dns_kasplist_t* kasplist,
-	       cfg_aclconfctx_t *aclconf, bool added, bool old_rpz_ok,
+	       dns_viewlist_t *viewlist, cfg_aclconfctx_t *aclconf,
+	       bool added, bool old_rpz_ok,
 	       bool modify);
 
 static isc_result_t
@@ -2037,13 +2039,7 @@ conf_dnsrps_num(const cfg_obj_t *obj, const char *name,
 		return;
 	}
 
-	if (cfg_obj_isduration(sub_obj)) {
-		conf_dnsrps_sadd(ctx, " %s %d", name,
-				 cfg_obj_asduration(sub_obj));
-	} else {
-		conf_dnsrps_sadd(ctx, " %s %d", name,
-				 cfg_obj_asuint32(sub_obj));
-	}
+	conf_dnsrps_sadd(ctx, " %s %d", name, cfg_obj_asuint32(sub_obj));
 }
 
 /*
@@ -2225,15 +2221,15 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 	}
 
 	obj = cfg_tuple_get(rpz_obj, "max-policy-ttl");
-	if (cfg_obj_isduration(obj)) {
-		zone->max_policy_ttl = cfg_obj_asduration(obj);
+	if (cfg_obj_isuint32(obj)) {
+		zone->max_policy_ttl = cfg_obj_asuint32(obj);
 	} else {
 		zone->max_policy_ttl = ttl_default;
 	}
 
 	obj = cfg_tuple_get(rpz_obj, "min-update-interval");
-	if (cfg_obj_isduration(obj)) {
-		zone->min_update_interval = cfg_obj_asduration(obj);
+	if (cfg_obj_isuint32(obj)) {
+		zone->min_update_interval = cfg_obj_asuint32(obj);
 	} else {
 		zone->min_update_interval = minupdateinterval_default;
 	}
@@ -2452,14 +2448,14 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 	}
 
 	sub_obj = cfg_tuple_get(rpz_obj, "max-policy-ttl");
-	if (cfg_obj_isduration(sub_obj))
-		ttl_default = cfg_obj_asduration(sub_obj);
+	if (cfg_obj_isuint32(sub_obj))
+		ttl_default = cfg_obj_asuint32(sub_obj);
 	else
 		ttl_default = DNS_RPZ_MAX_TTL_DEFAULT;
 
 	sub_obj = cfg_tuple_get(rpz_obj, "min-update-interval");
-	if (cfg_obj_isduration(sub_obj))
-		minupdateinterval_default = cfg_obj_asduration(sub_obj);
+	if (cfg_obj_isuint32(sub_obj))
+		minupdateinterval_default = cfg_obj_asuint32(sub_obj);
 	else
 		minupdateinterval_default = DNS_RPZ_MINUPDATEINTERVAL_DEFAULT;
 
@@ -2683,8 +2679,7 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 	dns_view_thaw(ev->view);
 	result = configure_zone(cfg->config, zoneobj, cfg->vconfig,
 				ev->cbd->server->mctx, ev->view,
-				&ev->cbd->server->viewlist,
-				&ev->cbd->server->kasplist, cfg->actx,
+				&ev->cbd->server->viewlist, cfg->actx,
 				true, false, ev->mod);
 	dns_view_freeze(ev->view);
 	isc_task_endexclusive(task);
@@ -2997,8 +2992,8 @@ configure_catz_zone(dns_view_t *view, const cfg_obj_t *config,
 	}
 
 	obj = cfg_tuple_get(catz_obj, "min-update-interval");
-	if (obj != NULL && cfg_obj_isduration(obj))
-		opts->min_update_interval = cfg_obj_asduration(obj);
+	if (obj != NULL && cfg_obj_isuint32(obj))
+		opts->min_update_interval = cfg_obj_asuint32(obj);
 
   cleanup:
 	if (pview != NULL)
@@ -3478,7 +3473,7 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 	isc_result_t result;
 	const cfg_obj_t *obj, *obj2;
 	const cfg_listelt_t *element;
-	const char *dpath;
+	const char *dpath = named_g_defaultdnstap;
 	const cfg_obj_t *dlist = NULL;
 	dns_dtmsgtype_t dttypes = 0;
 	unsigned int i;
@@ -3646,7 +3641,7 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 		result = named_config_get(maps, "fstrm-set-reopen-interval",
 				       &obj);
 		if (result == ISC_R_SUCCESS) {
-			i = cfg_obj_asduration(obj);
+			i = cfg_obj_asuint32(obj);
 			fstrm_iothr_options_set_reopen_interval(fopt, i);
 		}
 
@@ -3769,10 +3764,11 @@ register_one_plugin(const cfg_obj_t *config, const cfg_obj_t *obj,
  * global defaults in 'config' used exclusively.
  */
 static isc_result_t
-configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
-	       cfg_obj_t *vconfig, named_cachelist_t *cachelist,
-	       dns_kasplist_t *kasplist, const cfg_obj_t *bindkeys,
-	       isc_mem_t *mctx, cfg_aclconfctx_t *actx, bool need_hints)
+configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
+	       cfg_obj_t *config, cfg_obj_t *vconfig,
+	       named_cachelist_t *cachelist, const cfg_obj_t *bindkeys,
+	       isc_mem_t *mctx, cfg_aclconfctx_t *actx,
+	       bool need_hints)
 {
 	const cfg_obj_t *maps[4];
 	const cfg_obj_t *cfgmaps[3];
@@ -3899,8 +3895,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	{
 		const cfg_obj_t *zconfig = cfg_listelt_value(element);
 		CHECK(configure_zone(config, zconfig, vconfig, mctx, view,
-				     viewlist, kasplist, actx, false,
-				     old_rpz_ok, false));
+				     viewlist, actx, false, old_rpz_ok,
+				     false));
 	}
 
 	/*
@@ -4221,22 +4217,22 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	obj = NULL;
 	result = named_config_get(maps, "max-cache-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	view->maxcachettl = cfg_obj_asduration(obj);
+	view->maxcachettl = cfg_obj_asuint32(obj);
 
 	obj = NULL;
 	result = named_config_get(maps, "max-ncache-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	view->maxncachettl = cfg_obj_asduration(obj);
+	view->maxncachettl = cfg_obj_asuint32(obj);
 
 	obj = NULL;
 	result = named_config_get(maps, "min-cache-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	view->mincachettl = cfg_obj_asduration(obj);
+	view->mincachettl = cfg_obj_asuint32(obj);
 
 	obj = NULL;
 	result = named_config_get(maps, "min-ncache-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	view->minncachettl = cfg_obj_asduration(obj);
+	view->minncachettl = cfg_obj_asuint32(obj);
 
 	obj = NULL;
 	result = named_config_get(maps, "synth-from-dnssec", &obj);
@@ -4246,7 +4242,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	obj = NULL;
 	result = named_config_get(maps, "max-stale-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	max_stale_ttl = ISC_MAX(cfg_obj_asduration(obj), 1);
+	max_stale_ttl = ISC_MAX(cfg_obj_asuint32(obj), 1);
 
 	obj = NULL;
 	result = named_config_get(maps, "stale-answer-enable", &obj);
@@ -4396,7 +4392,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	obj = NULL;
 	result = named_config_get(maps, "stale-answer-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	view->staleanswerttl = ISC_MAX(cfg_obj_asduration(obj), 1);
+	view->staleanswerttl = ISC_MAX(cfg_obj_asuint32(obj), 1);
 
 	/*
 	 * Resolver.
@@ -4516,7 +4512,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	obj = NULL;
 	result = named_config_get(maps, "lame-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	lame_ttl = cfg_obj_asduration(obj);
+	lame_ttl = cfg_obj_asuint32(obj);
 	if (lame_ttl > 1800)
 		lame_ttl = 1800;
 	dns_resolver_setlamettl(view->resolver, lame_ttl);
@@ -5220,12 +5216,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	obj = NULL;
 	result = named_config_get(maps, "nta-recheck", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	view->nta_recheck = cfg_obj_asduration(obj);
+	view->nta_recheck = cfg_obj_asuint32(obj);
 
 	obj = NULL;
 	result = named_config_get(maps, "nta-lifetime", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	view->nta_lifetime = cfg_obj_asduration(obj);
+	view->nta_lifetime = cfg_obj_asuint32(obj);
 
 	obj = NULL;
 	result = named_config_get(maps, "preferred-glue", &obj);
@@ -5468,7 +5464,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	obj = NULL;
 	result = named_config_get(maps, "servfail-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	fail_ttl  = cfg_obj_asduration(obj);
+	fail_ttl  = cfg_obj_asuint32(obj);
 	if (fail_ttl > 30)
 		fail_ttl = 30;
 	dns_view_setfailttl(view, fail_ttl);
@@ -5897,8 +5893,8 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
 static isc_result_t
 configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	       const cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
-	       dns_viewlist_t *viewlist, dns_kasplist_t *kasplist,
-	       cfg_aclconfctx_t *aclconf, bool added, bool old_rpz_ok,
+	       dns_viewlist_t *viewlist, cfg_aclconfctx_t *aclconf,
+	       bool added, bool old_rpz_ok,
 	       bool modify)
 {
 	dns_view_t *pview = NULL;	/* Production view */
@@ -6115,8 +6111,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 						     zone));
 			dns_zone_setstats(zone, named_g_server->zonestats);
 		}
-		CHECK(named_zone_configure(config, vconfig, zconfig, aclconf,
-					   kasplist, zone, NULL));
+		CHECK(named_zone_configure(config, vconfig, zconfig,
+					   aclconf, zone, NULL));
 		dns_zone_attach(zone, &view->redirect);
 		goto cleanup;
 	}
@@ -6253,11 +6249,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	     strcasecmp(ztypestr, "master") == 0 ||
 	     strcasecmp(ztypestr, "secondary") == 0 ||
 	     strcasecmp(ztypestr, "slave") == 0) &&
-	    ((cfg_map_get(zoptions, "inline-signing", &signing) ==
-	      ISC_R_SUCCESS && cfg_obj_asboolean(signing)) ||
-	     (cfg_map_get(zoptions, "dnssec-policy", &signing) ==
-	      ISC_R_SUCCESS && signing != NULL &&
-	      strcmp(cfg_obj_asstring(signing), "none") != 0)))
+	    cfg_map_get(zoptions, "inline-signing", &signing) == ISC_R_SUCCESS &&
+	    cfg_obj_asboolean(signing))
 	{
 		dns_zone_getraw(zone, &raw);
 		if (raw == NULL) {
@@ -6281,8 +6274,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	/*
 	 * Configure the zone.
 	 */
-	CHECK(named_zone_configure(config, vconfig, zconfig, aclconf, kasplist,
-				   zone, raw));
+	CHECK(named_zone_configure(config, vconfig, zconfig,
+				   aclconf, zone, raw));
 
 	/*
 	 * Add the zone to its view in the new view list.
@@ -7574,10 +7567,9 @@ configure_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	     element = cfg_list_next(element))
 	{
 		const cfg_obj_t *zconfig = cfg_listelt_value(element);
-		CHECK(configure_zone(config, zconfig, vconfig, mctx, view,
-				     &named_g_server->viewlist,
-				     &named_g_server->kasplist, actx, true,
-				     false, false));
+		CHECK(configure_zone(config, zconfig, vconfig, mctx,
+				     view, &named_g_server->viewlist, actx,
+				     true, false, false));
 	}
 
 	result = ISC_R_SUCCESS;
@@ -7761,9 +7753,8 @@ configure_newzone(const cfg_obj_t *zconfig, cfg_obj_t *config,
 		  cfg_aclconfctx_t *actx)
 {
 	return (configure_zone(config, zconfig, vconfig, mctx, view,
-			       &named_g_server->viewlist,
-			       &named_g_server->kasplist, actx, true, false,
-			       false));
+			       &named_g_server->viewlist, actx, true,
+			       false, false));
 }
 
 /*%
@@ -7998,13 +7989,9 @@ load_configuration(const char *filename, named_server_t *server,
 	const cfg_obj_t *obj;
 	const cfg_obj_t *options;
 	const cfg_obj_t *usev4ports, *avoidv4ports, *usev6ports, *avoidv6ports;
-	const cfg_obj_t *kasps;
-	dns_kasp_t *kasp = NULL;
-	dns_kasp_t *kasp_next = NULL;
-	dns_kasplist_t tmpkasplist, kasplist;
 	const cfg_obj_t *views;
 	dns_view_t *view = NULL;
-	dns_view_t *view_next = NULL;
+	dns_view_t *view_next;
 	dns_viewlist_t tmpviewlist;
 	dns_viewlist_t viewlist, builtin_viewlist;
 	in_port_t listen_port, udpport_low, udpport_high;
@@ -8033,7 +8020,6 @@ load_configuration(const char *filename, named_server_t *server,
 	dns_aclenv_t *env =
 		ns_interfacemgr_getaclenv(named_g_server->interfacemgr);
 
-	ISC_LIST_INIT(kasplist);
 	ISC_LIST_INIT(viewlist);
 	ISC_LIST_INIT(builtin_viewlist);
 	ISC_LIST_INIT(cachelist);
@@ -8112,7 +8098,6 @@ load_configuration(const char *filename, named_server_t *server,
 	INSIST(result == ISC_R_SUCCESS);
 	CHECKM(setstring(server, &server->bindkeysfile,
 	       cfg_obj_asstring(obj)), "strdup");
-	INSIST(server->bindkeysfile != NULL);
 
 	if (access(server->bindkeysfile, R_OK) == 0) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -8574,7 +8559,7 @@ load_configuration(const char *filename, named_server_t *server,
 	obj = NULL;
 	result = named_config_get(maps, "interface-interval", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	interface_interval = cfg_obj_asduration(obj);
+	interface_interval = cfg_obj_asuint32(obj) * 60;
 	if (interface_interval == 0) {
 		CHECK(isc_timer_reset(server->interface_timer,
 				      isc_timertype_inactive,
@@ -8648,39 +8633,6 @@ load_configuration(const char *filename, named_server_t *server,
 	 */
 	(void)configure_session_key(maps, server, named_g_mctx);
 
-	/*
-	 * Create the DNSSEC key and signing policies (KASP).
-	 */
-	kasps = NULL;
-	(void)cfg_map_get(config, "dnssec-policy", &kasps);
-	for (element = cfg_list_first(kasps);
-	     element != NULL;
-	     element = cfg_list_next(element))
-	{
-		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		kasp = NULL;
-		CHECK(cfg_kasp_fromconfig(kconfig, named_g_mctx, &kasplist,
-					  &kasp));
-		INSIST(kasp != NULL);
-		dns_kasp_freeze(kasp);
-		dns_kasp_detach(&kasp);
-	}
-	/*
-	 * Create the default kasp.
-	 */
-	kasp = NULL;
-	CHECK(cfg_kasp_fromconfig(NULL, named_g_mctx, &kasplist, &kasp));
-	INSIST(kasp != NULL);
-	dns_kasp_freeze(kasp);
-	dns_kasp_detach(&kasp);
-
-	tmpkasplist = server->kasplist;
-	server->kasplist = kasplist;
-	kasplist = tmpkasplist;
-
-	/*
-	 * Configure the views.
-	 */
 	views = NULL;
 	(void)cfg_map_get(config, "view", &views);
 
@@ -8759,8 +8711,8 @@ load_configuration(const char *filename, named_server_t *server,
 		view = NULL;
 		CHECK(find_view(vconfig, &viewlist, &view));
 		CHECK(configure_view(view, &viewlist, config, vconfig,
-				     &cachelist, &server->kasplist, bindkeys,
-				     named_g_mctx, named_g_aclconfctx, true));
+				     &cachelist, bindkeys, named_g_mctx,
+				     named_g_aclconfctx, true));
 		dns_view_freeze(view);
 		dns_view_detach(&view);
 	}
@@ -8773,8 +8725,9 @@ load_configuration(const char *filename, named_server_t *server,
 		view = NULL;
 		CHECK(find_view(NULL, &viewlist, &view));
 		CHECK(configure_view(view, &viewlist, config, NULL,
-				     &cachelist, &server->kasplist, bindkeys,
-				     named_g_mctx, named_g_aclconfctx, true));
+				     &cachelist, bindkeys,
+				     named_g_mctx, named_g_aclconfctx,
+				     true));
 		dns_view_freeze(view);
 		dns_view_detach(&view);
 	}
@@ -8793,8 +8746,9 @@ load_configuration(const char *filename, named_server_t *server,
 
 		CHECK(create_view(vconfig, &builtin_viewlist, &view));
 		CHECK(configure_view(view, &viewlist, config, vconfig,
-				     &cachelist, &server->kasplist, bindkeys,
-				     named_g_mctx, named_g_aclconfctx, false));
+				     &cachelist, bindkeys,
+				     named_g_mctx, named_g_aclconfctx,
+				     false));
 		dns_view_freeze(view);
 		dns_view_detach(&view);
 		view = NULL;
@@ -9230,10 +9184,6 @@ load_configuration(const char *filename, named_server_t *server,
 		dns_view_detach(&view);
 	}
 
-	if (kasp != NULL) {
-		dns_kasp_detach(&kasp);
-	}
-
 	ISC_LIST_APPENDLIST(viewlist, builtin_viewlist, link);
 
 	/*
@@ -9256,15 +9206,6 @@ load_configuration(const char *filename, named_server_t *server,
 		dns_view_detach(&view);
 	}
 
-	/*
-	 * Same cleanup for kasp list.
-	 */
-	for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
-		kasp_next = ISC_LIST_NEXT(kasp, link);
-		ISC_LIST_UNLINK(kasplist, kasp, link);
-		dns_kasp_detach(&kasp);
-	}
-
 	/* Same cleanup for cache list. */
 	while ((nsc = ISC_LIST_HEAD(cachelist)) != NULL) {
 		ISC_LIST_UNLINK(cachelist, nsc, link);
@@ -9458,7 +9399,6 @@ run_server(isc_task_t *task, isc_event_t *event) {
 	CHECKFATAL(ns_interfacemgr_create(named_g_mctx, server->sctx,
 					  named_g_taskmgr, named_g_timermgr,
 					  named_g_socketmgr,
-					  named_g_nm,
 					  named_g_dispatchmgr,
 					  server->task, named_g_udpdisp, geoip,
 					  &server->interfacemgr),
@@ -9513,8 +9453,7 @@ named_server_flushonshutdown(named_server_t *server, bool flush) {
 static void
 shutdown_server(isc_task_t *task, isc_event_t *event) {
 	isc_result_t result;
-	dns_view_t *view, *view_next = NULL;
-	dns_kasp_t *kasp, *kasp_next = NULL;
+	dns_view_t *view, *view_next;
 	named_server_t *server = (named_server_t *)event->ev_arg;
 	bool flush = server->flushonshutdown;
 	named_cache_t *nsc;
@@ -9522,12 +9461,6 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 	UNUSED(task);
 	INSIST(task == server->task);
 
-	/*
-	 * We need to shutdown the interface before going
-	 * exclusive (which would pause the netmgr).
-	 */
-	ns_interfacemgr_shutdown(server->interfacemgr);
-
 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
@@ -9550,17 +9483,9 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 
 	(void) named_server_saventa(server);
 
-	for (kasp = ISC_LIST_HEAD(server->kasplist); kasp != NULL;
-	     kasp = kasp_next)
-	{
-		kasp_next = ISC_LIST_NEXT(kasp, link);
-		ISC_LIST_UNLINK(server->kasplist, kasp, link);
-		dns_kasp_detach(&kasp);
-	}
-
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = view_next)
-	{
+	for (view = ISC_LIST_HEAD(server->viewlist);
+	     view != NULL;
+	     view = view_next) {
 		view_next = ISC_LIST_NEXT(view, link);
 		ISC_LIST_UNLINK(server->viewlist, view, link);
 		if (flush)
@@ -9585,6 +9510,7 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 	isc_timer_detach(&server->pps_timer);
 	isc_timer_detach(&server->tat_timer);
 
+	ns_interfacemgr_shutdown(server->interfacemgr);
 	ns_interfacemgr_detach(&server->interfacemgr);
 
 	dns_dispatchmgr_destroy(&named_g_dispatchmgr);
@@ -9677,7 +9603,6 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 
 	/* Initialize server data structures. */
 	server->interfacemgr = NULL;
-	ISC_LIST_INIT(server->kasplist);
 	ISC_LIST_INIT(server->viewlist);
 	server->in_roothints = NULL;
 
@@ -9865,7 +9790,6 @@ named_server_destroy(named_server_t **serverp) {
 
 	isc_event_free(&server->reload_event);
 
-	INSIST(ISC_LIST_EMPTY(server->kasplist));
 	INSIST(ISC_LIST_EMPTY(server->viewlist));
 	INSIST(ISC_LIST_EMPTY(server->cachelist));
 
@@ -11154,12 +11078,11 @@ named_server_validation(named_server_t *server, isc_lex_t *lex,
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
-		if ((ptr != NULL && strcasecmp(ptr, view->name) != 0)
-		    || strcasecmp("_bind", view->name) == 0)
+		if (ptr != NULL && strcasecmp(ptr, view->name) != 0)
 			continue;
+		CHECK(dns_view_flushcache(view, false));
 
 		if (set) {
-			CHECK(dns_view_flushcache(view, false));
 			view->enablevalidation = enable;
 			changed = true;
 		} else {
@@ -11171,10 +11094,10 @@ named_server_validation(named_server_t *server, isc_lex_t *lex,
 			CHECK(putstr(text, " (view "));
 			CHECK(putstr(text, view->name));
 			CHECK(putstr(text, ")"));
+			CHECK(putnull(text));
 			first = false;
 		}
 	}
-	CHECK(putnull(text));
 
 	if (!set)
 		result = ISC_R_SUCCESS;
@@ -11522,11 +11445,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 		     isc_quota_getmax(&server->sctx->tcpquota));
 	CHECK(putstr(text, line));
 
-	snprintf(line, sizeof(line), "TCP high-water: %u\n",
-		     (unsigned)ns_stats_get_counter(server->sctx->nsstats,
-					  ns_statscounter_tcphighwater));
-	CHECK(putstr(text, line));
-
 	if (server->reload_status != NAMED_RELOAD_DONE) {
 		snprintf(line, sizeof(line), "reload/reconfig %s\n",
 			 server->reload_status == NAMED_RELOAD_FAILED
@@ -11835,10 +11753,7 @@ named_server_rekey(named_server_t *server, isc_lex_t *lex,
 
 	keyopts = dns_zone_getkeyopts(zone);
 
-	/*
-	 * "rndc loadkeys" requires "auto-dnssec maintain"
-	 * or a "dnssec-policy".
-	 */
+	/* "rndc loadkeys" requires "auto-dnssec maintain". */
 	if ((keyopts & DNS_ZONEKEY_ALLOW) == 0)
 		result = ISC_R_NOPERM;
 	else if ((keyopts & DNS_ZONEKEY_MAINTAIN) == 0 && !fullsign)
@@ -13003,8 +12918,7 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	dns_view_thaw(view);
 	result = configure_zone(cfg->config, zoneobj, cfg->vconfig,
 				server->mctx, view, &server->viewlist,
-				&server->kasplist, cfg->actx, true, false,
-				false);
+				cfg->actx, true, false, false);
 	dns_view_freeze(view);
 
 	isc_task_endexclusive(server->task);
@@ -13182,8 +13096,7 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	dns_view_thaw(view);
 	result = configure_zone(cfg->config, zoneobj, cfg->vconfig,
 				server->mctx, view, &server->viewlist,
-				&server->kasplist, cfg->actx, true, false,
-				true);
+				cfg->actx, true, false, true);
 	dns_view_freeze(view);
 
 	exclusive = false;

bin/named/statschannel.c

@@ -241,8 +241,6 @@ init_desc(void) {
 	SET_NSSTATDESC(invalidsig, "requests with invalid signature",
 		       "ReqBadSIG");
 	SET_NSSTATDESC(requesttcp, "TCP requests received", "ReqTCP");
-	SET_NSSTATDESC(tcphighwater, "TCP connection high-water",
-		       "TCPConnHighWater");
 	SET_NSSTATDESC(authrej, "auth queries rejected", "AuthQryRej");
 	SET_NSSTATDESC(recurserej, "recursive queries rejected", "RecQryRej");
 	SET_NSSTATDESC(xfrrej, "transfer requests rejected", "XfrRej");
@@ -324,7 +322,6 @@ init_desc(void) {
 		       "QryUsedStale");
 	SET_NSSTATDESC(prefetch, "queries triggered prefetch", "Prefetch");
 	SET_NSSTATDESC(keytagopt, "Keytag option received", "KeyTagOpt");
-
 	INSIST(i == ns_statscounter_max);
 
 	/* Initialize resolver statistics */

bin/named/win32/os.c

@@ -59,6 +59,7 @@ named_paths_init(void) {
 	named_g_keyfile = isc_ntpaths_get(RNDC_KEY_PATH);
 	named_g_defaultsessionkeyfile = isc_ntpaths_get(SESSION_KEY_PATH);
 	named_g_defaultbindkeys = isc_ntpaths_get(BIND_KEYS_PATH);
+	named_g_defaultdnstap = NULL;
 
 	Initialized = TRUE;
 }

bin/named/zoneconf.c

@@ -25,7 +25,6 @@
 #include <dns/ipkeylist.h>
 #include <dns/fixedname.h>
 #include <dns/journal.h>
-#include <dns/kasp.h>
 #include <dns/log.h>
 #include <dns/name.h>
 #include <dns/masterdump.h>
@@ -841,9 +840,8 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
-		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
-		     dns_kasplist_t *kasplist, dns_zone_t *zone,
-		     dns_zone_t *raw)
+		  const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
+		  dns_zone_t *zone, dns_zone_t *raw)
 {
 	isc_result_t result;
 	const char *zname;
@@ -855,7 +853,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const cfg_obj_t *options = NULL;
 	const cfg_obj_t *obj;
 	const char *filename = NULL;
-	const char *kaspname = NULL;
 	const char *dupcheck;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
 	uint32_t count;
@@ -871,8 +868,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	int32_t journal_size;
 	bool multi;
 	bool alt;
-	dns_view_t *view = NULL;
-	dns_kasp_t *kasp = NULL;
+	dns_view_t *view;
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
 	bool ixfrdiff;
@@ -1049,8 +1045,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	} else if (result == ISC_R_SUCCESS) {
 		dns_ttl_t maxttl = 0;	/* unlimited */
 
-		if (cfg_obj_isduration(obj))
-			maxttl = cfg_obj_asduration(obj);
+		if (cfg_obj_isuint32(obj))
+			maxttl = cfg_obj_asuint32(obj);
 		dns_zone_setmaxttl(zone, maxttl);
 		if (raw != NULL)
 			dns_zone_setmaxttl(raw, maxttl);
@@ -1196,24 +1192,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	 */
 	if (ztype != dns_zone_stub && ztype != dns_zone_staticstub &&
 	    ztype != dns_zone_redirect) {
-		obj = NULL;
-		result = named_config_get(maps, "dnssec-policy", &obj);
-		if (result == ISC_R_SUCCESS) {
-			kaspname = cfg_obj_asstring(obj);
-			if (strcmp(kaspname, "none") != 0) {
-				result = dns_kasplist_find(kasplist, kaspname,
-							   &kasp);
-				if (result != ISC_R_SUCCESS) {
-					cfg_obj_log(obj, named_g_lctx,
-						    ISC_LOG_ERROR,
-						    "'dnssec-policy '%s' not "
-						    "found ", kaspname);
-					RETERR(result);
-				}
-				dns_zone_setkasp(zone, kasp);
-			}
-		}
-
 		obj = NULL;
 		result = named_config_get(maps, "notify", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1503,52 +1481,38 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		bool allow = false, maint = false;
 		bool sigvalinsecs;
 
-		if (kasp) {
-			seconds = (uint32_t) dns_kasp_sigvalidity_dnskey(kasp);
-		} else {
-			obj = NULL;
-			result = named_config_get(maps, "dnskey-sig-validity",
-						  &obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
-			seconds = cfg_obj_asuint32(obj) * 86400;
-		}
+		obj = NULL;
+		result = named_config_get(maps, "dnskey-sig-validity", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		seconds = cfg_obj_asuint32(obj) * 86400;
 		dns_zone_setkeyvalidityinterval(zone, seconds);
 
-		if (kasp) {
-			seconds = (uint32_t) dns_kasp_sigvalidity(kasp);
-			dns_zone_setsigvalidityinterval(zone, seconds);
-			seconds = (uint32_t) dns_kasp_sigrefresh(kasp);
-			dns_zone_setsigresigninginterval(zone, seconds);
-		} else {
-			obj = NULL;
-			result = named_config_get(maps, "sig-validity-interval",
-							&obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		obj = NULL;
+		result = named_config_get(maps, "sig-validity-interval", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 
-			sigvalinsecs = ns_server_getoption(named_g_server->sctx,
-							NS_SERVER_SIGVALINSECS);
-			validity = cfg_tuple_get(obj, "validity");
-			seconds = cfg_obj_asuint32(validity);
-			if (!sigvalinsecs) {
-				seconds *= 86400;
-			}
-			dns_zone_setsigvalidityinterval(zone, seconds);
-
-			resign = cfg_tuple_get(obj, "re-sign");
-			if (cfg_obj_isvoid(resign)) {
-				seconds /= 4;
-			} else if (!sigvalinsecs) {
-				seconds = cfg_obj_asuint32(resign);
-				if (seconds > 7 * 86400) {
-					seconds *= 86400;
-				} else {
-					seconds *= 3600;
-				}
-			} else {
-				seconds = cfg_obj_asuint32(resign);
-			}
-			dns_zone_setsigresigninginterval(zone, seconds);
+		sigvalinsecs = ns_server_getoption(named_g_server->sctx,
+						   NS_SERVER_SIGVALINSECS);
+		validity = cfg_tuple_get(obj, "validity");
+		seconds = cfg_obj_asuint32(validity);
+		if (!sigvalinsecs) {
+			seconds *= 86400;
 		}
+		dns_zone_setsigvalidityinterval(zone, seconds);
+
+		resign = cfg_tuple_get(obj, "re-sign");
+		if (cfg_obj_isvoid(resign)) {
+			seconds /= 4;
+		} else if (!sigvalinsecs) {
+			if (seconds > 7 * 86400) {
+				seconds = cfg_obj_asuint32(resign) * 86400;
+			} else {
+				seconds = cfg_obj_asuint32(resign) * 3600;
+			}
+		} else {
+			seconds = cfg_obj_asuint32(resign);
+		}
+		dns_zone_setsigresigninginterval(zone, seconds);
 
 		obj = NULL;
 		result = named_config_get(maps, "key-directory", &obj);
@@ -1577,20 +1541,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
 				   cfg_obj_asboolean(obj));
-		/*
-		 * This setting will be ignored if dnssec-policy is used.
-		 * named-checkconf will error if both are configured.
-		 */
 
 		obj = NULL;
 		result = named_config_get(maps, "dnssec-dnskey-kskonly", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_DNSKEYKSKONLY,
 				   cfg_obj_asboolean(obj));
-		/*
-		 * This setting will be ignored if dnssec-policy is used.
-		 * named-checkconf will error if both are configured.
-		 */
 
 		obj = NULL;
 		result = named_config_get(maps, "dnssec-loadkeys-interval",
@@ -1601,11 +1557,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 
 		obj = NULL;
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
-		if (dns_zone_getkasp(zone) != NULL) {
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, true);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, true);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, true);
-		} else if (result == ISC_R_SUCCESS) {
+		if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
 			if (strcasecmp(arg, "allow") == 0) {
 				allow = true;
@@ -1618,7 +1570,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				ISC_UNREACHABLE();
 			}
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, false);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
 		}
 	}

bin/nsupdate/nsupdate.c

@@ -906,7 +906,7 @@ setup_system(void) {
 	result = isc_timermgr_create(gmctx, &timermgr);
 	check_result(result, "dns_timermgr_create");
 
-	result = isc_taskmgr_create(gmctx, 1, 0, NULL, &taskmgr);
+	result = isc_taskmgr_create(gmctx, 1, 0, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 
 	result = isc_task_create(taskmgr, 0, &global_task);

bin/rndc/rndc.c

@@ -936,14 +936,11 @@ main(int argc, char **argv) {
 	serial = isc_random32();
 
 	isc_mem_create(&rndc_mctx);
-	DO("create socket manager", isc_socketmgr_create(rndc_mctx,
-							 &socketmgr));
-	DO("create task manager", isc_taskmgr_create(rndc_mctx, 1, 0,
-						     NULL, &taskmgr));
+	DO("create socket manager", isc_socketmgr_create(rndc_mctx, &socketmgr));
+	DO("create task manager", isc_taskmgr_create(rndc_mctx, 1, 0, &taskmgr));
 	DO("create task", isc_task_create(taskmgr, 0, &task));
 
-	DO("create logging context", isc_log_create(rndc_mctx, &log,
-						    &logconfig));
+	DO("create logging context", isc_log_create(rndc_mctx, &log, &logconfig));
 	isc_log_setcontext(log);
 	DO("setting log tag", isc_log_settag(logconfig, progname));
 	logdest.file.stream = stderr;

bin/rndc/rndc.docbook

@@ -443,8 +443,7 @@
 	    allowed to incrementally re-sign over time.
 	  </para>
 	  <para>
-	    This command requires that the zone is configured with a
-	    <command>dnssec-policy</command>, or that the
+	    This command requires that the
 	    <command>auto-dnssec</command> zone option
 	    be set to <literal>maintain</literal>,
 	    and also requires the zone to be configured to
@@ -850,8 +849,7 @@
 	    re-signed with the new key set.
 	  </para>
 	  <para>
-	    This command requires that the zone is configured with a
-	    <command>dnssec-policy</command>, or that the
+	    This command requires that the
 	    <command>auto-dnssec</command> zone option be set
 	    to <literal>allow</literal> or
 	    <literal>maintain</literal>,
@@ -1080,8 +1078,6 @@
 	  <para>
 	    Enable, disable, or check the current status of
 	    DNSSEC validation.  By default, validation is enabled.
-	    The cache is flushed when validation is turned on or off
-	    to avoid using data that might differ between states.
 	  </para>
 	</listitem>
       </varlistentry>

bin/tests/optional/adb_test.c

@@ -144,7 +144,7 @@ create_managers(void) {
 	isc_result_t result;
 
 	taskmgr = NULL;
-	result = isc_taskmgr_create(mctx, 5, 0, NULL, &taskmgr);
+	result = isc_taskmgr_create(mctx, 5, 0, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
 
 	timermgr = NULL;

bin/tests/optional/byaddr_test.c

@@ -112,7 +112,7 @@ main(int argc, char *argv[]) {
 	}
 
 	taskmgr = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, NULL, &taskmgr)
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &taskmgr)
 		      == ISC_R_SUCCESS);
 	task = NULL;
 	RUNTIME_CHECK(isc_task_create(taskmgr, 0, &task)

bin/tests/optional/byname_test.c

@@ -226,7 +226,7 @@ main(int argc, char *argv[]) {
 	}
 
 	taskmgr = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, NULL, &taskmgr) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &taskmgr) ==
 		      ISC_R_SUCCESS);
 	task = NULL;
 	RUNTIME_CHECK(isc_task_create(taskmgr, 0, &task) ==

bin/tests/optional/gsstest.c

@@ -470,7 +470,7 @@ main(int argc, char *argv[]) {
 	RUNCHECK(dst_lib_init(mctx, NULL));
 
 	taskmgr = NULL;
-	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, NULL, &taskmgr));
+	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
 	task = NULL;
 	RUNCHECK(isc_task_create(taskmgr, 0, &task));
 	timermgr = NULL;

bin/tests/optional/ratelimiter_test.c

@@ -102,7 +102,7 @@ main(int argc, char *argv[]) {
 	isc_interval_set(&linterval, 1, 0);
 
 	isc_mem_create(&mctx);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, 3, 0, NULL, &taskmgr) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, 3, 0, &taskmgr) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx, &timermgr) ==
 		      ISC_R_SUCCESS);

bin/tests/optional/shutdown_test.c

@@ -181,7 +181,7 @@ main(int argc, char *argv[]) {
 	isc_mem_create(&mctx);
 	mctx2 = NULL;
 	isc_mem_create(&mctx2);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, NULL, &task_manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &task_manager) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx, &timer_manager) ==
 		      ISC_R_SUCCESS);

bin/tests/optional/sig0_test.c

@@ -226,7 +226,7 @@ main(int argc, char *argv[]) {
 	dst_result_register();
 
 	taskmgr = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, 0, NULL, &taskmgr) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, 0, &taskmgr) ==
 		      ISC_R_SUCCESS);
 	task1 = NULL;
 	RUNTIME_CHECK(isc_task_create(taskmgr, 0, &task1) == ISC_R_SUCCESS);

bin/tests/optional/sock_test.c

@@ -292,7 +292,7 @@ main(int argc, char *argv[]) {
 	 * The task manager is independent (other than memory context)
 	 */
 	manager = NULL;
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, NULL, &manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &manager) ==
 		      ISC_R_SUCCESS);
 
 	/*

bin/tests/optional/task_test.c

@@ -79,7 +79,7 @@ main(int argc, char *argv[]) {
 
 	isc_mem_create(&mctx);
 
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, NULL, &manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, workers, 0, &manager) ==
 		      ISC_R_SUCCESS);
 
 	RUNTIME_CHECK(isc_task_create(manager, 0, &t1) == ISC_R_SUCCESS);

bin/tests/optional/timer_test.c

@@ -108,7 +108,7 @@ main(int argc, char *argv[]) {
 	printf("%u workers\n", workers);
 
 	isc_mem_create(&mctx1);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx1, workers, 0, NULL, &manager) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx1, workers, 0, &manager) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx1, &timgr) == ISC_R_SUCCESS);
 

bin/tests/optional/zone_test.c

@@ -146,11 +146,12 @@ query(void) {
 	dns_fixedname_t name;
 	dns_fixedname_t found;
 	dns_db_t *db;
+	char *s;
 	isc_buffer_t buffer;
 	isc_result_t result;
 	dns_rdataset_t rdataset;
 	dns_rdataset_t sigset;
-	fd_set rfdset = { { 0 } };
+	fd_set rfdset;
 
 	db = NULL;
 	result = dns_zone_getdb(zone, &db);
@@ -165,7 +166,7 @@ query(void) {
 	dns_rdataset_init(&sigset);
 
 	do {
-		char *s;
+
 		fprintf(stdout, "zone_test ");
 		fflush(stdout);
 		FD_ZERO(&rfdset);
@@ -280,7 +281,7 @@ main(int argc, char **argv) {
 
 	RUNTIME_CHECK(isc_app_start() == ISC_R_SUCCESS);
 	isc_mem_create(&mctx);
-	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, 0, NULL, &taskmgr) ==
+	RUNTIME_CHECK(isc_taskmgr_create(mctx, 2, 0, &taskmgr) ==
 		      ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_timermgr_create(mctx, &timermgr) == ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_socketmgr_create(mctx, &socketmgr) == ISC_R_SUCCESS);

bin/tests/system/README

@@ -584,6 +584,10 @@ By default, start.pl starts a "named" server with the following options:
                     preventing multiple instances of this named running in this
                     directory (which could possibly interfere with the test).
 
+In addition, start.pl also sets the following undocumented flag:
+
+    -T clienttest   Makes clients single-shot with their own memory context.
+
 All output is sent to a file called "named.run" in the nameserver directory.
 
 The options used to start named can be altered.  There are three ways of doing
@@ -604,9 +608,9 @@ the named command-line arguments.  The rest of the file is ignored.
 
 3. Tweaking the default command line arguments with "-T" options.  This flag is
 used to alter the behavior of BIND for testing and is not documented in the
-ARM.  The presence of certain files in the "nsN" directory adds flags to
-the default command line (the content of the files is irrelevant - it
-is only the presence that counts):
+ARM.  The "clienttest" option has already been mentioned, but the presence of
+certain files in the "nsN" directory adds flags to the default command line
+(the content of the files is irrelevant - it is only the presence that counts):
 
     named.noaa       Appends "-T noaa" to the command line, which causes
                      "named" to never set the AA bit in an answer.
@@ -631,6 +635,7 @@ is only the presence that counts):
                      the additional section if the response is triggered by RPZ
                      rewriting).
 
+
 Starting Other Nameservers
 ---
 In contrast to "named", nameservers written in Perl or Python (whose script

bin/tests/system/additional/ns1/named.args

@@ -1,2 +1,2 @@
 # this server runs named with only one worker thread
--m record,size,mctx -c named.conf -d 99 -D additional-ns1 -X named.lock -g -n 1
+-m record,size,mctx -c named.conf -d 99 -D additional-ns1 -X named.lock -g -T clienttest -n 1

bin/tests/system/addzone/tests.sh

@@ -696,17 +696,11 @@ $RNDCCMD 10.53.0.3 addzone "test4.baz" '{ type master; file "e.db"; };' > /dev/n
 $RNDCCMD 10.53.0.3 addzone "test5.baz" '{ type master; file "e.db"; };' > /dev/null 2>&1 || ret=1
 $PERL $SYSTEMTESTTOP/stop.pl addzone ns3
 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} addzone ns3 || ret=1
-for try in 0 1 2 3 4 5 6 7 8 9; do
-    iret=0
-    $DIG $DIGOPTS @10.53.0.3 version.bind txt ch > dig.out.test$n || iret=1
-    grep "status: NOERROR" dig.out.test$n > /dev/null || iret=1
-    [ "$iret" -eq 0 ] && break
-    sleep 1
-done
-[ "$iret" -ne 0 ] && ret=1
+$DIG $DIGOPTS @10.53.0.3 version.bind txt ch > dig.out.test$n || ret=1
+grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
+n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
-n=`expr $n + 1`
 
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/allow-query/ns3/named.args

@@ -1,2 +1,2 @@
 # this server only has 127.0.0.1 in its localhost/localnets ACLs
--m record,size,mctx -c named.conf -d 99 -D allow-query-ns3 -X named.lock -g -T fixedlocal
+-m record,size,mctx -c named.conf -d 99 -D allow-query-ns3 -X named.lock -g -T clienttest -T fixedlocal

bin/tests/system/autosign/clean.sh

@@ -39,7 +39,6 @@ rm -f ns3/inacksk2.example.db
 rm -f ns3/inacksk3.example.db
 rm -f ns3/inaczsk2.example.db
 rm -f ns3/inaczsk3.example.db
-rm -f ns3/jitter.nsec3.example.db
 rm -f ns3/kg.out ns3/s.out ns3/st.out
 rm -f ns3/kskonly.example.db
 rm -f ns3/nozsk.example.db ns3/inaczsk.example.db

bin/tests/system/autosign/ns3/jitter.nsec3.example.db.in

@@ -1,20 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300	; 5 minutes
-@			IN SOA	mname1. . (
-				2000042407 ; serial
-				20         ; refresh (20 seconds)
-				20         ; retry (20 seconds)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS	ns
-ns			A	10.53.0.3
-

bin/tests/system/autosign/ns3/keygen.sh

@@ -52,21 +52,6 @@ ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
 $DSFROMKEY $ksk.key > dsset-${zone}$TP
 
-#
-#  Jitter/NSEC3 test zone
-#
-setup jitter.nsec3.example
-cp $infile $zonefile
-count=1
-while [ $count -le 1000 ]
-do
-    echo "label${count} IN TXT label${count}" >> $zonefile
-    count=`expr $count + 1`
-done
-# Don't create keys just yet, because the scenario we want to test
-# is an unsigned zone that has a NSEC3PARAM record added with
-# dynamic update before the keys are generated.
-
 #
 #  OPTOUT/NSEC3 test zone
 #
@@ -165,16 +150,9 @@ $DSFROMKEY $ksk.key > dsset-${zone}$TP
 #
 setup oldsigs.example
 cp $infile $zonefile
-count=1
-while [ $count -le 1000 ]
-do
-    echo "label${count} IN TXT label${count}" >> $zonefile
-    count=`expr $count + 1`
-done
 $KEYGEN -q -a RSASHA1 -fk $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -q -a RSASHA1 $zone > kg.out 2>&1 || dumpit kg.out
-$SIGNER -PS -s now-1y -e now-6mo -o $zone -f $zonefile.signed $zonefile > s.out || dumpit s.out
-mv $zonefile.signed $zonefile
+$SIGNER -PS -s now-1y -e now-6mo -o $zone -f $zonefile $infile > s.out || dumpit s.out
 
 #
 # NSEC3->NSEC transition test zone.

bin/tests/system/autosign/ns3/named.conf.in

@@ -95,14 +95,6 @@ zone "nsec3.nsec3.example" {
 	auto-dnssec maintain;
 };
 
-zone "jitter.nsec3.example" {
-	type master;
-	file "jitter.nsec3.example.db";
-	allow-update { any; };
-	auto-dnssec maintain;
-	sig-validity-interval 10 2;
-};
-
 zone "secure.nsec3.example" {
 	type master;
 	file "secure.nsec3.example.db";
@@ -186,7 +178,6 @@ zone "oldsigs.example" {
 	file "oldsigs.example.db";
 	allow-update { any; };
 	auto-dnssec maintain;
-	sig-validity-interval 10 2;
 };
 
 zone "prepub.example" {

bin/tests/system/autosign/tests.sh

@@ -50,71 +50,6 @@ checkprivate () {
     return 1
 }
 
-freq() {
-	_file=$1
-	# remove first and last line that has incomplete set and skews the distribution
-	awk '$4 == "RRSIG" {print substr($9,1,8)}' < "$_file" | sort | uniq -c | sed '1d;$d'
-}
-# Check the signatures expiration times.  First check how many signatures
-# there are in total ($rrsigs).  Then see what the distribution of signature
-# expiration times is ($expiretimes).  Ignore the time part for a better
-# modelled distribution.
-checkjitter () {
-	_file=$1
-	_ret=0
-
-	if ! command -v bc >/dev/null 2>&1; then
-		echo_i "skip: bc not available"
-		return 0
-	fi
-
-	freq "$_file" | cat_i
-	_expiretimes=$(freq "$_file" | awk '{print $1}')
-
-	_count=0
-	# Check if we have at least 8 days
-	for _num in $_expiretimes
-	do
-		_count=$((_count+1))
-	done
-	if [ "$_count" -lt 8 ]; then
-		echo_i "error: not enough categories"
-		return 1
-	fi
-
-	# Calculate mean
-	_total=0
-	for _num in $_expiretimes
-	do
-		_total=$((_total+_num))
-	done
-	_mean=$(($_total / $_count))
-
-	# Calculate stddev
-	_stddev=0
-	for _num in $_expiretimes
-	do
-		_stddev=$(echo "$_stddev + (($_num - $_mean) * ($_num - $_mean))" | bc)
-	done
-	_stddev=$(echo "sqrt($_stddev/$_count)" | bc)
-
-	# We expect the number of signatures not to exceed the mean +- 3 * stddev.
-	_limit=$((_stddev*3))
-	_low=$((_mean-_limit))
-	_high=$((_mean+_limit))
-	# Find outliers.
-	echo_i "checking whether all frequencies falls into <$_low;$_high> interval"
-	for _num in $_expiretimes
-	do
-		if [ $_num -gt $_high ] || [ $_num -lt $_low ]; then
-			echo_i "error: too many RRSIG records ($_num) with the same expiration time"
-			_ret=1
-		fi
-	done
-
-	return $_ret
-}
-
 #
 #  The NSEC record at the apex of the zone and its RRSIG records are
 #  added as part of the last step in signing a zone.  We wait for the
@@ -399,15 +334,6 @@ do
 	sleep 1
 done
 n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-# Check jitter distribution.
-echo_i "checking expired signatures were jittered correctly ($n)"
-ret=0
-$DIG $DIGOPTS axfr oldsigs.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-checkjitter dig.out.ns3.test$n || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
 echo_i "checking NSEC->NSEC3 conversion succeeded ($n)"
@@ -1012,38 +938,6 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
-echo_i "checking jitter in a newly signed NSEC3 zone ($n)"
-ret=0
-# Use DNS UPDATE to add an NSEC3PARAM record into the zone.
-$NSUPDATE > nsupdate.out.test$n 2>&1 <<END || ret=1
-server 10.53.0.3 ${PORT}
-zone jitter.nsec3.example.
-update add jitter.nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
-send
-END
-[ $ret != 0 ] && echo_i "error: dynamic update add NSEC3PARAM failed"
-# Create DNSSEC keys in the zone directory.
-$KEYGEN -a rsasha1 -3 -q -K ns3 jitter.nsec3.example > /dev/null
-# Trigger zone signing.
-$RNDCCMD 10.53.0.3 sign jitter.nsec3.example. 2>&1 | sed 's/^/ns3 /' | cat_i
-# Wait until zone has been signed.
-i=0
-while [ "$i" -lt 20 ]; do
-	failed=0
-	$DIG $DIGOPTS axfr jitter.nsec3.example @10.53.0.3 > dig.out.ns3.test$n || failed=1
-	grep "NSEC3PARAM" dig.out.ns3.test$n > /dev/null || failed=1
-	[ $failed -eq 0 ] && break
-	echo_i "waiting ... ($i)"
-	sleep $((i/5))
-	i=$((i+1))
-done
-[ $failed != 0 ] && echo_i "error: no NSEC3PARAM found in AXFR" && ret=1
-# Check jitter distribution.
-checkjitter dig.out.ns3.test$n || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "checking that serial number and RRSIGs are both updated (rt21045) ($n)"
 ret=0
 oldserial=`$DIG $DIGOPTS +short soa prepub.example @10.53.0.3 | awk '$0 !~ /SOA/ {print $3}'`

bin/tests/system/checkconf/bad-kasp1.conf

@@ -1,22 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// Using the keyword 'default' is not allowed.
-dnssec-policy "default" {
-	signatures-refresh P5D;
-};
-
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "default";
-};
-

bin/tests/system/checkconf/bad-kasp2.conf

@@ -1,22 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-include "good-kasp.conf";
-
-// Bad zone configuration because this has dnssec-policy and other DNSSEC sign
-// configuration options (auto-dnssec).
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "test";
-	auto-dnssec maintain;
-	allow-update { any; };
-};

bin/tests/system/checkconf/bad-kasp3.conf

@@ -1,22 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-include "good-kasp.conf";
-
-// Bad zone configuration because this has dnssec-policy with no matching
-// dnssec-policy configuration (good-kasp.conf has "test", zone refers to
-// "nosuchpolicy".
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "nosuchpolicy";
-};
-

bin/tests/system/checkconf/bad-kasp4.conf

@@ -1,23 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// Bad kasp configuration because this has an invalid duration for
-// signatures-refresh.
-dnssec-policy "badduration" {
-	signatures-refresh PT20Sabcd;
-};
-
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "badduration";
-};
-

bin/tests/system/checkconf/bad-kasp5.conf

@@ -1,22 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// Using the keyword 'none' is not allowed.
-dnssec-policy "none" {
-	signatures-refresh P5D;
-};
-
-zone "example.net" {
-	type master;
-	file "example.db";
-	dnssec-policy "none";
-};
-

bin/tests/system/checkconf/clean.sh

@@ -10,7 +10,6 @@
 # information regarding copyright ownership.
 
 rm -f good.conf.in good.conf.out badzero.conf *.out
-rm -f good-kasp.conf.in
 rm -rf test.keydir
 rm -f checkconf.out*
 rm -f diff.out*

bin/tests/system/checkconf/good-dnskey-validity-3660.conf

@@ -1,14 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-options {
-	dnskey-sig-validity 3660;	/* maximum value 10 years */
-};

bin/tests/system/checkconf/good-kasp.conf

@@ -1,56 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * This is just a random selection of DNSSEC configuration options.
- */
-
-/* cut here */
-dnssec-policy "test" {
-	dnskey-ttl 3600;
-	keys {
-		ksk key-directory lifetime P1Y algorithm 13 256;
-		zsk key-directory lifetime P30D algorithm 13;
-		csk key-directory lifetime P30D algorithm 8 2048;
-	};
-	publish-safety PT3600S;
-	retire-safety PT3600S;
-	signatures-refresh P3D;
-	signatures-validity P2W;
-	signatures-validity-dnskey P14D;
-	zone-max-ttl 86400;
-	zone-propagation-delay PT5M;
-	parent-ds-ttl 7200;
-	parent-propagation-delay PT1H;
-	parent-registration-delay P1D;
-};
-options {
-	dnssec-policy "default";
-};
-zone "example1" {
-	type master;
-	file "example1.db";
-};
-zone "example2" {
-	type master;
-	file "example2.db";
-	dnssec-policy "test";
-};
-zone "example3" {
-	type master;
-	file "example3.db";
-	dnssec-policy "default";
-};
-zone "example4" {
-	type master;
-	file "example4.db";
-	dnssec-policy "none";
-};

bin/tests/system/checkconf/good.conf

@@ -14,24 +14,6 @@
  */
 
 /* cut here */
-dnssec-policy "test" {
-	dnskey-ttl 3600;
-	keys {
-		ksk key-directory lifetime P1Y algorithm 13 256;
-		zsk key-directory lifetime P30D algorithm 13;
-		csk key-directory lifetime P30D algorithm 8 2048;
-	};
-	publish-safety PT3600S;
-	retire-safety PT3600S;
-	signatures-refresh P3D;
-	signatures-validity P2W;
-	signatures-validity-dnskey P14D;
-	zone-max-ttl 86400;
-	zone-propagation-delay PT5M;
-	parent-ds-ttl 7200;
-	parent-propagation-delay PT1H;
-	parent-registration-delay P1D;
-};
 options {
 	avoid-v4-udp-ports {
 		100;
@@ -78,7 +60,6 @@ options {
 	validate-except {
 		"corp";
 	};
-	dnssec-policy "test";
 	transfer-source 0.0.0.0 dscp 63;
 	zone-statistics none;
 };
@@ -159,28 +140,6 @@ view "third" {
 		};
 	};
 };
-view "fourth" {
-	zone "dnssec-test" {
-		type master;
-		file "dnssec-test.db";
-		dnssec-policy "test";
-	};
-	zone "dnssec-default" {
-		type master;
-		file "dnssec-default.db";
-		dnssec-policy "default";
-	};
-	zone "dnssec-inherit" {
-		type master;
-		file "dnssec-inherit.db";
-	};
-	zone "dnssec-none" {
-		type master;
-		file "dnssec-none.db";
-		dnssec-policy "none";
-	};
-	dnssec-policy "default";
-};
 view "chaos" chaos {
 	zone "hostname.bind" chaos {
 		type master;

bin/tests/system/checkconf/good.zonelist

@@ -8,8 +8,4 @@ clone IN third in-view first
 dnssec IN third master
 p IN third primary
 s IN third secondary
-dnssec-test IN fourth master
-dnssec-default IN fourth master
-dnssec-inherit IN fourth master
-dnssec-none IN fourth master
 hostname.bind chaos chaos master

bin/tests/system/checkconf/kasp-and-other-dnssec-options.conf

@@ -1,28 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-include "good-kasp.conf";
-
-zone "nsec3.net" {
-	type master;
-	file "nsec3.db";
-	dnssec-policy "test";
-	auto-dnssec maintain;
-	dnskey-sig-validity 3600;
-	dnssec-dnskey-kskonly yes;
-	dnssec-secure-to-insecure yes;
-	dnssec-update-mode maintain;
-	inline-signing yes;
-	sig-validity-interval 3600;
-	update-check-ksk yes;
-	allow-update { any; };
-};
-

bin/tests/system/checkconf/tests.sh

@@ -466,38 +466,5 @@ grep "'geoip-use-ecs' is obsolete" < checkconf.out$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; ret=1; fi
 status=`expr $status + $ret`
 
-n=`expr $n + 1`
-echo_i "checking named-checkconf kasp warnings ($n)"
-ret=0
-$CHECKCONF kasp-and-other-dnssec-options.conf > checkconf.out$n 2>&1
-grep "'auto-dnssec maintain;' cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "dnskey-sig-validity: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "dnssec-dnskey-kskonly: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "dnssec-secure-to-insecure: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "dnssec-update-mode: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "inline-signing: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "sig-validity-interval: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-grep "update-check-ksk: cannot be configured if dnssec-policy is also set" < checkconf.out$n > /dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "check that a good 'kasp' configuration is accepted ($n)"
-ret=0
-$CHECKCONF good-kasp.conf > checkconf.out$n 2>/dev/null || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
-n=`expr $n + 1`
-echo_i "checking that named-checkconf prints a known good kasp config ($n)"
-ret=0
-awk 'BEGIN { ok = 0; } /cut here/ { ok = 1; getline } ok == 1 { print }' good-kasp.conf > good-kasp.conf.in
-[ -s good-kasp.conf.in ] || ret=1
-$CHECKCONF -p good-kasp.conf.in | grep -v '^good-kasp.conf.in:' > good-kasp.conf.out 2>&1 || ret=1
-cmp good-kasp.conf.in good-kasp.conf.out || ret=1
-
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=`expr $status + $ret`
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

bin/tests/system/conf.sh.common

@@ -9,14 +9,17 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-testsock6() {
-	if test -n "$PERL" && $PERL -e "use IO::Socket::INET6;" 2> /dev/null
+if test -n "$PERL"
+then
+	if $PERL -e "use IO::Socket::INET6;" 2> /dev/null
 	then
-		$PERL "$TOP/bin/tests/system/testsock6.pl" "$@"
+		TESTSOCK6="$PERL $TOP/bin/tests/system/testsock6.pl"
 	else
-		false
+		TESTSOCK6=false
 	fi
-}
+else
+	TESTSOCK6=false
+fi
 
 export LANG=C
 
@@ -61,7 +64,7 @@ PARALLEL_COMMON="dnssec rpzrecurse serve-stale \
 	ednscompliance emptyzones \
 	fetchlimit filter-aaaa formerr forward \
 	geoip2 glue idna inline integrity ixfr \
-	kasp keepalive legacy limits \
+	keepalive legacy limits \
 	masterfile masterformat metadata mirror mkeys \
 	names notify nslookup nsupdate nzd2nzf \
 	padding pending pipelined qmin \
@@ -202,24 +205,6 @@ DISABLED_BITS=384
 # Useful functions in test scripts
 #
 
-# assert_int_equal: compare two integer variables, $1 and $2
-#
-# If $1 and $2 are equal, return 0; if $1 and $2 are not equal, report
-# the error using the description of the tested variable provided in $3
-# and return 1.
-assert_int_equal() {
-	found="$1"
-	expected="$2"
-	description="$3"
-
-	if [ "${expected}" -ne "${found}" ]; then
-		echo_i "incorrect ${description}: got ${found}, expected ${expected}"
-		return 1
-	fi
-
-	return 0
-}
-
 # keyfile_to_keys_section: helper function for keyfile_to_*_keys() which
 # converts keyfile data into a configuration section using the supplied
 # parameters
@@ -338,26 +323,6 @@ nextpartpeek() {
 	nextpartread $1 2> /dev/null
 }
 
-# retry: keep running a command until it succeeds, up to $1 times, with
-# one-second intervals
-retry() {
-	__retries="${1}"
-	shift
-
-	while :; do
-		if "$@"; then
-			return 0
-		fi
-		__retries=$((__retries-1))
-		if [ "${__retries}" -gt 0 ]; then
-			echo_i "retrying"
-			sleep 1
-		else
-			return 1
-		fi
-	done
-}
-
 rndc_reload() {
     echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload $3 2>&1 | sed 's/^/'$1' /'`"
     # reloading single zone is synchronous, if we're reloading whole server
@@ -526,5 +491,6 @@ export RRCHECKER
 export SAMPLEUPDATE
 export SIGNER
 export SUBDIRS
+export TESTSOCK6
 export TSIGKEYGEN
 export WIRETEST

bin/tests/system/delzone/ns2/named.args

@@ -1 +1 @@
--D delzone-ns2 -X named.lock -m record,size,mctx -c named.conf -g -U 4
+-D delzone-ns2 -X named.lock -m record,size,mctx -T clienttest -c named.conf -g -U 4

bin/tests/system/digdelv/tests.sh

@@ -310,7 +310,7 @@ if [ -x "$DIG" ] ; then
 
   n=$((n+1))
   echo_i "checking dig @IPv6addr -4 A a.example ($n)"
-  if testsock6 fd92:7065:b8e:ffff::2 2>/dev/null
+  if $TESTSOCK6 fd92:7065:b8e:ffff::2 2>/dev/null
   then
     ret=0
     dig_with_opts +tcp @fd92:7065:b8e:ffff::2 -4 A a.example > dig.out.test$n 2>&1 && ret=1
@@ -323,7 +323,7 @@ if [ -x "$DIG" ] ; then
 
   n=$((n+1))
   echo_i "checking dig @IPv4addr -6 +mapped A a.example ($n)"
-  if testsock6 fd92:7065:b8e:ffff::2 2>/dev/null && [ "$(uname -s)" != "OpenBSD" ]
+  if "$TESTSOCK6" fd92:7065:b8e:ffff::2 2>/dev/null && [ "$(uname -s)" != "OpenBSD" ]
   then
     ret=0
     dig_with_opts +tcp @10.53.0.2 -6 +mapped A a.example > dig.out.test$n 2>&1 || ret=1
@@ -336,7 +336,7 @@ if [ -x "$DIG" ] ; then
 
   n=$((n+1))
   echo_i "checking dig +tcp @IPv4addr -6 +nomapped A a.example ($n)"
-  if testsock6 fd92:7065:b8e:ffff::2 2>/dev/null
+  if $TESTSOCK6 fd92:7065:b8e:ffff::2 2>/dev/null
   then
     ret=0
     dig_with_opts +tcp @10.53.0.2 -6 +nomapped A a.example > dig.out.test$n 2>&1 || ret=1
@@ -349,7 +349,7 @@ if [ -x "$DIG" ] ; then
   n=$((n+1))
 
   echo_i "checking dig +notcp @IPv4addr -6 +nomapped A a.example ($n)"
-  if testsock6 fd92:7065:b8e:ffff::2 2>/dev/null
+  if $TESTSOCK6 fd92:7065:b8e:ffff::2 2>/dev/null
   then
     ret=0
     dig_with_opts +notcp @10.53.0.2 -6 +nomapped A a.example > dig.out.test$n 2>&1 || ret=1
@@ -860,7 +860,7 @@ if [ -x "$DELV" ] ; then
 
   n=$((n+1))
   echo_i "checking delv with IPv6 on IPv4 does not work ($n)"
-  if testsock6 fd92:7065:b8e:ffff::3 2>/dev/null
+  if $TESTSOCK6 fd92:7065:b8e:ffff::3 2>/dev/null
   then
     ret=0
     # following should fail because @IPv4 overrides earlier @IPv6 above
@@ -878,7 +878,7 @@ if [ -x "$DELV" ] ; then
 
   n=$((n+1))
   echo_i "checking delv with IPv4 on IPv6 does not work ($n)"
-  if testsock6 fd92:7065:b8e:ffff::3 2>/dev/null
+  if $TESTSOCK6 fd92:7065:b8e:ffff::3 2>/dev/null
   then
     ret=0
     # following should fail because @IPv6 overrides earlier @IPv4 above

bin/tests/system/dlzexternal/driver.c

@@ -99,7 +99,6 @@ add_name(struct dlz_example_data *state, struct record *list,
 	int first_empty = -1;
 
 	for (i = 0; i < MAX_RECORDS; i++) {
-		INSIST(list[i].name != NULL);
 		if (first_empty == -1 && strlen(list[i].name) == 0U) {
 			first_empty = i;
 		}
@@ -124,13 +123,13 @@ add_name(struct dlz_example_data *state, struct record *list,
 	    strlen(data) >= sizeof(list[i].data))
 		return (ISC_R_NOSPACE);
 
-	strncpy(list[i].name, name, sizeof(list[i].name) - 1);
+	strncpy(list[i].name, name, sizeof(list[i].name));
 	list[i].name[sizeof(list[i].name) - 1] = '\0';
 
-	strncpy(list[i].type, type, sizeof(list[i].type) - 1);
+	strncpy(list[i].type, type, sizeof(list[i].type));
 	list[i].type[sizeof(list[i].type) - 1] = '\0';
 
-	strncpy(list[i].data, data, sizeof(list[i].data) - 1);
+	strncpy(list[i].data, data, sizeof(list[i].data));
 	list[i].data[sizeof(list[i].data) - 1] = '\0';
 
 	list[i].ttl = ttl;

bin/tests/system/dnssec/ns6/named.args

@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D dnssec-ns6 -X named.lock -g -T nonearest -T tat=1
+-m record,size,mctx -c named.conf -d 99 -D dnssec-ns6 -X named.lock -g -T nonearest -T clienttest -T tat=1

bin/tests/system/dnssec/tests.sh

@@ -1485,7 +1485,7 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
-echo_i "checking that dnssec-signzone updates originalttl on ttl changes ($n)"
+echo_i "checking that dnsssec-signzone updates originalttl on ttl changes ($n)"
 ret=0
 zone=example
 key1=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone)

bin/tests/system/dscp/ns1/named.args

@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns1 -X named.lock -g -U 4 -T dscp=46
+-m record,size,mctx -T clienttest -c named.conf -d 99 -D dscp-ns1 -X named.lock -g -U 4 -T dscp=46

bin/tests/system/dscp/ns2/named.args

@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns2 -X named.lock -g -U 4 -T dscp=46
+-m record,size,mctx -T clienttest -c named.conf -d 99 -D dscp-ns2 -X named.lock -g -U 4 -T dscp=46

bin/tests/system/dscp/ns3/named.args

@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns3 -X named.lock -g -U 4 -T dscp=46
+-m record,size,mctx -T clienttest -c named.conf -d 99 -D dscp-ns3 -X named.lock -g -U 4 -T dscp=46

bin/tests/system/dscp/ns4/named.args

@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns4 -X named.lock -g -U 4 -T dscp=46
+-m record,size,mctx -T clienttest -c named.conf -d 99 -D dscp-ns4 -X named.lock -g -U 4 -T dscp=46

bin/tests/system/dscp/ns5/named.args

@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns5 -X named.lock -g -U 4 -T dscp=46
+-m record,size,mctx -T clienttest -c named.conf -d 99 -D dscp-ns5 -X named.lock -g -U 4 -T dscp=46

bin/tests/system/dscp/ns6/named.args

@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns6 -X named.lock -g -U 4 -T dscp=46
+-m record,size,mctx -T clienttest -c named.conf -d 99 -D dscp-ns6 -X named.lock -g -U 4 -T dscp=46

bin/tests/system/dscp/ns7/named.args

@@ -1 +1 @@
--m record,size,mctx -c named.conf -d 99 -D dscp-ns7 -X named.lock -g -U 4 -T dscp=46
+-m record,size,mctx -T clienttest -c named.conf -d 99 -D dscp-ns7 -X named.lock -g -U 4 -T dscp=46

bin/tests/system/dupsigs/ns1/named.args

@@ -1 +1 @@
--D dupsigs-ns1 -X named.lock -m record,size,mctx -c named.conf -d 99 -g -U 4 -T sigvalinsecs
+-D dupsigs-ns1 -X named.lock -m record,size,mctx -T clienttest -c named.conf -d 99 -g -U 4 -T sigvalinsecs

bin/tests/system/ecdsa/tests.sh

@@ -20,6 +20,7 @@ rm -f dig.out.*
 DIGOPTS="+tcp +noau +noadd +nosea +nostat +nocmd +dnssec -p 5300"
 
 # Check the example. domain
+
 echo "I:checking that positive validation works ($n)"
 ret=0
 $DIG $DIGOPTS . @10.53.0.1 soa > dig.out.ns1.test$n || ret=1

bin/tests/system/fetchlimit/ns3/named.args

@@ -0,0 +1,2 @@
+# Don't specify '-T clienttest' as it consumes lots of memory with this test
+-D fetchlimit-ns3 -X named.lock -m record,size,mctx -c named.conf -d 99 -g -U 4

bin/tests/system/filter-aaaa/tests.sh

@@ -166,7 +166,7 @@ status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv6 ($n)"
-if testsock6 fd92:7065:b8e:ffff::1
+if $TESTSOCK6 fd92:7065:b8e:ffff::1
 then
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
@@ -207,7 +207,7 @@ status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, over IPv6 ($n)"
-if testsock6 fd92:7065:b8e:ffff::1
+if $TESTSOCK6 fd92:7065:b8e:ffff::1
 then
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::1 @fd92:7065:b8e:ffff::1 > dig.out.ns1.test$n || ret=1
@@ -340,7 +340,7 @@ status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv6 with break-dnssec ($n)"
-if testsock6 fd92:7065:b8e:ffff::4
+if $TESTSOCK6 fd92:7065:b8e:ffff::4
 then
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
@@ -378,7 +378,7 @@ status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, over IPv6, with break-dnssec ($n)"
-if testsock6 fd92:7065:b8e:ffff::4
+if $TESTSOCK6 fd92:7065:b8e:ffff::4
 then
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::4 @fd92:7065:b8e:ffff::4 > dig.out.ns4.test$n || ret=1
@@ -513,7 +513,7 @@ status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv6, recursive ($n)"
-if testsock6 fd92:7065:b8e:ffff::2
+if $TESTSOCK6 fd92:7065:b8e:ffff::2
 then
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
@@ -557,7 +557,7 @@ status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, recursive, over IPv6 ($n)"
-if testsock6 fd92:7065:b8e:ffff::2
+if $TESTSOCK6 fd92:7065:b8e:ffff::2
 then
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::2 @fd92:7065:b8e:ffff::2 > dig.out.ns2.test$n || ret=1
@@ -690,7 +690,7 @@ status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo_i "checking that AAAA is returned when both AAAA and A record exists, unsigned over IPv6, recursive with break-dnssec ($n)"
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
 ret=0
 $DIG $DIGOPTS aaaa dual.unsigned -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
@@ -729,7 +729,7 @@ status=`expr $status + $ret`
 
 n=`expr $n + 1`
 echo_i "checking that AAAA is included in additional section, qtype=MX, unsigned, over IPv6, recursive with break-dnssec ($n)"
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
 ret=0
 $DIG $DIGOPTS +add +dnssec mx unsigned -b fd92:7065:b8e:ffff::3 @fd92:7065:b8e:ffff::3 > dig.out.ns3.test$n || ret=1
@@ -740,12 +740,11 @@ else
 echo_i "skipped."
 fi
 
-if ! testsock6 fd92:7065:b8e:ffff::1
-then
-	echo_i "IPv6 address not configured; skipping IPv6 query tests"
-	echo_i "exit status: $status"
-	exit $status
-fi
+$TESTSOCK6 fd92:7065:b8e:ffff::1 || {
+        echo_i "IPv6 address not configured; skipping IPv6 query tests"
+        echo_i "exit status: $status"
+        exit $status
+}
 
 # Reconfiguring for IPv6 tests
 echo_i "reconfiguring servers"

bin/tests/system/forward/tests.sh

@@ -98,15 +98,10 @@ status=`expr $status + $ret`
 
 echo_i "checking that forward only zone overrides empty zone"
 ret=0
-# retry loop in case the server restart above causes transient failure
-for try in 0 1 2 3 4 5 6 7 8 9; do
-    $DIG $DIGOPTS 1.0.10.in-addr.arpa TXT @10.53.0.4 > dig.out.f2
-    grep "status: NOERROR" dig.out.f2 > /dev/null || ret=1
-    $DIG $DIGOPTS 2.0.10.in-addr.arpa TXT @10.53.0.4 > dig.out.f2
-    grep "status: NXDOMAIN" dig.out.f2 > /dev/null || ret=1
-    [ "$ret" -eq 0 ] && break
-    sleep 1
-done
+$DIG $DIGOPTS 1.0.10.in-addr.arpa TXT @10.53.0.4 > dig.out.f2
+grep "status: NOERROR" dig.out.f2 > /dev/null || ret=1
+$DIG $DIGOPTS 2.0.10.in-addr.arpa TXT @10.53.0.4 > dig.out.f2
+grep "status: NXDOMAIN" dig.out.f2 > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 

bin/tests/system/geoip2/tests.sh

@@ -55,7 +55,7 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
   n=`expr $n + 1`
   echo_i "checking Country database by code using IPv6 ($n)"
@@ -94,7 +94,7 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
   n=`expr $n + 1`
   echo_i "checking Country database with nested ACLs using IPv6 ($n)"
@@ -133,7 +133,7 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
   n=`expr $n + 1`
   echo_i "checking Country database by name using IPv6 ($n)"
@@ -173,7 +173,7 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
   n=`expr $n + 1`
   echo_i "checking Country database by continent code using IPv6 ($n)"
@@ -214,7 +214,7 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
   n=`expr $n + 1`
   echo_i "checking City database by region code using IPv6 ($n)"
@@ -255,7 +255,7 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
   n=`expr $n + 1`
   echo_i "checking City database by city name using IPv6 ($n)"
@@ -294,7 +294,7 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
   n=`expr $n + 1`
   echo_i "checking ISP database using IPv6 ($n)"
@@ -333,7 +333,7 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
   n=`expr $n + 1`
   echo_i "checking ASN database by org name using IPv6 ($n)"
@@ -372,7 +372,7 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
   n=`expr $n + 1`
   echo_i "checking ASN database, ASNNNN only, using IPv6 ($n)"
@@ -411,7 +411,7 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
   n=`expr $n + 1`
   echo_i "checking ASN database, NNNN only, using IPv6 ($n)"
@@ -450,7 +450,7 @@ done
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
-if testsock6 fd92:7065:b8e:ffff::3
+if $TESTSOCK6 fd92:7065:b8e:ffff::3
 then
   n=`expr $n + 1`
   echo_i "checking Domain database using IPv6 ($n)"

bin/tests/system/include-multiplecfg/.gitignore

@@ -0,0 +1,2 @@
+/ns2/named.conf
+/ns2/controls.conf

bin/tests/system/include-multiplecfg/clean.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+#
+# Clean up after allow query tests.
+#
+
+rm -f dig.out.*
+rm -f ns*/named.conf
+rm -f */named.memstats
+rm -f ns*/named.lock
+rm -f ns*/named.run ns*/named.run.prev
+rm -f ns*/managed-keys.bind* ns*/*.mkeys*

bin/tests/system/include-multiplecfg/ns2/mars.com.db

@@ -0,0 +1,13 @@
+$TTL 86400
+@     IN     SOA    dns1.mars.com.     hostmaster.mars.com. (
+                    2001062501 ; serial
+                    21600      ; refresh after 6 hours
+                    3600       ; retry after 1 hour
+                    604800     ; expire after 1 week
+                    86400 )    ; minimum TTL of 1 day
+
+      IN     NS     dns1.mars.com.
+
+             IN     A       10.53.0.1
+
+dns1         IN     A       10.53.0.1

bin/tests/system/include-multiplecfg/ns2/mars.conf

@@ -0,0 +1,6 @@
+
+zone "mars.com" {
+        type master;
+        file "mars.com.db";
+};
+

bin/tests/system/include-multiplecfg/ns2/named.conf.in

@@ -10,5 +10,17 @@
  */
 
 options {
-	dnskey-sig-validity 0;	/* 0 is disabled */
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+        notify no;
 };
+
+# Should include all files matching pattern.
+include "zone*.conf";
+
+# Shouldn't break standard file pattern.
+include "mars.conf";
+

bin/tests/system/include-multiplecfg/ns2/zone1.com.db

@@ -0,0 +1,13 @@
+$TTL 86400
+@     IN     SOA    dns1.zone1.com.     hostmaster.zone1.com. (
+                    2001062501 ; serial
+                    21600      ; refresh after 6 hours
+                    3600       ; retry after 1 hour
+                    604800     ; expire after 1 week
+                    86400 )    ; minimum TTL of 1 day
+
+      IN     NS     dns1.zone1.com.
+
+             IN     A       10.53.0.1
+
+dns1         IN     A       10.53.0.1

bin/tests/system/include-multiplecfg/ns2/zone1.conf

@@ -0,0 +1,6 @@
+
+zone "zone1.com" {
+        type master;
+        file "zone1.com.db";
+};
+

bin/tests/system/include-multiplecfg/ns2/zone2.com.db

@@ -0,0 +1,13 @@
+$TTL 86400
+@     IN     SOA    dns1.zone2.com.     hostmaster.zone2.com. (
+                    2001062501 ; serial
+                    21600      ; refresh after 6 hours
+                    3600       ; retry after 1 hour
+                    604800     ; expire after 1 week
+                    86400 )    ; minimum TTL of 1 day
+
+      IN     NS     dns1.zone2.com.
+
+             IN     A       10.53.0.1
+
+dns1         IN     A       10.53.0.1

bin/tests/system/include-multiplecfg/ns2/zone2.conf

@@ -0,0 +1,6 @@
+
+zone "zone2.com" {
+        type master;
+        file "zone2.com.db";
+};
+

bin/tests/system/include-multiplecfg/setup.sh

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/sh -e
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
@@ -12,8 +12,6 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
 
-if ! test -n "$PYTHON"; then
-	echo_i "This test requires Python."
-	exit 1
-fi
+$SHELL clean.sh
 
+copy_setports  ns2/named.conf.in ns2/named.conf

bin/tests/system/include-multiplecfg/tests.sh

@@ -0,0 +1,54 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# Test of include statement with glob expression.
+
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noadd +nostats -p ${PORT}"
+
+status=0
+n=0
+
+# Test 1 - check if zone1 was loaded.
+n=`expr $n + 1`
+echo_i "checking glob include of zone1 config ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 zone1.com. a > dig.out.ns2.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
+grep '^zone1.com.' dig.out.ns2.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Test 2 - check if zone2 was loaded.
+n=`expr $n + 1`
+echo_i "checking glob include of zone2 config ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 zone2.com. a > dig.out.ns2.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
+grep '^zone2.com.' dig.out.ns2.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Test 3 - check if standard file path (no magic chars) works.
+n=`expr $n + 1`
+echo_i "checking include of standard file path config ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 mars.com. a > dig.out.ns2.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
+grep '^mars.com.' dig.out.ns2.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1

bin/tests/system/kasp/README

@@ -1,13 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
-
-The test setup for the KASP tests.
-
-ns1 is reserved for the root server.
-
-ns2 is running primary service for ns3.
-
-ns3 is an authoritative server for the various test domains.
-
-ns4 and ns5 are authoritative servers for various test domains related to views.

bin/tests/system/kasp/clean.sh

@@ -1,26 +0,0 @@
-#!/bin/sh
-#
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-set -e
-
-rm -f ./keygen.*
-rm -f ./K*.private ./K*.key ./K*.state ./K*.cmp
-rm -rf ./keys/
-rm -f dig.out* rrsig.out.* keyevent.out.*
-rm -f ns*/named.conf ns*/named.memstats ns*/named.run*
-rm -f ns*/*.jnl ns*/*.jbk
-rm -f ns*/K*.private ns*/K*.key ns*/K*.state
-rm -f ns*/dsset-* ns*/*.db ns*/*.db.signed
-rm -f ns*/keygen.out.* ns*/settime.out.* ns*/signer.out.*
-rm -f ns*/managed-keys.bind
-rm -f ns*/*.mkeys
-# NS3 specific
-rm -f ns3/zones ns3/*.db.infile

bin/tests/system/kasp/kasp.conf

@@ -1,25 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*
- * This is just a random selection of configuration options.
- */
-
-dnssec-policy "kasp" {
-	dnskey-ttl 200;
-
-	keys {
-		csk key-directory lifetime P1Y  algorithm 13;
-		ksk key-directory lifetime P1Y  algorithm 8;
-		zsk key-directory lifetime P30D algorithm 8 1024;
-		zsk key-directory lifetime P6M  algorithm 8 2000;
-	};
-};

bin/tests/system/kasp/ns2/named.conf.in

@@ -1,58 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-// NS2
-
-options {
-	query-source address 10.53.0.2;
-	notify-source 10.53.0.2;
-	transfer-source 10.53.0.2;
-	port @PORT@;
-	pid-file "named.pid";
-	listen-on { 10.53.0.2; };
-	listen-on-v6 { none; };
-	allow-transfer { any; };
-	recursion no;
-	dnssec-policy "none";
-};
-
-key rndc_key {
-	secret "1234abcd8765";
-	algorithm hmac-sha256;
-};
-
-controls {
-	inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
-};
-
-/* Inherit dnssec-policy (which is none) */
-
-zone "unsigned.tld" {
-	type master;
-	file "unsigned.tld.db";
-};
-
-/* Override dnssec-policy */
-
-zone "signed.tld" {
-	type master;
-	dnssec-policy "default";
-	file "signed.tld.db";
-};
-
-/* Primary service for ns3 */
-
-zone "secondary.kasp" {
-	type master;
-	file "secondary.kasp.db";
-	allow-transfer { 10.53.0.3; };
-	notify yes;
-};

bin/tests/system/kasp/ns2/secondary.kasp.db.in

@@ -1,27 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0. If a copy of the MPL was not distributed with this
-; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-@		IN	SOA  secondary.kasp. hostmaster.kasp. (
-			1       ; serial
-			20      ; refresh (20 seconds)
-			20      ; retry (20 seconds)
-			1814400 ; expire (3 weeks)
-			3600    ; minimum (1 hour)
-			)
-
-			NS	ns2
-			NS	ns3
-ns2			A	10.53.0.2
-ns3			A	10.53.0.3
-
-a			A	10.0.0.1
-b			A	10.0.0.2
-c			A	10.0.0.3
-