suppress DOXYGEN

List atypical failures in system test summary

See merge request isc-projects/bind9!2964

.gitattributes

@@ -1,2 +1,10 @@
 *.sln.in eol=crlf
 *.vcxproj.* eol=crlf
+
+.gitignore			 export-ignore
+/conftools			 export-ignore
+/doc/design			 export-ignore
+/doc/dev			 export-ignore
+/util/**			 export-ignore
+/util/bindkeys.pl		-export-ignore
+/util/mksymtbl.pl		-export-ignore

.gitignore

@@ -60,3 +60,4 @@ timestamp
 /compile_commands.json
 /cppcheck_html/
 /cppcheck.results
+/tsan

.gitlab-ci.yml

@@ -18,6 +18,19 @@ variables:
   MAKE: make
   CONFIGURE: ./configure
   SCAN_BUILD: scan-build-9
+  SYMBOLIZER: /usr/lib/llvm-9/bin/llvm-symbolizer
+  ASAN_SYMBOLIZER_PATH: "$SYMBOLIZER"
+
+  CFLAGS_COMMON: -fno-omit-frame-pointer -fno-optimize-sibling-calls -O1 -g -Wall -Wextra 
+
+  # Pass run-time flags to AddressSanitizer to get core dumps on error.
+  ASAN_OPTIONS_COMMON: abort_on_error=1:disable_coredump=0:unmap_shadow_on_exit=1
+
+  TARBALL_COMPRESSOR: xz
+  TARBALL_EXTENSION: xz
+
+  # limit jobs when debugging cppcheck
+  DEBUG_CPPCHECK: 1
 
 stages:
   - precheck
@@ -27,6 +40,7 @@ stages:
   - docs
   - push
   - postcheck
+  - release
 
 ### Runner Tag Templates
 
@@ -56,8 +70,8 @@ stages:
 
 # Alpine Linux
 
-.alpine-3.10-amd64: &alpine_3_10_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.10-amd64"
+.alpine-3.11-amd64: &alpine_3_11_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.11-amd64"
   <<: *linux_amd64
 
 # CentOS
@@ -100,10 +114,16 @@ stages:
   image: "$CI_REGISTRY_IMAGE:debian-sid-i386"
   <<: *linux_i386
 
+# openSUSE Tumbleweed
+
+.tumbleweed-latest-amd64: &tumbleweed_latest_amd64_image
+  image: "$CI_REGISTRY_IMAGE:tumbleweed-latest-amd64"
+  <<: *linux_amd64
+
 # Fedora
 
-.fedora-30-amd64: &fedora_30_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-30-amd64"
+.fedora-31-amd64: &fedora_31_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-31-amd64"
   <<: *linux_amd64
 
 # Ubuntu
@@ -131,12 +151,14 @@ stages:
     - merge_requests
     - tags
     - web
+    - schedules
 
 .release-branch-triggering-rules: &release_branch_triggering_rules
   only:
     - merge_requests
     - tags
     - web
+    - schedules
     - master@isc-projects/bind9
     - /^v9_[1-9][0-9]$/@isc-projects/bind9
 
@@ -157,7 +179,7 @@ stages:
       - configure
       - ltmain.sh
       - m4/libtool.m4
-    expire_in: "1 week"
+    expire_in: "1 day"
 
 .configure: &configure |
     ${CONFIGURE} \
@@ -172,12 +194,13 @@ stages:
     --without-make-clean \
     $EXTRA_CONFIGURE \
     || cat config.log
-    
+
 .build: &build_job
   <<: *default_triggering_rules
   stage: build
   before_script:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
+    - test -n "${OOT_BUILD_WORKSPACE}" && mkdir "${OOT_BUILD_WORKSPACE}" && cd "${OOT_BUILD_WORKSPACE}"
   script:
     - *configure
     - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
@@ -188,7 +211,43 @@ stages:
     - autoreconf:sid:amd64
   artifacts:
     untracked: true
-    expire_in: "1 week"
+    expire_in: "1 day"
+  except:
+    variables:
+      - $DEBUG_CPPCHECK == "1"
+
+.windows_build: &windows_build_job
+  stage: build
+  tags:
+    - windows
+    - amd64
+  script:
+    - 'Push-Location "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Auxiliary/Build"'
+    - '& cmd.exe /C "vcvarsall.bat x64 & set" | Foreach-Object { if ($_ -match "(.*?)=(.*)") { Set-Item -force -path "Env:\$($matches[1])" -value "$($matches[2])" } }'
+    - 'Pop-Location'
+    - 'Set-Location win32utils'
+    - '& "C:/Strawberry/perl/bin/perl.exe" Configure
+         "with-tools-version=15.0"
+         "with-platform-toolset=v141"
+         "with-platform-version=10.0.17763.0"
+         "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
+         "with-openssl=C:/OpenSSL"
+         "with-libxml2=C:/libxml2"
+         "with-libuv=C:/libuv"
+         "without-python"
+         "with-system-tests"
+         x64'
+    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
+    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
+  dependencies: []
+  needs:
+    - autoreconf:sid:amd64
+  artifacts:
+    untracked: true
+    expire_in: "1 day"
+  except:
+    variables:
+      - $DEBUG_CPPCHECK == "1"
 
 .setup_interfaces: &setup_interfaces |
     if [ "$(id -u)" -eq "0" ]; then
@@ -198,12 +257,11 @@ stages:
     fi
 
 .setup_softhsm: &setup_softhsm |
-    sh -x util/prepare-softhsm2.sh
+    sh -x bin/tests/prepare-softhsm2.sh
 
 .system_test: &system_test_job
   <<: *default_triggering_rules
   stage: system
-  retry: 2
   before_script:
     - *setup_interfaces
     - *setup_softhsm
@@ -212,8 +270,11 @@ stages:
     - test -s bin/tests/system/systests.output
   artifacts:
     untracked: true
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: on_failure
+  except:
+    variables:
+      - $DEBUG_CPPCHECK == "1"
 
 .kyua_report: &kyua_report_html |
   kyua --logfile /dev/null report-html \
@@ -222,6 +283,30 @@ stages:
        --results-filter "" \
        --output kyua_html
 
+.windows_system_test: &windows_system_test_job
+  stage: system
+  tags:
+    - windows
+    - amd64
+  script:
+    - 'Push-Location bin/tests/system'
+    - '$ifIndex = Get-NetIPInterface -AddressFamily IPv4 -InterfaceMetric 75 | Select-Object -ExpandProperty ifIndex'
+    - '& C:/tools/cygwin/bin/sed.exe -i "s/^exit.*/netsh interface ipv4 set dnsservers $ifIndex dhcp/; s/\(name\|interface\)=Loopback/$ifIndex/;" ifconfig.bat'
+    - '& C:/tools/cygwin/bin/sed.exe -i "s/kill -f/kill -W/;" conf.sh stop.pl'
+    - '& cmd.exe /C ifconfig.bat up; ""'
+    - 'Start-Sleep 2'
+    - '$Env:Path = "C:/tools/cygwin/bin;$Env:Path"'
+    - '& sh.exe runall.sh $TEST_PARALLEL_JOBS'
+    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
+  artifacts:
+    untracked: true
+    expire_in: "1 day"
+    when: on_failure
+  only:
+    - schedules
+    - tags
+    - web
+
 .unit_test: &unit_test_job
   <<: *default_triggering_rules
   stage: unit
@@ -236,14 +321,19 @@ stages:
       - kyua.log
       - kyua.results
       - kyua_html/
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: on_failure
+  except:
+    variables:
+      - $DEBUG_CPPCHECK == "1"
 
 .cppcheck_args: &run_cppcheck |
   cppcheck --enable=warning,performance,portability,information,missingInclude \
+           --dump \
            --include=config.h \
            --quiet \
            --std=c11 \
+           --library=std.cfg \
            --language=c \
            --project=compile_commands.json \
            --error-exitcode=2 \
@@ -252,6 +342,7 @@ stages:
            --output-file=cppcheck.results \
            --relative-paths="$CI_PROJECT_DIR" \
            --inline-suppr \
+           -U DOXYGEN \
            --suppressions-list=util/suppressions.txt
 
 .cppcheck_report: &cppcheck_report_html |
@@ -270,11 +361,12 @@ stages:
   after_script:
     - *cppcheck_report_html
   artifacts:
+    untracked: true
     paths:
       - compile_commands.json
       - cppcheck.results
       - cppcheck_html/
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: on_failure
 
 ### Job Definitions
@@ -291,8 +383,11 @@ misc:sid:amd64:
     - sh util/checklibs.sh > checklibs.out
     - sh util/tabify-changes < CHANGES > CHANGES.tmp
     - diff -urNap CHANGES CHANGES.tmp
-    - rm CHANGES.tmp
     - perl util/check-changes CHANGES
+    - test ! -f CHANGES.SE || sh util/tabify-changes < CHANGES.SE > CHANGES.tmp
+    - test ! -f CHANGES.SE || diff -urNap CHANGES.SE CHANGES.tmp
+    - test ! -f CHANGES.SE || perl util/check-changes master=0 CHANGES.SE
+    - rm CHANGES.tmp
     - perl -w util/merge_copyrights
     - diff -urNap util/copyrights util/newcopyrights
     - rm util/newcopyrights
@@ -305,15 +400,33 @@ misc:sid:amd64:
     paths:
       - util/newcopyrights
       - checklibs.out
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: on_failure
 
 🐞:sid:amd64:
   <<: *precheck_job
+  <<: *debian_buster_amd64_image
   script:
     - util/check-cocci
     - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
 
+tarball-create:sid:amd64:
+  <<: *debian_sid_amd64_image
+  stage: precheck
+  script:
+    - source version
+    - export BIND_DIRECTORY="bind-${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
+    - git archive --prefix="${BIND_DIRECTORY}/" --output="${BIND_DIRECTORY}.tar" HEAD
+    - mkdir "${BIND_DIRECTORY}"
+    - echo "SRCID=$(git rev-list --max-count=1 HEAD | cut -b1-7)" > "${BIND_DIRECTORY}/srcid"
+    - tar --append --file="${BIND_DIRECTORY}.tar" "${BIND_DIRECTORY}/srcid"
+    - ${TARBALL_COMPRESSOR} "${BIND_DIRECTORY}.tar"
+  artifacts:
+    paths:
+      - bind-*.tar.${TARBALL_EXTENSION}
+  only:
+    - tags
+
 # Jobs for doc builds on Debian Sid (amd64)
 
 docs:sid:amd64:
@@ -331,7 +444,10 @@ docs:sid:amd64:
   artifacts:
     paths:
       - doc/arm/
-    expire_in: "1 month"
+    expire_in: "1 day"
+  except:
+    variables:
+      - $DEBUG_CPPCHECK == "1"
 
 push:docs:sid:amd64:
   <<: *debian_sid_amd64_image
@@ -343,36 +459,36 @@ push:docs:sid:amd64:
     - master@isc-projects/bind9
     - /^v9_[1-9][0-9]$/@isc-projects/bind9
 
-# Jobs for regular GCC builds on Alpine Linux 3.10 (amd64)
+# Jobs for regular GCC builds on Alpine Linux 3.11 (amd64)
 
-gcc:alpine3.10:amd64:
+gcc:alpine3.11:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--enable-dnstap"
-  <<: *alpine_3_10_amd64_image
+  <<: *alpine_3_11_amd64_image
   <<: *build_job
 
-system:gcc:alpine3.10:amd64:
-  <<: *alpine_3_10_amd64_image
+system:gcc:alpine3.11:amd64:
+  <<: *alpine_3_11_amd64_image
   <<: *system_test_job
   dependencies:
-    - gcc:alpine3.10:amd64
-  needs: ["gcc:alpine3.10:amd64"]
+    - gcc:alpine3.11:amd64
+  needs: ["gcc:alpine3.11:amd64"]
 
-unit:gcc:alpine3.10:amd64:
-  <<: *alpine_3_10_amd64_image
+unit:gcc:alpine3.11:amd64:
+  <<: *alpine_3_11_amd64_image
   <<: *unit_test_job
   dependencies:
-    - gcc:alpine3.10:amd64
-  needs: ["gcc:alpine3.10:amd64"]
+    - gcc:alpine3.11:amd64
+  needs: ["gcc:alpine3.11:amd64"]
 
 # Jobs for regular GCC builds on CentOS 6 (amd64)
 
 gcc:centos6:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--with-libidn2 --disable-warn-error"
   <<: *centos_centos6_amd64_image
   <<: *build_job
@@ -396,7 +512,7 @@ unit:gcc:centos6:amd64:
 gcc:centos7:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
   <<: *centos_centos7_amd64_image
   <<: *build_job
@@ -420,7 +536,7 @@ unit:gcc:centos7:amd64:
 gcc:centos8:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--with-libidn2"
   <<: *centos_centos8_amd64_image
   <<: *build_job
@@ -444,7 +560,7 @@ unit:gcc:centos8:amd64:
 gcc:jessie:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON} -O2"
     EXTRA_CONFIGURE: "--without-cmocka --with-python --disable-geoip"
   <<: *debian_jessie_amd64_image
   <<: *build_job
@@ -468,7 +584,7 @@ unit:gcc:jessie:amd64:
 gcc:stretch:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON} -O2"
   <<: *debian_stretch_amd64_image
   <<: *build_job
 
@@ -491,7 +607,7 @@ unit:gcc:stretch:amd64:
 gcc:buster:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON}"
   <<: *debian_buster_amd64_image
   <<: *build_job
 
@@ -525,7 +641,7 @@ scan-build:buster:amd64:
   stage: postcheck
   variables:
     CC: clang-9
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON}"
     CONFIGURE: "${SCAN_BUILD} ./configure"
     EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
   script:
@@ -538,18 +654,22 @@ scan-build:buster:amd64:
   artifacts:
     paths:
       - scan-build.reports/
-    expire_in: "1 week"
+    expire_in: "1 day"
     when: on_failure
+  except:
+    variables:
+      - $DEBUG_CPPCHECK == "1"
 
 # Jobs for regular GCC builds on Debian Sid (amd64)
 
 gcc:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O3 -g"
+    CFLAGS: "${CFLAGS_COMMON} -O3"
     EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
     RUN_MAKE_INSTALL: 1
     MAKE: bear make
+    DEBUG_CPPCHECK: 0
   <<: *debian_sid_amd64_image
   <<: *build_job
 
@@ -574,12 +694,67 @@ cppcheck:gcc:sid:amd64:
     - gcc:sid:amd64
   needs: ["gcc:sid:amd64"]
 
+# Job for out-of-tree GCC build on Debian Sid (amd64)
+
+oot:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -O3"
+    CONFIGURE: ../configure
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
+    RUN_MAKE_INSTALL: 1
+    OOT_BUILD_WORKSPACE: workspace
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+# Jobs for tarball GCC builds on Debian Sid (amd64)
+
+tarball:sid:amd64:
+  variables:
+    CC: gcc
+    EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
+    RUN_MAKE_INSTALL: 1
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+  before_script:
+    - tar --extract --file bind-*.tar.${TARBALL_EXTENSION}
+    - rm -f bind-*.tar.${TARBALL_EXTENSION}
+    - cd bind-*
+  dependencies:
+    - tarball-create:sid:amd64
+  needs: ["tarball-create:sid:amd64"]
+  only:
+    - tags
+
+system:tarball:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  before_script:
+    - cd bind-*
+    - *setup_interfaces
+  dependencies:
+    - tarball:sid:amd64
+  needs: ["tarball:sid:amd64"]
+  only:
+    - tags
+
+unit:tarball:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  before_script:
+    - cd bind-*
+  dependencies:
+    - tarball:sid:amd64
+  needs: ["tarball:sid:amd64"]
+  only:
+    - tags
+
 # Jobs for regular GCC builds on Debian Sid (i386)
 
 gcc:sid:i386:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O3 -g"
+    CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 --without-python"
   <<: *debian_sid_i386_image
   <<: *build_job
@@ -598,36 +773,60 @@ unit:gcc:sid:i386:
     - gcc:sid:i386
   needs: ["gcc:sid:i386"]
 
-# Jobs for regular GCC builds on Fedora 30 (amd64)
+# Jobs for regular GCC builds on openSUSE Tumbleweed (amd64)
 
-gcc:fedora30:amd64:
+gcc:tumbleweed:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *fedora_30_amd64_image
+  <<: *tumbleweed_latest_amd64_image
   <<: *build_job
 
-system:gcc:fedora30:amd64:
-  <<: *fedora_30_amd64_image
+system:gcc:tumbleweed:amd64:
+  <<: *tumbleweed_latest_amd64_image
   <<: *system_test_job
   dependencies:
-    - gcc:fedora30:amd64
-  needs: ["gcc:fedora30:amd64"]
+    - gcc:tumbleweed:amd64
+  needs: ["gcc:tumbleweed:amd64"]
 
-unit:gcc:fedora30:amd64:
-  <<: *fedora_30_amd64_image
+unit:gcc:tumbleweed:amd64:
+  <<: *tumbleweed_latest_amd64_image
   <<: *unit_test_job
   dependencies:
-    - gcc:fedora30:amd64
-  needs: ["gcc:fedora30:amd64"]
+    - gcc:tumbleweed:amd64
+  needs: ["gcc:tumbleweed:amd64"]
+
+# Jobs for regular GCC builds on Fedora 31 (amd64)
+
+gcc:fedora31:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON} -O1"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *fedora_31_amd64_image
+  <<: *build_job
+
+system:gcc:fedora31:amd64:
+  <<: *fedora_31_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - gcc:fedora31:amd64
+  needs: ["gcc:fedora31:amd64"]
+
+unit:gcc:fedora31:amd64:
+  <<: *fedora_31_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - gcc:fedora31:amd64
+  needs: ["gcc:fedora31:amd64"]
 
 # Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)
 
 gcc:xenial:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON} -O2"
     EXTRA_CONFIGURE: "--disable-geoip"
   <<: *ubuntu_xenial_amd64_image
   <<: *build_job
@@ -651,7 +850,7 @@ unit:gcc:xenial:amd64:
 gcc:bionic:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON} -Og"
     EXTRA_CONFIGURE: "--with-libidn2"
   <<: *ubuntu_bionic_amd64_image
   <<: *build_job
@@ -675,14 +874,15 @@ unit:gcc:bionic:amd64:
 asan:sid:amd64:
   variables:
     CC: gcc
-    ASAN_OPTIONS: "detect_leaks=0"
-    CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
     LDFLAGS: "-fsanitize=address,undefined"
     EXTRA_CONFIGURE: "--with-libidn2"
   <<: *debian_sid_amd64_image
   <<: *build_job
 
 system:asan:sid:amd64:
+  variables:
+    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
   <<: *debian_sid_amd64_image
   <<: *system_test_job
   dependencies:
@@ -690,16 +890,75 @@ system:asan:sid:amd64:
   needs: ["asan:sid:amd64"]
 
 unit:asan:sid:amd64:
+  variables:
+    ASAN_OPTIONS: ${ASAN_OPTIONS_COMMON}
   <<: *debian_sid_amd64_image
   <<: *unit_test_job
   dependencies:
     - asan:sid:amd64
   needs: ["asan:sid:amd64"]
 
+# Jobs for GCC builds with TSAN enabled on Debian Sid (amd64)
+
+tsan:buster:amd64:
+  <<: *debian_buster_amd64_image
+  <<: *build_job
+  variables:
+    CC: clang-9
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    LDFLAGS: "-fsanitize=thread"
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
+
+system:tsan:buster:amd64:
+  variables:
+    TSAN_OPTIONS: "second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=$SYMBOLIZER exitcode=0"
+  before_script:
+    - *setup_interfaces
+    - echo $TSAN_OPTIONS
+  <<: *debian_buster_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - tsan:buster:amd64
+  needs: ["tsan:buster:amd64"]
+  allow_failure: true
+  after_script:
+    - find bin -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
+  artifacts:
+    expire_in: "1 day"
+    paths:
+      - bin/tests/system/*/tsan.*
+      - bin/tests/system/*/*/tsan.*
+      - tsan/
+    when: on_failure
+
+unit:tsan:buster:amd64:
+  variables:
+    TSAN_OPTIONS: "second_deadlock_stack=1 history_size=7 log_exe_name=true log_path=tsan external_symbolizer_path=$SYMBOLIZER"
+  before_script:
+    - echo $TSAN_OPTIONS
+    - lib/isc/tests/result_test
+  <<: *debian_buster_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - tsan:buster:amd64
+  needs: ["tsan:buster:amd64"]
+  allow_failure: true
+  after_script:
+    - find lib -name 'tsan.*' -exec python3 util/parse_tsan.py {} \;
+  artifacts:
+    expire_in: "1 day"
+    paths:
+      - lib/*/tests/tsan.*
+      - tsan/
+      - kyua.log
+      - kyua.results
+      - kyua_html/
+    when: on_failure
+
 rwlock:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    CFLAGS: "${CFLAGS_COMMON} -Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
     EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock"
   <<: *debian_sid_amd64_image
   <<: *build_job
@@ -722,7 +981,7 @@ unit:rwlock:sid:amd64:
 mutexatomics:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    CFLAGS: "${CFLAGS_COMMON} -DISC_MEM_USE_INTERNAL_MALLOC=0"
     EXTRA_CONFIGURE: "--with-libidn2 --enable-mutex-atomics"
   <<: *debian_sid_amd64_image
   <<: *build_job
@@ -747,7 +1006,7 @@ mutexatomics:sid:amd64:
 clang:stretch:amd64:
   variables:
     CC: clang
-    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
     EXTRA_CONFIGURE: "--with-python=python3"
   <<: *debian_stretch_amd64_image
   <<: *build_job
@@ -764,7 +1023,7 @@ unit:clang:stretch:amd64:
 clang:stretch:i386:
   variables:
     CC: clang
-    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
     EXTRA_CONFIGURE: "--with-python=python2"
   <<: *debian_stretch_i386_image
   <<: *build_job
@@ -774,7 +1033,7 @@ clang:stretch:i386:
 pkcs11:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--enable-native-pkcs11 --with-pkcs11=/usr/lib/softhsm/libsofthsm2.so"
   <<: *debian_sid_amd64_image
   <<: *build_job
@@ -797,7 +1056,7 @@ unit:pkcs11:sid:amd64:
 
 clang:freebsd11.3:amd64:
   variables:
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON}"
   <<: *freebsd_amd64
   <<: *build_job
 
@@ -819,7 +1078,7 @@ unit:clang:freebsd11.3:amd64:
 
 clang:freebsd12.0:amd64:
   variables:
-    CFLAGS: "-Wall -Wextra -O2 -g"
+    CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--enable-dnstap"
   <<: *freebsd_amd64
   <<: *build_job
@@ -853,6 +1112,7 @@ system:clang:openbsd6.5:amd64:
     - clang:openbsd6.5:amd64
   needs: ["clang:openbsd6.5:amd64"]
   only:
+    - schedules
     - tags
     - web
 
@@ -861,7 +1121,7 @@ system:clang:openbsd6.5:amd64:
 nolibtool:sid:amd64:
   variables:
     CC: gcc
-    CFLAGS: "-Wall -Wextra -Og -g"
+    CFLAGS: "${CFLAGS_COMMON}"
     EXTRA_CONFIGURE: "--with-libidn2 --without-libtool --with-dlopen"
   <<: *debian_sid_amd64_image
   <<: *build_job
@@ -883,62 +1143,80 @@ unit:nolibtool:sid:amd64:
 # Jobs for Visual Studio 2017 builds on Windows (amd64)
 
 msvc:windows:amd64:
+  <<: *windows_build_job
   <<: *default_triggering_rules
-  stage: build
-  tags:
-    - windows
-    - amd64
   variables:
     VSCONF: Release
-  script:
-    - 'Push-Location "C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Auxiliary/Build"'
-    - '& cmd.exe /C "vcvarsall.bat x64 & set" | Foreach-Object { if ($_ -match "(.*?)=(.*)") { Set-Item -force -path "Env:\$($matches[1])" -value "$($matches[2])" } }'
-    - 'Pop-Location'
-    - 'Set-Location win32utils'
-    - '& "C:/Strawberry/perl/bin/perl.exe" Configure
-         "with-tools-version=15.0"
-         "with-platform-toolset=v141"
-         "with-platform-version=10.0.17763.0"
-         "with-vcredist=C:/Program Files (x86)/Microsoft Visual Studio/2017/BuildTools/VC/Redist/MSVC/14.16.27012/vcredist_x64.exe"
-         "with-openssl=C:/OpenSSL"
-         "with-libxml2=C:/libxml2"
-         "with-libuv=C:/libuv"
-         "without-python"
-         "with-system-tests"
-         x64'
-    - 'Set-Item -path "Env:CL" -value "/MP$([Math]::Truncate($BUILD_PARALLEL_JOBS/2))"'
-    - '& msbuild.exe /maxCpuCount:2 /t:Build /p:Configuration=$VSCONF bind9.sln'
-  dependencies: []
-  needs:
-    - autoreconf:sid:amd64
-  artifacts:
-    untracked: true
-    expire_in: "1 week"
 
 system:msvc:windows:amd64:
-  stage: system
-  tags:
-    - windows
-    - amd64
+  <<: *windows_system_test_job
   variables:
     VSCONF: Release
-  script:
-    - 'Push-Location bin/tests/system'
-    - '$ifIndex = Get-NetIPInterface -AddressFamily IPv4 -InterfaceMetric 75 | Select-Object -ExpandProperty ifIndex'
-    - '& C:/tools/cygwin/bin/sed.exe -i "s/^exit.*/netsh interface ipv4 set dnsservers $ifIndex dhcp/; s/\(name\|interface\)=Loopback/$ifIndex/;" ifconfig.bat'
-    - '& C:/tools/cygwin/bin/sed.exe -i "s/kill -f/kill -W/;" conf.sh stop.pl'
-    - '& cmd.exe /C ifconfig.bat up; ""'
-    - 'Start-Sleep 2'
-    - '$Env:Path = "C:/tools/cygwin/bin;$Env:Path"'
-    - '& sh.exe runall.sh $TEST_PARALLEL_JOBS'
-    - 'If (Test-Path C:/CrashDumps/*) { dir C:/CrashDumps; Throw }'
   dependencies:
     - msvc:windows:amd64
   needs: ["msvc:windows:amd64"]
-  artifacts:
-    untracked: true
-    expire_in: "1 week"
-    when: on_failure
+  except:
+    variables:
+      - $DEBUG_CPPCHECK == "1"
+
+msvc-debug:windows:amd64:
+  <<: *windows_build_job
+  variables:
+    VSCONF: Debug
   only:
+    - schedules
     - tags
     - web
+
+system:msvc-debug:windows:amd64:
+  <<: *windows_system_test_job
+  variables:
+    VSCONF: Debug
+  dependencies:
+    - msvc-debug:windows:amd64
+  needs: ["msvc-debug:windows:amd64"]
+  except:
+    variables:
+      - $DEBUG_CPPCHECK == "1"
+
+# Job producing a release tarball
+
+release:sid:amd64:
+  <<: *debian_sid_amd64_image
+  stage: release
+  script:
+    # Determine BIND version
+    - source version
+    - export BIND_DIRECTORY="bind-${MAJORVER}.${MINORVER}.${PATCHVER}${RELEASETYPE}${RELEASEVER}"
+    # Remove redundant files and system test utilities from Windows build artifacts
+    - find Build/Release/ -name "*.pdb" -print -delete
+    - find Build/Debug/ \( -name "*.bsc" -o -name "*.idb" \) -print -delete
+    - find Build/ -regextype posix-extended -regex "Build/.*/($(find bin/tests/ -type f | sed -nE "s|^bin/tests(/system)?/win32/(.*)\.vcxproj$|\2|p" | paste -d"|" -s))\..*" -print -delete
+    # Create Windows zips
+    - openssl dgst -sha256 "${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" | tee Build/Release/SHA256 Build/Debug/SHA256
+    - ( cd Build/Release; zip "../../BIND${BIND_DIRECTORY#bind-}.x64.zip" * )
+    - ( cd Build/Debug; zip "../../BIND${BIND_DIRECTORY#bind-}.debug.x64.zip" * )
+    # Prepare release tarball contents (tarballs + zips + documentation)
+    - mkdir -p release/doc/arm
+    - pushd release
+    - mv "../${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}" ../BIND*.zip .
+    - tar --extract --file="${BIND_DIRECTORY}.tar.${TARBALL_EXTENSION}"
+    - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README,srcid} .
+    - mv "${BIND_DIRECTORY}"/doc/arm/{Bv9ARM{*.html,.pdf},man.*,notes.{html,pdf,txt}} doc/arm/
+    - rm -rf "${BIND_DIRECTORY}"
+    - cp doc/arm/notes.html "RELEASE-NOTES-${BIND_DIRECTORY}.html"
+    - cp doc/arm/notes.pdf "RELEASE-NOTES-${BIND_DIRECTORY}.pdf"
+    - cp doc/arm/notes.txt "RELEASE-NOTES-${BIND_DIRECTORY}.txt"
+    - popd
+    # Create release tarball
+    - tar --create --file="${CI_COMMIT_TAG}.tar.gz" --gzip release/
+  dependencies:
+    - tarball-create:sid:amd64
+    - msvc:windows:amd64
+    - msvc-debug:windows:amd64
+  only:
+    - tags
+  artifacts:
+    paths:
+      - "*.tar.gz"
+    expire_in: "1 day"

.gitlab/issue_templates/Release.md

@@ -2,8 +2,6 @@
 
 **Tagging Deadline:**
 
-**ASN Deadline:**
-
 **Public Release:**
 
 ## Release Checklist
@@ -12,6 +10,7 @@
 
  - [ ] ***(QA)*** Check whether all issues assigned to the release milestone are resolved[^1].
  - [ ] ***(QA)*** Ensure that there are no outstanding merge requests in the private repository[^1] (Subscription Edition only).
+ - [ ] ***(QA)*** Ensure all merge requests marked for backporting have been indeed backported.
 
 ## Before the Tagging Deadline
 
@@ -33,21 +32,22 @@
 
 ## Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)
 
- - [ ] ***(QA)*** Run the `make release` Jenkins jobs to produce the tarballs and zips.
- - [ ] ***(QA)*** Verify the results of `make release` Jenkins jobs and prepare a QA report for the releases to be published.
- - [ ] ***(QA)*** Request signatures for the tarballs.
- - [ ] ***(Signers)*** Sign the tarballs.
- - [ ] ***(QA)*** Check tarball signatures.
- - [ ] ***(QA)*** Notify Support that the releases are ready for publication.
+ - [ ] ***(QA)*** Verify GitLab CI results for the tags created and prepare a QA report for the releases to be published.
+ - [ ] ***(QA)*** Request signatures for the tarballs, providing their location and checksums.
+ - [ ] ***(Signers)*** Validate tarball checksums, sign tarballs, and upload signatures.
+ - [ ] ***(QA)*** Verify tarball signatures and check tarball checksums again.
  - [ ] ***(Support)*** Pre-publish ASN and/or Subscription Edition tarballs so that packages can be built.
  - [ ] ***(QA)*** Build and test ASN and/or Subscription Edition packages.
+ - [ ] ***(QA)*** Notify Support that the releases have been prepared.
  - [ ] ***(Support)*** Send out ASNs (if applicable).
 
 ## On the Day of Public Release
 
- - [ ] ***(Support)*** Publish the releases according to the release schedule.
- - [ ] ***(Support)*** Write release email to *bind9-announce*.
- - [ ] ***(Support)*** Write email to *bind9-users* (if a major release).
+ - [ ] ***(Support)*** Wait for clearance from Security Officer to proceed with the public release (if applicable).
+ - [ ] ***(Support)*** Place tarballs in public location on FTP site.
+ - [ ] ***(Support)*** Publish links to downloads on ISC website.
+ - [ ] ***(Support)*** Write release email to *bind-announce*.
+ - [ ] ***(Support)*** Write email to *bind-users* (if a major release).
  - [ ] ***(Support)*** Update tickets in case of waiting support customers.
  - [ ] ***(QA)*** Build and test any outstanding private packages.
  - [ ] ***(QA)*** Build public packages (`*.deb`, RPMs).

CHANGES

@@ -1,3 +1,121 @@
+5350.	[bug]		When a view was configured with class CHAOS, the
+			server could crash while processing a query for a
+			non-existent record. [GL #1540]
+
+5349.	[bug]		Fix a race in task_pause/unpause. [GL #1571]
+
+5348.	[bug]		dnssec-settime -Psync was not being honoured.
+			[GL !2893]
+
+	--- 9.15.8 released ---
+
+5347.	[bug]		Fixed a bug that could cause an intermittent crash
+			in validator.c when validating a negative cache
+			entry. [GL #1561]
+
+5346.	[bug]		Make hazard pointer array allocations dynamic, fixing
+			a bug that caused named to crash on machines with more
+			than 40 cores. [GL #1493]
+
+5345.	[func]		Key-style trust anchors and DS-style trust anchors
+			can now both be used for the same name. [GL #1237]
+
+5344.	[bug]		Handle accept() errors properly in netmgr. [GL !2880]
+
+5343.	[func]		Add statistics counters to the netmgr. [GL #1311]
+
+5342.	[bug]		Disable pktinfo for IPv6 and bind to each interface
+			explicitly instead, because libuv doesn't support
+			pktinfo control messages. [GL #1558]
+
+5341.	[func]		Simplify passing the bound TCP socket to child
+			threads by using isc_uv_export/import functions.
+			[GL !2825]
+
+5340.	[bug]		Don't deadlock when binding to a TCP socket fails.
+			[GL #1499]
+
+5339.	[bug]		With some libmaxminddb versions, named could erroneously
+			match an IP address not belonging to any subnet defined
+			in a given GeoIP2 database to one of the existing
+			entries in that database. [GL #1552]
+
+5338.	[bug]		Fix line spacing in `rndc secroots`.
+			Thanks to Tony Finch. [GL !2478]
+
+5337.	[func]		'named -V' now reports maxminddb and protobuf-c
+			versions. [GL !2686]
+
+	--- 9.15.7 released ---
+
+5336.	[bug]		The TCP high-water statistic could report an
+			incorrect value on startup. [GL #1392]
+
+5335.	[func]		Make TCP listening code multithreaded. [GL !2659]
+
+5334.	[doc]		Update documentation with dnssec-policy clarifications.
+			Also change some defaults. [GL !2711]
+
+5333.	[bug]		Fix duration printing on Solaris when value is not
+			an ISO 8601 duration. [GL #1460]
+
+5332.	[func]		Renamed "dnssec-keys" configuration statement
+			to the more descriptive "trust-anchors". [GL !2702]
+
+5331.	[func]		Use compiler-provided mechanisms for thread local
+			storage, and make the requirement for such mechanisms
+			explicit in configure. [GL #1444]
+
+5330.	[bug]		'configure --without-python' was ineffective if
+			PYTHON was set in the environment. [GL #1434]
+
+5329.	[bug]		Reconfiguring named caused memory to be leaked when any
+			GeoIP2 database was in use. [GL #1445]
+
+5328.	[bug]		rbtdb.c:rdataset_{get,set}ownercase failed to obtain
+			a node lock. [GL #1417]
+
+5327.	[func]		Added a statistics counter to track queries
+			dropped because the recursive-clients quota was
+			exceeded. [GL #1399]
+
+5326.	[bug]		Add Python dependency on 'distutils.core' to configure.
+			'distutils.core' is required for installation.
+			[GL #1397]
+
+5325.	[bug]		Addressed several issues with TCP connections in
+			the netmgr: restored support for TCP connection
+			timeouts, restored TCP backlog support, actively
+			close all open sockets during shutdown. [GL #1312]
+
+5324.	[bug]		Change the category of some log messages from general
+			to the more appopriate catergory of xfer-in. [GL #1394]
+
+5323.	[bug]		Fix a bug in DNSSEC trust anchor verification.
+			[GL !2609]
+
+5322.	[placeholder]
+
+5321.	[bug]		Obtain write lock before updating version->records
+			and version->bytes. [GL #1341]
+
+5320.	[cleanup]	Silence TSAN on header->count. [GL #1344]
+
+	--- 9.15.6 released ---
+
+5319.	[func]		Trust anchors can now be configured using DS
+			format to represent a key digest, by using the
+			new "initial-ds" or "static-ds" keywords in
+			the "dnssec-keys" statement.
+
+			Note: DNSKEY-format and DS-format trust anchors
+			cannot both be used for the same domain name.
+			[GL #622]
+
+5318.	[cleanup]	The DNSSEC validation code has been refactored
+			for clarity and to reduce code duplication.
+			[GL #622]
+
 5317.	[func]		A new asynchronous network communications system
 			based on libuv is now used for listening for
 			incoming requests and responding to them. (The
@@ -49,7 +167,8 @@
 5307.	[bug]		Fix hang when named-compilezone output is sent to pipe.
 			Thanks to Tony Finch. [GL !2481]
 
-5306.	[placeholder]
+5306.	[security]	Set a limit on number of simultaneous pipelined TCP
+			queries. (CVE-2019-6477) [GL #1264]
 
 5305.	[bug]		NSEC Aggressive Cache ("synth-from-dnssec") has been
 			disabled by default because it was found to have

COPYRIGHT

@@ -1,4 +1,4 @@
-Copyright (C) 1996-2019  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2020  Internet Systems Consortium, Inc. ("ISC")
 
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this

HISTORY.md

@@ -150,7 +150,7 @@ releases.  New features include:
 - "rndc modzone" reconfigures a single zone, without requiring the entire
   server to be reconfigured.
 - "rndc showzone" displays the current configuration of a zone.
-- "rndc managed-keys" can be used to check the status of RFC 5001 managed
+- "rndc managed-keys" can be used to check the status of RFC 5011 managed
   trust anchors, or to force trust anchors to be refreshed.
 - "max-cache-size" can now be set to a percentage of available memory. The
   default is 90%.

PLATFORMS

@@ -4,16 +4,29 @@ Supported platforms
 
 In general, this version of BIND will build and run on any POSIX-compliant
 system with a C11-compliant C compiler, BSD-style sockets with
-RFC-compliant IPv6 support, POSIX-compliant threads, and the OpenSSL
-cryptography library. Atomic operations support from the compiler is
-needed, either in the form of builtin operations, C11 atomics or the
-Interlocked family of functions on Windows.
+RFC-compliant IPv6 support, POSIX-compliant threads, the libuv
+asynchronous I/O library, and the OpenSSL cryptography library.
 
-BIND 9.15 requires fairly recent version of libuv library to run (>= 1.x).
-For some of the older systems listed below, you will have to install
-updated libuv package from sources such as EPEL, PPA and other native
-sources for updated packages. The other option is to install libuv from
-sources.
+The following C11 features are used in BIND 9:
+
+  * Atomic operations support from the compiler is needed, either in the
+    form of builtin operations, C11 atomics, or the Interlocked family of
+    functions on Windows.
+
+  * Thread Local Storage support from the compiler is needed, either in
+    the form of C11 _Thread_local/thread_local, the __thread GCC
+    extension, or the __declspec(thread) MSVC extension on Windows.
+
+BIND 9.15 requires a fairly recent version of libuv (at least 1.x). For
+some of the older systems listed below, you will have to install an
+updated libuv package from sources such as EPEL, PPA, or other native
+sources for updated packages. The other option is to build and install
+libuv from source.
+
+Certain optional BIND features have additional library dependencies. These
+include libxml2 and libjson-c for statistics, libmaxminddb for
+geolocation, libfstrm and libprotobuf-c for DNSTAP, and libidn2 for
+internationalized domain name conversion.
 
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -26,7 +39,7 @@ following systems:
 
   * Debian 9, 10
   * Ubuntu LTS 16.04, 18.04
-  * Fedora 30
+  * Fedora 31
   * Red Hat Enterprise Linux / CentOS 7, 8
   * FreeBSD 11.3, 12.0
   * OpenBSD 6.5
@@ -57,10 +70,10 @@ Server 2012 R2, none of these are tested regularly by ISC.
 
 Community maintained
 
-These systems may not all have easily available the required dependencies
-for building BIND although it will be possible in many cases to compile
+These systems may not all have the required dependencies for building BIND
+easily available, although it will be possible in many cases to compile
 those directly from source. The community and interested parties may wish
-to help with maintenance and we welcome patch contributions, although we
+to help with maintenance, and we welcome patch contributions, although we
 cannot guarantee that we will accept them. All contributions will be
 assessed against the risk of adverse effect on officially supported
 platforms.
@@ -83,6 +96,4 @@ These are platforms on which BIND 9.15 is known not to build or run:
   * Platforms that don't support atomic operations (via compiler or
     library)
   * Linux without NPTL (Native POSIX Thread Library)
-  * Platforms where libuv cannot be compiled
-
-Platform quirks
+  * Platforms on which libuv cannot be compiled

PLATFORMS.md

@@ -12,15 +12,29 @@
 
 In general, this version of BIND will build and run on any POSIX-compliant
 system with a C11-compliant C compiler, BSD-style sockets with RFC-compliant
-IPv6 support, POSIX-compliant threads, and the OpenSSL cryptography library.
-Atomic operations support from the compiler is needed, either in the form of
-builtin operations, C11 atomics or the Interlocked family of functions on
-Windows.
+IPv6 support, POSIX-compliant threads, the `libuv` asynchronous I/O library,
+and the OpenSSL cryptography library.
 
-BIND 9.15 requires fairly recent version of libuv library to run (>= 1.x).  For
-some of the older systems listed below, you will have to install updated libuv
-package from sources such as EPEL, PPA and other native sources for updated
-packages.  The other option is to install libuv from sources.
+The following C11 features are used in BIND 9:
+
+* Atomic operations support from the compiler is needed, either in the form of
+  builtin operations, C11 atomics, or the `Interlocked` family of functions on
+  Windows.
+
+* Thread Local Storage support from the compiler is needed, either in the form
+  of C11 `_Thread_local`/`thread_local`, the `__thread` GCC extension, or
+  the `__declspec(thread)` MSVC extension on Windows.
+
+BIND 9.15 requires a fairly recent version of `libuv` (at least 1.x).  For
+some of the older systems listed below, you will have to install an updated
+`libuv` package from sources such as EPEL, PPA, or other native sources for
+updated packages. The other option is to build and install `libuv` from
+source.
+
+Certain optional BIND features have additional library dependencies.
+These include `libxml2` and `libjson-c` for statistics, `libmaxminddb` for
+geolocation, `libfstrm` and `libprotobuf-c` for DNSTAP, and `libidn2` for
+internationalized domain name conversion.
 
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -33,7 +47,7 @@ following systems:
 
 * Debian 9, 10
 * Ubuntu LTS 16.04, 18.04
-* Fedora 30
+* Fedora 31
 * Red Hat Enterprise Linux / CentOS 7, 8
 * FreeBSD 11.3, 12.0
 * OpenBSD 6.5
@@ -63,12 +77,13 @@ Server 2012 R2, none of these are tested regularly by ISC.
 
 ### Community maintained
 
-These systems may not all have easily available the required dependencies for
-building BIND although it will be possible in many cases to compile those
-directly from source. The community and interested parties may wish to help with
-maintenance and we welcome patch contributions, although we cannot guarantee
-that we will accept them.  All contributions will be assessed against the risk
-of adverse effect on officially supported platforms.
+These systems may not all have the required dependencies for building BIND
+easily available, although it will be possible in many cases to compile
+those directly from source. The community and interested parties may wish
+to help with maintenance, and we welcome patch contributions, although we
+cannot guarantee that we will accept them.  All contributions will be
+assessed against the risk of adverse effect on officially supported
+platforms.
 
 * Platforms past or close to their respective EOL dates, such as:
     * Ubuntu 14.04, 18.10
@@ -87,6 +102,4 @@ These are platforms on which BIND 9.15 is known *not* to build or run:
 * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
 * Platforms that don't support atomic operations (via compiler or library)
 * Linux without NPTL (Native POSIX Thread Library)
-* Platforms where libuv cannot be compiled
-
-## Platform quirks
+* Platforms on which `libuv` cannot be compiled

README

@@ -48,8 +48,8 @@ the file HISTORY.
 For a detailed list of changes made throughout the history of BIND 9, see
 the file CHANGES. See below for details on the CHANGES file format.
 
-For up-to-date release notes and errata, see http://www.isc.org/software/
-bind9/releasenotes
+For up-to-date versions and release notes, see https://www.isc.org/
+download/.
 
 For information about supported platforms, see PLATFORMS.
 
@@ -111,28 +111,33 @@ BIND 9.15 features
 BIND 9.15 is the newest development branch of BIND 9. It includes a number
 of changes from BIND 9.14 and earlier releases. New features include:
 
-  * Support for the new GeoIP2 geolocation API
-  * Improved DNSSEC key configuration using dnssec-keys
+  * New dnssec-policy statement to configure a key and signing policy for
+    zones, enabling automatic key regeneration and rollover.
+  * New network manager based on libuv.
+  * Added support for the new GeoIP2 geolocation API, libmaxminddb.
+  * Improved DNSSEC trust anchor configuration using the trust-anchors
+    statement, permitting configuration of trust anchors in DS as well as
+    DNSKEY format.
   * YAML output for dig, mdig, and delv.
 
 Building BIND
 
 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
-basic POSIX support, and a 64-bit integer type. Successful builds have
-been observed on many versions of Linux and UNIX, including RHEL/CentOS,
-Fedora, Debian, Ubuntu, SLES, openSUSE, Slackware, Alpine, FreeBSD,
-NetBSD, OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE, HP-UX, and
-OpenWRT.
+basic POSIX support, and a 64-bit integer type. BIND also requires the
+libuv asynchronous I/O library, and a cryptography provider library such
+as OpenSSL or a hardware service module supporting PKCS#11. On Linux, BIND
+requires the libcap library to set process privileges, though this
+requirement can be overridden by disabling capability support at compile
+time. See Compile-time options below for details on other libraries that
+may be required to support optional features.
 
-BIND requires a cryptography provider library such as OpenSSL or a
-hardware service module supporting PKCS#11. On Linux, BIND requires the
-libcap library to set process privileges, though this requirement can be
-overridden by disabling capability support at compile time. See
-Compile-time options below for details on other libraries that may be
-required to support optional features.
+Successful builds have been observed on many versions of Linux and UNIX,
+including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE, Slackware,
+Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE,
+HP-UX, and OpenWRT.
 
-BIND is also available for Windows Server 2008 and higher. See win32utils/
-build.txt for details on building for Windows systems.
+BIND is also available for Windows Server 2012 R2 and higher. See
+win32utils/build.txt for details on building for Windows systems.
 
 To build on a UNIX or Linux system, use:
 
@@ -175,9 +180,10 @@ Dependencies
 
 Portions of BIND that are written in Python, including dnssec-keymgr,
 dnssec-coverage, dnssec-checkds, and some of the system tests, require the
-argparse and ply modules to be available. argparse is a standard module as
-of Python 2.7 and Python 3.2. ply is available from https://
-pypi.python.org/pypi/ply.
+argparse, ply and distutils.core modules to be available. argparse is a
+standard module as of Python 2.7 and Python 3.2. ply is available from
+https://pypi.python.org/pypi/ply. distutils.core is required for
+installation.
 
 Compile-time options
 

README.md

@@ -57,8 +57,8 @@ For a detailed list of changes made throughout the history of BIND 9, see
 the file [CHANGES](CHANGES). See [below](#changes) for details on the
 CHANGES file format.
 
-For up-to-date release notes and errata, see
-[http://www.isc.org/software/bind9/releasenotes](http://www.isc.org/software/bind9/releasenotes)
+For up-to-date versions and release notes, see
+[https://www.isc.org/download/](https://www.isc.org/download/).
 
 For information about supported platforms, see [PLATFORMS](PLATFORMS.md).
 
@@ -127,29 +127,33 @@ BIND 9.15 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.14 and earlier releases. New features
 include:
 
-* New "dnssec-policy" statement to configure a key and signing policy
+* New `dnssec-policy` statement to configure a key and signing policy
   for zones, enabling automatic key regeneration and rollover.
-* A new network manager based on libuv.
-* Support for the new GeoIP2 geolocation API
-* Improved DNSSEC trust anchor configuration using `dnssec-keys`
+* New network manager based on libuv.
+* Added support for the new GeoIP2 geolocation API, `libmaxminddb`.
+* Improved DNSSEC trust anchor configuration using the `trust-anchors`
+  statement, permitting configuration of trust anchors in DS as well as
+  DNSKEY format.
 * YAML output for `dig`, `mdig`, and `delv`.
 
 ### <a name="build"/> Building BIND
 
 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
-basic POSIX support, and a 64-bit integer type. Successful builds have been
-observed on many versions of Linux and UNIX, including RHEL/CentOS, Fedora,
-Debian, Ubuntu, SLES, openSUSE, Slackware, Alpine, FreeBSD, NetBSD,
-OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
+basic POSIX support, and a 64-bit integer type.  BIND also requires the
+`libuv` asynchronous I/O library, and a cryptography provider library
+such as OpenSSL or a hardware service module supporting PKCS#11. On
+Linux, BIND requires the `libcap` library to set process privileges,
+though this requirement can be overridden by disabling capability
+support at compile time. See [Compile-time options](#opts) below
+for details on other libraries that may be required to support
+optional features.
 
-BIND requires a cryptography provider library such as OpenSSL or a
-hardware service module supporting PKCS#11. On Linux, BIND requires
-the `libcap` library to set process privileges, though this requirement
-can be overridden by disabling capability support at compile time.
-See [Compile-time options](#opts) below for details on other libraries
-that may be required to support optional features.
+Successful builds have been observed on many versions of Linux and
+UNIX, including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE,
+Slackware, Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris,
+OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
 
-BIND is also available for Windows Server 2008 and higher.  See
+BIND is also available for Windows Server 2012 R2 and higher.  See
 `win32utils/build.txt` for details on building for Windows
 systems.
 
@@ -187,9 +191,11 @@ or if you have Xcode already installed you can run `xcode-select --install`.
 
 Portions of BIND that are written in Python, including
 `dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
-system tests, require the `argparse` and `ply` modules to be available.
+system tests, require the `argparse`, `ply` and `distutils.core` modules
+to be available.
 `argparse` is a standard module as of Python 2.7 and Python 3.2.
 `ply` is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
+`distutils.core` is required for installation.
 
 #### <a name="opts"/> Compile-time options
 

bin/check/named-checkconf.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -148,5 +148,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/check/named-checkconf.c

@@ -709,8 +709,6 @@ main(int argc, char **argv) {
 
 	cfg_parser_destroy(&parser);
 
-	dns_name_destroy();
-
 	isc_log_destroy(&logc);
 
 	isc_mem_destroy(&mctx);

bin/check/named-checkconf.docbook

@@ -41,6 +41,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/check/named-checkconf.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/check/named-checkzone.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -325,5 +325,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/check/named-checkzone.c

@@ -85,9 +85,9 @@ usage(void) {
 
 static void
 destroy(void) {
-	if (zone != NULL)
+	if (zone != NULL) {
 		dns_zone_detach(&zone);
-	dns_name_destroy();
+	}
 }
 
 /*% main processing routine */

bin/check/named-checkzone.docbook

@@ -44,6 +44,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/check/named-checkzone.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/confgen/ddns-confgen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -144,5 +144,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/confgen/ddns-confgen.docbook

@@ -38,6 +38,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/confgen/ddns-confgen.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/confgen/rndc-confgen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -206,5 +206,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/confgen/rndc-confgen.docbook

@@ -45,6 +45,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/confgen/rndc-confgen.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/delv/delv.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -144,7 +144,7 @@ options\&.
 Note: When reading the trust anchor file,
 \fBdelv\fR
 treats
-\fBdnssec\-keys\fR\fBinitial\-key\fR
+\fBtrust\-anchors\fR\fBinitial\-key\fR
 and
 \fBstatic\-key\fR
 entries identically\&. That is, even if a key is configured with
@@ -433,5 +433,5 @@ RFC5155\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/delv/delv.c

@@ -33,8 +33,10 @@
 #include <isc/app.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
+#include <isc/hex.h>
 #include <isc/lib.h>
 #include <isc/log.h>
+#include <isc/md.h>
 #include <isc/mem.h>
 #ifdef WIN32
 #include <isc/ntpaths.h>
@@ -138,7 +140,7 @@ static dns_fixedname_t afn;
 static dns_name_t *anchor_name = NULL;
 
 /* Default bind.keys contents */
-static char anchortext[] = DNSSEC_KEYS;
+static char anchortext[] = TRUST_ANCHORS;
 
 /*
  * Static function prototypes
@@ -158,43 +160,44 @@ usage(void) {
 "        q-class  is one of (in,hs,ch,...) [default: in]\n"
 "        q-type   is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n"
 "        q-opt    is one of:\n"
-"                 -x dot-notation     (shortcut for reverse lookups)\n"
-"                 -d level            (set debugging level)\n"
+"                 -4                  (use IPv4 query transport only)\n"
+"                 -6                  (use IPv6 query transport only)\n"
 "                 -a anchor-file      (specify root trust anchor)\n"
 "                 -b address[#port]   (bind to source address/port)\n"
+"                 -c class            (option included for compatibility;\n"
+"                 -d level            (set debugging level)\n"
+"                 -h                  (print help and exit)\n"
+"                 -i                  (disable DNSSEC validation)\n"
+"                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
 "                 -q name             (specify query name)\n"
 "                 -t type             (specify query type)\n"
-"                 -c class            (option included for compatibility;\n"
 "                                      only IN is supported)\n"
-"                 -4                  (use IPv4 query transport only)\n"
-"                 -6                  (use IPv6 query transport only)\n"
-"                 -i                  (disable DNSSEC validation)\n"
-"                 -m                  (enable memory usage debugging)\n"
+"                 -v                  (print version and exit)\n"
+"                 -x dot-notation     (shortcut for reverse lookups)\n"
 "        d-opt    is of the form +keyword[=value], where keyword is:\n"
 "                 +[no]all            (Set or clear all display flags)\n"
 "                 +[no]class          (Control display of class)\n"
+"                 +[no]comments       (Control display of comment lines)\n"
 "                 +[no]crypto         (Control display of cryptographic\n"
 "                                      fields in records)\n"
+"                 +[no]dlv            (Obsolete)\n"
+"                 +[no]dnssec         (Display DNSSEC records)\n"
+"                 +[no]mtrace         (Trace messages received)\n"
 "                 +[no]multiline      (Print records in an expanded format)\n"
-"                 +[no]comments       (Control display of comment lines)\n"
+"                 +[no]root           (DNSSEC validation trust anchor)\n"
 "                 +[no]rrcomments     (Control display of per-record "
 				       "comments)\n"
-"                 +[no]unknownformat  (Print RDATA in RFC 3597 "
-					"\"unknown\" format)\n"
+"                 +[no]rtrace         (Trace resolver fetches)\n"
 "                 +[no]short          (Short form answer)\n"
 "                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
 "                 +[no]tcp            (TCP mode)\n"
 "                 +[no]ttl            (Control display of ttls in records)\n"
 "                 +[no]trust          (Control display of trust level)\n"
-"                 +[no]rtrace         (Trace resolver fetches)\n"
-"                 +[no]mtrace         (Trace messages received)\n"
+"                 +[no]unknownformat  (Print RDATA in RFC 3597 "
+					"\"unknown\" format)\n"
 "                 +[no]vtrace         (Trace validation process)\n"
-"                 +[no]dlv            (Obsolete)\n"
-"                 +[no]root           (DNSSEC validation trust anchor)\n"
-"                 +[no]dnssec         (Display DNSSEC records)\n"
-"        -h                           (print help and exit)\n"
-"        -v                           (print version and exit)\n",
+"                 +[no]yaml           (Present the results as YAML)\n",
 	stderr);
 	exit(1);
 }
@@ -495,14 +498,17 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 				dns_rdata_reset(&rdata);
 			}
 		} else {
+			dns_indent_t indent = { "  ", 2 };
 			if (!yaml && (rdataset->attributes &
 				      DNS_RDATASETATTR_NEGATIVE) != 0)
 			{
 				isc_buffer_putstr(&target, "; ");
 			}
-
 			result = dns_master_rdatasettotext(owner, rdataset,
-							   style, &target);
+							   style,
+							   yaml ? &indent :
+								  NULL,
+							   &target);
 		}
 
 		if (result == ISC_R_NOSPACE) {
@@ -534,8 +540,6 @@ setup_style(dns_master_style_t **stylep) {
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
 		styleflags |= DNS_STYLEFLAG_YAML;
-		dns_master_indentstr = "  ";
-		dns_master_indent = 2;
 	} else {
 		if (showcomments) {
 			styleflags |= DNS_STYLEFLAG_COMMENT;
@@ -608,11 +612,12 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 
 static isc_result_t
 key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
-	dns_rdata_dnskey_t keystruct;
-	uint32_t flags, proto, alg;
-	const char *keystr, *keynamestr;
-	unsigned char keydata[4096];
-	isc_buffer_t keydatabuf;
+	dns_rdata_dnskey_t dnskey;
+	dns_rdata_ds_t ds;
+	uint32_t rdata1, rdata2, rdata3;
+	const char *datastr = NULL, *keynamestr = NULL, *atstr = NULL;
+	unsigned char data[4096];
+	isc_buffer_t databuf;
 	unsigned char rrdata[4096];
 	isc_buffer_t rrdatabuf;
 	isc_region_t r;
@@ -620,6 +625,13 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	dns_name_t *keyname;
 	isc_result_t result;
 	bool match_root = false;
+	enum {
+		INITIAL_KEY,
+		STATIC_KEY,
+		INITIAL_DS,
+		STATIC_DS,
+		TRUSTED
+	} anchortype;
 
 	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));
@@ -642,46 +654,118 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 
 	delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s", trust_anchor);
 
-	flags = cfg_obj_asuint32(cfg_tuple_get(key, "flags"));
-	proto = cfg_obj_asuint32(cfg_tuple_get(key, "protocol"));
-	alg = cfg_obj_asuint32(cfg_tuple_get(key, "algorithm"));
+	/* if DNSKEY, flags; if DS, key tag */
+	rdata1 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata1"));
 
-	keystruct.common.rdclass = dns_rdataclass_in;
-	keystruct.common.rdtype = dns_rdatatype_dnskey;
-	/*
-	 * The key data in keystruct is not dynamically allocated.
-	 */
-	keystruct.mctx = NULL;
+	/* if DNSKEY, protocol; if DS, algorithm */
+	rdata2 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata2"));
 
-	ISC_LINK_INIT(&keystruct.common, link);
+	/* if DNSKEY, algorithm; if DS, digest type */
+	rdata3 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata3"));
 
-	if (flags > 0xffff)
-		CHECK(ISC_R_RANGE);
-	if (proto > 0xff)
-		CHECK(ISC_R_RANGE);
-	if (alg > 0xff)
-		CHECK(ISC_R_RANGE);
+	/* What type of trust anchor is this? */
+	atstr = cfg_obj_asstring(cfg_tuple_get(key, "anchortype"));
+	if (strcasecmp(atstr, "static-key") == 0) {
+		anchortype = STATIC_KEY;
+	} else if (strcasecmp(atstr, "static-ds") == 0) {
+		anchortype = STATIC_DS;
+	} else if (strcasecmp(atstr, "initial-key") == 0) {
+		anchortype = INITIAL_KEY;
+	} else if (strcasecmp(atstr, "initial-ds") == 0) {
+		anchortype = INITIAL_DS;
+	} else {
+		delv_log(ISC_LOG_ERROR,
+			 "key '%s': invalid initialization method '%s'",
+			 keynamestr, atstr);
+		result = ISC_R_FAILURE;
+		goto cleanup;
+	}
 
-	keystruct.flags = (uint16_t)flags;
-	keystruct.protocol = (uint8_t)proto;
-	keystruct.algorithm = (uint8_t)alg;
-
-	isc_buffer_init(&keydatabuf, keydata, sizeof(keydata));
+	isc_buffer_init(&databuf, data, sizeof(data));
 	isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));
 
-	keystr = cfg_obj_asstring(cfg_tuple_get(key, "key"));
-	CHECK(isc_base64_decodestring(keystr, &keydatabuf));
-	isc_buffer_usedregion(&keydatabuf, &r);
-	keystruct.datalen = r.length;
-	keystruct.data = r.base;
+	if (rdata1 > 0xffff) {
+		CHECK(ISC_R_RANGE);
+	}
+	if (rdata2 > 0xff) {
+		CHECK(ISC_R_RANGE);
+	}
+	if (rdata3 > 0xff) {
+		CHECK(ISC_R_RANGE);
+	}
 
-	CHECK(dns_rdata_fromstruct(NULL,
-				   keystruct.common.rdclass,
-				   keystruct.common.rdtype,
-				   &keystruct, &rrdatabuf));
+	switch (anchortype) {
+	case STATIC_KEY:
+	case INITIAL_KEY:
+	case TRUSTED:
+		dnskey.common.rdclass = dns_rdataclass_in;
+		dnskey.common.rdtype = dns_rdatatype_dnskey;
+		dnskey.mctx = NULL;
+
+		ISC_LINK_INIT(&dnskey.common, link);
+
+		dnskey.flags = (uint16_t)rdata1;
+		dnskey.protocol = (uint8_t)rdata2;
+		dnskey.algorithm = (uint8_t)rdata3;
+
+		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
+		CHECK(isc_base64_decodestring(datastr, &databuf));
+		isc_buffer_usedregion(&databuf, &r);
+		dnskey.datalen = r.length;
+		dnskey.data = r.base;
+
+		CHECK(dns_rdata_fromstruct(NULL, dnskey.common.rdclass,
+					   dnskey.common.rdtype,
+					   &dnskey, &rrdatabuf));
+		CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
+					       dns_rdatatype_dnskey,
+					       keyname, &rrdatabuf));
+		break;
+	case INITIAL_DS:
+	case STATIC_DS:
+		ds.common.rdclass = dns_rdataclass_in;
+		ds.common.rdtype = dns_rdatatype_ds;
+		ds.mctx = NULL;
+
+		ISC_LINK_INIT(&ds.common, link);
+
+		ds.key_tag = (uint16_t)rdata1;
+		ds.algorithm = (uint8_t)rdata2;
+		ds.digest_type = (uint8_t)rdata3;
+
+		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
+		CHECK(isc_hex_decodestring(datastr, &databuf));
+		isc_buffer_usedregion(&databuf, &r);
+
+		switch (ds.digest_type) {
+		case DNS_DSDIGEST_SHA1:
+			if (r.length != ISC_SHA1_DIGESTLENGTH) {
+				CHECK(ISC_R_UNEXPECTEDEND);
+			}
+			break;
+		case DNS_DSDIGEST_SHA256:
+			if (r.length != ISC_SHA256_DIGESTLENGTH) {
+				CHECK(ISC_R_UNEXPECTEDEND);
+			}
+			break;
+		case DNS_DSDIGEST_SHA384:
+			if (r.length != ISC_SHA384_DIGESTLENGTH) {
+				CHECK(ISC_R_UNEXPECTEDEND);
+			}
+			break;
+		}
+
+		ds.length = r.length;
+		ds.digest = r.base;
+
+		CHECK(dns_rdata_fromstruct(NULL, ds.common.rdclass,
+					   ds.common.rdtype,
+					   &ds, &rrdatabuf));
+		CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
+					       dns_rdatatype_ds,
+					       keyname, &rrdatabuf));
+	};
 
-	CHECK(dns_client_addtrustedkey(client, dns_rdataclass_in,
-				       keyname, &rrdatabuf));
 	num_keys++;
 
  cleanup:
@@ -735,7 +819,7 @@ setup_dnsseckeys(dns_client_t *client) {
 	cfg_parser_t *parser = NULL;
 	const cfg_obj_t *trusted_keys = NULL;
 	const cfg_obj_t *managed_keys = NULL;
-	const cfg_obj_t *dnssec_keys = NULL;
+	const cfg_obj_t *trust_anchors = NULL;
 	cfg_obj_t *bindkeys = NULL;
 	const char *filename = anchorfile;
 
@@ -794,7 +878,7 @@ setup_dnsseckeys(dns_client_t *client) {
 	INSIST(bindkeys != NULL);
 	cfg_map_get(bindkeys, "trusted-keys", &trusted_keys);
 	cfg_map_get(bindkeys, "managed-keys", &managed_keys);
-	cfg_map_get(bindkeys, "dnssec-keys", &dnssec_keys);
+	cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
 
 	if (trusted_keys != NULL) {
 		CHECK(load_keys(trusted_keys, client));
@@ -802,8 +886,8 @@ setup_dnsseckeys(dns_client_t *client) {
 	if (managed_keys != NULL) {
 		CHECK(load_keys(managed_keys, client));
 	}
-	if (dnssec_keys != NULL) {
-		CHECK(load_keys(dnssec_keys, client));
+	if (trust_anchors != NULL) {
+		CHECK(load_keys(trust_anchors, client));
 	}
 	result = ISC_R_SUCCESS;
 

bin/delv/delv.docbook

@@ -40,6 +40,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -215,7 +216,7 @@
 	  </para>
 	  <para>
 	    Note: When reading the trust anchor file,
-	    <command>delv</command> treats <option>dnssec-keys</option>
+	    <command>delv</command> treats <option>trust-anchors</option>
 	    <option>initial-key</option> and <option>static-key</option>
 	    entries identically.  That is, even if a key is configured
 	    with <command>initial-key</command>, indicating that it is

bin/delv/delv.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -197,7 +197,7 @@
 	  </p>
 	  <p>
 	    Note: When reading the trust anchor file,
-	    <span class="command"><strong>delv</strong></span> treats <code class="option">dnssec-keys</code>
+	    <span class="command"><strong>delv</strong></span> treats <code class="option">trust-anchors</code>
 	    <code class="option">initial-key</code> and <code class="option">static-key</code>
 	    entries identically.  That is, even if a key is configured
 	    with <span class="command"><strong>initial-key</strong></span>, indicating that it is

bin/dig/dig.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -849,5 +849,5 @@ There are probably too many query options\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dig/dig.c

@@ -54,7 +54,7 @@
 
 dig_lookup_t *default_lookup = NULL;
 
-static char *batchname = NULL;
+static atomic_uintptr_t batchname = ATOMIC_VAR_INIT(0);
 static FILE *batchfp = NULL;
 static char *argv0;
 static int addresscount = 0;
@@ -239,6 +239,7 @@ help(void) {
 "                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" "
 					"format)\n"
 "                 +[no]vc             (TCP mode (+[no]tcp))\n"
+"                 +[no]yaml           (Present the results as YAML)\n"
 "                 +[no]zflag          (Set Z flag in query)\n"
 "        global d-opts and servers (before host name) affect all queries.\n"
 "        local d-opts and servers (after host name) affect only that lookup.\n"
@@ -486,8 +487,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf,
 
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
-		dns_master_indentstr = "  ";
-		dns_master_indent = 3;
+		msg->indent.string = "  ";
+		msg->indent.count = 3;
 		styleflags |= DNS_STYLEFLAG_YAML;
 	} else {
 		if (query->lookup->comments) {
@@ -1873,7 +1874,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				value);
 		return (value_from_next);
 	case 'f':
-		batchname = value;
+		atomic_store(&batchname, (uintptr_t)value);
 		return (value_from_next);
 	case 'k':
 		strlcpy(keyfile, value, sizeof(keyfile));
@@ -2326,13 +2327,15 @@ parse_args(bool is_batchfile, bool config_only,
 	 * first entry, then trust the callback in dighost_shutdown
 	 * to get the rest
 	 */
-	if ((batchname != NULL) && !(is_batchfile)) {
-		if (strcmp(batchname, "-") == 0)
+	char *filename = (char *)atomic_load(&batchname);
+	if ((filename != NULL) && !(is_batchfile)) {
+		if (strcmp(filename, "-") == 0) {
 			batchfp = stdin;
-		else
-			batchfp = fopen(batchname, "r");
+		} else {
+			batchfp = fopen(filename, "r");
+		}
 		if (batchfp == NULL) {
-			perror(batchname);
+			perror(filename);
 			if (exitcode < 8)
 				exitcode = 8;
 			fatal("couldn't open specified batch file");
@@ -2387,14 +2390,14 @@ query_finished(void) {
 	int bargc;
 	char *bargv[16];
 
-	if (batchname == NULL) {
+	if (atomic_load(&batchname) == 0) {
 		isc_app_shutdown();
 		return;
 	}
 
 	fflush(stdout);
 	if (feof(batchfp)) {
-		batchname = NULL;
+		atomic_store(&batchname, 0);
 		isc_app_shutdown();
 		if (batchfp != stdin)
 			fclose(batchfp);
@@ -2408,7 +2411,7 @@ query_finished(void) {
 		parse_args(true, false, bargc, (char **)bargv);
 		start_lookup();
 	} else {
-		batchname = NULL;
+		atomic_store(&batchname, 0);
 		if (batchfp != stdin)
 			fclose(batchfp);
 		isc_app_shutdown();
@@ -2538,10 +2541,11 @@ void dig_query_start()
 void
 dig_shutdown() {
 	destroy_lookup(default_lookup);
-	if (batchname != NULL) {
-		if (batchfp != stdin)
+	if (atomic_load(&batchname) != 0) {
+		if (batchfp != stdin) {
 			fclose(batchfp);
-		batchname = NULL;
+		}
+		atomic_store(&batchname, 0);
 	}
 	cancel_all();
 	destroy_libs();

bin/dig/dig.docbook

@@ -53,6 +53,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dig/dig.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dig/dighost.c

@@ -4252,7 +4252,6 @@ destroy_libs(void) {
 	result = dns_name_settotextfilter(NULL);
 	check_result(result, "dns_name_settotextfilter");
 #endif /* HAVE_LIBIDN2 */
-	dns_name_destroy();
 
 	if (commctx != NULL) {
 		debug("freeing commctx");

bin/dig/host.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -269,5 +269,5 @@ runs\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dig/host.docbook

@@ -48,6 +48,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dig/host.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dig/nslookup.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -301,5 +301,5 @@ runs or when the standard output is not a tty\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dig/nslookup.docbook

@@ -72,6 +72,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -307,7 +308,7 @@ nslookup -query=hinfo  -timeout=10
                     The class specifies the protocol group of the information.
 
                   </para>
-		  <para>
+                  <para>
                     (Default = IN; abbreviation = cl)
                   </para>
                 </listitem>
@@ -317,10 +318,10 @@ nslookup -query=hinfo  -timeout=10
                 <term><constant><replaceable><optional>no</optional></replaceable>debug</constant></term>
                 <listitem>
                   <para>
-		    Turn on or off the display of the full response packet and
-		    any intermediate response packets when searching.
+                    Turn on or off the display of the full response packet and
+                    any intermediate response packets when searching.
                   </para>
-		  <para>
+                  <para>
                     (Default = nodebug; abbreviation = <optional>no</optional>deb)
                   </para>
                 </listitem>
@@ -331,9 +332,9 @@ nslookup -query=hinfo  -timeout=10
                 <listitem>
                   <para>
                     Turn debugging mode on or off.  This displays more about
-	            what nslookup is doing.
+                    what nslookup is doing.
                   </para>
-		  <para>
+                  <para>
                     (Default = nod2)
                   </para>
                 </listitem>
@@ -357,7 +358,7 @@ nslookup -query=hinfo  -timeout=10
                     names in the domain search list to the request until an
                     answer is received.
                   </para>
-		  <para>
+                  <para>
                     (Default = search)
                   </para>
                 </listitem>
@@ -369,7 +370,7 @@ nslookup -query=hinfo  -timeout=10
                   <para>
                     Change the default TCP/UDP name server port to <replaceable>value</replaceable>.
                   </para>
-		  <para>
+                  <para>
                     (Default = 53; abbreviation = po)
                   </para>
                 </listitem>
@@ -388,9 +389,15 @@ nslookup -query=hinfo  -timeout=10
                   <para>
                     Change the type of the information query.
                   </para>
-		  <para>
-                    (Default = A; abbreviations = q, ty)
+                  <para>
+                    (Default = A and then AAAA; abbreviations = q, ty)
                   </para>
+                    <para>
+                      <emphasis role="bold">Note:</emphasis> It is
+                      only possible to specify one query type, only
+                      the default behavior looks up both when an
+                      alternative is not specified.
+                    </para>
                 </listitem>
               </varlistentry>
 
@@ -402,7 +409,7 @@ nslookup -query=hinfo  -timeout=10
                     have the
                     information.
                   </para>
-		  <para>
+                  <para>
                     (Default = recurse; abbreviation = [no]rec)
                   </para>
                 </listitem>
@@ -412,9 +419,9 @@ nslookup -query=hinfo  -timeout=10
                 <term><constant>ndots=</constant><replaceable>number</replaceable></term>
                 <listitem>
                   <para>
-		    Set the number of dots (label separators) in a domain
-		    that will disable searching.  Absolute names always
-		    stop searching.
+                    Set the number of dots (label separators) in a domain
+                    that will disable searching.  Absolute names always
+                    stop searching.
                   </para>
                 </listitem>
               </varlistentry>
@@ -445,7 +452,7 @@ nslookup -query=hinfo  -timeout=10
                     Always use a virtual circuit when sending requests to the
                     server.
                   </para>
-		  <para>
+                  <para>
                     (Default = novc)
                   </para>
                 </listitem>
@@ -455,15 +462,15 @@ nslookup -query=hinfo  -timeout=10
                 <term><constant><replaceable><optional>no</optional></replaceable>fail</constant></term>
                 <listitem>
                   <para>
-		    Try the next nameserver if a nameserver responds with
-		    SERVFAIL or a referral (nofail) or terminate query
-		    (fail) on such a response.
-		  </para>
-		  <para>
+                    Try the next nameserver if a nameserver responds with
+                    SERVFAIL or a referral (nofail) or terminate query
+                    (fail) on such a response.
+                  </para>
+                  <para>
                     (Default = nofail)
                   </para>
-	        </listitem>
-	      </varlistentry>
+                </listitem>
+              </varlistentry>
 
             </variablelist>
           </para>

bin/dig/nslookup.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-cds.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2017-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -293,5 +293,5 @@ RFC 7344\&.
 .RE
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2017-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-cds.c

@@ -372,7 +372,7 @@ formatset(dns_rdataset_t *rdataset) {
 
 	result = isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
 	check_result(result, "printing DS records");
-	result = dns_master_rdatasettotext(name, rdataset, style, buf);
+	result = dns_master_rdatasettotext(name, rdataset, style, NULL, buf);
 
 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
 		result = ISC_R_NOSPACE;

bin/dnssec/dnssec-cds.docbook

@@ -41,6 +41,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-cds.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2017-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-dsfromkey.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -222,5 +222,5 @@ RFC 7344
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-dsfromkey.c

@@ -517,7 +517,6 @@ main(int argc, char **argv) {
 	}
 	cleanup_logging(&log);
 	dst_lib_destroy();
-	dns_name_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}

bin/dnssec/dnssec-dsfromkey.docbook

@@ -42,6 +42,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-dsfromkey.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-importkey.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -134,5 +134,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-importkey.c

@@ -439,7 +439,6 @@ main(int argc, char **argv) {
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
 	dst_lib_destroy();
-	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);

bin/dnssec/dnssec-importkey.docbook

@@ -39,6 +39,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-importkey.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-keyfromlabel.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -307,5 +307,5 @@ The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13)\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-keyfromlabel.c

@@ -694,7 +694,6 @@ main(int argc, char **argv) {
 
 	cleanup_logging(&log);
 	dst_lib_destroy();
-	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_free(mctx, label);

bin/dnssec/dnssec-keyfromlabel.docbook

@@ -44,6 +44,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-keyfromlabel.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-keygen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-d\ \fR\fB\fIbits\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIpolicy\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-l\ \fR\fB\fIfile\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-T\ \fR\fB\fIrrtype\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -109,6 +109,11 @@ option suppresses them\&.
 Indicates that the DNS record containing the key should have the specified class\&. If not specified, class IN is used\&.
 .RE
 .PP
+\-d \fIbits\fR
+.RS 4
+Key size in bits\&. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256 and RSASHA512 the key size must be in range 1024\-4096\&. DH size is between 128 and 4096\&. This option is ignored for algorithms ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448\&.
+.RE
+.PP
 \-E \fIengine\fR
 .RS 4
 Specifies the cryptographic hardware to use, when applicable\&.
@@ -142,6 +147,17 @@ Prints a short summary of the options and arguments to
 Sets the directory in which the key files are to be written\&.
 .RE
 .PP
+\-k \fIpolicy\fR
+.RS 4
+Create keys for a specific dnssec\-policy\&. If a policy uses multiple keys,
+\fBdnssec\-keygen\fR
+will generate multiple keys\&. This will also create a "\&.state" file to keep track of the key state\&.
+.sp
+This option creates keys according to the dnssec\-policy configuration, hence it cannot be used together with many of the other options that
+\fBdnssec\-keygen\fR
+provides\&.
+.RE
+.PP
 \-L \fIttl\fR
 .RS 4
 Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL\&. Setting the default TTL to
@@ -151,6 +167,12 @@ none
 is the same as leaving it unset\&.
 .RE
 .PP
+\-l \fIfile\fR
+.RS 4
+Provide a configuration file that contains a dnssec\-policy statement (matching the policy set with
+\fB\-k\fR)\&.
+.RE
+.PP
 \-n \fInametype\fR
 .RS 4
 Specifies the owner type of the key\&. The value of
@@ -352,5 +374,5 @@ RFC 4034\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-keygen.c

@@ -1222,7 +1222,6 @@ main(int argc, char **argv) {
 
 	cleanup_logging(&log);
 	dst_lib_destroy();
-	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);

bin/dnssec/dnssec-keygen.docbook

@@ -51,6 +51,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-keygen.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -41,6 +41,7 @@
        [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
        [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
        [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-d <em class="replaceable"><code>bits</code></em></code>]
        [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
        [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>]
        [<code class="option">-G</code>]
@@ -49,8 +50,9 @@
        [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>]
        [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>]
        [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
-       [<code class="option">-k</code>]
+       [<code class="option">-k <em class="replaceable"><code>policy</code></em></code>]
        [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
+       [<code class="option">-l <em class="replaceable"><code>file</code></em></code>]
        [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
        [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
        [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>]
@@ -59,6 +61,7 @@
        [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>]
        [<code class="option">-S <em class="replaceable"><code>key</code></em></code>]
        [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>]
+       [<code class="option">-T <em class="replaceable"><code>rrtype</code></em></code>]
        [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
        [<code class="option">-V</code>]
        [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
@@ -168,6 +171,15 @@
 	    the specified class.  If not specified, class IN is used.
 	  </p>
 	</dd>
+<dt><span class="term">-d <em class="replaceable"><code>bits</code></em></span></dt>
+<dd>
+	  <p>
+	    Key size in bits. For the algorithms RSASHA1, NSEC3RSASA1,
+	    RSASHA256 and RSASHA512 the key size must be in range 1024-4096.
+	    DH size is between 128 and 4096. This option is ignored for
+	    algorithms ECDSAP256SHA256, ECDSAP384SHA384, ED25519 and ED448.
+	  </p>
+	</dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
 <dd>
 	  <p>
@@ -218,6 +230,21 @@
 	    Sets the directory in which the key files are to be written.
 	  </p>
 	</dd>
+<dt><span class="term">-k <em class="replaceable"><code>policy</code></em></span></dt>
+<dd>
+	  <p>
+	    Create keys for a specific dnssec-policy.  If a policy uses
+	    multiple keys, <span class="command"><strong>dnssec-keygen</strong></span> will generate
+	    multiple keys.  This will also create a ".state" file to keep
+	    track of the key state.
+	  </p>
+	  <p>
+	    This option creates keys according to the dnssec-policy
+	    configuration, hence it cannot be used together with many of
+	    the other options that <span class="command"><strong>dnssec-keygen</strong></span>
+	    provides.
+	  </p>
+	</dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
 <dd>
 	  <p>
@@ -231,6 +258,13 @@
 	    or <code class="literal">none</code> is the same as leaving it unset.
 	  </p>
 	</dd>
+<dt><span class="term">-l <em class="replaceable"><code>file</code></em></span></dt>
+<dd>
+	  <p>
+	    Provide a configuration file that contains a dnssec-policy
+	    statement (matching the policy set with <span class="command"><strong>-k</strong></span>).
+	  </p>
+	</dd>
 <dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
 <dd>
 	  <p>

bin/dnssec/dnssec-revoke.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -99,5 +99,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-revoke.docbook

@@ -39,6 +39,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-revoke.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-settime.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,7 @@
 dnssec-settime \- set the key timing metadata for a DNSSEC key
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-settime\fR\ 'u
-\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-h\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile}
+\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-h\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-s\fR] [\fB\-g\ \fR\fB\fIstate\fR\fR] [\fB\-d\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] [\fB\-k\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] [\fB\-z\ \fR\fB\fIstate\fR\fR\fB\ \fR\fB\fIdate/offset\fR\fR] {keyfile}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-settime\fR
@@ -59,7 +59,25 @@ simply prints the key timing metadata already stored in the key\&.
 .PP
 When key metadata fields are changed, both files of a key pair (Knnnn\&.+aaa+iiiii\&.key
 and
-Knnnn\&.+aaa+iiiii\&.private) are regenerated\&. Metadata fields are stored in the private file\&. A human\-readable description of the metadata is also placed in comments in the key file\&. The private file\*(Aqs permissions are always set to be inaccessible to anyone other than the owner (mode 0600)\&.
+Knnnn\&.+aaa+iiiii\&.private) are regenerated\&.
+.PP
+Metadata fields are stored in the private file\&. A human\-readable description of the metadata is also placed in comments in the key file\&. The private file\*(Aqs permissions are always set to be inaccessible to anyone other than the owner (mode 0600)\&.
+.PP
+When working with state files, it is possible to update the timing metadata in those files as well with
+\fB\-s\fR\&. If this option is used you can also update key states with
+\fB\-d\fR
+(DS),
+\fB\-k\fR
+(DNSKEY),
+\fB\-r\fR
+(RRSIG of KSK), or
+\fB\-z\fR
+(RRSIG of ZSK)\&. Allowed states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE\&.
+.PP
+You can also set the goal state of the key with
+\fB\-g\fR\&. This should be either HIDDEN or OMNIPRESENT (representing whether the key should be removed from the zone, or published)\&.
+.PP
+It is NOT RECOMMENDED to manipulate state files manually except for testing purposes\&.
 .SH "OPTIONS"
 .PP
 \-f
@@ -156,6 +174,39 @@ If the key is being set to be an explicit successor to another key, then the def
 .sp
 As with date offsets, if the argument is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the interval is measured in years, months, weeks, days, hours, or minutes, respectively\&. Without a suffix, the interval is measured in seconds\&.
 .RE
+.SH "KEY STATE OPTIONS"
+.PP
+Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE\&. These should not be set manually except for testing purposes\&.
+.PP
+\-s
+.RS 4
+When setting key timing data, also update the state file\&.
+.RE
+.PP
+\-g
+.RS 4
+Set the goal state for this key\&. Must be HIDDEN or OMNIPRESENT\&.
+.RE
+.PP
+\-d
+.RS 4
+Set the DS state for this key, and when it was last changed\&.
+.RE
+.PP
+\-k
+.RS 4
+Set the DNSKEY state for this key, and when it was last changed\&.
+.RE
+.PP
+\-r
+.RS 4
+Set the RRSIG (KSK) state for this key, and when it was last changed\&.
+.RE
+.PP
+\-z
+.RS 4
+Set the RRSIG (ZSK) state for this key, and when it was last changed\&.
+.RE
 .SH "PRINTING OPTIONS"
 .PP
 \fBdnssec\-settime\fR
@@ -200,5 +251,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-settime.c

@@ -253,106 +253,6 @@ main(int argc, char **argv) {
 #define CMDLINE_FLAGS "A:D:d:E:fg:hI:i:K:k:L:P:p:R:r:S:suv:Vz:"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
-		case 'E':
-			engine = isc_commandline_argument;
-			break;
-		case 'f':
-			force = true;
-			break;
-		case 'p':
-			p = isc_commandline_argument;
-			if (!strcasecmp(p, "all")) {
-				printcreate = true;
-				printpub = true;
-				printact = true;
-				printrev = true;
-				printinact = true;
-				printdel = true;
-				printsyncadd = true;
-				printsyncdel = true;
-				break;
-			}
-
-			do {
-				switch (*p++) {
-				case 'C':
-					printcreate = true;
-					break;
-				case 'P':
-					if (!strncmp(p, "sync", 4)) {
-						p += 4;
-						printsyncadd = true;
-						break;
-					}
-					printpub = true;
-					break;
-				case 'A':
-					printact = true;
-					break;
-				case 'R':
-					printrev = true;
-					break;
-				case 'I':
-					printinact = true;
-					break;
-				case 'D':
-					if (!strncmp(p, "sync", 4)) {
-						p += 4;
-						printsyncdel = true;
-						break;
-					}
-					printdel = true;
-					break;
-				case ' ':
-					break;
-				default:
-					usage();
-					break;
-				}
-			} while (*p != '\0');
-			break;
-		case 'u':
-			epoch = true;
-			break;
-		case 'K':
-			/*
-			 * We don't have to copy it here, but do it to
-			 * simplify cleanup later
-			 */
-			directory = isc_mem_strdup(mctx,
-						   isc_commandline_argument);
-			break;
-		case 'L':
-			ttl = strtottl(isc_commandline_argument);
-			setttl = true;
-			break;
-		case 'v':
-			verbose = strtol(isc_commandline_argument, &endp, 0);
-			if (*endp != '\0')
-				fatal("-v must be followed by a number");
-			break;
-		case 'P':
-			/* -Psync ? */
-			if (isoptarg("sync", argv, usage)) {
-				if (unsetsyncadd || setsyncadd)
-					fatal("-P sync specified more than "
-					      "once");
-
-				changed = true;
-				syncadd = strtotime(isc_commandline_argument,
-						   now, now, &setsyncadd);
-				unsetsyncadd = !setsyncadd;
-				break;
-			}
-			(void)isoptarg("dnskey", argv, usage);
-			if (setpub || unsetpub)
-				fatal("-P specified more than once");
-
-			changed = true;
-			pub = strtotime(isc_commandline_argument,
-					now, now, &setpub);
-			unsetpub = !setpub;
-			break;
 		case 'A':
 			if (setact || unsetact)
 				fatal("-A specified more than once");
@@ -362,24 +262,6 @@ main(int argc, char **argv) {
 					now, now, &setact);
 			unsetact = !setact;
 			break;
-		case 'R':
-			if (setrev || unsetrev)
-				fatal("-R specified more than once");
-
-			changed = true;
-			rev = strtotime(isc_commandline_argument,
-					now, now, &setrev);
-			unsetrev = !setrev;
-			break;
-		case 'I':
-			if (setinact || unsetinact)
-				fatal("-I specified more than once");
-
-			changed = true;
-			inact = strtotime(isc_commandline_argument,
-					now, now, &setinact);
-			unsetinact = !setinact;
-			break;
 		case 'D':
 			/* -Dsync ? */
 			if (isoptarg("sync", argv, usage)) {
@@ -403,14 +285,23 @@ main(int argc, char **argv) {
 					now, now, &setdel);
 			unsetdel = !setdel;
 			break;
-		case 'S':
-			predecessor = isc_commandline_argument;
+		case 'd':
+			if (setds) {
+				fatal("-d specified more than once");
+			}
+
+			ds = strtokeystate(isc_commandline_argument);
+			setds = true;
+			/* time */
+			(void)isoptarg(isc_commandline_argument, argv, usage);
+			dstime = strtotime(isc_commandline_argument,
+					   now, now, &setdstime);
 			break;
-		case 'i':
-			prepub = strtottl(isc_commandline_argument);
+		case 'E':
+			engine = isc_commandline_argument;
 			break;
-		case 's':
-			write_state = true;
+		case 'f':
+			force = true;
 			break;
 		case 'g':
 			if (setgoal) {
@@ -426,17 +317,33 @@ main(int argc, char **argv) {
 			}
 			setgoal = true;
 			break;
-		case 'd':
-			if (setds) {
-				fatal("-d specified more than once");
-			}
+		case '?':
+			if (isc_commandline_option != '?')
+				fprintf(stderr, "%s: invalid argument -%c\n",
+					program, isc_commandline_option);
+			/* FALLTHROUGH */
+		case 'h':
+			/* Does not return. */
+			usage();
+		case 'I':
+			if (setinact || unsetinact)
+				fatal("-I specified more than once");
 
-			ds = strtokeystate(isc_commandline_argument);
-			setds = true;
-			/* time */
-			(void)isoptarg(isc_commandline_argument, argv, usage);
-			dstime = strtotime(isc_commandline_argument,
-					   now, now, &setdstime);
+			changed = true;
+			inact = strtotime(isc_commandline_argument,
+					now, now, &setinact);
+			unsetinact = !setinact;
+			break;
+		case 'i':
+			prepub = strtottl(isc_commandline_argument);
+			break;
+		case 'K':
+			/*
+			 * We don't have to copy it here, but do it to
+			 * simplify cleanup later
+			 */
+			directory = isc_mem_strdup(mctx,
+						   isc_commandline_argument);
 			break;
 		case 'k':
 			if (setdnskey) {
@@ -450,6 +357,93 @@ main(int argc, char **argv) {
 			dnskeytime = strtotime(isc_commandline_argument,
 					       now, now, &setdnskeytime);
 			break;
+		case 'L':
+			ttl = strtottl(isc_commandline_argument);
+			setttl = true;
+			break;
+		case 'P':
+			/* -Psync ? */
+			if (isoptarg("sync", argv, usage)) {
+				if (unsetsyncadd || setsyncadd)
+					fatal("-P sync specified more than "
+					      "once");
+
+				changed = true;
+				syncadd = strtotime(isc_commandline_argument,
+						   now, now, &setsyncadd);
+				unsetsyncadd = !setsyncadd;
+				break;
+			}
+			(void)isoptarg("dnskey", argv, usage);
+			if (setpub || unsetpub)
+				fatal("-P specified more than once");
+
+			changed = true;
+			pub = strtotime(isc_commandline_argument,
+					now, now, &setpub);
+			unsetpub = !setpub;
+			break;
+		case 'p':
+			p = isc_commandline_argument;
+			if (!strcasecmp(p, "all")) {
+				printcreate = true;
+				printpub = true;
+				printact = true;
+				printrev = true;
+				printinact = true;
+				printdel = true;
+				printsyncadd = true;
+				printsyncdel = true;
+				break;
+			}
+
+			do {
+				switch (*p++) {
+				case 'A':
+					printact = true;
+					break;
+				case 'C':
+					printcreate = true;
+					break;
+				case 'D':
+					if (!strncmp(p, "sync", 4)) {
+						p += 4;
+						printsyncdel = true;
+						break;
+					}
+					printdel = true;
+					break;
+				case 'I':
+					printinact = true;
+					break;
+				case 'P':
+					if (!strncmp(p, "sync", 4)) {
+						p += 4;
+						printsyncadd = true;
+						break;
+					}
+					printpub = true;
+					break;
+				case 'R':
+					printrev = true;
+					break;
+				case ' ':
+					break;
+				default:
+					usage();
+					break;
+				}
+			} while (*p != '\0');
+			break;
+		case 'R':
+			if (setrev || unsetrev)
+				fatal("-R specified more than once");
+
+			changed = true;
+			rev = strtotime(isc_commandline_argument,
+					now, now, &setrev);
+			unsetrev = !setrev;
+			break;
 		case 'r':
 			if (setkrrsig) {
 				fatal("-r specified more than once");
@@ -462,6 +456,23 @@ main(int argc, char **argv) {
 			krrsigtime = strtotime(isc_commandline_argument,
 					       now, now, &setkrrsigtime);
 			break;
+		case 'S':
+			predecessor = isc_commandline_argument;
+			break;
+		case 's':
+			write_state = true;
+			break;
+		case 'u':
+			epoch = true;
+			break;
+		case 'V':
+			/* Does not return. */
+			version(program);
+		case 'v':
+			verbose = strtol(isc_commandline_argument, &endp, 0);
+			if (*endp != '\0')
+				fatal("-v must be followed by a number");
+			break;
 		case 'z':
 			if (setzrrsig) {
 				fatal("-z specified more than once");
@@ -473,18 +484,6 @@ main(int argc, char **argv) {
 			zrrsigtime = strtotime(isc_commandline_argument,
 					       now, now, &setzrrsigtime);
 			break;
-		case '?':
-			if (isc_commandline_option != '?')
-				fprintf(stderr, "%s: invalid argument -%c\n",
-					program, isc_commandline_option);
-			/* FALLTHROUGH */
-		case 'h':
-			/* Does not return. */
-			usage();
-
-		case 'V':
-			/* Does not return. */
-			version(program);
 
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n",

bin/dnssec/dnssec-settime.docbook

@@ -41,6 +41,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-settime.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -49,6 +49,12 @@
        [<code class="option">-V</code>]
        [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
        [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
+       [<code class="option">-s</code>]
+       [<code class="option">-g <em class="replaceable"><code>state</code></em></code>]
+       [<code class="option">-d <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-k <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-r <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-z <em class="replaceable"><code>state</code></em> <em class="replaceable"><code>date/offset</code></em></code>]
        {keyfile}
     </p></div>
   </div>
@@ -74,11 +80,30 @@
       When key metadata fields are changed, both files of a key
       pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
       <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
+    </p>
+    <p>
       Metadata fields are stored in the private file.  A human-readable
       description of the metadata is also placed in comments in the key
       file.  The private file's permissions are always set to be
       inaccessible to anyone other than the owner (mode 0600).
     </p>
+    <p>
+      When working with state files, it is possible to update the timing
+      metadata in those files as well with <code class="option">-s</code>.  If this
+      option is used you can also update key states with <code class="option">-d</code>
+      (DS), <code class="option">-k</code> (DNSKEY), <code class="option">-r</code> (RRSIG of KSK),
+      or <code class="option">-z</code> (RRSIG of ZSK). Allowed states are HIDDEN,
+      RUMOURED, OMNIPRESENT, and UNRETENTIVE.
+    </p>
+    <p>
+      You can also set the goal state of the key with <code class="option">-g</code>.
+      This should be either HIDDEN or OMNIPRESENT (representing whether the
+      key should be removed from the zone, or published).
+    </p>
+    <p>
+      It is NOT RECOMMENDED to manipulate state files manually except for
+      testing purposes.
+    </p>
   </div>
 
   <div class="refsection">
@@ -262,7 +287,57 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.10"></a><h2>PRINTING OPTIONS</h2>
+<a name="id-1.10"></a><h2>KEY STATE OPTIONS</h2>
+
+    <p>
+      Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE.
+      These should not be set manually except for testing purposes.
+    </p>
+
+    <div class="variablelist"><dl class="variablelist">
+<dt><span class="term">-s</span></dt>
+<dd>
+          <p>
+	    When setting key timing data, also update the state file.
+          </p>
+        </dd>
+<dt><span class="term">-g</span></dt>
+<dd>
+          <p>
+	    Set the goal state for this key. Must be HIDDEN or OMNIPRESENT.
+          </p>
+        </dd>
+<dt><span class="term">-d</span></dt>
+<dd>
+          <p>
+	    Set the DS state for this key, and when it was last changed.
+          </p>
+        </dd>
+<dt><span class="term">-k</span></dt>
+<dd>
+          <p>
+	    Set the DNSKEY state for this key, and when it was last changed.
+          </p>
+        </dd>
+<dt><span class="term">-r</span></dt>
+<dd>
+          <p>
+	    Set the RRSIG (KSK) state for this key, and when it was last
+	    changed.
+          </p>
+        </dd>
+<dt><span class="term">-z</span></dt>
+<dd>
+          <p>
+	    Set the RRSIG (ZSK) state for this key, and when it was last
+	    changed.
+          </p>
+        </dd>
+</dl></div>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.11"></a><h2>PRINTING OPTIONS</h2>
 
     <p>
       <span class="command"><strong>dnssec-settime</strong></span> can also be used to print the
@@ -298,7 +373,7 @@
   </div>
 
   <div class="refsection">
-<a name="id-1.11"></a><h2>SEE ALSO</h2>
+<a name="id-1.12"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">dnssec-keygen</span>(8)

bin/dnssec/dnssec-signzone.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -470,5 +470,5 @@ RFC 4641\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-signzone.c

@@ -246,7 +246,8 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 
 		for (;;) {
 			result = dns_master_rdatasettotext(name, &rds,
-							   masterstyle, buffer);
+							   masterstyle, NULL,
+							   buffer);
 			if (result != ISC_R_NOSPACE)
 				break;
 
@@ -3921,7 +3922,6 @@ main(int argc, char *argv[]) {
 
 	cleanup_logging(&log);
 	dst_lib_destroy();
-	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);

bin/dnssec/dnssec-signzone.docbook

@@ -51,6 +51,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-signzone.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/dnssec/dnssec-verify.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -120,5 +120,5 @@ RFC 4033\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-verify.c

@@ -335,7 +335,6 @@ main(int argc, char *argv[]) {
 
 	cleanup_logging(&log);
 	dst_lib_destroy();
-	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);

bin/dnssec/dnssec-verify.docbook

@@ -38,6 +38,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/dnssec/dnssec-verify.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/named/config.c

@@ -296,7 +296,7 @@ view \"_bind\" chaos {\n\
 # BEGIN DNSSEC KEYS\n"
 
 /* Imported from bind.keys.h: */
-DNSSEC_KEYS
+TRUST_ANCHORS
 
 "# END MANAGED KEYS\n\
 \n\
@@ -800,10 +800,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 					   dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
-		result = dns_name_dup(dns_fixedname_name(&fname), mctx,
-				      keys[i - 1]);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
+		dns_name_dup(dns_fixedname_name(&fname), mctx, keys[i - 1]);
 	}
 	if (pushed != 0) {
 		pushed--;

bin/named/geoip.c

@@ -113,8 +113,7 @@ named_geoip_load(char *dir) {
 #endif
 }
 
-void
-named_geoip_shutdown(void) {
+void named_geoip_unload(void) {
 #ifdef HAVE_GEOIP2
 	if (named_g_geoip->country != NULL) {
 		MMDB_close(named_g_geoip->country);
@@ -136,7 +135,12 @@ named_geoip_shutdown(void) {
 		MMDB_close(named_g_geoip->domain);
 		named_g_geoip->domain = NULL;
 	}
+#endif
+}
+
+void
+named_geoip_shutdown(void) {
+#ifdef HAVE_GEOIP2
+	named_geoip_unload();
 #endif /* HAVE_GEOIP2 */
-
-	dns_geoip_shutdown();
 }

bin/named/include/named/geoip.h

@@ -19,5 +19,8 @@ named_geoip_init(void);
 void
 named_geoip_load(char *dir);
 
+void
+named_geoip_unload(void);
+
 void
 named_geoip_shutdown(void);

bin/named/main.c

@@ -23,6 +23,7 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
+#include <isc/hp.h>
 #include <isc/httpd.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
@@ -59,6 +60,10 @@
 #include <json_c_version.h>
 #endif /* HAVE_JSON_C */
 
+#ifdef HAVE_GEOIP2
+#include <maxminddb.h>
+#endif
+
 /*
  * Defining NAMED_MAIN provides storage declarations (rather than extern)
  * for variables in named/globals.h.
@@ -116,7 +121,7 @@ LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_month;
 static bool	want_stats = false;
 static char		program_name[NAME_MAX] = "named";
 static char		absolute_conffile[PATH_MAX];
-static char		saved_command_line[8192] =  { 0 };
+static char		saved_command_line[4096] = { 0 };
 static char		ellipsis[5] = { 0 };
 static char		version[512];
 static unsigned int	maxsocks = 0;
@@ -136,7 +141,6 @@ static bool nonearest = false;
 static bool nosoa = false;
 static bool notcp = false;
 static bool sigvalinsecs = false;
-static unsigned int delay = 0;
 
 /*
  * -4 and -6
@@ -548,6 +552,17 @@ OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	       ZLIB_VERSION);
 	printf("linked to zlib version: %s\n",
 	       zlibVersion());
+#endif
+#if defined(HAVE_GEOIP2)
+	/* Unfortunately, no version define on link time */
+	printf("linked to maxminddb version: %s\n",
+	       MMDB_lib_version());
+#endif
+#if defined(HAVE_DNSTAP)
+	printf("compiled with protobuf-c version: %s\n",
+	       PROTOBUF_C_VERSION);
+	printf("linked to protobuf-c version: %s\n",
+	       protobuf_c_version());
 #endif
 	printf("threads support is enabled\n\n");
 
@@ -622,14 +637,10 @@ parse_T_opt(char *option) {
 	/*
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
-	 * delay=xxxx: delay client responses by xxxx ms to
-	 *	       simulate remote servers.
 	 * dscp=x:     check that dscp values are as
 	 * 	       expected and assert otherwise.
 	 */
-	if (!strncmp(option, "delay=", 6)) {
-		delay = atoi(option + 6);
-	} else if (!strcmp(option, "dropedns")) {
+	if (!strcmp(option, "dropedns")) {
 		dropedns = true;
 	} else if (!strncmp(option, "dscp=", 5)) {
 		isc_dscp_check_value = atoi(option + 5);
@@ -892,6 +903,12 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface",
 		      named_g_udpdisp, named_g_udpdisp == 1 ? "" : "s");
 
+	/*
+	 * We have ncpus network threads, ncpus worker threads, ncpus
+	 * old network threads - make it 4x just to be safe. The memory
+	 * impact is neglible.
+	 */
+	isc_hp_init(4*named_g_cpus);
 	named_g_nm = isc_nm_start(named_g_mctx, named_g_cpus);
 	if (named_g_nm == NULL) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
@@ -939,11 +956,23 @@ create_managers(void) {
 static void
 destroy_managers(void) {
 	/*
-	 * isc_taskmgr_destroy() will block until all tasks have exited,
+	 * isc_nm_closedown() closes all active connections, freeing
+	 * attached clients and other resources and preventing new
+	 * connections from being established, but it not does not
+	 * stop all processing or destroy the netmgr yet.
+	 */
+	isc_nm_closedown(named_g_nm);
+
+	/*
+	 * isc_taskmgr_destroy() will block until all tasks have exited.
 	 */
 	isc_taskmgr_destroy(&named_g_taskmgr);
 	isc_timermgr_destroy(&named_g_timermgr);
 	isc_socketmgr_destroy(&named_g_socketmgr);
+
+	/*
+	 * At this point is safe to destroy the netmgr.
+	 */
 	isc_nm_destroy(&named_g_nm);
 }
 
@@ -1284,8 +1313,6 @@ setup(void) {
 		ns_server_setoption(sctx, NS_SERVER_NOTCP, true);
 	if (sigvalinsecs)
 		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);
-
-	named_g_server->sctx->delay = delay;
 }
 
 static void
@@ -1317,8 +1344,6 @@ cleanup(void) {
 	dlz_dlopen_clear();
 #endif
 
-	dns_name_destroy();
-
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN,
 		      ISC_LOG_NOTICE, "exiting");
@@ -1431,6 +1456,10 @@ main(int argc, char *argv[]) {
 	setvbuf(stderr, NULL, _IOFBF, BUFSIZ);
 #endif
 
+#ifdef HAVE_LIBXML2
+	xmlInitThreads();
+#endif /* HAVE_LIBXML2 */
+
 	/*
 	 * Record version in core image.
 	 * strings named.core | grep "named version:"
@@ -1563,6 +1592,10 @@ main(int argc, char *argv[]) {
 
 	named_os_shutdown();
 
+#ifdef HAVE_LIBXML2
+	xmlCleanupThreads();
+#endif /* HAVE_LIBXML2 */
+
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif

bin/named/named.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -378,5 +378,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/named/named.conf.5

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2019-08-07
+.\"      Date: 2019-08-12
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2019\-08\-07" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2019\-08\-12" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -97,19 +97,6 @@ dlz \fIstring\fR {
 .if n \{\
 .RE
 .\}
-.SH "DNSSEC-KEYS"
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-dnssec\-keys { \fIstring\fR ( static\-key |
-    initial\-key ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
-    \fIquoted_string\fR; \&.\&.\&. };
-.fi
-.if n \{\
-.RE
-.\}
 .SH "DYNDB"
 .sp
 .if n \{\
@@ -163,16 +150,16 @@ logging {
 .\}
 .SH "MANAGED-KEYS"
 .PP
-Deprecated \- see DNSSEC\-KEYS\&.
+Deprecated \- see TRUST\-ANCHORS\&.
 .sp
 .if n \{\
 .RS 4
 .\}
 .nf
 managed\-keys { \fIstring\fR ( static\-key
-    | initial\-key ) \fIinteger\fR
-    \fIinteger\fR \fIinteger\fR
-    \fIquoted_string\fR; \&.\&.\&. }; deprecated
+    | initial\-key | static\-ds |
+    initial\-ds ) \fIinteger\fR \fIinteger\fR
+    \fIinteger\fR \fIquoted_string\fR; \&.\&.\&. }; deprecated
 .fi
 .if n \{\
 .RE
@@ -230,7 +217,7 @@ options {
 	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
 	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
-	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
+	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIduration\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
@@ -312,18 +299,18 @@ options {
 	fstrm\-set\-output\-notify\-threshold \fIinteger\fR;
 	fstrm\-set\-output\-queue\-model ( mpsc | spsc );
 	fstrm\-set\-output\-queue\-size \fIinteger\fR;
-	fstrm\-set\-reopen\-interval \fIttlval\fR;
+	fstrm\-set\-reopen\-interval \fIduration\fR;
 	geoip\-directory ( \fIquoted_string\fR | none );
 	glue\-cache \fIboolean\fR;
 	heartbeat\-interval \fIinteger\fR;
 	hostname ( \fIquoted_string\fR | none );
 	inline\-signing \fIboolean\fR;
-	interface\-interval \fIttlval\fR;
+	interface\-interval \fIduration\fR;
 	ixfr\-from\-differences ( primary | master | secondary | slave |
 	    \fIboolean\fR );
 	keep\-response\-order { \fIaddress_match_element\fR; \&.\&.\&. };
 	key\-directory \fIquoted_string\fR;
-	lame\-ttl \fIttlval\fR;
+	lame\-ttl \fIduration\fR;
 	listen\-on [ port \fIinteger\fR ] [ dscp
 	    \fIinteger\fR ] {
 	    \fIaddress_match_element\fR; \&.\&.\&. };
@@ -337,28 +324,28 @@ options {
 	masterfile\-style ( full | relative );
 	match\-mapped\-addresses \fIboolean\fR;
 	max\-cache\-size ( default | unlimited | \fIsizeval\fR | \fIpercentage\fR );
-	max\-cache\-ttl \fIttlval\fR;
+	max\-cache\-ttl \fIduration\fR;
 	max\-clients\-per\-query \fIinteger\fR;
 	max\-journal\-size ( default | unlimited | \fIsizeval\fR );
-	max\-ncache\-ttl \fIttlval\fR;
+	max\-ncache\-ttl \fIduration\fR;
 	max\-records \fIinteger\fR;
 	max\-recursion\-depth \fIinteger\fR;
 	max\-recursion\-queries \fIinteger\fR;
 	max\-refresh\-time \fIinteger\fR;
 	max\-retry\-time \fIinteger\fR;
 	max\-rsa\-exponent\-size \fIinteger\fR;
-	max\-stale\-ttl \fIttlval\fR;
+	max\-stale\-ttl \fIduration\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;
 	max\-transfer\-idle\-out \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-udp\-size \fIinteger\fR;
-	max\-zone\-ttl ( unlimited | \fIttlval\fR );
+	max\-zone\-ttl ( unlimited | \fIduration\fR );
 	memstatistics \fIboolean\fR;
 	memstatistics\-file \fIquoted_string\fR;
 	message\-compression \fIboolean\fR;
-	min\-cache\-ttl \fIttlval\fR;
-	min\-ncache\-ttl \fIttlval\fR;
+	min\-cache\-ttl \fIduration\fR;
+	min\-ncache\-ttl \fIduration\fR;
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	minimal\-any \fIboolean\fR;
@@ -375,8 +362,8 @@ options {
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]
 	    [ dscp \fIinteger\fR ];
 	notify\-to\-soa \fIboolean\fR;
-	nta\-lifetime \fIttlval\fR;
-	nta\-recheck \fIttlval\fR;
+	nta\-lifetime \fIduration\fR;
+	nta\-recheck \fIduration\fR;
 	nxdomain\-redirect \fIstring\fR;
 	pid\-file ( \fIquoted_string\fR | none );
 	port \fIinteger\fR;
@@ -423,13 +410,13 @@ options {
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
 	response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
-	    \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
-	    \fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
+	    \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [ min\-update\-interval
+	    \fIduration\fR ] [ policy ( cname | disabled | drop | given | no\-op |
 	    nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
 	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
-	    min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [
+	    min\-update\-interval \fIduration\fR ] [ min\-ns\-dots \fIinteger\fR ] [
 	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
 	    [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
@@ -443,7 +430,7 @@ options {
 	serial\-query\-rate \fIinteger\fR;
 	serial\-update\-method ( date | increment | unixtime );
 	server\-id ( \fIquoted_string\fR | none | hostname );
-	servfail\-ttl \fIttlval\fR;
+	servfail\-ttl \fIduration\fR;
 	session\-keyalg \fIstring\fR;
 	session\-keyfile ( \fIquoted_string\fR | none );
 	session\-keyname \fIstring\fR;
@@ -454,7 +441,7 @@ options {
 	sortlist { \fIaddress_match_element\fR; \&.\&.\&. };
 	stacksize ( default | unlimited | \fIsizeval\fR );
 	stale\-answer\-enable \fIboolean\fR;
-	stale\-answer\-ttl \fIttlval\fR;
+	stale\-answer\-ttl \fIduration\fR;
 	startup\-notify\-rate \fIinteger\fR;
 	statistics\-file \fIquoted_string\fR;
 	synth\-from\-dnssec \fIboolean\fR;
@@ -564,9 +551,23 @@ statistics\-channels {
 .if n \{\
 .RE
 .\}
+.SH "TRUST-ANCHORS"
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+trust\-anchors { \fIstring\fR ( static\-key |
+    initial\-key | static\-ds | initial\-ds )
+    \fIinteger\fR \fIinteger\fR \fIinteger\fR
+    \fIquoted_string\fR; \&.\&.\&. };
+.fi
+.if n \{\
+.RE
+.\}
 .SH "TRUSTED-KEYS"
 .PP
-Deprecated \- see DNSSEC\-KEYS\&.
+Deprecated \- see TRUST\-ANCHORS\&.
 .sp
 .if n \{\
 .RS 4
@@ -612,7 +613,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 	    [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
 	    \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
 	    \fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
-	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
+	    in\-memory \fIboolean\fR ] [ min\-update\-interval \fIduration\fR ]; \&.\&.\&. };
 	check\-dup\-records ( fail | warn | ignore );
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
@@ -654,9 +655,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 	dnsrps\-options { \fIunspecified\-text\fR };
 	dnssec\-accept\-expired \fIboolean\fR;
 	dnssec\-dnskey\-kskonly \fIboolean\fR;
-	dnssec\-keys { \fIstring\fR ( static\-key |
-	    initial\-key ) \fIinteger\fR \fIinteger\fR
-	    \fIinteger\fR \fIquoted_string\fR; \&.\&.\&. };
 	dnssec\-loadkeys\-interval \fIinteger\fR;
 	dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
@@ -690,10 +688,11 @@ view \fIstring\fR [ \fIclass\fR ] {
 		secret \fIstring\fR;
 	};
 	key\-directory \fIquoted_string\fR;
-	lame\-ttl \fIttlval\fR;
+	lame\-ttl \fIduration\fR;
 	lmdb\-mapsize \fIsizeval\fR;
 	managed\-keys { \fIstring\fR (
 	    static\-key | initial\-key
+	    | static\-ds | initial\-ds
 	    ) \fIinteger\fR \fIinteger\fR
 	    \fIinteger\fR
 	    \fIquoted_string\fR; \&.\&.\&. }; deprecated
@@ -703,25 +702,25 @@ view \fIstring\fR [ \fIclass\fR ] {
 	match\-destinations { \fIaddress_match_element\fR; \&.\&.\&. };
 	match\-recursive\-only \fIboolean\fR;
 	max\-cache\-size ( default | unlimited | \fIsizeval\fR | \fIpercentage\fR );
-	max\-cache\-ttl \fIttlval\fR;
+	max\-cache\-ttl \fIduration\fR;
 	max\-clients\-per\-query \fIinteger\fR;
 	max\-journal\-size ( default | unlimited | \fIsizeval\fR );
-	max\-ncache\-ttl \fIttlval\fR;
+	max\-ncache\-ttl \fIduration\fR;
 	max\-records \fIinteger\fR;
 	max\-recursion\-depth \fIinteger\fR;
 	max\-recursion\-queries \fIinteger\fR;
 	max\-refresh\-time \fIinteger\fR;
 	max\-retry\-time \fIinteger\fR;
-	max\-stale\-ttl \fIttlval\fR;
+	max\-stale\-ttl \fIduration\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;
 	max\-transfer\-idle\-out \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-udp\-size \fIinteger\fR;
-	max\-zone\-ttl ( unlimited | \fIttlval\fR );
+	max\-zone\-ttl ( unlimited | \fIduration\fR );
 	message\-compression \fIboolean\fR;
-	min\-cache\-ttl \fIttlval\fR;
-	min\-ncache\-ttl \fIttlval\fR;
+	min\-cache\-ttl \fIduration\fR;
+	min\-ncache\-ttl \fIduration\fR;
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	minimal\-any \fIboolean\fR;
@@ -737,8 +736,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]
 	    [ dscp \fIinteger\fR ];
 	notify\-to\-soa \fIboolean\fR;
-	nta\-lifetime \fIttlval\fR;
-	nta\-recheck \fIttlval\fR;
+	nta\-lifetime \fIduration\fR;
+	nta\-recheck \fIduration\fR;
 	nxdomain\-redirect \fIstring\fR;
 	plugin ( query ) \fIstring\fR [ {
 	    \fIunspecified\-text\fR } ];
@@ -780,13 +779,13 @@ view \fIstring\fR [ \fIclass\fR ] {
 	response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
 	    \fIinteger\fR;
 	response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
-	    \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
-	    \fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
+	    \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [ min\-update\-interval
+	    \fIduration\fR ] [ policy ( cname | disabled | drop | given | no\-op |
 	    nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
 	    recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
-	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
-	    min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
+	    break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIduration\fR ] [
+	    min\-update\-interval \fIduration\fR ] [ min\-ns\-dots \fIinteger\fR ] [
 	    nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
 	    [ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
 	    nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
@@ -831,14 +830,14 @@ view \fIstring\fR [ \fIclass\fR ] {
 		    \fIinteger\fR | * ) ] [ dscp \fIinteger\fR ];
 		transfers \fIinteger\fR;
 	};
-	servfail\-ttl \fIttlval\fR;
+	servfail\-ttl \fIduration\fR;
 	sig\-signing\-nodes \fIinteger\fR;
 	sig\-signing\-signatures \fIinteger\fR;
 	sig\-signing\-type \fIinteger\fR;
 	sig\-validity\-interval \fIinteger\fR [ \fIinteger\fR ];
 	sortlist { \fIaddress_match_element\fR; \&.\&.\&. };
 	stale\-answer\-enable \fIboolean\fR;
-	stale\-answer\-ttl \fIttlval\fR;
+	stale\-answer\-ttl \fIduration\fR;
 	synth\-from\-dnssec \fIboolean\fR;
 	transfer\-format ( many\-answers | one\-answer );
 	transfer\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ] [
@@ -846,6 +845,10 @@ view \fIstring\fR [ \fIclass\fR ] {
 	transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * )
 	    ] [ dscp \fIinteger\fR ];
 	trust\-anchor\-telemetry \fIboolean\fR; // experimental
+	trust\-anchors { \fIstring\fR ( static\-key |
+	    initial\-key | static\-ds | initial\-ds
+	    ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
+	    \fIquoted_string\fR; \&.\&.\&. };
 	trusted\-keys { \fIstring\fR
 	    \fIinteger\fR \fIinteger\fR
 	    \fIinteger\fR
@@ -890,6 +893,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		dnskey\-sig\-validity \fIinteger\fR;
 		dnssec\-dnskey\-kskonly \fIboolean\fR;
 		dnssec\-loadkeys\-interval \fIinteger\fR;
+		dnssec\-policy \fIstring\fR;
 		dnssec\-secure\-to\-insecure \fIboolean\fR;
 		dnssec\-update\-mode ( maintain | no\-resign );
 		file \fIquoted_string\fR;
@@ -915,7 +919,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		max\-transfer\-idle\-out \fIinteger\fR;
 		max\-transfer\-time\-in \fIinteger\fR;
 		max\-transfer\-time\-out \fIinteger\fR;
-		max\-zone\-ttl ( unlimited | \fIttlval\fR );
+		max\-zone\-ttl ( unlimited | \fIduration\fR );
 		min\-refresh\-time \fIinteger\fR;
 		min\-retry\-time \fIinteger\fR;
 		multi\-master \fIboolean\fR;
@@ -996,6 +1000,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	dnskey\-sig\-validity \fIinteger\fR;
 	dnssec\-dnskey\-kskonly \fIboolean\fR;
 	dnssec\-loadkeys\-interval \fIinteger\fR;
+	dnssec\-policy \fIstring\fR;
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	file \fIquoted_string\fR;
@@ -1020,7 +1025,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	max\-transfer\-idle\-out \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
-	max\-zone\-ttl ( unlimited | \fIttlval\fR );
+	max\-zone\-ttl ( unlimited | \fIduration\fR );
 	min\-refresh\-time \fIinteger\fR;
 	min\-retry\-time \fIinteger\fR;
 	multi\-master \fIboolean\fR;
@@ -1062,6 +1067,30 @@ zone \fIstring\fR [ \fIclass\fR ] {
 .if n \{\
 .RE
 .\}
+.SH "DNSSEC-POLICY"
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+dnssec\-policy \fIstring\fR {
+	dnskey\-ttl \fIduration\fR;
+	keys { ( csk | ksk | zsk ) key\-directory lifetime \fIduration\fR algorithm \fIinteger\fR [ \fIinteger\fR ] ; \&.\&.\&. };
+	parent\-ds\-ttl \fIduration\fR;
+	parent\-propagation\-delay \fIduration\fR;
+	parent\-registration\-delay \fIduration\fR;
+	publish\-safety \fIduration\fR;
+	retire\-safety \fIduration\fR;
+	signatures\-refresh \fIduration\fR;
+	signatures\-validity \fIduration\fR;
+	signatures\-validity\-dnskey \fIduration\fR;
+	zone\-max\-ttl \fIduration\fR;
+	zone\-propagation\-delay \fIduration\fR;
+};
+.fi
+.if n \{\
+.RE
+.\}
 .SH "FILES"
 .PP
 /etc/named\&.conf
@@ -1078,5 +1107,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/named/named.conf.docbook

@@ -13,7 +13,7 @@
 
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
   <info>
-    <date>2019-08-07</date>
+    <date>2019-08-12</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -49,6 +49,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -110,14 +111,6 @@ dlz <replaceable>string</replaceable> {
 </literallayout>
   </refsection>
 
-  <refsection><info><title>DNSSEC-KEYS</title></info>
-    <literallayout class="normal">
-dnssec-keys { <replaceable>string</replaceable> ( static-key |
-    initial-key ) <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
-    <replaceable>quoted_string</replaceable>; ... };
-</literallayout>
-  </refsection>
-
   <refsection><info><title>DYNDB</title></info>
     <literallayout class="normal">
 dyndb <replaceable>string</replaceable> <replaceable>quoted_string</replaceable> {
@@ -155,12 +148,12 @@ logging {
   </refsection>
 
   <refsection><info><title>MANAGED-KEYS</title></info>
-  <para>Deprecated - see DNSSEC-KEYS.</para>
+  <para>Deprecated - see TRUST-ANCHORS.</para>
     <literallayout class="normal">
 managed-keys { <replaceable>string</replaceable> ( static-key
-    | initial-key ) <replaceable>integer</replaceable>
-    <replaceable>integer</replaceable> <replaceable>integer</replaceable>
-    <replaceable>quoted_string</replaceable>; ... }; deprecated
+    | initial-key | static-ds |
+    initial-ds ) <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+    <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; ... }; deprecated
 </literallayout>
   </refsection>
 
@@ -526,8 +519,17 @@ statistics-channels {
 </literallayout>
   </refsection>
 
+  <refsection><info><title>TRUST-ANCHORS</title></info>
+    <literallayout class="normal">
+trust-anchors { <replaceable>string</replaceable> ( static-key |
+    initial-key | static-ds | initial-ds )
+    <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+    <replaceable>quoted_string</replaceable>; ... };
+</literallayout>
+  </refsection>
+
   <refsection><info><title>TRUSTED-KEYS</title></info>
-  <para>Deprecated - see DNSSEC-KEYS.</para>
+  <para>Deprecated - see TRUST-ANCHORS.</para>
     <literallayout class="normal">
 trusted-keys { <replaceable>string</replaceable> <replaceable>integer</replaceable>
     <replaceable>integer</replaceable> <replaceable>integer</replaceable>
@@ -606,9 +608,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnsrps-options { <replaceable>unspecified-text</replaceable> };
 	dnssec-accept-expired <replaceable>boolean</replaceable>;
 	dnssec-dnskey-kskonly <replaceable>boolean</replaceable>;
-	dnssec-keys { <replaceable>string</replaceable> ( static-key |
-	    initial-key ) <replaceable>integer</replaceable> <replaceable>integer</replaceable>
-	    <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; ... };
 	dnssec-loadkeys-interval <replaceable>integer</replaceable>;
 	dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
@@ -646,6 +645,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	lmdb-mapsize <replaceable>sizeval</replaceable>;
 	managed-keys { <replaceable>string</replaceable> (
 	    static-key | initial-key
+	    | static-ds | initial-ds
 	    ) <replaceable>integer</replaceable> <replaceable>integer</replaceable>
 	    <replaceable>integer</replaceable>
 	    <replaceable>quoted_string</replaceable>; ... }; deprecated
@@ -798,6 +798,10 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	trust-anchor-telemetry <replaceable>boolean</replaceable>; // experimental
+	trust-anchors { <replaceable>string</replaceable> ( static-key |
+	    initial-key | static-ds | initial-ds
+	    ) <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable>
+	    <replaceable>quoted_string</replaceable>; ... };
 	trusted-keys { <replaceable>string</replaceable>
 	    <replaceable>integer</replaceable> <replaceable>integer</replaceable>
 	    <replaceable>integer</replaceable>
@@ -1014,7 +1018,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 
     <literallayout class="normal">
 dnssec-policy <replaceable>string</replaceable> {
-	dnskey-ttl <replaceable>ttlval</replaceable>;
+	dnskey-ttl <replaceable>duration</replaceable>;
 	keys { ( csk | ksk | zsk ) key-directory lifetime <replaceable>duration</replaceable> algorithm <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ] ; ... };
 	parent-ds-ttl <replaceable>duration</replaceable>;
 	parent-propagation-delay <replaceable>duration</replaceable>;

bin/named/named.conf.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -92,16 +92,7 @@ dlz
   </div>
 
   <div class="refsection">
-<a name="id-1.11"></a><h2>DNSSEC-KEYS</h2>
-    <div class="literallayout"><p><br>
-dnssec-keys { <em class="replaceable"><code>string</code></em> ( static-key |<br>
-    initial-key ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
-    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
-</p></div>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.12"></a><h2>DYNDB</h2>
+<a name="id-1.11"></a><h2>DYNDB</h2>
     <div class="literallayout"><p><br>
 dyndb <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>quoted_string</code></em> {<br>
     <em class="replaceable"><code>unspecified-text</code></em> };<br>
@@ -109,7 +100,7 @@ dyndb
   </div>
 
   <div class="refsection">
-<a name="id-1.13"></a><h2>KEY</h2>
+<a name="id-1.12"></a><h2>KEY</h2>
     <div class="literallayout"><p><br>
 key <em class="replaceable"><code>string</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -119,7 +110,7 @@ key
   </div>
 
   <div class="refsection">
-<a name="id-1.14"></a><h2>LOGGING</h2>
+<a name="id-1.13"></a><h2>LOGGING</h2>
     <div class="literallayout"><p><br>
 logging {<br>
 	category <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>; ... };<br>
@@ -140,18 +131,18 @@ logging
   </div>
 
   <div class="refsection">
-<a name="id-1.15"></a><h2>MANAGED-KEYS</h2>
-  <p>Deprecated - see DNSSEC-KEYS.</p>
+<a name="id-1.14"></a><h2>MANAGED-KEYS</h2>
+  <p>Deprecated - see TRUST-ANCHORS.</p>
     <div class="literallayout"><p><br>
 managed-keys { <em class="replaceable"><code>string</code></em> ( static-key<br>
-    | initial-key ) <em class="replaceable"><code>integer</code></em><br>
-    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
-    <em class="replaceable"><code>quoted_string</code></em>; ... }; deprecated<br>
+    | initial-key | static-ds |<br>
+    initial-ds ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>quoted_string</code></em>; ... }; deprecated<br>
 </p></div>
   </div>
 
   <div class="refsection">
-<a name="id-1.16"></a><h2>MASTERS</h2>
+<a name="id-1.15"></a><h2>MASTERS</h2>
     <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [ port <em class="replaceable"><code>integer</code></em> ] [ dscp<br>
     <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
@@ -161,7 +152,7 @@ masters
   </div>
 
   <div class="refsection">
-<a name="id-1.17"></a><h2>OPTIONS</h2>
+<a name="id-1.16"></a><h2>OPTIONS</h2>
     <div class="literallayout"><p><br>
 options {<br>
 	allow-new-zones <em class="replaceable"><code>boolean</code></em>;<br>
@@ -196,7 +187,7 @@ options
 	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
-	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
+	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>duration</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
@@ -278,18 +269,18 @@ options
 	fstrm-set-output-notify-threshold <em class="replaceable"><code>integer</code></em>;<br>
 	fstrm-set-output-queue-model ( mpsc | spsc );<br>
 	fstrm-set-output-queue-size <em class="replaceable"><code>integer</code></em>;<br>
-	fstrm-set-reopen-interval <em class="replaceable"><code>ttlval</code></em>;<br>
+	fstrm-set-reopen-interval <em class="replaceable"><code>duration</code></em>;<br>
 	geoip-directory ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	glue-cache <em class="replaceable"><code>boolean</code></em>;<br>
 	heartbeat-interval <em class="replaceable"><code>integer</code></em>;<br>
 	hostname ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	inline-signing <em class="replaceable"><code>boolean</code></em>;<br>
-	interface-interval <em class="replaceable"><code>ttlval</code></em>;<br>
+	interface-interval <em class="replaceable"><code>duration</code></em>;<br>
 	ixfr-from-differences ( primary | master | secondary | slave |<br>
 	    <em class="replaceable"><code>boolean</code></em> );<br>
 	keep-response-order { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	key-directory <em class="replaceable"><code>quoted_string</code></em>;<br>
-	lame-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	lame-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	listen-on [ port <em class="replaceable"><code>integer</code></em> ] [ dscp<br>
 	    <em class="replaceable"><code>integer</code></em> ] {<br>
 	    <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -303,28 +294,28 @@ options
 	masterfile-style ( full | relative );<br>
 	match-mapped-addresses <em class="replaceable"><code>boolean</code></em>;<br>
 	max-cache-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> | <em class="replaceable"><code>percentage</code></em> );<br>
-	max-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	max-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	max-clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
 	max-journal-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
-	max-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	max-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	max-records <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-depth <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-queries <em class="replaceable"><code>integer</code></em>;<br>
 	max-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	max-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	max-rsa-exponent-size <em class="replaceable"><code>integer</code></em>;<br>
-	max-stale-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	max-stale-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
-	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
+	max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
 	memstatistics <em class="replaceable"><code>boolean</code></em>;<br>
 	memstatistics-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	message-compression <em class="replaceable"><code>boolean</code></em>;<br>
-	min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
-	min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	min-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	min-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -341,8 +332,8 @@ options
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ]<br>
 	    [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
-	nta-lifetime <em class="replaceable"><code>ttlval</code></em>;<br>
-	nta-recheck <em class="replaceable"><code>ttlval</code></em>;<br>
+	nta-lifetime <em class="replaceable"><code>duration</code></em>;<br>
+	nta-recheck <em class="replaceable"><code>duration</code></em>;<br>
 	nxdomain-redirect <em class="replaceable"><code>string</code></em>;<br>
 	pid-file ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	port <em class="replaceable"><code>integer</code></em>;<br>
@@ -389,13 +380,13 @@ options
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
 	response-policy { zone <em class="replaceable"><code>string</code></em> [ add-soa <em class="replaceable"><code>boolean</code></em> ] [ log<br>
-	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval<br>
-	    <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
+	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [ min-update-interval<br>
+	    <em class="replaceable"><code>duration</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
 	    nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
 	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ add-soa <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
-	    min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [<br>
+	    min-update-interval <em class="replaceable"><code>duration</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
 	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
 	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
@@ -409,7 +400,7 @@ options
 	serial-query-rate <em class="replaceable"><code>integer</code></em>;<br>
 	serial-update-method ( date | increment | unixtime );<br>
 	server-id ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );<br>
-	servfail-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	servfail-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	session-keyalg <em class="replaceable"><code>string</code></em>;<br>
 	session-keyfile ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	session-keyname <em class="replaceable"><code>string</code></em>;<br>
@@ -420,7 +411,7 @@ options
 	sortlist { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	stacksize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
 	stale-answer-enable <em class="replaceable"><code>boolean</code></em>;<br>
-	stale-answer-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	stale-answer-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	startup-notify-rate <em class="replaceable"><code>integer</code></em>;<br>
 	statistics-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	synth-from-dnssec <em class="replaceable"><code>boolean</code></em>;<br>
@@ -460,7 +451,7 @@ options
   </div>
 
   <div class="refsection">
-<a name="id-1.18"></a><h2>PLUGIN</h2>
+<a name="id-1.17"></a><h2>PLUGIN</h2>
     <div class="literallayout"><p><br>
 plugin ( query ) <em class="replaceable"><code>string</code></em> [ { <em class="replaceable"><code>unspecified-text</code></em><br>
     } ];<br>
@@ -468,7 +459,7 @@ plugin
   </div>
 
   <div class="refsection">
-<a name="id-1.19"></a><h2>SERVER</h2>
+<a name="id-1.18"></a><h2>SERVER</h2>
     <div class="literallayout"><p><br>
 server <em class="replaceable"><code>netprefix</code></em> {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -506,7 +497,7 @@ server
   </div>
 
   <div class="refsection">
-<a name="id-1.20"></a><h2>STATISTICS-CHANNELS</h2>
+<a name="id-1.19"></a><h2>STATISTICS-CHANNELS</h2>
     <div class="literallayout"><p><br>
 statistics-channels {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> |<br>
@@ -517,9 +508,19 @@ statistics-channels
 </p></div>
   </div>
 
+  <div class="refsection">
+<a name="id-1.20"></a><h2>TRUST-ANCHORS</h2>
+    <div class="literallayout"><p><br>
+trust-anchors { <em class="replaceable"><code>string</code></em> ( static-key |<br>
+    initial-key | static-ds | initial-ds )<br>
+    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
+</p></div>
+  </div>
+
   <div class="refsection">
 <a name="id-1.21"></a><h2>TRUSTED-KEYS</h2>
-  <p>Deprecated - see DNSSEC-KEYS.</p>
+  <p>Deprecated - see TRUST-ANCHORS.</p>
     <div class="literallayout"><p><br>
 trusted-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em><br>
     <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
@@ -557,7 +558,7 @@ view
 	    [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
 	    <em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
-	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
+	    in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>duration</code></em> ]; ... };<br>
 	check-dup-records ( fail | warn | ignore );<br>
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
@@ -599,9 +600,6 @@ view
 	dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> };<br>
 	dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
-	dnssec-keys { <em class="replaceable"><code>string</code></em> ( static-key |<br>
-	    initial-key ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
-	    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 	dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
 	dnssec-must-be-secure <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
@@ -635,10 +633,11 @@ view
 		secret <em class="replaceable"><code>string</code></em>;<br>
 	};<br>
 	key-directory <em class="replaceable"><code>quoted_string</code></em>;<br>
-	lame-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	lame-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	lmdb-mapsize <em class="replaceable"><code>sizeval</code></em>;<br>
 	managed-keys { <em class="replaceable"><code>string</code></em> (<br>
 	    static-key | initial-key<br>
+	    | static-ds | initial-ds<br>
 	    ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>quoted_string</code></em>; ... }; deprecated<br>
@@ -648,25 +647,25 @@ view
 	match-destinations { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	match-recursive-only <em class="replaceable"><code>boolean</code></em>;<br>
 	max-cache-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> | <em class="replaceable"><code>percentage</code></em> );<br>
-	max-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	max-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	max-clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
 	max-journal-size ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
-	max-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	max-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	max-records <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-depth <em class="replaceable"><code>integer</code></em>;<br>
 	max-recursion-queries <em class="replaceable"><code>integer</code></em>;<br>
 	max-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	max-retry-time <em class="replaceable"><code>integer</code></em>;<br>
-	max-stale-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	max-stale-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
-	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
+	max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
 	message-compression <em class="replaceable"><code>boolean</code></em>;<br>
-	min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
-	min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	min-cache-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	min-ncache-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -682,8 +681,8 @@ view
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ]<br>
 	    [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
-	nta-lifetime <em class="replaceable"><code>ttlval</code></em>;<br>
-	nta-recheck <em class="replaceable"><code>ttlval</code></em>;<br>
+	nta-lifetime <em class="replaceable"><code>duration</code></em>;<br>
+	nta-recheck <em class="replaceable"><code>duration</code></em>;<br>
 	nxdomain-redirect <em class="replaceable"><code>string</code></em>;<br>
 	plugin ( query ) <em class="replaceable"><code>string</code></em> [ {<br>
 	    <em class="replaceable"><code>unspecified-text</code></em> } ];<br>
@@ -725,13 +724,13 @@ view
 	response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
 	    <em class="replaceable"><code>integer</code></em>;<br>
 	response-policy { zone <em class="replaceable"><code>string</code></em> [ add-soa <em class="replaceable"><code>boolean</code></em> ] [ log<br>
-	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval<br>
-	    <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
+	    <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [ min-update-interval<br>
+	    <em class="replaceable"><code>duration</code></em> ] [ policy ( cname | disabled | drop | given | no-op |<br>
 	    nodata | nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
 	    recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ add-soa <em class="replaceable"><code>boolean</code></em> ] [<br>
-	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
-	    min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
+	    break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>duration</code></em> ] [<br>
+	    min-update-interval <em class="replaceable"><code>duration</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
 	    nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
 	    [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
@@ -776,14 +775,14 @@ view
 		    <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		transfers <em class="replaceable"><code>integer</code></em>;<br>
 	};<br>
-	servfail-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	servfail-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-type <em class="replaceable"><code>integer</code></em>;<br>
 	sig-validity-interval <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
 	sortlist { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	stale-answer-enable <em class="replaceable"><code>boolean</code></em>;<br>
-	stale-answer-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+	stale-answer-ttl <em class="replaceable"><code>duration</code></em>;<br>
 	synth-from-dnssec <em class="replaceable"><code>boolean</code></em>;<br>
 	transfer-format ( many-answers | one-answer );<br>
 	transfer-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ] [<br>
@@ -791,6 +790,10 @@ view
 	transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * )<br>
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	trust-anchor-telemetry <em class="replaceable"><code>boolean</code></em>; // experimental<br>
+	trust-anchors { <em class="replaceable"><code>string</code></em> ( static-key |<br>
+	    initial-key | static-ds | initial-ds<br>
+	    ) <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
+	    <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
 	trusted-keys { <em class="replaceable"><code>string</code></em><br>
 	    <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
 	    <em class="replaceable"><code>integer</code></em><br>
@@ -835,6 +838,7 @@ view
 		dnskey-sig-validity <em class="replaceable"><code>integer</code></em>;<br>
 		dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
 		dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
+		dnssec-policy <em class="replaceable"><code>string</code></em>;<br>
 		dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 		dnssec-update-mode ( maintain | no-resign );<br>
 		file <em class="replaceable"><code>quoted_string</code></em>;<br>
@@ -860,7 +864,7 @@ view
 		max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 		max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 		max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
-		max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
+		max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
 		min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 		min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 		multi-master <em class="replaceable"><code>boolean</code></em>;<br>
@@ -937,6 +941,7 @@ zone
 	dnskey-sig-validity <em class="replaceable"><code>integer</code></em>;<br>
 	dnssec-dnskey-kskonly <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-loadkeys-interval <em class="replaceable"><code>integer</code></em>;<br>
+	dnssec-policy <em class="replaceable"><code>string</code></em>;<br>
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	file <em class="replaceable"><code>quoted_string</code></em>;<br>
@@ -961,7 +966,7 @@ zone
 	max-transfer-idle-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
-	max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
+	max-zone-ttl ( unlimited | <em class="replaceable"><code>duration</code></em> );<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
 	multi-master <em class="replaceable"><code>boolean</code></em>;<br>
@@ -1003,14 +1008,35 @@ zone
   </div>
 
   <div class="refsection">
-<a name="id-1.24"></a><h2>FILES</h2>
+<a name="id-1.24"></a><h2>DNSSEC-POLICY</h2>
+
+    <div class="literallayout"><p><br>
+dnssec-policy <em class="replaceable"><code>string</code></em> {<br>
+	dnskey-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	keys { ( csk | ksk | zsk ) key-directory lifetime <em class="replaceable"><code>duration</code></em> algorithm <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ] ; ... };<br>
+	parent-ds-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	parent-propagation-delay <em class="replaceable"><code>duration</code></em>;<br>
+	parent-registration-delay <em class="replaceable"><code>duration</code></em>;<br>
+	publish-safety <em class="replaceable"><code>duration</code></em>;<br>
+	retire-safety <em class="replaceable"><code>duration</code></em>;<br>
+	signatures-refresh <em class="replaceable"><code>duration</code></em>;<br>
+	signatures-validity <em class="replaceable"><code>duration</code></em>;<br>
+	signatures-validity-dnskey <em class="replaceable"><code>duration</code></em>;<br>
+	zone-max-ttl <em class="replaceable"><code>duration</code></em>;<br>
+	zone-propagation-delay <em class="replaceable"><code>duration</code></em>;<br>
+};<br>
+</p></div>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.25"></a><h2>FILES</h2>
 
     <p><code class="filename">/etc/named.conf</code>
     </p>
   </div>
 
   <div class="refsection">
-<a name="id-1.25"></a><h2>SEE ALSO</h2>
+<a name="id-1.26"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
 	<span class="refentrytitle">ddns-confgen</span>(8)

bin/named/named.docbook

@@ -49,6 +49,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/named/named.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/named/server.c

@@ -68,6 +68,7 @@
 #include <dns/events.h>
 #include <dns/forward.h>
 #include <dns/fixedname.h>
+#include <dns/geoip.h>
 #include <dns/journal.h>
 #include <dns/kasp.h>
 #include <dns/keytable.h>
@@ -201,8 +202,8 @@
 
 #define CHECKFATAL(op, msg) \
 	do { result = (op);					  \
-	       if (result != ISC_R_SUCCESS)			  \
-			fatal(msg, result);			  \
+		if (result != ISC_R_SUCCESS)			  \
+			fatal(server, msg, result);		  \
 	} while (0)						  \
 
 /*%
@@ -431,7 +432,8 @@ const char *empty_zones[] = {
 };
 
 ISC_PLATFORM_NORETURN_PRE static void
-fatal(const char *msg, isc_result_t result) ISC_PLATFORM_NORETURN_POST;
+fatal(named_server_t *server,const char *msg, isc_result_t result)
+ISC_PLATFORM_NORETURN_POST;
 
 static void
 named_server_reload(isc_task_t *task, isc_event_t *event);
@@ -698,111 +700,198 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 }
 
 static isc_result_t
-dstkey_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **target,
-		  const char **keynamestrp, isc_mem_t *mctx)
+ta_fromconfig(const cfg_obj_t *key, bool *initialp, const char **namestrp,
+	      unsigned char *digest, dns_rdata_ds_t *ds)
 {
+	isc_result_t result;
 	dns_rdata_dnskey_t keystruct;
-	uint32_t flags, proto, alg;
-	const char *keystr, *keynamestr;
-	unsigned char keydata[4096];
-	isc_buffer_t keydatabuf;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	uint32_t rdata1, rdata2, rdata3;
+	const char *datastr = NULL, *namestr = NULL;
+	unsigned char data[4096];
+	isc_buffer_t databuf;
 	unsigned char rrdata[4096];
 	isc_buffer_t rrdatabuf;
 	isc_region_t r;
-	dns_fixedname_t fkeyname;
-	dns_name_t *keyname;
+	dns_fixedname_t fname;
+	dns_name_t *name = NULL;
 	isc_buffer_t namebuf;
-	isc_result_t result;
-	dst_key_t *dstkey = NULL;
+	const char *atstr = NULL;
+	enum {
+		INIT_DNSKEY,
+		STATIC_DNSKEY,
+		INIT_DS,
+		STATIC_DS,
+		TRUSTED
+	} anchortype;
 
-	INSIST(target != NULL && *target == NULL);
-	INSIST(keynamestrp != NULL && *keynamestrp == NULL);
+	REQUIRE(namestrp != NULL && *namestrp == NULL);
+	REQUIRE(ds != NULL);
 
-	flags = cfg_obj_asuint32(cfg_tuple_get(key, "flags"));
-	proto = cfg_obj_asuint32(cfg_tuple_get(key, "protocol"));
-	alg = cfg_obj_asuint32(cfg_tuple_get(key, "algorithm"));
-	keyname = dns_fixedname_name(&fkeyname);
-	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
-	*keynamestrp = keynamestr;
+	/* if DNSKEY, flags; if DS, key tag */
+	rdata1 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata1"));
+
+	/* if DNSKEY, protocol; if DS, algorithm */
+	rdata2 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata2"));
+
+	/* if DNSKEY, algorithm; if DS, digest type */
+	rdata3 = cfg_obj_asuint32(cfg_tuple_get(key, "rdata3"));
+
+	namestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
+	*namestrp = namestr;
+
+	name = dns_fixedname_initname(&fname);
+	isc_buffer_constinit(&namebuf, namestr, strlen(namestr));
+	isc_buffer_add(&namebuf, strlen(namestr));
+	CHECK(dns_name_fromtext(name, &namebuf, dns_rootname, 0, NULL));
 
 	if (*initialp) {
-		const char *initmethod;
-		initmethod = cfg_obj_asstring(cfg_tuple_get(key, "init"));
+		atstr = cfg_obj_asstring(cfg_tuple_get(key, "anchortype"));
 
-		if (strcasecmp(initmethod, "static-key") == 0) {
+		if (strcasecmp(atstr, "static-key") == 0) {
 			*initialp = false;
-		} else if (strcasecmp(initmethod, "initial-key") != 0) {
+			anchortype = STATIC_DNSKEY;
+		} else if (strcasecmp(atstr, "static-ds") == 0) {
+			*initialp = false;
+			anchortype = STATIC_DS;
+		} else if (strcasecmp(atstr, "initial-key") == 0) {
+			anchortype = INIT_DNSKEY;
+		} else if (strcasecmp(atstr, "initial-ds") == 0) {
+			anchortype = INIT_DS;
+		} else {
 			cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
 				    "key '%s': "
 				    "invalid initialization method '%s'",
-				    keynamestr, initmethod);
+				    namestr, atstr);
 			result = ISC_R_FAILURE;
 			goto cleanup;
 		}
+	} else {
+		anchortype = TRUSTED;
 	}
 
-	/*
-	 * This function should never be reached for non-IN classes.
-	 */
-	keystruct.common.rdclass = dns_rdataclass_in;
-	keystruct.common.rdtype = dns_rdatatype_dnskey;
-
-	/*
-	 * The key data in keystruct is not dynamically allocated.
-	 */
-	keystruct.mctx = NULL;
-
-	ISC_LINK_INIT(&keystruct.common, link);
-
-	if (flags > 0xffff)
-		CHECKM(ISC_R_RANGE, "key flags");
-	if (flags & DNS_KEYFLAG_REVOKE)
-		CHECKM(DST_R_BADKEYTYPE, "key flags revoke bit set");
-	if (proto > 0xff)
-		CHECKM(ISC_R_RANGE, "key protocol");
-	if (alg > 0xff)
-		CHECKM(ISC_R_RANGE, "key algorithm");
-	keystruct.flags = (uint16_t)flags;
-	keystruct.protocol = (uint8_t)proto;
-	keystruct.algorithm = (uint8_t)alg;
-
-	isc_buffer_init(&keydatabuf, keydata, sizeof(keydata));
+	isc_buffer_init(&databuf, data, sizeof(data));
 	isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));
 
-	keystr = cfg_obj_asstring(cfg_tuple_get(key, "key"));
-	CHECK(isc_base64_decodestring(keystr, &keydatabuf));
-	isc_buffer_usedregion(&keydatabuf, &r);
-	keystruct.datalen = r.length;
-	keystruct.data = r.base;
+	*ds = (dns_rdata_ds_t){
+		.common.rdclass = dns_rdataclass_in,
+		.common.rdtype = dns_rdatatype_ds
+	};
 
-	if ((keystruct.algorithm == DST_ALG_RSASHA1) &&
-	    r.length > 1 && r.base[0] == 1 && r.base[1] == 3)
-	{
-		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
-			    "%s '%s' has a weak exponent",
-			    *initialp ? "initial-key" : "static-key",
-			    keynamestr);
+	ISC_LINK_INIT(&ds->common, link);
+
+	switch(anchortype) {
+	case INIT_DNSKEY:
+	case STATIC_DNSKEY:
+	case TRUSTED:
+		/*
+		 * This function should never be reached for view
+		 * class other than IN
+		 */
+		keystruct.common.rdclass = dns_rdataclass_in;
+		keystruct.common.rdtype = dns_rdatatype_dnskey;
+
+		/*
+		 * The key data in keystruct is not dynamically allocated.
+		 */
+		keystruct.mctx = NULL;
+
+		ISC_LINK_INIT(&keystruct.common, link);
+
+		if (rdata1 > 0xffff) {
+			CHECKM(ISC_R_RANGE, "key flags");
+		}
+		if (rdata1 & DNS_KEYFLAG_REVOKE) {
+			CHECKM(DST_R_BADKEYTYPE, "key flags revoke bit set");
+		}
+		if (rdata2 > 0xff) {
+			CHECKM(ISC_R_RANGE, "key protocol");
+		}
+		if (rdata3 > 0xff) {
+			CHECKM(ISC_R_RANGE, "key algorithm");
+		}
+
+		keystruct.flags = (uint16_t)rdata1;
+		keystruct.protocol = (uint8_t)rdata2;
+		keystruct.algorithm = (uint8_t)rdata3;
+
+		if (!dst_algorithm_supported(keystruct.algorithm)) {
+			CHECK(DST_R_UNSUPPORTEDALG);
+		}
+
+		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
+		CHECK(isc_base64_decodestring(datastr, &databuf));
+		isc_buffer_usedregion(&databuf, &r);
+		keystruct.datalen = r.length;
+		keystruct.data = r.base;
+
+		CHECK(dns_rdata_fromstruct(&rdata, keystruct.common.rdclass,
+					   keystruct.common.rdtype,
+					   &keystruct, &rrdatabuf));
+		CHECK(dns_ds_fromkeyrdata(name, &rdata, DNS_DSDIGEST_SHA256,
+					  digest, ds));
+		break;
+
+	case INIT_DS:
+	case STATIC_DS:
+		if (rdata1 > 0xffff) {
+			CHECKM(ISC_R_RANGE, "key tag");
+		}
+		if (rdata2 > 0xff) {
+			CHECKM(ISC_R_RANGE, "key algorithm");
+		}
+		if (rdata3 > 0xff) {
+			CHECKM(ISC_R_RANGE, "digest type");
+		}
+
+		ds->key_tag = (uint16_t)rdata1;
+		ds->algorithm = (uint8_t)rdata2;
+		ds->digest_type = (uint8_t)rdata3;
+
+		datastr = cfg_obj_asstring(cfg_tuple_get(key, "data"));
+		CHECK(isc_hex_decodestring(datastr, &databuf));
+		isc_buffer_usedregion(&databuf, &r);
+
+		switch (ds->digest_type) {
+		case DNS_DSDIGEST_SHA1:
+			if (r.length != ISC_SHA1_DIGESTLENGTH) {
+				CHECK(ISC_R_UNEXPECTEDEND);
+			}
+			break;
+		case DNS_DSDIGEST_SHA256:
+			if (r.length != ISC_SHA256_DIGESTLENGTH) {
+				CHECK(ISC_R_UNEXPECTEDEND);
+			}
+			break;
+		case DNS_DSDIGEST_SHA384:
+			if (r.length != ISC_SHA384_DIGESTLENGTH) {
+				CHECK(ISC_R_UNEXPECTEDEND);
+			}
+			break;
+		default:
+			cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
+				    "key '%s': "
+				    "unknown ds digest type %u",
+				    namestr, ds->digest_type);
+			result = ISC_R_FAILURE;
+			goto cleanup;
+			break;
+		}
+
+		ds->length = r.length;
+		ds->digest = digest;
+		memmove(ds->digest, r.base, r.length);
+
+		break;
+
+	default:
+		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
-	CHECK(dns_rdata_fromstruct(NULL,
-				   keystruct.common.rdclass,
-				   keystruct.common.rdtype,
-				   &keystruct, &rrdatabuf));
-	dns_fixedname_init(&fkeyname);
-	isc_buffer_constinit(&namebuf, keynamestr, strlen(keynamestr));
-	isc_buffer_add(&namebuf, strlen(keynamestr));
-	CHECK(dns_name_fromtext(keyname, &namebuf, dns_rootname, 0, NULL));
-	CHECK(dst_key_fromdns(keyname, dns_rdataclass_in, &rrdatabuf,
-			      mctx, &dstkey));
-
-	*target = dstkey;
 	return (ISC_R_SUCCESS);
 
  cleanup:
-	if (dstkey != NULL) {
-		dst_key_free(&dstkey);
-	}
-
 	return (result);
 }
 
@@ -820,26 +909,31 @@ dstkey_fromconfig(const cfg_obj_t *key, bool *initialp, dst_key_t **target,
 static isc_result_t
 process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 	    const dns_name_t *keyname_match, dns_resolver_t *resolver,
-	    bool managed, isc_mem_t *mctx)
+	    bool managed)
 {
-	const dns_name_t *keyname = NULL;
-	const char *keynamestr = NULL;
-	dst_key_t *dstkey = NULL;
-	unsigned int keyalg;
+	dns_fixedname_t fkeyname;
+	dns_name_t *keyname = NULL;
+	const char *namestr = NULL;
+	dns_rdata_ds_t ds;
 	isc_result_t result;
 	bool initializing = managed;
+	unsigned char digest[ISC_MAX_MD_SIZE];
+	isc_buffer_t b;
 
-	result = dstkey_fromconfig(key, &initializing,
-				   &dstkey, &keynamestr, mctx);
+	result = ta_fromconfig(key, &initializing, &namestr, digest, &ds);
 
 	switch (result) {
 	case ISC_R_SUCCESS:
 		/*
-		 * Key was parsed correctly, its algorithm is supported by the
-		 * crypto library, and it is not revoked.
+		 * Trust anchor was parsed correctly.
 		 */
-		keyname = dst_key_name(dstkey);
-		keyalg = dst_key_alg(dstkey);
+		isc_buffer_constinit(&b, namestr, strlen(namestr));
+		isc_buffer_add(&b, strlen(namestr));
+		keyname = dns_fixedname_initname(&fkeyname);
+		result = dns_name_fromtext(keyname, &b, dns_rootname, 0, NULL);
+		if (result != ISC_R_SUCCESS) {
+			return (result);
+		}
 		break;
 	case DST_R_UNSUPPORTEDALG:
 	case DST_R_BADKEYTYPE:
@@ -851,7 +945,7 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "ignoring %s for '%s': %s",
 			    initializing ? "initial-key" : "static-key",
-			    keynamestr, isc_result_totext(result));
+			    namestr, isc_result_totext(result));
 		return (ISC_R_SUCCESS);
 	case DST_R_NOCRYPTO:
 		/*
@@ -860,7 +954,7 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
 			    "ignoring %s for '%s': no crypto support",
 			    initializing ? "initial-key" : "static-key",
-			    keynamestr);
+			    namestr);
 		return (result);
 	default:
 		/*
@@ -871,7 +965,7 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
 			    "configuring %s for '%s': %s",
 			    initializing ? "initial-key" : "static-key",
-			    keynamestr, isc_result_totext(result));
+			    namestr, isc_result_totext(result));
 		return (ISC_R_FAILURE);
 	}
 
@@ -889,34 +983,26 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
 	 * its owner name.  If it does not, do not load the key and log a
 	 * warning, but do not prevent further keys from being processed.
 	 */
-	if (!dns_resolver_algorithm_supported(resolver, keyname, keyalg)) {
+	if (!dns_resolver_algorithm_supported(resolver, keyname, ds.algorithm))
+	{
 		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "ignoring %s for '%s': algorithm is disabled",
 			    initializing ? "initial-key" : "static-key",
-			    keynamestr);
+			    namestr);
 		goto done;
 	}
 
 	/*
-	 * Add the key to 'secroots'.  Keys from a "dnssec-keys" or
+	 * Add the key to 'secroots'.  Keys from a "trust-anchors" or
 	 * "managed-keys" statement may be either static or initializing
 	 * keys. If it's not initializing, we don't want to treat it as
 	 * managed, so we use 'initializing' twice here, for both the
 	 * 'managed' and 'initializing' arguments to dns_keytable_add().
 	 */
-	result = dns_keytable_add(secroots, initializing,
-				  initializing, &dstkey);
+	result = dns_keytable_add(secroots, initializing, initializing,
+				  keyname, &ds);
 
  done:
-	/*
-	 * Ensure 'dstkey' does not leak.  Note that if dns_keytable_add()
-	 * succeeds, ownership of the key structure is transferred to the key
-	 * table, i.e. 'dstkey' is set to NULL.
-	 */
-	if (dstkey != NULL) {
-		dst_key_free(&dstkey);
-	}
-
 	return (result);
 }
 
@@ -927,7 +1013,7 @@ process_key(const cfg_obj_t *key, dns_keytable_t *secroots,
  */
 static isc_result_t
 load_view_keys(const cfg_obj_t *keys, dns_view_t *view, bool managed,
-	       const dns_name_t *keyname, isc_mem_t *mctx)
+	       const dns_name_t *keyname)
 {
 	const cfg_listelt_t *elt, *elt2;
 	const cfg_obj_t *keylist;
@@ -946,9 +1032,8 @@ load_view_keys(const cfg_obj_t *keys, dns_view_t *view, bool managed,
 		     elt2 != NULL;
 		     elt2 = cfg_list_next(elt2))
 		{
-			CHECK(process_key(cfg_listelt_value(elt2),
-					  secroots, keyname, view->resolver,
-					  managed, mctx));
+			CHECK(process_key(cfg_listelt_value(elt2), secroots,
+					  keyname, view->resolver, managed));
 		}
 	}
 
@@ -1000,9 +1085,9 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	const cfg_obj_t *view_keys = NULL;
 	const cfg_obj_t *global_keys = NULL;
 	const cfg_obj_t *view_managed_keys = NULL;
-	const cfg_obj_t *view_dnssec_keys = NULL;
+	const cfg_obj_t *view_trust_anchors = NULL;
 	const cfg_obj_t *global_managed_keys = NULL;
-	const cfg_obj_t *global_dnssec_keys = NULL;
+	const cfg_obj_t *global_trust_anchors = NULL;
 	const cfg_obj_t *maps[4];
 	const cfg_obj_t *voptions = NULL;
 	const cfg_obj_t *options = NULL;
@@ -1023,11 +1108,11 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 			(void) cfg_map_get(voptions, "trusted-keys",
 					   &view_keys);
 
-			/* managed-keys and dnssec-keys are synonyms. */
+			/* managed-keys and trust-anchors are synonyms. */
 			(void) cfg_map_get(voptions, "managed-keys",
 					   &view_managed_keys);
-			(void) cfg_map_get(voptions, "dnssec-keys",
-					   &view_dnssec_keys);
+			(void) cfg_map_get(voptions, "trust-anchors",
+					   &view_trust_anchors);
 
 			maps[i++] = voptions;
 		}
@@ -1036,9 +1121,10 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	if (config != NULL) {
 		(void)cfg_map_get(config, "trusted-keys", &global_keys);
 
-		/* managed-keys and dnssec-keys are synonyms. */
+		/* managed-keys and trust-anchors are synonyms. */
 		(void)cfg_map_get(config, "managed-keys", &global_managed_keys);
-		(void)cfg_map_get(config, "dnssec-keys", &global_dnssec_keys);
+		(void)cfg_map_get(config, "trust-anchors",
+				  &global_trust_anchors);
 
 		(void)cfg_map_get(config, "options", &options);
 		if (options != NULL) {
@@ -1070,7 +1156,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 
 		/*
 		 * If bind.keys exists and is populated, it overrides
-		 * the dnssec-keys clause hard-coded in named_g_config.
+		 * the trust-anchors clause hard-coded in named_g_config.
 		 */
 		if (bindkeys != NULL) {
 			isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY,
@@ -1079,7 +1165,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 				      "from '%s'",
 				      view->name, named_g_server->bindkeysfile);
 
-			(void)cfg_map_get(bindkeys, "dnssec-keys",
+			(void)cfg_map_get(bindkeys, "trust-anchors",
 					  &builtin_keys);
 
 			if (builtin_keys == NULL) {
@@ -1099,13 +1185,13 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 				      "using built-in root key for view %s",
 				      view->name);
 
-			(void)cfg_map_get(named_g_config, "dnssec-keys",
+			(void)cfg_map_get(named_g_config, "trust-anchors",
 					  &builtin_keys);
 		}
 
 		if (builtin_keys != NULL) {
 			CHECK(load_view_keys(builtin_keys, view, true,
-					     dns_rootname, mctx));
+					     dns_rootname));
 		}
 
 		if (!keyloaded(view, dns_rootname)) {
@@ -1117,16 +1203,14 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 		}
 	}
 
-	CHECK(load_view_keys(view_keys, view, false, NULL, mctx));
-	CHECK(load_view_keys(view_managed_keys, view, true, NULL, mctx));
-	CHECK(load_view_keys(view_dnssec_keys, view, true, NULL, mctx));
-
 	if (view->rdclass == dns_rdataclass_in) {
-		CHECK(load_view_keys(global_keys, view, false, NULL, mctx));
-		CHECK(load_view_keys(global_managed_keys, view, true,
-				     NULL, mctx));
-		CHECK(load_view_keys(global_dnssec_keys, view, true,
-				     NULL, mctx));
+		CHECK(load_view_keys(view_keys, view, false, NULL));
+		CHECK(load_view_keys(view_trust_anchors, view, true, NULL));
+		CHECK(load_view_keys(view_managed_keys, view, true, NULL));
+
+		CHECK(load_view_keys(global_keys, view, false, NULL));
+		CHECK(load_view_keys(global_trust_anchors, view, true, NULL));
+		CHECK(load_view_keys(global_managed_keys, view, true, NULL));
 	}
 
 	/*
@@ -6700,35 +6784,34 @@ struct dotat_arg {
  * reported in the TAT query.
  */
 static isc_result_t
-get_tat_qname(dns_name_t *dst, const dns_name_t **origin,
-	      dns_keytable_t *keytable, dns_keynode_t *keynode)
-{
-	dns_keynode_t *firstnode = keynode;
-	dns_keynode_t *nextnode;
+get_tat_qname(dns_name_t *target, dns_name_t *keyname, dns_keynode_t *keynode) {
+	dns_rdataset_t *dsset = NULL;
 	unsigned int i, n = 0;
 	uint16_t ids[12];
 	isc_textregion_t r;
 	char label[64];
 	int m;
 
-	REQUIRE(origin != NULL && *origin == NULL);
+	if ((dsset = dns_keynode_dsset(keynode)) != NULL) {
+		isc_result_t result;
 
-	do {
-		dst_key_t *key = dns_keynode_key(keynode);
-		if (key != NULL) {
-			*origin = dst_key_name(key);
+		for (result = dns_rdataset_first(dsset);
+		     result == ISC_R_SUCCESS;
+		     result = dns_rdataset_next(dsset))
+		{
+			dns_rdata_t rdata = DNS_RDATA_INIT;
+			dns_rdata_ds_t ds;
+
+			dns_rdata_reset(&rdata);
+			dns_rdataset_current(dsset, &rdata);
+			result = dns_rdata_tostruct(&rdata, &ds, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
 			if (n < (sizeof(ids)/sizeof(ids[0]))) {
-				ids[n] = dst_key_id(key);
+				ids[n] = ds.key_tag;
 				n++;
 			}
 		}
-		nextnode = NULL;
-		(void)dns_keytable_nextkeynode(keytable, keynode, &nextnode);
-		if (keynode != firstnode) {
-			dns_keytable_detachkeynode(keytable, &keynode);
-		}
-		keynode = nextnode;
-	} while (keynode != NULL);
+	}
 
 	if (n == 0) {
 		return (DNS_R_EMPTYNAME);
@@ -6758,14 +6841,15 @@ get_tat_qname(dns_name_t *dst, const dns_name_t **origin,
 		isc_textregion_consume(&r, m);
 	}
 
-	return (dns_name_fromstring2(dst, label, *origin, 0, NULL));
+	return (dns_name_fromstring2(target, label, keyname, 0, NULL));
 }
 
 static void
-dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
+dotat(dns_keytable_t *keytable, dns_keynode_t *keynode,
+      dns_name_t *keyname, void *arg)
+{
 	struct dotat_arg *dotat_arg = arg;
 	char namebuf[DNS_NAME_FORMATSIZE];
-	const dns_name_t *origin = NULL;
 	dns_fixedname_t fixed, fdomain;
 	dns_name_t *tatname, *domain;
 	dns_rdataset_t nameservers;
@@ -6782,7 +6866,7 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 	task = dotat_arg->task;
 
 	tatname = dns_fixedname_initname(&fixed);
-	result = get_tat_qname(tatname, &origin, keytable, keynode);
+	result = get_tat_qname(tatname, keyname, keynode);
 	if (result != ISC_R_SUCCESS) {
 		return;
 	}
@@ -6820,17 +6904,13 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {
 	 * order to eventually find the destination host to send the TAT query
 	 * to.
 	 *
-	 * 'origin' holds the domain name at 'keynode', i.e. the domain name
-	 * for which the trust anchors to be reported by this TAT query are
-	 * defined.
-	 *
 	 * After the dns_view_findzonecut() call, 'domain' will hold the
-	 * deepest zone cut we can find for 'origin' while 'nameservers' will
+	 * deepest zone cut we can find for 'keyname' while 'nameservers' will
 	 * hold the NS RRset at that zone cut.
 	 */
 	domain = dns_fixedname_initname(&fdomain);
 	dns_rdataset_init(&nameservers);
-	result = dns_view_findzonecut(view, origin, domain, NULL, 0, 0,
+	result = dns_view_findzonecut(view, keyname, domain, NULL, 0, 0,
 				      true, true, &nameservers, NULL);
 	if (result == ISC_R_SUCCESS) {
 		result = dns_resolver_createfetch(view->resolver, tatname,
@@ -6899,7 +6979,7 @@ tat_timer_tick(isc_task_t *task, isc_event_t *event) {
 static void
 pps_timer_tick(isc_task_t *task, isc_event_t *event) {
 	static unsigned int oldrequests = 0;
-	unsigned int requests = ns_client_requests;
+	unsigned int requests = atomic_load_relaxed(&ns_client_requests);
 
 	UNUSED(task);
 	isc_event_free(&event);
@@ -7261,7 +7341,7 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 		server->session_keyname = isc_mem_get(mctx,
 						      sizeof(dns_name_t));
 		dns_name_init(server->session_keyname, NULL);
-		CHECK(dns_name_dup(keyname, mctx, server->session_keyname));
+		dns_name_dup(keyname, mctx, server->session_keyname);
 
 		server->session_keyfile = isc_mem_strdup(mctx, keyfile);
 
@@ -8196,6 +8276,11 @@ load_configuration(const char *filename, named_server_t *server,
 	isc_socketmgr_setreserved(named_g_socketmgr, reserved);
 
 #if defined(HAVE_GEOIP2)
+	/*
+	 * Release any previously opened GeoIP2 databases.
+	 */
+	named_geoip_unload();
+
 	/*
 	 * Initialize GeoIP databases from the configured location.
 	 * This should happen before configuring any ACLs, so that we
@@ -8329,8 +8414,8 @@ load_configuration(const char *filename, named_server_t *server,
 		advertised = MAX_TCP_TIMEOUT;
 	}
 
-	ns_server_settimeouts(named_g_server->sctx,
-			      initial, idle, keepalive, advertised);
+	isc_nm_tcp_settimeouts(named_g_nm, initial, idle,
+			       keepalive, advertised);
 
 	/*
 	 * Configure sets of UDP query source ports.
@@ -9595,9 +9680,6 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 		dns_tsigkey_detach(&named_g_sessionkey);
 		dns_name_free(&named_g_sessionkeyname, server->mctx);
 	}
-#ifdef HAVE_DNSTAP
-	dns_dt_shutdown();
-#endif
 #if defined(HAVE_GEOIP2)
 	named_geoip_shutdown();
 #endif /* HAVE_GEOIP2 */
@@ -9664,7 +9746,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	named_server_t *server = isc_mem_get(mctx, sizeof(*server));
 
 	if (server == NULL)
-		fatal("allocating server object", ISC_R_NOMEMORY);
+		fatal(server, "allocating server object", ISC_R_NOMEMORY);
 
 	server->mctx = mctx;
 	server->task = NULL;
@@ -9721,7 +9803,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	/*
 	 * GeoIP must be initialized before the interface
 	 * manager (which includes the ACL environment)
-	 * is created
+	 * is created.
 	 */
 	named_geoip_init();
 #endif /* HAVE_GEOIP2 */
@@ -9787,6 +9869,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 				    isc_sockstatscounter_max),
 		   "isc_stats_create");
 	isc_socketmgr_setstats(named_g_socketmgr, server->sockstats);
+	isc_nm_setstats(named_g_nm, server->sockstats);
 
 	CHECKFATAL(isc_stats_create(named_g_mctx, &server->zonestats,
 				    dns_zonestatscounter_max),
@@ -9875,7 +9958,15 @@ named_server_destroy(named_server_t **serverp) {
 }
 
 static void
-fatal(const char *msg, isc_result_t result) {
+fatal(named_server_t *server, const char *msg, isc_result_t result) {
+	if (server != NULL) {
+		/*
+		 * Prevent races between the OpenSSL on_exit registered
+		 * function and any other OpenSSL calls from other tasks
+		 * by requesting exclusive access to the task manager.
+		 */
+		(void)isc_task_beginexclusive(server->task);
+	}
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_CRITICAL,
 		      "%s: %s", msg, isc_result_totext(result));
@@ -10956,17 +11047,20 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 	FILE *fp = NULL;
 	isc_time_t now;
 	char tbuf[64];
+	unsigned int used = isc_buffer_usedlength(*text);
+	bool first = true;
 
 	/* Skip the command name. */
 	ptr = next_token(lex, text);
-	if (ptr == NULL)
+	if (ptr == NULL) {
 		return (ISC_R_UNEXPECTEDEND);
+	}
 
 	/* "-" here means print the output instead of dumping to file */
 	ptr = next_token(lex, text);
-	if (ptr != NULL && strcmp(ptr, "-") == 0)
+	if (ptr != NULL && strcmp(ptr, "-") == 0) {
 		ptr = next_token(lex, text);
-	else {
+	} else {
 		result = isc_stdio_open(server->secrootsfile, "w", &fp);
 		if (result != ISC_R_SUCCESS) {
 			(void) putstr(text, "could not open ");
@@ -10981,66 +11075,85 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 	CHECK(putstr(text, "secure roots as of "));
 	CHECK(putstr(text, tbuf));
 	CHECK(putstr(text, ":\n"));
+	used = isc_buffer_usedlength(*text);
 
 	do {
 		for (view = ISC_LIST_HEAD(server->viewlist);
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link))
 		{
-			if (ptr != NULL && strcmp(view->name, ptr) != 0)
+			if (ptr != NULL && strcmp(view->name, ptr) != 0) {
 				continue;
-			if (secroots != NULL)
+			}
+			if (secroots != NULL) {
 				dns_keytable_detach(&secroots);
+			}
 			result = dns_view_getsecroots(view, &secroots);
 			if (result == ISC_R_NOTFOUND) {
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			CHECK(putstr(text, "\n Start view "));
+			if (first || used != isc_buffer_usedlength(*text)) {
+				CHECK(putstr(text, "\n"));
+				first = false;
+			}
+			CHECK(putstr(text, " Start view "));
 			CHECK(putstr(text, view->name));
 			CHECK(putstr(text, "\n   Secure roots:\n\n"));
+			used = isc_buffer_usedlength(*text);
 			CHECK(dns_keytable_totext(secroots, text));
 
-			if (ntatable != NULL)
+			if (ntatable != NULL) {
 				dns_ntatable_detach(&ntatable);
+			}
 			result = dns_view_getntatable(view, &ntatable);
 			if (result == ISC_R_NOTFOUND) {
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			CHECK(putstr(text, "\n   Negative trust anchors:\n\n"));
+			if (used != isc_buffer_usedlength(*text)) {
+				CHECK(putstr(text, "\n"));
+			}
+			CHECK(putstr(text, "   Negative trust anchors:\n\n"));
+			used = isc_buffer_usedlength(*text);
 			CHECK(dns_ntatable_totext(ntatable, NULL, text));
 		}
-		if (ptr != NULL)
+
+		if (ptr != NULL) {
 			ptr = next_token(lex, text);
+		}
 	} while (ptr != NULL);
 
  cleanup:
-	if (isc_buffer_usedlength(*text) > 0) {
-		if (fp != NULL)
-			(void)putstr(text, "\n");
-		else
-			(void)putnull(text);
-	}
-	if (secroots != NULL)
+	if (secroots != NULL) {
 		dns_keytable_detach(&secroots);
-	if (ntatable != NULL)
+	}
+	if (ntatable != NULL) {
 		dns_ntatable_detach(&ntatable);
+	}
+
 	if (fp != NULL) {
+		if (used != isc_buffer_usedlength(*text)) {
+			(void)putstr(text, "\n");
+		}
 		fprintf(fp, "%.*s", (int) isc_buffer_usedlength(*text),
 			(char *) isc_buffer_base(*text));
 		isc_buffer_clear(*text);
 		(void)isc_stdio_close(fp);
+	} else if (isc_buffer_usedlength(*text) > 0) {
+		(void)putnull(text);
 	}
-	if (result == ISC_R_SUCCESS)
+
+	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "dumpsecroots complete");
-	else
+	} else {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "dumpsecroots failed: %s",
 			      dns_result_totext(result));
+	}
 	return (result);
 }
 
@@ -15264,8 +15377,8 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
-	ns_server_gettimeouts(named_g_server->sctx,
-			      &initial, &idle, &keepalive, &advertised);
+	isc_nm_tcp_gettimeouts(named_g_nm, &initial, &idle,
+			       &keepalive, &advertised);
 
 	/* Look for optional arguments. */
 	ptr = next_token(lex, NULL);
@@ -15304,7 +15417,7 @@ named_server_tcptimeouts(isc_lex_t *lex, isc_buffer_t **text) {
 		result = isc_task_beginexclusive(named_g_server->task);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-		ns_server_settimeouts(named_g_server->sctx, initial, idle,
+		isc_nm_tcp_settimeouts(named_g_nm, initial, idle,
 				      keepalive, advertised);
 
 		isc_task_endexclusive(named_g_server->task);

bin/named/statschannel.c

@@ -324,6 +324,9 @@ init_desc(void) {
 		       "QryUsedStale");
 	SET_NSSTATDESC(prefetch, "queries triggered prefetch", "Prefetch");
 	SET_NSSTATDESC(keytagopt, "Keytag option received", "KeyTagOpt");
+	SET_NSSTATDESC(reclimitdropped,
+		       "queries dropped due to recursive client limit",
+		       "RecLimitDropped");
 
 	INSIST(i == ns_statscounter_max);
 
@@ -3590,10 +3593,6 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 
 	ISC_LIST_INIT(new_listeners);
 
-#ifdef HAVE_LIBXML2
-	xmlInitThreads();
-#endif /* HAVE_LIBXML2 */
-
 	/*
 	 * Get the list of named.conf 'statistics-channels' statements.
 	 */
@@ -3726,10 +3725,6 @@ named_statschannels_shutdown(named_server_t *server) {
 		ISC_LIST_UNLINK(server->statschannels, listener, link);
 		shutdown_listener(listener);
 	}
-
-#ifdef HAVE_LIBXML2
-	xmlCleanupThreads();
-#endif /* HAVE_LIBXML2 */
 }
 
 isc_result_t

bin/named/tkeyconf.c

@@ -85,7 +85,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 		tctx->domain = isc_mem_get(mctx, sizeof(dns_name_t));
 		dns_name_init(tctx->domain, NULL);
-		RETERR(dns_name_dup(name, mctx, tctx->domain));
+		dns_name_dup(name, mctx, tctx->domain);
 	}
 
 	obj = NULL;
@@ -114,4 +114,3 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	dns_tkeyctx_destroy(&tctx);
 	return (result);
 }
-

bin/nsupdate/nsupdate.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -519,5 +519,5 @@ The TSIG key is redundantly stored in two separate files\&. This is a consequenc
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/nsupdate/nsupdate.c

@@ -3210,9 +3210,6 @@ cleanup(void) {
 	ddebug("Shutting down timer manager");
 	isc_timermgr_destroy(&timermgr);
 
-	ddebug("Destroying name state");
-	dns_name_destroy();
-
 	ddebug("Removing log context");
 	isc_log_destroy(&glctx);
 

bin/nsupdate/nsupdate.docbook

@@ -50,6 +50,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/nsupdate/nsupdate.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/pkcs11/pkcs11-destroy.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -93,5 +93,5 @@ Specify how long to pause before carrying out key destruction\&. The default is
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/pkcs11/pkcs11-destroy.c

@@ -124,7 +124,7 @@ main(int argc, char *argv[]) {
 	if (errflg || (id && (label != NULL))) {
 		fprintf(stderr, "Usage:\n");
 		fprintf(stderr, "\tpkcs11-destroy [-m module] [-s slot] "
-				"[-i id | -l label] [-p pin] [-w waittime]\n");
+				"{-i id | -l label} [-p pin] [-w waittime]\n");
 		exit(1);
 	}
 

bin/pkcs11/pkcs11-destroy.docbook

@@ -38,6 +38,7 @@
       <year>2016</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/pkcs11/pkcs11-destroy.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/pkcs11/pkcs11-keygen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -116,5 +116,5 @@ Open the session with the given PKCS#11 slot\&. The default is slot 0\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/pkcs11/pkcs11-keygen.docbook

@@ -39,6 +39,7 @@
       <year>2017</year>
       <year>2018</year>
       <year>2019</year>
+      <year>2020</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>

bin/pkcs11/pkcs11-keygen.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this

bin/pkcs11/pkcs11-list.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -94,5 +94,5 @@ will prompt for it\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
 .br