increment test number (cherry picked from commit e5c2cfdbf9cfc9811a2df481586331cbff693642)

4840. [test] Add tests to cover fallback to using ZSK on inactive KSK. [RT #46787] (cherry picked from commit 32d09cd7e05f53b227f7a68d7f6e8cc5a3f2b1fb)

clarify "stage 1" and "stage 2" in autosign test

set the DNSKEY deletion time to now+5 once we got all the zones into their initial state (cherry picked from commit ecafa2ae506b8cae3660de29d66c10af656174c5)

4839. [bug] zone.c:zone_sign was not properly determining if there were active KSK and ZSK keys for a algorithm when update-check-ksk is true (default) leaving records unsigned with one or more DNSKEY algorithms. [RT #46774] (cherry picked from commit 00f5ea91cf6d3897f24efb2ba097bda1df24082f)

[v9_11] fix test descriptions

update copyright notice / whitespace

4838. [bug] zone.c:add_sigs was not properly determining if there were active KSK and ZSK keys for a algorithm when update-check-ksk is true (default) leaving records unsigned with one or more DNSKEY algorithms. [RT #46754] (cherry picked from commit 6fa2a0691e1d701b361611069ab97471b8cd29bd)

[v9_11] store "addzone" zone config in a NZD database 4421. [func] When built with LMDB (Lightning Memory-mapped Database), named will now use a database to store the configuration for zones added by "rndc addzone" instead of using a flat NZF file. This improves performance of "rndc delzone" and "rndc modzone" significantly. Existing NZF files will automatically by converted to NZD databases. To view the contents of an NZD or to roll back to NZF format, use "named-nzd2nzf". To disable this feature, use "configure --without-lmdb". [RT #39837]

4401. [misc] Change LICENSE to MPL 2.0.

do not overflow exit status. [RT #42643]

update copyright notice / whitespace

4301. [bug] dnssec-settime -p [DP]sync was not working. [RT #41534]

update copyright notice / whitespace

4252. [func] Add support for automating the generation CDS and CDNSKEY rrsets to named and dnssec-signzone. [RT #40424]

use $PERL

[35063] Don't publish an activated key automatically before its publish time

update copyright notice

[master] testcrypto.sh in system tests 3714. [test] System tests that need to test for cryptography support before running can now use a common "testcrypto.sh" script to do so. [RT #35213]

update copyright notice

3635. [bug] Signatures were not being removed from a zone with only KSK keys for a algorithm. [RT #24439]

loop 'I:checking expired signatures were updated' test

reverse bad copyright update

update copyright notice

merging fast format zone files Conflicts: .gitignore bin/named/zoneconf.c bin/tests/.gitignore bin/tests/system/autosign/tests.sh bin/tests/system/masterformat/clean.sh bin/tests/system/masterformat/ns1/compile.sh bin/tests/system/masterformat/tests.sh configure lib/dns/db.c lib/dns/include/dns/db.h lib/dns/include/dns/types.h lib/dns/master.c lib/dns/masterdump.c lib/dns/rbt.c lib/dns/rbtdb.c lib/dns/sdb.c lib/dns/sdlz.c lib/dns/tests/.cvsignore lib/dns/tests/Makefile.in lib/dns/win32/libdns.def lib/dns/xfrin.c lib/dns/zone.c lib/export/dns/Makefile.in lib/isc/include/isc/file.h lib/isc/unix/file.c lib/isc/win32/file.c lib/isccfg/namedconf.c

fix key name variable in autosign

fixed a test error that caused autosign to fail on freebsd

3277. [bug] Make sure automatic key maintenance is started when "auto-dnssec maintain" is turned on during "rndc reconfig". [RT #26805]

update copyright notice

portable code, ok'd bu Evan

forcing full sign with unreadable keys

+/- 500ms was too small a fudge factor (-582ms seen in testing), raise to +/- 1000ms

join line for old awk

chech that the final time is within 10 seconds but no greater than the expected interval

make grep more precise

3185. [func] New 'rndc signing' option for auto-dnssec zones: - 'rndc signing -list' displays the current state of signing operations - 'rndc signing -clear' clears the signing state records for keys that have fully signed the zone - 'rndc signing -nsec3param' sets the NSEC3 parameters for the zone The 'rndc keydone' syntax is removed. [RT #23729]

3174. [bug] Always compute to revoked key tag from scratch. [RT #24711]

3173. [port] Correctly validate root DS responses. [RT #25726]

remove check for oldid as named may have already deleted it

id was not being properly set

3133. [bug] Change #3114 was incomplete. [RT #24577]

3128. [func] Inserting an NSEC3PARAM via dynamic update in an auto-dnssec zone that has not been signed yet will cause it to be signed with the specified NSEC3 parameters when keys are activated. The NSEC3PARAM record will not appear in the zone until it is signed, but the parameters will be stored. [RT #23684]

3127. [bug] 'rndc thaw' will now remove a zone's journal file if the zone serial number has been changed and ixfr-from-differences is not in use. [RT #24687]

date +%s is not portable, use perl -e 'print time();', Adjust messages

The old active key could be deleted before the "former standby key has now signed fully" ran causing it to fail. Delay the deletion by 10 seconds.

3118. [bug] When rolling to a new DNSSEC key, a private-type record could be created and never marked complete. [RT #23253]

treat asb(x) < 500ms as 0

force numeric comparision

handle end of day

fix expression

awk -v is not portable, add floating point arithmetic effects

3102. [func] New 'dnssec-loadkeys-interval' option configures how often, in minutes, to check the key repository for updates when using automatic key maintenance. Default is every 60 minutes (formerly hard-coded to 12 hours). [RT #23744] 3101. [bug] Zones using automatic key maintenance could fail to check the key repository for updates. [RT #23744]

3092. [bug] Signatures for records at the zone apex could go stale due to an incorrect timer setting. [RT #23769] 3091. [bug] Fixed a bug in which zone keys that were published and then subsequently activated could fail to trigger automatic signing. [RT #22991]

use "rndc sync" instead of freeze/thaw cycle to dump zones, now that it's available.

3076. [func] New '-L' option in dnssec-keygen, dnsset-settime, and dnssec-keyfromlabel sets the default TTL of the key. When possible, automatic signing will use that TTL when the key is published. [RT #23304]

Fixed last autosign test report [RT #23256]

3045. [removed] Replaced by change #3050.

3050. [bug] The autosign system test was timing dependent. Wait for the initial autosigning to complete before running the rest of the test. [RT #23035]

update copyright notice

ove the testsock.pl sleep to autosign test suite [RT #23400]

2985. [bug] Add a regression test for change #2896. [RT #21324]

2943. [func] Add support to load new keys into managed zones without signing immediately with "rndc loadkeys". Add support to link keys with "dnssec-keygen -S" and "dnssec-settime -S". [RT #21351]

2914. [bug] Make the "autosign" system test more portable. [RT #20997]

2902. [func] Add regression test for change 2897. [RT #21040]

2892. [bug] Handle REVOKED keys better. [RT #20961]

update copyright notice

2841. [func] Added "smartsign" and improved "autosign" and "dnssec" regression tests. [RT #20865]

change all keys from rsasha1 to nsec3rsasha1 so that the nsec->nsec3 transitions work correctly. (they worked before, but weren't supposed to; when that bug was fixed, the test broke.)

fixed autosign/metadata brokenness on solaris [rt20685]

update copyright notice

Create automatic tests "autosign" and "metadata". [rt19946]