From c01d63373c0679c03b03b94f8d406ac0f60a945f Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Wed, 6 Feb 2019 15:36:21 +0100
Subject: [PATCH 1/9] Add README to RPZ tests

---
 bin/tests/system/rpz/README | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 bin/tests/system/rpz/README

diff --git a/bin/tests/system/rpz/README b/bin/tests/system/rpz/README
new file mode 100644
index 0000000000..0f647baaf0
--- /dev/null
+++ b/bin/tests/system/rpz/README
@@ -0,0 +1,30 @@
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
+
+The test setup for the RPZ tests prepares a query perf tool and sets up
+policy zones.
+
+
+Name servers
+------------
+
+ns1 is the root server.
+
+ns2 and ns4 are authoritative servers for the various test domains.
+
+ns3 is the main rewriting resolver.
+
+ns5 and ns7 are additional rewriting resolvers.
+
+ns6 is a forwarding server.
+
+
+Updating the response policy zones
+----------------------------------
+
+test1, test2, test3, test4, test5, and test6 are dynamic update files.  These
+updates are made against ns3.  The script function "start_group" is called to
+start an new batch of tests that may depend on certain server updates.  The
+function takes an optional file name and if provided the server updates are
+performed before executing the test batch.

From e2def297b6c1e5e964a51ed726870988101f51af Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Wed, 6 Feb 2019 15:40:06 +0100
Subject: [PATCH 2/9] Make RPZ tests more readable

---
 bin/tests/system/rpz/setup.sh |   5 +-
 bin/tests/system/rpz/tests.sh | 265 ++++++++++++++++++----------------
 2 files changed, 144 insertions(+), 126 deletions(-)

diff --git a/bin/tests/system/rpz/setup.sh b/bin/tests/system/rpz/setup.sh
index b873f2aaf9..c9313699c0 100644
--- a/bin/tests/system/rpz/setup.sh
+++ b/bin/tests/system/rpz/setup.sh
@@ -69,7 +69,10 @@ for NM in '' -2 -given -disabled -passthru -no-op -nodata -nxdomain -cname -wild
     sed -e "/SOA/s/blx/bl$NM/g" ns3/base.db >ns3/bl$NM.db
 done
 
-# $1=directory, $2=domain name, $3=input zone file, $4=output file
+# $1=directory
+# $2=domain name
+# $3=input zone file
+# $4=output file
 signzone () {
     KEYNAME=`$KEYGEN -q -a rsasha256 -K $1 $2`
     cat $1/$3 $1/$KEYNAME.key > $1/tmp
diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 40f303e477..5671cde796 100644
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -106,7 +106,8 @@ setret () {
 }
 
 # set $SN to the SOA serial number of a zone
-# $1=domain  $2=DNS server and client IP address
+# $1=domain
+# $2=DNS server and client IP address
 get_sn() {
     SOA=`$DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2"`
     SN=`expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*'`
@@ -125,7 +126,8 @@ get_sn_fast () {
 }
 
 # check that dnsrpzd has loaded its zones
-# $1=domain  $2=DNS server IP address
+# $1=domain
+# $2=DNS server IP address
 FZONES=`sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrpzd.conf`
 dnsrps_loaded() {
     test "$mode" = dnsrps || return
@@ -150,8 +152,10 @@ dnsrps_loaded() {
 }
 
 # check the serial number in an SOA to ensure that a policy zone has
-#	been (re)loaded
-# $1=serial number  $2=domain  $3=DNS server
+#   been (re)loaded
+# $1=serial number
+# $2=domain
+# $3=DNS server
 ck_soa() {
     n=0
     while true; do
@@ -211,7 +215,8 @@ restart () {
     dnsrps_loaded
 }
 
-# $1=server and irrelevant args  $2=error message
+# $1=server and irrelevant args
+# $2=error message
 ckalive () {
     CKALIVE_NS=`expr "$1" : '.*@ns\([1-9]\).*'`
     if test -z "$CKALIVE_NS"; then
@@ -264,7 +269,8 @@ ckstatsrange () {
     eval "${NSDIR}_CNT=$NEW_CNT"
 }
 
-# $1=message  $2=optional test file name
+# $1=message
+# $2=optional test file name
 start_group () {
     ret=0
     t=`expr $t + 1`
@@ -299,7 +305,8 @@ clean_result () {
     fi
 }
 
-# $1=dig args $2=other dig output file
+# $1=dig args
+# $2=other dig output file
 ckresult () {
     #ckalive "$1" "server crashed by 'dig $1'" || return 1
     if grep "flags:.* aa .*ad;" $DIGNM; then
@@ -322,7 +329,8 @@ ckresult () {
 }
 
 # check only that the server does not crash
-# $1=target domain  $2=optional query type
+# $1=target domain
+# $2=optional query type
 nocrash () {
     digcmd $* >/dev/null
     ckalive "$*" "server crashed by 'dig $*'"
@@ -330,7 +338,8 @@ nocrash () {
 
 
 # check rewrite to NXDOMAIN
-# $1=target domain  $2=optional query type
+# $1=target domain
+# $2=optional query type
 nxdomain () {
     make_dignm
     digcmd $*								\
@@ -341,7 +350,8 @@ nxdomain () {
 }
 
 # check rewrite to NODATA
-# $1=target domain  $2=optional query type
+# $1=target domain
+# $2=optional query type
 nodata () {
     make_dignm
     digcmd $*								\
@@ -351,7 +361,9 @@ nodata () {
 
 # check rewrite to an address
 #   modify the output so that it is easily compared, but save the original line
-# $1=IPv4 address  $2=digcmd args  $3=optional TTL
+# $1=IPv4 address
+# $2=digcmd args
+# $3=optional TTL
 addr () {
     ADDR=$1
     make_dignm
@@ -373,7 +385,8 @@ addr () {
 # Check that a response is not rewritten
 #   Use $ns1 instead of the authority for most test domains, $ns2 to prevent
 #   spurious differences for `dig +norecurse`
-# $1=optional "TCP"  remaining args for dig
+# $1=optional "TCP"
+# remaining args for dig
 nochange () {
     make_dignm
     digcmd $* >$DIGNM
@@ -455,102 +468,104 @@ for mode in native dnsrps; do
   digcmd txt-only.tld2 @$ns2 >proto.nodata
 
   start_group "QNAME rewrites" test1
-  nochange .				# 1 do not crash or rewrite root
-  nxdomain a0-1.tld2			# 2
-  nodata a3-1.tld2			# 3
-  nodata a3-2.tld2			# 4 nodata at DNAME itself
-  nochange sub.a3-2.tld2		# 5 miss where DNAME might work
-  nxdomain a4-2.tld2			# 6 rewrite based on CNAME target
-  nxdomain a4-2-cname.tld2		# 7
-  nodata a4-3-cname.tld2		# 8
-  addr 12.12.12.12  a4-1.sub1.tld2	# 9 A replacement
-  addr 12.12.12.12  a4-1.sub2.tld2	# 10 A replacement with wildcard
-  addr 12.12.12.12  nxc1.sub1.tld2	# 11 replace NXDOMAIN with CNAME
-  addr 12.12.12.12  nxc2.sub1.tld2	# 12 replace NXDOMAIN with CNAME chain
-  addr 127.4.4.1	  a4-4.tld2	# 13 prefer 1st conflicting QNAME zone
-  nochange a6-1.tld2			# 14
-  addr 127.6.2.1	  a6-2.tld2	# 15
-  addr 56.56.56.56  a3-6.tld2		# 16 wildcard CNAME
-  addr 57.57.57.57  a3-7.sub1.tld2	# 17 wildcard CNAME
-  addr 127.0.0.16	  a4-5-cname3.tld2	# 18 CNAME chain
-  addr 127.0.0.17	  a4-6-cname3.tld2	# 19 stop short in CNAME chain
-  nochange a5-2.tld2	    +norecurse	# 20 check that RD=1 is required
-  nochange a5-3.tld2	    +norecurse	# 21
-  nochange a5-4.tld2	    +norecurse	# 22
-  nochange sub.a5-4.tld2	    +norecurse	# 23
-  nxdomain c1.crash2.tld3		# 24 assert in rbtdb.c
-  nxdomain a0-1.tld2	    +dnssec	# 25 simple DO=1 without signatures
-  nxdomain a0-1.tld2s	    +nodnssec	# 26 simple DO=0 with signatures
-  nochange a0-1.tld2s	    +dnssec	# 27 simple DO=1 with signatures
-  nxdomain a0-1s-cname.tld2s  +dnssec	# 28 DNSSEC too early in CNAME chain
-  nochange a0-1-scname.tld2   +dnssec	# 29 DNSSEC on target in CNAME chain
-  nochange a0-1.tld2s srv +auth +dnssec	# 30 no write for DNSSEC and no record
-  nxdomain a0-1.tld2s srv	    +nodnssec	# 31
-  drop a3-8.tld2 any			# 32 drop
-  nochange tcp a3-9.tld2		# 33 tcp-only
-  here x.servfail <<'EOF'		# 34 qname-wait-recurse yes
+  nochange .					# 1 do not crash or rewrite root
+  nxdomain a0-1.tld2				# 2
+  nodata a3-1.tld2				# 3
+  nodata a3-2.tld2				# 4 nodata at DNAME itself
+  nochange sub.a3-2.tld2			# 5 miss where DNAME might work
+  nxdomain a4-2.tld2				# 6 rewrite based on CNAME target
+  nxdomain a4-2-cname.tld2			# 7
+  nodata a4-3-cname.tld2			# 8
+  addr 12.12.12.12  a4-1.sub1.tld2		# 9 A replacement
+  addr 12.12.12.12  a4-1.sub2.tld2		# 10 A replacement with wildcard
+  addr 12.12.12.12  nxc1.sub1.tld2		# 11 replace NXDOMAIN with CNAME
+  addr 12.12.12.12  nxc2.sub1.tld2		# 12 replace NXDOMAIN with CNAME chain
+  addr 127.4.4.1    a4-4.tld2			# 13 prefer 1st conflicting QNAME zone
+  nochange a6-1.tld2				# 14
+  addr 127.6.2.1    a6-2.tld2			# 15
+  addr 56.56.56.56  a3-6.tld2			# 16 wildcard CNAME
+  addr 57.57.57.57  a3-7.sub1.tld2		# 17 wildcard CNAME
+  addr 127.0.0.16   a4-5-cname3.tld2		# 18 CNAME chain
+  addr 127.0.0.17   a4-6-cname3.tld2		# 19 stop short in CNAME chain
+  nochange a5-2.tld2 +norecurse			# 20 check that RD=1 is required
+  nochange a5-3.tld2 +norecurse			# 21
+  nochange a5-4.tld2 +norecurse			# 22
+  nochange sub.a5-4.tld2 +norecurse		# 23
+  nxdomain c1.crash2.tld3			# 24 assert in rbtdb.c
+  nxdomain a0-1.tld2  +dnssec			# 25 simple DO=1 without signatures
+  nxdomain a0-1.tld2s +nodnssec			# 26 simple DO=0 with signatures
+  nochange a0-1.tld2s +dnssec			# 27 simple DO=1 with signatures
+  nxdomain a0-1s-cname.tld2s +dnssec		# 28 DNSSEC too early in CNAME chain
+  nochange a0-1-scname.tld2  +dnssec		# 29 DNSSEC on target in CNAME chain
+  nochange a0-1.tld2s srv +auth +dnssec		# 30 no write for DNSSEC and no record
+  nxdomain a0-1.tld2s srv +nodnssec		# 31
+  drop a3-8.tld2 any				# 32 drop
+  nochange tcp a3-9.tld2			# 33 tcp-only
+  here x.servfail <<'EOF'			# 34 qname-wait-recurse yes
     ;; status: SERVFAIL, x
 EOF
-  addr 35.35.35.35 "x.servfail @$ns5"	# 35 qname-wait-recurse no
+  addr 35.35.35.35 "x.servfail @$ns5"		# 35 qname-wait-recurse no
   end_group
   ckstats $ns3 test1 ns3 22
   ckstats $ns5 test1 ns5 1
   ckstats $ns6 test1 ns6 0
 
   start_group "NXDOMAIN/NODATA action on QNAME trigger" test1
-  nxdomain a0-1.tld2 @$ns6		   # 1
-  nodata a3-1.tld2 @$ns6			   # 2
-  nodata a3-2.tld2 @$ns6			   # 3 nodata at DNAME itself
-  nxdomain a4-2.tld2 @$ns6		   # 4 rewrite based on CNAME target
-  nxdomain a4-2-cname.tld2 @$ns6		   # 5
-  nodata a4-3-cname.tld2 @$ns6		   # 6
-  addr 12.12.12.12  "a4-1.sub1.tld2 @$ns6"   # 7 A replacement
-  addr 12.12.12.12  "a4-1.sub2.tld2 @$ns6"   # 8 A replacement with wildcard
-  addr 127.4.4.1    "a4-4.tld2 @$ns6"	   # 9 prefer 1st conflicting QNAME zone
-  addr 12.12.12.12  "nxc1.sub1.tld2 @$ns6"   # 10 replace NXDOMAIN w/ CNAME
-  addr 12.12.12.12  "nxc2.sub1.tld2 @$ns6"   # 11 replace NXDOMAIN w/ CNAME chain
-  addr 127.6.2.1    "a6-2.tld2 @$ns6"	   # 12
-  addr 56.56.56.56  "a3-6.tld2 @$ns6"	   # 13 wildcard CNAME
-  addr 57.57.57.57  "a3-7.sub1.tld2 @$ns6"   # 14 wildcard CNAME
-  addr 127.0.0.16   "a4-5-cname3.tld2 @$ns6" # 15 CNAME chain
-  addr 127.0.0.17   "a4-6-cname3.tld2 @$ns6" # 16 stop short in CNAME chain
-  nxdomain c1.crash2.tld3 @$ns6		   # 17 assert in rbtdb.c
-  nxdomain a0-1.tld2 +dnssec @$ns6	   # 18 simple DO=1 without sigs
-  nxdomain a0-1s-cname.tld2s  +dnssec @$ns6  # 19
-  drop a3-8.tld2 any @$ns6		   # 20 drop
+  nxdomain a0-1.tld2 @$ns6			# 1
+  nodata a3-1.tld2 @$ns6			# 2
+  nodata a3-2.tld2 @$ns6			# 3 nodata at DNAME itself
+  nxdomain a4-2.tld2 @$ns6			# 4 rewrite based on CNAME target
+  nxdomain a4-2-cname.tld2 @$ns6		# 5
+  nodata a4-3-cname.tld2 @$ns6			# 6
+  addr 12.12.12.12  "a4-1.sub1.tld2 @$ns6"	# 7 A replacement
+  addr 12.12.12.12  "a4-1.sub2.tld2 @$ns6"	# 8 A replacement with wildcard
+  addr 127.4.4.1    "a4-4.tld2 @$ns6"		# 9 prefer 1st conflicting QNAME zone
+  addr 12.12.12.12  "nxc1.sub1.tld2 @$ns6"	# 10 replace NXDOMAIN w/ CNAME
+  addr 12.12.12.12  "nxc2.sub1.tld2 @$ns6"	# 11 replace NXDOMAIN w/ CNAME chain
+  addr 127.6.2.1    "a6-2.tld2 @$ns6"		# 12
+  addr 56.56.56.56  "a3-6.tld2 @$ns6"		# 13 wildcard CNAME
+  addr 57.57.57.57  "a3-7.sub1.tld2 @$ns6"	# 14 wildcard CNAME
+  addr 127.0.0.16   "a4-5-cname3.tld2 @$ns6"	# 15 CNAME chain
+  addr 127.0.0.17   "a4-6-cname3.tld2 @$ns6"	# 16 stop short in CNAME chain
+  nxdomain c1.crash2.tld3 @$ns6			# 17 assert in rbtdb.c
+  nxdomain a0-1.tld2 +dnssec @$ns6		# 18 simple DO=1 without sigs
+  nxdomain a0-1s-cname.tld2s  +dnssec @$ns6	# 19
+  drop a3-8.tld2 any @$ns6			# 20 drop
   end_group
   ckstatsrange $ns3 test1 ns3 22 30
   ckstats $ns5 test1 ns5 0
   ckstats $ns6 test1 ns6 0
 
   start_group "IP rewrites" test2
-  nodata a3-1.tld2			# 1 NODATA
-  nochange a3-2.tld2			# 2 no policy record so no change
-  nochange a4-1.tld2			# 3 obsolete PASSTHRU record style
-  nxdomain a4-2.tld2			# 4
-  nochange a4-2.tld2 -taaaa		# 5 no A => no policy rewrite
-  nochange a4-2.tld2 -ttxt		# 6 no A => no policy rewrite
-  nxdomain a4-2.tld2 -tany		# 7 no A => no policy rewrite
-  nodata a4-3.tld2			# 8
-  nxdomain a3-1.tld2 -taaaa		# 9 IPv6 policy
-  nochange a4-1-aaaa.tld2 -taaaa	# 10
-  addr 127.0.0.1	 a5-1-2.tld2	# 11 prefer smallest policy address
-  addr 127.0.0.1	 a5-3.tld2	# 12 prefer first conflicting IP zone
-  nochange a5-4.tld2	    +norecurse	# 13 check that RD=1 is required for #14
-  addr 14.14.14.14 a5-4.tld2		# 14 prefer QNAME to IP
-  nochange a4-4.tld2			# 15 PASSTHRU
-  nxdomain c2.crash2.tld3		# 16 assert in rbtdb.c
-  addr 127.0.0.17 "a4-4.tld2 -b $ns1"	# 17 client-IP address trigger
-  nxdomain a7-1.tld2			# 18 slave policy zone (RT34450)
+  nodata a3-1.tld2				# 1 NODATA
+  nochange a3-2.tld2				# 2 no policy record so no change
+  nochange a4-1.tld2				# 3 obsolete PASSTHRU record style
+  nxdomain a4-2.tld2				# 4
+  nochange a4-2.tld2 -taaaa			# 5 no A => no policy rewrite
+  nochange a4-2.tld2 -ttxt			# 6 no A => no policy rewrite
+  nxdomain a4-2.tld2 -tany			# 7 no A => no policy rewrite
+  nodata a4-3.tld2				# 8
+  nxdomain a3-1.tld2 -taaaa			# 9 IPv6 policy
+  nochange a4-1-aaaa.tld2 -taaaa		# 10
+  addr 127.0.0.1 a5-1-2.tld2			# 11 prefer smallest policy address
+  addr 127.0.0.1 a5-3.tld2			# 12 prefer first conflicting IP zone
+  nochange a5-4.tld2 +norecurse			# 13 check that RD=1 is required for #14
+  addr 14.14.14.14 a5-4.tld2			# 14 prefer QNAME to IP
+  nochange a4-4.tld2				# 15 PASSTHRU
+  nxdomain c2.crash2.tld3			# 16 assert in rbtdb.c
+  addr 127.0.0.17 "a4-4.tld2 -b $ns1"		# 17 client-IP address trigger
+  nxdomain a7-1.tld2				# 18 slave policy zone (RT34450)
+  # updating an response zone policy
   cp ns2/blv2.tld2.db.in ns2/bl.tld2.db
   rndc_reload ns2 $ns2 bl.tld2
   ck_soa 2 bl.tld2 $ns3
-  nochange a7-1.tld2			# 19 PASSTHRU
-  sleep 1	# ensure that a clock tick has occured so that named will do the reload
+  nochange a7-1.tld2				# 19 PASSTHRU
+  # ensure that a clock tick has occured so that named will do the reload
+  sleep 1
   cp ns2/blv3.tld2.db.in ns2/bl.tld2.db
   rndc_reload ns2 $ns2 bl.tld2
   ck_soa 3 bl.tld2 $ns3
-  nxdomain a7-1.tld2			# 20 slave policy zone (RT34450)
+  nxdomain a7-1.tld2				# 20 slave policy zone (RT34450)
   end_group
   ckstats $ns3 test2 ns3 12
 
@@ -572,20 +587,20 @@ EOF
 
   # these tests assume "min-ns-dots 0"
   start_group "NSDNAME rewrites" test3
-  nochange a3-1.tld2			# 1
-  nochange a3-1.tld2	    +dnssec	# 2 this once caused problems
+  nochange a3-1.tld2				# 1
+  nochange a3-1.tld2 +dnssec			# 2 this once caused problems
   nxdomain a3-1.sub1.tld2			# 3 NXDOMAIN *.sub1.tld2 by NSDNAME
-  nxdomain a3-1.subsub.sub1.tld2
-  nxdomain a3-1.subsub.sub1.tld2 -tany
+  nxdomain a3-1.subsub.sub1.tld2		# 4
+  nxdomain a3-1.subsub.sub1.tld2 -tany		# 5
   addr 12.12.12.12 a4-2.subsub.sub2.tld2	# 6 walled garden for *.sub2.tld2
-  nochange a3-2.tld2.			# 7 exempt rewrite by name
-  nochange a0-1.tld2.			# 8 exempt rewrite by address block
-  addr 12.12.12.12 a4-1.tld2		# 9 prefer QNAME policy to NSDNAME
-  addr 127.0.0.1 a3-1.sub3.tld2		# 10 prefer policy for largest NSDNAME
-  addr 127.0.0.2 a3-1.subsub.sub3.tld2
-  nxdomain xxx.crash1.tld2		# 12 dns_db_detachnode() crash
+  nochange a3-2.tld2.				# 7 exempt rewrite by name
+  nochange a0-1.tld2.				# 8 exempt rewrite by address block
+  addr 12.12.12.12 a4-1.tld2			# 9 prefer QNAME policy to NSDNAME
+  addr 127.0.0.1 a3-1.sub3.tld2			# 10 prefer policy for largest NSDNAME
+  addr 127.0.0.2 a3-1.subsub.sub3.tld2		# 11
+  nxdomain xxx.crash1.tld2			# 12 dns_db_detachnode() crash
   if [ "$mode" = dnsrps ]; then
-    addr 12.12.12.12 as-ns.tld5.	# 13 qname-as-ns
+    addr 12.12.12.12 as-ns.tld5.		# 13 qname-as-ns
   fi
   end_group
   if [ "$mode" = dnsrps ]; then
@@ -596,19 +611,19 @@ EOF
 
   # these tests assume "min-ns-dots 0"
   start_group "NSIP rewrites" test4
-  nxdomain a3-1.tld2			# 1 NXDOMAIN for all of tld2
-  nochange a3-2.tld2.			# 2 exempt rewrite by name
-  nochange a0-1.tld2.			# 3 exempt rewrite by address block
-  nochange a3-1.tld4			# 4 different NS IP address
+  nxdomain a3-1.tld2				# 1 NXDOMAIN for all of tld2
+  nochange a3-2.tld2.				# 2 exempt rewrite by name
+  nochange a0-1.tld2.				# 3 exempt rewrite by address block
+  nochange a3-1.tld4				# 4 different NS IP address
   if [ "$mode" = dnsrps ]; then
-      addr 12.12.12.12 as-ns.tld5.	# 5 ip-as-ns
+      addr 12.12.12.12 as-ns.tld5.		# 5 ip-as-ns
   fi
   end_group
 
   start_group "walled garden NSIP rewrites" test4a
-  addr 41.41.41.41 a3-1.tld2		# 1 walled garden for all of tld2
-  addr 2041::41   'a3-1.tld2 AAAA'	# 2 walled garden for all of tld2
-  here a3-1.tld2 TXT <<'EOF'		# 3 text message for all of tld2
+  addr 41.41.41.41 a3-1.tld2			# 1 walled garden for all of tld2
+  addr 2041::41   'a3-1.tld2 AAAA'		# 2 walled garden for all of tld2
+  here a3-1.tld2 TXT <<'EOF'			# 3 text message for all of tld2
     ;; status: NOERROR, x
     a3-1.tld2.	    x	IN	TXT   "NSIP walled garden"
 EOF
@@ -620,30 +635,30 @@ EOF
   fi
 
   # policies in ./test5 overridden by response-policy{} in ns3/named.conf
-  #   and in ns5/named.conf
+  # and in ns5/named.conf
   start_group "policy overrides" test5
-  addr 127.0.0.1 a3-1.tld2		# 1 bl-given
-  nochange a3-2.tld2			# 2 bl-passthru
-  nochange a3-3.tld2			# 3 bl-no-op	obsolete for passthru
-  nochange a3-4.tld2			# 4 bl-disabled
-  nodata a3-5.tld2			# 5 bl-nodata	zone recursive-only no
-  nodata a3-5.tld2    +norecurse		# 6 bl-nodata	zone recursive-only no
-  nodata a3-5.tld2			# 7 bl-nodata		not needed
-  nxdomain a3-5.tld2  +norecurse	@$ns5	# 8 bl-nodata	global recursive-only no
-  nxdomain a3-5.tld2s		@$ns5	# 9 bl-nodata	global break-dnssec
-  nxdomain a3-5.tld2s +dnssec	@$ns5	# 10 bl-nodata	global break-dnssec
-  nxdomain a3-6.tld2			# 11 bl-nxdomain
-  here a3-7.tld2 -tany <<'EOF'
+  addr 127.0.0.1 a3-1.tld2			# 1 bl-given
+  nochange a3-2.tld2				# 2 bl-passthru
+  nochange a3-3.tld2				# 3 bl-no-op (obsolete for passthru)
+  nochange a3-4.tld2				# 4 bl-disabled
+  nodata a3-5.tld2				# 5 bl-nodata zone recursive-only no
+  nodata a3-5.tld2 +norecurse			# 6 bl-nodata zone recursive-only no
+  nodata a3-5.tld2				# 7 bl-nodata not needed
+  nxdomain a3-5.tld2 +norecurse @$ns5		# 8 bl-nodata global recursive-only no
+  nxdomain a3-5.tld2s @$ns5			# 9 bl-nodata global break-dnssec
+  nxdomain a3-5.tld2s +dnssec @$ns5		# 10 bl-nodata global break-dnssec
+  nxdomain a3-6.tld2				# 11 bl-nxdomain
+  here a3-7.tld2 -tany <<'EOF'			# 12
     ;; status: NOERROR, x
     a3-7.tld2.	    x	IN	CNAME   txt-only.tld2.
     txt-only.tld2.  x	IN	TXT     "txt-only-tld2"
 EOF
-  addr 58.58.58.58 a3-8.tld2		# 13 bl_wildcname
+  addr 58.58.58.58 a3-8.tld2			# 13 bl_wildcname
   addr 59.59.59.59 a3-9.sub9.tld2		# 14 bl_wildcname
-  addr 12.12.12.12 a3-15.tld2		# 15 bl-garden	via CNAME to a12.tld2
-  addr 127.0.0.16 a3-16.tld2	    100	# 16 bl		    max-policy-ttl 100
-  addr 17.17.17.17 "a3-17.tld2 @$ns5" 90	# 17 ns5 bl	    max-policy-ttl 90
-  drop a3-18.tld2 any			# 18 bl-drop
+  addr 12.12.12.12 a3-15.tld2			# 15 bl-garden via CNAME to a12.tld2
+  addr 127.0.0.16 a3-16.tld2 100		# 16 bl	max-policy-ttl 100
+  addr 17.17.17.17 "a3-17.tld2 @$ns5" 90	# 17 ns5 bl max-policy-ttl 90
+  drop a3-18.tld2 any				# 18 bl-drop
   nxdomain TCP a3-19.tld2			# 19 bl-tcp-only
   end_group
   ckstats $ns3 test5 ns3 12

From 48d7e4bb407bb09ed17193267937793ec4585446 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Thu, 7 Feb 2019 15:25:28 +0100
Subject: [PATCH 3/9] named crashes on shutdown after load rpz failed

This may happen when loading an RPZ failed and the code path skips
calling dns_db_endload().  The dns_rpz_zone_t object is still kept
marked as having registered db.  So when this object is finally
destroyed in rpz_detach(), this code will incorrectly call
`dns_db_updatenotify_unregister()`:

   if (rpz->db_registered)
     dns_db_updatenotify_unregister(rpz->db,
                                    dns_rpz_dbupdate_callback, rpz);

and trigger this assertion failure:

   REQUIRE(db != NULL);

To fix this, only call `dns_db_updatenotify_unregister()` when
`rpz->db` is not NULL.
---
 lib/dns/rpz.c  | 9 ++++-----
 lib/dns/zone.c | 2 +-
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index e3b2f25698..d7112b01ed 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -1586,7 +1586,6 @@ dns_rpz_dbupdate_callback(dns_db_t *db, void *fn_arg) {
 	LOCK(&zone->rpzs->maint_lock);
 	REQUIRE(zone->db_registered);
 
-
 	/* New zone came as AXFR */
 	if (zone->db != NULL && zone->db != db) {
 		/* We need to clean up the old DB */
@@ -2097,14 +2096,14 @@ rpz_detach(dns_rpz_zone_t **rpzp, dns_rpz_zones_t *rpzs) {
 	if (dns_name_dynamic(&rpz->cname)) {
 		dns_name_free(&rpz->cname, rpzs->mctx);
 	}
-	if (rpz->db_registered) {
-		dns_db_updatenotify_unregister(rpz->db,
-					       dns_rpz_dbupdate_callback, rpz);
-	}
 	if (rpz->dbversion != NULL) {
 		dns_db_closeversion(rpz->db, &rpz->dbversion, false);
 	}
 	if (rpz->db != NULL) {
+		if (rpz->db_registered) {
+			dns_db_updatenotify_unregister(
+				rpz->db, dns_rpz_dbupdate_callback, rpz);
+		}
 		dns_db_detach(&rpz->db);
 	}
 	if (rpz->updaterunning) {
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index f2087658c8..5e6988cfdf 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2120,7 +2120,7 @@ zone_load(dns_zone_t *zone, unsigned int flags, bool locked) {
 		}
 	}
 
-	if (! dns_db_ispersistent(db)) {
+	if (!dns_db_ispersistent(db)) {
 		if (zone->masterfile != NULL) {
 			result = zone_startload(db, zone, loadtime);
 		} else {

From a4cd74e71af9da379ed891b22fb20e002f6876b9 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Fri, 8 Feb 2019 15:28:49 +0100
Subject: [PATCH 4/9] Add curly brackets on if statements

---
 lib/dns/zone.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 5e6988cfdf..457e47b927 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2494,9 +2494,11 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 
 	dns_zone_rpz_enable_db(zone, db);
 	dns_zone_catz_enable_db(zone, db);
+
 	options = get_master_options(zone);
-	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_MANYERRORS))
+	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_MANYERRORS)) {
 		options |= DNS_MASTER_MANYERRORS;
+	}
 
 	if (zone->zmgr != NULL && zone->db != NULL && zone->loadtask != NULL) {
 		load = isc_mem_get(zone->mctx, sizeof(*load));
@@ -2516,8 +2518,9 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 		load->callbacks.rawdata = zone_setrawdata;
 		zone_iattach(zone, &load->callbacks.zone);
 		result = dns_db_beginload(db, &load->callbacks);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			goto cleanup;
+		}
 		result = zonemgr_getio(zone->zmgr, true, zone->loadtask,
 				       zone_gotreadhandle, load,
 				       &zone->readio);
@@ -2528,8 +2531,9 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 			 */
 			(void)dns_db_endload(load->db, &load->callbacks);
 			goto cleanup;
-		} else
+		} else {
 			result = DNS_R_CONTINUE;
+		}
 	} else {
 		dns_rdatacallbacks_t callbacks;
 
@@ -2550,8 +2554,9 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 					     zone->masterformat,
 					     zone->maxttl);
 		tresult = dns_db_endload(db, &callbacks);
-		if (result == ISC_R_SUCCESS)
+		if (result == ISC_R_SUCCESS) {
 			result = tresult;
+		}
 		zone_idetach(&callbacks.zone);
 	}
 

From 6594f7acb2c48819f49e70871df588b7a82ae0a8 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Fri, 8 Feb 2019 16:20:47 +0100
Subject: [PATCH 5/9] Remove rpz->db_registered

As pointed out in !813 db_registered is sort of redundant.  It is
set to `true` only in `dns_zone_rpz_enable_db()` right before the
`dns_rpz_dbupdate_callback()` callback is registered.  It is only
required in that callback and it is the only place that the callback
is registered.  Therefore there is no path that that `REQUIRE` can
fail.

The `db_registered` variable is only set to `false` in
`dns_rpz_new_zone`, so it is not like the variable is unset again
later.

The only other place where `db_registered` is checked is in
`rpz_detach()`.  If `true`, it will call
`dns_db_updatenotify_unregister()`.  However if that happens, the
`db_registered` is not set back to `false` thus this implies that
this may happen multiple times.  If called a second time, most
likely the unregister function will return `ISC_R_NOTFOUND`, but
the return value is not checked anyway.  So it can do without the
`db_registered` check.
---
 lib/dns/include/dns/rpz.h | 5 ++---
 lib/dns/rpz.c             | 8 ++------
 lib/dns/zone.c            | 1 -
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/lib/dns/include/dns/rpz.h b/lib/dns/include/dns/rpz.h
index 0c12da6e9d..e8f5170ca7 100644
--- a/lib/dns/include/dns/rpz.h
+++ b/lib/dns/include/dns/rpz.h
@@ -144,15 +144,14 @@ struct dns_rpz_zone {
 	isc_ht_t	 *nodes;	/* entries in zone */
 	dns_rpz_zones_t	 *rpzs;		/* owner */
 	isc_time_t	 lastupdated;	/* last time the zone was processed */
-	bool	 updatepending;	/* there is an update pending/waiting */
-	bool	 updaterunning;	/* there is an update running */
+	bool	 	 updatepending;	/* there is an update pending/waiting */
+	bool	 	 updaterunning;	/* there is an update running */
 	dns_db_t	 *db;		/* zones database */
 	dns_dbversion_t	 *dbversion;	/* version we will be updating to */
 	dns_db_t	 *updb;		/* zones database we're working on */
 	dns_dbversion_t	 *updbversion;	/* version we're currently working on */
 	dns_dbiterator_t *updbit;	/* iterator to use when updating */
 	isc_ht_t	 *newnodes;	/* entries in zone being updated */
-	bool	 db_registered;	/* is the notify event registered? */
 	isc_timer_t	 *updatetimer;
 	isc_event_t	 updateevent;
 };
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index d7112b01ed..83f8f7d6c5 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -1549,7 +1549,6 @@ dns_rpz_new_zone(dns_rpz_zones_t *rpzs, dns_rpz_zone_t **rpzp) {
 	zone->updbversion = NULL;
 	zone->updbit = NULL;
 	zone->rpzs = rpzs;
-	zone->db_registered = false;
 	ISC_EVENT_INIT(&zone->updateevent, sizeof(zone->updateevent),
 		       0, NULL, 0, NULL, NULL, NULL, NULL, NULL);
 
@@ -1584,7 +1583,6 @@ dns_rpz_dbupdate_callback(dns_db_t *db, void *fn_arg) {
 	REQUIRE(zone != NULL);
 
 	LOCK(&zone->rpzs->maint_lock);
-	REQUIRE(zone->db_registered);
 
 	/* New zone came as AXFR */
 	if (zone->db != NULL && zone->db != db) {
@@ -2100,10 +2098,8 @@ rpz_detach(dns_rpz_zone_t **rpzp, dns_rpz_zones_t *rpzs) {
 		dns_db_closeversion(rpz->db, &rpz->dbversion, false);
 	}
 	if (rpz->db != NULL) {
-		if (rpz->db_registered) {
-			dns_db_updatenotify_unregister(
-				rpz->db, dns_rpz_dbupdate_callback, rpz);
-		}
+		dns_db_updatenotify_unregister(
+			rpz->db, dns_rpz_dbupdate_callback, rpz);
 		dns_db_detach(&rpz->db);
 	}
 	if (rpz->updaterunning) {
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 457e47b927..28f353a2ea 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -1786,7 +1786,6 @@ dns_zone_rpz_enable_db(dns_zone_t *zone, dns_db_t *db) {
 	if (zone->rpz_num == DNS_RPZ_INVALID_NUM)
 		return;
 	REQUIRE(zone->rpzs != NULL);
-	zone->rpzs->zones[zone->rpz_num]->db_registered = true;
 	result = dns_db_updatenotify_register(db,
 					      dns_rpz_dbupdate_callback,
 					      zone->rpzs->zones[zone->rpz_num]);

From d6cb3022a3bef85a71f4100e1975982b6ff11164 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Fri, 8 Feb 2019 17:13:52 +0100
Subject: [PATCH 6/9] Add test for rpz zone load fail

---
 bin/tests/system/rpz/clean.sh                 |  1 +
 bin/tests/system/rpz/ns3/broken.db.in         | 16 ++++++++
 .../system/rpz/ns3/manual-update-rpz-2.db.in  | 20 ++++++++++
 .../system/rpz/ns3/manual-update-rpz.db.in    | 20 ++++++++++
 bin/tests/system/rpz/ns3/named.conf.in        |  7 ++++
 bin/tests/system/rpz/setup.sh                 |  3 +-
 bin/tests/system/rpz/tests.sh                 | 40 +++++++++++++++----
 7 files changed, 99 insertions(+), 8 deletions(-)
 create mode 100644 bin/tests/system/rpz/ns3/broken.db.in
 create mode 100644 bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in
 create mode 100644 bin/tests/system/rpz/ns3/manual-update-rpz.db.in

diff --git a/bin/tests/system/rpz/clean.sh b/bin/tests/system/rpz/clean.sh
index cf38807b6a..e0bdf5a74c 100644
--- a/bin/tests/system/rpz/clean.sh
+++ b/bin/tests/system/rpz/clean.sh
@@ -30,6 +30,7 @@ fi
 rm -f ns*/*.key ns*/*.private
 rm -f ns2/tld2s.db ns2/bl.tld2.db
 rm -f ns3/bl*.db ns*/empty.db
+rm -f ns3/manual-update-rpz.db
 rm -f ns5/example.db ns5/bl.db
 rm -f */policy2.db
 rm -f */*.jnl
diff --git a/bin/tests/system/rpz/ns3/broken.db.in b/bin/tests/system/rpz/ns3/broken.db.in
new file mode 100644
index 0000000000..671ed38a7f
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/broken.db.in
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+; broken zone
+foobar
diff --git a/bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in b/bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in
new file mode 100644
index 0000000000..5c82651802
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+$TTL 300
+@				SOA	bl-reload.  hostmaster.ns.bl-reload. ( 2 3600 1200 604800 60 )
+				NS	ns.tld3.
+
+walled.tld2.bl-reload.	 300	A	10.0.0.2
+
diff --git a/bin/tests/system/rpz/ns3/manual-update-rpz.db.in b/bin/tests/system/rpz/ns3/manual-update-rpz.db.in
new file mode 100644
index 0000000000..81fa1f0754
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/manual-update-rpz.db.in
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+;   This basic file is copied to several zone files before being used.
+;   Its contents are also changed with nsupdate
+
+
+$TTL 300
+@					SOA	manual-update-rpz.  hostmaster.ns.manual-rpz-update. ( 1 3600 1200 604800 60 )
+					NS	ns.tld3.
+
+walled.tld2.manual-update-rpz.	 300	A	10.0.0.1
+
diff --git a/bin/tests/system/rpz/ns3/named.conf.in b/bin/tests/system/rpz/ns3/named.conf.in
index 851a055bc9..bd1a7103c3 100644
--- a/bin/tests/system/rpz/ns3/named.conf.in
+++ b/bin/tests/system/rpz/ns3/named.conf.in
@@ -44,6 +44,7 @@ options {
 	    zone "bl-drop"	policy drop;
 	    zone "bl-tcp-only"	policy tcp-only;
 	    zone "bl.tld2";
+	    zone "manual-update-rpz";
 	}
 	min-ns-dots 0
 	qname-wait-recurse yes
@@ -102,3 +103,9 @@ zone "bl.tld2."		{type slave; file "bl.tld2.db"; masters {10.53.0.2;};
 
 zone "crash1.tld2"	{type master; file "crash1"; notify no;};
 zone "crash2.tld3."	{type master; file "crash2"; notify no;};
+
+zone "manual-update-rpz." {
+	type master;
+	file "manual-update-rpz.db";
+	notify no;
+};
diff --git a/bin/tests/system/rpz/setup.sh b/bin/tests/system/rpz/setup.sh
index c9313699c0..0a6665c1fd 100644
--- a/bin/tests/system/rpz/setup.sh
+++ b/bin/tests/system/rpz/setup.sh
@@ -68,6 +68,8 @@ test -z "`grep 'dnsrps-enable yes' dnsrps.conf`" && TEST_DNSRPS=
 for NM in '' -2 -given -disabled -passthru -no-op -nodata -nxdomain -cname -wildcname -garden -drop -tcp-only; do
     sed -e "/SOA/s/blx/bl$NM/g" ns3/base.db >ns3/bl$NM.db
 done
+#  bl zones are dynamically updated.  Add one zone that is updated manually.
+cp ns3/manual-update-rpz.db.in ns3/manual-update-rpz.db
 
 # $1=directory
 # $2=domain name
@@ -83,7 +85,6 @@ signzone () {
 }
 signzone ns2 tld2s. base-tld2s.db tld2s.db
 
-
 # Performance and a few other checks.
 cat <<EOF >ns5/rpz-switch
 response-policy {
diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 5671cde796..b6ba574360 100644
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -190,6 +190,9 @@ load_db () {
     fi
 }
 
+# restart name server
+# $1 ns number
+# $2 rebuild bl rpz zones if "rebuild-bl-rpz"
 restart () {
     # try to ensure that the server really has stopped
     # and won't mess with ns$1/name.pid
@@ -205,10 +208,12 @@ restart () {
 	fi
     fi
     rm -f ns$1/*.jnl
-    if test -f ns$1/base.db; then
-	for NM in ns$1/bl*.db; do
-	    cp -f ns$1/base.db $NM
-	done
+    if [ "$2" == "rebuild-bl-rpz" ]; then
+        if test -f ns$1/base.db; then
+	    for NM in ns$1/bl*.db; do
+	        cp -f ns$1/base.db $NM
+            done
+        fi
     fi
     $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} rpz ns$1
     load_db
@@ -227,7 +232,7 @@ ckalive () {
     HAVE_CORE=yes
     setret "$2"
     # restart the server to avoid stalling waiting for it to stop
-    restart $CKALIVE_NS
+    restart $CKALIVE_NS "rebuild-bl-rpz"
     return 1
 }
 
@@ -681,7 +686,6 @@ EOF
   end_group
   ckstats $ns3 bugs ns3 8
 
-
   # superficial test for major performance bugs
   QPERF=`sh qperf.sh`
   if test -n "$QPERF"; then
@@ -757,7 +761,7 @@ EOF
   # restart the main test RPZ server to see if that creates a core file
   if test -z "$HAVE_CORE"; then
     $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
-    restart 3
+    restart 3 "rebuild-bl-rpz"
     HAVE_CORE=`find ns* -name '*core*' -print`
     test -z "$HAVE_CORE" || setret "found $HAVE_CORE; memory leak?"
   fi
@@ -772,6 +776,28 @@ EOF
     fi
   done
 
+  # restart the main test RPZ server with a bad zone.
+  t=`expr $t + 1`
+  echo_i "checking that ns3 with broken rpz does not crash (${t})"
+  $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+  cp ns3/broken.db.in ns3/bl.db
+  restart 3 # do not rebuild rpz zones
+  nocrash a3-1.tld2 -tA
+  $PERL $SYSTEMTESTTOP/stop.pl --use-rndc --port ${CONTROLPORT} rpz ns3
+  restart 3 "rebuild-bl-rpz"
+
+  # reload a RPZ zone that is now deliberately broken.
+  t=`expr $t + 1`
+  echo_i "checking rpz failed update will keep previous rpz rules (${t})"
+  $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.before
+  grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.before > /dev/null || setret "failed"
+  cp ns3/broken.db.in ns3/manual-update-rpz.db
+  rndc_reload ns3 $ns3 manual-update-rpz
+  sleep 1
+  # ensure previous RPZ rules still apply.
+  $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.after
+  grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.after > /dev/null || setret "failed"
+
   t=`expr $t + 1`
   echo_i "checking that ttl values are not zeroed when qtype is '*' (${t})"
   $DIG +noall +answer -p ${PORT} @$ns3 any a3-2.tld2 > dig.out.$t

From ae159914b07a49136dec6bf98639633d40edcc6d Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Mon, 11 Feb 2019 10:55:50 +0100
Subject: [PATCH 7/9] Update copyrights

---
 bin/tests/system/rpz/README | 1 -
 util/copyrights             | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/tests/system/rpz/README b/bin/tests/system/rpz/README
index 0f647baaf0..51517b2fc7 100644
--- a/bin/tests/system/rpz/README
+++ b/bin/tests/system/rpz/README
@@ -5,7 +5,6 @@ See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
 The test setup for the RPZ tests prepares a query perf tool and sets up
 policy zones.
 
-
 Name servers
 ------------
 
diff --git a/util/copyrights b/util/copyrights
index b0b2e2eb22..109c3503e5 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -934,6 +934,7 @@
 ./bin/tests/system/rootkeysentinel/ns2/sign.sh	SH	2018,2019
 ./bin/tests/system/rootkeysentinel/setup.sh	SH	2018,2019
 ./bin/tests/system/rootkeysentinel/tests.sh	SH	2018,2019
+./bin/tests/system/rpz/README			TXT.BRIEF	2019
 ./bin/tests/system/rpz/ckdnsrps.sh		SH	2017,2018,2019
 ./bin/tests/system/rpz/clean.sh			SH	2011,2012,2013,2014,2016,2017,2018,2019
 ./bin/tests/system/rpz/dnsrps.c			C	2017,2018,2019

From 05f156e8babb901174d0702a2c8c69122e250edb Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Mon, 11 Feb 2019 17:25:34 +0100
Subject: [PATCH 8/9] Unregister RPZ CATZ db cbs when zone load fails

In case when a zone fails to load because the file does not exist
or is malformed, we should not run the callback that updates the
zone database when the load is done.  This is achieved by
unregistering the callbacks if at zone load end if the result
indicates something else than success.
---
 lib/dns/zone.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 28f353a2ea..8eb4eb764e 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -1792,6 +1792,18 @@ dns_zone_rpz_enable_db(dns_zone_t *zone, dns_db_t *db) {
 	REQUIRE(result == ISC_R_SUCCESS);
 }
 
+static void
+dns_zone_rpz_disable_db(dns_zone_t *zone, dns_db_t *db) {
+	isc_result_t result;
+	if (zone->rpz_num == DNS_RPZ_INVALID_NUM)
+		return;
+	REQUIRE(zone->rpzs != NULL);
+	result = dns_db_updatenotify_unregister(db,
+					        dns_rpz_dbupdate_callback,
+					        zone->rpzs->zones[zone->rpz_num]);
+	REQUIRE(result == ISC_R_SUCCESS);
+}
+
 void
 dns_zone_catz_enable(dns_zone_t *zone, dns_catz_zones_t *catzs) {
 	REQUIRE(DNS_ZONE_VALID(zone));
@@ -1819,6 +1831,17 @@ dns_zone_catz_enable_db(dns_zone_t *zone, dns_db_t *db) {
 	}
 }
 
+static void
+dns_zone_catz_disable_db(dns_zone_t *zone, dns_db_t *db) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(db != NULL);
+
+	if (zone->catzs != NULL) {
+		dns_db_updatenotify_unregister(db, dns_catz_dbupdate_callback,
+					       zone->catzs);
+	}
+}
+
 /*
  * Set catalog zone ownership of the zone
  */
@@ -2486,11 +2509,14 @@ dns_zone_setrawdata(dns_zone_t *zone, dns_masterrawheader_t *header) {
 
 static isc_result_t
 zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
+	const char me[] = "zone_startload";
 	dns_load_t *load;
 	isc_result_t result;
 	isc_result_t tresult;
 	unsigned int options;
 
+	ENTER;
+
 	dns_zone_rpz_enable_db(zone, db);
 	dns_zone_catz_enable_db(zone, db);
 
@@ -15805,6 +15831,15 @@ zone_loaddone(void *arg, isc_result_t result) {
 
 	ENTER;
 
+	/*
+	 * If zone loading failed, remove the update db callbacks prior
+	 * to calling the list of callbacks in the zone load structure.
+	 */
+	if (result != ISC_R_SUCCESS) {
+		dns_zone_rpz_disable_db(zone, load->db);
+		dns_zone_catz_disable_db(zone, load->db);
+	}
+
 	tresult = dns_db_endload(load->db, &load->callbacks);
 	if (tresult != ISC_R_SUCCESS &&
 	    (result == ISC_R_SUCCESS || result == DNS_R_SEENINCLUDE))

From 0f520ac02686f54f8c8320382746bd4d48a61ee4 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Mon, 11 Feb 2019 17:30:04 +0100
Subject: [PATCH 9/9] Update CHANGES

---
 CHANGES        |  9 ++++++++-
 lib/dns/zone.c | 17 +++++++++--------
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index 42c817c08c..0cd2051c12 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,11 @@
-	--- 9.13.7 released ---
+5168.	[bug]		Do not crash on shutdown when RPZ fails to load.  Also,
+			keep previous version of the database if RPZ fails to
+			load. [GL #813]
+
+5167.	[bug]		nxdomain-redirect could sometimes lookup the wrong
+			redirect name. [GL #892]
+
+5166.	[placeholder]
 
 5165.	[contrib]	Removed SDB drivers from contrib; they're obsolete.
 			[GL #428]
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 8eb4eb764e..735928e379 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -1783,8 +1783,9 @@ dns_zone_get_rpz_num(dns_zone_t *zone) {
 void
 dns_zone_rpz_enable_db(dns_zone_t *zone, dns_db_t *db) {
 	isc_result_t result;
-	if (zone->rpz_num == DNS_RPZ_INVALID_NUM)
+	if (zone->rpz_num == DNS_RPZ_INVALID_NUM) {
 		return;
+	}
 	REQUIRE(zone->rpzs != NULL);
 	result = dns_db_updatenotify_register(db,
 					      dns_rpz_dbupdate_callback,
@@ -1794,14 +1795,13 @@ dns_zone_rpz_enable_db(dns_zone_t *zone, dns_db_t *db) {
 
 static void
 dns_zone_rpz_disable_db(dns_zone_t *zone, dns_db_t *db) {
-	isc_result_t result;
-	if (zone->rpz_num == DNS_RPZ_INVALID_NUM)
+	if (zone->rpz_num == DNS_RPZ_INVALID_NUM) {
 		return;
+	}
 	REQUIRE(zone->rpzs != NULL);
-	result = dns_db_updatenotify_unregister(db,
-					        dns_rpz_dbupdate_callback,
-					        zone->rpzs->zones[zone->rpz_num]);
-	REQUIRE(result == ISC_R_SUCCESS);
+	(void) dns_db_updatenotify_unregister(db,
+					      dns_rpz_dbupdate_callback,
+					      zone->rpzs->zones[zone->rpz_num]);
 }
 
 void
@@ -1812,8 +1812,9 @@ dns_zone_catz_enable(dns_zone_t *zone, dns_catz_zones_t *catzs) {
 	LOCK_ZONE(zone);
 	INSIST(zone->catzs == NULL || zone->catzs == catzs);
 	dns_catz_catzs_set_view(catzs, zone->view);
-	if (zone->catzs == NULL)
+	if (zone->catzs == NULL) {
 		dns_catz_catzs_attach(catzs, &zone->catzs);
+	}
 	UNLOCK_ZONE(zone);
 }