2026-06-12 20:10:01 -04:00 · 2018-12-21 04:11:14 -05:00 · 2018-12-21 04:11:14 -05:00 · 94740dc46a
commit 94740dc46a
parent 158e3187a3 c8c74d8b3e
17 changed files with 339 additions and 121 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -4,6 +4,7 @@ variables:
  DOCKER_DRIVER: overlay2
  CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
  CCACHE_DIR: "/ccache"
+  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"

 stages:
  - precheck
@ -81,20 +82,6 @@ stages:
    - docker
    - i386

-.ubuntu-trusty-amd64: &ubuntu_trusty_amd64_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
-
-.ubuntu-trusty-i386: &ubuntu_trusty_i386_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-i386"
-  tags:
-    - linux
-    - docker
-    - i386
-
 .ubuntu-xenial-amd64: &ubuntu_xenial_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-amd64"
  tags:
@ -109,13 +96,27 @@ stages:
    - docker
    - i386

+.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
+  tags:
+    - linux
+    - docker
+    - amd64
+
+.ubuntu-bionic-i386: &ubuntu_bionic_i386_image
+  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-i386"
+  tags:
+    - linux
+    - docker
+    - i386
+
 .build: &build_job
  stage: build
  before_script:
    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
-    - autoreconf -fi
+#    - ./autogen.sh
  script:
-    - ./configure --enable-developer --with-randomdev=/dev/urandom --with-libtool --disable-static --with-cmocka --with-libidn2 --prefix=$HOME/.local --without-make-clean ${EXTRA_CONFIGURE} || cat config.log
+    - ./configure --enable-developer --with-randomdev=/dev/urandom --with-libtool --disable-static --with-cmocka --prefix=$HOME/.local --without-make-clean ${EXTRA_CONFIGURE} || cat config.log
    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
  artifacts:
    paths:
@ -132,9 +133,11 @@ stages:

 .system_test: &system_test_job
  stage: test
+  retry: 2
  before_script:
    - rm -rf .ccache
    - bash -x bin/tests/system/ifconfig.sh up
+    - bash -x util/prepare-softhsm2.sh
  script:
    - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
    - test -s bin/tests/system/systests.output
@ -147,6 +150,7 @@ stages:
  stage: test
  before_script:
    - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
+    - bash -x util/prepare-softhsm2.sh
  script:
    - make unit
  after_script:
@ -159,7 +163,7 @@ stages:
    expire_in: '1 week'
    when: on_failure

-precheck:debian:sid:amd64:
+sid:amd64:precheck:
  <<: *debian_sid_amd64_image
  stage: precheck
  script:
@ -182,11 +186,16 @@ precheck:debian:sid:amd64:
    expire_in: '1 week'
    when: on_failure

-docs:debian:sid:amd64:
+🐞:sid:amd64:precheck:
+  <<: *debian_sid_amd64_image
+  stage: precheck
+  script: util/check-cocci
+
+docs:sid:amd64:
  <<: *debian_sid_amd64_image
  stage: test
  dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build
  script:
    - make -C doc/misc docbook
    - make -C doc/arm Bv9ARM.html
@ -195,7 +204,7 @@ docs:debian:sid:amd64:
    - doc/arm/
    expire_in: '1 month'

-push:docs:
+docs:push:
  <<: *debian_sid_amd64_image
  stage: push
  dependencies: []
@ -205,15 +214,15 @@ push:docs:
    - master@isc-projects/bind9
    - /^v9_.*$/@isc-projects/bind9

-#build:debian:jessie:amd64:
+#jessie:amd64:build:
 #  <<: *debian_jessie_amd64_image
 #  <<: *build_job
 #
-#build:debian:jessie:i386:
+#build:jessie:i386:
 #  <<: *debian_jessie_i386_image
 #  <<: *build_job
 #
-#build:debian:stretch:amd64:
+#build:stretch:amd64:
 #  <<: *debian_stretch_amd64_image
 #  <<: *build_job
 #
@ -221,117 +230,201 @@ push:docs:
 #  <<: *debian_buster_i386_image
 #  <<: *build_job
 #
-#build:ubuntu:trusty:amd64:
-#  <<: *ubuntu_trusty_amd64_image
+#build:ubuntu:bionic:amd64:
+#  <<: *ubuntu_bionic_amd64_image
 #  <<: *build_job
 #
 #build:ubuntu:xenial:i386:
 #  <<: *ubuntu_xenial_i386_image
 #  <<: *build_job

-build:centos:centos6:amd64:
+centos6:amd64:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--disable-warn-error"
+    EXTRA_CONFIGURE: "--with-libidn2 --disable-warn-error"
  <<: *centos_centos6_amd64_image
  <<: *build_job

-build:centos:centos7:amd64:
+centos7:amd64:build:
  variables:
    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g -DDIG_SIGCHASE=1"
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *centos_centos7_amd64_image
  <<: *build_job

-build:debian:sid:amd64:
+clang:stretch:amd64:build:
  variables:
-    EXTRA_CONFIGURE: "--without-eddsa"
+    CC: clang
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+  <<: *debian_stretch_amd64_image
+  <<: *build_job
+
+jessie:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: --without-cmocka
+  <<: *debian_jessie_amd64_image
+  <<: *build_job
+
+stretch:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *debian_stretch_amd64_image
+  <<: *build_job
+
+sid:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_sid_amd64_image
  <<: *build_job

-build:asan:debian:sid:amd64:
+asan:sid:amd64:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
    LDFLAGS: "-fsanitize=address,undefined"
-    EXTRA_CONFIGURE: "--with-libidn2 --with-dlopen=no"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_sid_amd64_image
  <<: *build_job

-build:debian:sid:i386:
+clang:stretch:i386:build:
  variables:
-    EXTRA_CONFIGURE: "--without-eddsa"
+    CC: clang
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+  <<: *debian_stretch_i386_image
+  <<: *build_job
+
+sid:i386:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_sid_i386_image
  <<: *build_job

-unittest:centos:centos6:amd64:
+unit:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:centos:centos6:amd64
+    - centos6:amd64:build

-unittest:centos:centos7:amd64:
+unit:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:centos:centos7:amd64
+    - centos7:amd64:build

-unittest:debian:sid:amd64:
+unit:jessie:amd64:
+  <<: *debian_jessie_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - jessie:amd64:build
+
+unit:stretch:amd64:
+  <<: *debian_stretch_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - stretch:amd64:build
+
+unit:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build

-unittest:asan:debian:sid:amd64:
+unit:asan:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:asan:debian:sid:amd64
+    - asan:sid:amd64:build

-unittest:debian:sid:i386:
+unit:clang:stretch:amd64:
+  <<: *debian_stretch_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - clang:stretch:amd64:build
+
+unit:sid:i386:
  <<: *debian_sid_i386_image
  <<: *unit_test_job
  dependencies:
-    - build:debian:sid:i386
+    - sid:i386:build

-systemtest:centos:centos6:amd64:
+system:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:centos:centos6:amd64
+    - centos6:amd64:build

-systemtest:centos:centos7:amd64:
+system:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:centos:centos7:amd64
+    - centos7:amd64:build

-systemtest:debian:sid:amd64:
+system:jessie:amd64:
+  <<: *debian_jessie_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - jessie:amd64:build
+
+system:stretch:amd64:
+  <<: *debian_stretch_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - stretch:amd64:build
+
+system:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build

-systemtest:asan:debian:sid:amd64:
+system:asan:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
-    - build:asan:debian:sid:amd64
+    - asan:sid:amd64:build

-systemtest:debian:sid:i386:
+system:sid:i386:
  <<: *debian_sid_i386_image
  <<: *system_test_job
  dependencies:
-    - build:debian:sid:i386
+    - sid:i386:build

-install:debian:sid:amd64:
+install:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *install_test_job
  dependencies:
-    - build:debian:sid:amd64
+    - sid:amd64:build

-noassert:build:debian:sid:amd64:
+pkcs11:sid:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--enable-native-pkcs11 --with-pkcs11=/usr/lib/softhsm/libsofthsm2.so"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+pkcs11:unit:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - pkcs11:sid:amd64:build
+
+pkcs11:system:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - pkcs11:sid:amd64:build
+
+noassert:sid:amd64:build:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g -DISC_CHECK_NONE=1"
@ -339,14 +432,53 @@ noassert:build:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *build_job

-noassert:unittest:debian:sid:amd64:
+noassert:unit:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
-    - noassert:build:debian:sid:amd64
+    - noassert:sid:amd64:build

-noassert:systemtest:debian:sid:amd64:
+noassert:system:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
-    - noassert:build:debian:sid:amd64
+    - noassert:sid:amd64:build
+
+xenial:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *ubuntu_xenial_amd64_image
+  <<: *build_job
+
+unit:xenial:amd64:
+  <<: *ubuntu_xenial_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - xenial:amd64:build
+
+system:xenial:amd64:
+  <<: *ubuntu_xenial_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - xenial:amd64:build
+
+bionic:amd64:build:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *ubuntu_bionic_amd64_image
+  <<: *build_job
+
+unit:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - bionic:amd64:build
+
+system:bionic:amd64:
+  <<: *ubuntu_bionic_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - bionic:amd64:build
--- a/bin/pkcs11/pkcs11-keygen.c
+++ b/bin/pkcs11/pkcs11-keygen.c
@ -43,7 +43,7 @@
 * Create a key in the keystore of an HSM
 *
 * The calculation of key tag is left to the script
- * that converts the key into a DNSKEY RR and inserts 
+ * that converts the key into a DNSKEY RR and inserts
 * it into a zone file.
 *
 * usage:
@ -432,10 +432,10 @@ main(int argc, char *argv[]) {

 		break;
 	case key_ecx:
-#ifndef CKM_EDDSA_KEY_PAIR_GEN
+#if !defined(CKM_EDDSA_KEY_PAIR_GEN)
 		fprintf(stderr, "CKM_EDDSA_KEY_PAIR_GEN is not defined\n");
 		usage();
-#endif
+#else
 		op_type = OP_EC;
 		if (bits == 0)
 			bits = 256;
@ -454,16 +454,27 @@ main(int argc, char *argv[]) {
 		id_offset = ECC_ID;

 		if (bits == 256) {
+#if HAVE_PKCS11_ED25519
 			public_template[4].pValue = pk11_ecc_ed25519;
 			public_template[4].ulValueLen =
 				sizeof(pk11_ecc_ed25519);
+#else
+			fprintf(stderr, "Ed25519 is not supported\n");
+			usage();
+#endif
 		} else {
+#if HAVE_PKCS11_ED448
 			public_template[4].pValue = pk11_ecc_ed448;
 			public_template[4].ulValueLen =
 				sizeof(pk11_ecc_ed448);
+#else
+			fprintf(stderr, "Ed449 is not supported\n");
+			usage();
+#endif
 		}

 		break;
+#endif /* !defined(CKM_EDDSA_KEY_PAIR_GEN) */
 	case key_dsa:
 		op_type = OP_DSA;
 		if (bits == 0)
@ -527,7 +538,7 @@ main(int argc, char *argv[]) {
 	case key_unknown:
 		usage();
 	}
-	
+
 	search_template[0].pValue = label;
 	search_template[0].ulValueLen = strlen((char *)label);
 	public_template[0].pValue = label;
@ -584,7 +595,7 @@ main(int argc, char *argv[]) {
 	hSession = pctx.session;

 	/* check if a key with the same id already exists */
-	rv = pkcs_C_FindObjectsInit(hSession, search_template, 1); 
+	rv = pkcs_C_FindObjectsInit(hSession, search_template, 1);
 	if (rv != CKR_OK) {
 		fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8lX\n", rv);
 		error = 1;
@ -714,13 +725,13 @@ main(int argc, char *argv[]) {
 			       public_template, public_attrcnt,
 			       private_template, private_attrcnt,
 			       &publickey, &privatekey);
-	
+
 	if (rv != CKR_OK) {
 		fprintf(stderr, "C_GenerateKeyPair: Error = 0x%.8lX\n", rv);
 		error = 1;
 	 } else if (!quiet)
 		printf("Key pair generation complete.\n");
-	
+
 exit_params:
 	/* Free parameter attributes */
 	if (keyclass == key_dsa || keyclass == key_dh) {
--- a/cocci/.gitignore
+++ b/cocci/.gitignore
@ -0,0 +1 @@
+/*.patch
--- a/cocci/unreachable.spatch
+++ b/cocci/unreachable.spatch
@ -0,0 +1,6 @@
+@@
+@@
+
+    INSIST(0);
+   ISC_UNREACHABLE();
+    ... when != ISC_UNREACHABLE();
--- a/20
+++ b/20
@ -972,7 +972,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@ -1140,7 +1139,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@ -1393,15 +1391,6 @@ do
  | -silent | --silent | --silen | --sile | --sil)
    silent=yes ;;

-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
  -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
    ac_prev=sbindir ;;
  -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@ -1539,7 +1528,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
  eval ac_val=\$$ac_var
  # Remove trailing slashes.
@ -1692,7 +1681,6 @@ Fine tuning of the installation directories:
  --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
  --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
  --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
  --libdir=DIR            object code libraries [EPREFIX/lib]
  --includedir=DIR        C header files [PREFIX/include]
  --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@ -21049,7 +21037,11 @@ int
 main ()
 {

-atomic_int_fast32_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);
+  #if ATOMIC_INT_LOCK_FREE == 2 && ATOMIC_LONG_LOCK_FREE == 2
+  atomic_int_fast32_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);
+  #else
+  #error stdatomic not lock free
+  #endif

  ;
  return 0;
--- a/configure.ac
+++ b/configure.ac
@ -4022,7 +4022,11 @@ AC_TRY_COMPILE([
 #include <stdatomic.h>
 ],
 [
-atomic_int_fast32_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);
+  #if ATOMIC_INT_LOCK_FREE == 2 && ATOMIC_LONG_LOCK_FREE == 2
+  atomic_int_fast32_t val = 0; atomic_fetch_add_explicit(&val, 1, memory_order_relaxed);
+  #else
+  #error stdatomic not lock free
+  #endif
 ],
        [AC_MSG_RESULT(yes)
 	 have_stdatomic=yes
--- a/lib/isc/include/isc/refcount.h
+++ b/lib/isc/include/isc/refcount.h
@ -99,12 +99,17 @@ ISC_LANG_BEGINDECLS
 * Sample implementations
 */
 #ifdef ISC_PLATFORM_USETHREADS
-#if (defined(ISC_PLATFORM_HAVESTDATOMIC) && ATOMIC_INT_LOCK_FREE == 2) || \
-	defined(ISC_PLATFORM_HAVEXADD)
-#define ISC_REFCOUNT_HAVEATOMIC 1
-#if (defined(ISC_PLATFORM_HAVESTDATOMIC) && ATOMIC_INT_LOCK_FREE == 2)
-#define ISC_REFCOUNT_HAVESTDATOMIC 1
-#endif
+
+#if defined(ISC_PLATFORM_HAVESTDATOMIC)
+# define ISC_REFCOUNT_HAVEATOMIC 1
+# define ISC_REFCOUNT_HAVESTDATOMIC 1
+#else /* defined(ISC_PLATFORM_HAVESTDATOMIC) */
+# if defined(ISC_PLATFORM_HAVEXADD)
+#  define ISC_REFCOUNT_HAVEATOMIC 1
+# endif /* defined(ISC_PLATFORM_HAVEXADD */
+#endif /* !defined(ISC_REFCOUNT_HAVEATOMIC) */
+
+#if defined(ISC_REFCOUNT_HAVEATOMIC)

 typedef struct isc_refcount {
 #if defined(ISC_REFCOUNT_HAVESTDATOMIC)
@ -153,7 +158,7 @@ typedef struct isc_refcount {
 			*_tmp = prev - 1;			\
 	} while (0)

-#else /* ISC_REFCOUNT_HAVESTDATOMIC */
+#else /* defined(ISC_REFCOUNT_HAVESTDATOMIC) */

 #define isc_refcount_current(rp)				\
 	((unsigned int)(isc_atomic_xadd(&(rp)->refs, 0)))
@ -188,9 +193,9 @@ typedef struct isc_refcount {
 			*_tmp = prev - 1;			\
 	} while (0)

-#endif /* ISC_REFCOUNT_HAVESTDATOMIC */
+#endif /* defined(ISC_REFCOUNT_HAVESTDATOMIC) */

-#else  /* ISC_PLATFORM_HAVEXADD */
+#else /* defined(ISC_REFCOUNT_HAVEATOMIC) */

 typedef struct isc_refcount {
 	int refs;
@ -257,7 +262,8 @@ typedef struct isc_refcount {
 		ISC_ERROR_RUNTIMECHECK(_result == ISC_R_SUCCESS);	\
 	} while (0)

-#endif /* (defined(ISC_PLATFORM_HAVESTDATOMIC) && ATOMIC_INT_LOCK_FREE == 2) || defined(ISC_PLATFORM_HAVEXADD) */
+#endif /* defined(ISC_REFCOUNT_ATOMIC) */
+
 #else  /* ISC_PLATFORM_USETHREADS */

 typedef struct isc_refcount {
--- a/lib/isc/include/isc/rwlock.h
+++ b/lib/isc/include/isc/rwlock.h
@ -39,13 +39,14 @@ typedef enum {
 } isc_rwlocktype_t;

 #ifdef ISC_PLATFORM_USETHREADS
-#if (defined(ISC_PLATFORM_HAVESTDATOMIC) && ATOMIC_INT_LOCK_FREE == 2) || \
-	(defined(ISC_PLATFORM_HAVEXADD) && defined(ISC_PLATFORM_HAVECMPXCHG))
-#define ISC_RWLOCK_USEATOMIC 1
-#if (defined(ISC_PLATFORM_HAVESTDATOMIC) && ATOMIC_INT_LOCK_FREE == 2)
-#define ISC_RWLOCK_USESTDATOMIC 1
-#endif
-#endif
+# if defined(ISC_PLATFORM_HAVESTDATOMIC)
+#  define ISC_RWLOCK_USEATOMIC 1
+#  define ISC_RWLOCK_USESTDATOMIC 1
+# else /* defined(ISC_PLATFORM_HAVESTDATOMIC) */
+#  if defined(ISC_PLATFORM_HAVEXADD) && defined(ISC_PLATFORM_HAVECMPXCHG)
+#   define ISC_RWLOCK_USEATOMIC 1
+#  endif
+# endif /* defined(ISC_PLATFORM_HAVESTDATOMIC) */

 struct isc_rwlock {
 	/* Unlocked. */
--- a/lib/isc/include/isc/util.h
+++ b/lib/isc/include/isc/util.h
@ -69,7 +69,7 @@
 * Use this in translation units that would otherwise be empty, to
 * suppress compiler warnings.
 */
-#define EMPTY_TRANSLATION_UNIT static void isc__empty(void) { isc__empty(); }
+#define EMPTY_TRANSLATION_UNIT extern int isc__empty;

 /*%
 * We use macros instead of calling the routines directly because
--- a/lib/isc/include/pk11/constants.h
+++ b/lib/isc/include/pk11/constants.h
@ -19,19 +19,25 @@
 * Static arrays of data used for key template initalization
 */
 #ifdef WANT_ECC_CURVES
+#if HAVE_PKCS11_ECDSA
 static CK_BYTE pk11_ecc_prime256v1[] = {
 	0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07
 };
 static CK_BYTE pk11_ecc_secp384r1[] = {
 	0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22
 };
+#endif /* HAVE_PKCS11_ECDSA */
+#if HAVE_PKCS11_ED25519
 static CK_BYTE pk11_ecc_ed25519[] = {
 	0x06, 0x03, 0x2b, 0x65, 0x70
 };
+#endif /* HAVE_PKCS11_ED25519 */
+#if HAVE_PKCS11_ED448
 static CK_BYTE pk11_ecc_ed448[] = {
 	0x06, 0x03, 0x2b, 0x65, 0x71
 };
-#endif
+#endif /* HAVE_PKCS11_ED448 */
+#endif /* WANT_ECC_CURVES */

 #ifdef WANT_DH_PRIMES
 static CK_BYTE pk11_dh_bn2[] = { 2 };
--- a/lib/isc/stats.c
+++ b/lib/isc/stats.c
@ -39,18 +39,19 @@
 #define ISC_STATS_VALID(x)		ISC_MAGIC_VALID(x, ISC_STATS_MAGIC)

 /*%
- * Local macro confirming prescence of 64-bit
+ * Local macro confirming presence of 64-bit
 * increment and store operations, just to make
 * the later macros simpler
 */
-#if (defined(ISC_PLATFORM_HAVESTDATOMIC) && ATOMIC_LONG_LOCK_FREE == 2) || \
-	(defined(ISC_PLATFORM_HAVEXADDQ) && defined(ISC_PLATFORM_HAVEATOMICSTOREQ))
-#define ISC_STATS_HAVEATOMICQ 1
-#if (defined(ISC_PLATFORM_HAVESTDATOMIC) && ATOMIC_LONG_LOCK_FREE == 2)
-#define ISC_STATS_HAVESTDATOMICQ 1
-#endif
-#else
-#define ISC_STATS_HAVEATOMICQ 0
+#if defined(ISC_PLATFORM_HAVESTDATOMIC)
+# define ISC_STATS_HAVEATOMICQ 1
+# define ISC_STATS_HAVESTDATOMICQ 1
+#else /* defined(ISC_PLATFORM_HAVESTDATOMIC) */
+# if defined(ISC_PLATFORM_HAVEXADDQ) && defined(ISC_PLATFORM_HAVEATOMICSTOREQ)
+#  define ISC_STATS_HAVEATOMICQ 1
+# else
+#  define ISC_STATS_HAVEATOMICQ 0
+# endif
 #endif

 /*%
@ -76,16 +77,22 @@
 * Otherwise, just rely on standard 64-bit data types
 * and operations
 */
-#if !ISC_STATS_HAVEATOMICQ && \
-	((defined(ISC_PLATFORM_HAVESTDATOMIC) && ATOMIC_INT_LOCK_FREE == 2) || \
-	 defined(ISC_PLATFORM_HAVEXADD))
-#define ISC_STATS_USEMULTIFIELDS 1
-#if (defined(ISC_PLATFORM_HAVESTDATOMIC) && ATOMIC_INT_LOCK_FREE == 2)
-#define ISC_STATS_HAVESTDATOMIC 1
-#endif
-#else
+#if !ISC_STATS_HAVEATOMICQ
+
+# if defined(ISC_PLATFORM_HAVESTDATOMIC)
+#  define ISC_STATS_USEMULTIFIELDS 1
+#  define ISC_STATS_HAVESTDATOMIC 1
+# else /* defined(ISC_PLATFORM_HAVESTDATOMIC) */
+#  if ISC_PLATFORM_HAVEXADD
+#   define ISC_STATS_USEMULTIFIELDS 1
+#  else
+#   define ISC_STATS_USEMULTIFIELDS 0
+#  endif
+# endif
+
+#else /* !ISC_STATS_HAVEATOMICQ */
 #define ISC_STATS_USEMULTIFIELDS 0
-#endif
+#endif /* !ISC_STATS_HAVEATOMICQ */

 #if ISC_STATS_USEMULTIFIELDS
 typedef struct {
--- a/lib/lwres/getipnode.c
+++ b/lib/lwres/getipnode.c
@ -126,6 +126,7 @@
 #include <lwres/netdb.h>	/* XXX #include <netdb.h> */

 #include "assert_p.h"
+#include "unreachable_p.h"

 #ifndef INADDRSZ
 #define INADDRSZ 4
@ -1023,6 +1024,7 @@ hostfromaddr(lwres_gnbaresponse_t *addr, int af, const void *src) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	/*
@ -1100,6 +1102,7 @@ hostfromname(lwres_gabnresponse_t *name, int af) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	/*
--- a/lib/lwres/getnameinfo.c
+++ b/lib/lwres/getnameinfo.c
@ -117,6 +117,7 @@
 #include "print_p.h"

 #include "assert_p.h"
+#include "unreachable_p.h"

 #define SUCCESS 0

@ -299,6 +300,7 @@ lwres_getnameinfo(const struct sockaddr *sa, size_t salen, char *host,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}

 		n = lwres_context_create(&lwrctx, NULL, NULL, NULL, 0);
--- a/lib/lwres/unreachable_p.h
+++ b/lib/lwres/unreachable_p.h
@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+#ifdef HAVE_BUILTIN_UNREACHABLE
+#define ISC_UNREACHABLE() __builtin_unreachable();
+#else
+#define ISC_UNREACHABLE()
+#endif
--- a/util/check-cocci
+++ b/util/check-cocci
@ -0,0 +1,15 @@
+#!/bin/sh
+
+ret=0
+for spatch in cocci/*.spatch; do
+    patch="$(dirname "$spatch")/$(basename "$spatch" .spatch).patch"
+    spatch --sp-file="$spatch" --use-gitgrep --dir . --very-quiet > "$patch";
+    if [ "$(< "$patch" wc -l)" -gt "0" ]; then
+	cat "$patch"
+	ret=1
+    else
+	rm "$patch"
+    fi
+done
+
+exit $ret
--- a/util/copyrights
+++ b/util/copyrights
@ -2627,6 +2627,7 @@
 ./bin/win32/BINDInstall/resource.h		X	2001,2005,2009,2018
 ./bind.keys					X	2009,2010,2011,2017,2018
 ./bind.keys.h					X	2009,2010,2011,2012,2014,2017,2018
+./cocci/unreachable.spatch			X	2018
 ./config.guess					X	1998,1999,2000,2001,2004,2009,2013,2018
 ./config.h.in					X	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018
 ./config.h.win32				C	1999,2000,2001,2004,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018
@ -4319,6 +4320,7 @@
 ./lib/lwres/unix/include/Makefile.in		MAKE	2001,2004,2007,2012,2016,2018
 ./lib/lwres/unix/include/lwres/Makefile.in	MAKE	2001,2004,2007,2012,2016,2018
 ./lib/lwres/unix/include/lwres/net.h		C	2000,2001,2002,2004,2005,2007,2016,2018
+./lib/lwres/unreachable_p.h			C	2018
 ./lib/lwres/version.c				C	2000,2001,2004,2005,2007,2016,2018
 ./lib/lwres/win32/DLLMain.c			C	2001,2004,2007,2016,2018
 ./lib/lwres/win32/Makefile.in			MAKE	2001,2004,2007,2012,2016,2018
@ -4415,6 +4417,7 @@
 ./util/branchsync.sh				SH	2013,2016,2018
 ./util/check-categories.sh			SH	2015,2016,2017,2018
 ./util/check-changes				PERL	2002,2004,2007,2012,2016,2018
+./util/check-cocci				X	2018
 ./util/check-includes.pl			PERL	2000,2001,2004,2007,2012,2016,2018
 ./util/check-instincludes.sh			SH	2000,2001,2004,2007,2012,2016,2018
 ./util/check-pullups.pl				PERL	2001,2002,2003,2004,2007,2012,2016,2018
@ -4433,6 +4436,7 @@
 ./util/nanny.pl					PERL	2000,2001,2004,2007,2012,2016,2018
 ./util/new-func					PERL	2005,2007,2012,2016,2018
 ./util/nt-kit					SH	1999,2000,2001,2004,2007,2012,2016,2018
+./util/prepare-softhsm2.sh			X	2018
 ./util/spacewhack.pl				PERL	2000,2001,2004,2007,2012,2016,2018
 ./util/tabify-changes				SH	2004,2007,2012,2016,2018
 ./util/update-drafts.pl				PERL	2000,2001,2004,2007,2012,2016,2018
--- a/util/prepare-softhsm2.sh
+++ b/util/prepare-softhsm2.sh
@ -0,0 +1,10 @@
+#!/bin/sh
+if [ -n "${SOFTHSM2_CONF}" ] && command -v softhsm2-util >/dev/null; then
+    SOFTHSM2_DIR=$(dirname "$SOFTHSM2_CONF")
+    mkdir -p "${SOFTHSM2_DIR}/tokens"
+    echo "directories.tokendir = ${SOFTHSM2_DIR}/tokens" > "${SOFTHSM2_CONF}"
+    echo "objectstore.backend = file" >> "${SOFTHSM2_CONF}"
+    echo "log.level = DEBUG" >> "${SOFTHSM2_CONF}"
+    softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm2";
+fi
+exit 0