From a70fc47e9dc165175e77f091076559748858a488 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Wed, 28 Oct 2015 09:45:46 +1100
Subject: [PATCH 01/39] 4243.   [func]          Improved stats reporting from
 Timothe Litt. [RT #38941]

---
 CHANGES                              |   2 +
 bin/named/bind9.xsl                  | 972 +++++++++++++--------------
 bin/named/bind9.xsl.h                |   6 +
 bin/named/server.c                   |   1 +
 bin/named/statschannel.c             |  65 +-
 bin/tests/system/statistics/tests.sh |  12 +
 lib/dns/include/dns/zone.h           |   3 +-
 7 files changed, 568 insertions(+), 493 deletions(-)

diff --git a/CHANGES b/CHANGES
index 7a28800429..d85e874257 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4243.	[func]		Improved stats reporting from Timothe Litt. [RT #38941]
+
 4242.	[bug]		Replace the client if not already replaced when
 			prefetching. [RT #41001]
 
diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
index 5b1ffe8655..b516a2930c 100644
--- a/bin/named/bind9.xsl
+++ b/bin/named/bind9.xsl
@@ -14,7 +14,6 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
   <xsl:output method="html" indent="yes" version="4.0"/>
   <xsl:template match="statistics[@version=&quot;3.6&quot;]">
@@ -25,58 +24,58 @@
           <script type="text/javascript" src="https://www.google.com/jsapi"/>
           <script type="text/javascript">
 
-            google.load("visualization", "1", {packages:["corechart"]});
-            google.setOnLoadCallback(loadGraphs);
+	    google.load("visualization", "1", {packages:["corechart"]});
+	    google.setOnLoadCallback(loadGraphs);
 
-            var graphs=[];
+	    var graphs=[];
 
-            function drawChart(chart_title,target,style,data) {
-              var data = google.visualization.arrayToDataTable(data);
+	    function drawChart(chart_title,target,style,data) {
+	      var data = google.visualization.arrayToDataTable(data);
 
-              var options = {
-                title: chart_title
-              };
+	      var options = {
+		title: chart_title
+	      };
 
-              var chart;
-              if (style == "barchart") {
-                chart = new google.visualization.BarChart(document.getElementById(target));
-                chart.draw(data, options);
-              } else if (style == "piechart") {
-                chart = new google.visualization.PieChart(document.getElementById(target));
-                chart.draw(data, options);
-              }
-            }
+	      var chart;
+	      if (style == "barchart") {
+		chart = new google.visualization.BarChart(document.getElementById(target));
+		chart.draw(data, options);
+	      } else if (style == "piechart") {
+		chart = new google.visualization.PieChart(document.getElementById(target));
+		chart.draw(data, options);
+	      }
+	    }
 
-            function loadGraphs(){
-              var g;
+	    function loadGraphs(){
+	      var g;
 
-              while(g = graphs.shift()){
-                // alert("going for: " + g.target);
-                if(g.data.length > 1){
-                  drawChart(g.title,g.target,g.style,g.data);
-                }
-              }
-            }
+	      while(g = graphs.shift()){
+		// alert("going for: " + g.target);
+		if(g.data.length > 1){
+		  drawChart(g.title,g.target,g.style,g.data);
+		}
+	      }
+	    }
 
-            <xsl:if test="server/counters[@type=&quot;qtype&quot;]/counter">
-              // Server Incoming Query Types
-              graphs.push({
-                           'title' : "Server Incoming Query Types",
-                           'target': 'chart_incoming_qtypes',
-                           'style': 'barchart',
-                           'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type=&quot;qtype&quot;]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
-                           });
-            </xsl:if>
+	    <xsl:if test="server/counters[@type=&quot;qtype&quot;]/counter">
+	      // Server Incoming Query Types
+	      graphs.push({
+			   'title' : "Server Incoming Query Types",
+			   'target': 'chart_incoming_qtypes',
+			   'style': 'barchart',
+			   'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type=&quot;qtype&quot;]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
+			   });
+	    </xsl:if>
 
-            <xsl:if test="server/counters[@type=&quot;opcode&quot;]/counter">
-              // Server Incoming Requests by opcode
-              graphs.push({
-                           'title' : "Server Incoming Requests by DNS Opcode",
-                           'target': 'chart_incoming_opcodes',
-                           'style': 'barchart',
-                           'data': [['Opcode','Counter'],<xsl:for-each select="server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0 or substring(@name,1,3) != 'RES']">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]});
-            </xsl:if>
-          </script>
+	    <xsl:if test="server/counters[@type=&quot;opcode&quot;]/counter">
+	      // Server Incoming Requests by opcode
+	      graphs.push({
+			   'title' : "Server Incoming Requests by DNS Opcode",
+			   'target': 'chart_incoming_opcodes',
+			   'style': 'barchart',
+			   'data': [['Opcode','Counter'],<xsl:for-each select="server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0 or substring(@name,1,3) != 'RES']">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]});
+	    </xsl:if>
+	  </script>
         </xsl:if>
         <style type="text/css">
      body {
@@ -250,8 +249,8 @@
        text-align:center;
      }
      h4 {
-        color:  rgb(1,169,206);
-        font-size: 10pt;
+	color:  rgb(1,169,206);
+	font-size: 10pt;
        width:500px;
        text-align:center;
      }
@@ -268,7 +267,7 @@
         <div class="header">
           <h1>ISC Bind 9 Configuration and Statistics</h1>
         </div>
-	<p>Alternate statistics views: <a href="/">All</a>,
+        <p>Alternate statistics views: <a href="/">All</a>,
 	<a href="/xml/v3/status">Status</a>,
 	<a href="/xml/v3/server">Server</a>,
 	<a href="/xml/v3/zones">Zones</a>,
@@ -297,6 +296,12 @@
               <xsl:value-of select="server/current-time"/>
             </td>
           </tr>
+          <tr>
+            <th>Server version:</th>
+            <td>
+              <xsl:value-of select="server/version"/>
+            </td>
+          </tr>
         </table>
         <br/>
         <xsl:if test="server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0]">
@@ -304,8 +309,8 @@
             <h2>Incoming Requests by DNS Opcode</h2>
             <!-- Non Mozilla specific markup -->
             <div class="pie" id="chart_incoming_opcodes">
-              [cannot display chart]
-            </div>
+	      [cannot display chart]
+	    </div>
           </xsl:if>
           <table class="counters">
             <xsl:for-each select="server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0 or substring(@name,1,3) != 'RES']">
@@ -333,8 +338,8 @@
             <!-- Non Mozilla specific markup -->
             <h3>Incoming Queries by Query Type</h3>
             <div class="pie" id="chart_incoming_qtypes">
-              [cannot display chart]
-            </div>
+	      [cannot display chart]
+	    </div>
           </xsl:if>
           <table class="counters">
             <xsl:for-each select="server/counters[@type=&quot;qtype&quot;]/counter">
@@ -369,17 +374,17 @@
             <h3>View <xsl:value-of select="@name"/></h3>
             <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
               <!-- Non Mozilla specific markup -->
-            <script type="text/javascript">
-                  graphs.push({
-                                'title': "Outgoing Queries for view: <xsl:value-of select="@name"/>",
-                                'target': 'chart_outgoing_queries_view_<xsl:value-of select="@name"/>',
-                                'style': 'barchart',
-                                'data': [['Type','Counter'],<xsl:for-each select="counters[@type=&quot;resqtype&quot;]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
-                                });
-              </script>
-            <xsl:variable name="target">
-              <xsl:value-of select="@name"/>
-            </xsl:variable>
+              <script type="text/javascript">
+		  graphs.push({
+				'title': "Outgoing Queries for view: <xsl:value-of select="@name"/>",
+				'target': 'chart_outgoing_queries_view_<xsl:value-of select="@name"/>',
+				'style': 'barchart',
+				'data': [['Type','Counter'],<xsl:for-each select="counters[@type=&quot;resqtype&quot;]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
+				});
+	      </script>
+              <xsl:variable name="target">
+                <xsl:value-of select="@name"/>
+              </xsl:variable>
               <div class="pie" id="chart_outgoing_queries_view_{$target}">[no data to display]</div>
             </xsl:if>
             <table class="counters">
@@ -408,14 +413,14 @@
           <h2>Server Statistics</h2>
           <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
             <!-- Non Mozilla specific markup -->
-          <script type="text/javascript">
-                  graphs.push({
-                                'title' : "Server Counters",
-                                'target': 'chart_server_nsstat_restype',
-                                'style': 'barchart',
-                                'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type=&quot;nsstat&quot;]/counter[.&gt;0]">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
-                                });
-              </script>
+            <script type="text/javascript">
+		  graphs.push({
+				'title' : "Server Counters",
+				'target': 'chart_server_nsstat_restype',
+				'style': 'barchart',
+				'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type=&quot;nsstat&quot;]/counter[.&gt;0]">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
+				});
+	      </script>
             <div class="pie" id="chart_server_nsstat_restype">[no data to display]</div>
           </xsl:if>
           <table class="counters">
@@ -443,13 +448,13 @@
           <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
             <h2>Zone Maintenance Statistics</h2>
             <script type="text/javascript">
-                  graphs.push({
-                                'title' : "Zone Maintenance Stats",
-                                'target': 'chart_server_zone_maint',
-                                'style': 'barchart',
-                                'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type=&quot;zonestat&quot;]/counter[.&gt;0]">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
-                                });
-            </script>
+		  graphs.push({
+				'title' : "Zone Maintenance Stats",
+				'target': 'chart_server_zone_maint',
+				'style': 'barchart',
+				'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type=&quot;zonestat&quot;]/counter[.&gt;0]">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
+				});
+	    </script>
             <!-- Non Mozilla specific markup -->
             <div class="pie" id="chart_server_zone_maint">[no data to display]</div>
           </xsl:if>
@@ -543,7 +548,6 @@
             </table>
           </xsl:if>
         </xsl:for-each>
-
         <xsl:for-each select="views/view">
           <xsl:if test="counters[@type=&quot;cachestats&quot;]/counter[.&gt;0]">
             <h3>Cache Statistics for View <xsl:value-of select="@name"/></h3>
@@ -568,7 +572,6 @@
             </table>
           </xsl:if>
         </xsl:for-each>
-
         <xsl:for-each select="views/view">
           <xsl:if test="cache/rrset">
             <h3>Cache DB RRsets for View <xsl:value-of select="@name"/></h3>
@@ -593,137 +596,132 @@
             <br/>
           </xsl:if>
         </xsl:for-each>
-
         <xsl:if test="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
           <h2>Traffic Size Statistics</h2>
         </xsl:if>
-	<xsl:if test="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
-	  <h4>UDP Requests Received</h4>
-	  <table class="counters">
-	    <xsl:for-each select="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
-	      <xsl:variable name="css-class7">
-		<xsl:choose>
-		  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-		  <xsl:otherwise>odd</xsl:otherwise>
-		</xsl:choose>
-	      </xsl:variable>
-	      <tr class="{$css-class7}">
-		<th>
-		  <xsl:value-of select="@name"/>
-		</th>
-		<td>
-		  <xsl:value-of select="."/>
-		</td>
-	      </tr>
-	    </xsl:for-each>
-	  </table>
-	  <br/>
-	</xsl:if>
-
-	<xsl:if test="traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
-	  <h4>UDP Responses Sent</h4>
-	  <table class="counters">
-		  <xsl:for-each select="traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
-	      <xsl:variable name="css-class7">
-		<xsl:choose>
-		  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-		  <xsl:otherwise>odd</xsl:otherwise>
-		</xsl:choose>
-	      </xsl:variable>
-	      <tr class="{$css-class7}">
-		<th>
-		  <xsl:value-of select="@name"/>
-		</th>
-		<td>
-		  <xsl:value-of select="."/>
-		</td>
-	      </tr>
-	    </xsl:for-each>
-	  </table>
-	  <br/>
-	</xsl:if>
-
-	<xsl:if test="traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
-	  <h4>TCP Requests Received</h4>
-	  <table class="counters">
-	    <xsl:for-each select="traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
-	      <xsl:variable name="css-class7">
-		<xsl:choose>
-		  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-		  <xsl:otherwise>odd</xsl:otherwise>
-		</xsl:choose>
-	      </xsl:variable>
-	      <tr class="{$css-class7}">
-		<th>
-		  <xsl:value-of select="@name"/>
-		</th>
-		<td>
-		  <xsl:value-of select="."/>
-		</td>
-	      </tr>
-	    </xsl:for-each>
-	  </table>
-	  <br/>
-	</xsl:if>
-
-	<xsl:if test="traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
-	  <h4>TCP Responses Sent</h4>
-	  <table class="counters">
-		  <xsl:for-each select="traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
-	      <xsl:variable name="css-class7">
-		<xsl:choose>
-		  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-		  <xsl:otherwise>odd</xsl:otherwise>
-		</xsl:choose>
-	      </xsl:variable>
-	      <tr class="{$css-class7}">
-		<th>
-		  <xsl:value-of select="@name"/>
-		</th>
-		<td>
-		  <xsl:value-of select="."/>
-		</td>
-	      </tr>
-	    </xsl:for-each>
-	  </table>
-	  <br/>
-	</xsl:if>
-
-	<xsl:if test="server/counters[@type=&quot;sockstat&quot;]/counter[.&gt;0]">
-	  <h2>Socket I/O Statistics</h2>
-	  <table class="counters">
-	    <xsl:for-each select="server/counters[@type=&quot;sockstat&quot;]/counter[.&gt;0]">
-	      <xsl:variable name="css-class7">
-		<xsl:choose>
-		  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-		  <xsl:otherwise>odd</xsl:otherwise>
-		</xsl:choose>
-	      </xsl:variable>
-	      <tr class="{$css-class7}">
-		<th>
-		  <xsl:value-of select="@name"/>
-		</th>
-		<td>
-		  <xsl:value-of select="."/>
-		</td>
-	      </tr>
-	    </xsl:for-each>
-	  </table>
-	  <br/>
-	</xsl:if>
-	<xsl:if test="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
-	  <h2>Received QTYPES per view/zone</h2>
-	  <xsl:for-each select="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
-	    <h3>View <xsl:value-of select="@name"/></h3>
-	    <xsl:variable name="thisview">
-	      <xsl:value-of select="@name"/>
-	    </xsl:variable>
-	    <xsl:for-each select="zones/zone">
-	      <xsl:if test="counters[@type=&quot;qtype&quot;]/counter[count(.) &gt; 0]">
-		<h4>Zone <xsl:value-of select="@name"/></h4>
-		<xsl:if test="system-property('xsl:vendor')!='Transformiix'">
-		  <!-- Non Mozilla specific markup -->
-		<script type="text/javascript">
+        <xsl:if test="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+          <h4>UDP Requests Received</h4>
+          <table class="counters">
+            <xsl:for-each select="traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+              <xsl:variable name="css-class7">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class7}">
+                <th>
+                  <xsl:value-of select="@name"/>
+                </th>
+                <td>
+                  <xsl:value-of select="."/>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+          <h4>UDP Responses Sent</h4>
+          <table class="counters">
+            <xsl:for-each select="traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+              <xsl:variable name="css-class7">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class7}">
+                <th>
+                  <xsl:value-of select="@name"/>
+                </th>
+                <td>
+                  <xsl:value-of select="."/>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+          <h4>TCP Requests Received</h4>
+          <table class="counters">
+            <xsl:for-each select="traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]">
+              <xsl:variable name="css-class7">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class7}">
+                <th>
+                  <xsl:value-of select="@name"/>
+                </th>
+                <td>
+                  <xsl:value-of select="."/>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+          <h4>TCP Responses Sent</h4>
+          <table class="counters">
+            <xsl:for-each select="traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]">
+              <xsl:variable name="css-class7">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class7}">
+                <th>
+                  <xsl:value-of select="@name"/>
+                </th>
+                <td>
+                  <xsl:value-of select="."/>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="server/counters[@type=&quot;sockstat&quot;]/counter[.&gt;0]">
+          <h2>Socket I/O Statistics</h2>
+          <table class="counters">
+            <xsl:for-each select="server/counters[@type=&quot;sockstat&quot;]/counter[.&gt;0]">
+              <xsl:variable name="css-class7">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class7}">
+                <th>
+                  <xsl:value-of select="@name"/>
+                </th>
+                <td>
+                  <xsl:value-of select="."/>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
+          <h2>Received QTYPES per view/zone</h2>
+          <xsl:for-each select="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
+            <h3>View <xsl:value-of select="@name"/></h3>
+            <xsl:variable name="thisview">
+              <xsl:value-of select="@name"/>
+            </xsl:variable>
+            <xsl:for-each select="zones/zone">
+              <xsl:if test="counters[@type=&quot;qtype&quot;]/counter[count(.) &gt; 0]">
+                <h4>Zone <xsl:value-of select="@name"/></h4>
+                <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
+                  <!-- Non Mozilla specific markup -->
+                  <script type="text/javascript">
 			graphs.push({
 				      'title': "Query types for zone <xsl:value-of select="@name"/>",
 				      'target': 'chart_qtype_<xsl:value-of select="../../@name"/>_<xsl:value-of select="@name"/>',
@@ -732,47 +730,47 @@
 				      });
 
 		    </script>
-		<xsl:variable name="target">
-		  <xsl:value-of select="@name"/>
-		</xsl:variable>
-		  <div class="pie" id="chart_qtype_{$thisview}_{$target}">[no data to display]</div>
-		</xsl:if>
-		<table class="counters">
-		  <xsl:for-each select="counters[@type=&quot;qtype&quot;]/counter">
-		    <xsl:sort select="."/>
-		    <xsl:variable name="css-class10">
-		      <xsl:choose>
-			<xsl:when test="position() mod 2 = 0">even</xsl:when>
-			<xsl:otherwise>odd</xsl:otherwise>
-		      </xsl:choose>
-		    </xsl:variable>
-		    <tr class="{$css-class10}">
-		      <th>
-			<xsl:value-of select="@name"/>
-		      </th>
-		      <td>
-			<xsl:value-of select="."/>
-		      </td>
-		    </tr>
-		  </xsl:for-each>
-		</table>
-	      </xsl:if>
-	    </xsl:for-each>
-	  </xsl:for-each>
-	</xsl:if>
-	<xsl:if test="views/view[zones/zone/counters[@type=&quot;rcode&quot;]/counter &gt;0]">
-	  <h2>Response Codes per view/zone</h2>
-	  <xsl:for-each select="views/view[zones/zone/counters[@type=&quot;rcode&quot;]/counter &gt;0]">
-	    <h3>View <xsl:value-of select="@name"/></h3>
-	    <xsl:variable name="thisview2">
-	      <xsl:value-of select="@name"/>
-	    </xsl:variable>
-	    <xsl:for-each select="zones/zone">
-	      <xsl:if test="counters[@type=&quot;rcode&quot;]/counter[. &gt; 0]">
-		<h4>Zone <xsl:value-of select="@name"/></h4>
-		<xsl:if test="system-property('xsl:vendor')!='Transformiix'">
-		  <!-- Non Mozilla specific markup -->
-		<script type="text/javascript">
+                  <xsl:variable name="target">
+                    <xsl:value-of select="@name"/>
+                  </xsl:variable>
+                  <div class="pie" id="chart_qtype_{$thisview}_{$target}">[no data to display]</div>
+                </xsl:if>
+                <table class="counters">
+                  <xsl:for-each select="counters[@type=&quot;qtype&quot;]/counter">
+                    <xsl:sort select="."/>
+                    <xsl:variable name="css-class10">
+                      <xsl:choose>
+                        <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                        <xsl:otherwise>odd</xsl:otherwise>
+                      </xsl:choose>
+                    </xsl:variable>
+                    <tr class="{$css-class10}">
+                      <th>
+                        <xsl:value-of select="@name"/>
+                      </th>
+                      <td>
+                        <xsl:value-of select="."/>
+                      </td>
+                    </tr>
+                  </xsl:for-each>
+                </table>
+              </xsl:if>
+            </xsl:for-each>
+          </xsl:for-each>
+        </xsl:if>
+        <xsl:if test="views/view[zones/zone/counters[@type=&quot;rcode&quot;]/counter &gt;0]">
+          <h2>Response Codes per view/zone</h2>
+          <xsl:for-each select="views/view[zones/zone/counters[@type=&quot;rcode&quot;]/counter &gt;0]">
+            <h3>View <xsl:value-of select="@name"/></h3>
+            <xsl:variable name="thisview2">
+              <xsl:value-of select="@name"/>
+            </xsl:variable>
+            <xsl:for-each select="zones/zone">
+              <xsl:if test="counters[@type=&quot;rcode&quot;]/counter[. &gt; 0]">
+                <h4>Zone <xsl:value-of select="@name"/></h4>
+                <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
+                  <!-- Non Mozilla specific markup -->
+                  <script type="text/javascript">
 			graphs.push({
 				      'title': "Response codes for zone <xsl:value-of select="@name"/>",
 				      'target': 'chart_rescode_<xsl:value-of select="../../@name"/>_<xsl:value-of select="@name"/>',
@@ -781,244 +779,244 @@
 				      });
 
 		</script>
-		<xsl:variable name="target">
-		  <xsl:value-of select="@name"/>
-		</xsl:variable>
-		  <div class="pie" id="chart_rescode_{$thisview2}_{$target}">[no data to display]</div>
-		</xsl:if>
-		<table class="counters">
-		  <xsl:for-each select="counters[@type=&quot;rcode&quot;]/counter[.&gt;0 and @name != &quot;QryAuthAns&quot;]">
-		    <xsl:sort select="."/>
-		    <xsl:variable name="css-class11">
-		      <xsl:choose>
-			<xsl:when test="position() mod 2 = 0">even</xsl:when>
-			<xsl:otherwise>odd</xsl:otherwise>
-		      </xsl:choose>
-		    </xsl:variable>
-		    <tr class="{$css-class11}">
-		      <th>
-			<xsl:value-of select="@name"/>
-		      </th>
-		      <td>
-			<xsl:value-of select="."/>
-		      </td>
-		    </tr>
-		  </xsl:for-each>
-		</table>
-	      </xsl:if>
-	    </xsl:for-each>
-	  </xsl:for-each>
-	</xsl:if>
-	<xsl:if test="socketmgr/sockets/socket">
-	  <h2>Network Status</h2>
-	  <table class="netstat">
-	    <tr>
-	      <th>ID</th>
-	      <th>Name</th>
-	      <th>Type</th>
-	      <th>References</th>
-	      <th>LocalAddress</th>
-	      <th>PeerAddress</th>
-	      <th>State</th>
-	    </tr>
-	    <xsl:for-each select="socketmgr/sockets/socket">
-	      <xsl:sort select="id"/>
-	      <xsl:variable name="css-class12">
-		<xsl:choose>
-		  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-		  <xsl:otherwise>odd</xsl:otherwise>
-		</xsl:choose>
-	      </xsl:variable>
-	      <tr class="{$css-class12}">
-		<td>
-		  <xsl:value-of select="id"/>
-		</td>
-		<td>
-		  <xsl:value-of select="name"/>
-		</td>
-		<td>
-		  <xsl:value-of select="type"/>
-		</td>
-		<td>
-		  <xsl:value-of select="references"/>
-		</td>
-		<td>
-		  <xsl:value-of select="local-address"/>
-		</td>
-		<td>
-		  <xsl:value-of select="peer-address"/>
-		</td>
-		<td>
-		  <xsl:for-each select="states">
-		    <xsl:value-of select="."/>
-		  </xsl:for-each>
-		</td>
-	      </tr>
-	    </xsl:for-each>
-	  </table>
-	  <br/>
-	</xsl:if>
-	<xsl:if test="taskmgr/thread-model/type">
-	  <h2>Task Manager Configuration</h2>
-	  <table class="counters">
-	    <tr>
-	      <th class="even">Thread-Model</th>
-	      <td>
-		<xsl:value-of select="taskmgr/thread-model/type"/>
-	      </td>
-	    </tr>
-	    <tr class="odd">
-	      <th>Worker Threads</th>
-	      <td>
-		<xsl:value-of select="taskmgr/thread-model/worker-threads"/>
-	      </td>
-	    </tr>
-	    <tr class="even">
-	      <th>Default Quantum</th>
-	      <td>
-		<xsl:value-of select="taskmgr/thread-model/default-quantum"/>
-	      </td>
-	    </tr>
-	    <tr class="odd">
-	      <th>Tasks Running</th>
-	      <td>
-		<xsl:value-of select="taskmgr/thread-model/tasks-running"/>
-	      </td>
-	    </tr>
-	    <tr class="even">
-	      <th>Tasks Ready</th>
-	      <td>
-		<xsl:value-of select="taskmgr/thread-model/tasks-ready"/>
-	      </td>
-	    </tr>
-	  </table>
-	  <br/>
-	</xsl:if>
-	<xsl:if test="taskmgr/tasks/task">
-	  <h2>Tasks</h2>
-	  <table class="tasks">
-	    <tr>
-	      <th>ID</th>
-	      <th>Name</th>
-	      <th>References</th>
-	      <th>State</th>
-	      <th>Quantum</th>
-	      <th>Events</th>
-	    </tr>
-	    <xsl:for-each select="taskmgr/tasks/task">
-	      <xsl:sort select="name"/>
-	      <xsl:variable name="css-class14">
-		<xsl:choose>
-		  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-		  <xsl:otherwise>odd</xsl:otherwise>
-		</xsl:choose>
-	      </xsl:variable>
-	      <tr class="{$css-class14}">
-		<td>
-		  <xsl:value-of select="id"/>
-		</td>
-		<td>
-		  <xsl:value-of select="name"/>
-		</td>
-		<td>
-		  <xsl:value-of select="references"/>
-		</td>
-		<td>
-		  <xsl:value-of select="state"/>
-		</td>
-		<td>
-		  <xsl:value-of select="quantum"/>
-		</td>
-		<td>
-		  <xsl:value-of select="events"/>
-		</td>
-	      </tr>
-	    </xsl:for-each>
-	  </table>
-	  <br/>
-	</xsl:if>
-	<xsl:if test="memory/summary">
-	  <h2>Memory Usage Summary</h2>
-	  <table class="counters">
-	    <xsl:for-each select="memory/summary/*">
-	      <xsl:variable name="css-class13">
-		<xsl:choose>
-		  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-		  <xsl:otherwise>odd</xsl:otherwise>
-		</xsl:choose>
-	      </xsl:variable>
-	      <tr class="{$css-class13}">
-		<th>
-		  <xsl:value-of select="name()"/>
-		</th>
-		<td>
-		  <xsl:value-of select="."/>
-		</td>
-	      </tr>
-	    </xsl:for-each>
-	  </table>
-	  <br/>
-	</xsl:if>
-	<xsl:if test="memory/contexts/context">
-	  <h2>Memory Contexts</h2>
-	  <table class="mctx">
-	    <tr>
-	      <th>ID</th>
-	      <th>Name</th>
-	      <th>References</th>
-	      <th>TotalUse</th>
-	      <th>InUse</th>
-	      <th>MaxUse</th>
-	      <th>BlockSize</th>
-	      <th>Pools</th>
-	      <th>HiWater</th>
-	      <th>LoWater</th>
-	    </tr>
-	    <xsl:for-each select="memory/contexts/context">
-	      <xsl:sort select="total" data-type="number" order="descending"/>
-	      <xsl:variable name="css-class14">
-		<xsl:choose>
-		  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-		  <xsl:otherwise>odd</xsl:otherwise>
-		</xsl:choose>
-	      </xsl:variable>
-	      <tr class="{$css-class14}">
-		<td>
-		  <xsl:value-of select="id"/>
-		</td>
-		<td>
-		  <xsl:value-of select="name"/>
-		</td>
-		<td>
-		  <xsl:value-of select="references"/>
-		</td>
-		<td>
-		  <xsl:value-of select="total"/>
-		</td>
-		<td>
-		  <xsl:value-of select="inuse"/>
-		</td>
-		<td>
-		  <xsl:value-of select="maxinuse"/>
-		</td>
-		<td>
-		  <xsl:value-of select="blocksize"/>
-		</td>
-		<td>
-		  <xsl:value-of select="pools"/>
-		</td>
-		<td>
-		  <xsl:value-of select="hiwater"/>
-		</td>
-		<td>
-		  <xsl:value-of select="lowater"/>
-		</td>
-	      </tr>
-	    </xsl:for-each>
-	  </table>
-	</xsl:if>
-	<hr/>
-	<p class="footer">Internet Systems Consortium Inc.<br/><a href="http://www.isc.org">http://www.isc.org</a></p>
+                  <xsl:variable name="target">
+                    <xsl:value-of select="@name"/>
+                  </xsl:variable>
+                  <div class="pie" id="chart_rescode_{$thisview2}_{$target}">[no data to display]</div>
+                </xsl:if>
+                <table class="counters">
+                  <xsl:for-each select="counters[@type=&quot;rcode&quot;]/counter[.&gt;0 and @name != &quot;QryAuthAns&quot;]">
+                    <xsl:sort select="."/>
+                    <xsl:variable name="css-class11">
+                      <xsl:choose>
+                        <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                        <xsl:otherwise>odd</xsl:otherwise>
+                      </xsl:choose>
+                    </xsl:variable>
+                    <tr class="{$css-class11}">
+                      <th>
+                        <xsl:value-of select="@name"/>
+                      </th>
+                      <td>
+                        <xsl:value-of select="."/>
+                      </td>
+                    </tr>
+                  </xsl:for-each>
+                </table>
+              </xsl:if>
+            </xsl:for-each>
+          </xsl:for-each>
+        </xsl:if>
+        <xsl:if test="socketmgr/sockets/socket">
+          <h2>Network Status</h2>
+          <table class="netstat">
+            <tr>
+              <th>ID</th>
+              <th>Name</th>
+              <th>Type</th>
+              <th>References</th>
+              <th>LocalAddress</th>
+              <th>PeerAddress</th>
+              <th>State</th>
+            </tr>
+            <xsl:for-each select="socketmgr/sockets/socket">
+              <xsl:sort select="id"/>
+              <xsl:variable name="css-class12">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class12}">
+                <td>
+                  <xsl:value-of select="id"/>
+                </td>
+                <td>
+                  <xsl:value-of select="name"/>
+                </td>
+                <td>
+                  <xsl:value-of select="type"/>
+                </td>
+                <td>
+                  <xsl:value-of select="references"/>
+                </td>
+                <td>
+                  <xsl:value-of select="local-address"/>
+                </td>
+                <td>
+                  <xsl:value-of select="peer-address"/>
+                </td>
+                <td>
+                  <xsl:for-each select="states">
+                    <xsl:value-of select="."/>
+                  </xsl:for-each>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="taskmgr/thread-model/type">
+          <h2>Task Manager Configuration</h2>
+          <table class="counters">
+            <tr>
+              <th class="even">Thread-Model</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/type"/>
+              </td>
+            </tr>
+            <tr class="odd">
+              <th>Worker Threads</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/worker-threads"/>
+              </td>
+            </tr>
+            <tr class="even">
+              <th>Default Quantum</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/default-quantum"/>
+              </td>
+            </tr>
+            <tr class="odd">
+              <th>Tasks Running</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/tasks-running"/>
+              </td>
+            </tr>
+            <tr class="even">
+              <th>Tasks Ready</th>
+              <td>
+                <xsl:value-of select="taskmgr/thread-model/tasks-ready"/>
+              </td>
+            </tr>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="taskmgr/tasks/task">
+          <h2>Tasks</h2>
+          <table class="tasks">
+            <tr>
+              <th>ID</th>
+              <th>Name</th>
+              <th>References</th>
+              <th>State</th>
+              <th>Quantum</th>
+              <th>Events</th>
+            </tr>
+            <xsl:for-each select="taskmgr/tasks/task">
+              <xsl:sort select="name"/>
+              <xsl:variable name="css-class14">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class14}">
+                <td>
+                  <xsl:value-of select="id"/>
+                </td>
+                <td>
+                  <xsl:value-of select="name"/>
+                </td>
+                <td>
+                  <xsl:value-of select="references"/>
+                </td>
+                <td>
+                  <xsl:value-of select="state"/>
+                </td>
+                <td>
+                  <xsl:value-of select="quantum"/>
+                </td>
+                <td>
+                  <xsl:value-of select="events"/>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="memory/summary">
+          <h2>Memory Usage Summary</h2>
+          <table class="counters">
+            <xsl:for-each select="memory/summary/*">
+              <xsl:variable name="css-class13">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class13}">
+                <th>
+                  <xsl:value-of select="name()"/>
+                </th>
+                <td>
+                  <xsl:value-of select="."/>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+          <br/>
+        </xsl:if>
+        <xsl:if test="memory/contexts/context">
+          <h2>Memory Contexts</h2>
+          <table class="mctx">
+            <tr>
+              <th>ID</th>
+              <th>Name</th>
+              <th>References</th>
+              <th>TotalUse</th>
+              <th>InUse</th>
+              <th>MaxUse</th>
+              <th>BlockSize</th>
+              <th>Pools</th>
+              <th>HiWater</th>
+              <th>LoWater</th>
+            </tr>
+            <xsl:for-each select="memory/contexts/context">
+              <xsl:sort select="total" data-type="number" order="descending"/>
+              <xsl:variable name="css-class14">
+                <xsl:choose>
+                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
+                  <xsl:otherwise>odd</xsl:otherwise>
+                </xsl:choose>
+              </xsl:variable>
+              <tr class="{$css-class14}">
+                <td>
+                  <xsl:value-of select="id"/>
+                </td>
+                <td>
+                  <xsl:value-of select="name"/>
+                </td>
+                <td>
+                  <xsl:value-of select="references"/>
+                </td>
+                <td>
+                  <xsl:value-of select="total"/>
+                </td>
+                <td>
+                  <xsl:value-of select="inuse"/>
+                </td>
+                <td>
+                  <xsl:value-of select="maxinuse"/>
+                </td>
+                <td>
+                  <xsl:value-of select="blocksize"/>
+                </td>
+                <td>
+                  <xsl:value-of select="pools"/>
+                </td>
+                <td>
+                  <xsl:value-of select="hiwater"/>
+                </td>
+                <td>
+                  <xsl:value-of select="lowater"/>
+                </td>
+              </tr>
+            </xsl:for-each>
+          </table>
+        </xsl:if>
+        <hr/>
+        <p class="footer">Internet Systems Consortium Inc.<br/><a href="http://www.isc.org">http://www.isc.org</a></p>
       </body>
     </html>
   </xsl:template>
diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
index 9b7ab4b2bd..f1e1edd28e 100644
--- a/bin/named/bind9.xsl.h
+++ b/bin/named/bind9.xsl.h
@@ -302,6 +302,12 @@ static char xslmsg[] =
 	" <xsl:value-of select=\"server/current-time\"/>\n"
 	" </td>\n"
 	" </tr>\n"
+	" <tr>\n"
+	" <th>Server version:</th>\n"
+	" <td>\n"
+	" <xsl:value-of select=\"server/version\"/>\n"
+	" </td>\n"
+	" </tr>\n"
 	" </table>\n"
 	" <br/>\n"
 	" <xsl:if test=\"server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0]\">\n"
diff --git a/bin/named/server.c b/bin/named/server.c
index f607cbd8d0..ff5ac5e983 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -2373,6 +2373,7 @@ create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
 		dns_db_closeversion(db, &version, ISC_TRUE);
 		CHECK(dns_zone_replacedb(zone, db, ISC_FALSE));
 	}
+	dns_zone_setoption2(zone, DNS_ZONEOPT2_AUTOEMPTY, ISC_TRUE);
 	dns_zone_setview(zone, view);
 	CHECK(dns_view_addzone(view, zone));
 
diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
index 3c55304e09..adb9125d1d 100644
--- a/bin/named/statschannel.c
+++ b/bin/named/statschannel.c
@@ -80,6 +80,41 @@ static isc_once_t once = ISC_ONCE_INIT;
 #undef EXTENDED_STATS
 #endif
 
+#ifdef EXTENDED_STATS
+static const char *
+user_zonetype( dns_zone_t *zone ) {
+	dns_zonetype_t ztype;
+	dns_view_t *view;
+	static const struct zt {
+		const dns_zonetype_t type;
+		const char *const string;
+	} typemap[] = {
+		{ dns_zone_none, "none" },
+		{ dns_zone_master, "master" },
+		{ dns_zone_slave, "slave" },
+		{ dns_zone_stub, "stub" },
+		{ dns_zone_staticstub, "static-stub" },
+		{ dns_zone_key, "key" },
+		{ dns_zone_dlz, "dlz" },
+		{ dns_zone_redirect, "redirect" },
+		{ 0, NULL }
+	};
+	const struct zt *tp;
+
+	if ((dns_zone_getoptions2(zone) & DNS_ZONEOPT2_AUTOEMPTY) != 0)
+		return ("builtin");
+
+	view = dns_zone_getview(zone);
+	if (view != NULL && strcmp(view->name, "_bind") == 0)
+		return ("builtin");
+
+	ztype = dns_zone_gettype(zone);
+	for  (tp = typemap; tp->string != NULL && tp->type != ztype; tp++)
+		/* empty */;
+	return (tp->string);
+}
+#endif
+
 /*%
  * Statistics descriptions.  These could be statistically initialized at
  * compile time, but we configure them run time in the init_desc() function
@@ -1296,6 +1331,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	isc_uint64_t nsstat_values[dns_nsstatscounter_max];
 	int xmlrc;
 	stats_dumparg_t dumparg;
+	const char *ztype;
 
 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none)
@@ -1315,6 +1351,14 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "rdataclass",
 					 ISC_XMLCHAR buf));
 
+	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "type"));
+	ztype = user_zonetype(zone);
+	if (ztype != NULL)
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR ztype));
+	else
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "unknown"));
+	TRY0(xmlTextWriterEndElement(writer)); /* type */
+
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial"));
 	if (dns_zone_getserial2(zone, &serial) == ISC_R_SUCCESS)
 		TRY0(xmlTextWriterWriteFormatString(writer, "%u", serial));
@@ -1418,6 +1462,9 @@ generatexml(ns_server_t *server, isc_uint32_t flags,
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "current-time"));
 	TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR nowstr));
 	TRY0(xmlTextWriterEndElement(writer));  /* current-time */
+	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "version"));
+	TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR ns_g_version));
+	TRY0(xmlTextWriterEndElement(writer));  /* version */
 
 	if ((flags & STATS_XML_SERVER) != 0) {
 		dumparg.result = ISC_R_SUCCESS;
@@ -1896,8 +1943,8 @@ wrap_jsonfree(isc_buffer_t *buffer, void *arg) {
 }
 
 static json_object *
-addzone(char *name, char *class, isc_uint32_t serial,
-	isc_boolean_t add_serial)
+addzone(char *name, char *class, const char *ztype,
+	isc_uint32_t serial, isc_boolean_t add_serial)
 {
 	json_object *node = json_object_new_object();
 
@@ -1909,6 +1956,9 @@ addzone(char *name, char *class, isc_uint32_t serial,
 	if (add_serial)
 		json_object_object_add(node, "serial",
 				       json_object_new_int64(serial));
+	if (ztype != NULL)
+		json_object_object_add(node, "type",
+				       json_object_new_string(ztype));
 	return (node);
 }
 
@@ -1940,9 +1990,11 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	class_only = class;
 
 	if (dns_zone_getserial2(zone, &serial) != ISC_R_SUCCESS)
-		zoneobj = addzone(zone_name_only, class_only, 0, ISC_FALSE);
+		zoneobj = addzone(zone_name_only, class_only,
+				  user_zonetype(zone), 0, ISC_FALSE);
 	else
-		zoneobj = addzone(zone_name_only, class_only, serial, ISC_TRUE);
+		zoneobj = addzone(zone_name_only, class_only,
+				  user_zonetype(zone), serial, ISC_TRUE);
 
 	if (zoneobj == NULL)
 		return (ISC_R_NOMEMORY);
@@ -2057,6 +2109,9 @@ generatejson(ns_server_t *server, size_t *msglen,
 	obj = json_object_new_string(nowstr);
 	CHECKMEM(obj);
 	json_object_object_add(bindstats, "current-time", obj);
+	obj = json_object_new_string(ns_g_version);
+	CHECKMEM(obj);
+	json_object_object_add(bindstats, "version", obj);
 
 	if ((flags & STATS_JSON_SERVER) != 0) {
 		/* OPCODE counters */
@@ -2466,7 +2521,7 @@ render_json(isc_uint32_t flags,
 	json_object *bindstats = NULL;
 	ns_server_t *server = arg;
 	const char *msg = NULL;
-	size_t msglen;
+	size_t msglen = 0;
 	char *p;
 
 	UNUSED(url);
diff --git a/bin/tests/system/statistics/tests.sh b/bin/tests/system/statistics/tests.sh
index 39f42806af..49524fa9f6 100644
--- a/bin/tests/system/statistics/tests.sh
+++ b/bin/tests/system/statistics/tests.sh
@@ -130,5 +130,17 @@ fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+ret=0
+n=`expr $n + 1`
+echo "I:checking that zones return their type ($n)"
+if ./xmlstats && [ -x ${CURL} ] ; then
+    ${CURL} http://10.53.0.1:8053/xml/v3/zones > curl.out.${t} 2>/dev/null || ret=1
+    grep '<zone name="32/1.0.0.127-in-addr.example" rdataclass="IN"><type>master</type>' curl.out.${t} > /dev/null || ret=1
+else
+    echo "I:skipping test as libxml2 and/or curl was not found"
+fi
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status
diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index a5f3cde275..8837ea655e 100644
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -93,7 +93,8 @@ typedef enum {
  * The following zone options are shifted left into the
  * higher-order 32 bits of the options.
  */
-#define DNS_ZONEOPT2_CHECKTTL	  0x00000001	/*%< check max-zone-ttl */
+#define DNS_ZONEOPT2_CHECKTTL	  0x00000001U	/*%< check max-zone-ttl */
+#define DNS_ZONEOPT2_AUTOEMPTY	  0x00000002U	/*%< automatic empty zone */
 
 #ifndef NOMINUM_PUBLIC
 /*

From 7b26f8d8b9730bd9c2eaf8d16f652d7f101cc9a2 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Tue, 27 Oct 2015 23:30:01 +0000
Subject: [PATCH 02/39] regen

---
 bin/named/bind9.xsl.h | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
index f1e1edd28e..ba43dbc6e6 100644
--- a/bin/named/bind9.xsl.h
+++ b/bin/named/bind9.xsl.h
@@ -19,7 +19,6 @@ static char xslmsg[] =
 	" - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR\n"
 	" - PERFORMANCE OF THIS SOFTWARE.\n"
 	"-->\n"
-	"\n"
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
 	" <xsl:template match=\"statistics[@version=&quot;3.6&quot;]\">\n"
@@ -554,7 +553,6 @@ static char xslmsg[] =
 	" </table>\n"
 	" </xsl:if>\n"
 	" </xsl:for-each>\n"
-	"\n"
 	" <xsl:for-each select=\"views/view\">\n"
 	" <xsl:if test=\"counters[@type=&quot;cachestats&quot;]/counter[.&gt;0]\">\n"
 	" <h3>Cache Statistics for View <xsl:value-of select=\"@name\"/></h3>\n"
@@ -579,7 +577,6 @@ static char xslmsg[] =
 	" </table>\n"
 	" </xsl:if>\n"
 	" </xsl:for-each>\n"
-	"\n"
 	" <xsl:for-each select=\"views/view\">\n"
 	" <xsl:if test=\"cache/rrset\">\n"
 	" <h3>Cache DB RRsets for View <xsl:value-of select=\"@name\"/></h3>\n"
@@ -604,7 +601,6 @@ static char xslmsg[] =
 	" <br/>\n"
 	" </xsl:if>\n"
 	" </xsl:for-each>\n"
-	"\n"
 	" <xsl:if test=\"traffic/udp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0] or traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h2>Traffic Size Statistics</h2>\n"
 	" </xsl:if>\n"
@@ -630,7 +626,6 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	"\n"
 	" <xsl:if test=\"traffic/udp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>UDP Responses Sent</h4>\n"
 	" <table class=\"counters\">\n"
@@ -653,7 +648,6 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	"\n"
 	" <xsl:if test=\"traffic/tcp/counters[@type=&quot;request-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>TCP Requests Received</h4>\n"
 	" <table class=\"counters\">\n"
@@ -676,7 +670,6 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	"\n"
 	" <xsl:if test=\"traffic/tcp/counters[@type=&quot;response-size&quot;]/counter[.&gt;0]\">\n"
 	" <h4>TCP Responses Sent</h4>\n"
 	" <table class=\"counters\">\n"
@@ -699,7 +692,6 @@ static char xslmsg[] =
 	" </table>\n"
 	" <br/>\n"
 	" </xsl:if>\n"
-	"\n"
 	" <xsl:if test=\"server/counters[@type=&quot;sockstat&quot;]/counter[.&gt;0]\">\n"
 	" <h2>Socket I/O Statistics</h2>\n"
 	" <table class=\"counters\">\n"

From 13908e7551003805d0dc0907296c2fb0ec7e26fe Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Tue, 27 Oct 2015 23:45:22 +0000
Subject: [PATCH 03/39] update copyright notice / whitespace

---
 bin/named/bind9.xsl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl
index b516a2930c..8ef66f9357 100644
--- a/bin/named/bind9.xsl
+++ b/bin/named/bind9.xsl
@@ -14,6 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
+
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
   <xsl:output method="html" indent="yes" version="4.0"/>
   <xsl:template match="statistics[@version=&quot;3.6&quot;]">

From 1b6e38d7b83b26f123e6f113e4b30093a2774562 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Wed, 28 Oct 2015 23:30:01 +0000
Subject: [PATCH 04/39] regen

---
 bin/named/bind9.xsl.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h
index ba43dbc6e6..fd4322d66a 100644
--- a/bin/named/bind9.xsl.h
+++ b/bin/named/bind9.xsl.h
@@ -19,6 +19,7 @@ static char xslmsg[] =
 	" - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR\n"
 	" - PERFORMANCE OF THIS SOFTWARE.\n"
 	"-->\n"
+	"\n"
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
 	" <xsl:template match=\"statistics[@version=&quot;3.6&quot;]\">\n"

From 72ac929f2bfe186ab4fe2d9425685d6ef419f200 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 29 Oct 2015 12:51:17 +1100
Subject: [PATCH 05/39] 4244.   [bug]           The parser was not reporting
 that use-ixfr is obsolete.                         [RT #41010]

---
 CHANGES                      | 3 +++
 bin/named/config.c           | 2 +-
 bin/named/named.conf.docbook | 2 +-
 lib/isccfg/namedconf.c       | 2 +-
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index d85e874257..df81898c91 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4244.	[bug]		The parser was not reporting that use-ixfr is obsolete.
+			[RT #41010]
+
 4243.	[func]		Improved stats reporting from Timothe Litt. [RT #38941]
 
 4242.	[bug]		Replace the client if not already replaced when
diff --git a/bin/named/config.c b/bin/named/config.c
index c5d5e23c29..a0ee482261 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -118,7 +118,7 @@ options {\n\
 	transfers-out 10;\n\
 #	treat-cr-as-space <obsolete>;\n\
 #	use-id-pool <obsolete>;\n\
-	use-ixfr true;\n\
+#	use-ixfr <obsolete>;\n\
 	edns-udp-size 4096;\n\
 	max-udp-size 4096;\n\
 	nocookie-udp-size 4096;\n\
diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
index a47e2c8f46..a6a31070ed 100644
--- a/bin/named/named.conf.docbook
+++ b/bin/named/named.conf.docbook
@@ -240,7 +240,6 @@ options {
 	transfers-per-ns <replaceable>integer</replaceable>;
 	transfers-in <replaceable>integer</replaceable>;
 	transfers-out <replaceable>integer</replaceable>;
-	use-ixfr <replaceable>boolean</replaceable>;
 	version ( <replaceable>quoted_string</replaceable> | none );
 	allow-recursion { <replaceable>address_match_element</replaceable>; ... };
 	allow-recursion-on { <replaceable>address_match_element</replaceable>; ... };
@@ -408,6 +407,7 @@ options {
 	serial-queries <replaceable>integer</replaceable>; // obsolete
 	treat-cr-as-space <replaceable>boolean</replaceable>; // obsolete
 	use-id-pool <replaceable>boolean</replaceable>; // obsolete
+	use-ixfr <replaceable>boolean</replaceable>; // obsolete
 };
 </literallayout>
   </refsection>
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 86c47f5ab5..8ac0a4cba1 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -1090,7 +1090,7 @@ options_clauses[] = {
 	{ "transfers-out", &cfg_type_uint32, 0 },
 	{ "treat-cr-as-space", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "use-id-pool", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
-	{ "use-ixfr", &cfg_type_boolean, 0 },
+	{ "use-ixfr", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "use-v4-udp-ports", &cfg_type_bracketed_portlist, 0 },
 	{ "use-v6-udp-ports", &cfg_type_bracketed_portlist, 0 },
 	{ "version", &cfg_type_qstringornone, 0 },

From 412f873b9fafa0f8161a1203e7731d9d67052e49 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 29 Oct 2015 12:59:40 +1100
Subject: [PATCH 06/39] placeholder

---
 CHANGES | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGES b/CHANGES
index df81898c91..ed3c8f4da5 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4245.	[placeholder]
+
 4244.	[bug]		The parser was not reporting that use-ixfr is obsolete.
 			[RT #41010]
 

From eadee66609d24bee478aa750cea3c8b3cc1e7579 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Thu, 29 Oct 2015 02:56:15 +0000
Subject: [PATCH 07/39] regen master

---
 bin/named/named.conf.5      | 2 +-
 bin/named/named.conf.html   | 2 +-
 doc/arm/man.named.conf.html | 2 +-
 doc/misc/options            | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5
index 4904d7d972..92ecc610d3 100644
--- a/bin/named/named.conf.5
+++ b/bin/named/named.conf.5
@@ -257,7 +257,6 @@ options {
 	transfers\-per\-ns \fIinteger\fR;
 	transfers\-in \fIinteger\fR;
 	transfers\-out \fIinteger\fR;
-	use\-ixfr \fIboolean\fR;
 	version ( \fIquoted_string\fR | none );
 	allow\-recursion { \fIaddress_match_element\fR; \&.\&.\&. };
 	allow\-recursion\-on { \fIaddress_match_element\fR; \&.\&.\&. };
@@ -410,6 +409,7 @@ options {
 	serial\-queries \fIinteger\fR; // obsolete
 	treat\-cr\-as\-space \fIboolean\fR; // obsolete
 	use\-id\-pool \fIboolean\fR; // obsolete
+	use\-ixfr \fIboolean\fR; // obsolete
 };
 .fi
 .if n \{\
diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html
index 9305b59078..06ddc413d2 100644
--- a/bin/named/named.conf.html
+++ b/bin/named/named.conf.html
@@ -200,7 +200,6 @@ options
 	transfers-per-ns <em class="replaceable"><code>integer</code></em>;<br>
 	transfers-in <em class="replaceable"><code>integer</code></em>;<br>
 	transfers-out <em class="replaceable"><code>integer</code></em>;<br>
-	use-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 	version ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	allow-recursion { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	allow-recursion-on { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -368,6 +367,7 @@ options
 	serial-queries <em class="replaceable"><code>integer</code></em>; // obsolete<br>
 	treat-cr-as-space <em class="replaceable"><code>boolean</code></em>; // obsolete<br>
 	use-id-pool <em class="replaceable"><code>boolean</code></em>; // obsolete<br>
+	use-ixfr <em class="replaceable"><code>boolean</code></em>; // obsolete<br>
 };<br>
 </p></div>
 </div>
diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html
index 74cc725937..2433118222 100644
--- a/doc/arm/man.named.conf.html
+++ b/doc/arm/man.named.conf.html
@@ -219,7 +219,6 @@ options
 	transfers-per-ns <em class="replaceable"><code>integer</code></em>;<br>
 	transfers-in <em class="replaceable"><code>integer</code></em>;<br>
 	transfers-out <em class="replaceable"><code>integer</code></em>;<br>
-	use-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
 	version ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	allow-recursion { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	allow-recursion-on { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -387,6 +386,7 @@ options
 	serial-queries <em class="replaceable"><code>integer</code></em>; // obsolete<br>
 	treat-cr-as-space <em class="replaceable"><code>boolean</code></em>; // obsolete<br>
 	use-id-pool <em class="replaceable"><code>boolean</code></em>; // obsolete<br>
+	use-ixfr <em class="replaceable"><code>boolean</code></em>; // obsolete<br>
 };<br>
 </p></div>
 </div>
diff --git a/doc/misc/options b/doc/misc/options
index 6e6ac785c2..3d6a5bfb7b 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -318,7 +318,7 @@ options {
         update-check-ksk <boolean>;
         use-alt-transfer-source <boolean>;
         use-id-pool <boolean>; // obsolete
-        use-ixfr <boolean>;
+        use-ixfr <boolean>; // obsolete
         use-queryport-pool <boolean>; // obsolete
         use-v4-udp-ports { <portrange>; ... };
         use-v6-udp-ports { <portrange>; ... };

From aa9b64060fb6e946a920e957805f564d149e88e0 Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Wed, 28 Oct 2015 20:19:31 -0700
Subject: [PATCH 08/39] [master] fix statschannel with no libjson

4246.	[test]		Ensure the statschannel system test runs when BIND
			is not built with libjson. [RT #40944]
---
 CHANGES                                |  3 ++
 bin/tests/system/conf.sh.in            |  8 +++++
 bin/tests/system/statschannel/tests.sh | 45 ++++++++++++++++++--------
 configure                              | 21 +++++++++---
 configure.in                           | 18 ++++++++---
 util/copyrights                        |  2 +-
 6 files changed, 72 insertions(+), 25 deletions(-)

diff --git a/CHANGES b/CHANGES
index ed3c8f4da5..413a9e7f01 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4246.	[test]		Ensure the statschannel system test runs when BIND
+			is not built with libjson. [RT #40944]
+
 4245.	[placeholder]
 
 4244.	[bug]		The parser was not reporting that use-ixfr is obsolete.
diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
index e0767bdc4e..0a55c7a96d 100644
--- a/bin/tests/system/conf.sh.in
+++ b/bin/tests/system/conf.sh.in
@@ -101,6 +101,14 @@ else
 	TESTSOCK6=false
 fi
 
+#
+# Determine if we support various optional features.
+#
+CHECK_DSA=@CHECK_DSA@
+XMLSTATS=@XMLSTATS@
+JSONSTATS=@JSONSTATS@
+ZLIB=@ZLIB@
+
 . ${TOP}/version
 
 export NAMED LWRESD DIG NSUPDATE KEYGEN KEYFRLAB SIGNER KEYSIGNER KEYSETTOOL \
diff --git a/bin/tests/system/statschannel/tests.sh b/bin/tests/system/statschannel/tests.sh
index d38effc509..30ba853918 100644
--- a/bin/tests/system/statschannel/tests.sh
+++ b/bin/tests/system/statschannel/tests.sh
@@ -19,7 +19,11 @@ SYSTEMTESTTOP=..
 
 DIGCMD="$DIG @10.53.0.2 -p 5300"
 
-if $PERL -e 'use JSON;' 2>/dev/null
+if [ ! "$JSONSTATS" ]
+then
+    unset PERL_JSON
+    echo "I:JSON was not configured; skipping" >&2
+elif $PERL -e 'use JSON;' 2>/dev/null
 then
     PERL_JSON=1
 else
@@ -27,7 +31,11 @@ else
     echo "I:JSON tests require JSON library; skipping" >&2
 fi
 
-if $PERL -e 'use XML::Simple;' 2>/dev/null
+if [ ! "$XMLSTATS" ]
+then
+    unset PERL_XML
+    echo "I:XML was not configured; skipping" >&2
+elif $PERL -e 'use XML::Simple;' 2>/dev/null
 then
     PERL_XML=1
 else
@@ -143,10 +151,10 @@ if [ $PERL_XML ]; then
     file=`$PERL fetch.pl xml/v3/server`
     mv $file xml.stats
     $PERL server-xml.pl > xml.fmtstats 2> /dev/null
-    xml_query_count=`awk '/opcode QUERY/ { print $NF }' xml.fmtstats` 
+    xml_query_count=`awk '/opcode QUERY/ { print $NF }' xml.fmtstats`
     xml_query_count=${xml_query_count:-0}
     [ "$query_count" -eq "$xml_query_count" ] || ret=1
-    xml_txt_count=`awk '/qtype TXT/ { print $NF }' xml.fmtstats` 
+    xml_txt_count=`awk '/qtype TXT/ { print $NF }' xml.fmtstats`
     xml_txt_count=${xml_txt_count:-0}
     [ "$txt_count" -eq "$xml_txt_count" ] || ret=1
 fi
@@ -154,10 +162,10 @@ if [ $PERL_JSON ]; then
     file=`$PERL fetch.pl json/v1/server`
     mv $file json.stats
     $PERL server-json.pl > json.fmtstats 2> /dev/null
-    json_query_count=`awk '/opcode QUERY/ { print $NF }' json.fmtstats` 
+    json_query_count=`awk '/opcode QUERY/ { print $NF }' json.fmtstats`
     json_query_count=${json_query_count:-0}
     [ "$query_count" -eq "$json_query_count" ] || ret=1
-    json_txt_count=`awk '/qtype TXT/ { print $NF }' json.fmtstats` 
+    json_txt_count=`awk '/qtype TXT/ { print $NF }' json.fmtstats`
     json_txt_count=${json_txt_count:-0}
     [ "$txt_count" -eq "$json_txt_count" ] || ret=1
 fi
@@ -165,13 +173,18 @@ if [ $ret != 0 ]; then echo "I: failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`
 
+
 ret=0
 echo "I:checking consistency between regular and compressed output ($n)"
-$CURL -D regular.headers \
-	http://10.53.0.2:8853/xml/v3/server 2>/dev/null | \
+if [ "$XMLSTATS" ];
+then
+	URL=http://10.53.0.2:8853/xml/v3/server
+else
+	URL=http://10.53.0.2:8853/json/v1/server
+fi
+$CURL -D regular.headers $URL 2>/dev/null | \
 	sed -e "s#<current-time>.*</current-time>##g" > regular.out
-$CURL -D compressed.headers --compressed \
-	http://10.53.0.2:8853/xml/v3/server 2>/dev/null | \
+$CURL -D compressed.headers --compressed $URL 2>/dev/null | \
 	sed -e "s#<current-time>.*</current-time>##g" > compressed.out
 diff regular.out compressed.out >/dev/null || ret=1
 if [ $ret != 0 ]; then echo "I: failed"; fi
@@ -180,14 +193,18 @@ n=`expr $n + 1`
 
 ret=0
 echo "I:checking if compressed output is really compressed ($n)"
-REGSIZE=`cat regular.headers | \
+if [ "$ZLIB" ];
+then
+    REGSIZE=`cat regular.headers | \
 	grep -i Content-Length | sed -e "s/.*: \([0-9]*\).*/\1/"`
-COMPSIZE=`cat compressed.headers | \
+    COMPSIZE=`cat compressed.headers | \
 	grep -i Content-Length | sed -e "s/.*: \([0-9]*\).*/\1/"`
-if [ ! `expr $REGSIZE / $COMPSIZE` -gt 2 ]; then
+    if [ ! `expr $REGSIZE / $COMPSIZE` -gt 2 ]; then
 	ret=1
+    fi
+else
+    echo "I:skipped"
 fi
-
 if [ $ret != 0 ]; then echo "I: failed"; fi
 status=`expr $status + $ret`
 n=`expr $n + 1`
diff --git a/configure b/configure
index 9f063ea75e..4284f78e51 100755
--- a/configure
+++ b/configure
@@ -814,6 +814,9 @@ IRIX_DNSSEC_WARNINGS_HACK
 MKDEPPROG
 MKDEPCFLAGS
 MKDEPCC
+ZLIB
+JSONSTATS
+XMLSTATS
 PKCS11_TEST
 PKCS11_GOST
 PKCS11_ECDSA
@@ -16547,11 +16550,13 @@ rm -f core conftest.err conftest.$ac_objext \
 
 $as_echo "#define HAVE_LIBXML2 1" >>confdefs.h
 
+	XMLSTATS=1
 else
 	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 fi
 
+
 #
 # was --with-libjson specified?
 #
@@ -16696,8 +16701,10 @@ $as_echo "#define HAVE_JSON 1" >>confdefs.h
 $as_echo "#define HAVE_JSON_C 1" >>confdefs.h
 
 	fi
+	JSONSTATS=1
 fi
 
+
 #
 # was --with-zlib specified?
 #
@@ -16814,15 +16821,18 @@ else
 $as_echo "no" >&6; }
 fi
 
+ZLIB=
 if test "X${have_zlib}" != "X"
 then
 	CFLAGS="$CFLAGS $zlib_cflags"
 
 $as_echo "#define HAVE_ZLIB 1" >>confdefs.h
 
+	ZLIB=1
 fi
 
 
+
 #
 # In solaris 10, SMF can manage named service
 #
@@ -24915,9 +24925,9 @@ if test "$enable_full_report" = "yes"; then
     test "X$CRYPTO" = "X" -o "$want_native_pkcs11" = "yes" || \
 	    echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
     test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
-    test "X$libxml2_libs" = "X" || echo "    XML statistics (--with-libxml2)"
-    test "X$have_libjson" = "X" || echo "    JSON statistics (--with-libjson)"
-    test "X$have_zlib" = "X" || echo "    HTTP zlib compression (--with-zlib)"
+    test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
+    test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
+    test "X$ZLIB" = "X" || echo "    HTTP zlib compression (--with-zlib)"
 fi
 
 if test "$use_pkcs11" != "no"; then
@@ -25006,8 +25016,9 @@ test "$use_libtool" = "yes" || echo "    Use GNU libtool (--with-libtool)"
 test "$atf" = "no" && echo "    Automated Testing Framework (--with-atf)"
 
 test "X$PYTHON" = "X" && echo "    Python tools (--with-python)"
-test "X$libxml2_libs" = "X" && echo "    XML statistics (--with-libxml2)"
-test "X$have_libjson" = "X" && echo "    JSON statistics (--with-libjson)"
+test "X$XMLSTATS" = "X" && echo "    XML statistics (--with-libxml2)"
+test "X$JSONSTATS" = "X" && echo "    JSON statistics (--with-libjson)"
+test "X$ZLIB" = "X" && echo "    HTTP zlib compression (--with-zlib)"
 
 if test "X$ac_unrecognized_opts" != "X"; then
     echo
diff --git a/configure.in b/configure.in
index 8b24380bf3..339022bde3 100644
--- a/configure.in
+++ b/configure.in
@@ -2097,9 +2097,11 @@ then
 		    AC_MSG_RESULT(yes),
 		    AC_MSG_ERROR(xml2-config returns badness))
 	AC_DEFINE(HAVE_LIBXML2, 1, [Define if libxml2 was found])
+	XMLSTATS=1
 else
 	AC_MSG_RESULT(no)
 fi
+AC_SUBST(XMLSTATS)
 
 #
 # was --with-libjson specified?
@@ -2177,7 +2179,9 @@ then
 	then
 		AC_DEFINE(HAVE_JSON_C, 1, [Define if json-c was found])
 	fi
+	JSONSTATS=1
 fi
+AC_SUBST(JSONSTATS)
 
 #
 # was --with-zlib specified?
@@ -2231,11 +2235,14 @@ else
 	AC_MSG_RESULT(no)
 fi
 
+ZLIB=
 if test "X${have_zlib}" != "X"
 then
 	CFLAGS="$CFLAGS $zlib_cflags"
 	AC_DEFINE(HAVE_ZLIB, 1, [Define if zlib was found])
+	ZLIB=1
 fi
+AC_SUBST(ZLIB)
 
 
 #
@@ -4913,9 +4920,9 @@ if test "$enable_full_report" = "yes"; then
     test "X$CRYPTO" = "X" -o "$want_native_pkcs11" = "yes" || \
 	    echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
     test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
-    test "X$libxml2_libs" = "X" || echo "    XML statistics (--with-libxml2)"
-    test "X$have_libjson" = "X" || echo "    JSON statistics (--with-libjson)"
-    test "X$have_zlib" = "X" || echo "    HTTP zlib compression (--with-zlib)"
+    test "X$XMLSTATS" = "X" || echo "    XML statistics (--with-libxml2)"
+    test "X$JSONSTATS" = "X" || echo "    JSON statistics (--with-libjson)"
+    test "X$ZLIB" = "X" || echo "    HTTP zlib compression (--with-zlib)"
 fi
 
 if test "$use_pkcs11" != "no"; then
@@ -5004,8 +5011,9 @@ test "$use_libtool" = "yes" || echo "    Use GNU libtool (--with-libtool)"
 test "$atf" = "no" && echo "    Automated Testing Framework (--with-atf)"
 
 test "X$PYTHON" = "X" && echo "    Python tools (--with-python)"
-test "X$libxml2_libs" = "X" && echo "    XML statistics (--with-libxml2)"
-test "X$have_libjson" = "X" && echo "    JSON statistics (--with-libjson)"
+test "X$XMLSTATS" = "X" && echo "    XML statistics (--with-libxml2)"
+test "X$JSONSTATS" = "X" && echo "    JSON statistics (--with-libjson)"
+test "X$ZLIB" = "X" && echo "    HTTP zlib compression (--with-zlib)"
 
 if test "X$ac_unrecognized_opts" != "X"; then
     echo
diff --git a/util/copyrights b/util/copyrights
index 078ccd2f6c..398cd3a3ea 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -2056,7 +2056,7 @@
 ./bin/tests/system/statschannel/prereq.sh	SH	2015
 ./bin/tests/system/statschannel/server-json.pl	PERL	2015
 ./bin/tests/system/statschannel/server-xml.pl	PERL	2015
-./bin/tests/system/statschannel/tests.sh	SH	2015
+./bin/tests/system/statschannel/tests.sh.in	SH	2015
 ./bin/tests/system/statschannel/traffic-json.pl	PERL	2015
 ./bin/tests/system/statschannel/traffic-xml.pl	PERL	2015
 ./bin/tests/system/statschannel/traffic.expect.1	X	2015

From f06b6a9b14509a3b473f52dd797bc490f6f6511d Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 29 Oct 2015 15:22:41 +1100
Subject: [PATCH 09/39] 4247.   [port]          Require both HAVE_JSON and
 JSON_C_VERSION to be                         defined to report json library
 version. [RT #41045]

---
 CHANGES          | 3 +++
 bin/named/main.c | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 413a9e7f01..6fb6191cbf 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4247.	[port]		Require both HAVE_JSON and JSON_C_VERSION to be
+			defined to report json library version. [RT #41045]
+
 4246.	[test]		Ensure the statschannel system test runs when BIND
 			is not built with libjson. [RT #40944]
 
diff --git a/bin/named/main.c b/bin/named/main.c
index ccfc7a3adf..8b852584df 100644
--- a/bin/named/main.c
+++ b/bin/named/main.c
@@ -666,7 +666,7 @@ parse_command_line(int argc, char *argv[]) {
 			printf("linked to libxml2 version: %s\n",
 			       xmlParserVersion);
 #endif
-#ifdef HAVE_JSON
+#if defined(HAVE_JSON) && defined(JSON_C_VERSION)
 			printf("compiled with libjson-c version: %s\n",
 			       JSON_C_VERSION);
 			printf("linked to libjson-c version: %s\n",

From ffb47c916a32684adbd031c0bacdd0d11ff33e3a Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Wed, 28 Oct 2015 21:38:55 -0700
Subject: [PATCH 10/39] [master] update README-SGML

---
 doc/arm/README-SGML | 342 +++++---------------------------------------
 1 file changed, 34 insertions(+), 308 deletions(-)

diff --git a/doc/arm/README-SGML b/doc/arm/README-SGML
index e33c937e4b..a7c347c654 100644
--- a/doc/arm/README-SGML
+++ b/doc/arm/README-SGML
@@ -1,32 +1,45 @@
-Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004, 2015  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 2000, 2001  Internet Software Consortium.
 See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
 
-The BIND v9 ARM master document is now kept in DocBook XML format.
+The BIND v9 ARM master document is now kept in DocBook 5 XML format.
 
-Version: $Id: README-SGML,v 1.17 2004/03/05 05:04:43 marka Exp $
+Most of the ARM is in the single file "Bv9ARM-book.xml", with certain
+other files included into it:
 
-The entire ARM is in the single file:
+    - dlz.xml
+    - dnssec.xml
+    - libdns.xml
+    - logging-categories.xml
+    - managed-keys.xml
+    - notes.xml
+    - pkcs11.xml
+    - BIND man pages
 
-    Bv9ARM-book.xml
+All of the published ARM formats - HTML, PDF, etc - are generated from
+this master source.
 
-All of the other documents - HTML, PDF, etc - are generated from this
-master source.
+The file "notes.xml" contains the release notes for the current release. In
+addition to being included in the ARM as an appendix, it is also built into
+a stand-alone document: "notes.pdf" and "notes.html".
 
-This file attempts to describe what tools are necessary for the
-maintenance of this document as well as the generation of the
-alternate formats of this document.
+Building these these files requires DocBook 5 and dblatex. These are
+available as packages in many OS distributes; in debian, for example:
 
-This file will also spend a very little time describing the XML and
-SGML headers so you can understand a bit what you may need to do to be
-able to work with this document in any fashion other than simply
-editing it. 
+    $ sudo apt-get install docbook5-xml docbook-xml docbook-xsl-ns \
+                           docbook-utils dblatex
 
-We will spend almost no time on the actual tags and how to write an
-XML DocBook compliant document. If you are at all familiar with SGML
-or HTML it will be very evident. You only need to know what the tags
-are and how to use them. You can find a good resource either for this
-either online or in printed form:
+To build all documentation, run "make doc".
+
+When committing changes or submitting patches, it is only necessary to
+edit the XML source (i.e., the files with ".docbook" or ".xml" suffixes);
+the files in HTML and man page format are built from the XML source by a
+cron job.
+
+If you are familiar with SGML or HTML, editing the DocBook XML is quite
+straightforward.  You only need to know what the tags are and how to use
+them.  You can find a good resource either for this either online or in
+printed form:
 
     DocBook: The Definitive Guide
     By Norman Walsh and Leonard Muellner
@@ -38,292 +51,5 @@ The book is available online in HTML format:
 
     http://docbook.org/
 
-and buried in:
-
-    http://www.nwalsh.com/docbook/defguide/index.html
-
-A lot of useful stuff is at NWalsh's site in general. You may also
-want to look at:
-
-    http://www.xml.com/
-
-The BIND v9 ARM is based on the XML 4.0 DocBook DTD. Every XML and
-SGML document begins with a prefix that tells where to find the file
-that describes the meaning and structure of the tags used in the rest
-of the document.
-
-For our XML DocBook 4.0 based document this prefix looks like this:
-
-    <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-		   "/usr/local/share/xml/dtd/docbook/docbookx.dtd">
-
-This "DOCTYPE" statement has three parts, of which we are only using
-two:
-
-o The highest level term that represents this document (in this case
-  it is "book"
-
-o The identifier that tells us which DTD to use. This identifier has
-  two parts, the "Formal Public Identifier" (or FPI) and the system
-  identifier. In SGML you can have either a FPI or a SYSTEM identifier
-  but you have to have at least one of them. In XML you have to have a
-  SYSTEM identifier.
-
-FP & SYSTEM identifiers - These are names/lookups for the actual
-DTD. The FPI is a globally unique name that should, on a properly
-configured system, tell you exactly what DTD to use. The SYSTEM
-identifier gives an absolute location for the DTD. In XML these are
-supposed to be properly formatted URL's.
-
-SGML has these things called "catalogs" that are files that map FPI's
-in to actual files. A "catalog" can also be used to remap a SYSTEM
-identifier so you can say something like: "http://www.oasis.org/foo"
-is actually "/usr/local/share/xml/foo.dtd"
-
-When you use various SGML/XML tools they need to be configured to look
-at the same "catalog" files so that as you move from tool to tool they
-all refer to the same DTD for the same document.
-
-We will be spending most of our configuration time making sure our
-tools use the same "catalog" files and that we have the same DTD's
-installed on our machines. XML's requirement of the SYSTEM identifier
-over the FPI will probably lead to more problems as it does not
-guarantee that everyone is using the same DTD.
-
-I did my initial work with the "sgmltools" the XML 4.0 DocBook DTD and
-"jade" or "openjade."
-
-You can get the 4.0 XML DocBook DTD from:
-
-    http://www.docbook.org/xml/4.0/
-
-(download the .zip file.) NOTE: We will eventually be changing the
-SYSTEM identifier to the recommended value of:
-
-    http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd
-
-NOTE: Under FreeBSD this is the package: 
-
-    /usr/ports/textproc/docbook-xml
-
-NetBSD instructions are coming soon.
-
-With packages listed below installed under FreeBSD the "catalog" file
-that all the tools refer to at least one is in:
-
-    /usr/local/share/sgml/catalog
-
-In order for our SYSTEM identifier for the XML DocBook dtd to be found
-I create a new catalog file at the top of the XML directory created on
-FreeBSD:
-
-   /usr/local/share/xml/catalog
-
-This file has one line:
-
-   SYSTEM "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd" "/usr/local/share/xml/dtd/docbook/docbookx.dtd"
-
-Then in the main "catalog" I have it include this XML catalog:
-
-   CATALOG "/usr/local/share/xml/catalog"
-
-
-On your systems you need to replace "/usr/local/share" with your
-prefix root (probably /usr/pkg under NetBSD.)
-
-NOTE: The URL used above is supposed to the be the proper one for this
-XML DocBook DTD... but there is nothing at that URL so you really do
-need the "SYSTEM" identifier mapping in your catalog (or make the
-SYSTEM identifier in your document refer to the real location of the
-file on your local system.)
-
-HOW TO VALIDATE A DOCUMENT:
-
-I use the sgmltools "nsgmls" document validator. Since we are using
-XML we need to use the XML declarations, which are installed as part
-of the modular DSSL style sheets:
-
-    nsgmls -sv /usr/local/share/sgml/docbook/dsssl/modular/dtds/decls/xml.dcl \
-	   Bv9ARM-book.xml
-
-A convenient shell script "validate.sh" is now generated by configure
-to invoke the above command with the correct system-dependent paths.
-
-The SGML tools can be found at:
-
-    ftp://ftp.us.sgmltools.org/pub/SGMLtools/v2.0/source/ \
-    ftp://ftp.nllgg.nl/pub/SGMLtools/v2.0/source/
-
-FreeBSD package for these is: 
-
-    /usr/ports/textproc/sgmltools
-
-HOW TO RENDER A DOCUMENT AS HTML or TeX:
-
-o Generate html doc with:
-
-    openjade -v -d ./nominum-docbook-html.dsl \
-	 -t sgml \
-	 /usr/local/share/sgml/docbook/dsssl/modular/dtds/decls/xml.dcl \
-	 Bv9ARM-book.xml
-
-A convenient shell script "genhtml.sh" is now generated by configure to
-invoke the above command with the correct system-dependent paths.
-
-On NetBSD there is no port for "openjade" however "jade" does still
-work. However you need to specify the "catalog" file to use for style
-sheets on the command line AND you need to have a default "catalog"
-mapping where to find various DTDs. It seems that "jade" installed out
-of the box on NetBSD does not use a globally defined "catalog" file
-for mapping PUBLIC identifiers in to SYSTEM identifiers.
-
-So you need to have a "catalog" file in your current working directory
-that has in it this: (these are probably more entries than you need!)
-
-     CATALOG "/usr/pkg/share/sgml/iso8879/catalog"
-     CATALOG "/usr/pkg/share/sgml/docbook/2.4.1/catalog"
-     CATALOG "/usr/pkg/share/sgml/docbook/3.0/catalog"
-     CATALOG "/usr/pkg/share/sgml/docbook/3.1/catalog"
-     CATALOG "/usr/pkg/share/sgml/jade/catalog"
-     CATALOG "/usr/local/share/xml/catalog"
-
-(These would all be "/usr/local" on FreeBSD)
-
-So the command for jade on NetBSD will look like this:
-
-jade -v -c /usr/pkg/share/sgml/catalog -t sgml \
-     -d ./nominum-docbook-html.dsl \
-     /usr/pkg/share/sgml/docbook/dsssl/modular/dtds/decls/xml.dcl \
-     ./Bv9ARM-book.xml
-
-Furthermore, since the style sheet subset we define has in it a hard
-coded path to the style sheet is based, it is actually generated by
-configure from a .in file so that it will contain the correct
-system-dependent path: where on FreeBSD the second line reads:
-
-    <!ENTITY dbstyle SYSTEM "/usr/local/share/sgml/docbook/dsssl/modular/html/docbook.dsl" CDATA DSSSL>
-  
-On NetBSD it needs to read:
-
-    <!ENTITY dbstyle SYSTEM "/usr/pkg/share/sgml/docbook/dsssl/modular/html/docbook.dsl" CDATA DSSSL>
-
-NOTE: This is usually solved by having this style sheet modification
-be installed in a system directory and have it reference the style
-sheet it is based on via a relative path.
-
-o Generate TeX documentation:
-
-openjade -d ./nominum-docbook-print.dsl -t tex -v \
-     /usr/local/share/sgml/docbook/dsssl/modular/dtds/decls/xml.dcl \
-     Bv9ARM-book.xml
-
-If you have "jade" installed instead of "openjade" then use that as
-the command. There is little difference, openjade has some bug fixes
-and is in more active development.
-
-To convert the resulting TeX file in to a DVI file you need to do:
-
-    tex "&jadetex" Bv9ARM-book.tex
-
-You can also directly generate the pdf file via:
-
-    pdftex "&pdfjadetex" Bv9ARM-book.tex
-
-The scripts "genpdf.sh" and "gendvi." have been added to simply
-generating the  PDF and DVI output. These substitute the correct paths
-of NetBSD & FreeBSD. You still need to have TeX, jadeTeX, and pdfTeX
-installed and configured properly for these to work.
-
-You will need to up both the "pool_size" and "hash_extra" variables in
-your texmf.cnf file and regenerate them. See below.
-
-You can see that I am using a DSSSL style sheet for DocBook. Actually
-two different ones - one for rendering html, and one for 'print'
-media.
-
-NOTE: For HTML we are using a Nominum DSSSL style instead of the
-default one (all it does is change the chunking to the chapter level
-and makes the files end with ".html" instead of ".htm" so far.) If you
-want to use the plain jane DSSSL style sheet replace the:
-
-    -d ./nominum-docbook-html.dsl
-
-with
-
-    -d /usr/local/share/sgml/docbook/dsssl/modular/html/docbook.dsl
-
-This style sheet will attempt to reference the one above.
-
-I am currently working on fixing these up so that it works the same on
-our various systems. The main trick is knowing which DTD's and DSSSL
-stylesheets you have installed, installing the right ones, and
-configuring a CATALOG that refers to them in the same way. We will
-probably end up putting our CATALOG's in the same place and then we
-should be able to generate and validate our documents with a minimal
-number of command line arguments.
-
-When running these commands you will get a lot of messages about a
-bunch of general entities not being defined and having no default
-entity. You can ignore those for now.
-
-Also with the style sheets we have and jade as it is you will get
-messages about "xref to title" being unsupported. You can ignore these
-for now as well.
-
-=== Getting the various tools installed on FreeBSD
-(NetBSD coming soon..)
-
-o On freebsd you need to install the following packages:
-  o print/teTeX
-  o textproc/openjade
-  o textproc/docbook
-  o textproc/docbook-xml
-  o textproc/dsssl-docbook-modular
-  o textproc/dtd-catalogs
-
-o on freebsd you need to make some entities visible to the docbook xml
-  dtd by making a symlink (can probably be done with a catalog too)
-  ln -s /usr/local/share/xml/entity /usr/local/share/xml/dtd/docbook/ent
-
-o you may need to edit /usr/local/share/sgml/catalog and add the line:
-
-  CATALOG "/usr/local/share/sgml/openjade/catalog"
-
-o add "hugelatex," Enlarge pool sizes, install the jadetex TeX driver
-  file.
-
-  cd /usr/local/share/texmf/web2c/
-  sudo cp texmf.cnf texmf.cnf.bak
-
-  o edit the lines in texmf.cnf with these keys to these values:
-
-                  main_memory = 1100000
-                  hash_extra = 15000
-                  pool_size = 500000
-                  string_vacancies = 45000
-                  max_strings = 55000
-                  pool_free = 47500
-                  nest_size = 500
-                  param_size = 1500
-                  save_size = 5000
-                  stack_size = 1500
-
-  sudo tex -ini -progname=hugelatex -fmt=hugelatex latex.ltx
-  sudo texconfig init
-  sudo texhash
-
-  o For the jadetex macros you will need I recommend you get a more
-    current version than what is packaged with openjade or jade.
-
-    Checkout http://www.tug.org/applications/jadetex/
-    
-    Unzip the file you get from there (should be jadetex-2.20 or
-    newer.) 
-
-    In the directory you unzip: 
-
-      sudo make install
-      sudo texhash
-
-    NOTE: In the most uptodate "ports" for FreeBSD, jadetext is 2.20+
-    so on this platform you should be set as of 2001.01.08.
+After editing documentation, it is useful to check the correctness of the
+XML; this can be done using the "xmllint" utility.

From 1ff2118d6c63006a961de0b696f597197fb26f16 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 29 Oct 2015 15:48:01 +1100
Subject: [PATCH 11/39] return dns_dbtable_add result on error [RT #40653]

---
 bin/tests/db_test.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bin/tests/db_test.c b/bin/tests/db_test.c
index d95dad47c7..259ed6c7e8 100644
--- a/bin/tests/db_test.c
+++ b/bin/tests/db_test.c
@@ -295,7 +295,8 @@ load(const char *filename, const char *origintext, isc_boolean_t cache) {
 		dns_dbtable_adddefault(dbtable, dbi->db);
 		cache_dbi = dbi;
 	} else {
-		if (dns_dbtable_add(dbtable, dbi->db) != ISC_R_SUCCESS) {
+		result = dns_dbtable_add(dbtable, dbi->db);
+		if (result != ISC_R_SUCCESS) {
 			dns_db_detach(&dbi->db);
 			isc_mem_put(mctx, dbi, sizeof(*dbi));
 			return (result);

From 821ff5e8fa1df2e09fea157ee3e298eef6cf4ec9 Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Wed, 28 Oct 2015 22:19:18 -0700
Subject: [PATCH 12/39] [master] isc_atomic_storeq()/stats improvements

4248.	[func]		Add an isc_atomic_storeq() function, use it in
			stats counters to improve performance.
			[RT #39972] [RT #39979]
---
 CHANGES                             |   4 +
 bin/tests/atomic/t_atomic.c         | 162 ++++++++++++++++++++++++++--
 configure                           |   5 +
 configure.in                        |   4 +
 lib/isc/include/isc/platform.h.in   |  10 +-
 lib/isc/stats.c                     |  84 ++++++++++-----
 lib/isc/tests/print_test.c          |   6 ++
 lib/isc/win32/include/isc/atomic.h  |  14 ++-
 lib/isc/x86_32/include/isc/atomic.h |  24 ++++-
 lib/isc/x86_64/include/isc/atomic.h |  11 +-
 win32utils/Configure                |   2 +
 11 files changed, 285 insertions(+), 41 deletions(-)

diff --git a/CHANGES b/CHANGES
index 6fb6191cbf..2b2845b0d8 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4248.	[func]		Add an isc_atomic_storeq() function, use it in
+			stats counters to improve performance.
+			[RT #39972] [RT #39979]
+
 4247.	[port]		Require both HAVE_JSON and JSON_C_VERSION to be
 			defined to report json library version. [RT #41045]
 
diff --git a/bin/tests/atomic/t_atomic.c b/bin/tests/atomic/t_atomic.c
index f63ddf1869..b73da02ad3 100644
--- a/bin/tests/atomic/t_atomic.c
+++ b/bin/tests/atomic/t_atomic.c
@@ -65,14 +65,10 @@ typedef struct {
 
 counter_t counters[TASKS];
 
-void do_xaddq(isc_task_t *task, isc_event_t *ev);
-
 #if defined(ISC_PLATFORM_HAVEXADD)
-isc_int32_t counter_32;
+static isc_int32_t counter_32;
 
-void do_xadd(isc_task_t *task, isc_event_t *ev);
-
-void
+static void
 do_xadd(isc_task_t *task, isc_event_t *ev) {
 	counter_t *state = (counter_t *)ev->ev_arg;
 	int i;
@@ -128,11 +124,9 @@ test_atomic_xadd() {
 #endif
 
 #if defined(ISC_PLATFORM_HAVEXADDQ)
-isc_int64_t counter_64;
+static isc_int64_t counter_64;
 
-void do_xaddq(isc_task_t *task, isc_event_t *ev);
-
-void
+static void
 do_xaddq(isc_task_t *task, isc_event_t *ev) {
 	counter_t *state = (counter_t *)ev->ev_arg;
 	int i;
@@ -188,6 +182,150 @@ test_atomic_xaddq() {
 }
 #endif
 
+static isc_int32_t store_32;
+
+static void
+do_store(isc_task_t *task, isc_event_t *ev) {
+	counter_t *state = (counter_t *)ev->ev_arg;
+	int i;
+	isc_uint8_t r;
+	isc_uint32_t val;
+
+	r = random() % 256;
+	val = (r << 24) | (r << 16) | (r << 8) | r;
+
+	for (i = 0 ; i < COUNTS_PER_ITERATION ; i++) {
+		isc_atomic_store(&store_32, val);
+	}
+
+	state->iteration++;
+	if (state->iteration < ITERATIONS) {
+		isc_task_send(task, &ev);
+	} else {
+		isc_event_free(&ev);
+	}
+}
+
+static void
+test_atomic_store() {
+	int test_result;
+	isc_task_t *tasks[TASKS];
+	isc_event_t *event;
+	int i;
+	isc_uint8_t r;
+	isc_uint32_t val;
+
+	t_assert("test_atomic_store", 1, T_REQUIRED, "%s",
+		 "ensure that isc_atomic_store() works.");
+
+	setup();
+
+	memset(counters, 0, sizeof(counters));
+	store_32 = 0;
+
+	/*
+	 * Create our tasks, and allocate an event to get the counters
+	 * going.
+	 */
+	for (i = 0 ; i < TASKS ; i++) {
+		tasks[i] = NULL;
+		CHECK(isc_task_create(task_manager, 0, &tasks[i]));
+		event = isc_event_allocate(mctx, NULL, 1000, do_store,
+					   &counters[i],
+					   sizeof(struct isc_event));
+		isc_task_sendanddetach(&tasks[i], &event);
+	}
+
+	teardown();
+
+	test_result = T_PASS;
+	r = store_32 & 0xff;
+	val = (r << 24) | (r << 16) | (r << 8) | r;
+	t_info("32-bit store 0x%x, expected 0x%x\n",
+	       (isc_uint32_t) store_32, val);
+	if ((isc_uint32_t) store_32 != val)
+		test_result = T_FAIL;
+	t_result(test_result);
+
+	store_32 = 0;
+}
+
+#if defined(ISC_PLATFORM_HAVEATOMICSTOREQ)
+static isc_int64_t store_64;
+
+static void
+do_storeq(isc_task_t *task, isc_event_t *ev) {
+	counter_t *state = (counter_t *)ev->ev_arg;
+	int i;
+	isc_uint8_t r;
+	isc_uint64_t val;
+
+	r = random() % 256;
+	val = (((isc_uint64_t) r << 24) |
+	       ((isc_uint64_t) r << 16) |
+	       ((isc_uint64_t) r << 8) |
+	       (isc_uint64_t) r);
+	val |= ((isc_uint64_t) val << 32);
+
+	for (i = 0 ; i < COUNTS_PER_ITERATION ; i++) {
+		isc_atomic_storeq(&store_64, val);
+	}
+
+	state->iteration++;
+	if (state->iteration < ITERATIONS) {
+		isc_task_send(task, &ev);
+	} else {
+		isc_event_free(&ev);
+	}
+}
+
+static void
+test_atomic_storeq() {
+	int test_result;
+	isc_task_t *tasks[TASKS];
+	isc_event_t *event;
+	int i;
+	isc_uint8_t r;
+	isc_uint64_t val;
+
+	t_assert("test_atomic_storeq", 1, T_REQUIRED, "%s",
+		 "ensure that isc_atomic_storeq() works.");
+
+	setup();
+
+	memset(counters, 0, sizeof(counters));
+	store_64 = 0;
+
+	/*
+	 * Create our tasks, and allocate an event to get the counters going.
+	 */
+	for (i = 0 ; i < TASKS ; i++) {
+		tasks[i] = NULL;
+		CHECK(isc_task_create(task_manager, 0, &tasks[i]));
+		event = isc_event_allocate(mctx, NULL, 1000, do_storeq,
+					   &counters[i], sizeof(struct isc_event));
+		isc_task_sendanddetach(&tasks[i], &event);
+	}
+
+	teardown();
+
+	test_result = T_PASS;
+	r = store_64 & 0xff;
+	val = (((isc_uint64_t) r << 24) |
+	       ((isc_uint64_t) r << 16) |
+	       ((isc_uint64_t) r << 8) |
+	       (isc_uint64_t) r);
+	val |= ((isc_uint64_t) val << 32);
+	t_info("64-bit store 0x%"ISC_PRINT_QUADFORMAT"x, expected 0x%"ISC_PRINT_QUADFORMAT"x\n",
+	       (isc_uint64_t) store_64, val);
+	if ((isc_uint64_t) store_64 != val)
+		test_result = T_FAIL;
+	t_result(test_result);
+
+	store_64 = 0;
+}
+#endif /* ISC_PLATFORM_HAVEATOMICSTOREQ */
+
 
 testspec_t T_testlist[] = {
 #if defined(ISC_PLATFORM_HAVEXADD)
@@ -195,6 +333,10 @@ testspec_t T_testlist[] = {
 #endif
 #if defined(ISC_PLATFORM_HAVEXADDQ)
 	{ (PFV) test_atomic_xaddq,	"test_atomic_xaddq"		},
+#endif
+	{ (PFV) test_atomic_store,	"test_atomic_store"		},
+#if defined(ISC_PLATFORM_HAVEXADDQ)
+	{ (PFV) test_atomic_storeq,	"test_atomic_storeq"		},
 #endif
 	{ (PFV) 0,			NULL }
 };
diff --git a/configure b/configure
index 4284f78e51..864645b6bd 100755
--- a/configure
+++ b/configure
@@ -717,6 +717,7 @@ ISC_PLATFORM_USEMACASM
 ISC_PLATFORM_USESTDASM
 ISC_PLATFORM_USEOSFASM
 ISC_PLATFORM_USEGCCASM
+ISC_PLATFORM_HAVEATOMICSTOREQ
 ISC_PLATFORM_HAVEATOMICSTORE
 ISC_PLATFORM_HAVECMPXCHG
 ISC_PLATFORM_HAVEXADDQ
@@ -19854,14 +19855,17 @@ if test "$have_atomic" = "yes"; then
 	ISC_PLATFORM_HAVEATOMICSTORE="#define ISC_PLATFORM_HAVEATOMICSTORE 1"
 	if test "$have_xaddq" = "yes"; then
 		ISC_PLATFORM_HAVEXADDQ="#define ISC_PLATFORM_HAVEXADDQ 1"
+		ISC_PLATFORM_HAVEATOMICSTOREQ="#define ISC_PLATFORM_HAVEATOMICSTOREQ 1"
 	else
 		ISC_PLATFORM_HAVEXADDQ="#undef ISC_PLATFORM_HAVEXADDQ"
+		ISC_PLATFORM_HAVEATOMICSTOREQ="#undef ISC_PLATFORM_HAVEATOMICSTOREQ"
 	fi
 else
 	ISC_PLATFORM_HAVEXADD="#undef ISC_PLATFORM_HAVEXADD"
 	ISC_PLATFORM_HAVECMPXCHG="#undef ISC_PLATFORM_HAVECMPXCHG"
 	ISC_PLATFORM_HAVEATOMICSTORE="#undef ISC_PLATFORM_HAVEATOMICSTORE"
 	ISC_PLATFORM_HAVEXADDQ="#undef ISC_PLATFORM_HAVEXADDQ"
+	ISC_PLATFORM_HAVEATOMICSTOREQ="#undef ISC_PLATFORM_HAVEATOMICSTOREQ"
 fi
 
 
@@ -19874,6 +19878,7 @@ fi
 
 
 
+
 ISC_ARCH_DIR=$arch
 
 
diff --git a/configure.in b/configure.in
index 339022bde3..cf06cd9ad0 100644
--- a/configure.in
+++ b/configure.in
@@ -3841,20 +3841,24 @@ if test "$have_atomic" = "yes"; then
 	ISC_PLATFORM_HAVEATOMICSTORE="#define ISC_PLATFORM_HAVEATOMICSTORE 1"
 	if test "$have_xaddq" = "yes"; then
 		ISC_PLATFORM_HAVEXADDQ="#define ISC_PLATFORM_HAVEXADDQ 1"
+		ISC_PLATFORM_HAVEATOMICSTOREQ="#define ISC_PLATFORM_HAVEATOMICSTOREQ 1"
 	else
 		ISC_PLATFORM_HAVEXADDQ="#undef ISC_PLATFORM_HAVEXADDQ"
+		ISC_PLATFORM_HAVEATOMICSTOREQ="#undef ISC_PLATFORM_HAVEATOMICSTOREQ"
 	fi
 else
 	ISC_PLATFORM_HAVEXADD="#undef ISC_PLATFORM_HAVEXADD"
 	ISC_PLATFORM_HAVECMPXCHG="#undef ISC_PLATFORM_HAVECMPXCHG"
 	ISC_PLATFORM_HAVEATOMICSTORE="#undef ISC_PLATFORM_HAVEATOMICSTORE"
 	ISC_PLATFORM_HAVEXADDQ="#undef ISC_PLATFORM_HAVEXADDQ"
+	ISC_PLATFORM_HAVEATOMICSTOREQ="#undef ISC_PLATFORM_HAVEATOMICSTOREQ"
 fi
 
 AC_SUBST(ISC_PLATFORM_HAVEXADD)
 AC_SUBST(ISC_PLATFORM_HAVEXADDQ)
 AC_SUBST(ISC_PLATFORM_HAVECMPXCHG)
 AC_SUBST(ISC_PLATFORM_HAVEATOMICSTORE)
+AC_SUBST(ISC_PLATFORM_HAVEATOMICSTOREQ)
 
 AC_SUBST(ISC_PLATFORM_USEGCCASM)
 AC_SUBST(ISC_PLATFORM_USEOSFASM)
diff --git a/lib/isc/include/isc/platform.h.in b/lib/isc/include/isc/platform.h.in
index 3431712c44..75cdec33a3 100644
--- a/lib/isc/include/isc/platform.h.in
+++ b/lib/isc/include/isc/platform.h.in
@@ -288,11 +288,17 @@
 @ISC_PLATFORM_HAVEXADDQ@
 
 /*
- * If the "atomic swap" operation is available on this architecture,
- * ISC_PLATFORM_HAVEATOMICSTORE" will be defined.
+ * If the 32-bit "atomic swap" operation is available on this
+ * architecture, ISC_PLATFORM_HAVEATOMICSTORE" will be defined.
  */
 @ISC_PLATFORM_HAVEATOMICSTORE@
 
+/*
+ * If the 64-bit "atomic swap" operation is available on this
+ * architecture, ISC_PLATFORM_HAVEATOMICSTORE" will be defined.
+ */
+@ISC_PLATFORM_HAVEATOMICSTOREQ@
+
 /*
  * If the "compare-and-exchange" operation is available on this architecture,
  * ISC_PLATFORM_HAVECMPXCHG will be defined.
diff --git a/lib/isc/stats.c b/lib/isc/stats.c
index 3a685e59f8..61f3ec2e35 100644
--- a/lib/isc/stats.c
+++ b/lib/isc/stats.c
@@ -35,13 +35,45 @@
 #define ISC_STATS_MAGIC			ISC_MAGIC('S', 't', 'a', 't')
 #define ISC_STATS_VALID(x)		ISC_MAGIC_VALID(x, ISC_STATS_MAGIC)
 
-#ifndef ISC_STATS_USEMULTIFIELDS
-#if defined(ISC_RWLOCK_USEATOMIC) && defined(ISC_PLATFORM_HAVEXADD) && !defined(ISC_PLATFORM_HAVEXADDQ)
+/*%
+ * Local macro confirming prescence of 64-bit
+ * increment and store operations, just to make
+ * the later macros simpler
+ */
+#if defined(ISC_PLATFORM_HAVEXADDQ) && defined(ISC_PLATFORM_HAVEATOMICSTOREQ)
+#define ISC_STATS_HAVEATOMICQ 1
+#else
+#define ISC_STATS_HAVEATOMICQ 0
+#endif
+
+/*%
+ * Only lock the counters if 64-bit atomic operations are
+ * not available but cheap atomic lock operations are.
+ * On a modern 64-bit system this should never be the case.
+ *
+ * Normal locks are too expensive to be used whenever a counter
+ * is updated.
+ */
+#if !ISC_STATS_HAVEATOMICQ && defined(ISC_RWLOCK_HAVEATOMIC)
+#define ISC_STATS_LOCKCOUNTERS 1
+#else
+#define ISC_STATS_LOCKCOUNTERS 0
+#endif
+
+/*%
+ * If 64-bit atomic operations are not available but
+ * 32-bit operations are then split the counter into two,
+ * using the atomic operations to try to ensure that any carry
+ * from the low word is correctly carried into the high word.
+ *
+ * Otherwise, just rely on standard 64-bit data types
+ * and operations
+ */
+#if !ISC_STATS_HAVEATOMICQ && defined(ISC_PLATFORM_HAVEXADD)
 #define ISC_STATS_USEMULTIFIELDS 1
 #else
 #define ISC_STATS_USEMULTIFIELDS 0
 #endif
-#endif	/* ISC_STATS_USEMULTIFIELDS */
 
 #if ISC_STATS_USEMULTIFIELDS
 typedef struct {
@@ -65,7 +97,7 @@ struct isc_stats {
 	 * Locked by counterlock or unlocked if efficient rwlock is not
 	 * available.
 	 */
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 	isc_rwlock_t	counterlock;
 #endif
 	isc_stat_t	*counters;
@@ -111,7 +143,7 @@ create_stats(isc_mem_t *mctx, int ncounters, isc_stats_t **statsp) {
 		goto clean_counters;
 	}
 
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 	result = isc_rwlock_init(&stats->counterlock, 0, 0);
 	if (result != ISC_R_SUCCESS)
 		goto clean_copiedcounters;
@@ -131,7 +163,7 @@ create_stats(isc_mem_t *mctx, int ncounters, isc_stats_t **statsp) {
 clean_counters:
 	isc_mem_put(mctx, stats->counters, sizeof(isc_stat_t) * ncounters);
 
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 clean_copiedcounters:
 	isc_mem_put(mctx, stats->copiedcounters,
 		    sizeof(isc_stat_t) * ncounters);
@@ -177,7 +209,7 @@ isc_stats_detach(isc_stats_t **statsp) {
 			    sizeof(isc_stat_t) * stats->ncounters);
 		UNLOCK(&stats->lock);
 		DESTROYLOCK(&stats->lock);
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 		isc_rwlock_destroy(&stats->counterlock);
 #endif
 		isc_mem_putanddetach(&stats->mctx, stats, sizeof(*stats));
@@ -198,7 +230,7 @@ static inline void
 incrementcounter(isc_stats_t *stats, int counter) {
 	isc_int32_t prev;
 
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 	/*
 	 * We use a "read" lock to prevent other threads from reading the
 	 * counter while we "writing" a counter field.  The write access itself
@@ -219,7 +251,7 @@ incrementcounter(isc_stats_t *stats, int counter) {
 	 */
 	if (prev == (isc_int32_t)0xffffffff)
 		isc_atomic_xadd((isc_int32_t *)&stats->counters[counter].hi, 1);
-#elif defined(ISC_PLATFORM_HAVEXADDQ)
+#elif ISC_STATS_HAVEATOMICQ
 	UNUSED(prev);
 	isc_atomic_xaddq((isc_int64_t *)&stats->counters[counter], 1);
 #else
@@ -227,7 +259,7 @@ incrementcounter(isc_stats_t *stats, int counter) {
 	stats->counters[counter]++;
 #endif
 
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 	isc_rwlock_unlock(&stats->counterlock, isc_rwlocktype_read);
 #endif
 }
@@ -236,7 +268,7 @@ static inline void
 decrementcounter(isc_stats_t *stats, int counter) {
 	isc_int32_t prev;
 
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 	isc_rwlock_lock(&stats->counterlock, isc_rwlocktype_read);
 #endif
 
@@ -245,7 +277,7 @@ decrementcounter(isc_stats_t *stats, int counter) {
 	if (prev == 0)
 		isc_atomic_xadd((isc_int32_t *)&stats->counters[counter].hi,
 				-1);
-#elif defined(ISC_PLATFORM_HAVEXADDQ)
+#elif ISC_STATS_HAVEATOMICQ
 	UNUSED(prev);
 	isc_atomic_xaddq((isc_int64_t *)&stats->counters[counter], -1);
 #else
@@ -253,7 +285,7 @@ decrementcounter(isc_stats_t *stats, int counter) {
 	stats->counters[counter]--;
 #endif
 
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 	isc_rwlock_unlock(&stats->counterlock, isc_rwlocktype_read);
 #endif
 }
@@ -262,7 +294,7 @@ static void
 copy_counters(isc_stats_t *stats) {
 	int i;
 
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 	/*
 	 * We use a "write" lock before "reading" the statistics counters as
 	 * an exclusive lock.
@@ -270,19 +302,21 @@ copy_counters(isc_stats_t *stats) {
 	isc_rwlock_lock(&stats->counterlock, isc_rwlocktype_write);
 #endif
 
-#if ISC_STATS_USEMULTIFIELDS
 	for (i = 0; i < stats->ncounters; i++) {
+#if ISC_STATS_USEMULTIFIELDS
 		stats->copiedcounters[i] =
-				(isc_uint64_t)(stats->counters[i].hi) << 32 |
-				stats->counters[i].lo;
-	}
+			(isc_uint64_t)(stats->counters[i].hi) << 32 |
+			stats->counters[i].lo;
+#elif ISC_STATS_HAVEATOMICQ
+		/* use xaddq(..., 0) as an atomic load */
+		stats->copiedcounters[i] =
+			(isc_uint64_t)isc_atomic_xaddq((isc_int64_t *)&stats->counters[i], 0);
 #else
-	UNUSED(i);
-	memmove(stats->copiedcounters, stats->counters,
-		stats->ncounters * sizeof(isc_stat_t));
+		stats->copiedcounters[i] = stats->counters[i];
 #endif
+	}
 
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 	isc_rwlock_unlock(&stats->counterlock, isc_rwlocktype_write);
 #endif
 }
@@ -335,7 +369,7 @@ isc_stats_set(isc_stats_t *stats, isc_uint64_t val,
 	REQUIRE(ISC_STATS_VALID(stats));
 	REQUIRE(counter < stats->ncounters);
 
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 	/*
 	 * We use a "write" lock before "reading" the statistics counters as
 	 * an exclusive lock.
@@ -346,11 +380,13 @@ isc_stats_set(isc_stats_t *stats, isc_uint64_t val,
 #if ISC_STATS_USEMULTIFIELDS
 	stats->counters[counter].hi = (isc_uint32_t)((val >> 32) & 0xffffffff);
 	stats->counters[counter].lo = (isc_uint32_t)(val & 0xffffffff);
+#elif ISC_STATS_HAVEATOMICQ
+	isc_atomic_storeq((isc_int64_t *)&stats->counters[counter], val);
 #else
 	stats->counters[counter] = val;
 #endif
 
-#ifdef ISC_RWLOCK_USEATOMIC
+#if ISC_STATS_LOCKCOUNTERS
 	isc_rwlock_unlock(&stats->counterlock, isc_rwlocktype_write);
 #endif
 }
diff --git a/lib/isc/tests/print_test.c b/lib/isc/tests/print_test.c
index 7d0342ba8a..19bcfaf85e 100644
--- a/lib/isc/tests/print_test.c
+++ b/lib/isc/tests/print_test.c
@@ -117,6 +117,12 @@ ATF_TC_BODY(snprintf, tc) {
 	n = isc_print_snprintf(buf, sizeof(buf), "%zo", size);
 	ATF_CHECK_EQ(n, 4);
 	ATF_CHECK_STREQ(buf, "1750");
+
+	zz = 0xf5f5f5f5f5f5f5f5;
+	memset(buf, 0xff, sizeof(buf));
+	n = isc_print_snprintf(buf, sizeof(buf), "0x%"ISC_PRINT_QUADFORMAT"x", zz);
+	ATF_CHECK_EQ(n, 18);
+	ATF_CHECK_STREQ(buf, "0xf5f5f5f5f5f5f5f5");
 }
 
 ATF_TC(fprintf);
diff --git a/lib/isc/win32/include/isc/atomic.h b/lib/isc/win32/include/isc/atomic.h
index 1c99c44097..f0bcd901fe 100644
--- a/lib/isc/win32/include/isc/atomic.h
+++ b/lib/isc/win32/include/isc/atomic.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2013, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -43,7 +43,7 @@ isc_atomic_xaddq(isc_int64_t *p, isc_int64_t val) {
 #endif
 
 /*
- * This routine atomically stores the value 'val' in 'p'.
+ * This routine atomically stores the value 'val' in 'p' (32-bit version).
  */
 #ifdef ISC_PLATFORM_HAVEATOMICSTORE
 static __inline void
@@ -52,6 +52,16 @@ isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
 }
 #endif
 
+/*
+ * This routine atomically stores the value 'val' in 'p' (64-bit version).
+ */
+#ifdef ISC_PLATFORM_HAVEATOMICSTOREQ
+static __inline void
+isc_atomic_storeq(isc_int64_t *p, isc_int64_t val) {
+	(void) _InterlockedExchange64((__int64 *)p, (__int64)val);
+}
+#endif
+
 /*
  * This routine atomically replaces the value in 'p' with 'val', if the
  * original value is equal to 'cmpval'.  The original value is returned in any
diff --git a/lib/isc/x86_32/include/isc/atomic.h b/lib/isc/x86_32/include/isc/atomic.h
index bf2148cb33..fa0ec15dbd 100644
--- a/lib/isc/x86_32/include/isc/atomic.h
+++ b/lib/isc/x86_32/include/isc/atomic.h
@@ -62,7 +62,7 @@ isc_atomic_xaddq(isc_int64_t *p, isc_int64_t val) {
 #endif /* ISC_PLATFORM_HAVEXADDQ */
 
 /*
- * This routine atomically stores the value 'val' in 'p'.
+ * This routine atomically stores the value 'val' in 'p' (32-bit version).
  */
 static __inline__ void
 isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
@@ -81,6 +81,28 @@ isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
 		: "memory");
 }
 
+#ifdef ISC_PLATFORM_HAVEATOMICSTOREQ
+/*
+ * This routine atomically stores the value 'val' in 'p' (64-bit version).
+ */
+static __inline__ void
+isc_atomic_storeq(isc_int64_t *p, isc_int64_t val) {
+	__asm__ volatile(
+#ifdef ISC_PLATFORM_USETHREADS
+		/*
+		 * xchg should automatically lock memory, but we add it
+		 * explicitly just in case (it at least doesn't harm)
+		 */
+		"lock;"
+#endif
+
+		"xchgq %1, %0"
+		:
+		: "r"(val), "m"(*p)
+		: "memory");
+}
+#endif /* ISC_PLATFORM_HAVEATOMICSTOREQ */
+
 /*
  * This routine atomically replaces the value in 'p' with 'val', if the
  * original value is equal to 'cmpval'.  The original value is returned in any
diff --git a/lib/isc/x86_64/include/isc/atomic.h b/lib/isc/x86_64/include/isc/atomic.h
index f57bd2a786..3f4a5c3459 100644
--- a/lib/isc/x86_64/include/isc/atomic.h
+++ b/lib/isc/x86_64/include/isc/atomic.h
@@ -100,6 +100,9 @@ isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
 	UNUSED(val);
 
 	__asm (
+		/*
+		 * p is %rdi, cmpval is %esi, val is %edx.
+		 */
 		"movl %edx, %ecx\n"
 		"movl %esi, %eax\n"
 		"movq %rdi, %rdx\n"
@@ -108,8 +111,12 @@ isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
 		"lock;"
 #endif
 		/*
-		 * If (%rdi) == %eax then (%rdi) := %edx.
-		 * %eax is set to old (%ecx), which will be the return value.
+		 * If [%rdi] == %eax then [%rdi] := %ecx (equal to %edx
+		 * from above), and %eax is untouched (equal to %esi)
+		 * from above.
+		 *
+		 * Else if [%rdi] != %eax then [%rdi] := [%rdi]
+		 * (rewritten in write cycle) and %eax := [%rdi].
 		 */
 		"cmpxchgl %ecx, (%rdx)"
 		);
diff --git a/win32utils/Configure b/win32utils/Configure
index 25fb03ff4e..2476d45c40 100644
--- a/win32utils/Configure
+++ b/win32utils/Configure
@@ -383,6 +383,7 @@ my @substdefh = ("AES_SIT",
 my %configdefp;
 
 my @substdefp = ("ISC_PLATFORM_HAVEATOMICSTORE",
+                 "ISC_PLATFORM_HAVEATOMICSTOREQ",
                  "ISC_PLATFORM_HAVECMPXCHG",
                  "ISC_PLATFORM_HAVEXADD",
                  "ISC_PLATFORM_HAVEXADDQ",
@@ -1305,6 +1306,7 @@ if ($enable_intrinsics eq "yes") {
     $configdefp{"ISC_PLATFORM_HAVEXADD"} = 1;
     if ($want_x64 eq "yes") {
         $configdefp{"ISC_PLATFORM_HAVEXADDQ"} = 1;
+        $configdefp{"ISC_PLATFORM_HAVEATOMICSTOREQ"} = 1;
     }
     $configdefp{"ISC_PLATFORM_HAVEATOMICSTORE"} = 1;
     $configdefp{"ISC_PLATFORM_HAVECMPXCHG"} = 1;

From 8475bed9de77920f884f1ae296f581efbd1e42f8 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 29 Oct 2015 17:03:03 +1100
Subject: [PATCH 13/39] 4249.   [func]          Improve error reporting of TSIG
 / SIG(0) records in                         the wrong location. [RT #40953]

---
 CHANGES                      |  3 +++
 lib/dns/include/dns/result.h |  4 +++-
 lib/dns/message.c            | 26 +++++++++++++-------------
 lib/dns/result.c             |  7 ++++++-
 4 files changed, 25 insertions(+), 15 deletions(-)

diff --git a/CHANGES b/CHANGES
index 2b2845b0d8..57a8875ba0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4249.	[func]		Improve error reporting of TSIG / SIG(0) records in
+			the wrong location. [RT #40953]
+
 4248.	[func]		Add an isc_atomic_storeq() function, use it in
 			stats counters to improve performance.
 			[RT #39972] [RT #39979]
diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h
index 1a8966dae9..9d8f5d6305 100644
--- a/lib/dns/include/dns/result.h
+++ b/lib/dns/include/dns/result.h
@@ -156,8 +156,10 @@
 #define DNS_R_BADCDNSKEY		(ISC_RESULTCLASS_DNS + 112)
 #define DNS_R_OPTERR			(ISC_RESULTCLASS_DNS + 113)
 #define DNS_R_BADDNSTAP			(ISC_RESULTCLASS_DNS + 114)
+#define DNS_R_BADTSIG			(ISC_RESULTCLASS_DNS + 115)
+#define DNS_R_BADSIG0			(ISC_RESULTCLASS_DNS + 116)
 
-#define DNS_R_NRESULTS			115	/*%< Number of results */
+#define DNS_R_NRESULTS			117	/*%< Number of results */
 
 /*
  * DNS wire format rcodes.
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 37477c532b..a6de041a5a 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -993,12 +993,12 @@ getrdata(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	}
 }
 
-#define DO_FORMERR					\
+#define DO_ERROR(r)					\
 	do {						\
 		if (best_effort)			\
 			seen_problem = ISC_TRUE;	\
 		else {					\
-			result = DNS_R_FORMERR;		\
+			result = r;			\
 			goto cleanup;			\
 		}					\
 	} while (0)
@@ -1073,7 +1073,7 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		 */
 		if (result != ISC_R_SUCCESS) {
 			if (!ISC_LIST_EMPTY(*section))
-				DO_FORMERR;
+				DO_ERROR(DNS_R_FORMERR);
 			ISC_LIST_APPEND(*section, name, link);
 			free_name = ISC_FALSE;
 		} else {
@@ -1102,14 +1102,14 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			msg->state = DNS_SECTION_QUESTION;
 			msg->rdclass = rdclass;
 		} else if (msg->rdclass != rdclass)
-			DO_FORMERR;
+			DO_ERROR(DNS_R_FORMERR);
 
 		/*
 		 * Can't ask the same question twice.
 		 */
 		result = dns_message_find(name, rdclass, rdtype, 0, NULL);
 		if (result == ISC_R_SUCCESS)
-			DO_FORMERR;
+			DO_ERROR(DNS_R_FORMERR);
 
 		/*
 		 * Allocate a new rdatalist.
@@ -1265,7 +1265,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		    && rdtype != dns_rdatatype_tkey /* Win2000 TKEY */
 		    && msg->rdclass != dns_rdataclass_any
 		    && msg->rdclass != rdclass)
-			DO_FORMERR;
+			DO_ERROR(DNS_R_FORMERR);
 
 		/*
 		 * Special type handling for TSIG, OPT, and TKEY.
@@ -1278,7 +1278,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			if (sectionid != DNS_SECTION_ADDITIONAL ||
 			    rdclass != dns_rdataclass_any ||
 			    count != msg->counts[sectionid]  - 1)
-				DO_FORMERR;
+				DO_ERROR(DNS_R_BADTSIG);
 			msg->sigstart = recstart;
 			skip_name_search = ISC_TRUE;
 			skip_type_search = ISC_TRUE;
@@ -1291,7 +1291,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			if (!dns_name_equal(dns_rootname, name) ||
 			    sectionid != DNS_SECTION_ADDITIONAL ||
 			    msg->opt != NULL)
-				DO_FORMERR;
+				DO_ERROR(DNS_R_FORMERR);
 			skip_name_search = ISC_TRUE;
 			skip_type_search = ISC_TRUE;
 		} else if (rdtype == dns_rdatatype_tkey) {
@@ -1310,7 +1310,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 				tkeysection = DNS_SECTION_ANSWER;
 			if (sectionid != tkeysection &&
 			    sectionid != DNS_SECTION_ANSWER)
-				DO_FORMERR;
+				DO_ERROR(DNS_R_FORMERR);
 		}
 
 		/*
@@ -1370,14 +1370,14 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		    rdata->flags == 0) {
 			covers = dns_rdata_covers(rdata);
 			if (covers == 0)
-				DO_FORMERR;
+				DO_ERROR(DNS_R_FORMERR);
 		} else if (rdtype == dns_rdatatype_sig /* SIG(0) */ &&
 			   rdata->flags == 0) {
 			covers = dns_rdata_covers(rdata);
 			if (covers == 0) {
 				if (sectionid != DNS_SECTION_ADDITIONAL ||
 				    count != msg->counts[sectionid]  - 1)
-					DO_FORMERR;
+					DO_ERROR(DNS_R_BADSIG0);
 				msg->sigstart = recstart;
 				skip_name_search = ISC_TRUE;
 				skip_type_search = ISC_TRUE;
@@ -1444,7 +1444,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 			 * the question section, fail.
 			 */
 			if (dns_rdatatype_questiononly(rdtype))
-				DO_FORMERR;
+				DO_ERROR(DNS_R_FORMERR);
 
 			rdataset = NULL;
 			result = dns_message_find(name, rdclass, rdtype,
@@ -1470,7 +1470,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 				first = ISC_LIST_HEAD(rdatalist->rdata);
 				INSIST(first != NULL);
 				if (dns_rdata_compare(rdata, first) != 0)
-					DO_FORMERR;
+					DO_ERROR(DNS_R_FORMERR);
 			}
 		}
 
diff --git a/lib/dns/result.c b/lib/dns/result.c
index 204d2eeac9..a187e68d7e 100644
--- a/lib/dns/result.c
+++ b/lib/dns/result.c
@@ -166,7 +166,10 @@ static const char *text[DNS_R_NRESULTS] = {
 	"bad CDS",			       /*%< 111 DNS_R_BADCSD */
 	"bad CDNSKEY",			       /*%< 112 DNS_R_BADCDNSKEY */
 	"malformed OPT option",		       /*%< 113 DNS_R_OPTERR */
-	"malformed DNSTAP data",	       /*%< 114 DNS_R_BADDNSTAP*/
+	"malformed DNSTAP data",	       /*%< 114 DNS_R_BADDNSTAP */
+
+	"TSIG in wrong location",	       /*%< 115 DNS_R_BADTSIG */
+	"SIG(0) in wrong location",	       /*%< 116 DNS_R_BADSIG0 */
 };
 
 static const char *ids[DNS_R_NRESULTS] = {
@@ -289,6 +292,8 @@ static const char *ids[DNS_R_NRESULTS] = {
 	"DNS_R_BADCDNSKEY",
 	"DNS_R_OPTERR",
 	"DNS_R_BADDNSTAP",
+	"DNS_R_BADTSIG",
+	"DNS_R_BADSIG0",
 };
 
 static const char *rcode_text[DNS_R_NRCODERESULTS] = {

From 861aa4e9039e6f354545177c4c2323b485549602 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 29 Oct 2015 17:04:35 +1100
Subject: [PATCH 14/39] fix rt #

---
 CHANGES | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 57a8875ba0..9d6b88dd9b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,5 @@
 4249.	[func]		Improve error reporting of TSIG / SIG(0) records in
-			the wrong location. [RT #40953]
+			the wrong location. [RT #41030]
 
 4248.	[func]		Add an isc_atomic_storeq() function, use it in
 			stats counters to improve performance.

From f02e14c74f8ba58af09a399a8f6d75dd1bb95f7a Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 30 Oct 2015 07:06:20 +1100
Subject: [PATCH 15/39] #ifdef ISC_PLATFORM_HAVEATOMICSTORE

(cherry picked from commit f75f9e1b628d0eeb1a236dc40b65f1a8d6124aed)
---
 bin/tests/atomic/t_atomic.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/bin/tests/atomic/t_atomic.c b/bin/tests/atomic/t_atomic.c
index b73da02ad3..9c7b76fb4d 100644
--- a/bin/tests/atomic/t_atomic.c
+++ b/bin/tests/atomic/t_atomic.c
@@ -14,8 +14,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: t_atomic.c,v 1.2 2011/01/11 23:47:12 tbox Exp $ */
-
 #include <config.h>
 
 #include <ctype.h>
@@ -38,7 +36,9 @@ char *progname;
 isc_mem_t *mctx = NULL;
 isc_taskmgr_t *task_manager = NULL;
 
-#if defined(ISC_PLATFORM_HAVEXADD) || defined(ISC_PLATFORM_HAVEXADDQ)
+#if defined(ISC_PLATFORM_HAVEXADD) || defined(ISC_PLATFORM_HAVEXADDQ) || \
+    defined(ISC_PLATFORM_HAVEATOMICSTORE) || \
+    defined(ISC_PLATFORM_HAVEATOMICSTOREQ)
 static void
 setup(void) {
 	/* 1 */ CHECK(isc_mem_create(0, 0, &mctx));
@@ -182,6 +182,7 @@ test_atomic_xaddq() {
 }
 #endif
 
+#ifdef ISC_PLATFORM_HAVEATOMICSTORE
 static isc_int32_t store_32;
 
 static void
@@ -249,6 +250,7 @@ test_atomic_store() {
 
 	store_32 = 0;
 }
+#endif
 
 #if defined(ISC_PLATFORM_HAVEATOMICSTOREQ)
 static isc_int64_t store_64;
@@ -326,7 +328,6 @@ test_atomic_storeq() {
 }
 #endif /* ISC_PLATFORM_HAVEATOMICSTOREQ */
 
-
 testspec_t T_testlist[] = {
 #if defined(ISC_PLATFORM_HAVEXADD)
 	{ (PFV) test_atomic_xadd,	"test_atomic_xadd"		},
@@ -334,7 +335,9 @@ testspec_t T_testlist[] = {
 #if defined(ISC_PLATFORM_HAVEXADDQ)
 	{ (PFV) test_atomic_xaddq,	"test_atomic_xaddq"		},
 #endif
+#ifdef ISC_PLATFORM_HAVEATOMICSTORE
 	{ (PFV) test_atomic_store,	"test_atomic_store"		},
+#endif
 #if defined(ISC_PLATFORM_HAVEXADDQ)
 	{ (PFV) test_atomic_storeq,	"test_atomic_storeq"		},
 #endif

From 7c38fa994b486e674e302bf70e8cc90b7397e649 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 30 Oct 2015 08:11:48 +1100
Subject: [PATCH 16/39] 0xf5f5f5f5f5f5f5f5 is a LLU

---
 lib/isc/tests/print_test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/isc/tests/print_test.c b/lib/isc/tests/print_test.c
index 19bcfaf85e..39432d9166 100644
--- a/lib/isc/tests/print_test.c
+++ b/lib/isc/tests/print_test.c
@@ -118,7 +118,7 @@ ATF_TC_BODY(snprintf, tc) {
 	ATF_CHECK_EQ(n, 4);
 	ATF_CHECK_STREQ(buf, "1750");
 
-	zz = 0xf5f5f5f5f5f5f5f5;
+	zz = 0xf5f5f5f5f5f5f5f5LLU;
 	memset(buf, 0xff, sizeof(buf));
 	n = isc_print_snprintf(buf, sizeof(buf), "0x%"ISC_PRINT_QUADFORMAT"x", zz);
 	ATF_CHECK_EQ(n, 18);

From 702e9f43bc893f1ba687fd376e84afccb9b6a314 Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Thu, 29 Oct 2015 15:50:36 -0700
Subject: [PATCH 17/39] [master] typo

---
 lib/dns/tests/dbversion_test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/dns/tests/dbversion_test.c b/lib/dns/tests/dbversion_test.c
index ddbed7f8be..3aaead3f7b 100644
--- a/lib/dns/tests/dbversion_test.c
+++ b/lib/dns/tests/dbversion_test.c
@@ -423,7 +423,7 @@ subtract(isc_assertioncallback_t callback) {
 	result = dns_db_subtractrdataset(db1, node, VERSION(callback),
 					 &rdataset, 0, NULL);
 	if (callback != NULL)
-		atf_tc_fail("dns_db_dns_db_subtractrdataset did not assert");
+		atf_tc_fail("dns_db_subtractrdataset did not assert");
 	ATF_REQUIRE_EQ(result, DNS_R_UNCHANGED);
 
 	dns_db_detachnode(db1, &node);

From 1bf507ca635310b340aea42d6c3e567819974a99 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Thu, 29 Oct 2015 23:30:03 +0000
Subject: [PATCH 18/39] newcopyrights

---
 util/copyrights | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/util/copyrights b/util/copyrights
index 398cd3a3ea..878e327266 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -403,7 +403,7 @@
 ./bin/tests/Makefile.in				MAKE	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015
 ./bin/tests/adb_test.c				C	1999,2000,2001,2004,2005,2007,2009,2011,2012,2013,2015
 ./bin/tests/atomic/Makefile.in			MAKE	2011,2012,2014
-./bin/tests/atomic/t_atomic.c			C	2011,2013
+./bin/tests/atomic/t_atomic.c			C	2011,2013,2015
 ./bin/tests/atomic/win32/t_atomic.dsp.in	X	2013
 ./bin/tests/atomic/win32/t_atomic.dsw		X	2013
 ./bin/tests/atomic/win32/t_atomic.mak.in	X	2013
@@ -2056,6 +2056,7 @@
 ./bin/tests/system/statschannel/prereq.sh	SH	2015
 ./bin/tests/system/statschannel/server-json.pl	PERL	2015
 ./bin/tests/system/statschannel/server-xml.pl	PERL	2015
+./bin/tests/system/statschannel/tests.sh	SH	2015
 ./bin/tests/system/statschannel/tests.sh.in	SH	2015
 ./bin/tests/system/statschannel/traffic-json.pl	PERL	2015
 ./bin/tests/system/statschannel/traffic-xml.pl	PERL	2015
@@ -3007,7 +3008,7 @@
 ./doc/arm/Bv9ARM.html				X	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015
 ./doc/arm/Bv9ARM.pdf				X	2007,2008,2009,2010,2011,2012,2013,2014,2015
 ./doc/arm/Makefile.in				MAKE	2001,2002,2004,2005,2006,2007,2009,2012,2014,2015
-./doc/arm/README-SGML				TXT.BRIEF	2000,2001,2004
+./doc/arm/README-SGML				TXT.BRIEF	2000,2001,2004,2015
 ./doc/arm/dlz.xml				SGML	2012,2013,2014,2015
 ./doc/arm/dnssec.xml				SGML	2010,2011,2015
 ./doc/arm/dyndb.xml				SGML	2015
@@ -3947,7 +3948,7 @@
 ./lib/isc/win32/fsaccess.c			C	2000,2001,2002,2004,2007,2013
 ./lib/isc/win32/include/Makefile.in		MAKE	1999,2000,2001,2004,2007,2012,2014
 ./lib/isc/win32/include/isc/Makefile.in		MAKE	1999,2000,2001,2004,2007,2012,2013,2014
-./lib/isc/win32/include/isc/atomic.h		C	2013
+./lib/isc/win32/include/isc/atomic.h		C	2013,2015
 ./lib/isc/win32/include/isc/bind_registry.h	C	2001,2004,2007
 ./lib/isc/win32/include/isc/bindevt.h		C	2001,2004,2007
 ./lib/isc/win32/include/isc/condition.h		C	1998,1999,2000,2001,2004,2007
@@ -4007,11 +4008,11 @@
 ./lib/isc/x86_32/Makefile.in			MAKE	2007,2012
 ./lib/isc/x86_32/include/Makefile.in		MAKE	2007,2012
 ./lib/isc/x86_32/include/isc/Makefile.in	MAKE	2007,2012
-./lib/isc/x86_32/include/isc/atomic.h		C	2005,2007,2008
+./lib/isc/x86_32/include/isc/atomic.h		C	2005,2007,2008,2015
 ./lib/isc/x86_64/Makefile.in			MAKE	2007,2012
 ./lib/isc/x86_64/include/Makefile.in		MAKE	2007,2012
 ./lib/isc/x86_64/include/isc/Makefile.in	MAKE	2007,2012
-./lib/isc/x86_64/include/isc/atomic.h		C	2005,2007,2008
+./lib/isc/x86_64/include/isc/atomic.h		C	2005,2007,2008,2015
 ./lib/isccc/Makefile.in				MAKE	2001,2003,2004,2007,2009,2011,2012,2014,2015
 ./lib/isccc/alist.c				C.NOM	2001,2004,2005,2007,2015
 ./lib/isccc/api					X	2001,2006,2008,2009,2010,2011,2012,2013,2014,2015

From d4a69308f5322314d067bebf4592257f536542ec Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Thu, 29 Oct 2015 23:45:34 +0000
Subject: [PATCH 19/39] update copyright notice / whitespace

---
 bin/tests/atomic/t_atomic.c         | 2 +-
 lib/isc/x86_32/include/isc/atomic.h | 2 +-
 lib/isc/x86_64/include/isc/atomic.h | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bin/tests/atomic/t_atomic.c b/bin/tests/atomic/t_atomic.c
index 9c7b76fb4d..379122485c 100644
--- a/bin/tests/atomic/t_atomic.c
+++ b/bin/tests/atomic/t_atomic.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2011, 2013, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/lib/isc/x86_32/include/isc/atomic.h b/lib/isc/x86_32/include/isc/atomic.h
index fa0ec15dbd..36088e4d53 100644
--- a/lib/isc/x86_32/include/isc/atomic.h
+++ b/lib/isc/x86_32/include/isc/atomic.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005, 2007, 2008, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/lib/isc/x86_64/include/isc/atomic.h b/lib/isc/x86_64/include/isc/atomic.h
index 3f4a5c3459..f819dfb000 100644
--- a/lib/isc/x86_64/include/isc/atomic.h
+++ b/lib/isc/x86_64/include/isc/atomic.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005, 2007, 2008, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above

From 6b9768937587c43dacd072296d58d6d3b0b7b09e Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 30 Oct 2015 11:57:12 +1100
Subject: [PATCH 20/39] remove /bin/tests/system/statschannel/tests.sh.in

---
 util/copyrights | 1 -
 1 file changed, 1 deletion(-)

diff --git a/util/copyrights b/util/copyrights
index 878e327266..3b8d384c08 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -2057,7 +2057,6 @@
 ./bin/tests/system/statschannel/server-json.pl	PERL	2015
 ./bin/tests/system/statschannel/server-xml.pl	PERL	2015
 ./bin/tests/system/statschannel/tests.sh	SH	2015
-./bin/tests/system/statschannel/tests.sh.in	SH	2015
 ./bin/tests/system/statschannel/traffic-json.pl	PERL	2015
 ./bin/tests/system/statschannel/traffic-xml.pl	PERL	2015
 ./bin/tests/system/statschannel/traffic.expect.1	X	2015

From 09f82f50798e170b172e6ba358ed123536243839 Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Mon, 2 Nov 2015 20:13:13 -0800
Subject: [PATCH 21/39] [master] log TSIG key on xfrin

4250.	[func]		Log the TSIG key in use during inbound zone
			transfers. [RT #41075]
---
 CHANGES         |  3 +++
 lib/dns/xfrin.c | 13 ++++++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index 9d6b88dd9b..914afd9d00 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4250.	[func]		Log the TSIG key in use during inbound zone
+			transfers. [RT #41075]
+
 4249.	[func]		Improve error reporting of TSIG / SIG(0) records in
 			the wrong location. [RT #41030]
 
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index 4781465168..aeace4600e 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -970,6 +970,8 @@ xfrin_connect_done(isc_task_t *task, isc_event_t *event) {
 	dns_xfrin_ctx_t *xfr = (dns_xfrin_ctx_t *) event->ev_arg;
 	isc_result_t result = cev->result;
 	char sourcetext[ISC_SOCKADDR_FORMATSIZE];
+	char signerbuf[DNS_NAME_FORMATSIZE];
+	const char *signer = "", *sep = "";
 	isc_sockaddr_t sockaddr;
 	dns_zonemgr_t * zmgr;
 	isc_time_t now;
@@ -1004,7 +1006,16 @@ xfrin_connect_done(isc_task_t *task, isc_event_t *event) {
 		isc_sockaddr_format(&sockaddr, sourcetext, sizeof(sourcetext));
 	} else
 		strcpy(sourcetext, "<UNKNOWN>");
-	xfrin_log(xfr, ISC_LOG_INFO, "connected using %s", sourcetext);
+
+	if (xfr->tsigkey != NULL && xfr->tsigkey->key != NULL) {
+		dns_name_format(dst_key_name(xfr->tsigkey->key),
+				signerbuf, sizeof(signerbuf));
+		sep = " TSIG ";
+		signer = signerbuf;
+	}
+
+	xfrin_log(xfr, ISC_LOG_INFO, "connected using %s%s%s",
+		  sourcetext, sep, signer);
 
 	dns_tcpmsg_init(xfr->mctx, xfr->socket, &xfr->tcpmsg);
 	xfr->tcpmsg_valid = ISC_TRUE;

From 6b8519147a5c24b4a5942042e83fd539d0d445cc Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Wed, 4 Nov 2015 10:34:28 -0800
Subject: [PATCH 22/39] [master] NTAs did not survive reoad/reconfig

4251.	[bug]		NTAs were deleted when the server was reconfigured
			or reloaded. [RT #41058]
---
 CHANGES                          | 3 +++
 bin/named/server.c               | 4 ++--
 bin/tests/system/dnssec/tests.sh | 2 ++
 doc/arm/notes.xml                | 7 ++++++-
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 914afd9d00..914f27c825 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4251.	[bug]		NTAs were deleted when the server was reconfigured
+			or reloaded. [RT #41058]
+
 4250.	[func]		Log the TSIG key in use during inbound zone
 			transfers. [RT #41075]
 
diff --git a/bin/named/server.c b/bin/named/server.c
index ff5ac5e983..1b820bc416 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -6786,6 +6786,8 @@ load_configuration(const char *filename, ns_server_t *server,
 			goto cleanup;
 	}
 
+	(void) ns_server_loadnta(server);
+
 	result = ISC_R_SUCCESS;
 
  cleanup:
@@ -7055,8 +7057,6 @@ run_server(isc_task_t *task, isc_event_t *event) {
 	isc_hash_init();
 
 	CHECKFATAL(load_zones(server, ISC_TRUE), "loading zones");
-
-	(void) ns_server_loadnta(server);
 }
 
 void
diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index fd3f6fc2d1..e124d5e52a 100644
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -1674,11 +1674,13 @@ ret=0
 #
 $RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 nta -f -l 20s bogus.example 2>&1 | sed 's/^/I:ns4 /'
 $RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 nta badds.example 2>&1 | sed 's/^/I:ns4 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 reconfig # reconfig should maintain NTAs
 $RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 nta -d > rndc.out.ns4.test$n.1
 lines=`wc -l < rndc.out.ns4.test$n.1`
 [ "$lines" -eq 2 ] || ret=1
 $RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 nta secure.example 2>&1 | sed 's/^/I:ns4 /'
 $RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 nta fakenode.secure.example 2>&1 | sed 's/^/I:ns4 /'
+$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 reload # reload should maintain NTAs
 $RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 nta -d > rndc.out.ns4.test$n.2
 lines=`wc -l < rndc.out.ns4.test$n.2`
 [ "$lines" -eq 4 ] || ret=1
diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index dc0e4d9c5c..4493dac524 100644
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -692,7 +692,6 @@
     </itemizedlist>
   </section>
   <section xml:id="relnotes_bugs"><info><title>Bug Fixes</title></info>
-
     <itemizedlist>
       <listitem>
 	<para>
@@ -864,6 +863,12 @@
 	      already in progress. [RT #39649]
 	    </para>
 	  </listitem>
+	  <listitem>
+	    <para>
+	      Negative trust anchors (NTAs) were incorrectly deleted
+	      when the server was reloaded or reconfigured. [RT #41058]
+	    </para>
+	  </listitem>
 	</itemizedlist>
       </listitem>
     </itemizedlist>

From 2b39e7bde959e3bfe1974187997998c518266f73 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Thu, 5 Nov 2015 01:04:10 +0000
Subject: [PATCH 23/39] regen master

---
 doc/arm/Bv9ARM.ch09.html | 4 ++++
 doc/arm/notes.html       | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 71d4af36ed..f0aa1ed75c 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -759,6 +759,10 @@
 	      initiated while another reload of the same zone was
 	      already in progress. [RT #39649]
 	    </p></li>
+<li class="listitem"><p>
+	      Negative trust anchors (NTAs) were incorrectly deleted
+	      when the server was reloaded or reconfigured. [RT #41058]
+	    </p></li>
 </ul></div>
 </li>
 </ul></div>
diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index 54844749b0..bbe7357bff 100644
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -720,6 +720,10 @@
 	      initiated while another reload of the same zone was
 	      already in progress. [RT #39649]
 	    </p></li>
+<li class="listitem"><p>
+	      Negative trust anchors (NTAs) were incorrectly deleted
+	      when the server was reloaded or reconfigured. [RT #41058]
+	    </p></li>
 </ul></div>
 </li>
 </ul></div>

From e939674d53a127ddeeaf4b41fd72933f0b493308 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 5 Nov 2015 12:09:48 +1100
Subject: [PATCH 24/39] 4252.   [func]          Add support for automating the
 generation CDS and                         CDNSKEY rrsets to named and
 dnssec-signzone.                         [RT #40424]

---
 CHANGES                                       |   4 +
 bin/dnssec/dnssec-dsfromkey.docbook           | 204 +++---
 bin/dnssec/dnssec-importkey.c                 |  36 ++
 bin/dnssec/dnssec-importkey.docbook           | 137 ++--
 bin/dnssec/dnssec-keyfromlabel.c              |  41 +-
 bin/dnssec/dnssec-keyfromlabel.docbook        | 483 +++++++-------
 bin/dnssec/dnssec-keygen.c                    |  46 +-
 bin/dnssec/dnssec-keygen.docbook              | 605 +++++++++---------
 bin/dnssec/dnssec-settime.c                   |  69 +-
 bin/dnssec/dnssec-settime.docbook             |  76 ++-
 bin/dnssec/dnssectool.c                       |  20 +-
 bin/dnssec/dnssectool.h                       |   4 +
 bin/tests/system/autosign/clean.sh            |  36 +-
 bin/tests/system/autosign/ns2/keygen.sh       |   2 +-
 bin/tests/system/autosign/ns3/keygen.sh       |  10 +
 bin/tests/system/autosign/ns3/named.conf      |   8 +
 .../system/autosign/ns3/sync.example.db.in    |  37 ++
 bin/tests/system/autosign/tests.sh            |  28 +
 bin/tests/system/dyndb/driver/driver.c        |   2 +-
 bin/tests/system/dyndb/driver/log.c           |   2 +-
 bin/tests/system/rrchecker/tests.sh           |  12 +-
 doc/arm/man.dnstap-read.html                  |   4 +-
 doc/arm/man.lwresd.html                       |  10 +-
 doc/arm/man.named.conf.html                   |   4 +-
 lib/dns/dnssec.c                              | 294 ++++++++-
 lib/dns/dst_parse.c                           |   6 +-
 lib/dns/include/dns/dnssec.h                  |  23 +
 lib/dns/include/dst/dst.h                     |   4 +-
 lib/dns/win32/libdns.def.in                   |   4 +
 lib/dns/zone.c                                |  78 ++-
 lib/isc/win32/libisc.mak.in                   | 234 +++----
 31 files changed, 1622 insertions(+), 901 deletions(-)
 create mode 100644 bin/tests/system/autosign/ns3/sync.example.db.in

diff --git a/CHANGES b/CHANGES
index 914f27c825..5662dbd7ff 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4252.	[func]		Add support for automating the generation CDS and
+			CDNSKEY rrsets to named and dnssec-signzone.
+			[RT #40424]
+
 4251.	[bug]		NTAs were deleted when the server was reconfigured
 			or reloaded. [RT #41058]
 
diff --git a/bin/dnssec/dnssec-dsfromkey.docbook b/bin/dnssec/dnssec-dsfromkey.docbook
index 1237c362d0..85cec76882 100644
--- a/bin/dnssec/dnssec-dsfromkey.docbook
+++ b/bin/dnssec/dnssec-dsfromkey.docbook
@@ -96,85 +96,85 @@
 
     <variablelist>
       <varlistentry>
-        <term>-1</term>
-        <listitem>
-          <para>
-            Use SHA-1 as the digest algorithm (the default is to use
-            both SHA-1 and SHA-256).
-          </para>
-        </listitem>
+	<term>-1</term>
+	<listitem>
+	  <para>
+	    Use SHA-1 as the digest algorithm (the default is to use
+	    both SHA-1 and SHA-256).
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-2</term>
-        <listitem>
-          <para>
-            Use SHA-256 as the digest algorithm.
-          </para>
-        </listitem>
+	<term>-2</term>
+	<listitem>
+	  <para>
+	    Use SHA-256 as the digest algorithm.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-a <replaceable class="parameter">algorithm</replaceable></term>
-        <listitem>
-          <para>
-            Select the digest algorithm. The value of
-            <option>algorithm</option> must be one of SHA-1 (SHA1),
-            SHA-256 (SHA256), GOST or SHA-384 (SHA384).
-            These values are case insensitive.
-          </para>
-        </listitem>
+	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
+	<listitem>
+	  <para>
+	    Select the digest algorithm. The value of
+	    <option>algorithm</option> must be one of SHA-1 (SHA1),
+	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
+	    These values are case insensitive.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-C</term>
-        <listitem>
-          <para>
-            Generate CDS records rather than DS records.  This is mutually
+	<term>-C</term>
+	<listitem>
+	  <para>
+	    Generate CDS records rather than DS records.  This is mutually
 	    exclusive with generating lookaside records.
-          </para>
-        </listitem>
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-T <replaceable class="parameter">TTL</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the TTL of the DS records.
-          </para>
+	<term>-T <replaceable class="parameter">TTL</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the TTL of the DS records.
+	  </para>
 	  </listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-K <replaceable class="parameter">directory</replaceable></term>
-        <listitem>
-          <para>
-            Look for key files (or, in keyset mode,
-            <filename>keyset-</filename> files) in
-            <option>directory</option>.
-          </para>
-        </listitem>
+	<term>-K <replaceable class="parameter">directory</replaceable></term>
+	<listitem>
+	  <para>
+	    Look for key files (or, in keyset mode,
+	    <filename>keyset-</filename> files) in
+	    <option>directory</option>.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-f <replaceable class="parameter">file</replaceable></term>
-        <listitem>
-          <para>
-            Zone file mode: in place of the keyfile name, the argument is
-            the DNS domain name of a zone master file, which can be read
-            from <option>file</option>.  If the zone name is the same as
-            <option>file</option>, then it may be omitted.
-          </para>
-          <para>
-            If <option>file</option> is set to <literal>"-"</literal>, then
-            the zone data is read from the standard input.  This makes it
-            possible to use the output of the <command>dig</command>
-            command as input, as in:
-          </para>
-          <para>
-            <userinput>dig dnskey example.com | dnssec-dsfromkey -f - example.com</userinput>
-          </para>
-        </listitem>
+	<term>-f <replaceable class="parameter">file</replaceable></term>
+	<listitem>
+	  <para>
+	    Zone file mode: in place of the keyfile name, the argument is
+	    the DNS domain name of a zone master file, which can be read
+	    from <option>file</option>.  If the zone name is the same as
+	    <option>file</option>, then it may be omitted.
+	  </para>
+	  <para>
+	    If <option>file</option> is set to <literal>"-"</literal>, then
+	    the zone data is read from the standard input.  This makes it
+	    possible to use the output of the <command>dig</command>
+	    command as input, as in:
+	  </para>
+	  <para>
+	    <userinput>dig dnskey example.com | dnssec-dsfromkey -f - example.com</userinput>
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
@@ -189,64 +189,64 @@
       </varlistentry>
 
       <varlistentry>
-        <term>-l <replaceable class="parameter">domain</replaceable></term>
-        <listitem>
-          <para>
-            Generate a DLV set instead of a DS set.  The specified
-            <option>domain</option> is appended to the name for each
-            record in the set.
-            The DNSSEC Lookaside Validation (DLV) RR is described
-            in RFC 4431.  This is mutually exclusive with generating
+	<term>-l <replaceable class="parameter">domain</replaceable></term>
+	<listitem>
+	  <para>
+	    Generate a DLV set instead of a DS set.  The specified
+	    <option>domain</option> is appended to the name for each
+	    record in the set.
+	    The DNSSEC Lookaside Validation (DLV) RR is described
+	    in RFC 4431.  This is mutually exclusive with generating
 	    CDS records.
-          </para>
-        </listitem>
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-s</term>
-        <listitem>
-          <para>
-            Keyset mode: in place of the keyfile name, the argument is
-            the DNS domain name of a keyset file.
-          </para>
-        </listitem>
+	<term>-s</term>
+	<listitem>
+	  <para>
+	    Keyset mode: in place of the keyfile name, the argument is
+	    the DNS domain name of a keyset file.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-c <replaceable class="parameter">class</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the DNS class (default is IN).  Useful only
-            in keyset or zone file mode.
-          </para>
+	<term>-c <replaceable class="parameter">class</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the DNS class (default is IN).  Useful only
+	    in keyset or zone file mode.
+	  </para>
 	  </listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-v <replaceable class="parameter">level</replaceable></term>
-        <listitem>
-          <para>
-            Sets the debugging level.
-          </para>
-        </listitem>
+	<term>-v <replaceable class="parameter">level</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the debugging level.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-h</term>
-        <listitem>
-          <para>
-            Prints usage information.
-          </para>
-        </listitem>
+	<term>-h</term>
+	<listitem>
+	  <para>
+	    Prints usage information.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-V</term>
-        <listitem>
-          <para>
-            Prints version information.
-          </para>
-        </listitem>
+	<term>-V</term>
+	<listitem>
+	  <para>
+	    Prints version information.
+	  </para>
+	</listitem>
       </varlistentry>
     </variablelist>
   </refsection>
@@ -292,10 +292,10 @@
   <refsection><info><title>SEE ALSO</title></info>
 
     <para><citerefentry>
-        <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
+	<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citerefentry>
-        <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
+	<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
       <citetitle>RFC 3658</citetitle>,
diff --git a/bin/dnssec/dnssec-importkey.c b/bin/dnssec/dnssec-importkey.c
index 9012ef3f94..b2ea6e1907 100644
--- a/bin/dnssec/dnssec-importkey.c
+++ b/bin/dnssec/dnssec-importkey.c
@@ -68,6 +68,9 @@ static isc_boolean_t	setpub = ISC_FALSE, setdel = ISC_FALSE;
 static isc_boolean_t	setttl = ISC_FALSE;
 static isc_stdtime_t	pub = 0, del = 0;
 static dns_ttl_t	ttl = 0;
+static isc_stdtime_t	syncadd = 0, syncdel = 0;
+static isc_boolean_t	setsyncadd = ISC_FALSE;
+static isc_boolean_t	setsyncdel = ISC_FALSE;
 
 static isc_result_t
 initname(char *setname) {
@@ -236,6 +239,11 @@ emit(const char *dir, dns_rdata_t *rdata) {
 		dst_key_settime(key, DST_TIME_PUBLISH, pub);
 	if (setdel)
 		dst_key_settime(key, DST_TIME_DELETE, del);
+	if (setsyncadd)
+		dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
+	if (setsyncdel)
+		dst_key_settime(key, DST_TIME_SYNCDELETE, syncdel);
+
 	if (setttl)
 		dst_key_setttl(key, ttl);
 
@@ -278,8 +286,12 @@ usage(void) {
 	fprintf(stderr, "Timing options:\n");
 	fprintf(stderr, "    -P date/[+-]offset/none: set/unset key "
 						     "publication date\n");
+	fprintf(stderr, "    -P sync date/[+-]offset/none: set/unset "
+				"CDS and CDNSKEY publication date\n");
 	fprintf(stderr, "    -D date/[+-]offset/none: set/unset key "
 						     "deletion date\n");
+	fprintf(stderr, "    -D sync date/[+-]offset/none: set/unset "
+				"CDS and CDNSKEY deletion date\n");
 
 	exit (-1);
 }
@@ -318,6 +330,18 @@ main(int argc, char **argv) {
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case 'D':
+			/* -Dsync ? */
+			if (isoptarg("sync", argv, usage)) {
+				if (setsyncdel)
+					fatal("-D sync specified more than "
+					      "once");
+
+				syncdel = strtotime(isc_commandline_argument,
+						   now, now, &setsyncdel);
+				break;
+			}
+			/* -Ddnskey ? */
+			(void)isoptarg("dnskey", argv, usage);
 			if (setdel)
 				fatal("-D specified more than once");
 
@@ -334,6 +358,18 @@ main(int argc, char **argv) {
 			setttl = ISC_TRUE;
 			break;
 		case 'P':
+			/* -Psync ? */
+			if (isoptarg("sync", argv, usage)) {
+				if (setsyncadd)
+					fatal("-P sync specified more than "
+					      "once");
+
+				syncadd = strtotime(isc_commandline_argument,
+						   now, now, &setsyncadd);
+				break;
+			}
+			/* -Pdnskey ? */
+			(void)isoptarg("dnskey", argv, usage);
 			if (setpub)
 				fatal("-P specified more than once");
 
diff --git a/bin/dnssec/dnssec-importkey.docbook b/bin/dnssec/dnssec-importkey.docbook
index f4c3f172b3..3b6e3e51ae 100644
--- a/bin/dnssec/dnssec-importkey.docbook
+++ b/bin/dnssec/dnssec-importkey.docbook
@@ -20,6 +20,7 @@
     <date>2014-02-20</date>
   </info>
   <refentryinfo>
+    <date>August 21, 2015</date>
     <corpname>ISC</corpname>
     <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
   </refentryinfo>
@@ -50,7 +51,9 @@
       <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-h</option></arg>
       <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
@@ -62,7 +65,9 @@
       <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-h</option></arg>
       <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
@@ -97,68 +102,68 @@
     <variablelist>
       <varlistentry>
 	<term>-f <replaceable class="parameter">filename</replaceable></term>
-        <listitem>
-          <para>
-            Zone file mode: instead of a public keyfile name, the argument
+	<listitem>
+	  <para>
+	    Zone file mode: instead of a public keyfile name, the argument
 	    is the DNS domain name of a zone master file, which can be read
-            from <option>file</option>.  If the domain name is the same as
-            <option>file</option>, then it may be omitted.
-          </para>
-          <para>
-            If <option>file</option> is set to <literal>"-"</literal>, then
-            the zone data is read from the standard input.
-          </para>
-        </listitem>
+	    from <option>file</option>.  If the domain name is the same as
+	    <option>file</option>, then it may be omitted.
+	  </para>
+	  <para>
+	    If <option>file</option> is set to <literal>"-"</literal>, then
+	    the zone data is read from the standard input.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-K <replaceable class="parameter">directory</replaceable></term>
-        <listitem>
-          <para>
-            Sets the directory in which the key files are to reside.
-          </para>
-        </listitem>
+	<term>-K <replaceable class="parameter">directory</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the directory in which the key files are to reside.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-L <replaceable class="parameter">ttl</replaceable></term>
-        <listitem>
-          <para>
-            Sets the default TTL to use for this key when it is converted
-            into a DNSKEY RR.  If the key is imported into a zone,
-            this is the TTL that will be used for it, unless there was
-            already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <literal>0</literal> or <literal>none</literal> removes it.
-          </para>
-        </listitem>
+	<term>-L <replaceable class="parameter">ttl</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the default TTL to use for this key when it is converted
+	    into a DNSKEY RR.  If the key is imported into a zone,
+	    this is the TTL that will be used for it, unless there was
+	    already a DNSKEY RRset in place, in which case the existing TTL
+	    would take precedence.  Setting the default TTL to
+	    <literal>0</literal> or <literal>none</literal> removes it.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
 	<term>-h</term>
-        <listitem>
+	<listitem>
 	  <para>
 	    Emit usage message and exit.
 	  </para>
-        </listitem>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-v <replaceable class="parameter">level</replaceable></term>
-        <listitem>
-          <para>
-            Sets the debugging level.
-          </para>
-        </listitem>
+	<term>-v <replaceable class="parameter">level</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the debugging level.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
 	<term>-V</term>
-        <listitem>
+	<listitem>
 	  <para>
 	    Prints version information.
 	  </para>
-        </listitem>
+	</listitem>
       </varlistentry>
 
     </variablelist>
@@ -180,25 +185,45 @@
 
     <variablelist>
       <varlistentry>
-        <term>-P <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which a key is to be published to the zone.
-            After that date, the key will be included in the zone but will
-            not be used to sign it.
-          </para>
-        </listitem>
+	<term>-P <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which a key is to be published to the zone.
+	    After that date, the key will be included in the zone but will
+	    not be used to sign it.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-D <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which the key is to be deleted.  After that
-            date, the key will no longer be included in the zone.  (It
-            may remain in the key repository, however.)
-          </para>
-        </listitem>
+	<term>-P sync <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which CDS and CDNSKEY records that match this
+	    key are to be published to the zone.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-D <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the key is to be deleted.  After that
+	    date, the key will no longer be included in the zone.  (It
+	    may remain in the key repository, however.)
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-D sync <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the CDS and CDNSKEY records that match
+	    this key are to be deleted.
+	  </para>
+	</listitem>
       </varlistentry>
 
     </variablelist>
@@ -217,10 +242,10 @@
   <refsection><info><title>SEE ALSO</title></info>
 
     <para><citerefentry>
-        <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
+	<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citerefentry>
-        <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
+	<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
       <citetitle>RFC 5011</citetitle>.
diff --git a/bin/dnssec/dnssec-keyfromlabel.c b/bin/dnssec/dnssec-keyfromlabel.c
index 47ff822a10..8bf85271e5 100644
--- a/bin/dnssec/dnssec-keyfromlabel.c
+++ b/bin/dnssec/dnssec-keyfromlabel.c
@@ -104,10 +104,14 @@ usage(void) {
 	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "Date options:\n");
 	fprintf(stderr, "    -P date/[+-]offset: set key publication date\n");
+	fprintf(stderr, "    -P sync date/[+-]offset: set CDS and CDNSKEY "
+			"publication date\n");
 	fprintf(stderr, "    -A date/[+-]offset: set key activation date\n");
 	fprintf(stderr, "    -R date/[+-]offset: set key revocation date\n");
 	fprintf(stderr, "    -I date/[+-]offset: set key inactivation date\n");
 	fprintf(stderr, "    -D date/[+-]offset: set key deletion date\n");
+	fprintf(stderr, "    -D sync date/[+-]offset: set CDS and CDNSKEY "
+			"deletion date\n");
 	fprintf(stderr, "    -G: generate key only; do not set -P or -A\n");
 	fprintf(stderr, "    -C: generate a backward-compatible key, omitting"
 			" all dates\n");
@@ -171,6 +175,9 @@ main(int argc, char **argv) {
 	isc_boolean_t   avoid_collisions = ISC_TRUE;
 	isc_boolean_t	exact;
 	unsigned char	c;
+	isc_stdtime_t	syncadd = 0, syncdel = 0;
+	isc_boolean_t	unsetsyncadd = ISC_FALSE, setsyncadd = ISC_FALSE;
+	isc_boolean_t	unsetsyncdel = ISC_FALSE, setsyncdel = ISC_FALSE;
 
 	if (argc == 1)
 		usage();
@@ -255,6 +262,19 @@ main(int argc, char **argv) {
 			genonly = ISC_TRUE;
 			break;
 		case 'P':
+			/* -Psync ? */
+			if (isoptarg("sync", argv, usage)) {
+				if (unsetsyncadd || setsyncadd)
+					fatal("-P sync specified more than "
+					      "once");
+
+				syncadd = strtotime(isc_commandline_argument,
+						   now, now, &setsyncadd);
+				unsetsyncadd = !setsyncadd;
+				break;
+			}
+			/* -Pdnskey ? */
+			(void)isoptarg("dnskey", argv, usage);
 			if (setpub || unsetpub)
 				fatal("-P specified more than once");
 
@@ -287,6 +307,19 @@ main(int argc, char **argv) {
 			unsetinact = !setinact;
 			break;
 		case 'D':
+			/* -Dsync ? */
+			if (isoptarg("sync", argv, usage)) {
+				if (unsetsyncdel || setsyncdel)
+					fatal("-D sync specified more than "
+					      "once");
+
+				syncdel = strtotime(isc_commandline_argument,
+						   now, now, &setsyncdel);
+				unsetsyncdel = !setsyncdel;
+				break;
+			}
+			/* -Ddnskey ? */
+			(void)isoptarg("dnskey", argv, usage);
 			if (setdel || unsetdel)
 				fatal("-D specified more than once");
 
@@ -621,10 +654,16 @@ main(int argc, char **argv) {
 
 		if (setdel)
 			dst_key_settime(key, DST_TIME_DELETE, delete);
+	if (setsyncadd)
+		dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
+	if (setsyncdel)
+		dst_key_settime(key, DST_TIME_SYNCDELETE, syncdel);
+
 	} else {
 		if (setpub || setact || setrev || setinact ||
 		    setdel || unsetpub || unsetact ||
-		    unsetrev || unsetinact || unsetdel || genonly)
+		    unsetrev || unsetinact || unsetdel || genonly ||
+		    setsyncadd || setsyncdel)
 			fatal("cannot use -C together with "
 			      "-P, -A, -R, -I, -D, or -G options");
 		/*
diff --git a/bin/dnssec/dnssec-keyfromlabel.docbook b/bin/dnssec/dnssec-keyfromlabel.docbook
index b05b322330..353e1a894b 100644
--- a/bin/dnssec/dnssec-keyfromlabel.docbook
+++ b/bin/dnssec/dnssec-keyfromlabel.docbook
@@ -20,6 +20,7 @@
     <date>2014-02-27</date>
   </info>
   <refentryinfo>
+    <date>August 27, 2015</date>
     <corpname>ISC</corpname>
     <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
   </refentryinfo>
@@ -57,6 +58,7 @@
       <arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">flag</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-G</option></arg>
@@ -67,6 +69,7 @@
       <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
@@ -100,113 +103,113 @@
 
     <variablelist>
       <varlistentry>
-        <term>-a <replaceable class="parameter">algorithm</replaceable></term>
-        <listitem>
+	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
+	<listitem>
 	  <para>
 	    Selects the cryptographic algorithm.  The value of
-            <option>algorithm</option> must be one of RSAMD5, RSASHA1,
+	    <option>algorithm</option> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256 or ECDSAP384SHA384.
 	    These values are case insensitive.
 	  </para>
-          <para>
-            If no algorithm is specified, then RSASHA1 will be used by
-            default, unless the <option>-3</option> option is specified,
-            in which case NSEC3RSASHA1 will be used instead.  (If
-            <option>-3</option> is used and an algorithm is specified,
-            that algorithm will be checked for compatibility with NSEC3.)
-          </para>
-          <para>
-            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
-            algorithm, and DSA is recommended.
-          </para>
-          <para>
-            Note 2: DH automatically sets the -k flag.
-          </para>
-        </listitem>
+	  <para>
+	    If no algorithm is specified, then RSASHA1 will be used by
+	    default, unless the <option>-3</option> option is specified,
+	    in which case NSEC3RSASHA1 will be used instead.  (If
+	    <option>-3</option> is used and an algorithm is specified,
+	    that algorithm will be checked for compatibility with NSEC3.)
+	  </para>
+	  <para>
+	    Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
+	    algorithm, and DSA is recommended.
+	  </para>
+	  <para>
+	    Note 2: DH automatically sets the -k flag.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-3</term>
-        <listitem>
-          <para>
+	<term>-3</term>
+	<listitem>
+	  <para>
 	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-            If this option is used and no algorithm is explicitly
-            set on the command line, NSEC3RSASHA1 will be used by
-            default.
-          </para>
-        </listitem>
+	    If this option is used and no algorithm is explicitly
+	    set on the command line, NSEC3RSASHA1 will be used by
+	    default.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-E <replaceable class="parameter">engine</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the cryptographic hardware to use.
-          </para>
-          <para>
-            When BIND is built with OpenSSL PKCS#11 support, this defaults
-            to the string "pkcs11", which identifies an OpenSSL engine
-            that can drive a cryptographic accelerator or hardware service
-            module.  When BIND is built with native PKCS#11 cryptography
-            (--enable-native-pkcs11), it defaults to the path of the PKCS#11
-            provider library specified via "--with-pkcs11".
-          </para>
-        </listitem>
+	<term>-E <replaceable class="parameter">engine</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the cryptographic hardware to use.
+	  </para>
+	  <para>
+	    When BIND is built with OpenSSL PKCS#11 support, this defaults
+	    to the string "pkcs11", which identifies an OpenSSL engine
+	    that can drive a cryptographic accelerator or hardware service
+	    module.  When BIND is built with native PKCS#11 cryptography
+	    (--enable-native-pkcs11), it defaults to the path of the PKCS#11
+	    provider library specified via "--with-pkcs11".
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-l <replaceable class="parameter">label</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the label for a key pair in the crypto hardware.
-          </para>
-          <para>
-            When <acronym>BIND</acronym> 9 is built with OpenSSL-based
-            PKCS#11 support, the label is an arbitrary string that
-            identifies a particular key.  It may be preceded by an
-            optional OpenSSL engine name, followed by a colon, as in
-            "pkcs11:<replaceable>keylabel</replaceable>".
-          </para>
-          <para>
-            When <acronym>BIND</acronym> 9 is built with native PKCS#11
-            support, the label is a PKCS#11 URI string in the format
-            "pkcs11:<option>keyword</option>=<replaceable>value</replaceable><optional>;<option>keyword</option>=<replaceable>value</replaceable>;...</optional>"
-            Keywords include "token", which identifies the HSM; "object", which
-            identifies the key; and "pin-source", which identifies a file from
-            which the HSM's PIN code can be obtained.  The label will be
-            stored in the on-disk "private" file.
-          </para>
-          <para>
-            If the label contains a
-            <option>pin-source</option> field, tools using the generated
-            key files will be able to use the HSM for signing and other
-            operations without any need for an operator to manually enter
-            a PIN.  Note: Making the HSM's PIN accessible in this manner
-            may reduce the security advantage of using an HSM; be sure
-            this is what you want to do before making use of this feature.
-          </para>
-        </listitem>
+	<term>-l <replaceable class="parameter">label</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the label for a key pair in the crypto hardware.
+	  </para>
+	  <para>
+	    When <acronym>BIND</acronym> 9 is built with OpenSSL-based
+	    PKCS#11 support, the label is an arbitrary string that
+	    identifies a particular key.  It may be preceded by an
+	    optional OpenSSL engine name, followed by a colon, as in
+	    "pkcs11:<replaceable>keylabel</replaceable>".
+	  </para>
+	  <para>
+	    When <acronym>BIND</acronym> 9 is built with native PKCS#11
+	    support, the label is a PKCS#11 URI string in the format
+	    "pkcs11:<option>keyword</option>=<replaceable>value</replaceable><optional>;<option>keyword</option>=<replaceable>value</replaceable>;...</optional>"
+	    Keywords include "token", which identifies the HSM; "object", which
+	    identifies the key; and "pin-source", which identifies a file from
+	    which the HSM's PIN code can be obtained.  The label will be
+	    stored in the on-disk "private" file.
+	  </para>
+	  <para>
+	    If the label contains a
+	    <option>pin-source</option> field, tools using the generated
+	    key files will be able to use the HSM for signing and other
+	    operations without any need for an operator to manually enter
+	    a PIN.  Note: Making the HSM's PIN accessible in this manner
+	    may reduce the security advantage of using an HSM; be sure
+	    this is what you want to do before making use of this feature.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-n <replaceable class="parameter">nametype</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the owner type of the key.  The value of
-            <option>nametype</option> must either be ZONE (for a DNSSEC
-            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-            a host (KEY)),
-            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-            These values are case insensitive.
-          </para>
-        </listitem>
+	<term>-n <replaceable class="parameter">nametype</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the owner type of the key.  The value of
+	    <option>nametype</option> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
+	    a host (KEY)),
+	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
+	    These values are case insensitive.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-C</term>
-        <listitem>
-          <para>
+	<term>-C</term>
+	<listitem>
+	  <para>
 	    Compatibility mode:  generates an old-style key, without
 	    any metadata.  By default, <command>dnssec-keyfromlabel</command>
 	    will include the key's creation date in the metadata stored
@@ -214,150 +217,150 @@
 	    (publication date, activation date, etc).  Keys that include
 	    this data may be incompatible with older versions of BIND; the
 	    <option>-C</option> option suppresses them.
-          </para>
-        </listitem>
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-c <replaceable class="parameter">class</replaceable></term>
-        <listitem>
-          <para>
-            Indicates that the DNS record containing the key should have
-            the specified class.  If not specified, class IN is used.
-          </para>
-        </listitem>
+	<term>-c <replaceable class="parameter">class</replaceable></term>
+	<listitem>
+	  <para>
+	    Indicates that the DNS record containing the key should have
+	    the specified class.  If not specified, class IN is used.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-f <replaceable class="parameter">flag</replaceable></term>
-        <listitem>
-          <para>
-            Set the specified flag in the flag field of the KEY/DNSKEY record.
-            The only recognized flags are KSK (Key Signing Key) and REVOKE.
-          </para>
-        </listitem>
+	<term>-f <replaceable class="parameter">flag</replaceable></term>
+	<listitem>
+	  <para>
+	    Set the specified flag in the flag field of the KEY/DNSKEY record.
+	    The only recognized flags are KSK (Key Signing Key) and REVOKE.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-G</term>
-        <listitem>
-          <para>
-            Generate a key, but do not publish it or sign with it.  This
-            option is incompatible with -P and -A.
-          </para>
-        </listitem>
+	<term>-G</term>
+	<listitem>
+	  <para>
+	    Generate a key, but do not publish it or sign with it.  This
+	    option is incompatible with -P and -A.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-h</term>
-        <listitem>
-          <para>
-            Prints a short summary of the options and arguments to
-            <command>dnssec-keyfromlabel</command>.
-          </para>
-        </listitem>
+	<term>-h</term>
+	<listitem>
+	  <para>
+	    Prints a short summary of the options and arguments to
+	    <command>dnssec-keyfromlabel</command>.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-K <replaceable class="parameter">directory</replaceable></term>
-        <listitem>
-          <para>
-            Sets the directory in which the key files are to be written.
-          </para>
-        </listitem>
+	<term>-K <replaceable class="parameter">directory</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the directory in which the key files are to be written.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-k</term>
-        <listitem>
-          <para>
-            Generate KEY records rather than DNSKEY records.
-          </para>
-        </listitem>
+	<term>-k</term>
+	<listitem>
+	  <para>
+	    Generate KEY records rather than DNSKEY records.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-L <replaceable class="parameter">ttl</replaceable></term>
-        <listitem>
-          <para>
-            Sets the default TTL to use for this key when it is converted
-            into a DNSKEY RR.  If the key is imported into a zone,
-            this is the TTL that will be used for it, unless there was
-            already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <literal>0</literal> or <literal>none</literal> removes it.
-          </para>
-        </listitem>
+	<term>-L <replaceable class="parameter">ttl</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the default TTL to use for this key when it is converted
+	    into a DNSKEY RR.  If the key is imported into a zone,
+	    this is the TTL that will be used for it, unless there was
+	    already a DNSKEY RRset in place, in which case the existing TTL
+	    would take precedence.  Setting the default TTL to
+	    <literal>0</literal> or <literal>none</literal> removes it.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-p <replaceable class="parameter">protocol</replaceable></term>
-        <listitem>
-          <para>
-            Sets the protocol value for the key.  The protocol
-            is a number between 0 and 255.  The default is 3 (DNSSEC).
-            Other possible values for this argument are listed in
-            RFC 2535 and its successors.
-          </para>
-        </listitem>
+	<term>-p <replaceable class="parameter">protocol</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the protocol value for the key.  The protocol
+	    is a number between 0 and 255.  The default is 3 (DNSSEC).
+	    Other possible values for this argument are listed in
+	    RFC 2535 and its successors.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-S <replaceable class="parameter">key</replaceable></term>
-        <listitem>
-          <para>
-            Generate a key as an explicit successor to an existing key.
+	<term>-S <replaceable class="parameter">key</replaceable></term>
+	<listitem>
+	  <para>
+	    Generate a key as an explicit successor to an existing key.
 	    The name, algorithm, size, and type of the key will be set
 	    to match the predecessor. The activation date of the new
 	    key will be set to the inactivation date of the existing
 	    one. The publication date will be set to the activation
 	    date minus the prepublication interval, which defaults to
 	    30 days.
-          </para>
-        </listitem>
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-t <replaceable class="parameter">type</replaceable></term>
-        <listitem>
-          <para>
-            Indicates the use of the key.  <option>type</option> must be
-            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-            is AUTHCONF.  AUTH refers to the ability to authenticate
-            data, and CONF the ability to encrypt data.
-          </para>
-        </listitem>
+	<term>-t <replaceable class="parameter">type</replaceable></term>
+	<listitem>
+	  <para>
+	    Indicates the use of the key.  <option>type</option> must be
+	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
+	    is AUTHCONF.  AUTH refers to the ability to authenticate
+	    data, and CONF the ability to encrypt data.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-v <replaceable class="parameter">level</replaceable></term>
-        <listitem>
-          <para>
-            Sets the debugging level.
-          </para>
-        </listitem>
+	<term>-v <replaceable class="parameter">level</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the debugging level.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
 	<term>-V</term>
-        <listitem>
+	<listitem>
 	  <para>
 	    Prints version information.
 	  </para>
-        </listitem>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-y</term>
-        <listitem>
-          <para>
-            Allows DNSSEC key files to be generated even if the key ID
+	<term>-y</term>
+	<listitem>
+	  <para>
+	    Allows DNSSEC key files to be generated even if the key ID
 	    would collide with that of an existing key, in the event of
 	    either key being revoked.  (This is only safe to use if you
-            are sure you won't be using RFC 5011 trust anchor maintenance
-            with either of the keys involved.)
-          </para>
-        </listitem>
+	    are sure you won't be using RFC 5011 trust anchor maintenance
+	    with either of the keys involved.)
+	  </para>
+	</listitem>
       </varlistentry>
 
     </variablelist>
@@ -380,60 +383,80 @@
 
     <variablelist>
       <varlistentry>
-        <term>-P <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which a key is to be published to the zone.
-            After that date, the key will be included in the zone but will
-            not be used to sign it.  If not set, and if the -G option has
-            not been used, the default is "now".
-          </para>
-        </listitem>
+	<term>-P <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which a key is to be published to the zone.
+	    After that date, the key will be included in the zone but will
+	    not be used to sign it.  If not set, and if the -G option has
+	    not been used, the default is "now".
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-A <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which the key is to be activated.  After that
-            date, the key will be included in the zone and used to sign
-            it.  If not set, and if the -G option has not been used, the
-            default is "now".
-          </para>
-        </listitem>
+	<term>-P sync <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the CDS and CDNSKEY records which match
+	    this key are to be published to the zone.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-R <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which the key is to be revoked.  After that
-            date, the key will be flagged as revoked.  It will be included
-            in the zone and will be used to sign it.
-          </para>
-        </listitem>
+	<term>-A <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the key is to be activated.  After that
+	    date, the key will be included in the zone and used to sign
+	    it.  If not set, and if the -G option has not been used, the
+	    default is "now".
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-I <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which the key is to be retired.  After that
-            date, the key will still be included in the zone, but it
-            will not be used to sign it.
-          </para>
-        </listitem>
+	<term>-R <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the key is to be revoked.  After that
+	    date, the key will be flagged as revoked.  It will be included
+	    in the zone and will be used to sign it.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-D <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which the key is to be deleted.  After that
-            date, the key will no longer be included in the zone.  (It
-            may remain in the key repository, however.)
-          </para>
-        </listitem>
+	<term>-I <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the key is to be retired.  After that
+	    date, the key will still be included in the zone, but it
+	    will not be used to sign it.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-D <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the key is to be deleted.  After that
+	    date, the key will no longer be included in the zone.  (It
+	    may remain in the key repository, however.)
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-D sync <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the CDS and CDNSKEY records which match
+	    this key are to be deleted.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
@@ -477,18 +500,18 @@
     </para>
     <itemizedlist>
       <listitem>
-        <para><filename>nnnn</filename> is the key name.
-        </para>
+	<para><filename>nnnn</filename> is the key name.
+	</para>
       </listitem>
       <listitem>
-        <para><filename>aaa</filename> is the numeric representation
-          of the algorithm.
-        </para>
+	<para><filename>aaa</filename> is the numeric representation
+	  of the algorithm.
+	</para>
       </listitem>
       <listitem>
-        <para><filename>iiiii</filename> is the key identifier (or
-          footprint).
-        </para>
+	<para><filename>iiiii</filename> is the key identifier (or
+	  footprint).
+	</para>
       </listitem>
     </itemizedlist>
     <para><command>dnssec-keyfromlabel</command>
@@ -515,10 +538,10 @@
   <refsection><info><title>SEE ALSO</title></info>
 
     <para><citerefentry>
-        <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
+	<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citerefentry>
-        <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
+	<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
       <citetitle>RFC 4034</citetitle>,
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index ddf5ddebcc..997d606907 100644
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -153,13 +153,18 @@ usage(void) {
 	fprintf(stderr, "Timing options:\n");
 	fprintf(stderr, "    -P date/[+-]offset/none: set key publication date "
 						"(default: now)\n");
+	fprintf(stderr, "    -P sync date/[+-]offset/none: set CDS and CDNSKEY "
+						"publication date\n");
 	fprintf(stderr, "    -A date/[+-]offset/none: set key activation date "
 						"(default: now)\n");
 	fprintf(stderr, "    -R date/[+-]offset/none: set key "
-						     "revocation date\n");
+						"revocation date\n");
 	fprintf(stderr, "    -I date/[+-]offset/none: set key "
-						     "inactivation date\n");
+						"inactivation date\n");
 	fprintf(stderr, "    -D date/[+-]offset/none: set key deletion date\n");
+	fprintf(stderr, "    -D sync date/[+-]offset/none: set CDS and CDNSKEY "
+						"deletion date\n");
+
 	fprintf(stderr, "    -G: generate key only; do not set -P or -A\n");
 	fprintf(stderr, "    -C: generate a backward-compatible key, omitting "
 			"all dates\n");
@@ -254,6 +259,9 @@ main(int argc, char **argv) {
 	isc_boolean_t	quiet = ISC_FALSE;
 	isc_boolean_t	show_progress = ISC_FALSE;
 	unsigned char	c;
+	isc_stdtime_t	syncadd = 0, syncdel = 0;
+	isc_boolean_t	setsyncadd = ISC_FALSE;
+	isc_boolean_t	setsyncdel = ISC_FALSE;
 
 	if (argc == 1)
 		usage();
@@ -409,6 +417,17 @@ main(int argc, char **argv) {
 			genonly = ISC_TRUE;
 			break;
 		case 'P':
+			/* -Psync ? */
+			if (isoptarg("sync", argv, usage)) {
+				if (setsyncadd)
+					fatal("-P sync specified more than "
+					      "once");
+
+				syncadd = strtotime(isc_commandline_argument,
+						   now, now, &setsyncadd);
+				break;
+			}
+			(void)isoptarg("dnskey", argv, usage);
 			if (setpub || unsetpub)
 				fatal("-P specified more than once");
 
@@ -441,6 +460,17 @@ main(int argc, char **argv) {
 			unsetinact = !setinact;
 			break;
 		case 'D':
+			/* -Dsync ? */
+			if (isoptarg("sync", argv, usage)) {
+				if (setsyncdel)
+					fatal("-D sync specified more than "
+					      "once");
+
+				syncdel = strtotime(isc_commandline_argument,
+						   now, now, &setsyncdel);
+				break;
+			}
+			(void)isoptarg("dnskey", argv, usage);
 			if (setdel || unsetdel)
 				fatal("-D specified more than once");
 
@@ -973,10 +1003,20 @@ main(int argc, char **argv) {
 						program);
 				dst_key_settime(key, DST_TIME_DELETE, delete);
 			}
+
+			if (setsyncadd)
+				dst_key_settime(key, DST_TIME_SYNCPUBLISH,
+						syncadd);
+
+			if (setsyncdel)
+				dst_key_settime(key, DST_TIME_SYNCDELETE,
+						syncdel);
+
 		} else {
 			if (setpub || setact || setrev || setinact ||
 			    setdel || unsetpub || unsetact ||
-			    unsetrev || unsetinact || unsetdel || genonly)
+			    unsetrev || unsetinact || unsetdel || genonly ||
+			    setsyncadd || setsyncdel)
 				fatal("cannot use -C together with "
 				      "-P, -A, -R, -I, -D, or -G options");
 			/*
diff --git a/bin/dnssec/dnssec-keygen.docbook b/bin/dnssec/dnssec-keygen.docbook
index e5c3e540ac..09d1fa8b23 100644
--- a/bin/dnssec/dnssec-keygen.docbook
+++ b/bin/dnssec/dnssec-keygen.docbook
@@ -21,6 +21,7 @@
     <date>2014-02-06</date>
   </info>
   <refentryinfo>
+    <date>August 21, 2015</date>
     <corpname>ISC</corpname>
     <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
   </refentryinfo>
@@ -70,6 +71,7 @@
       <arg choice="opt" rep="norepeat"><option>-C</option></arg>
       <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">flag</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-G</option></arg>
@@ -78,9 +80,10 @@
       <arg choice="opt" rep="norepeat"><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-k</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-q</option></arg>
       <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
@@ -88,8 +91,8 @@
       <arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-z</option></arg>
       <arg choice="req" rep="norepeat">name</arg>
     </cmdsynopsis>
@@ -115,94 +118,94 @@
 
     <variablelist>
       <varlistentry>
-        <term>-a <replaceable class="parameter">algorithm</replaceable></term>
-        <listitem>
-          <para>
-            Selects the cryptographic algorithm.  For DNSSEC keys, the value
-            of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
+	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
+	<listitem>
+	  <para>
+	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
+	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256 or ECDSAP384SHA384.
 	    For TSIG/TKEY, the value must
-            be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
-            HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512.  These values are
-            case insensitive.
-          </para>
-          <para>
-            If no algorithm is specified, then RSASHA1 will be used by
-            default, unless the <option>-3</option> option is specified,
-            in which case NSEC3RSASHA1 will be used instead.  (If
-            <option>-3</option> is used and an algorithm is specified,
-            that algorithm will be checked for compatibility with NSEC3.)
-          </para>
-          <para>
-            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
-            algorithm, and DSA is recommended.  For TSIG, HMAC-MD5 is
+	    be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
+	    HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512.  These values are
+	    case insensitive.
+	  </para>
+	  <para>
+	    If no algorithm is specified, then RSASHA1 will be used by
+	    default, unless the <option>-3</option> option is specified,
+	    in which case NSEC3RSASHA1 will be used instead.  (If
+	    <option>-3</option> is used and an algorithm is specified,
+	    that algorithm will be checked for compatibility with NSEC3.)
+	  </para>
+	  <para>
+	    Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
+	    algorithm, and DSA is recommended.  For TSIG, HMAC-MD5 is
 	    mandatory.
-          </para>
-          <para>
-            Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
-            automatically set the -T KEY option.
-          </para>
-        </listitem>
+	  </para>
+	  <para>
+	    Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
+	    automatically set the -T KEY option.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-b <replaceable class="parameter">keysize</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the number of bits in the key.  The choice of key
-            size depends on the algorithm used.  RSA keys must be
-            between 512 and 2048 bits.  Diffie Hellman keys must be between
-            128 and 4096 bits.  DSA keys must be between 512 and 1024
-            bits and an exact multiple of 64.  HMAC keys must be
-            between 1 and 512 bits. Elliptic curve algorithms don't need
-            this parameter.
-          </para>
-          <para>
-            The key size does not need to be specified if using a default
-            algorithm.  The default key size is 1024 bits for zone signing
-            keys (ZSKs) and 2048 bits for key signing keys (KSKs,
-            generated with <option>-f KSK</option>).  However, if an
-            algorithm is explicitly specified with the <option>-a</option>,
-            then there is no default key size, and the <option>-b</option>
-            must be used.
-          </para>
-        </listitem>
+	<term>-b <replaceable class="parameter">keysize</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the number of bits in the key.  The choice of key
+	    size depends on the algorithm used.  RSA keys must be
+	    between 512 and 2048 bits.  Diffie Hellman keys must be between
+	    128 and 4096 bits.  DSA keys must be between 512 and 1024
+	    bits and an exact multiple of 64.  HMAC keys must be
+	    between 1 and 512 bits. Elliptic curve algorithms don't need
+	    this parameter.
+	  </para>
+	  <para>
+	    The key size does not need to be specified if using a default
+	    algorithm.  The default key size is 1024 bits for zone signing
+	    keys (ZSKs) and 2048 bits for key signing keys (KSKs,
+	    generated with <option>-f KSK</option>).  However, if an
+	    algorithm is explicitly specified with the <option>-a</option>,
+	    then there is no default key size, and the <option>-b</option>
+	    must be used.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-n <replaceable class="parameter">nametype</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the owner type of the key.  The value of
-            <option>nametype</option> must either be ZONE (for a DNSSEC
-            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-            a host (KEY)),
-            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-            These values are case insensitive.  Defaults to ZONE for DNSKEY
+	<term>-n <replaceable class="parameter">nametype</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the owner type of the key.  The value of
+	    <option>nametype</option> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
+	    a host (KEY)),
+	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
+	    These values are case insensitive.  Defaults to ZONE for DNSKEY
 	    generation.
-          </para>
-        </listitem>
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-3</term>
-        <listitem>
-          <para>
+	<term>-3</term>
+	<listitem>
+	  <para>
 	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-            If this option is used and no algorithm is explicitly
-            set on the command line, NSEC3RSASHA1 will be used by
-            default. Note that RSASHA256, RSASHA512, ECCGOST,
+	    If this option is used and no algorithm is explicitly
+	    set on the command line, NSEC3RSASHA1 will be used by
+	    default. Note that RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256 and ECDSAP384SHA384 algorithms
 	    are NSEC3-capable.
-          </para>
-        </listitem>
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-C</term>
-        <listitem>
-          <para>
+	<term>-C</term>
+	<listitem>
+	  <para>
 	    Compatibility mode:  generates an old-style key, without
 	    any metadata.  By default, <command>dnssec-keygen</command>
 	    will include the key's creation date in the metadata stored
@@ -210,231 +213,231 @@
 	    (publication date, activation date, etc).  Keys that include
 	    this data may be incompatible with older versions of BIND; the
 	    <option>-C</option> option suppresses them.
-          </para>
-        </listitem>
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-c <replaceable class="parameter">class</replaceable></term>
-        <listitem>
-          <para>
-            Indicates that the DNS record containing the key should have
-            the specified class.  If not specified, class IN is used.
-          </para>
-        </listitem>
+	<term>-c <replaceable class="parameter">class</replaceable></term>
+	<listitem>
+	  <para>
+	    Indicates that the DNS record containing the key should have
+	    the specified class.  If not specified, class IN is used.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-E <replaceable class="parameter">engine</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the cryptographic hardware to use, when applicable.
-          </para>
-          <para>
-            When BIND is built with OpenSSL PKCS#11 support, this defaults
-            to the string "pkcs11", which identifies an OpenSSL engine
-            that can drive a cryptographic accelerator or hardware service
-            module.  When BIND is built with native PKCS#11 cryptography
-            (--enable-native-pkcs11), it defaults to the path of the PKCS#11
-            provider library specified via "--with-pkcs11".
-          </para>
-        </listitem>
+	<term>-E <replaceable class="parameter">engine</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the cryptographic hardware to use, when applicable.
+	  </para>
+	  <para>
+	    When BIND is built with OpenSSL PKCS#11 support, this defaults
+	    to the string "pkcs11", which identifies an OpenSSL engine
+	    that can drive a cryptographic accelerator or hardware service
+	    module.  When BIND is built with native PKCS#11 cryptography
+	    (--enable-native-pkcs11), it defaults to the path of the PKCS#11
+	    provider library specified via "--with-pkcs11".
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-f <replaceable class="parameter">flag</replaceable></term>
-        <listitem>
-          <para>
-            Set the specified flag in the flag field of the KEY/DNSKEY record.
-            The only recognized flags are KSK (Key Signing Key) and REVOKE.
-          </para>
-        </listitem>
+	<term>-f <replaceable class="parameter">flag</replaceable></term>
+	<listitem>
+	  <para>
+	    Set the specified flag in the flag field of the KEY/DNSKEY record.
+	    The only recognized flags are KSK (Key Signing Key) and REVOKE.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-G</term>
-        <listitem>
-          <para>
-            Generate a key, but do not publish it or sign with it.  This
-            option is incompatible with -P and -A.
-          </para>
-        </listitem>
+	<term>-G</term>
+	<listitem>
+	  <para>
+	    Generate a key, but do not publish it or sign with it.  This
+	    option is incompatible with -P and -A.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-g <replaceable class="parameter">generator</replaceable></term>
-        <listitem>
-          <para>
-            If generating a Diffie Hellman key, use this generator.
-            Allowed values are 2 and 5.  If no generator
-            is specified, a known prime from RFC 2539 will be used
-            if possible; otherwise the default is 2.
-          </para>
-        </listitem>
+	<term>-g <replaceable class="parameter">generator</replaceable></term>
+	<listitem>
+	  <para>
+	    If generating a Diffie Hellman key, use this generator.
+	    Allowed values are 2 and 5.  If no generator
+	    is specified, a known prime from RFC 2539 will be used
+	    if possible; otherwise the default is 2.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-h</term>
-        <listitem>
-          <para>
-            Prints a short summary of the options and arguments to
-            <command>dnssec-keygen</command>.
-          </para>
-        </listitem>
+	<term>-h</term>
+	<listitem>
+	  <para>
+	    Prints a short summary of the options and arguments to
+	    <command>dnssec-keygen</command>.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-K <replaceable class="parameter">directory</replaceable></term>
-        <listitem>
-          <para>
-            Sets the directory in which the key files are to be written.
-          </para>
-        </listitem>
+	<term>-K <replaceable class="parameter">directory</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the directory in which the key files are to be written.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-k</term>
-        <listitem>
-          <para>
-            Deprecated in favor of -T KEY.
-          </para>
-        </listitem>
+	<term>-k</term>
+	<listitem>
+	  <para>
+	    Deprecated in favor of -T KEY.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-L <replaceable class="parameter">ttl</replaceable></term>
-        <listitem>
-          <para>
-            Sets the default TTL to use for this key when it is converted
-            into a DNSKEY RR.  If the key is imported into a zone,
-            this is the TTL that will be used for it, unless there was
-            already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  If this value is not set and there
-            is no existing DNSKEY RRset, the TTL will default to the
-            SOA TTL. Setting the default TTL to <literal>0</literal>
-            or <literal>none</literal> is the same as leaving it unset.
-          </para>
-        </listitem>
+	<term>-L <replaceable class="parameter">ttl</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the default TTL to use for this key when it is converted
+	    into a DNSKEY RR.  If the key is imported into a zone,
+	    this is the TTL that will be used for it, unless there was
+	    already a DNSKEY RRset in place, in which case the existing TTL
+	    would take precedence.  If this value is not set and there
+	    is no existing DNSKEY RRset, the TTL will default to the
+	    SOA TTL. Setting the default TTL to <literal>0</literal>
+	    or <literal>none</literal> is the same as leaving it unset.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-p <replaceable class="parameter">protocol</replaceable></term>
-        <listitem>
-          <para>
-            Sets the protocol value for the generated key.  The protocol
-            is a number between 0 and 255.  The default is 3 (DNSSEC).
-            Other possible values for this argument are listed in
-            RFC 2535 and its successors.
-          </para>
-        </listitem>
+	<term>-p <replaceable class="parameter">protocol</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the protocol value for the generated key.  The protocol
+	    is a number between 0 and 255.  The default is 3 (DNSSEC).
+	    Other possible values for this argument are listed in
+	    RFC 2535 and its successors.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-q</term>
-        <listitem>
-          <para>
-            Quiet mode: Suppresses unnecessary output, including
-            progress indication.  Without this option, when
-            <command>dnssec-keygen</command> is run interactively
-            to generate an RSA or DSA key pair, it will print a string
-            of symbols to <filename>stderr</filename> indicating the
-            progress of the key generation.  A '.' indicates that a
-            random number has been found which passed an initial
-            sieve test; '+' means a number has passed a single
-            round of the Miller-Rabin primality test; a space
-            means that the number has passed all the tests and is
-            a satisfactory key.
-          </para>
-        </listitem>
+	<term>-q</term>
+	<listitem>
+	  <para>
+	    Quiet mode: Suppresses unnecessary output, including
+	    progress indication.  Without this option, when
+	    <command>dnssec-keygen</command> is run interactively
+	    to generate an RSA or DSA key pair, it will print a string
+	    of symbols to <filename>stderr</filename> indicating the
+	    progress of the key generation.  A '.' indicates that a
+	    random number has been found which passed an initial
+	    sieve test; '+' means a number has passed a single
+	    round of the Miller-Rabin primality test; a space
+	    means that the number has passed all the tests and is
+	    a satisfactory key.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-r <replaceable class="parameter">randomdev</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the source of randomness.  If the operating
-            system does not provide a <filename>/dev/random</filename>
-            or equivalent device, the default source of randomness
-            is keyboard input.  <filename>randomdev</filename>
-            specifies
-            the name of a character device or file containing random
-            data to be used instead of the default.  The special value
-            <filename>keyboard</filename> indicates that keyboard
-            input should be used.
-          </para>
-        </listitem>
+	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the source of randomness.  If the operating
+	    system does not provide a <filename>/dev/random</filename>
+	    or equivalent device, the default source of randomness
+	    is keyboard input.  <filename>randomdev</filename>
+	    specifies
+	    the name of a character device or file containing random
+	    data to be used instead of the default.  The special value
+	    <filename>keyboard</filename> indicates that keyboard
+	    input should be used.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-S <replaceable class="parameter">key</replaceable></term>
-        <listitem>
-          <para>
-            Create a new key which is an explicit successor to an
-            existing key.  The name, algorithm, size, and type of the
-            key will be set to match the existing key.  The activation
-            date of the new key will be set to the inactivation date of
-            the existing one.  The publication date will be set to the
-            activation date minus the prepublication interval, which
-            defaults to 30 days.
-          </para>
-        </listitem>
+	<term>-S <replaceable class="parameter">key</replaceable></term>
+	<listitem>
+	  <para>
+	    Create a new key which is an explicit successor to an
+	    existing key.  The name, algorithm, size, and type of the
+	    key will be set to match the existing key.  The activation
+	    date of the new key will be set to the inactivation date of
+	    the existing one.  The publication date will be set to the
+	    activation date minus the prepublication interval, which
+	    defaults to 30 days.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-s <replaceable class="parameter">strength</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the strength value of the key.  The strength is
-            a number between 0 and 15, and currently has no defined
-            purpose in DNSSEC.
-          </para>
-        </listitem>
+	<term>-s <replaceable class="parameter">strength</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the strength value of the key.  The strength is
+	    a number between 0 and 15, and currently has no defined
+	    purpose in DNSSEC.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-T <replaceable class="parameter">rrtype</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the resource record type to use for the key.
-            <option>rrtype</option> must be either DNSKEY or KEY.  The
-            default is DNSKEY when using a DNSSEC algorithm, but it can be
-            overridden to KEY for use with SIG(0).
-          <para>
-          </para>
-            Using any TSIG algorithm (HMAC-* or DH) forces this option
-            to KEY.
-          </para>
-        </listitem>
+	<term>-T <replaceable class="parameter">rrtype</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies the resource record type to use for the key.
+	    <option>rrtype</option> must be either DNSKEY or KEY.  The
+	    default is DNSKEY when using a DNSSEC algorithm, but it can be
+	    overridden to KEY for use with SIG(0).
+	  <para>
+	  </para>
+	    Using any TSIG algorithm (HMAC-* or DH) forces this option
+	    to KEY.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-t <replaceable class="parameter">type</replaceable></term>
-        <listitem>
-          <para>
-            Indicates the use of the key.  <option>type</option> must be
-            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-            is AUTHCONF.  AUTH refers to the ability to authenticate
-            data, and CONF the ability to encrypt data.
-          </para>
-        </listitem>
+	<term>-t <replaceable class="parameter">type</replaceable></term>
+	<listitem>
+	  <para>
+	    Indicates the use of the key.  <option>type</option> must be
+	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
+	    is AUTHCONF.  AUTH refers to the ability to authenticate
+	    data, and CONF the ability to encrypt data.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-v <replaceable class="parameter">level</replaceable></term>
-        <listitem>
-          <para>
-            Sets the debugging level.
-          </para>
-        </listitem>
+	<term>-v <replaceable class="parameter">level</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the debugging level.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
 	<term>-V</term>
-        <listitem>
+	<listitem>
 	  <para>
 	    Prints version information.
 	  </para>
-        </listitem>
+	</listitem>
       </varlistentry>
 
     </variablelist>
@@ -457,62 +460,82 @@
 
     <variablelist>
       <varlistentry>
-        <term>-P <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which a key is to be published to the zone.
-            After that date, the key will be included in the zone but will
-            not be used to sign it.  If not set, and if the -G option has
-            not been used, the default is "now".
-          </para>
-        </listitem>
+	<term>-P <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which a key is to be published to the zone.
+	    After that date, the key will be included in the zone but will
+	    not be used to sign it.  If not set, and if the -G option has
+	    not been used, the default is "now".
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-A <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which the key is to be activated.  After that
-            date, the key will be included in the zone and used to sign
-            it.  If not set, and if the -G option has not been used, the
-            default is "now".  If set, if and -P is not set, then
-            the publication date will be set to the activation date
-            minus the prepublication interval.
-          </para>
-        </listitem>
+	<term>-P sync <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which CDS and CDNSKEY records that match this
+	    key are to be published to the zone.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-R <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which the key is to be revoked.  After that
-            date, the key will be flagged as revoked.  It will be included
-            in the zone and will be used to sign it.
-          </para>
-        </listitem>
+	<term>-A <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the key is to be activated.  After that
+	    date, the key will be included in the zone and used to sign
+	    it.  If not set, and if the -G option has not been used, the
+	    default is "now".  If set, if and -P is not set, then
+	    the publication date will be set to the activation date
+	    minus the prepublication interval.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-I <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which the key is to be retired.  After that
-            date, the key will still be included in the zone, but it
-            will not be used to sign it.
-          </para>
-        </listitem>
+	<term>-R <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the key is to be revoked.  After that
+	    date, the key will be flagged as revoked.  It will be included
+	    in the zone and will be used to sign it.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-D <replaceable class="parameter">date/offset</replaceable></term>
-        <listitem>
-          <para>
-            Sets the date on which the key is to be deleted.  After that
-            date, the key will no longer be included in the zone.  (It
-            may remain in the key repository, however.)
-          </para>
-        </listitem>
+	<term>-I <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the key is to be retired.  After that
+	    date, the key will still be included in the zone, but it
+	    will not be used to sign it.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-D <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the key is to be deleted.  After that
+	    date, the key will no longer be included in the zone.  (It
+	    may remain in the key repository, however.)
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-D sync <replaceable class="parameter">date/offset</replaceable></term>
+	<listitem>
+	  <para>
+	    Sets the date on which the CDS and CDNSKEY records that match this
+	    key are to be deleted.
+	  </para>
+	</listitem>
       </varlistentry>
 
       <varlistentry>
@@ -557,19 +580,19 @@
     </para>
     <itemizedlist>
       <listitem>
-        <para><filename>nnnn</filename> is the key name.
-        </para>
+	<para><filename>nnnn</filename> is the key name.
+	</para>
       </listitem>
       <listitem>
-        <para><filename>aaa</filename> is the numeric representation
-          of the
-          algorithm.
-        </para>
+	<para><filename>aaa</filename> is the numeric representation
+	  of the
+	  algorithm.
+	</para>
       </listitem>
       <listitem>
-        <para><filename>iiiii</filename> is the key identifier (or
-          footprint).
-        </para>
+	<para><filename>iiiii</filename> is the key identifier (or
+	  footprint).
+	</para>
       </listitem>
     </itemizedlist>
     <para><command>dnssec-keygen</command>
@@ -624,7 +647,7 @@
   <refsection><info><title>SEE ALSO</title></info>
 
     <para><citerefentry>
-        <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
+	<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
       <citetitle>RFC 2539</citetitle>,
diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
index 8d784a624b..c5bd3ae6a7 100644
--- a/bin/dnssec/dnssec-settime.c
+++ b/bin/dnssec/dnssec-settime.c
@@ -78,6 +78,8 @@ usage(void) {
 	fprintf(stderr, "Timing options:\n");
 	fprintf(stderr, "    -P date/[+-]offset/none: set/unset key "
 						     "publication date\n");
+	fprintf(stderr, "    -P sync date/[+-]offset/none: set/unset "
+					"CDS and CDNSKEY publication date\n");
 	fprintf(stderr, "    -A date/[+-]offset/none: set/unset key "
 						     "activation date\n");
 	fprintf(stderr, "    -R date/[+-]offset/none: set/unset key "
@@ -86,9 +88,11 @@ usage(void) {
 						     "inactivation date\n");
 	fprintf(stderr, "    -D date/[+-]offset/none: set/unset key "
 						     "deletion date\n");
+	fprintf(stderr, "    -D sync date/[+-]offset/none: set/unset "
+					"CDS and CDNSKEY deletion date\n");
 	fprintf(stderr, "Printing options:\n");
-	fprintf(stderr, "    -p C/P/A/R/I/D/all: print a particular time "
-						"value or values\n");
+	fprintf(stderr, "    -p C/P/Psync/A/R/I/D/Dsync/all: print a "
+					"particular time value or values\n");
 	fprintf(stderr, "    -u:                 print times in unix epoch "
 						"format\n");
 	fprintf(stderr, "Output:\n");
@@ -161,6 +165,10 @@ main(int argc, char **argv) {
 	isc_boolean_t   epoch = ISC_FALSE;
 	isc_boolean_t   changed = ISC_FALSE;
 	isc_log_t       *log = NULL;
+	isc_stdtime_t	syncadd = 0, syncdel = 0;
+	isc_boolean_t	unsetsyncadd = ISC_FALSE, setsyncadd = ISC_FALSE;
+	isc_boolean_t	unsetsyncdel = ISC_FALSE, setsyncdel = ISC_FALSE;
+	isc_boolean_t	printsyncadd = ISC_FALSE, printsyncdel = ISC_FALSE;
 
 	if (argc == 1)
 		usage();
@@ -198,6 +206,8 @@ main(int argc, char **argv) {
 				printrev = ISC_TRUE;
 				printinact = ISC_TRUE;
 				printdel = ISC_TRUE;
+				printsyncadd = ISC_TRUE;
+				printsyncdel = ISC_TRUE;
 				break;
 			}
 
@@ -207,6 +217,11 @@ main(int argc, char **argv) {
 					printcreate = ISC_TRUE;
 					break;
 				case 'P':
+					if (!strncmp(p, "sync", 3)) {
+						p += 3;
+						printsyncadd = ISC_TRUE;
+						break;
+					}
 					printpub = ISC_TRUE;
 					break;
 				case 'A':
@@ -219,6 +234,11 @@ main(int argc, char **argv) {
 					printinact = ISC_TRUE;
 					break;
 				case 'D':
+					if (!strncmp(p, "sync", 3)) {
+						p += 3;
+						printsyncdel = ISC_TRUE;
+						break;
+					}
 					printdel = ISC_TRUE;
 					break;
 				case ' ':
@@ -254,6 +274,19 @@ main(int argc, char **argv) {
 				fatal("-v must be followed by a number");
 			break;
 		case 'P':
+			/* -Psync ? */
+			if (isoptarg("sync", argv, usage)) {
+				if (unsetsyncadd || setsyncadd)
+					fatal("-P sync specified more than "
+					      "once");
+
+				changed = ISC_TRUE;
+				syncadd = strtotime(isc_commandline_argument,
+						   now, now, &setsyncadd);
+				unsetsyncadd = !setsyncadd;
+				break;
+			}
+			(void)isoptarg("dnskey", argv, usage);
 			if (setpub || unsetpub)
 				fatal("-P specified more than once");
 
@@ -290,6 +323,20 @@ main(int argc, char **argv) {
 			unsetinact = !setinact;
 			break;
 		case 'D':
+			/* -Dsync ? */
+			if (isoptarg("sync", argv, usage)) {
+				if (unsetsyncdel || setsyncdel)
+					fatal("-D sync specified more than "
+					      "once");
+
+				changed = ISC_TRUE;
+				syncdel = strtotime(isc_commandline_argument,
+						   now, now, &setsyncdel);
+				unsetsyncdel = !setsyncdel;
+				break;
+			}
+			/* -Ddnskey ? */
+			(void)isoptarg("dnskey", argv, usage);
 			if (setdel || unsetdel)
 				fatal("-D specified more than once");
 
@@ -533,6 +580,16 @@ main(int argc, char **argv) {
 	else if (unsetdel)
 		dst_key_unsettime(key, DST_TIME_DELETE);
 
+	if (setsyncadd)
+		dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
+	else if (unsetsyncadd)
+		dst_key_unsettime(key, DST_TIME_SYNCPUBLISH);
+
+	if (setsyncdel)
+		dst_key_settime(key, DST_TIME_SYNCDELETE, syncdel);
+	else if (unsetsyncdel)
+		dst_key_unsettime(key, DST_TIME_SYNCDELETE);
+
 	if (setttl)
 		dst_key_setttl(key, ttl);
 
@@ -570,6 +627,14 @@ main(int argc, char **argv) {
 	if (printdel)
 		printtime(key, DST_TIME_DELETE, "Delete", epoch, stdout);
 
+	if (printsyncadd)
+		printtime(key, DST_TIME_SYNCPUBLISH, "SYNC Publish",
+			  epoch, stdout);
+
+	if (printsyncdel)
+		printtime(key, DST_TIME_SYNCDELETE, "SYNC Delete",
+			  epoch, stdout);
+
 	if (changed) {
 		isc_buffer_init(&buf, newname, sizeof(newname));
 		result = dst_key_buildfilename(key, DST_TYPE_PUBLIC, directory,
diff --git a/bin/dnssec/dnssec-settime.docbook b/bin/dnssec/dnssec-settime.docbook
index ceb2fe02aa..8bc5b5898c 100644
--- a/bin/dnssec/dnssec-settime.docbook
+++ b/bin/dnssec/dnssec-settime.docbook
@@ -17,7 +17,7 @@
 <!-- Converted by db4-upgrade version 1.0 -->
 <refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-settime">
   <info>
-    <date>2014-02-06</date>
+    <date>2015-08-21</date>
   </info>
   <refentryinfo>
     <corpname>ISC</corpname>
@@ -53,10 +53,13 @@
       <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg><option>-D sync <replaceable class="parameter">date/offset</replaceable></option></arg>
+
       <arg choice="opt" rep="norepeat"><option>-h</option></arg>
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
       <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
@@ -97,10 +100,10 @@
 
     <variablelist>
       <varlistentry>
-	<term>-f</term>
+        <term>-f</term>
         <listitem>
-	  <para>
-	    Force an update of an old-format key with no metadata fields.
+          <para>
+            Force an update of an old-format key with no metadata fields.
             Without this option, <command>dnssec-settime</command> will
             fail when attempting to update a legacy key.  With this option,
             the key will be recreated in the new format, but with the
@@ -108,7 +111,7 @@
             set to the present time.  If no other values are specified,
             then the key's publication and activation dates will also
             be set to the present time.
-	  </para>
+          </para>
         </listitem>
       </varlistentry>
 
@@ -138,20 +141,20 @@
       </varlistentry>
 
       <varlistentry>
-	<term>-h</term>
+        <term>-h</term>
         <listitem>
-	  <para>
-	    Emit usage message and exit.
-	  </para>
+          <para>
+            Emit usage message and exit.
+          </para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
-	<term>-V</term>
+        <term>-V</term>
         <listitem>
-	  <para>
-	    Prints version information.
-	  </para>
+          <para>
+            Prints version information.
+          </para>
         </listitem>
       </varlistentry>
 
@@ -208,6 +211,16 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>-P sync <replaceable class="parameter">date/offset</replaceable></term>
+        <listitem>
+          <para>
+            Sets the date on which CDS and CDNSKEY records that match this
+            key are to be published to the zone.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-A <replaceable class="parameter">date/offset</replaceable></term>
         <listitem>
@@ -252,6 +265,16 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>-D sync <replaceable class="parameter">date/offset</replaceable></term>
+        <listitem>
+          <para>
+            Sets the date on which the CDS and CDNSKEY records that match this
+            key are to be deleted.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-S <replaceable class="parameter">predecessor key</replaceable></term>
         <listitem>
@@ -305,29 +328,32 @@
 
     <variablelist>
       <varlistentry>
-	<term>-u</term>
+        <term>-u</term>
         <listitem>
-	  <para>
-	    Print times in UNIX epoch format.
-	  </para>
+          <para>
+            Print times in UNIX epoch format.
+          </para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
-        <term>-p <replaceable class="parameter">C/P/A/R/I/D/all</replaceable></term>
+        <term>-p <replaceable class="parameter">C/P/Psync/A/R/I/D/Dsync/all</replaceable></term>
         <listitem>
-	  <para>
-	    Print a specific metadata value or set of metadata values.
+          <para>
+            Print a specific metadata value or set of metadata values.
             The <option>-p</option> option may be followed by one or more
-            of the following letters to indicate which value or values to print:
+            of the following letters or strings to indicate which value
+            or values to print:
             <option>C</option> for the creation date,
             <option>P</option> for the publication date,
+            <option>Psync</option> for the CDS and CDNSKEY publication date,
             <option>A</option> for the activation date,
             <option>R</option> for the revocation date,
-            <option>I</option> for the inactivation date, or
-            <option>D</option> for the deletion date.
+            <option>I</option> for the inactivation date,
+            <option>D</option> for the deletion date, and
+            <option>Dsync</option> for the CDS and CDNSKEY deletion date
             To print all of the metadata, use <option>-p all</option>.
-	  </para>
+          </para>
         </listitem>
       </varlistentry>
 
diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
index 42936414ab..0e25e6733b 100644
--- a/bin/dnssec/dnssectool.c
+++ b/bin/dnssec/dnssectool.c
@@ -27,15 +27,16 @@
 
 #include <isc/base32.h>
 #include <isc/buffer.h>
+#include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/entropy.h>
 #include <isc/heap.h>
 #include <isc/list.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/string.h>
 #include <isc/time.h>
 #include <isc/util.h>
-#include <isc/print.h>
 
 #include <dns/db.h>
 #include <dns/dbiterator.h>
@@ -1834,3 +1835,20 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 		}
 	}
 }
+
+isc_boolean_t
+isoptarg(const char *arg, char **argv, void(*usage)(void)) {
+	if (!strcasecmp(isc_commandline_argument, arg)) {
+		if (argv[isc_commandline_index] == NULL) {
+			fprintf(stderr, "%s: missing argument -%c %s\n",
+				program, isc_commandline_option,
+				isc_commandline_argument);
+			usage();
+		}
+		isc_commandline_argument = argv[isc_commandline_index];
+		/* skip to next arguement */
+		isc_commandline_index++;
+		return (ISC_TRUE);
+	}
+	return (ISC_FALSE);
+}
diff --git a/bin/dnssec/dnssectool.h b/bin/dnssec/dnssectool.h
index 2ad83d3d86..48c4725927 100644
--- a/bin/dnssec/dnssectool.h
+++ b/bin/dnssec/dnssectool.h
@@ -98,4 +98,8 @@ void
 verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 		   dns_name_t *origin, isc_mem_t *mctx,
 		   isc_boolean_t ignore_kskflag, isc_boolean_t keyset_kskonly);
+
+isc_boolean_t
+isoptarg(const char *arg, char **argv, void (*usage)(void));
+
 #endif /* DNSSEC_DNSSECTOOL_H */
diff --git a/bin/tests/system/autosign/clean.sh b/bin/tests/system/autosign/clean.sh
index 32eb915ac8..2ca92e0950 100644
--- a/bin/tests/system/autosign/clean.sh
+++ b/bin/tests/system/autosign/clean.sh
@@ -15,42 +15,44 @@
 # PERFORMANCE OF THIS SOFTWARE.
 
 rm -f */K* */dsset-* */*.signed */trusted.conf */tmp* */*.jnl */*.bk
-rm -f active.key inact.key del.key unpub.key standby.key rev.key
-rm -f activate-now-publish-1day.key
-rm -f nopriv.key vanishing.key del1.key del2.key
-rm -f delayksk.key delayzsk.key autoksk.key autozsk.key
-rm -f missingzsk.key inactivezsk.key
-rm -f nsupdate.out
 rm -f */core
 rm -f */example.bk
 rm -f */named.memstats
+rm -f activate-now-publish-1day.key
+rm -f active.key inact.key del.key unpub.key standby.key rev.key
+rm -f sync.key
+rm -f delayksk.key delayzsk.key autoksk.key autozsk.key
 rm -f dig.out.*
+rm -f digcomp.out.test*
+rm -f missingzsk.key inactivezsk.key
+rm -f nopriv.key vanishing.key del1.key del2.key
+rm -f ns*/named.lock
 rm -f ns1/root.db
 rm -f ns2/example.db
 rm -f ns2/private.secure.example.db ns2/bar.db
+rm -f ns3/*.nzf
 rm -f ns3/autonsec3.example.db
+rm -f ns3/sync.example.db
+rm -f ns3/kg.out ns3/s.out ns3/st.out
+rm -f ns3/nozsk.example.db ns3/inaczsk.example.db
 rm -f ns3/nsec.example.db
+rm -f ns3/nsec3-to-nsec.example.db
 rm -f ns3/nsec3.example.db
 rm -f ns3/nsec3.nsec3.example.db
 rm -f ns3/nsec3.optout.example.db
-rm -f ns3/nsec3-to-nsec.example.db
 rm -f ns3/oldsigs.example.db
 rm -f ns3/optout.example.db
 rm -f ns3/optout.nsec3.example.db
 rm -f ns3/optout.optout.example.db
+rm -f ns3/prepub.example.db
+rm -f ns3/prepub.example.db.in
+rm -f ns3/reconf.example.db
 rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
+rm -f ns3/secure-to-insecure.example.db
+rm -f ns3/secure-to-insecure2.example.db
 rm -f ns3/secure.example.db
 rm -f ns3/secure.nsec3.example.db
 rm -f ns3/secure.optout.example.db
-rm -f ns3/secure-to-insecure.example.db
-rm -f ns3/prepub.example.db
-rm -f ns3/prepub.example.db.in
-rm -f ns3/secure-to-insecure2.example.db
-rm -f ns3/nozsk.example.db ns3/inaczsk.example.db
-rm -f ns3/reconf.example.db
-rm -f ns3/kg.out ns3/s.out ns3/st.out
 rm -f ns3/ttl*.db
+rm -f nsupdate.out
 rm -f signing.out.*
-rm -f ns3/*.nzf
-rm -f digcomp.out.test*
-rm -f ns*/named.lock
diff --git a/bin/tests/system/autosign/ns2/keygen.sh b/bin/tests/system/autosign/ns2/keygen.sh
index a7686e06a4..06e0cabc82 100644
--- a/bin/tests/system/autosign/ns2/keygen.sh
+++ b/bin/tests/system/autosign/ns2/keygen.sh
@@ -20,7 +20,7 @@ SYSTEMTESTTOP=../..
 # Have the child generate subdomain keys and pass DS sets to us.
 ( cd ../ns3 && $SHELL keygen.sh )
 
-for subdomain in secure nsec3 autonsec3 optout rsasha256 rsasha512 nsec3-to-nsec oldsigs
+for subdomain in secure nsec3 autonsec3 optout rsasha256 rsasha512 nsec3-to-nsec oldsigs sync
 do
 	cp ../ns3/dsset-$subdomain.example. .
 done
diff --git a/bin/tests/system/autosign/ns3/keygen.sh b/bin/tests/system/autosign/ns3/keygen.sh
index f2ba8755f9..70532dbf3a 100644
--- a/bin/tests/system/autosign/ns3/keygen.sh
+++ b/bin/tests/system/autosign/ns3/keygen.sh
@@ -262,3 +262,13 @@ setup reconf.example
 cp secure.example.db.in $zonefile
 $KEYGEN -q -3 -r $RANDFILE -fk $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -q -3 -r $RANDFILE $zone > kg.out 2>&1 || dumpit kg.out
+
+#
+# A zone which generates a CDS and CDNSEY RRsets automatically
+#
+setup sync.example
+cp $infile $zonefile
+ksk=`$KEYGEN -3 -q -r $RANDFILE -fk -P sync now $zone 2> kg.out` || dumpit kg.out
+$KEYGEN -3 -q -r $RANDFILE $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}.
+echo ns3/$ksk > ../sync.key
diff --git a/bin/tests/system/autosign/ns3/named.conf b/bin/tests/system/autosign/ns3/named.conf
index dbeebfd633..67135500ff 100644
--- a/bin/tests/system/autosign/ns3/named.conf
+++ b/bin/tests/system/autosign/ns3/named.conf
@@ -243,4 +243,12 @@ zone "inaczsk.example" {
 	allow-update { any; };
 	auto-dnssec maintain;
 };
+
+zone "sync.example" {
+	type master;
+	file "sync.example.db";
+	allow-update { any; };
+	auto-dnssec maintain;
+};
+
 include "trusted.conf";
diff --git a/bin/tests/system/autosign/ns3/sync.example.db.in b/bin/tests/system/autosign/ns3/sync.example.db.in
new file mode 100644
index 0000000000..1aed9c4460
--- /dev/null
+++ b/bin/tests/system/autosign/ns3/sync.example.db.in
@@ -0,0 +1,37 @@
+; Copyright (C) 2015  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+z			A	10.0.0.26
+a.a.a.a.a.a.a.a.a.a.e	A	10.0.0.27
+x			CNAME	a
+
+private			NS	ns.private
+ns.private		A	10.53.0.2
+
+insecure		NS	ns.insecure
+ns.insecure		A	10.53.0.2
diff --git a/bin/tests/system/autosign/tests.sh b/bin/tests/system/autosign/tests.sh
index 6b6ddb7641..3986540498 100644
--- a/bin/tests/system/autosign/tests.sh
+++ b/bin/tests/system/autosign/tests.sh
@@ -1170,5 +1170,33 @@ if [ "$lret" != 0 ]; then ret=$lret; fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:test CDS and CDNSKEY auto generation ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.3 sync.example cds > dig.out.ns3.cdstest$n
+$DIG $DIGOPTS @10.53.0.3 sync.example cdnskey > dig.out.ns3.cdnskeytest$n
+grep -i "sync.example.*in.cds.*[1-9][0-9]* " dig.out.ns3.cdstest$n > /dev/null || ret=1
+grep -i "sync.example.*in.cdnskey.*257 " dig.out.ns3.cdnskeytest$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ "$lret" != 0 ]; then ret=$lret; fi
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:setting CDS and CDNSKEY deletion times and calling 'rndc loadkeys'"
+$SETTIME -D sync now+2 `cat sync.key`
+$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 loadkeys sync.example
+echo "I:waiting for deletion to occur"
+sleep 3
+
+echo "I:checking that the CDS and CDNSKEY are deleted ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.3 sync.example cds > dig.out.ns3.cdstest$n
+$DIG $DIGOPTS @10.53.0.3 sync.example cdnskey > dig.out.ns3.cdnskeytest$n
+grep -i "sync.example.*in.cds.*[1-9][0-9]* " dig.out.ns3.cdstest$n > /dev/null && ret=1
+grep -i "sync.example.*in.cdnskey.*257 " dig.out.ns3.cdnskeytest$n > /dev/null && ret=1
+n=`expr $n + 1`
+if [ "$lret" != 0 ]; then ret=$lret; fi
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status
diff --git a/bin/tests/system/dyndb/driver/driver.c b/bin/tests/system/dyndb/driver/driver.c
index f9c9213a3c..1d0274e35b 100644
--- a/bin/tests/system/dyndb/driver/driver.c
+++ b/bin/tests/system/dyndb/driver/driver.c
@@ -44,7 +44,7 @@ dns_dyndb_version_t dyndb_version;
  * @code
  * dyndb example-name "sample.so" { param1 param2 };
  * @endcode
- * 
+ *
  * @param[in] name User-defined string from dyndb "name" {}; definition
  *                 in named.conf.
  *                 The example above will have name = "example-name".
diff --git a/bin/tests/system/dyndb/driver/log.c b/bin/tests/system/dyndb/driver/log.c
index 2238c7e087..10980424f7 100644
--- a/bin/tests/system/dyndb/driver/log.c
+++ b/bin/tests/system/dyndb/driver/log.c
@@ -9,7 +9,7 @@
 #include <dns/log.h>
 
 #include "log.h"
- 
+
 void
 log_write(int level, const char *format, ...) {
 	va_list args;
diff --git a/bin/tests/system/rrchecker/tests.sh b/bin/tests/system/rrchecker/tests.sh
index 9d47c23c8e..fd79c7e2f3 100644
--- a/bin/tests/system/rrchecker/tests.sh
+++ b/bin/tests/system/rrchecker/tests.sh
@@ -21,15 +21,15 @@ status=0
 t=0
 
 echo "I:class list"
-$RRCHECKER -C > classlist.out 
+$RRCHECKER -C > classlist.out
 diff classlist.out classlist.good || { echo "I:failed"; status=`expr $status + 1`; }
 
 echo "I:type list"
-$RRCHECKER -T > typelist.out 
+$RRCHECKER -T > typelist.out
 diff typelist.out typelist.good || { echo "I:failed"; status=`expr $status + 1`; }
 
 echo "I:private type list"
-$RRCHECKER -P > privatelist.out 
+$RRCHECKER -P > privatelist.out
 diff privatelist.out privatelist.good || { echo "I:failed"; status=`expr $status + 1`; }
 
 myecho() {
@@ -44,7 +44,7 @@ $SHELL ../genzone.sh 0 > tempzone
 $CHECKZONE -Dq . tempzone | sed '/^;/d' |
 while read -r n tt cl ty rest
 do
- 	myecho "$cl $ty $rest" | $RRCHECKER -p > checker.out || {
+	myecho "$cl $ty $rest" | $RRCHECKER -p > checker.out || {
 		ret=1
 		echo "I: '$cl $ty $rest' not handled."
 	}
@@ -61,12 +61,12 @@ ret=0
 $CHECKZONE -Dq . tempzone | sed '/^;/d' |
 while read -r n tt cl ty rest
 do
- 	myecho "$cl $ty $rest" | $RRCHECKER -u > checker.out || {
+	myecho "$cl $ty $rest" | $RRCHECKER -u > checker.out || {
 		ret=1
 		echo "I: '$cl $ty $rest' not converted to unknown record format"
 	}
 	read -r clu tyu restu < checker.out
- 	myecho "$clu $tyu $restu" | $RRCHECKER -p > checker.out || {
+	myecho "$clu $tyu $restu" | $RRCHECKER -p > checker.out || {
 		ret=1
 		echo "I: '$cl $ty $rest' not converted back to canonical format"
 	}
diff --git a/doc/arm/man.dnstap-read.html b/doc/arm/man.dnstap-read.html
index f1c6872c94..50aa7eda6c 100644
--- a/doc/arm/man.dnstap-read.html
+++ b/doc/arm/man.dnstap-read.html
@@ -1,11 +1,11 @@
 <!--
  - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
- - 
+ -
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
- - 
+ -
  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
diff --git a/doc/arm/man.lwresd.html b/doc/arm/man.lwresd.html
index a9500635cd..401818692d 100644
--- a/doc/arm/man.lwresd.html
+++ b/doc/arm/man.lwresd.html
@@ -1,11 +1,11 @@
 <!--
  - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
- - 
+ -
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
- - 
+ -
  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
@@ -103,7 +103,7 @@
             Use <em class="replaceable"><code>config-file</code></em> as the
             configuration file instead of the default,
             <code class="filename">/etc/lwresd.conf</code>.
-	    
+
 	    <code class="option">-c</code> can not be used with <code class="option">-C</code>.
           </p></dd>
 <dt><span class="term">-C <em class="replaceable"><code>config-file</code></em></span></dt>
@@ -117,7 +117,7 @@
 <dd><p>
             Set the daemon's debug level to <em class="replaceable"><code>debug-level</code></em>.
             Debugging traces from <span class="command"><strong>lwresd</strong></span> become
-            		more verbose as the debug level increases.
+		more verbose as the debug level increases.
           </p></dd>
 <dt><span class="term">-f</span></dt>
 <dd><p>
@@ -158,7 +158,7 @@
 <dd><p>
             Listen for lightweight resolver queries on port
             <em class="replaceable"><code>port</code></em>.  If
-            		not specified, the default is port 921.
+		not specified, the default is port 921.
           </p></dd>
 <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
 <dd><p>
diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html
index 2433118222..3bfea8ff1f 100644
--- a/doc/arm/man.named.conf.html
+++ b/doc/arm/man.named.conf.html
@@ -1,11 +1,11 @@
 <!--
  - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
- - 
+ -
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
- - 
+ -
  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index dd97d5c208..db28510cd1 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -660,28 +660,95 @@ dns_dnssec_keyactive(dst_key_t *key, isc_stdtime_t now) {
 	return (ISC_FALSE);
 }
 
+/*%<
+ * Indicate whether a key is scheduled to to have CDS/CDNSKEY records
+ * published now.
+ *
+ * Returns ISC_TRUE iff.
+ *  - SyncPublish is set and in the past, AND
+ *  - SyncDelete is unset or in the future
+ */
+static isc_boolean_t
+syncpublish(dst_key_t *key, isc_stdtime_t now) {
+	isc_result_t result;
+	isc_stdtime_t when;
+	int major, minor;
+
+	/*
+	 * Is this an old-style key?
+	 */
+	result = dst_key_getprivateformat(key, &major, &minor);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+	/*
+	 * Smart signing started with key format 1.3
+	 */
+	if (major == 1 && minor <= 2)
+		return (ISC_FALSE);
+
+	result = dst_key_gettime(key, DST_TIME_SYNCPUBLISH, &when);
+	if (result != ISC_R_SUCCESS)
+		return (ISC_FALSE);
+
+	result = dst_key_gettime(key, DST_TIME_SYNCDELETE, &when);
+	if (result != ISC_R_SUCCESS)
+		return (ISC_TRUE);
+	if (when <= now)
+		return (ISC_FALSE);
+	return (ISC_TRUE);
+}
+
+/*%<
+ * Indicate whether a key is scheduled to to have CDS/CDNSKEY records
+ * deleted now.
+ *
+ * Returns ISC_TRUE iff. SyncDelete is set and in the past.
+ */
+static isc_boolean_t
+syncdelete(dst_key_t *key, isc_stdtime_t now) {
+	isc_result_t result;
+	isc_stdtime_t when;
+	int major, minor;
+
+	/*
+	 * Is this an old-style key?
+	 */
+	result = dst_key_getprivateformat(key, &major, &minor);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+	/*
+	 * Smart signing started with key format 1.3.
+	 */
+	if (major == 1 && minor <= 2)
+		return (ISC_FALSE);
+
+	result = dst_key_gettime(key, DST_TIME_SYNCDELETE, &when);
+	if (result != ISC_R_SUCCESS)
+		return (ISC_FALSE);
+	if (when <= now)
+		return (ISC_TRUE);
+	return (ISC_FALSE);
+}
+
 #define is_zone_key(key) ((dst_key_flags(key) & DNS_KEYFLAG_OWNERMASK) \
 			  == DNS_KEYOWNER_ZONE)
 
 isc_result_t
-dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
+dns_dnssec_findzonekeys3(dns_db_t *db, dns_dbversion_t *ver,
 			 dns_dbnode_t *node, dns_name_t *name,
-			 const char *directory, isc_mem_t *mctx,
-			 unsigned int maxkeys, dst_key_t **keys,
-			 unsigned int *nkeys)
+			 const char *directory, isc_stdtime_t now,
+			 isc_mem_t *mctx, unsigned int maxkeys,
+			 dst_key_t **keys, unsigned int *nkeys)
 {
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_result_t result;
 	dst_key_t *pubkey = NULL;
 	unsigned int count = 0;
-	isc_stdtime_t now;
 
 	REQUIRE(nkeys != NULL);
 	REQUIRE(keys != NULL);
 
-	isc_stdtime_get(&now);
-
 	*nkeys = 0;
 	memset(keys, 0, sizeof(*keys) * maxkeys);
 	dns_rdataset_init(&rdataset);
@@ -827,14 +894,31 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
 	return (result);
 }
 
+isc_result_t
+dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
+			 dns_dbnode_t *node, dns_name_t *name,
+			 const char *directory, isc_mem_t *mctx,
+			 unsigned int maxkeys, dst_key_t **keys,
+			 unsigned int *nkeys)
+{
+	isc_stdtime_t now;
+
+	isc_stdtime_get(&now);
+	return (dns_dnssec_findzonekeys3(db, ver, node, name, directory, now,
+					 mctx, maxkeys, keys, nkeys));
+}
+
 isc_result_t
 dns_dnssec_findzonekeys(dns_db_t *db, dns_dbversion_t *ver,
 			dns_dbnode_t *node, dns_name_t *name, isc_mem_t *mctx,
 			unsigned int maxkeys, dst_key_t **keys,
 			unsigned int *nkeys)
 {
-	return (dns_dnssec_findzonekeys2(db, ver, node, name, NULL, mctx,
-					 maxkeys, keys, nkeys));
+	isc_stdtime_t now;
+
+	isc_stdtime_get(&now);
+	return (dns_dnssec_findzonekeys3(db, ver, node, name, NULL, now,
+					 mctx, maxkeys, keys, nkeys));
 }
 
 isc_result_t
@@ -1323,8 +1407,9 @@ get_hints(dns_dnsseckey_t *key, isc_stdtime_t now) {
  * Get a list of DNSSEC keys from the key repository
  */
 isc_result_t
-dns_dnssec_findmatchingkeys(dns_name_t *origin, const char *directory,
-			    isc_mem_t *mctx, dns_dnsseckeylist_t *keylist)
+dns_dnssec_findmatchingkeys2(dns_name_t *origin, const char *directory,
+			     isc_stdtime_t now, isc_mem_t *mctx,
+			     dns_dnsseckeylist_t *keylist)
 {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_boolean_t dir_open = ISC_FALSE;
@@ -1335,7 +1420,6 @@ dns_dnssec_findmatchingkeys(dns_name_t *origin, const char *directory,
 	char namebuf[DNS_NAME_FORMATSIZE];
 	isc_buffer_t b;
 	unsigned int len, i;
-	isc_stdtime_t now;
 
 	REQUIRE(keylist != NULL);
 	ISC_LIST_INIT(list);
@@ -1351,8 +1435,6 @@ dns_dnssec_findmatchingkeys(dns_name_t *origin, const char *directory,
 	RETERR(isc_dir_open(&dir, directory));
 	dir_open = ISC_TRUE;
 
-	isc_stdtime_get(&now);
-
 	while (isc_dir_read(&dir) == ISC_R_SUCCESS) {
 		if (dir.entry.name[0] != 'K' ||
 		    dir.entry.length < len + 1 ||
@@ -1427,6 +1509,17 @@ dns_dnssec_findmatchingkeys(dns_name_t *origin, const char *directory,
 	return (result);
 }
 
+isc_result_t
+dns_dnssec_findmatchingkeys(dns_name_t *origin, const char *directory,
+			    isc_mem_t *mctx, dns_dnsseckeylist_t *keylist)
+{
+	isc_stdtime_t now;
+
+	isc_stdtime_get(&now);
+	return (dns_dnssec_findmatchingkeys2(origin, directory, now, mctx,
+					     keylist));
+}
+
 /*%
  * Add 'newkey' to 'keylist' if it's not already there.
  *
@@ -1706,6 +1799,36 @@ make_dnskey(dst_key_t *key, unsigned char *buf, int bufsize,
 	return (ISC_R_SUCCESS);
 }
 
+static isc_result_t
+publish(dns_rdata_t *rdata, dns_diff_t *diff, dns_name_t *origin,
+	dns_ttl_t ttl, isc_mem_t *mctx)
+{
+	isc_result_t result;
+	dns_difftuple_t *tuple = NULL;
+
+	RETERR(dns_difftuple_create(mctx, DNS_DIFFOP_ADD, origin, ttl,
+				    rdata, &tuple));
+	dns_diff_appendminimal(diff, &tuple);
+
+ failure:
+	return (result);
+}
+
+static isc_result_t
+delete(dns_rdata_t *rdata, dns_diff_t *diff, dns_name_t *origin,
+	dns_ttl_t ttl, isc_mem_t *mctx)
+{
+	isc_result_t result;
+	dns_difftuple_t *tuple = NULL;
+
+	RETERR(dns_difftuple_create(mctx, DNS_DIFFOP_DEL, origin, ttl,
+				    rdata, &tuple));
+	dns_diff_appendminimal(diff, &tuple);
+
+ failure:
+	return (result);
+}
+
 static isc_result_t
 publish_key(dns_diff_t *diff, dns_dnsseckey_t *key, dns_name_t *origin,
 	    dns_ttl_t ttl, isc_mem_t *mctx, isc_boolean_t allzsk,
@@ -1773,6 +1896,149 @@ remove_key(dns_diff_t *diff, dns_dnsseckey_t *key, dns_name_t *origin,
 	return (result);
 }
 
+static isc_boolean_t
+exists(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
+	isc_result_t result;
+	dns_rdataset_t trdataset;
+
+	dns_rdataset_init(&trdataset);
+	dns_rdataset_clone(rdataset, &trdataset);
+	for (result = dns_rdataset_first(&trdataset);
+	     result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(&trdataset)) {
+		dns_rdata_t current = DNS_RDATA_INIT;
+
+		dns_rdataset_current(&trdataset, &current);
+		if (dns_rdata_compare(rdata, &current) == 0) {
+			dns_rdataset_disassociate(&trdataset);
+			return (ISC_TRUE);
+		}
+	}
+	dns_rdataset_disassociate(&trdataset);
+	return (ISC_FALSE);
+}
+
+isc_result_t
+dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
+		      dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
+		      isc_stdtime_t now, dns_ttl_t ttl, dns_diff_t *diff,
+		      isc_mem_t *mctx)
+{
+	unsigned char dsbuf1[DNS_DS_BUFFERSIZE];
+	unsigned char dsbuf2[DNS_DS_BUFFERSIZE];
+	unsigned char keybuf[DST_KEY_MAXSIZE];
+	isc_result_t result;
+	dns_dnsseckey_t *key;
+
+	for (key = ISC_LIST_HEAD(*keys);
+	     key != NULL;
+	     key = ISC_LIST_NEXT(key, link)) {
+		dns_rdata_t cdsrdata1 = DNS_RDATA_INIT;
+		dns_rdata_t cdsrdata2 = DNS_RDATA_INIT;
+		dns_rdata_t cdnskeyrdata = DNS_RDATA_INIT;
+		dns_name_t *origin = dst_key_name(key->key);
+
+		RETERR(make_dnskey(key->key, keybuf, sizeof(keybuf),
+				   &cdnskeyrdata));
+
+		/*
+		 * XXXMPA we need to be able to specify the DS algorithms
+		 * to be used here and below with rmkeys.
+		 */
+		RETERR(dns_ds_buildrdata(origin, &cdnskeyrdata,
+					 DNS_DSDIGEST_SHA1, dsbuf1,
+					 &cdsrdata1));
+		RETERR(dns_ds_buildrdata(origin, &cdnskeyrdata,
+					 DNS_DSDIGEST_SHA256, dsbuf2,
+					 &cdsrdata2));
+
+		/*
+		 * Now that the we have created the DS records convert
+		 * the rdata to CDNSKEY and CDS for comparison.
+		 */
+		cdnskeyrdata.type = dns_rdatatype_cdnskey;
+		cdsrdata1.type = dns_rdatatype_cds;
+		cdsrdata2.type = dns_rdatatype_cds;
+
+		if (syncpublish(key->key, now)) {
+			if (!dns_rdataset_isassociated(cdnskey) ||
+			    !exists(cdnskey, &cdnskeyrdata))
+				RETERR(publish(&cdnskeyrdata, diff, origin,
+					       ttl, mctx));
+			if (!dns_rdataset_isassociated(cds) ||
+			    !exists(cds, &cdsrdata1))
+				RETERR(publish(&cdsrdata1, diff, origin,
+					       ttl, mctx));
+			if (!dns_rdataset_isassociated(cds) ||
+			    !exists(cds, &cdsrdata2))
+				RETERR(publish(&cdsrdata2, diff, origin,
+					       ttl, mctx));
+		}
+
+		if (dns_rdataset_isassociated(cds) &&
+		    syncdelete(key->key, now)) {
+			if (exists(cds, &cdsrdata1))
+				RETERR(delete(&cdsrdata1, diff, origin,
+					      cds->ttl, mctx));
+			if (exists(cds, &cdsrdata2))
+				RETERR(delete(&cdsrdata2, diff, origin,
+					      cds->ttl, mctx));
+		}
+
+		if (dns_rdataset_isassociated(cdnskey) &&
+		    syncdelete(key->key, now)) {
+			if (exists(cdnskey, &cdnskeyrdata))
+				RETERR(delete(&cdnskeyrdata, diff, origin,
+					      cdnskey->ttl, mctx));
+		}
+	}
+
+	if (!dns_rdataset_isassociated(cds) &&
+	    !dns_rdataset_isassociated(cdnskey))
+		return (ISC_R_SUCCESS);
+
+	/*
+	 * Unconditionaly remove CDS/DNSKEY records for removed keys.
+	 */
+	for (key = ISC_LIST_HEAD(*rmkeys);
+	     key != NULL;
+	     key = ISC_LIST_NEXT(key, link)) {
+		dns_rdata_t cdsrdata1 = DNS_RDATA_INIT;
+		dns_rdata_t cdsrdata2 = DNS_RDATA_INIT;
+		dns_rdata_t cdnskeyrdata = DNS_RDATA_INIT;
+		dns_name_t *origin = dst_key_name(key->key);
+
+		RETERR(make_dnskey(key->key, keybuf, sizeof(keybuf),
+				   &cdnskeyrdata));
+
+		if (dns_rdataset_isassociated(cds)) {
+			RETERR(dns_ds_buildrdata(origin, &cdnskeyrdata,
+						 DNS_DSDIGEST_SHA1, dsbuf1,
+						 &cdsrdata1));
+			RETERR(dns_ds_buildrdata(origin, &cdnskeyrdata,
+						 DNS_DSDIGEST_SHA256, dsbuf2,
+						 &cdsrdata2));
+			if (exists(cds, &cdsrdata1))
+				RETERR(delete(&cdsrdata1, diff, origin,
+					      cds->ttl, mctx));
+			if (exists(cds, &cdsrdata2))
+				RETERR(delete(&cdsrdata2, diff, origin,
+					      cds->ttl, mctx));
+		}
+
+		if (dns_rdataset_isassociated(cdnskey)) {
+			if (exists(cdnskey, &cdnskeyrdata))
+				RETERR(delete(&cdnskeyrdata, diff, origin,
+					      cdnskey->ttl, mctx));
+		}
+	}
+
+	result = ISC_R_SUCCESS;
+
+ failure:
+	return (result);
+}
+
 /*
  * Update 'keys' with information from 'newkeys'.
  *
diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
index b9c232696d..e1a2b978a4 100644
--- a/lib/dns/dst_parse.c
+++ b/lib/dns/dst_parse.c
@@ -67,7 +67,9 @@ static const char *timetags[TIMING_NTAGS] = {
 	"Revoke:",
 	"Inactive:",
 	"Delete:",
-	"DSPublish:"
+	"DSPublish:",
+	"SyncPublish:",
+	"SyncDelete:"
 };
 
 #define NUMERIC_NTAGS (DST_MAX_NUMERIC + 1)
@@ -163,7 +165,7 @@ find_metadata(const char *s, const char *tags[], int ntags) {
 	int i;
 
 	for (i = 0; i < ntags; i++) {
-		if (strcasecmp(s, tags[i]) == 0)
+		if (tags[i] != NULL && strcasecmp(s, tags[i]) == 0)
 			return (i);
 	}
 
diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h
index 936454fc46..a236884a47 100644
--- a/lib/dns/include/dns/dnssec.h
+++ b/lib/dns/include/dns/dnssec.h
@@ -181,6 +181,14 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
 			 const char *directory, isc_mem_t *mctx,
 			 unsigned int maxkeys, dst_key_t **keys,
 			 unsigned int *nkeys);
+
+isc_result_t
+dns_dnssec_findzonekeys3(dns_db_t *db, dns_dbversion_t *ver,
+			 dns_dbnode_t *node, dns_name_t *name,
+			 const char *directory, isc_stdtime_t now,
+			 isc_mem_t *mctx, unsigned int maxkeys,
+			 dst_key_t **keys, unsigned int *nkeys);
+
 /*%<
  * 	Finds a set of zone keys.
  * 	XXX temporary - this should be handled in dns_zone_t.
@@ -290,6 +298,11 @@ dns_dnsseckey_destroy(isc_mem_t *mctx, dns_dnsseckey_t **dkp);
 isc_result_t
 dns_dnssec_findmatchingkeys(dns_name_t *origin, const char *directory,
 			    isc_mem_t *mctx, dns_dnsseckeylist_t *keylist);
+
+isc_result_t
+dns_dnssec_findmatchingkeys2(dns_name_t *origin, const char *directory,
+			     isc_stdtime_t now, isc_mem_t *mctx,
+			     dns_dnsseckeylist_t *keylist);
 /*%<
  * Search 'directory' for K* key files matching the name in 'origin'.
  * Append all such keys, along with use hints gleaned from their
@@ -360,6 +373,16 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
  *
  * On completion, any remaining keys in 'newkeys' are freed.
  */
+
+isc_boolean_t
+dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
+		      dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
+		      isc_stdtime_t now, dns_ttl_t hint_ttl, dns_diff_t *diff,
+		      isc_mem_t *mctx);
+/*%<
+ * Update the CDS and CDNSKEY RRsets, adding and removing keys as needed.
+ */
+
 ISC_LANG_ENDDECLS
 
 #endif /* DNS_DNSSEC_H */
diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
index ea28dfa776..9a85f5c4b3 100644
--- a/lib/dns/include/dst/dst.h
+++ b/lib/dns/include/dst/dst.h
@@ -96,7 +96,9 @@ typedef struct dst_context 	dst_context_t;
 #define DST_TIME_INACTIVE	4
 #define DST_TIME_DELETE 	5
 #define DST_TIME_DSPUBLISH 	6
-#define DST_MAX_TIMES		6
+#define DST_TIME_SYNCPUBLISH 	7
+#define DST_TIME_SYNCDELETE 	8
+#define DST_MAX_TIMES		8
 
 /* Numeric metadata definitions */
 #define DST_NUM_PREDECESSOR	0
diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
index 24a568b738..2557aa78c7 100644
--- a/lib/dns/win32/libdns.def.in
+++ b/lib/dns/win32/libdns.def.in
@@ -296,8 +296,10 @@ dns_dns64_destroy
 dns_dns64_next
 dns_dns64_unlink
 dns_dnssec_findmatchingkeys
+dns_dnssec_findmatchingkeys2
 dns_dnssec_findzonekeys
 dns_dnssec_findzonekeys2
+dns_dnssec_findzonekeys3
 dns_dnssec_keyactive
 dns_dnssec_keyfromrdata
 dns_dnssec_keylistfromrdataset
@@ -305,6 +307,8 @@ dns_dnssec_selfsigns
 dns_dnssec_sign
 dns_dnssec_signmessage
 dns_dnssec_signs
+dns_dnssec_syncupdate
+dns_dnssec_syncupdate
 dns_dnssec_updatekeys
 dns_dnssec_verify
 dns_dnssec_verify2
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 2f691583c9..d38f11f50a 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -5787,7 +5787,7 @@ was_dumping(dns_zone_t *zone) {
 
 static isc_result_t
 find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
-	       isc_mem_t *mctx, unsigned int maxkeys,
+	       isc_stdtime_t now, isc_mem_t *mctx, unsigned int maxkeys,
 	       dst_key_t **keys, unsigned int *nkeys)
 {
 	isc_result_t result;
@@ -5796,8 +5796,8 @@ find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 
 	CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node));
 	memset(keys, 0, sizeof(*keys) * maxkeys);
-	result = dns_dnssec_findzonekeys2(db, ver, node, dns_db_origin(db),
-					  directory, mctx, maxkeys, keys,
+	result = dns_dnssec_findzonekeys3(db, ver, node, dns_db_origin(db),
+					  directory, now, mctx, maxkeys, keys,
 					  nkeys);
 	if (result == ISC_R_NOTFOUND)
 		result = ISC_R_SUCCESS;
@@ -6240,8 +6240,10 @@ zone_resigninc(dns_zone_t *zone) {
 		goto failure;
 	}
 
-	result = find_zone_keys(zone, db, version, zone->mctx, DNS_MAXZONEKEYS,
-				zone_keys, &nkeys);
+	isc_stdtime_get(&now);
+
+	result = find_zone_keys(zone, db, version, now, zone->mctx,
+				DNS_MAXZONEKEYS, zone_keys, &nkeys);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "zone_resigninc:find_zone_keys -> %s",
@@ -6249,7 +6251,6 @@ zone_resigninc(dns_zone_t *zone) {
 		goto failure;
 	}
 
-	isc_stdtime_get(&now);
 	inception = now - 3600;	/* Allow for clock skew. */
 	soaexpire = now + dns_zone_getsigvalidityinterval(zone);
 	/*
@@ -7173,7 +7174,9 @@ zone_nsec3chain(dns_zone_t *zone) {
 		goto failure;
 	}
 
-	result = find_zone_keys(zone, db, version, zone->mctx,
+	isc_stdtime_get(&now);
+
+	result = find_zone_keys(zone, db, version, now, zone->mctx,
 				DNS_MAXZONEKEYS, zone_keys, &nkeys);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
@@ -7182,7 +7185,6 @@ zone_nsec3chain(dns_zone_t *zone) {
 		goto failure;
 	}
 
-	isc_stdtime_get(&now);
 	inception = now - 3600;	/* Allow for clock skew. */
 	soaexpire = now + dns_zone_getsigvalidityinterval(zone);
 
@@ -8026,7 +8028,9 @@ zone_sign(dns_zone_t *zone) {
 		goto failure;
 	}
 
-	result = find_zone_keys(zone, db, version, zone->mctx,
+	isc_stdtime_get(&now);
+
+	result = find_zone_keys(zone, db, version, now, zone->mctx,
 				DNS_MAXZONEKEYS, zone_keys, &nkeys);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
@@ -8035,7 +8039,6 @@ zone_sign(dns_zone_t *zone) {
 		goto failure;
 	}
 
-	isc_stdtime_get(&now);
 	inception = now - 3600;	/* Allow for clock skew. */
 	soaexpire = now + dns_zone_getsigvalidityinterval(zone);
 
@@ -17070,17 +17073,17 @@ add_signing_records(dns_db_t *db, dns_rdatatype_t privatetype,
 
 static isc_result_t
 sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
-	  dns_diff_t *diff, zonediff_t *zonediff)
+	  isc_stdtime_t now, dns_diff_t *diff, zonediff_t *zonediff)
 {
 	isc_result_t result;
-	isc_stdtime_t now, inception, soaexpire;
+	isc_stdtime_t inception, soaexpire;
 	isc_boolean_t check_ksk, keyset_kskonly;
 	dst_key_t *zone_keys[DNS_MAXZONEKEYS];
 	unsigned int nkeys = 0, i;
 	dns_difftuple_t *tuple;
 
-	result = find_zone_keys(zone, db, ver, zone->mctx, DNS_MAXZONEKEYS,
-				zone_keys, &nkeys);
+	result = find_zone_keys(zone, db, ver, now, zone->mctx,
+				DNS_MAXZONEKEYS, zone_keys, &nkeys);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "sign_apex:find_zone_keys -> %s",
@@ -17088,7 +17091,6 @@ sign_apex(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 		return (result);
 	}
 
-	isc_stdtime_get(&now);
 	inception = now - 3600;	/* Allow for clock skew. */
 	soaexpire = now + dns_zone_getsigvalidityinterval(zone);
 
@@ -17286,7 +17288,7 @@ zone_rekey(dns_zone_t *zone) {
 	dns_db_t *db = NULL;
 	dns_dbnode_t *node = NULL;
 	dns_dbversion_t *ver = NULL;
-	dns_rdataset_t soaset, soasigs, keyset, keysigs;
+	dns_rdataset_t cdsset, soaset, soasigs, keyset, keysigs, cdnskeyset;
 	dns_dnsseckeylist_t dnskeys, keys, rmkeys;
 	dns_dnsseckey_t *key;
 	dns_diff_t diff, _sig_diff;
@@ -17311,6 +17313,8 @@ zone_rekey(dns_zone_t *zone) {
 	dns_rdataset_init(&soasigs);
 	dns_rdataset_init(&keyset);
 	dns_rdataset_init(&keysigs);
+	dns_rdataset_init(&cdsset);
+	dns_rdataset_init(&cdnskeyset);
 	dir = dns_zone_getkeydirectory(zone);
 	mctx = zone->mctx;
 	dns_diff_init(mctx, &diff);
@@ -17345,13 +17349,27 @@ zone_rekey(dns_zone_t *zone) {
 	} else if (result != ISC_R_NOTFOUND)
 		goto failure;
 
+
+	/* Get the CDS rdataset */
+	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_cds,
+				     dns_rdatatype_none, 0, &cdsset, NULL);
+	if (result != ISC_R_SUCCESS && dns_rdataset_isassociated(&cdsset))
+		dns_rdataset_disassociate(&cdsset);
+
+	/* Get the CDNSKEY rdataset */
+	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_cdnskey,
+				     dns_rdatatype_none, 0, &cdnskeyset, NULL);
+	if (result != ISC_R_SUCCESS && dns_rdataset_isassociated(&cdnskeyset))
+		dns_rdataset_disassociate(&cdnskeyset);
+
 	/*
 	 * True when called from "rndc sign".  Indicates the zone should be
 	 * fully signed now.
 	 */
 	fullsign = ISC_TF(DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_FULLSIGN) != 0);
 
-	result = dns_dnssec_findmatchingkeys(&zone->origin, dir, mctx, &keys);
+	result = dns_dnssec_findmatchingkeys2(&zone->origin, dir, now, mctx,
+					      &keys);
 	if (result == ISC_R_SUCCESS) {
 		isc_boolean_t check_ksk;
 		check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);
@@ -17360,9 +17378,10 @@ zone_rekey(dns_zone_t *zone) {
 					       &zone->origin, ttl, &diff,
 					       ISC_TF(!check_ksk),
 					       mctx, logmsg);
-
-		/* Keys couldn't be updated for some reason;
-		 * try again later. */
+		/*
+		 * Keys couldn't be updated for some reason;
+		 * try again later.
+		 */
 		if (result != ISC_R_SUCCESS) {
 			dns_zone_log(zone, ISC_LOG_ERROR, "zone_rekey:"
 				     "couldn't update zone keys: %s",
@@ -17370,6 +17389,19 @@ zone_rekey(dns_zone_t *zone) {
 			goto failure;
 		}
 
+		/*
+		 * Update CDS / CDNSKEY records.
+		 */
+		result = dns_dnssec_syncupdate(&dnskeys, &rmkeys, &cdsset,
+					       &cdnskeyset, now, ttl,
+					       &diff, mctx);
+		if (result != ISC_R_SUCCESS) {
+			dns_zone_log(zone, ISC_LOG_ERROR, "zone_rekey:"
+				     "couldn't update CDS/CDNSKEY: %s",
+				     isc_result_totext(result));
+			goto failure;
+		}
+
 		/*
 		 * See if any pre-existing keys have newly become active;
 		 * also, see if any new key is for a new algorithm, as in that
@@ -17413,7 +17445,7 @@ zone_rekey(dns_zone_t *zone) {
 			CHECK(update_soa_serial(db, ver, &diff, mctx,
 						zone->updatemethod));
 			CHECK(add_chains(zone, db, ver, &diff));
-			CHECK(sign_apex(zone, db, ver, &diff, &zonediff));
+			CHECK(sign_apex(zone, db, ver, now, &diff, &zonediff));
 			CHECK(zone_journal(zone, zonediff.diff, NULL,
 					   "zone_rekey"));
 			commit = ISC_TRUE;
@@ -17596,12 +17628,16 @@ zone_rekey(dns_zone_t *zone) {
 
 	if (ver != NULL)
 		dns_db_closeversion(db, &ver, ISC_FALSE);
+	if (dns_rdataset_isassociated(&cdsset))
+		dns_rdataset_disassociate(&cdsset);
 	if (dns_rdataset_isassociated(&keyset))
 		dns_rdataset_disassociate(&keyset);
 	if (dns_rdataset_isassociated(&keysigs))
 		dns_rdataset_disassociate(&keysigs);
 	if (dns_rdataset_isassociated(&soasigs))
 		dns_rdataset_disassociate(&soasigs);
+	if (dns_rdataset_isassociated(&cdnskeyset))
+		dns_rdataset_disassociate(&cdnskeyset);
 	if (node != NULL)
 		dns_db_detachnode(db, &node);
 	if (db != NULL)
diff --git a/lib/isc/win32/libisc.mak.in b/lib/isc/win32/libisc.mak.in
index beb6a90866..8c129aa25b 100644
--- a/lib/isc/win32/libisc.mak.in
+++ b/lib/isc/win32/libisc.mak.in
@@ -2,28 +2,28 @@
 !IF "$(CFG)" == ""
 CFG=libisc - @PLATFORM@ Debug
 !MESSAGE No configuration specified. Defaulting to libisc - @PLATFORM@ Debug.
-!ENDIF 
+!ENDIF
 
 !IF "$(CFG)" != "libisc - @PLATFORM@ Release" && "$(CFG)" != "libisc - @PLATFORM@ Debug"
 !MESSAGE Invalid configuration "$(CFG)" specified.
 !MESSAGE You can specify a configuration when running NMAKE
 !MESSAGE by defining the macro CFG on the command line. For example:
-!MESSAGE 
+!MESSAGE
 !MESSAGE NMAKE /f "libisc.mak" CFG="libisc - @PLATFORM@ Debug"
-!MESSAGE 
+!MESSAGE
 !MESSAGE Possible choices for configuration are:
-!MESSAGE 
+!MESSAGE
 !MESSAGE "libisc - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Dynamic-Link Library")
 !MESSAGE "libisc - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Dynamic-Link Library")
-!MESSAGE 
+!MESSAGE
 !ERROR An invalid configuration is specified.
-!ENDIF 
+!ENDIF
 
 !IF "$(OS)" == "Windows_NT"
 NULL=
-!ELSE 
+!ELSE
 NULL=nul
-!ENDIF 
+!ENDIF
 
 CPP=cl.exe
 MTL=midl.exe
@@ -216,17 +216,17 @@ CLEAN :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
 
 @IF PKCS11
-CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" /I "include" /I "../include" /I "win32" /I "../../isccfg/include" /I "../../dns/win32/include" /I "../../dns/include" @LIBXML2_INC@ @OPENSSL_INC@ /D "BIND9" @CRYPTO@ @PK11_LIB_LOCATION@ /D "WIN32" /D "NDEBUG" /D "__STDC__" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "LIBISC_EXPORTS" /Fp"$(INTDIR)\libisc.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" /I "include" /I "../include" /I "win32" /I "../../isccfg/include" /I "../../dns/win32/include" /I "../../dns/include" @LIBXML2_INC@ @OPENSSL_INC@ /D "BIND9" @CRYPTO@ @PK11_LIB_LOCATION@ /D "WIN32" /D "NDEBUG" /D "__STDC__" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "LIBISC_EXPORTS" /Fp"$(INTDIR)\libisc.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c
 @ELSE PKCS11
-CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" /I "include" /I "../include" /I "win32" /I "../../isccfg/include" @LIBXML2_INC@ @OPENSSL_INC@ /D "BIND9" /D "WIN32" /D "NDEBUG" /D "__STDC__" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "LIBISC_EXPORTS" /Fp"$(INTDIR)\libisc.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" /I "include" /I "../include" /I "win32" /I "../../isccfg/include" @LIBXML2_INC@ @OPENSSL_INC@ /D "BIND9" /D "WIN32" /D "NDEBUG" /D "__STDC__" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /D "LIBISC_EXPORTS" /Fp"$(INTDIR)\libisc.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c
 @END PKCS11
-MTL_PROJ=/nologo /D "NDEBUG" /mktyplib203 /win32 
+MTL_PROJ=/nologo /D "NDEBUG" /mktyplib203 /win32
 BSC32=bscmake.exe
-BSC32_FLAGS=/nologo /o"$(OUTDIR)\libisc.bsc" 
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\libisc.bsc"
 BSC32_SBRS= \
 	
 LINK32=link.exe
-LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib $(LIBXML) @OPENSSL_LIB@ /nologo /dll /incremental:no /pdb:"$(OUTDIR)\libisc.pdb" @MACHINE@ /def:".\libisc.def" /out:"../../../Build/Release/libisc.dll" /implib:"$(OUTDIR)\libisc.lib" 
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib $(LIBXML) @OPENSSL_LIB@ /nologo /dll /incremental:no /pdb:"$(OUTDIR)\libisc.pdb" @MACHINE@ /def:".\libisc.def" /out:"../../../Build/Release/libisc.dll" /implib:"$(OUTDIR)\libisc.lib"
 DEF_FILE= \
 	".\libisc.def"
 LINK32_OBJS= \
@@ -535,13 +535,13 @@ CLEAN :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
 
 @IF PKCS11
-CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" /I "include" /I "../include" /I "win32" /I "../../isccfg/include" /I "../../dns/win32/include" /I "../../dns/include" @LIBXML2_INC@ @OPENSSL_INC@ /D "BIND9" @CRYPTO@ @PK11_LIB_LOCATION@ /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /D "_USRDLL" /D "LIBISC_EXPORTS" /FR"$(INTDIR)\\" /Fp"$(INTDIR)\libisc.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" /I "include" /I "../include" /I "win32" /I "../../isccfg/include" /I "../../dns/win32/include" /I "../../dns/include" @LIBXML2_INC@ @OPENSSL_INC@ /D "BIND9" @CRYPTO@ @PK11_LIB_LOCATION@ /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /D "_USRDLL" /D "LIBISC_EXPORTS" /FR"$(INTDIR)\\" /Fp"$(INTDIR)\libisc.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c
 @ELSE PKCS11
-CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" /I "include" /I "../include" /I "win32" /I "../../isccfg/include" @LIBXML2_INC@ @OPENSSL_INC@ /D "BIND9" /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /D "_USRDLL" /D "LIBISC_EXPORTS" /FR"$(INTDIR)\\" /Fp"$(INTDIR)\libisc.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" /I "include" /I "../include" /I "win32" /I "../../isccfg/include" @LIBXML2_INC@ @OPENSSL_INC@ /D "BIND9" /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /D "_USRDLL" /D "LIBISC_EXPORTS" /FR"$(INTDIR)\\" /Fp"$(INTDIR)\libisc.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c
 @END PKCS11
-MTL_PROJ=/nologo /D "_DEBUG" /mktyplib203 /win32 
+MTL_PROJ=/nologo /D "_DEBUG" /mktyplib203 /win32
 BSC32=bscmake.exe
-BSC32_FLAGS=/nologo /o"$(OUTDIR)\libisc.bsc" 
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\libisc.bsc"
 BSC32_SBRS= \
 	"$(INTDIR)\app.sbr" \
 	"$(INTDIR)\condition.sbr" \
@@ -644,7 +644,7 @@ BSC32_SBRS= \
 <<
 
 LINK32=link.exe
-LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib $(LIBXML) @OPENSSL_LIB@ /nologo /dll /incremental:yes /pdb:"$(OUTDIR)\libisc.pdb" /map:"$(INTDIR)\libisc.map" /debug @MACHINE@ /def:".\libisc.def" /out:"../../../Build/Debug/libisc.dll" /implib:"$(OUTDIR)\libisc.lib" /pdbtype:sept 
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib $(LIBXML) @OPENSSL_LIB@ /nologo /dll /incremental:yes /pdb:"$(OUTDIR)\libisc.pdb" /map:"$(INTDIR)\libisc.map" /debug @MACHINE@ /def:".\libisc.def" /out:"../../../Build/Debug/libisc.dll" /implib:"$(OUTDIR)\libisc.lib" /pdbtype:sept
 DEF_FILE= \
 	".\libisc.def"
 LINK32_OBJS= \
@@ -749,46 +749,46 @@ LINK32_OBJS= \
 <<
   $(_VC_MANIFEST_EMBED_DLL)
 
-!ENDIF 
+!ENDIF
 
 .c{$(INTDIR)}.obj::
    $(CPP) @<<
-   $(CPP_PROJ) $< 
+   $(CPP_PROJ) $<
 <<
 
 .cpp{$(INTDIR)}.obj::
    $(CPP) @<<
-   $(CPP_PROJ) $< 
+   $(CPP_PROJ) $<
 <<
 
 .cxx{$(INTDIR)}.obj::
    $(CPP) @<<
-   $(CPP_PROJ) $< 
+   $(CPP_PROJ) $<
 <<
 
 .c{$(INTDIR)}.sbr::
    $(CPP) @<<
-   $(CPP_PROJ) $< 
+   $(CPP_PROJ) $<
 <<
 
 .cpp{$(INTDIR)}.sbr::
    $(CPP) @<<
-   $(CPP_PROJ) $< 
+   $(CPP_PROJ) $<
 <<
 
 .cxx{$(INTDIR)}.sbr::
    $(CPP) @<<
-   $(CPP_PROJ) $< 
+   $(CPP_PROJ) $<
 <<
 
 
 !IF "$(NO_EXTERNAL_DEPS)" != "1"
 !IF EXISTS("libisc.dep")
 !INCLUDE "libisc.dep"
-!ELSE 
+!ELSE
 !MESSAGE Warning: cannot find "libisc.dep"
-!ENDIF 
-!ENDIF 
+!ENDIF
+!ENDIF
 
 
 !IF "$(CFG)" == "libisc - @PLATFORM@ Release" || "$(CFG)" == "libisc - @PLATFORM@ Debug"
@@ -806,7 +806,7 @@ SOURCE=.\app.c
 "$(INTDIR)\app.obj"	"$(INTDIR)\app.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\condition.c
 
@@ -822,7 +822,7 @@ SOURCE=.\condition.c
 "$(INTDIR)\condition.obj"	"$(INTDIR)\condition.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\dir.c
 
@@ -838,7 +838,7 @@ SOURCE=.\dir.c
 "$(INTDIR)\dir.obj"	"$(INTDIR)\dir.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\DLLMain.c
 
@@ -854,7 +854,7 @@ SOURCE=.\DLLMain.c
 "$(INTDIR)\DLLMain.obj"	"$(INTDIR)\DLLMain.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\entropy.c
 
@@ -870,7 +870,7 @@ SOURCE=.\entropy.c
 "$(INTDIR)\entropy.obj"	"$(INTDIR)\entropy.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\errno2result.c
 
@@ -886,7 +886,7 @@ SOURCE=.\errno2result.c
 "$(INTDIR)\errno2result.obj"	"$(INTDIR)\errno2result.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\file.c
 
@@ -902,7 +902,7 @@ SOURCE=.\file.c
 "$(INTDIR)\file.obj"	"$(INTDIR)\file.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\fsaccess.c
 
@@ -918,7 +918,7 @@ SOURCE=.\fsaccess.c
 "$(INTDIR)\fsaccess.obj"	"$(INTDIR)\fsaccess.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\interfaceiter.c
 
@@ -934,7 +934,7 @@ SOURCE=.\interfaceiter.c
 "$(INTDIR)\interfaceiter.obj"	"$(INTDIR)\interfaceiter.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\ipv6.c
 
@@ -950,7 +950,7 @@ SOURCE=.\ipv6.c
 "$(INTDIR)\ipv6.obj"	"$(INTDIR)\ipv6.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 
 SOURCE=.\keyboard.c
@@ -967,7 +967,7 @@ SOURCE=.\keyboard.c
 "$(INTDIR)\keyboard.obj"	"$(INTDIR)\keyboard.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\meminfo.c
 
@@ -983,7 +983,7 @@ SOURCE=.\meminfo.c
 "$(INTDIR)\meminfo.obj"	"$(INTDIR)\meminfo.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\net.c
 
@@ -999,7 +999,7 @@ SOURCE=.\net.c
 "$(INTDIR)\net.obj"	"$(INTDIR)\net.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\ntpaths.c
 
@@ -1015,7 +1015,7 @@ SOURCE=.\ntpaths.c
 "$(INTDIR)\ntpaths.obj"	"$(INTDIR)\ntpaths.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\once.c
 
@@ -1031,7 +1031,7 @@ SOURCE=.\once.c
 "$(INTDIR)\once.obj"	"$(INTDIR)\once.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\os.c
 
@@ -1047,7 +1047,7 @@ SOURCE=.\os.c
 "$(INTDIR)\os.obj"	"$(INTDIR)\os.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\pk11_api.c
 
@@ -1065,7 +1065,7 @@ SOURCE=.\pk11_api.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\resource.c
 
@@ -1081,7 +1081,7 @@ SOURCE=.\resource.c
 "$(INTDIR)\resource.obj"	"$(INTDIR)\resource.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\socket.c
 
@@ -1097,7 +1097,7 @@ SOURCE=.\socket.c
 "$(INTDIR)\socket.obj"	"$(INTDIR)\socket.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\stdio.c
 
@@ -1113,7 +1113,7 @@ SOURCE=.\stdio.c
 "$(INTDIR)\stdio.obj"	"$(INTDIR)\stdio.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\stdtime.c
 
@@ -1129,7 +1129,7 @@ SOURCE=.\stdtime.c
 "$(INTDIR)\stdtime.obj"	"$(INTDIR)\stdtime.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\strerror.c
 
@@ -1145,7 +1145,7 @@ SOURCE=.\strerror.c
 "$(INTDIR)\strerror.obj"	"$(INTDIR)\strerror.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\syslog.c
 
@@ -1161,7 +1161,7 @@ SOURCE=.\syslog.c
 "$(INTDIR)\syslog.obj"	"$(INTDIR)\syslog.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\thread.c
 
@@ -1177,7 +1177,7 @@ SOURCE=.\thread.c
 "$(INTDIR)\thread.obj"	"$(INTDIR)\thread.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\time.c
 
@@ -1193,7 +1193,7 @@ SOURCE=.\time.c
 "$(INTDIR)\time.obj"	"$(INTDIR)\time.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\version.c
 
@@ -1209,7 +1209,7 @@ SOURCE=.\version.c
 "$(INTDIR)\version.obj"	"$(INTDIR)\version.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=.\win32os.c
 
@@ -1225,7 +1225,7 @@ SOURCE=.\win32os.c
 "$(INTDIR)\win32os.obj"	"$(INTDIR)\win32os.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 
 @IF AES
 SOURCE=..\aes.c
@@ -1242,7 +1242,7 @@ SOURCE=..\aes.c
 "$(INTDIR)\aes.obj"	"$(INTDIR)\aes.sbr" : $(SOURCE) "$(INTDIR)"
 
 
-!ENDIF 
+!ENDIF
 @END AES
 
 SOURCE=..\assertions.c
@@ -1261,7 +1261,7 @@ SOURCE=..\assertions.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\backtrace.c
 
@@ -1279,7 +1279,7 @@ SOURCE=..\backtrace.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\backtrace-emptytbl.c
 
@@ -1297,7 +1297,7 @@ SOURCE=..\backtrace-emptytbl.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\base32.c
 
@@ -1315,7 +1315,7 @@ SOURCE=..\base32.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\base64.c
 
@@ -1333,7 +1333,7 @@ SOURCE=..\base64.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\bind9.c
 
@@ -1351,7 +1351,7 @@ SOURCE=..\bind9.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\buffer.c
 
@@ -1369,7 +1369,7 @@ SOURCE=..\buffer.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\bufferlist.c
 
@@ -1387,7 +1387,7 @@ SOURCE=..\bufferlist.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\commandline.c
 
@@ -1405,7 +1405,7 @@ SOURCE=..\commandline.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\counter.c
 
@@ -1423,7 +1423,7 @@ SOURCE=..\counter.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\crc64.c
 
@@ -1441,7 +1441,7 @@ SOURCE=..\crc64.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\error.c
 
@@ -1459,7 +1459,7 @@ SOURCE=..\error.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\event.c
 
@@ -1477,7 +1477,7 @@ SOURCE=..\event.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\hash.c
 
@@ -1495,7 +1495,7 @@ SOURCE=..\hash.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\heap.c
 
@@ -1513,7 +1513,7 @@ SOURCE=..\heap.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\hex.c
 
@@ -1531,7 +1531,7 @@ SOURCE=..\hex.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\hmacmd5.c
 
@@ -1549,7 +1549,7 @@ SOURCE=..\hmacmd5.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\hmacsha.c
 
@@ -1567,7 +1567,7 @@ SOURCE=..\hmacsha.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\httpd.c
 
@@ -1585,7 +1585,7 @@ SOURCE=..\httpd.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\inet_aton.c
 
@@ -1603,7 +1603,7 @@ SOURCE=..\inet_aton.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\inet_ntop.c
 
@@ -1621,7 +1621,7 @@ SOURCE=..\inet_ntop.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\inet_pton.c
 
@@ -1639,7 +1639,7 @@ SOURCE=..\inet_pton.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\iterated_hash.c
 
@@ -1657,7 +1657,7 @@ SOURCE=..\iterated_hash.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\lex.c
 
@@ -1675,7 +1675,7 @@ SOURCE=..\lex.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\lfsr.c
 
@@ -1693,7 +1693,7 @@ SOURCE=..\lfsr.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\lib.c
 
@@ -1711,7 +1711,7 @@ SOURCE=..\lib.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\log.c
 
@@ -1729,7 +1729,7 @@ SOURCE=..\log.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\md5.c
 
@@ -1747,7 +1747,7 @@ SOURCE=..\md5.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\mem.c
 
@@ -1765,7 +1765,7 @@ SOURCE=..\mem.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\nls\msgcat.c
 
@@ -1783,7 +1783,7 @@ SOURCE=..\nls\msgcat.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\mutexblock.c
 
@@ -1801,7 +1801,7 @@ SOURCE=..\mutexblock.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\netaddr.c
 
@@ -1819,7 +1819,7 @@ SOURCE=..\netaddr.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\netscope.c
 
@@ -1837,7 +1837,7 @@ SOURCE=..\netscope.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\ondestroy.c
 
@@ -1855,7 +1855,7 @@ SOURCE=..\ondestroy.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\parseint.c
 
@@ -1873,7 +1873,7 @@ SOURCE=..\parseint.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\pk11.c
 
@@ -1891,7 +1891,7 @@ SOURCE=..\pk11.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\pk11_result.c
 
@@ -1909,7 +1909,7 @@ SOURCE=..\pk11_result.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\pool.c
 
@@ -1927,7 +1927,7 @@ SOURCE=..\pool.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\portset.c
 
@@ -1945,7 +1945,7 @@ SOURCE=..\portset.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\quota.c
 
@@ -1963,7 +1963,7 @@ SOURCE=..\quota.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\radix.c
 
@@ -1981,7 +1981,7 @@ SOURCE=..\radix.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\random.c
 
@@ -1999,7 +1999,7 @@ SOURCE=..\random.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\ratelimiter.c
 
@@ -2017,7 +2017,7 @@ SOURCE=..\ratelimiter.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\refcount.c
 
@@ -2035,7 +2035,7 @@ SOURCE=..\refcount.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\regex.c
 
@@ -2053,7 +2053,7 @@ SOURCE=..\regex.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 
 SOURCE=..\region.c
@@ -2072,7 +2072,7 @@ SOURCE=..\region.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\result.c
 
@@ -2090,7 +2090,7 @@ SOURCE=..\result.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\rwlock.c
 
@@ -2108,7 +2108,7 @@ SOURCE=..\rwlock.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\safe.c
 
@@ -2126,7 +2126,7 @@ SOURCE=..\safe.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\serial.c
 
@@ -2144,7 +2144,7 @@ SOURCE=..\serial.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\sha1.c
 
@@ -2162,7 +2162,7 @@ SOURCE=..\sha1.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\sha2.c
 
@@ -2180,7 +2180,7 @@ SOURCE=..\sha2.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\sockaddr.c
 
@@ -2198,7 +2198,7 @@ SOURCE=..\sockaddr.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\stats.c
 
@@ -2216,7 +2216,7 @@ SOURCE=..\stats.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\string.c
 
@@ -2234,7 +2234,7 @@ SOURCE=..\string.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\symtab.c
 
@@ -2252,7 +2252,7 @@ SOURCE=..\symtab.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\task.c
 
@@ -2270,7 +2270,7 @@ SOURCE=..\task.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\taskpool.c
 
@@ -2288,7 +2288,7 @@ SOURCE=..\taskpool.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\timer.c
 
@@ -2306,7 +2306,7 @@ SOURCE=..\timer.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 SOURCE=..\tm.c
 
@@ -2324,10 +2324,10 @@ SOURCE=..\tm.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ENDIF 
+!ENDIF
 
 
-!ENDIF 
+!ENDIF
 
 ####################################################
 # Commands to generate initial empty manifest file and the RC file

From 2f450fcd295795fb1771432e098af3d6e52c8a0b Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 5 Nov 2015 17:10:10 +1100
Subject: [PATCH 25/39] 4253.   [bug]           Address fetch context reference
 count handling error                         on socket error.  [RT#40945]

---
 CHANGES            |  3 ++
 lib/dns/resolver.c | 97 ++++++++++++++++++++++++++--------------------
 2 files changed, 57 insertions(+), 43 deletions(-)

diff --git a/CHANGES b/CHANGES
index 5662dbd7ff..de92dc6647 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4253.	[bug]		Address fetch context reference count handling error
+			on socket error.  [RT#40945]
+
 4252.	[func]		Add support for automating the generation CDS and
 			CDNSKEY rrsets to named and dnssec-signzone.
 			[RT #40424]
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index f73b8d2ad2..25dccd50e8 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -1787,8 +1787,7 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	}
 
 	query->dispentry = NULL;
-	fctx_increference(fctx);
-	query->fctx = fctx;
+	query->fctx = fctx;	/* reference added by caller */
 	query->tsig = NULL;
 	query->tsigkey = NULL;
 	ISC_LINK_INIT(query, link);
@@ -1842,11 +1841,6 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	if (query->dispatch != NULL)
 		dns_dispatch_detach(&query->dispatch);
 
-	LOCK(&res->buckets[fctx->bucketnum].lock);
-	INSIST(fctx->references > 1);
-	fctx->references--;
-	UNLOCK(&res->buckets[fctx->bucketnum].lock);
-
  cleanup_query:
 	if (query->connects == 0) {
 		query->magic = 0;
@@ -3661,6 +3655,8 @@ fctx_try(fetchctx_t *fctx, isc_boolean_t retrying, isc_boolean_t badcache) {
 	isc_result_t result;
 	dns_adbaddrinfo_t *addrinfo = NULL;
 	dns_resolver_t *res;
+	unsigned int bucketnum;
+	isc_boolean_t bucket_empty;
 
 	FCTXTRACE("try");
 
@@ -3733,10 +3729,17 @@ fctx_try(fetchctx_t *fctx, isc_boolean_t retrying, isc_boolean_t badcache) {
 		}
 	}
 
+	bucketnum = fctx->bucketnum;
+	fctx_increference(fctx);
 	result = fctx_query(fctx, addrinfo, fctx->options);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		fctx_done(fctx, result, __LINE__);
-	else if (retrying)
+		LOCK(&res->buckets[bucketnum].lock);
+		bucket_empty = fctx_decreference(fctx);
+		UNLOCK(&res->buckets[bucketnum].lock);
+		if (bucket_empty)
+			empty_bucket(res);
+	} else if (retrying)
 		inc_stats(res, dns_resstatscounter_retry);
 }
 
@@ -7612,6 +7615,9 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	isc_result_t broken_server;
 	badnstype_t broken_type = badns_response;
 	isc_boolean_t no_response;
+	unsigned int bucketnum;
+	dns_resolver_t *res;
+	isc_boolean_t bucket_empty;
 #ifdef HAVE_DNSTAP
 	unsigned char zone[DNS_NAME_MAXWIRE];
 	dns_dtmsgtype_t dtmsgtype;
@@ -7628,10 +7634,11 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 
 	QTRACE("response");
 
+	res = fctx->res;
 	if (isc_sockaddr_pf(&query->addrinfo->sockaddr) == PF_INET)
-		inc_stats(fctx->res, dns_resstatscounter_responsev4);
+		inc_stats(res, dns_resstatscounter_responsev4);
 	else
-		inc_stats(fctx->res, dns_resstatscounter_responsev6);
+		inc_stats(res, dns_resstatscounter_responsev6);
 
 	(void)isc_timer_touch(fctx->timer);
 
@@ -7643,7 +7650,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	finish = NULL;
 	no_response = ISC_FALSE;
 
-	if (fctx->res->exiting) {
+	if (res->exiting) {
 		result = ISC_R_SHUTTINGDOWN;
 		FCTXTRACE("resolver shutting down");
 		goto done;
@@ -7757,7 +7764,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 					resend = ISC_TRUE;
 					add_bad_edns(fctx,
 						    &query->addrinfo->sockaddr);
-					inc_stats(fctx->res,
+					inc_stats(res,
 						 dns_resstatscounter_edns0fail);
 				} else {
 					broken_server = result;
@@ -7781,8 +7788,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				options |= DNS_FETCHOPT_NOEDNS0;
 				resend = ISC_TRUE;
 				add_bad_edns(fctx, &query->addrinfo->sockaddr);
-				inc_stats(fctx->res,
-						 dns_resstatscounter_edns0fail);
+				inc_stats(res, dns_resstatscounter_edns0fail);
 			} else {
 				broken_server = DNS_R_UNEXPECTEDRCODE;
 				keep_trying = ISC_TRUE;
@@ -7804,15 +7810,14 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				  DNS_LOGCATEGORY_RESOLVER,
 				  DNS_LOGMODULE_PACKETS,
 				  &dns_master_style_comment,
-				  ISC_LOG_DEBUG(10),
-				  fctx->res->mctx);
+				  ISC_LOG_DEBUG(10), res->mctx);
 
 #ifdef HAVE_DNSTAP
 	/*
 	 * Log the response via dnstap.
 	 */
 	memset(&zr, 0, sizeof(zr));
-	result = dns_compress_init(&cctx, -1, fctx->res->mctx);
+	result = dns_compress_init(&cctx, -1, res->mctx);
 	if (result == ISC_R_SUCCESS) {
 		isc_buffer_init(&zb, zone, sizeof(zone));
 		dns_compress_setmethods(&cctx, DNS_COMPRESS_NONE);
@@ -7827,8 +7832,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	else
 		dtmsgtype = DNS_DTTYPE_RR;
 
-	dns_dt_send(fctx->res->view, dtmsgtype,
-		    &query->addrinfo->sockaddr,
+	dns_dt_send(res->view, dtmsgtype, &query->addrinfo->sockaddr,
 		    ISC_TF((query->options & DNS_FETCHOPT_TCP) != 0),
 		    &zr, &query->start, NULL, &devent->buffer);
 #endif /* HAVE_DNSTAP */
@@ -7854,7 +7858,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	 * If the message is signed, check the signature.  If not, this
 	 * returns success anyway.
 	 */
-	result = dns_message_checksig(message, fctx->res->view);
+	result = dns_message_checksig(message, res->view);
 	if (result != ISC_R_SUCCESS) {
 		FCTXTRACE3("signature check failed", result);
 		goto done;
@@ -7890,7 +7894,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				       DNS_LOGCATEGORY_RESOLVER,
 				       DNS_LOGMODULE_RESOLVER,
 				       ISC_LOG_DEBUG(3),
-				       fctx->res->mctx);
+				       res->mctx);
 		dns_adb_changeflags(fctx->adb, query->addrinfo,
 				    DNS_FETCHOPT_NOEDNS0,
 				    DNS_FETCHOPT_NOEDNS0);
@@ -7914,8 +7918,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				       &query->addrinfo->sockaddr,
 				       DNS_LOGCATEGORY_RESOLVER,
 				       DNS_LOGMODULE_RESOLVER,
-				       ISC_LOG_DEBUG(3),
-				       fctx->res->mctx);
+				       ISC_LOG_DEBUG(3), res->mctx);
 		dns_adb_changeflags(fctx->adb, query->addrinfo,
 				    DNS_FETCHOPT_NOEDNS0,
 				    DNS_FETCHOPT_NOEDNS0);
@@ -7943,7 +7946,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		truncated = ISC_TRUE;
 
 	if (truncated) {
-		inc_stats(fctx->res, dns_resstatscounter_truncated);
+		inc_stats(res, dns_resstatscounter_truncated);
 		if ((options & DNS_FETCHOPT_TCP) != 0) {
 			broken_server = DNS_R_TRUNCATEDTCP;
 			keep_trying = ISC_TRUE;
@@ -7972,25 +7975,25 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	if (message->rcode != dns_rcode_noerror) {
 		switch (message->rcode) {
 		case dns_rcode_nxdomain:
-			inc_stats(fctx->res, dns_resstatscounter_nxdomain);
+			inc_stats(res, dns_resstatscounter_nxdomain);
 			break;
 		case dns_rcode_servfail:
-			inc_stats(fctx->res, dns_resstatscounter_servfail);
+			inc_stats(res, dns_resstatscounter_servfail);
 			break;
 		case dns_rcode_formerr:
-			inc_stats(fctx->res, dns_resstatscounter_formerr);
+			inc_stats(res, dns_resstatscounter_formerr);
 			break;
 		case dns_rcode_refused:
-			inc_stats(fctx->res, dns_resstatscounter_refused);
+			inc_stats(res, dns_resstatscounter_refused);
 			break;
 		case dns_rcode_badvers:
-			inc_stats(fctx->res, dns_resstatscounter_badvers);
+			inc_stats(res, dns_resstatscounter_badvers);
 			break;
 		case dns_rcode_badcookie:
-			inc_stats(fctx->res, dns_resstatscounter_badcookie);
+			inc_stats(res, dns_resstatscounter_badcookie);
 			break;
 		default:
-			inc_stats(fctx->res, dns_resstatscounter_othererror);
+			inc_stats(res, dns_resstatscounter_othererror);
 			break;
 		}
 	}
@@ -8039,7 +8042,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			 * Remember that they may not like EDNS0.
 			 */
 			add_bad_edns(fctx, &query->addrinfo->sockaddr);
-			inc_stats(fctx->res, dns_resstatscounter_edns0fail);
+			inc_stats(res, dns_resstatscounter_edns0fail);
 		} else if (message->rcode == dns_rcode_formerr) {
 			if (ISFORWARDER(query->addrinfo)) {
 				/*
@@ -8174,13 +8177,13 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	/*
 	 * Is the server lame?
 	 */
-	if (fctx->res->lame_ttl != 0 && !ISFORWARDER(query->addrinfo) &&
+	if (res->lame_ttl != 0 && !ISFORWARDER(query->addrinfo) &&
 	    is_lame(fctx)) {
-		inc_stats(fctx->res, dns_resstatscounter_lame);
+		inc_stats(res, dns_resstatscounter_lame);
 		log_lame(fctx, query->addrinfo);
 		result = dns_adb_marklame(fctx->adb, query->addrinfo,
 					  &fctx->name, fctx->type,
-					  now + fctx->res->lame_ttl);
+					  now + res->lame_ttl);
 		if (result != ISC_R_SUCCESS)
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR,
@@ -8196,7 +8199,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	 * Enforce delegations only zones like NET and COM.
 	 */
 	if (!ISFORWARDER(query->addrinfo) &&
-	    dns_view_isdelegationonly(fctx->res->view, &fctx->domain) &&
+	    dns_view_isdelegationonly(res->view, &fctx->domain) &&
 	    !dns_name_equal(&fctx->domain, &fctx->name) &&
 	    fix_mustbedelegationornxdomain(message, fctx)) {
 		char namebuf[DNS_NAME_FORMATSIZE];
@@ -8208,7 +8211,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		dns_name_format(&fctx->name, namebuf, sizeof(namebuf));
 		dns_name_format(&fctx->domain, domainbuf, sizeof(domainbuf));
 		dns_rdatatype_format(fctx->type, typebuf, sizeof(typebuf));
-		dns_rdataclass_format(fctx->res->rdclass, classbuf,
+		dns_rdataclass_format(res->rdclass, classbuf,
 				      sizeof(classbuf));
 		isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf,
 				    sizeof(addrbuf));
@@ -8220,7 +8223,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			     domainbuf, namebuf, typebuf, classbuf, addrbuf);
 	}
 
-	if ((fctx->res->options & DNS_RESOLVER_CHECKNAMES) != 0)
+	if ((res->options & DNS_RESOLVER_CHECKNAMES) != 0)
 		checknames(message);
 
 	/*
@@ -8462,7 +8465,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				name = &fctx->name;
 			else
 				name = &fctx->domain;
-			result = dns_view_findzonecut(fctx->res->view,
+			result = dns_view_findzonecut(res->view,
 						      name, fname,
 						      now, findoptions,
 						      ISC_TRUE,
@@ -8513,10 +8516,18 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		 * Resend (probably with changed options).
 		 */
 		FCTXTRACE("resend");
-		inc_stats(fctx->res, dns_resstatscounter_retry);
+		inc_stats(res, dns_resstatscounter_retry);
+		bucketnum = fctx->bucketnum;
+		fctx_increference(fctx);
 		result = fctx_query(fctx, addrinfo, options);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			fctx_done(fctx, result, __LINE__);
+			LOCK(&res->buckets[bucketnum].lock);
+			bucket_empty = fctx_decreference(fctx);
+			UNLOCK(&res->buckets[bucketnum].lock);
+			if (bucket_empty)
+				empty_bucket(res);
+		}
 	} else if (result == ISC_R_SUCCESS && !HAVE_ANSWER(fctx)) {
 		/*
 		 * All has gone well so far, but we are waiting for the
@@ -8543,7 +8554,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 
 		FCTXTRACE("suspending DS lookup to find parent's NS records");
 
-		result = dns_resolver_createfetch(fctx->res, &fctx->nsname,
+		result = dns_resolver_createfetch(res, &fctx->nsname,
 						  dns_rdatatype_ns,
 						  NULL, NULL, NULL,
 						  fctx->options, task,

From 29868ebbe3c7bc06f833e329ea190dc442331bf1 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 5 Nov 2015 17:43:30 +1100
Subject: [PATCH 26/39] 4254.   [bug]           Address missing lock when
 getting zone's serial.                         [RT #41072]

---
 CHANGES        |  3 +++
 lib/dns/zone.c | 45 +++++++++++++++++++++++++++++++++++----------
 2 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/CHANGES b/CHANGES
index de92dc6647..39f264f4bd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4254.	[bug]		Address missing lock when getting zone's serial.
+			[RT #41072]
+
 4253.	[bug]		Address fetch context reference count handling error
 			on socket error.  [RT#40945]
 
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index d38f11f50a..de41f176fe 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -9769,6 +9769,7 @@ static void
 dump_done(void *arg, isc_result_t result) {
 	const char me[] = "dump_done";
 	dns_zone_t *zone = arg;
+	dns_zone_t *secure = NULL;
 	dns_db_t *db;
 	dns_dbversion_t *version;
 	isc_boolean_t again = ISC_FALSE;
@@ -9782,30 +9783,54 @@ dump_done(void *arg, isc_result_t result) {
 
 	if (result == ISC_R_SUCCESS && zone->journal != NULL &&
 	    zone->journalsize != -1) {
-
 		/*
 		 * We don't own these, zone->dctx must stay valid.
 		 */
 		db = dns_dumpctx_db(zone->dctx);
 		version = dns_dumpctx_version(zone->dctx);
-
 		tresult = dns_db_getsoaserial(db, version, &serial);
+
+		/*
+		 * Handle lock order inversion.
+		 */
+ again:
+		LOCK_ZONE(zone);
+		if (inline_raw(zone)) {
+			secure = zone->secure;
+			INSIST(secure != zone);
+			TRYLOCK_ZONE(result, secure);
+			if (result != ISC_R_SUCCESS) {
+				UNLOCK_ZONE(zone);
+				secure = NULL;
+#if ISC_PLATFORM_USETHREADS
+				isc_thread_yield();
+#endif
+				goto again;
+			}
+		}
+
 		/*
 		 * If there is a secure version of this zone
 		 * use its serial if it is less than ours.
 		 */
-		if (tresult == ISC_R_SUCCESS && inline_raw(zone) &&
-		    zone->secure->db != NULL)
-		{
+		if (tresult == ISC_R_SUCCESS && secure != NULL) {
 			isc_uint32_t sserial;
 			isc_result_t mresult;
 
-			mresult = dns_db_getsoaserial(zone->secure->db,
-						      NULL, &sserial);
-			if (mresult == ISC_R_SUCCESS &&
-			    isc_serial_lt(sserial, serial))
-				serial = sserial;
+			ZONEDB_LOCK(&secure->dblock, isc_rwlocktype_read);
+			if (secure->db != NULL) {
+				mresult = dns_db_getsoaserial(zone->secure->db,
+							      NULL, &sserial);
+				if (mresult == ISC_R_SUCCESS &&
+				    isc_serial_lt(sserial, serial))
+					serial = sserial;
+			}
+			ZONEDB_UNLOCK(&secure->dblock, isc_rwlocktype_read);
 		}
+		if (secure != NULL)
+			UNLOCK_ZONE(secure);
+		UNLOCK_ZONE(zone);
+
 		/*
 		 * Note: we are task locked here so we can test
 		 * zone->xfr safely.

From bfd4b9e11aa9e8c2b43022a6b7a896b26bd5d7a0 Mon Sep 17 00:00:00 2001
From: Witold Krecicki <wpk@isc.org>
Date: Thu, 5 Nov 2015 12:19:04 +0100
Subject: [PATCH 27/39] 4255.   [func] Add 'message-compression' option to
 disable DNS compression in responses. [RT #40726]

---
 CHANGES                               |   3 +
 bin/named/client.c                    |   5 +
 bin/named/config.c                    |   1 +
 bin/named/server.c                    |  10 ++
 bin/tests/Makefile.in                 |   6 -
 bin/tests/compress_test.c             | 195 --------------------------
 bin/tests/system/conf.sh.in           |   4 +-
 bin/tests/system/names/clean.sh       |  20 +++
 bin/tests/system/names/ns1/example.db |  54 +++++++
 bin/tests/system/names/ns1/named.conf |  49 +++++++
 bin/tests/system/names/setup.sh       |  15 ++
 bin/tests/system/names/tests.sh       |  51 +++++++
 doc/arm/Bv9ARM-book.xml               |  14 ++
 doc/arm/notes.xml                     |   9 ++
 doc/misc/options                      |   2 +
 lib/dns/compress.c                    |  15 +-
 lib/dns/include/dns/compress.h        |  38 ++++-
 lib/dns/include/dns/view.h            |   1 +
 lib/dns/tests/name_test.c             | 171 +++++++++++++++++++++-
 lib/dns/view.c                        |   1 +
 lib/isccfg/namedconf.c                |   1 +
 21 files changed, 451 insertions(+), 214 deletions(-)
 delete mode 100644 bin/tests/compress_test.c
 create mode 100644 bin/tests/system/names/clean.sh
 create mode 100644 bin/tests/system/names/ns1/example.db
 create mode 100644 bin/tests/system/names/ns1/named.conf
 create mode 100644 bin/tests/system/names/setup.sh
 create mode 100644 bin/tests/system/names/tests.sh

diff --git a/CHANGES b/CHANGES
index 39f264f4bd..b7b7377131 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4255.	[func]		Add 'message-compression' option to disable DNS
+			compression in responses. [RT #40726]
+
 4254.	[bug]		Address missing lock when getting zone's serial.
 			[RT #41072]
 
diff --git a/bin/named/client.c b/bin/named/client.c
index f2e41f01cb..0fa461f62f 100644
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -1065,12 +1065,17 @@ client_send(ns_client_t *client) {
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 		if (client->message->tsigkey != NULL)
 			name = &client->message->tsigkey->name;
+
 		if (client->view->nocasecompress == NULL ||
 		    !allowed(&netaddr, name, NULL, 0, NULL,
 			     client->view->nocasecompress))
 		{
 			dns_compress_setsensitive(&cctx, ISC_TRUE);
 		}
+
+		if (client->view->msgcompression == ISC_FALSE) {
+			dns_compress_disable(&cctx);
+		}
 	}
 	cleanup_cctx = ISC_TRUE;
 
diff --git a/bin/named/config.c b/bin/named/config.c
index a0ee482261..2b7d0c9456 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -185,6 +185,7 @@ options {\n\
 	fetches-per-server 0;\n\
 	require-server-cookie no;\n\
 	v6-bias 50;\n\
+	message-compression yes;\n\
 "
 #ifdef HAVE_DNSTAP
 "\
diff --git a/bin/named/server.c b/bin/named/server.c
index 1b820bc416..0e88fef90d 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -3652,6 +3652,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	CHECK(configure_view_acl(vconfig, config, "no-case-compress", NULL,
 				 actx, ns_g_mctx, &view->nocasecompress));
 
+	/*
+	 * Disable name compression completely, this is a tradeoff
+	 * between CPU and network usage.
+	 */
+
+	obj = NULL;
+	result = ns_config_get(maps, "message-compression", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->msgcompression = cfg_obj_asboolean(obj);
+
 	/*
 	 * Filter setting on addresses in the answer section.
 	 */
diff --git a/bin/tests/Makefile.in b/bin/tests/Makefile.in
index f4f7c1fc0a..c7d6c78c8b 100644
--- a/bin/tests/Makefile.in
+++ b/bin/tests/Makefile.in
@@ -59,7 +59,6 @@ XTARGETS =	adb_test@EXEEXT@ \
 		backtrace_test@EXEEXT@ \
 		backtrace_test_nosymtbl@EXEEXT@ \
 		byname_test@EXEEXT@ \
-		compress_test@EXEEXT@ \
 		db_test@EXEEXT@ \
 		entropy_test@EXEEXT@ \
 		entropy2_test@EXEEXT@ \
@@ -99,7 +98,6 @@ XSRCS =		adb_test.c \
 		byaddr_test.c \
 		backtrace_test.c \
 		byname_test.c \
-		compress_test.c \
 		db_test.c \
 		entropy_test.c \
 		entropy2_test.c \
@@ -258,10 +256,6 @@ db_test@EXEEXT@: db_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ db_test.@O@ \
 		${DNSLIBS} ${ISCLIBS} ${LIBS}
 
-compress_test@EXEEXT@: compress_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ compress_test.@O@ \
-		${DNSLIBS} ${ISCLIBS} ${LIBS}
-
 mempool_test@EXEEXT@: mempool_test.@O@ ${ISCDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ mempool_test.@O@ \
 		${ISCLIBS} ${LIBS}
diff --git a/bin/tests/compress_test.c b/bin/tests/compress_test.c
deleted file mode 100644
index b24b8b9503..0000000000
--- a/bin/tests/compress_test.c
+++ /dev/null
@@ -1,195 +0,0 @@
-/*
- * Copyright (C) 2004-2007, 2015  Internet Systems Consortium, Inc. ("ISC")
- * Copyright (C) 1999-2001  Internet Software Consortium.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/* $Id: compress_test.c,v 1.34 2007/06/18 23:47:26 tbox Exp $ */
-
-/*! \file */
-
-#include <config.h>
-
-#include <stdlib.h>
-#include <string.h>
-
-#include <isc/buffer.h>
-#include <isc/commandline.h>
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/util.h>
-
-#include <dns/compress.h>
-#include <dns/name.h>
-
-unsigned char plain1[] = "\003yyy\003foo";
-unsigned char plain2[] = "\003bar\003yyy\003foo";
-unsigned char plain3[] = "\003xxx\003bar\003foo";
-unsigned char plain[] = "\003yyy\003foo\0\003bar\003yyy\003foo\0\003"
-			"bar\003yyy\003foo\0\003xxx\003bar\003foo";
-
-/*
- * Result concatenate (plain1, plain2, plain2, plain3).
- */
-int raw = 0;
-int verbose = 0;
-
-void
-test(unsigned int, dns_name_t *, dns_name_t *, dns_name_t *,
-     unsigned char *, unsigned int);
-
-int
-main(int argc, char *argv[]) {
-	dns_name_t name1;
-	dns_name_t name2;
-	dns_name_t name3;
-	isc_region_t region;
-	int c;
-
-	while ((c = isc_commandline_parse(argc, argv, "rv")) != -1) {
-		switch (c) {
-		case 'r':
-			raw++;
-			break;
-		case 'v':
-			verbose++;
-			break;
-		}
-	}
-
-	dns_name_init(&name1, NULL);
-	region.base = plain1;
-	region.length = sizeof(plain1);
-	dns_name_fromregion(&name1, &region);
-
-	dns_name_init(&name2, NULL);
-	region.base = plain2;
-	region.length = sizeof(plain2);
-	dns_name_fromregion(&name2, &region);
-
-	dns_name_init(&name3, NULL);
-	region.base = plain3;
-	region.length = sizeof(plain3);
-	dns_name_fromregion(&name3, &region);
-
-	test(DNS_COMPRESS_NONE, &name1, &name2, &name3, plain, sizeof(plain));
-	test(DNS_COMPRESS_GLOBAL14, &name1, &name2, &name3, plain,
-	     sizeof(plain));
-	test(DNS_COMPRESS_ALL, &name1, &name2, &name3, plain, sizeof(plain));
-
-	return (0);
-}
-
-void
-test(unsigned int allowed, dns_name_t *name1, dns_name_t *name2,
-     dns_name_t *name3, unsigned char *result, unsigned int length)
-{
-	isc_mem_t *mctx = NULL;
-	dns_compress_t cctx;
-	dns_decompress_t dctx;
-	isc_buffer_t source;
-	isc_buffer_t target;
-	dns_name_t name;
-	unsigned char buf1[1024];
-	unsigned char buf2[1024];
-
-	if (verbose) {
-		const char *s;
-		switch (allowed) {
-		case DNS_COMPRESS_NONE: s = "DNS_COMPRESS_NONE"; break;
-		case DNS_COMPRESS_GLOBAL14: s = "DNS_COMPRESS_GLOBAL14"; break;
-		/* case DNS_COMPRESS_ALL: s = "DNS_COMPRESS_ALL"; break; */
-		default: s = "UNKNOWN"; break;
-		}
-		fprintf(stdout, "Allowed = %s\n", s);
-	}
-	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
-	isc_buffer_init(&source, buf1, sizeof(buf1));
-	RUNTIME_CHECK(dns_compress_init(&cctx, -1, mctx) == ISC_R_SUCCESS);
-
-	RUNTIME_CHECK(dns_name_towire(name1, &cctx, &source) == ISC_R_SUCCESS);
-
-	/*
-	RUNTIME_CHECK(dns_compress_localinit(&cctx, name1, &source) ==
-		      ISC_R_SUCCESS);
-	*/
-	dns_compress_setmethods(&cctx, allowed);
-	RUNTIME_CHECK(dns_name_towire(name2, &cctx, &source) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(dns_name_towire(name2, &cctx, &source) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(dns_name_towire(name3, &cctx, &source) == ISC_R_SUCCESS);
-
-	/*
-	dns_compress_localinvalidate(&cctx);
-	*/
-	dns_compress_rollback(&cctx, 0);	/* testing only */
-	dns_compress_invalidate(&cctx);
-
-	if (raw) {
-		unsigned int i;
-		for (i = 0; i < source.used; /* */ ) {
-			fprintf(stdout, "%02x",
-				((unsigned char *)source.base)[i]);
-			if ((++i % 20) == 0)
-				fputs("\n", stdout);
-			else
-				if (i == source.used)
-					fputs("\n", stdout);
-				else
-					fputs(" ", stdout);
-		}
-	}
-
-	isc_buffer_setactive(&source, source.used);
-	isc_buffer_init(&target, buf2, sizeof(buf2));
-	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
-
-	dns_name_init(&name, NULL);
-	RUNTIME_CHECK(dns_name_fromwire(&name, &source, &dctx, ISC_FALSE,
-					&target) == ISC_R_SUCCESS);
-	dns_decompress_setmethods(&dctx, allowed);
-	/*
-	dns_decompress_localinit(&dctx, &name, &source);
-	*/
-	RUNTIME_CHECK(dns_name_fromwire(&name, &source, &dctx, ISC_FALSE,
-					&target) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(dns_name_fromwire(&name, &source, &dctx, ISC_FALSE,
-					&target) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(dns_name_fromwire(&name, &source, &dctx, ISC_FALSE,
-					&target) == ISC_R_SUCCESS);
-	/*
-	dns_decompress_localinvalidate(&dctx);
-	*/
-	dns_decompress_invalidate(&dctx);
-
-	if (raw) {
-		unsigned int i;
-		for (i = 0; i < target.used; /* */ ) {
-			fprintf(stdout, "%02x",
-				((unsigned char *)target.base)[i]);
-			if ((++i % 20) == 0)
-				fputs("\n", stdout);
-			else
-				if (i == target.used)
-					fputs("\n", stdout);
-				else
-					fputs(" ", stdout);
-		}
-		fputs("\n", stdout);
-		fflush(stdout);
-	}
-
-	RUNTIME_CHECK(target.used == length);
-	RUNTIME_CHECK(memcmp(target.base, result, target.used) == 0);
-	isc_mem_destroy(&mctx);
-}
diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
index 0a55c7a96d..937f3f9a5e 100644
--- a/bin/tests/system/conf.sh.in
+++ b/bin/tests/system/conf.sh.in
@@ -71,8 +71,8 @@ SUBDIRS="acl additional allow_query addzone autosign builtin
 	 dname dns64 dnssec dsdigest dscp @DNSTAP@ ecdsa ednscompliance
 	 emptyzones fetchlimit filter-aaaa formerr forward geoip glue gost
 	 ixfr inline legacy limits logfileconfig lwresd masterfile
-	 masterformat metadata mkeys notify nslookup nsupdate pending
-	 pipelined @PKCS11_TEST@ reclimit redirect resolver rndc
+	 masterformat metadata mkeys names notify nslookup nsupdate
+	 pending pipelined @PKCS11_TEST@ reclimit redirect resolver rndc
 	 rpz rpzrecurse rrl rrchecker rrsetorder rsabigexponent
 	 runtime sfcache smartsign sortlist spf staticstub statistics
 	 stub tcp tkey tsig tsiggss unknown upforwd verify views
diff --git a/bin/tests/system/names/clean.sh b/bin/tests/system/names/clean.sh
new file mode 100644
index 0000000000..6e215b6306
--- /dev/null
+++ b/bin/tests/system/names/clean.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+#
+# Copyright (C) 2013-2015  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+rm -f dig.*.test*
+rm -f ns*/named.lock
+rm -f ns*/named.memstats
+rm -f ns*/named.pid
diff --git a/bin/tests/system/names/ns1/example.db b/bin/tests/system/names/ns1/example.db
new file mode 100644
index 0000000000..bcc1d6ed84
--- /dev/null
+++ b/bin/tests/system/names/ns1/example.db
@@ -0,0 +1,54 @@
+; Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns1
+ns1			A	10.53.0.1
+@			MX	0 m1.mail-servers.example.
+@			MX	0 m2.mail-servers.example.
+@			MX	0 m3.mail-servers.example.
+@			MX	0 m4.mail-servers.example.
+@			MX	0 m5.mail-servers.example.
+@			MX	0 m6.mail-servers.example.
+@			MX	0 m7.mail-servers.example.
+@			MX	0 m8.mail-servers.example.
+@			MX	0 m9.mail-servers.example.
+@			MX	0 m10.mail-servers.example.
+@			MX	0 m11.mail-servers.example.
+@			MX	0 m12.mail-servers.example.
+@			MX	0 m13.mail-servers.example.
+@			MX	0 m14.mail-servers.example.
+@			MX	0 m15.mail-servers.example.
+@			MX	0 m16.mail-servers.example.
+@			MX	0 m17.mail-servers.example.
+@			MX	0 m18.mail-servers.example.
+@			MX	0 m19.mail-servers.example.
+@			MX	0 m20.mail-servers.example.
+@			MX	0 m21.mail-servers.example.
+@			MX	0 m22.mail-servers.example.
+@			MX	0 m23.mail-servers.example.
+@			MX	0 m24.mail-servers.example.
+@			MX	0 m25.mail-servers.example.
+@			MX	0 m26.mail-servers.example.
+@			MX	0 m27.mail-servers.example.
+@			MX	0 m28.mail-servers.example.
+@			MX	0 m29.mail-servers.example.
diff --git a/bin/tests/system/names/ns1/named.conf b/bin/tests/system/names/ns1/named.conf
new file mode 100644
index 0000000000..04bc6b38af
--- /dev/null
+++ b/bin/tests/system/names/ns1/named.conf
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2013, 2015  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+	ixfr-from-differences yes;
+	check-integrity no;
+};
+
+
+view compress {
+	match-clients { 10.53.0.1/32; };
+	zone "example" {
+		type master;
+		file "example.db";
+	};
+};
+
+view nocompress {
+	match-clients { 10.53.0.2/32; };
+	message-compression no;
+	zone "example" {
+		type master;
+		file "example.db";
+	};
+};
diff --git a/bin/tests/system/names/setup.sh b/bin/tests/system/names/setup.sh
new file mode 100644
index 0000000000..5a26769525
--- /dev/null
+++ b/bin/tests/system/names/setup.sh
@@ -0,0 +1,15 @@
+# Copyright (C) 2015  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+sh clean.sh
diff --git a/bin/tests/system/names/tests.sh b/bin/tests/system/names/tests.sh
new file mode 100644
index 0000000000..e5ee4aebad
--- /dev/null
+++ b/bin/tests/system/names/tests.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+#
+# Copyright (C) 2013-2015  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+DIGOPTS="+nosea +stat +noquest +nocomm +nocmd"
+
+status=0
+
+echo "I:Getting message size with compression enabled"
+$DIG $DIGOPTS -b 10.53.0.1 @10.53.0.1 -p 5300 mx example > dig.compen.test
+COMPEN=`grep ';; MSG SIZE' dig.compen.test |sed -e "s/.*: //g"`
+cat dig.compen.test  |grep -v ';;' |sort > dig.compen.sorted.test
+
+echo "I:Getting message size with compression disabled"
+$DIG $DIGOPTS -b 10.53.0.2 @10.53.0.1 -p 5300 mx example > dig.compdis.test
+COMPDIS=`grep ';; MSG SIZE' dig.compdis.test |sed -e "s/.*: //g"`
+cat dig.compdis.test  |grep -v ';;' |sort > dig.compdis.sorted.test
+
+# the compression disabled message should be at least twice as large as with
+# compression disabled, but the content should be the same
+echo "I:Checking if responses are identical other than in message size"
+diff dig.compdis.sorted.test dig.compen.sorted.test >/dev/null
+ret=$?
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:Checking if message with compression disabled is significantly larger"
+echo "I: Disabled $COMPDIS vs enabled $COMPEN"
+val=`expr \( $COMPDIS \* 3 / 2 \) / $COMPEN`
+if [ $val -le 1 ]; then
+	echo "I:failed"
+	status=`expr $status + 1`
+fi;
+
+echo "I:exit status: $status"
+exit $status
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 5ebc967c01..b7e268bd09 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -4486,6 +4486,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
     <optional> blackhole { <replaceable>address_match_list</replaceable> }; </optional>
     <optional> keep-response-order { <replaceable>address_match_list</replaceable> }; </optional>
     <optional> no-case-compress { <replaceable>address_match_list</replaceable> }; </optional>
+    <optional> message-compression <replaceable>yes_or_no</replaceable> ; </optional>
     <optional> use-v4-udp-ports { <replaceable>port_list</replaceable> }; </optional>
     <optional> avoid-v4-udp-ports { <replaceable>port_list</replaceable> }; </optional>
     <optional> use-v6-udp-ports { <replaceable>port_list</replaceable> }; </optional>
@@ -6150,6 +6151,19 @@ options {
 	      </listitem>
 	    </varlistentry>
 
+	    <varlistentry>
+	      <term><command>message-compression</command></term> <listitem>
+		<para>
+		  If <userinput>yes</userinput>, DNS name compression will
+		  be used for responses to regular queries (not including
+		  AXFR or IXFR, which always uses compression).  Setting
+		  this option to <userinput>no</userinput> can result in
+		  larger responses, but will reduce CPU usage on servers.
+		  The default is <userinput>yes</userinput>.
+		</para>
+	      </listitem>
+	    </varlistentry>
+
 	    <varlistentry>
 	      <term><command>minimal-responses</command></term>
 	      <listitem>
diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 4493dac524..ec35be6cae 100644
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -504,6 +504,15 @@
 	  SINK, TA, TALINK.
 	</para>
       </listitem>
+      <listitem>
+	<para>
+	  A new <command>message-compression</command> option can be
+	  used to specify whether or not to use name compression when
+	  answering queries. Setting this to <userinput>no</userinput>
+	  results in larger responses, but reduces CPU consumption and
+	  may improve throughput.  The default is <userinput>yes</userinput>.
+	</para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="relnotes_changes"><info><title>Feature Changes</title></info>
diff --git a/doc/misc/options b/doc/misc/options
index 3d6a5bfb7b..b3ba91d9c7 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -206,6 +206,7 @@ options {
         max-zone-ttl ( unlimited | <ttlval> );
         memstatistics <boolean>;
         memstatistics-file <quoted_string>;
+        message-compression <boolean>;
         min-refresh-time <integer>;
         min-retry-time <integer>;
         min-roots <integer>; // not implemented
@@ -489,6 +490,7 @@ view <string> [ <class> ] {
         max-transfer-time-out <integer>;
         max-udp-size <integer>;
         max-zone-ttl ( unlimited | <ttlval> );
+        message-compression <boolean>;
         min-refresh-time <integer>;
         min-retry-time <integer>;
         min-roots <integer>; // not implemented
diff --git a/lib/dns/compress.c b/lib/dns/compress.c
index c6ad96e905..d826de4fb7 100644
--- a/lib/dns/compress.c
+++ b/lib/dns/compress.c
@@ -15,8 +15,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id$ */
-
 /*! \file */
 
 #define DNS_NAME_USEINLINE 1
@@ -56,6 +54,7 @@ dns_compress_init(dns_compress_t *cctx, int edns, isc_mem_t *mctx) {
 	cctx->mctx = mctx;
 	cctx->count = 0;
 	cctx->magic = CCTX_MAGIC;
+	cctx->enabled = ISC_TRUE;
 	return (ISC_R_SUCCESS);
 }
 
@@ -97,6 +96,12 @@ dns_compress_getmethods(dns_compress_t *cctx) {
 	return (cctx->allowed & DNS_COMPRESS_ALL);
 }
 
+void
+dns_compress_disable(dns_compress_t *cctx) {
+	REQUIRE(VALID_CCTX(cctx));
+	cctx->enabled = ISC_FALSE;
+}
+
 void
 dns_compress_setsensitive(dns_compress_t *cctx, isc_boolean_t sensitive) {
 	REQUIRE(VALID_CCTX(cctx));
@@ -145,6 +150,9 @@ dns_compress_findglobal(dns_compress_t *cctx, const dns_name_t *name,
 	REQUIRE(dns_name_isabsolute(name) == ISC_TRUE);
 	REQUIRE(offset != NULL);
 
+	if (cctx->enabled == ISC_FALSE)
+		return (ISC_FALSE);
+
 	if (cctx->count == 0)
 		return (ISC_FALSE);
 
@@ -214,6 +222,9 @@ dns_compress_add(dns_compress_t *cctx, const dns_name_t *name,
 	REQUIRE(VALID_CCTX(cctx));
 	REQUIRE(dns_name_isabsolute(name));
 
+	if (cctx->enabled == ISC_FALSE)
+		return;
+
 	if (offset >= 0x4000)
 		return;
 	dns_name_init(&tname, NULL);
diff --git a/lib/dns/include/dns/compress.h b/lib/dns/include/dns/compress.h
index a10f4d3930..10ee321979 100644
--- a/lib/dns/include/dns/compress.h
+++ b/lib/dns/include/dns/compress.h
@@ -15,8 +15,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: compress.h,v 1.42 2009/01/17 23:47:43 tbox Exp $ */
-
 #ifndef DNS_COMPRESS_H
 #define DNS_COMPRESS_H 1
 
@@ -27,15 +25,26 @@
 
 ISC_LANG_BEGINDECLS
 
+/*! \file dns/compress.h
+ * Direct manipulation of the structures is strongly discouraged.
+ *
+ * A name compression context handles compression of multiple DNS names
+ * in relation to a single DNS message. The context can be used to
+ * selectively turn on/off compression for specific names (depending on
+ * the RR type) by using \c dns_compress_setmethods(). Alternately,
+ * compression can be disabled completely using \c
+ * dns_compress_disable().
+ *
+ * \c dns_compress_setmethods() is intended for use by RDATA towire()
+ * implementations, whereas \c dns_compress_disable() is intended to be
+ * used by a nameserver's configuration manager.
+ */
+
 #define DNS_COMPRESS_NONE		0x00	/*%< no compression */
 #define DNS_COMPRESS_GLOBAL14		0x01	/*%< "normal" compression. */
 #define DNS_COMPRESS_ALL		0x01	/*%< all compression. */
 #define DNS_COMPRESS_CASESENSITIVE	0x02	/*%< case sensitive compression. */
 
-/*! \file dns/compress.h
- *	Direct manipulation of the structures is strongly discouraged.
- */
-
 #define DNS_COMPRESS_TABLESIZE 64
 #define DNS_COMPRESS_INITIALNODES 16
 
@@ -52,6 +61,7 @@ struct dns_compressnode {
 struct dns_compress {
 	unsigned int		magic;		/*%< Magic number. */
 	unsigned int		allowed;	/*%< Allowed methods. */
+	isc_boolean_t		enabled;	/*%< If the compression is enabled at all. */
 	int			edns;		/*%< Edns version or -1. */
 	/*% Global compression table. */
 	dns_compressnode_t	*table[DNS_COMPRESS_TABLESIZE];
@@ -77,7 +87,10 @@ struct dns_decompress {
 isc_result_t
 dns_compress_init(dns_compress_t *cctx, int edns, isc_mem_t *mctx);
 /*%<
- *	Initialise the compression context structure pointed to by 'cctx'.
+ *	Initialise the compression context structure pointed to by
+ *	'cctx'. A freshly initialized context has name compression
+ *	enabled, but no methods are set. Please use \c
+ *	dns_compress_setmethods() to set a compression method.
  *
  *	Requires:
  *	\li	'cctx' is a valid dns_compress_t structure.
@@ -123,6 +136,17 @@ dns_compress_getmethods(dns_compress_t *cctx);
  *\li		allowed compression bitmap.
  */
 
+void
+dns_compress_disable(dns_compress_t *cctx);
+/*%<
+ *	Disables all name compression in the context. Once disabled,
+ *	name compression cannot currently be re-enabled.
+ *
+ *	Requires:
+ *\li		'cctx' to be initialized.
+ *
+ */
+
 void
 dns_compress_setsensitive(dns_compress_t *cctx, isc_boolean_t sensitive);
 
diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
index fe52e7b6e7..106ef700c6 100644
--- a/lib/dns/include/dns/view.h
+++ b/lib/dns/include/dns/view.h
@@ -143,6 +143,7 @@ struct dns_view {
 	dns_acl_t *			upfwdacl;
 	dns_acl_t *			denyansweracl;
 	dns_acl_t *			nocasecompress;
+	isc_boolean_t			msgcompression;
 	dns_rbt_t *			answeracl_exclude;
 	dns_rbt_t *			denyanswernames;
 	dns_rbt_t *			answernames_exclude;
diff --git a/lib/dns/tests/name_test.c b/lib/dns/tests/name_test.c
index b5f9f9c7ff..1a36de7c31 100644
--- a/lib/dns/tests/name_test.c
+++ b/lib/dns/tests/name_test.c
@@ -20,12 +20,22 @@
 
 #include <config.h>
 
-#include <atf-c.h>
-
+#include <stdlib.h>
+#include <string.h>
 #include <unistd.h>
 
+#include <atf-c.h>
+
+#include <isc/buffer.h>
+#include <isc/commandline.h>
+#include <isc/mem.h>
+#include <isc/print.h>
+#include <isc/util.h>
+
+#include <dns/compress.h>
 #include <dns/name.h>
 #include <dns/fixedname.h>
+
 #include "dnstest.h"
 
 /*
@@ -117,11 +127,168 @@ ATF_TC_BODY(fullcompare, tc) {
 	}
 }
 
+static void
+compress_test(dns_name_t *name1, dns_name_t *name2, dns_name_t *name3,
+	      unsigned char *expected, unsigned int length,
+	      dns_compress_t *cctx, dns_decompress_t *dctx)
+{
+	isc_buffer_t source;
+	isc_buffer_t target;
+	dns_name_t name;
+	unsigned char buf1[1024];
+	unsigned char buf2[1024];
+
+	isc_buffer_init(&source, buf1, sizeof(buf1));
+	isc_buffer_init(&target, buf2, sizeof(buf2));
+
+	ATF_REQUIRE_EQ(dns_name_towire(name1, cctx, &source), ISC_R_SUCCESS);
+
+	ATF_CHECK_EQ(dns_name_towire(name2, cctx, &source), ISC_R_SUCCESS);
+	ATF_CHECK_EQ(dns_name_towire(name2, cctx, &source), ISC_R_SUCCESS);
+	ATF_CHECK_EQ(dns_name_towire(name3, cctx, &source), ISC_R_SUCCESS);
+
+	isc_buffer_setactive(&source, source.used);
+
+	dns_name_init(&name, NULL);
+	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, ISC_FALSE,
+					&target) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, ISC_FALSE,
+					&target) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, ISC_FALSE,
+					&target) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(dns_name_fromwire(&name, &source, dctx, ISC_FALSE,
+					&target) == ISC_R_SUCCESS);
+	dns_decompress_invalidate(dctx);
+
+	ATF_CHECK_EQ(target.used, length);
+	ATF_CHECK(memcmp(target.base, expected, target.used) == 0);
+}
+
+ATF_TC(compression);
+ATF_TC_HEAD(compression, tc) {
+	atf_tc_set_md_var(tc, "descr", "name compression test");
+}
+ATF_TC_BODY(compression, tc) {
+	unsigned int allowed;
+	dns_compress_t cctx;
+	dns_decompress_t dctx;
+	dns_name_t name1;
+	dns_name_t name2;
+	dns_name_t name3;
+	isc_region_t r;
+	unsigned char plain1[] = "\003yyy\003foo";
+	unsigned char plain2[] = "\003bar\003yyy\003foo";
+	unsigned char plain3[] = "\003xxx\003bar\003foo";
+	unsigned char plain[] = "\003yyy\003foo\0\003bar\003yyy\003foo\0\003"
+				"bar\003yyy\003foo\0\003xxx\003bar\003foo";
+
+	dns_test_begin(NULL, ISC_FALSE);
+
+	dns_name_init(&name1, NULL);
+	r.base = plain1;
+	r.length = sizeof(plain1);
+	dns_name_fromregion(&name1, &r);
+
+	dns_name_init(&name2, NULL);
+	r.base = plain2;
+	r.length = sizeof(plain2);
+	dns_name_fromregion(&name2, &r);
+
+	dns_name_init(&name3, NULL);
+	r.base = plain3;
+	r.length = sizeof(plain3);
+	dns_name_fromregion(&name3, &r);
+
+	/* Test 1: NONE */
+	allowed = DNS_COMPRESS_NONE;
+	ATF_REQUIRE_EQ(dns_compress_init(&cctx, -1, mctx), ISC_R_SUCCESS);
+	dns_compress_setmethods(&cctx, allowed);
+	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
+	dns_decompress_setmethods(&dctx, allowed);
+
+	compress_test(&name1, &name2, &name3, plain, sizeof(plain),
+		      &cctx, &dctx);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test2: GLOBAL14 */
+	allowed = DNS_COMPRESS_GLOBAL14;
+	ATF_REQUIRE_EQ(dns_compress_init(&cctx, -1, mctx), ISC_R_SUCCESS);
+	dns_compress_setmethods(&cctx, allowed);
+	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
+	dns_decompress_setmethods(&dctx, allowed);
+
+	compress_test(&name1, &name2, &name3, plain, sizeof(plain),
+		      &cctx, &dctx);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test3: ALL */
+	allowed = DNS_COMPRESS_ALL;
+	ATF_REQUIRE_EQ(dns_compress_init(&cctx, -1, mctx), ISC_R_SUCCESS);
+	dns_compress_setmethods(&cctx, allowed);
+	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
+	dns_decompress_setmethods(&dctx, allowed);
+
+	compress_test(&name1, &name2, &name3, plain, sizeof(plain),
+		      &cctx, &dctx);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test4: NONE disabled */
+	allowed = DNS_COMPRESS_NONE;
+	ATF_REQUIRE_EQ(dns_compress_init(&cctx, -1, mctx), ISC_R_SUCCESS);
+	dns_compress_setmethods(&cctx, allowed);
+	dns_compress_disable(&cctx);
+	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
+	dns_decompress_setmethods(&dctx, allowed);
+
+	compress_test(&name1, &name2, &name3, plain, sizeof(plain),
+		      &cctx, &dctx);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test5: GLOBAL14 disabled */
+	allowed = DNS_COMPRESS_GLOBAL14;
+	ATF_REQUIRE_EQ(dns_compress_init(&cctx, -1, mctx), ISC_R_SUCCESS);
+	dns_compress_setmethods(&cctx, allowed);
+	dns_compress_disable(&cctx);
+	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
+	dns_decompress_setmethods(&dctx, allowed);
+
+	compress_test(&name1, &name2, &name3, plain, sizeof(plain),
+		      &cctx, &dctx);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	/* Test6: ALL disabled */
+	allowed = DNS_COMPRESS_ALL;
+	ATF_REQUIRE_EQ(dns_compress_init(&cctx, -1, mctx), ISC_R_SUCCESS);
+	dns_compress_setmethods(&cctx, allowed);
+	dns_compress_disable(&cctx);
+	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT);
+	dns_decompress_setmethods(&dctx, allowed);
+
+	compress_test(&name1, &name2, &name3, plain, sizeof(plain),
+		      &cctx, &dctx);
+
+	dns_compress_rollback(&cctx, 0);
+	dns_compress_invalidate(&cctx);
+
+	dns_test_end();
+}
+
 /*
  * Main
  */
 ATF_TP_ADD_TCS(tp) {
 	ATF_TP_ADD_TC(tp, fullcompare);
+	ATF_TP_ADD_TC(tp, compression);
 
 	return (atf_no_error());
 }
diff --git a/lib/dns/view.c b/lib/dns/view.c
index 612849cddb..c28b2f9bf3 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -205,6 +205,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->upfwdacl = NULL;
 	view->denyansweracl = NULL;
 	view->nocasecompress = NULL;
+	view->msgcompression = ISC_TRUE;
 	view->answeracl_exclude = NULL;
 	view->denyanswernames = NULL;
 	view->answernames_exclude = NULL;
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 8ac0a4cba1..1ddb06ea1c 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -1690,6 +1690,7 @@ view_clauses[] = {
 	{ "prefetch", &cfg_type_prefetch, 0 },
 	{ "preferred-glue", &cfg_type_astring, 0 },
 	{ "no-case-compress", &cfg_type_bracketed_aml, 0 },
+	{ "message-compression", &cfg_type_boolean, 0 },
 	{ "provide-ixfr", &cfg_type_boolean, 0 },
 	/*
 	 * Note that the query-source option syntax is different

From f4b1a7e063f90e7f0cfc9e4d0d3724351c395d45 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 6 Nov 2015 00:15:23 +1100
Subject: [PATCH 28/39] add dns_compress_disable

---
 lib/dns/win32/libdns.def.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
index 2557aa78c7..d5a64e24c3 100644
--- a/lib/dns/win32/libdns.def.in
+++ b/lib/dns/win32/libdns.def.in
@@ -138,6 +138,7 @@ dns_client_updaterec
 dns_clientinfo_init
 dns_clientinfomethods_init
 dns_compress_add
+dns_compress_disable
 dns_compress_findglobal
 dns_compress_getedns
 dns_compress_getmethods

From 1404d301dd9e7e487a247b803f63909cd10cdf72 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Thu, 5 Nov 2015 23:30:12 +0000
Subject: [PATCH 29/39] newcopyrights

---
 util/copyrights | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/util/copyrights b/util/copyrights
index 3b8d384c08..d0e7940963 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -804,7 +804,7 @@
 ./bin/tests/system/allow_query/setup.sh		SH	2010,2012
 ./bin/tests/system/allow_query/tests.sh		SH	2010,2012,2013
 ./bin/tests/system/ans.pl			PERL	2011,2012,2014
-./bin/tests/system/autosign/clean.sh		SH	2009,2010,2011,2012,2013,2014
+./bin/tests/system/autosign/clean.sh		SH	2009,2010,2011,2012,2013,2014,2015
 ./bin/tests/system/autosign/ns1/keygen.sh	SH	2009,2010,2011,2012,2014
 ./bin/tests/system/autosign/ns1/named.conf	CONF-C	2009,2013
 ./bin/tests/system/autosign/ns1/root.db.in	ZONE	2009,2010
@@ -818,7 +818,7 @@
 ./bin/tests/system/autosign/ns2/dst.example.db.in	ZONE	2009
 ./bin/tests/system/autosign/ns2/example.db.in	ZONE	2009,2010
 ./bin/tests/system/autosign/ns2/insecure.secure.example.db	ZONE	2009
-./bin/tests/system/autosign/ns2/keygen.sh	SH	2009,2010,2011,2012,2014
+./bin/tests/system/autosign/ns2/keygen.sh	SH	2009,2010,2011,2012,2014,2015
 ./bin/tests/system/autosign/ns2/named.conf	CONF-C	2009,2010,2011,2013
 ./bin/tests/system/autosign/ns2/private.secure.example.db.in	ZONE	2009
 ./bin/tests/system/autosign/ns3/.gitignore	X	2012
@@ -826,8 +826,8 @@
 ./bin/tests/system/autosign/ns3/delay.example.db	ZONE	2011
 ./bin/tests/system/autosign/ns3/inaczsk.example.db.in	ZONE	2011
 ./bin/tests/system/autosign/ns3/insecure.example.db	ZONE	2009
-./bin/tests/system/autosign/ns3/keygen.sh	SH	2009,2010,2011,2012,2014
-./bin/tests/system/autosign/ns3/named.conf	CONF-C	2009,2010,2011,2012,2013
+./bin/tests/system/autosign/ns3/keygen.sh	SH	2009,2010,2011,2012,2014,2015
+./bin/tests/system/autosign/ns3/named.conf	CONF-C	2009,2010,2011,2012,2013,2015
 ./bin/tests/system/autosign/ns3/nozsk.example.db.in	ZONE	2011
 ./bin/tests/system/autosign/ns3/nsec.example.db.in	ZONE	2010
 ./bin/tests/system/autosign/ns3/nsec3-to-nsec.example.db.in	ZONE	2010
@@ -845,6 +845,7 @@
 ./bin/tests/system/autosign/ns3/secure.example.db.in	ZONE	2009
 ./bin/tests/system/autosign/ns3/secure.nsec3.example.db.in	ZONE	2009
 ./bin/tests/system/autosign/ns3/secure.optout.example.db.in	ZONE	2009
+./bin/tests/system/autosign/ns3/sync.example.db.in	ZONE	2015
 ./bin/tests/system/autosign/ns3/ttl1.example.db.in	ZONE	2011
 ./bin/tests/system/autosign/ns3/ttl2.example.db.in	ZONE	2011
 ./bin/tests/system/autosign/ns3/ttl3.example.db.in	ZONE	2011
@@ -853,7 +854,7 @@
 ./bin/tests/system/autosign/ns5/named.conf	CONF-C	2009
 ./bin/tests/system/autosign/prereq.sh		SH	2009,2010,2012,2014
 ./bin/tests/system/autosign/setup.sh		SH	2009,2010,2012,2014
-./bin/tests/system/autosign/tests.sh		SH	2009,2010,2011,2012,2013,2014
+./bin/tests/system/autosign/tests.sh		SH	2009,2010,2011,2012,2013,2014,2015
 ./bin/tests/system/builtin/.gitignore		X	2014
 ./bin/tests/system/builtin/Makefile.in		MAKE	2014,2015
 ./bin/tests/system/builtin/clean.sh		SH	2014
@@ -1622,6 +1623,11 @@
 ./bin/tests/system/mkeys/prereq.sh		SH	2015
 ./bin/tests/system/mkeys/setup.sh		SH	2015
 ./bin/tests/system/mkeys/tests.sh		SH	2015
+./bin/tests/system/names/clean.sh		SH	2015
+./bin/tests/system/names/ns1/example.db		ZONE	2015
+./bin/tests/system/names/ns1/named.conf		CONF-C	2015
+./bin/tests/system/names/setup.sh		SH	2015
+./bin/tests/system/names/tests.sh		SH	2015
 ./bin/tests/system/notify/clean.sh		SH	2000,2001,2004,2007,2011,2012,2014,2015
 ./bin/tests/system/notify/ns1/named.conf	CONF-C	2000,2001,2004,2007
 ./bin/tests/system/notify/ns1/root.db		ZONE	2000,2001,2004,2007
@@ -3223,7 +3229,7 @@
 ./lib/dns/include/dns/cert.h			C	1999,2000,2001,2004,2005,2006,2007
 ./lib/dns/include/dns/client.h			C	2009,2013,2014
 ./lib/dns/include/dns/clientinfo.h		C	2011,2014
-./lib/dns/include/dns/compress.h		C	1999,2000,2001,2002,2004,2005,2006,2007,2009
+./lib/dns/include/dns/compress.h		C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2015
 ./lib/dns/include/dns/db.h			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011,2012,2013,2014,2015
 ./lib/dns/include/dns/dbiterator.h		C	1999,2000,2001,2004,2005,2006,2007
 ./lib/dns/include/dns/dbtable.h			C	1999,2000,2001,2004,2005,2006,2007
@@ -3232,7 +3238,7 @@
 ./lib/dns/include/dns/dlz.h			C.PORTION	1999,2000,2001,2005,2006,2007,2009,2010,2011,2012,2013
 ./lib/dns/include/dns/dlz_dlopen.h		C	2011,2012,2013
 ./lib/dns/include/dns/dns64.h			C	2010,2014
-./lib/dns/include/dns/dnssec.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2010,2011,2012,2013,2014
+./lib/dns/include/dns/dnssec.h			C	1999,2000,2001,2002,2004,2005,2006,2007,2009,2010,2011,2012,2013,2014,2015
 ./lib/dns/include/dns/dnstap.h			C	2015
 ./lib/dns/include/dns/dnstap.pb-c.h		X	2015
 ./lib/dns/include/dns/ds.h			C	2002,2004,2005,2006,2007,2010,2012,2014
@@ -3543,7 +3549,7 @@
 ./lib/dns/tests/keytable_test.c			C	2014,2015
 ./lib/dns/tests/master_test.c			C	2011,2012,2013,2015
 ./lib/dns/tests/mkraw.pl			PERL	2011,2012
-./lib/dns/tests/name_test.c			C	2014
+./lib/dns/tests/name_test.c			C	2014,2015
 ./lib/dns/tests/nsec3_test.c			C	2012,2014
 ./lib/dns/tests/peer_test.c			C	2014
 ./lib/dns/tests/private_test.c			C	2011,2012

From 4ba2689c1f4e0c8c670fc47307d7b46d9da3a45b Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Thu, 5 Nov 2015 23:45:25 +0000
Subject: [PATCH 30/39] update copyright notice / whitespace

---
 bin/tests/system/autosign/clean.sh       | 2 +-
 bin/tests/system/autosign/ns2/keygen.sh  | 2 +-
 bin/tests/system/autosign/ns3/keygen.sh  | 2 +-
 bin/tests/system/autosign/ns3/named.conf | 2 +-
 bin/tests/system/autosign/tests.sh       | 2 +-
 bin/tests/system/names/clean.sh          | 2 +-
 bin/tests/system/names/ns1/example.db    | 2 +-
 bin/tests/system/names/ns1/named.conf    | 2 +-
 bin/tests/system/names/tests.sh          | 2 +-
 lib/dns/include/dns/compress.h           | 2 +-
 lib/dns/include/dns/dnssec.h             | 2 +-
 lib/dns/tests/name_test.c                | 2 +-
 12 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/bin/tests/system/autosign/clean.sh b/bin/tests/system/autosign/clean.sh
index 2ca92e0950..11b3a312f5 100644
--- a/bin/tests/system/autosign/clean.sh
+++ b/bin/tests/system/autosign/clean.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2009-2014  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009-2015  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
diff --git a/bin/tests/system/autosign/ns2/keygen.sh b/bin/tests/system/autosign/ns2/keygen.sh
index 06e0cabc82..961775ec58 100644
--- a/bin/tests/system/autosign/ns2/keygen.sh
+++ b/bin/tests/system/autosign/ns2/keygen.sh
@@ -1,6 +1,6 @@
 #!/bin/sh -e
 #
-# Copyright (C) 2009-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
diff --git a/bin/tests/system/autosign/ns3/keygen.sh b/bin/tests/system/autosign/ns3/keygen.sh
index 70532dbf3a..11a7d45328 100644
--- a/bin/tests/system/autosign/ns3/keygen.sh
+++ b/bin/tests/system/autosign/ns3/keygen.sh
@@ -1,6 +1,6 @@
 #!/bin/sh -e
 #
-# Copyright (C) 2009-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
diff --git a/bin/tests/system/autosign/ns3/named.conf b/bin/tests/system/autosign/ns3/named.conf
index 67135500ff..01d3c6b043 100644
--- a/bin/tests/system/autosign/ns3/named.conf
+++ b/bin/tests/system/autosign/ns3/named.conf
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2013, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/bin/tests/system/autosign/tests.sh b/bin/tests/system/autosign/tests.sh
index 3986540498..286c09f8fa 100644
--- a/bin/tests/system/autosign/tests.sh
+++ b/bin/tests/system/autosign/tests.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2009-2014  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009-2015  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
diff --git a/bin/tests/system/names/clean.sh b/bin/tests/system/names/clean.sh
index 6e215b6306..8b9242d364 100644
--- a/bin/tests/system/names/clean.sh
+++ b/bin/tests/system/names/clean.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2013-2015  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2015  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
diff --git a/bin/tests/system/names/ns1/example.db b/bin/tests/system/names/ns1/example.db
index bcc1d6ed84..ac0202f1eb 100644
--- a/bin/tests/system/names/ns1/example.db
+++ b/bin/tests/system/names/ns1/example.db
@@ -1,4 +1,4 @@
-; Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2015  Internet Systems Consortium, Inc. ("ISC")
 ;
 ; Permission to use, copy, modify, and/or distribute this software for any
 ; purpose with or without fee is hereby granted, provided that the above
diff --git a/bin/tests/system/names/ns1/named.conf b/bin/tests/system/names/ns1/named.conf
index 04bc6b38af..4610778eba 100644
--- a/bin/tests/system/names/ns1/named.conf
+++ b/bin/tests/system/names/ns1/named.conf
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
diff --git a/bin/tests/system/names/tests.sh b/bin/tests/system/names/tests.sh
index e5ee4aebad..9fe49ece25 100644
--- a/bin/tests/system/names/tests.sh
+++ b/bin/tests/system/names/tests.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2013-2015  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2015  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
diff --git a/lib/dns/include/dns/compress.h b/lib/dns/include/dns/compress.h
index 10ee321979..1b9f22c6d2 100644
--- a/lib/dns/include/dns/compress.h
+++ b/lib/dns/include/dns/compress.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009, 2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h
index a236884a47..59bc7c1632 100644
--- a/lib/dns/include/dns/dnssec.h
+++ b/lib/dns/include/dns/dnssec.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
diff --git a/lib/dns/tests/name_test.c b/lib/dns/tests/name_test.c
index 1a36de7c31..94eb5ef7d1 100644
--- a/lib/dns/tests/name_test.c
+++ b/lib/dns/tests/name_test.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above

From e74212eb2fc6e67cdd94d5b6ed4c517fd569ae7f Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 6 Nov 2015 10:58:05 +1100
Subject: [PATCH 31/39] remove bin/tests/compress_test.c

---
 util/copyrights | 1 -
 1 file changed, 1 deletion(-)

diff --git a/util/copyrights b/util/copyrights
index d0e7940963..12af4428ea 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -421,7 +421,6 @@
 ./bin/tests/byaddr_test.c			C	2000,2001,2002,2004,2005,2007,2012,2015
 ./bin/tests/byname_test.c			C	2000,2001,2004,2005,2007,2009,2012,2015
 ./bin/tests/cfg_test.c				C	2001,2002,2004,2005,2007,2009,2010,2011,2015
-./bin/tests/compress_test.c			C	1999,2000,2001,2004,2005,2006,2007,2015
 ./bin/tests/db/Makefile.in			MAKE	1999,2000,2001,2002,2004,2007,2009,2010,2012,2014
 ./bin/tests/db/dns_db_class_1.data		X	1999,2000,2001
 ./bin/tests/db/dns_db_class_data		X	1999,2000,2001

From e62b9c9ce6413fb183c8116381e75dcd07ca5517 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Fri, 6 Nov 2015 01:04:13 +0000
Subject: [PATCH 32/39] regen master

---
 bin/dnssec/dnssec-dsfromkey.html     |  96 ++++----
 bin/dnssec/dnssec-importkey.8        |  18 +-
 bin/dnssec/dnssec-importkey.html     |  66 ++---
 bin/dnssec/dnssec-keyfromlabel.8     |  16 +-
 bin/dnssec/dnssec-keyfromlabel.html  | 262 ++++++++++----------
 bin/dnssec/dnssec-keygen.8           |  16 +-
 bin/dnssec/dnssec-keygen.html        | 352 ++++++++++++++-------------
 bin/dnssec/dnssec-settime.8          |  28 ++-
 bin/dnssec/dnssec-settime.html       |  43 ++--
 doc/arm/Bv9ARM.ch06.html             |  10 +
 doc/arm/Bv9ARM.ch09.html             |   7 +
 doc/arm/man.dnssec-dsfromkey.html    |  96 ++++----
 doc/arm/man.dnssec-importkey.html    |  66 ++---
 doc/arm/man.dnssec-keyfromlabel.html | 262 ++++++++++----------
 doc/arm/man.dnssec-keygen.html       | 352 ++++++++++++++-------------
 doc/arm/man.dnssec-settime.html      |  43 ++--
 doc/arm/man.dnstap-read.html         |   4 +-
 doc/arm/man.lwresd.html              |  10 +-
 doc/arm/man.named.conf.html          |   4 +-
 doc/arm/notes.html                   |   7 +
 20 files changed, 956 insertions(+), 802 deletions(-)

diff --git a/bin/dnssec/dnssec-dsfromkey.html b/bin/dnssec/dnssec-dsfromkey.html
index 269ab16cde..207527d043 100644
--- a/bin/dnssec/dnssec-dsfromkey.html
+++ b/bin/dnssec/dnssec-dsfromkey.html
@@ -43,52 +43,52 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-1</span></dt>
 <dd><p>
-            Use SHA-1 as the digest algorithm (the default is to use
-            both SHA-1 and SHA-256).
-          </p></dd>
+	    Use SHA-1 as the digest algorithm (the default is to use
+	    both SHA-1 and SHA-256).
+	  </p></dd>
 <dt><span class="term">-2</span></dt>
 <dd><p>
-            Use SHA-256 as the digest algorithm.
-          </p></dd>
+	    Use SHA-256 as the digest algorithm.
+	  </p></dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd><p>
-            Select the digest algorithm. The value of
-            <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
-            SHA-256 (SHA256), GOST or SHA-384 (SHA384).
-            These values are case insensitive.
-          </p></dd>
+	    Select the digest algorithm. The value of
+	    <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
+	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
+	    These values are case insensitive.
+	  </p></dd>
 <dt><span class="term">-C</span></dt>
 <dd><p>
-            Generate CDS records rather than DS records.  This is mutually
+	    Generate CDS records rather than DS records.  This is mutually
 	    exclusive with generating lookaside records.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
 <dd><p>
-            Specifies the TTL of the DS records.
-          </p></dd>
+	    Specifies the TTL of the DS records.
+	  </p></dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            Look for key files (or, in keyset mode,
-            <code class="filename">keyset-</code> files) in
-            <code class="option">directory</code>.
-          </p></dd>
+	    Look for key files (or, in keyset mode,
+	    <code class="filename">keyset-</code> files) in
+	    <code class="option">directory</code>.
+	  </p></dd>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
 <dd>
 <p>
-            Zone file mode: in place of the keyfile name, the argument is
-            the DNS domain name of a zone master file, which can be read
-            from <code class="option">file</code>.  If the zone name is the same as
-            <code class="option">file</code>, then it may be omitted.
-          </p>
+	    Zone file mode: in place of the keyfile name, the argument is
+	    the DNS domain name of a zone master file, which can be read
+	    from <code class="option">file</code>.  If the zone name is the same as
+	    <code class="option">file</code>, then it may be omitted.
+	  </p>
 <p>
-            If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
-            the zone data is read from the standard input.  This makes it
-            possible to use the output of the <span class="command"><strong>dig</strong></span>
-            command as input, as in:
-          </p>
+	    If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
+	    the zone data is read from the standard input.  This makes it
+	    possible to use the output of the <span class="command"><strong>dig</strong></span>
+	    command as input, as in:
+	  </p>
 <p>
-            <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
-          </p>
+	    <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
+	  </p>
 </dd>
 <dt><span class="term">-A</span></dt>
 <dd><p>
@@ -98,35 +98,35 @@
           </p></dd>
 <dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
 <dd><p>
-            Generate a DLV set instead of a DS set.  The specified
-            <code class="option">domain</code> is appended to the name for each
-            record in the set.
-            The DNSSEC Lookaside Validation (DLV) RR is described
-            in RFC 4431.  This is mutually exclusive with generating
+	    Generate a DLV set instead of a DS set.  The specified
+	    <code class="option">domain</code> is appended to the name for each
+	    record in the set.
+	    The DNSSEC Lookaside Validation (DLV) RR is described
+	    in RFC 4431.  This is mutually exclusive with generating
 	    CDS records.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-s</span></dt>
 <dd><p>
-            Keyset mode: in place of the keyfile name, the argument is
-            the DNS domain name of a keyset file.
-          </p></dd>
+	    Keyset mode: in place of the keyfile name, the argument is
+	    the DNS domain name of a keyset file.
+	  </p></dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd><p>
-            Specifies the DNS class (default is IN).  Useful only
-            in keyset or zone file mode.
-          </p></dd>
+	    Specifies the DNS class (default is IN).  Useful only
+	    in keyset or zone file mode.
+	  </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
 <dd><p>
-            Sets the debugging level.
-          </p></dd>
+	    Sets the debugging level.
+	  </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
-            Prints usage information.
-          </p></dd>
+	    Prints usage information.
+	  </p></dd>
 <dt><span class="term">-V</span></dt>
 <dd><p>
-            Prints version information.
-          </p></dd>
+	    Prints version information.
+	  </p></dd>
 </dl></div>
 </div>
 <div class="refsection">
diff --git a/bin/dnssec/dnssec-importkey.8 b/bin/dnssec/dnssec-importkey.8
index 2d1d0b7188..3940077200 100644
--- a/bin/dnssec/dnssec-importkey.8
+++ b/bin/dnssec/dnssec-importkey.8
@@ -18,12 +18,12 @@
 .\"     Title: dnssec-importkey
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2014-02-20
+.\"      Date: August 21, 2015
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "DNSSEC\-IMPORTKEY" "8" "2014\-02\-20" "ISC" "BIND9"
+.TH "DNSSEC\-IMPORTKEY" "8" "August 21, 2015" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -47,9 +47,9 @@
 dnssec-importkey \- Import DNSKEY records from external systems so they can be managed\&.
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-importkey\fR\ 'u
-\fBdnssec\-importkey\fR [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] {\fBkeyfile\fR}
+\fBdnssec\-importkey\fR [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] {\fBkeyfile\fR}
 .HP \w'\fBdnssec\-importkey\fR\ 'u
-\fBdnssec\-importkey\fR {\fB\-f\ \fR\fB\fIfilename\fR\fR} [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fBdnsname\fR]
+\fBdnssec\-importkey\fR {\fB\-f\ \fR\fB\fIfilename\fR\fR} [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fBdnsname\fR]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-importkey\fR
@@ -109,10 +109,20 @@ Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argume
 Sets the date on which a key is to be published to the zone\&. After that date, the key will be included in the zone but will not be used to sign it\&.
 .RE
 .PP
+\-P sync \fIdate/offset\fR
+.RS 4
+Sets the date on which CDS and CDNSKEY records that match this key are to be published to the zone\&.
+.RE
+.PP
 \-D \fIdate/offset\fR
 .RS 4
 Sets the date on which the key is to be deleted\&. After that date, the key will no longer be included in the zone\&. (It may remain in the key repository, however\&.)
 .RE
+.PP
+\-D sync \fIdate/offset\fR
+.RS 4
+Sets the date on which the CDS and CDNSKEY records that match this key are to be deleted\&.
+.RE
 .SH "FILES"
 .PP
 A keyfile can be designed by the key identification
diff --git a/bin/dnssec/dnssec-importkey.html b/bin/dnssec/dnssec-importkey.html
index 5417a5415b..6f1d657ffc 100644
--- a/bin/dnssec/dnssec-importkey.html
+++ b/bin/dnssec/dnssec-importkey.html
@@ -28,8 +28,8 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] {<code class="option">keyfile</code>}</p></div>
-<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>} [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">dnsname</code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] {<code class="option">keyfile</code>}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>} [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">dnsname</code>]</p></div>
 </div>
 <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
@@ -57,37 +57,37 @@
 <dt><span class="term">-f <em class="replaceable"><code>filename</code></em></span></dt>
 <dd>
 <p>
-            Zone file mode: instead of a public keyfile name, the argument
+	    Zone file mode: instead of a public keyfile name, the argument
 	    is the DNS domain name of a zone master file, which can be read
-            from <code class="option">file</code>.  If the domain name is the same as
-            <code class="option">file</code>, then it may be omitted.
-          </p>
+	    from <code class="option">file</code>.  If the domain name is the same as
+	    <code class="option">file</code>, then it may be omitted.
+	  </p>
 <p>
-            If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
-            the zone data is read from the standard input.
-          </p>
+	    If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
+	    the zone data is read from the standard input.
+	  </p>
 </dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            Sets the directory in which the key files are to reside.
-          </p></dd>
+	    Sets the directory in which the key files are to reside.
+	  </p></dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
 <dd><p>
-            Sets the default TTL to use for this key when it is converted
-            into a DNSKEY RR.  If the key is imported into a zone,
-            this is the TTL that will be used for it, unless there was
-            already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <code class="literal">0</code> or <code class="literal">none</code> removes it.
-          </p></dd>
+	    Sets the default TTL to use for this key when it is converted
+	    into a DNSKEY RR.  If the key is imported into a zone,
+	    this is the TTL that will be used for it, unless there was
+	    already a DNSKEY RRset in place, in which case the existing TTL
+	    would take precedence.  Setting the default TTL to
+	    <code class="literal">0</code> or <code class="literal">none</code> removes it.
+	  </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
 	    Emit usage message and exit.
 	  </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
 <dd><p>
-            Sets the debugging level.
-          </p></dd>
+	    Sets the debugging level.
+	  </p></dd>
 <dt><span class="term">-V</span></dt>
 <dd><p>
 	    Prints version information.
@@ -110,16 +110,26 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which a key is to be published to the zone.
-            After that date, the key will be included in the zone but will
-            not be used to sign it.
-          </p></dd>
+	    Sets the date on which a key is to be published to the zone.
+	    After that date, the key will be included in the zone but will
+	    not be used to sign it.
+	  </p></dd>
+<dt><span class="term">-P sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which CDS and CDNSKEY records that match this
+	    key are to be published to the zone.
+	  </p></dd>
 <dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be deleted.  After that
-            date, the key will no longer be included in the zone.  (It
-            may remain in the key repository, however.)
-          </p></dd>
+	    Sets the date on which the key is to be deleted.  After that
+	    date, the key will no longer be included in the zone.  (It
+	    may remain in the key repository, however.)
+	  </p></dd>
+<dt><span class="term">-D sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which the CDS and CDNSKEY records that match
+	    this key are to be deleted.
+	  </p></dd>
 </dl></div>
 </div>
 <div class="refsection">
diff --git a/bin/dnssec/dnssec-keyfromlabel.8 b/bin/dnssec/dnssec-keyfromlabel.8
index 8822519e11..90aaaf78e3 100644
--- a/bin/dnssec/dnssec-keyfromlabel.8
+++ b/bin/dnssec/dnssec-keyfromlabel.8
@@ -18,12 +18,12 @@
 .\"     Title: dnssec-keyfromlabel
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2014-02-27
+.\"      Date: August 27, 2015
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "DNSSEC\-KEYFROMLABEL" "8" "2014\-02\-27" "ISC" "BIND9"
+.TH "DNSSEC\-KEYFROMLABEL" "8" "August 27, 2015" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -47,7 +47,7 @@
 dnssec-keyfromlabel \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keyfromlabel\fR\ 'u
-\fBdnssec\-keyfromlabel\fR {\-l\ \fIlabel\fR} [\fB\-3\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-k\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-y\fR] {name}
+\fBdnssec\-keyfromlabel\fR {\-l\ \fIlabel\fR} [\fB\-3\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-k\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-y\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keyfromlabel\fR
@@ -201,6 +201,11 @@ Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argume
 Sets the date on which a key is to be published to the zone\&. After that date, the key will be included in the zone but will not be used to sign it\&. If not set, and if the \-G option has not been used, the default is "now"\&.
 .RE
 .PP
+\-P sync \fIdate/offset\fR
+.RS 4
+Sets the date on which the CDS and CDNSKEY records which match this key are to be published to the zone\&.
+.RE
+.PP
 \-A \fIdate/offset\fR
 .RS 4
 Sets the date on which the key is to be activated\&. After that date, the key will be included in the zone and used to sign it\&. If not set, and if the \-G option has not been used, the default is "now"\&.
@@ -221,6 +226,11 @@ Sets the date on which the key is to be retired\&. After that date, the key will
 Sets the date on which the key is to be deleted\&. After that date, the key will no longer be included in the zone\&. (It may remain in the key repository, however\&.)
 .RE
 .PP
+\-D sync \fIdate/offset\fR
+.RS 4
+Sets the date on which the CDS and CDNSKEY records which match this key are to be deleted\&.
+.RE
+.PP
 \-i \fIinterval\fR
 .RS 4
 Sets the prepublication interval for a key\&. If set, then the publication and activation dates must be separated by at least this much time\&. If the activation date is specified but the publication date isn\*(Aqt, then the publication date will default to this much time before the activation date; conversely, if the publication date is specified but activation date isn\*(Aqt, then activation will be set to this much time after publication\&.
diff --git a/bin/dnssec/dnssec-keyfromlabel.html b/bin/dnssec/dnssec-keyfromlabel.html
index 93037d9bf1..df6acbf996 100644
--- a/bin/dnssec/dnssec-keyfromlabel.html
+++ b/bin/dnssec/dnssec-keyfromlabel.html
@@ -27,7 +27,7 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code>  {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code>  {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
 </div>
 <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
@@ -52,87 +52,87 @@
 <dd>
 <p>
 	    Selects the cryptographic algorithm.  The value of
-            <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
+	    <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256 or ECDSAP384SHA384.
 	    These values are case insensitive.
 	  </p>
 <p>
-            If no algorithm is specified, then RSASHA1 will be used by
-            default, unless the <code class="option">-3</code> option is specified,
-            in which case NSEC3RSASHA1 will be used instead.  (If
-            <code class="option">-3</code> is used and an algorithm is specified,
-            that algorithm will be checked for compatibility with NSEC3.)
-          </p>
+	    If no algorithm is specified, then RSASHA1 will be used by
+	    default, unless the <code class="option">-3</code> option is specified,
+	    in which case NSEC3RSASHA1 will be used instead.  (If
+	    <code class="option">-3</code> is used and an algorithm is specified,
+	    that algorithm will be checked for compatibility with NSEC3.)
+	  </p>
 <p>
-            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
-            algorithm, and DSA is recommended.
-          </p>
+	    Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
+	    algorithm, and DSA is recommended.
+	  </p>
 <p>
-            Note 2: DH automatically sets the -k flag.
-          </p>
+	    Note 2: DH automatically sets the -k flag.
+	  </p>
 </dd>
 <dt><span class="term">-3</span></dt>
 <dd><p>
 	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-            If this option is used and no algorithm is explicitly
-            set on the command line, NSEC3RSASHA1 will be used by
-            default.
-          </p></dd>
+	    If this option is used and no algorithm is explicitly
+	    set on the command line, NSEC3RSASHA1 will be used by
+	    default.
+	  </p></dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
 <dd>
 <p>
-            Specifies the cryptographic hardware to use.
-          </p>
+	    Specifies the cryptographic hardware to use.
+	  </p>
 <p>
-            When BIND is built with OpenSSL PKCS#11 support, this defaults
-            to the string "pkcs11", which identifies an OpenSSL engine
-            that can drive a cryptographic accelerator or hardware service
-            module.  When BIND is built with native PKCS#11 cryptography
-            (--enable-native-pkcs11), it defaults to the path of the PKCS#11
-            provider library specified via "--with-pkcs11".
-          </p>
+	    When BIND is built with OpenSSL PKCS#11 support, this defaults
+	    to the string "pkcs11", which identifies an OpenSSL engine
+	    that can drive a cryptographic accelerator or hardware service
+	    module.  When BIND is built with native PKCS#11 cryptography
+	    (--enable-native-pkcs11), it defaults to the path of the PKCS#11
+	    provider library specified via "--with-pkcs11".
+	  </p>
 </dd>
 <dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
 <dd>
 <p>
-            Specifies the label for a key pair in the crypto hardware.
-          </p>
+	    Specifies the label for a key pair in the crypto hardware.
+	  </p>
 <p>
-            When <acronym class="acronym">BIND</acronym> 9 is built with OpenSSL-based
-            PKCS#11 support, the label is an arbitrary string that
-            identifies a particular key.  It may be preceded by an
-            optional OpenSSL engine name, followed by a colon, as in
-            "pkcs11:<em class="replaceable"><code>keylabel</code></em>".
-          </p>
+	    When <acronym class="acronym">BIND</acronym> 9 is built with OpenSSL-based
+	    PKCS#11 support, the label is an arbitrary string that
+	    identifies a particular key.  It may be preceded by an
+	    optional OpenSSL engine name, followed by a colon, as in
+	    "pkcs11:<em class="replaceable"><code>keylabel</code></em>".
+	  </p>
 <p>
-            When <acronym class="acronym">BIND</acronym> 9 is built with native PKCS#11
-            support, the label is a PKCS#11 URI string in the format
-            "pkcs11:<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>[<span class="optional">;<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>;...</span>]"
-            Keywords include "token", which identifies the HSM; "object", which
-            identifies the key; and "pin-source", which identifies a file from
-            which the HSM's PIN code can be obtained.  The label will be
-            stored in the on-disk "private" file.
-          </p>
+	    When <acronym class="acronym">BIND</acronym> 9 is built with native PKCS#11
+	    support, the label is a PKCS#11 URI string in the format
+	    "pkcs11:<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>[<span class="optional">;<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>;...</span>]"
+	    Keywords include "token", which identifies the HSM; "object", which
+	    identifies the key; and "pin-source", which identifies a file from
+	    which the HSM's PIN code can be obtained.  The label will be
+	    stored in the on-disk "private" file.
+	  </p>
 <p>
-            If the label contains a
-            <code class="option">pin-source</code> field, tools using the generated
-            key files will be able to use the HSM for signing and other
-            operations without any need for an operator to manually enter
-            a PIN.  Note: Making the HSM's PIN accessible in this manner
-            may reduce the security advantage of using an HSM; be sure
-            this is what you want to do before making use of this feature.
-          </p>
+	    If the label contains a
+	    <code class="option">pin-source</code> field, tools using the generated
+	    key files will be able to use the HSM for signing and other
+	    operations without any need for an operator to manually enter
+	    a PIN.  Note: Making the HSM's PIN accessible in this manner
+	    may reduce the security advantage of using an HSM; be sure
+	    this is what you want to do before making use of this feature.
+	  </p>
 </dd>
 <dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
 <dd><p>
-            Specifies the owner type of the key.  The value of
-            <code class="option">nametype</code> must either be ZONE (for a DNSSEC
-            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-            a host (KEY)),
-            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-            These values are case insensitive.
-          </p></dd>
+	    Specifies the owner type of the key.  The value of
+	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
+	    a host (KEY)),
+	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
+	    These values are case insensitive.
+	  </p></dd>
 <dt><span class="term">-C</span></dt>
 <dd><p>
 	    Compatibility mode:  generates an old-style key, without
@@ -142,84 +142,84 @@
 	    (publication date, activation date, etc).  Keys that include
 	    this data may be incompatible with older versions of BIND; the
 	    <code class="option">-C</code> option suppresses them.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd><p>
-            Indicates that the DNS record containing the key should have
-            the specified class.  If not specified, class IN is used.
-          </p></dd>
+	    Indicates that the DNS record containing the key should have
+	    the specified class.  If not specified, class IN is used.
+	  </p></dd>
 <dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
 <dd><p>
-            Set the specified flag in the flag field of the KEY/DNSKEY record.
-            The only recognized flags are KSK (Key Signing Key) and REVOKE.
-          </p></dd>
+	    Set the specified flag in the flag field of the KEY/DNSKEY record.
+	    The only recognized flags are KSK (Key Signing Key) and REVOKE.
+	  </p></dd>
 <dt><span class="term">-G</span></dt>
 <dd><p>
-            Generate a key, but do not publish it or sign with it.  This
-            option is incompatible with -P and -A.
-          </p></dd>
+	    Generate a key, but do not publish it or sign with it.  This
+	    option is incompatible with -P and -A.
+	  </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
-            Prints a short summary of the options and arguments to
-            <span class="command"><strong>dnssec-keyfromlabel</strong></span>.
-          </p></dd>
+	    Prints a short summary of the options and arguments to
+	    <span class="command"><strong>dnssec-keyfromlabel</strong></span>.
+	  </p></dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            Sets the directory in which the key files are to be written.
-          </p></dd>
+	    Sets the directory in which the key files are to be written.
+	  </p></dd>
 <dt><span class="term">-k</span></dt>
 <dd><p>
-            Generate KEY records rather than DNSKEY records.
-          </p></dd>
+	    Generate KEY records rather than DNSKEY records.
+	  </p></dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
 <dd><p>
-            Sets the default TTL to use for this key when it is converted
-            into a DNSKEY RR.  If the key is imported into a zone,
-            this is the TTL that will be used for it, unless there was
-            already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <code class="literal">0</code> or <code class="literal">none</code> removes it.
-          </p></dd>
+	    Sets the default TTL to use for this key when it is converted
+	    into a DNSKEY RR.  If the key is imported into a zone,
+	    this is the TTL that will be used for it, unless there was
+	    already a DNSKEY RRset in place, in which case the existing TTL
+	    would take precedence.  Setting the default TTL to
+	    <code class="literal">0</code> or <code class="literal">none</code> removes it.
+	  </p></dd>
 <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
 <dd><p>
-            Sets the protocol value for the key.  The protocol
-            is a number between 0 and 255.  The default is 3 (DNSSEC).
-            Other possible values for this argument are listed in
-            RFC 2535 and its successors.
-          </p></dd>
+	    Sets the protocol value for the key.  The protocol
+	    is a number between 0 and 255.  The default is 3 (DNSSEC).
+	    Other possible values for this argument are listed in
+	    RFC 2535 and its successors.
+	  </p></dd>
 <dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
 <dd><p>
-            Generate a key as an explicit successor to an existing key.
+	    Generate a key as an explicit successor to an existing key.
 	    The name, algorithm, size, and type of the key will be set
 	    to match the predecessor. The activation date of the new
 	    key will be set to the inactivation date of the existing
 	    one. The publication date will be set to the activation
 	    date minus the prepublication interval, which defaults to
 	    30 days.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd><p>
-            Indicates the use of the key.  <code class="option">type</code> must be
-            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-            is AUTHCONF.  AUTH refers to the ability to authenticate
-            data, and CONF the ability to encrypt data.
-          </p></dd>
+	    Indicates the use of the key.  <code class="option">type</code> must be
+	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
+	    is AUTHCONF.  AUTH refers to the ability to authenticate
+	    data, and CONF the ability to encrypt data.
+	  </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
 <dd><p>
-            Sets the debugging level.
-          </p></dd>
+	    Sets the debugging level.
+	  </p></dd>
 <dt><span class="term">-V</span></dt>
 <dd><p>
 	    Prints version information.
 	  </p></dd>
 <dt><span class="term">-y</span></dt>
 <dd><p>
-            Allows DNSSEC key files to be generated even if the key ID
+	    Allows DNSSEC key files to be generated even if the key ID
 	    would collide with that of an existing key, in the event of
 	    either key being revoked.  (This is only safe to use if you
-            are sure you won't be using RFC 5011 trust anchor maintenance
-            with either of the keys involved.)
-          </p></dd>
+	    are sure you won't be using RFC 5011 trust anchor maintenance
+	    with either of the keys involved.)
+	  </p></dd>
 </dl></div>
 </div>
 <div class="refsection">
@@ -238,36 +238,46 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which a key is to be published to the zone.
-            After that date, the key will be included in the zone but will
-            not be used to sign it.  If not set, and if the -G option has
-            not been used, the default is "now".
-          </p></dd>
+	    Sets the date on which a key is to be published to the zone.
+	    After that date, the key will be included in the zone but will
+	    not be used to sign it.  If not set, and if the -G option has
+	    not been used, the default is "now".
+	  </p></dd>
+<dt><span class="term">-P sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which the CDS and CDNSKEY records which match
+	    this key are to be published to the zone.
+	  </p></dd>
 <dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be activated.  After that
-            date, the key will be included in the zone and used to sign
-            it.  If not set, and if the -G option has not been used, the
-            default is "now".
-          </p></dd>
+	    Sets the date on which the key is to be activated.  After that
+	    date, the key will be included in the zone and used to sign
+	    it.  If not set, and if the -G option has not been used, the
+	    default is "now".
+	  </p></dd>
 <dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be revoked.  After that
-            date, the key will be flagged as revoked.  It will be included
-            in the zone and will be used to sign it.
-          </p></dd>
+	    Sets the date on which the key is to be revoked.  After that
+	    date, the key will be flagged as revoked.  It will be included
+	    in the zone and will be used to sign it.
+	  </p></dd>
 <dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be retired.  After that
-            date, the key will still be included in the zone, but it
-            will not be used to sign it.
-          </p></dd>
+	    Sets the date on which the key is to be retired.  After that
+	    date, the key will still be included in the zone, but it
+	    will not be used to sign it.
+	  </p></dd>
 <dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be deleted.  After that
-            date, the key will no longer be included in the zone.  (It
-            may remain in the key repository, however.)
-          </p></dd>
+	    Sets the date on which the key is to be deleted.  After that
+	    date, the key will no longer be included in the zone.  (It
+	    may remain in the key repository, however.)
+	  </p></dd>
+<dt><span class="term">-D sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which the CDS and CDNSKEY records which match
+	    this key are to be deleted.
+	  </p></dd>
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
 <p>
@@ -305,13 +315,13 @@
     </p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem"><p><code class="filename">nnnn</code> is the key name.
-        </p></li>
+	</p></li>
 <li class="listitem"><p><code class="filename">aaa</code> is the numeric representation
-          of the algorithm.
-        </p></li>
+	  of the algorithm.
+	</p></li>
 <li class="listitem"><p><code class="filename">iiiii</code> is the key identifier (or
-          footprint).
-        </p></li>
+	  footprint).
+	</p></li>
 </ul></div>
 <p><span class="command"><strong>dnssec-keyfromlabel</strong></span>
       creates two files, with names based
diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8
index 8a56cd5d25..55488e99c3 100644
--- a/bin/dnssec/dnssec-keygen.8
+++ b/bin/dnssec/dnssec-keygen.8
@@ -19,12 +19,12 @@
 .\"     Title: dnssec-keygen
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2014-02-06
+.\"      Date: August 21, 2015
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "DNSSEC\-KEYGEN" "8" "2014\-02\-06" "ISC" "BIND9"
+.TH "DNSSEC\-KEYGEN" "8" "August 21, 2015" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -48,7 +48,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-k\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-z\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -228,6 +228,11 @@ Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argume
 Sets the date on which a key is to be published to the zone\&. After that date, the key will be included in the zone but will not be used to sign it\&. If not set, and if the \-G option has not been used, the default is "now"\&.
 .RE
 .PP
+\-P sync \fIdate/offset\fR
+.RS 4
+Sets the date on which CDS and CDNSKEY records that match this key are to be published to the zone\&.
+.RE
+.PP
 \-A \fIdate/offset\fR
 .RS 4
 Sets the date on which the key is to be activated\&. After that date, the key will be included in the zone and used to sign it\&. If not set, and if the \-G option has not been used, the default is "now"\&. If set, if and \-P is not set, then the publication date will be set to the activation date minus the prepublication interval\&.
@@ -248,6 +253,11 @@ Sets the date on which the key is to be retired\&. After that date, the key will
 Sets the date on which the key is to be deleted\&. After that date, the key will no longer be included in the zone\&. (It may remain in the key repository, however\&.)
 .RE
 .PP
+\-D sync \fIdate/offset\fR
+.RS 4
+Sets the date on which the CDS and CDNSKEY records that match this key are to be deleted\&.
+.RE
+.PP
 \-i \fIinterval\fR
 .RS 4
 Sets the prepublication interval for a key\&. If set, then the publication and activation dates must be separated by at least this much time\&. If the activation date is specified but the publication date isn\*(Aqt, then the publication date will default to this much time before the activation date; conversely, if the publication date is specified but activation date isn\*(Aqt, then activation will be set to this much time after publication\&.
diff --git a/bin/dnssec/dnssec-keygen.html b/bin/dnssec/dnssec-keygen.html
index 2aeda3c217..c39b274697 100644
--- a/bin/dnssec/dnssec-keygen.html
+++ b/bin/dnssec/dnssec-keygen.html
@@ -28,7 +28,7 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-z</code>] {name}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k</code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {name}</p></div>
 </div>
 <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
@@ -50,72 +50,72 @@
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
 <p>
-            Selects the cryptographic algorithm.  For DNSSEC keys, the value
-            of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
+	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
+	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256 or ECDSAP384SHA384.
 	    For TSIG/TKEY, the value must
-            be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
-            HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512.  These values are
-            case insensitive.
-          </p>
+	    be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
+	    HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512.  These values are
+	    case insensitive.
+	  </p>
 <p>
-            If no algorithm is specified, then RSASHA1 will be used by
-            default, unless the <code class="option">-3</code> option is specified,
-            in which case NSEC3RSASHA1 will be used instead.  (If
-            <code class="option">-3</code> is used and an algorithm is specified,
-            that algorithm will be checked for compatibility with NSEC3.)
-          </p>
+	    If no algorithm is specified, then RSASHA1 will be used by
+	    default, unless the <code class="option">-3</code> option is specified,
+	    in which case NSEC3RSASHA1 will be used instead.  (If
+	    <code class="option">-3</code> is used and an algorithm is specified,
+	    that algorithm will be checked for compatibility with NSEC3.)
+	  </p>
 <p>
-            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
-            algorithm, and DSA is recommended.  For TSIG, HMAC-MD5 is
+	    Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
+	    algorithm, and DSA is recommended.  For TSIG, HMAC-MD5 is
 	    mandatory.
-          </p>
+	  </p>
 <p>
-            Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
-            automatically set the -T KEY option.
-          </p>
+	    Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
+	    automatically set the -T KEY option.
+	  </p>
 </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
 <dd>
 <p>
-            Specifies the number of bits in the key.  The choice of key
-            size depends on the algorithm used.  RSA keys must be
-            between 512 and 2048 bits.  Diffie Hellman keys must be between
-            128 and 4096 bits.  DSA keys must be between 512 and 1024
-            bits and an exact multiple of 64.  HMAC keys must be
-            between 1 and 512 bits. Elliptic curve algorithms don't need
-            this parameter.
-          </p>
+	    Specifies the number of bits in the key.  The choice of key
+	    size depends on the algorithm used.  RSA keys must be
+	    between 512 and 2048 bits.  Diffie Hellman keys must be between
+	    128 and 4096 bits.  DSA keys must be between 512 and 1024
+	    bits and an exact multiple of 64.  HMAC keys must be
+	    between 1 and 512 bits. Elliptic curve algorithms don't need
+	    this parameter.
+	  </p>
 <p>
-            The key size does not need to be specified if using a default
-            algorithm.  The default key size is 1024 bits for zone signing
-            keys (ZSKs) and 2048 bits for key signing keys (KSKs,
-            generated with <code class="option">-f KSK</code>).  However, if an
-            algorithm is explicitly specified with the <code class="option">-a</code>,
-            then there is no default key size, and the <code class="option">-b</code>
-            must be used.
-          </p>
+	    The key size does not need to be specified if using a default
+	    algorithm.  The default key size is 1024 bits for zone signing
+	    keys (ZSKs) and 2048 bits for key signing keys (KSKs,
+	    generated with <code class="option">-f KSK</code>).  However, if an
+	    algorithm is explicitly specified with the <code class="option">-a</code>,
+	    then there is no default key size, and the <code class="option">-b</code>
+	    must be used.
+	  </p>
 </dd>
 <dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
 <dd><p>
-            Specifies the owner type of the key.  The value of
-            <code class="option">nametype</code> must either be ZONE (for a DNSSEC
-            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-            a host (KEY)),
-            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-            These values are case insensitive.  Defaults to ZONE for DNSKEY
+	    Specifies the owner type of the key.  The value of
+	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
+	    a host (KEY)),
+	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
+	    These values are case insensitive.  Defaults to ZONE for DNSKEY
 	    generation.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-3</span></dt>
 <dd><p>
 	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-            If this option is used and no algorithm is explicitly
-            set on the command line, NSEC3RSASHA1 will be used by
-            default. Note that RSASHA256, RSASHA512, ECCGOST,
+	    If this option is used and no algorithm is explicitly
+	    set on the command line, NSEC3RSASHA1 will be used by
+	    default. Note that RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256 and ECDSAP384SHA384 algorithms
 	    are NSEC3-capable.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-C</span></dt>
 <dd><p>
 	    Compatibility mode:  generates an old-style key, without
@@ -125,142 +125,142 @@
 	    (publication date, activation date, etc).  Keys that include
 	    this data may be incompatible with older versions of BIND; the
 	    <code class="option">-C</code> option suppresses them.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd><p>
-            Indicates that the DNS record containing the key should have
-            the specified class.  If not specified, class IN is used.
-          </p></dd>
+	    Indicates that the DNS record containing the key should have
+	    the specified class.  If not specified, class IN is used.
+	  </p></dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
 <dd>
 <p>
-            Specifies the cryptographic hardware to use, when applicable.
-          </p>
+	    Specifies the cryptographic hardware to use, when applicable.
+	  </p>
 <p>
-            When BIND is built with OpenSSL PKCS#11 support, this defaults
-            to the string "pkcs11", which identifies an OpenSSL engine
-            that can drive a cryptographic accelerator or hardware service
-            module.  When BIND is built with native PKCS#11 cryptography
-            (--enable-native-pkcs11), it defaults to the path of the PKCS#11
-            provider library specified via "--with-pkcs11".
-          </p>
+	    When BIND is built with OpenSSL PKCS#11 support, this defaults
+	    to the string "pkcs11", which identifies an OpenSSL engine
+	    that can drive a cryptographic accelerator or hardware service
+	    module.  When BIND is built with native PKCS#11 cryptography
+	    (--enable-native-pkcs11), it defaults to the path of the PKCS#11
+	    provider library specified via "--with-pkcs11".
+	  </p>
 </dd>
 <dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
 <dd><p>
-            Set the specified flag in the flag field of the KEY/DNSKEY record.
-            The only recognized flags are KSK (Key Signing Key) and REVOKE.
-          </p></dd>
+	    Set the specified flag in the flag field of the KEY/DNSKEY record.
+	    The only recognized flags are KSK (Key Signing Key) and REVOKE.
+	  </p></dd>
 <dt><span class="term">-G</span></dt>
 <dd><p>
-            Generate a key, but do not publish it or sign with it.  This
-            option is incompatible with -P and -A.
-          </p></dd>
+	    Generate a key, but do not publish it or sign with it.  This
+	    option is incompatible with -P and -A.
+	  </p></dd>
 <dt><span class="term">-g <em class="replaceable"><code>generator</code></em></span></dt>
 <dd><p>
-            If generating a Diffie Hellman key, use this generator.
-            Allowed values are 2 and 5.  If no generator
-            is specified, a known prime from RFC 2539 will be used
-            if possible; otherwise the default is 2.
-          </p></dd>
+	    If generating a Diffie Hellman key, use this generator.
+	    Allowed values are 2 and 5.  If no generator
+	    is specified, a known prime from RFC 2539 will be used
+	    if possible; otherwise the default is 2.
+	  </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
-            Prints a short summary of the options and arguments to
-            <span class="command"><strong>dnssec-keygen</strong></span>.
-          </p></dd>
+	    Prints a short summary of the options and arguments to
+	    <span class="command"><strong>dnssec-keygen</strong></span>.
+	  </p></dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            Sets the directory in which the key files are to be written.
-          </p></dd>
+	    Sets the directory in which the key files are to be written.
+	  </p></dd>
 <dt><span class="term">-k</span></dt>
 <dd><p>
-            Deprecated in favor of -T KEY.
-          </p></dd>
+	    Deprecated in favor of -T KEY.
+	  </p></dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
 <dd><p>
-            Sets the default TTL to use for this key when it is converted
-            into a DNSKEY RR.  If the key is imported into a zone,
-            this is the TTL that will be used for it, unless there was
-            already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  If this value is not set and there
-            is no existing DNSKEY RRset, the TTL will default to the
-            SOA TTL. Setting the default TTL to <code class="literal">0</code>
-            or <code class="literal">none</code> is the same as leaving it unset.
-          </p></dd>
+	    Sets the default TTL to use for this key when it is converted
+	    into a DNSKEY RR.  If the key is imported into a zone,
+	    this is the TTL that will be used for it, unless there was
+	    already a DNSKEY RRset in place, in which case the existing TTL
+	    would take precedence.  If this value is not set and there
+	    is no existing DNSKEY RRset, the TTL will default to the
+	    SOA TTL. Setting the default TTL to <code class="literal">0</code>
+	    or <code class="literal">none</code> is the same as leaving it unset.
+	  </p></dd>
 <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
 <dd><p>
-            Sets the protocol value for the generated key.  The protocol
-            is a number between 0 and 255.  The default is 3 (DNSSEC).
-            Other possible values for this argument are listed in
-            RFC 2535 and its successors.
-          </p></dd>
+	    Sets the protocol value for the generated key.  The protocol
+	    is a number between 0 and 255.  The default is 3 (DNSSEC).
+	    Other possible values for this argument are listed in
+	    RFC 2535 and its successors.
+	  </p></dd>
 <dt><span class="term">-q</span></dt>
 <dd><p>
-            Quiet mode: Suppresses unnecessary output, including
-            progress indication.  Without this option, when
-            <span class="command"><strong>dnssec-keygen</strong></span> is run interactively
-            to generate an RSA or DSA key pair, it will print a string
-            of symbols to <code class="filename">stderr</code> indicating the
-            progress of the key generation.  A '.' indicates that a
-            random number has been found which passed an initial
-            sieve test; '+' means a number has passed a single
-            round of the Miller-Rabin primality test; a space
-            means that the number has passed all the tests and is
-            a satisfactory key.
-          </p></dd>
+	    Quiet mode: Suppresses unnecessary output, including
+	    progress indication.  Without this option, when
+	    <span class="command"><strong>dnssec-keygen</strong></span> is run interactively
+	    to generate an RSA or DSA key pair, it will print a string
+	    of symbols to <code class="filename">stderr</code> indicating the
+	    progress of the key generation.  A '.' indicates that a
+	    random number has been found which passed an initial
+	    sieve test; '+' means a number has passed a single
+	    round of the Miller-Rabin primality test; a space
+	    means that the number has passed all the tests and is
+	    a satisfactory key.
+	  </p></dd>
 <dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
 <dd><p>
-            Specifies the source of randomness.  If the operating
-            system does not provide a <code class="filename">/dev/random</code>
-            or equivalent device, the default source of randomness
-            is keyboard input.  <code class="filename">randomdev</code>
-            specifies
-            the name of a character device or file containing random
-            data to be used instead of the default.  The special value
-            <code class="filename">keyboard</code> indicates that keyboard
-            input should be used.
-          </p></dd>
+	    Specifies the source of randomness.  If the operating
+	    system does not provide a <code class="filename">/dev/random</code>
+	    or equivalent device, the default source of randomness
+	    is keyboard input.  <code class="filename">randomdev</code>
+	    specifies
+	    the name of a character device or file containing random
+	    data to be used instead of the default.  The special value
+	    <code class="filename">keyboard</code> indicates that keyboard
+	    input should be used.
+	  </p></dd>
 <dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
 <dd><p>
-            Create a new key which is an explicit successor to an
-            existing key.  The name, algorithm, size, and type of the
-            key will be set to match the existing key.  The activation
-            date of the new key will be set to the inactivation date of
-            the existing one.  The publication date will be set to the
-            activation date minus the prepublication interval, which
-            defaults to 30 days.
-          </p></dd>
+	    Create a new key which is an explicit successor to an
+	    existing key.  The name, algorithm, size, and type of the
+	    key will be set to match the existing key.  The activation
+	    date of the new key will be set to the inactivation date of
+	    the existing one.  The publication date will be set to the
+	    activation date minus the prepublication interval, which
+	    defaults to 30 days.
+	  </p></dd>
 <dt><span class="term">-s <em class="replaceable"><code>strength</code></em></span></dt>
 <dd><p>
-            Specifies the strength value of the key.  The strength is
-            a number between 0 and 15, and currently has no defined
-            purpose in DNSSEC.
-          </p></dd>
+	    Specifies the strength value of the key.  The strength is
+	    a number between 0 and 15, and currently has no defined
+	    purpose in DNSSEC.
+	  </p></dd>
 <dt><span class="term">-T <em class="replaceable"><code>rrtype</code></em></span></dt>
 <dd>
 <p>
-            Specifies the resource record type to use for the key.
-            <code class="option">rrtype</code> must be either DNSKEY or KEY.  The
-            default is DNSKEY when using a DNSSEC algorithm, but it can be
-            overridden to KEY for use with SIG(0).
-          </p>
+	    Specifies the resource record type to use for the key.
+	    <code class="option">rrtype</code> must be either DNSKEY or KEY.  The
+	    default is DNSKEY when using a DNSSEC algorithm, but it can be
+	    overridden to KEY for use with SIG(0).
+	  </p>
 <p>
-          </p>
+	  </p>
 <p>
-            Using any TSIG algorithm (HMAC-* or DH) forces this option
-            to KEY.
-          </p>
+	    Using any TSIG algorithm (HMAC-* or DH) forces this option
+	    to KEY.
+	  </p>
 </dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd><p>
-            Indicates the use of the key.  <code class="option">type</code> must be
-            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-            is AUTHCONF.  AUTH refers to the ability to authenticate
-            data, and CONF the ability to encrypt data.
-          </p></dd>
+	    Indicates the use of the key.  <code class="option">type</code> must be
+	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
+	    is AUTHCONF.  AUTH refers to the ability to authenticate
+	    data, and CONF the ability to encrypt data.
+	  </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
 <dd><p>
-            Sets the debugging level.
-          </p></dd>
+	    Sets the debugging level.
+	  </p></dd>
 <dt><span class="term">-V</span></dt>
 <dd><p>
 	    Prints version information.
@@ -283,38 +283,48 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which a key is to be published to the zone.
-            After that date, the key will be included in the zone but will
-            not be used to sign it.  If not set, and if the -G option has
-            not been used, the default is "now".
-          </p></dd>
+	    Sets the date on which a key is to be published to the zone.
+	    After that date, the key will be included in the zone but will
+	    not be used to sign it.  If not set, and if the -G option has
+	    not been used, the default is "now".
+	  </p></dd>
+<dt><span class="term">-P sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which CDS and CDNSKEY records that match this
+	    key are to be published to the zone.
+	  </p></dd>
 <dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be activated.  After that
-            date, the key will be included in the zone and used to sign
-            it.  If not set, and if the -G option has not been used, the
-            default is "now".  If set, if and -P is not set, then
-            the publication date will be set to the activation date
-            minus the prepublication interval.
-          </p></dd>
+	    Sets the date on which the key is to be activated.  After that
+	    date, the key will be included in the zone and used to sign
+	    it.  If not set, and if the -G option has not been used, the
+	    default is "now".  If set, if and -P is not set, then
+	    the publication date will be set to the activation date
+	    minus the prepublication interval.
+	  </p></dd>
 <dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be revoked.  After that
-            date, the key will be flagged as revoked.  It will be included
-            in the zone and will be used to sign it.
-          </p></dd>
+	    Sets the date on which the key is to be revoked.  After that
+	    date, the key will be flagged as revoked.  It will be included
+	    in the zone and will be used to sign it.
+	  </p></dd>
 <dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be retired.  After that
-            date, the key will still be included in the zone, but it
-            will not be used to sign it.
-          </p></dd>
+	    Sets the date on which the key is to be retired.  After that
+	    date, the key will still be included in the zone, but it
+	    will not be used to sign it.
+	  </p></dd>
 <dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be deleted.  After that
-            date, the key will no longer be included in the zone.  (It
-            may remain in the key repository, however.)
-          </p></dd>
+	    Sets the date on which the key is to be deleted.  After that
+	    date, the key will no longer be included in the zone.  (It
+	    may remain in the key repository, however.)
+	  </p></dd>
+<dt><span class="term">-D sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which the CDS and CDNSKEY records that match this
+	    key are to be deleted.
+	  </p></dd>
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
 <p>
@@ -352,14 +362,14 @@
     </p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem"><p><code class="filename">nnnn</code> is the key name.
-        </p></li>
+	</p></li>
 <li class="listitem"><p><code class="filename">aaa</code> is the numeric representation
-          of the
-          algorithm.
-        </p></li>
+	  of the
+	  algorithm.
+	</p></li>
 <li class="listitem"><p><code class="filename">iiiii</code> is the key identifier (or
-          footprint).
-        </p></li>
+	  footprint).
+	</p></li>
 </ul></div>
 <p><span class="command"><strong>dnssec-keygen</strong></span>
       creates two files, with names based
diff --git a/bin/dnssec/dnssec-settime.8 b/bin/dnssec/dnssec-settime.8
index af1cfd9d76..599eca4776 100644
--- a/bin/dnssec/dnssec-settime.8
+++ b/bin/dnssec/dnssec-settime.8
@@ -18,12 +18,12 @@
 .\"     Title: dnssec-settime
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2014-02-06
+.\"      Date: 2015-08-21
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "DNSSEC\-SETTIME" "8" "2014\-02\-06" "ISC" "BIND9"
+.TH "DNSSEC\-SETTIME" "8" "2015\-08\-21" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -47,7 +47,7 @@
 dnssec-settime \- Set the key timing metadata for a DNSSEC key
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-settime\fR\ 'u
-\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile}
+\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-settime\fR
@@ -121,6 +121,11 @@ Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argume
 Sets the date on which a key is to be published to the zone\&. After that date, the key will be included in the zone but will not be used to sign it\&.
 .RE
 .PP
+\-P sync \fIdate/offset\fR
+.RS 4
+Sets the date on which CDS and CDNSKEY records that match this key are to be published to the zone\&.
+.RE
+.PP
 \-A \fIdate/offset\fR
 .RS 4
 Sets the date on which the key is to be activated\&. After that date, the key will be included in the zone and used to sign it\&.
@@ -141,6 +146,11 @@ Sets the date on which the key is to be retired\&. After that date, the key will
 Sets the date on which the key is to be deleted\&. After that date, the key will no longer be included in the zone\&. (It may remain in the key repository, however\&.)
 .RE
 .PP
+\-D sync \fIdate/offset\fR
+.RS 4
+Sets the date on which the CDS and CDNSKEY records that match this key are to be deleted\&.
+.RE
+.PP
 \-S \fIpredecessor key\fR
 .RS 4
 Select a key for which the key being modified will be an explicit successor\&. The name, algorithm, size, and type of the predecessor key must exactly match those of the key being modified\&. The activation date of the successor key will be set to the inactivation date of the predecessor\&. The publication date will be set to the activation date minus the prepublication interval, which defaults to 30 days\&.
@@ -164,23 +174,27 @@ can also be used to print the timing metadata associated with a key\&.
 Print times in UNIX epoch format\&.
 .RE
 .PP
-\-p \fIC/P/A/R/I/D/all\fR
+\-p \fIC/P/Psync/A/R/I/D/Dsync/all\fR
 .RS 4
 Print a specific metadata value or set of metadata values\&. The
 \fB\-p\fR
-option may be followed by one or more of the following letters to indicate which value or values to print:
+option may be followed by one or more of the following letters or strings to indicate which value or values to print:
 \fBC\fR
 for the creation date,
 \fBP\fR
 for the publication date,
+\fBPsync\fR
+for the CDS and CDNSKEY publication date,
 \fBA\fR
 for the activation date,
 \fBR\fR
 for the revocation date,
 \fBI\fR
-for the inactivation date, or
+for the inactivation date,
 \fBD\fR
-for the deletion date\&. To print all of the metadata, use
+for the deletion date, and
+\fBDsync\fR
+for the CDS and CDNSKEY deletion date To print all of the metadata, use
 \fB\-p all\fR\&.
 .RE
 .SH "SEE ALSO"
diff --git a/bin/dnssec/dnssec-settime.html b/bin/dnssec/dnssec-settime.html
index e366fb215c..509cf1190c 100644
--- a/bin/dnssec/dnssec-settime.html
+++ b/bin/dnssec/dnssec-settime.html
@@ -27,7 +27,7 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code>  [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code>  [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
 </div>
 <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
@@ -60,7 +60,7 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-f</span></dt>
 <dd><p>
-	    Force an update of an old-format key with no metadata fields.
+            Force an update of an old-format key with no metadata fields.
             Without this option, <span class="command"><strong>dnssec-settime</strong></span> will
             fail when attempting to update a legacy key.  With this option,
             the key will be recreated in the new format, but with the
@@ -68,7 +68,7 @@
             set to the present time.  If no other values are specified,
             then the key's publication and activation dates will also
             be set to the present time.
-	  </p></dd>
+          </p></dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
             Sets the directory in which the key files are to reside.
@@ -86,12 +86,12 @@
           </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
-	    Emit usage message and exit.
-	  </p></dd>
+            Emit usage message and exit.
+          </p></dd>
 <dt><span class="term">-V</span></dt>
 <dd><p>
-	    Prints version information.
-	  </p></dd>
+            Prints version information.
+          </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
 <dd><p>
             Sets the debugging level.
@@ -131,6 +131,11 @@
             After that date, the key will be included in the zone but will
             not be used to sign it.
           </p></dd>
+<dt><span class="term">-P sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+            Sets the date on which CDS and CDNSKEY records that match this
+            key are to be published to the zone.
+          </p></dd>
 <dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
             Sets the date on which the key is to be activated.  After that
@@ -155,6 +160,11 @@
             date, the key will no longer be included in the zone.  (It
             may remain in the key repository, however.)
           </p></dd>
+<dt><span class="term">-D sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+            Sets the date on which the CDS and CDNSKEY records that match this
+            key are to be deleted.
+          </p></dd>
 <dt><span class="term">-S <em class="replaceable"><code>predecessor key</code></em></span></dt>
 <dd><p>
             Select a key for which the key being modified will be an
@@ -200,21 +210,24 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-u</span></dt>
 <dd><p>
-	    Print times in UNIX epoch format.
-	  </p></dd>
-<dt><span class="term">-p <em class="replaceable"><code>C/P/A/R/I/D/all</code></em></span></dt>
+            Print times in UNIX epoch format.
+          </p></dd>
+<dt><span class="term">-p <em class="replaceable"><code>C/P/Psync/A/R/I/D/Dsync/all</code></em></span></dt>
 <dd><p>
-	    Print a specific metadata value or set of metadata values.
+            Print a specific metadata value or set of metadata values.
             The <code class="option">-p</code> option may be followed by one or more
-            of the following letters to indicate which value or values to print:
+            of the following letters or strings to indicate which value
+            or values to print:
             <code class="option">C</code> for the creation date,
             <code class="option">P</code> for the publication date,
+            <code class="option">Psync</code> for the CDS and CDNSKEY publication date,
             <code class="option">A</code> for the activation date,
             <code class="option">R</code> for the revocation date,
-            <code class="option">I</code> for the inactivation date, or
-            <code class="option">D</code> for the deletion date.
+            <code class="option">I</code> for the inactivation date,
+            <code class="option">D</code> for the deletion date, and
+            <code class="option">Dsync</code> for the CDS and CDNSKEY deletion date
             To print all of the metadata, use <code class="option">-p all</code>.
-	  </p></dd>
+          </p></dd>
 </dl></div>
 </div>
 <div class="refsection">
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 0d0da0d19b..27d9c86b61 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -2366,6 +2366,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
     [<span class="optional"> blackhole { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
     [<span class="optional"> keep-response-order { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
     [<span class="optional"> no-case-compress { <em class="replaceable"><code>address_match_list</code></em> }; </span>]
+    [<span class="optional"> message-compression <em class="replaceable"><code>yes_or_no</code></em> ; </span>]
     [<span class="optional"> use-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
     [<span class="optional"> avoid-v4-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
     [<span class="optional"> use-v6-udp-ports { <em class="replaceable"><code>port_list</code></em> }; </span>]
@@ -3774,6 +3775,15 @@ options {
                   incremental zone
                   transfers, use <span class="command"><strong>provide-ixfr</strong></span> <strong class="userinput"><code>no</code></strong>.
                 </p></dd>
+<dt><span class="term"><span class="command"><strong>message-compression</strong></span></span></dt>
+<dd><p>
+                  If <strong class="userinput"><code>yes</code></strong>, DNS name compression will
+                  be used for responses to regular queries (not including
+                  AXFR or IXFR, which always uses compression).  Setting
+                  this option to <strong class="userinput"><code>no</code></strong> can result in
+                  larger responses, but will reduce CPU usage on servers.
+                  The default is <strong class="userinput"><code>yes</code></strong>.
+                </p></dd>
 <dt><span class="term"><span class="command"><strong>minimal-responses</strong></span></span></dt>
 <dd><p>
                   If <strong class="userinput"><code>yes</code></strong>, then when generating
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index f0aa1ed75c..abc6e70525 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -478,6 +478,13 @@
 	  The following types have been implemented: CSYNC, NINFO, RKEY,
 	  SINK, TA, TALINK.
 	</p></li>
+<li class="listitem"><p>
+	  A new <span class="command"><strong>message-compression</strong></span> option can be
+	  used to specify whether or not to use name compression when
+	  answering queries. Setting this to <strong class="userinput"><code>no</code></strong>
+	  results in larger responses, but reduces CPU consumption and
+	  may improve throughput.  The default is <strong class="userinput"><code>yes</code></strong>.
+	</p></li>
 </ul></div>
 </div>
 <div class="section">
diff --git a/doc/arm/man.dnssec-dsfromkey.html b/doc/arm/man.dnssec-dsfromkey.html
index ed468f25d8..508df20b7f 100644
--- a/doc/arm/man.dnssec-dsfromkey.html
+++ b/doc/arm/man.dnssec-dsfromkey.html
@@ -62,52 +62,52 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-1</span></dt>
 <dd><p>
-            Use SHA-1 as the digest algorithm (the default is to use
-            both SHA-1 and SHA-256).
-          </p></dd>
+	    Use SHA-1 as the digest algorithm (the default is to use
+	    both SHA-1 and SHA-256).
+	  </p></dd>
 <dt><span class="term">-2</span></dt>
 <dd><p>
-            Use SHA-256 as the digest algorithm.
-          </p></dd>
+	    Use SHA-256 as the digest algorithm.
+	  </p></dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd><p>
-            Select the digest algorithm. The value of
-            <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
-            SHA-256 (SHA256), GOST or SHA-384 (SHA384).
-            These values are case insensitive.
-          </p></dd>
+	    Select the digest algorithm. The value of
+	    <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
+	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
+	    These values are case insensitive.
+	  </p></dd>
 <dt><span class="term">-C</span></dt>
 <dd><p>
-            Generate CDS records rather than DS records.  This is mutually
+	    Generate CDS records rather than DS records.  This is mutually
 	    exclusive with generating lookaside records.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
 <dd><p>
-            Specifies the TTL of the DS records.
-          </p></dd>
+	    Specifies the TTL of the DS records.
+	  </p></dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            Look for key files (or, in keyset mode,
-            <code class="filename">keyset-</code> files) in
-            <code class="option">directory</code>.
-          </p></dd>
+	    Look for key files (or, in keyset mode,
+	    <code class="filename">keyset-</code> files) in
+	    <code class="option">directory</code>.
+	  </p></dd>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
 <dd>
 <p>
-            Zone file mode: in place of the keyfile name, the argument is
-            the DNS domain name of a zone master file, which can be read
-            from <code class="option">file</code>.  If the zone name is the same as
-            <code class="option">file</code>, then it may be omitted.
-          </p>
+	    Zone file mode: in place of the keyfile name, the argument is
+	    the DNS domain name of a zone master file, which can be read
+	    from <code class="option">file</code>.  If the zone name is the same as
+	    <code class="option">file</code>, then it may be omitted.
+	  </p>
 <p>
-            If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
-            the zone data is read from the standard input.  This makes it
-            possible to use the output of the <span class="command"><strong>dig</strong></span>
-            command as input, as in:
-          </p>
+	    If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
+	    the zone data is read from the standard input.  This makes it
+	    possible to use the output of the <span class="command"><strong>dig</strong></span>
+	    command as input, as in:
+	  </p>
 <p>
-            <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
-          </p>
+	    <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
+	  </p>
 </dd>
 <dt><span class="term">-A</span></dt>
 <dd><p>
@@ -117,35 +117,35 @@
           </p></dd>
 <dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
 <dd><p>
-            Generate a DLV set instead of a DS set.  The specified
-            <code class="option">domain</code> is appended to the name for each
-            record in the set.
-            The DNSSEC Lookaside Validation (DLV) RR is described
-            in RFC 4431.  This is mutually exclusive with generating
+	    Generate a DLV set instead of a DS set.  The specified
+	    <code class="option">domain</code> is appended to the name for each
+	    record in the set.
+	    The DNSSEC Lookaside Validation (DLV) RR is described
+	    in RFC 4431.  This is mutually exclusive with generating
 	    CDS records.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-s</span></dt>
 <dd><p>
-            Keyset mode: in place of the keyfile name, the argument is
-            the DNS domain name of a keyset file.
-          </p></dd>
+	    Keyset mode: in place of the keyfile name, the argument is
+	    the DNS domain name of a keyset file.
+	  </p></dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd><p>
-            Specifies the DNS class (default is IN).  Useful only
-            in keyset or zone file mode.
-          </p></dd>
+	    Specifies the DNS class (default is IN).  Useful only
+	    in keyset or zone file mode.
+	  </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
 <dd><p>
-            Sets the debugging level.
-          </p></dd>
+	    Sets the debugging level.
+	  </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
-            Prints usage information.
-          </p></dd>
+	    Prints usage information.
+	  </p></dd>
 <dt><span class="term">-V</span></dt>
 <dd><p>
-            Prints version information.
-          </p></dd>
+	    Prints version information.
+	  </p></dd>
 </dl></div>
 </div>
 <div class="refsection">
diff --git a/doc/arm/man.dnssec-importkey.html b/doc/arm/man.dnssec-importkey.html
index d3cf277f63..478ca15b37 100644
--- a/doc/arm/man.dnssec-importkey.html
+++ b/doc/arm/man.dnssec-importkey.html
@@ -46,8 +46,8 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] {<code class="option">keyfile</code>}</p></div>
-<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>} [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">dnsname</code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] {<code class="option">keyfile</code>}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>} [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">dnsname</code>]</p></div>
 </div>
 <div class="refsection">
 <a name="id-1.14.8.7"></a><h2>DESCRIPTION</h2>
@@ -75,37 +75,37 @@
 <dt><span class="term">-f <em class="replaceable"><code>filename</code></em></span></dt>
 <dd>
 <p>
-            Zone file mode: instead of a public keyfile name, the argument
+	    Zone file mode: instead of a public keyfile name, the argument
 	    is the DNS domain name of a zone master file, which can be read
-            from <code class="option">file</code>.  If the domain name is the same as
-            <code class="option">file</code>, then it may be omitted.
-          </p>
+	    from <code class="option">file</code>.  If the domain name is the same as
+	    <code class="option">file</code>, then it may be omitted.
+	  </p>
 <p>
-            If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
-            the zone data is read from the standard input.
-          </p>
+	    If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
+	    the zone data is read from the standard input.
+	  </p>
 </dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            Sets the directory in which the key files are to reside.
-          </p></dd>
+	    Sets the directory in which the key files are to reside.
+	  </p></dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
 <dd><p>
-            Sets the default TTL to use for this key when it is converted
-            into a DNSKEY RR.  If the key is imported into a zone,
-            this is the TTL that will be used for it, unless there was
-            already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <code class="literal">0</code> or <code class="literal">none</code> removes it.
-          </p></dd>
+	    Sets the default TTL to use for this key when it is converted
+	    into a DNSKEY RR.  If the key is imported into a zone,
+	    this is the TTL that will be used for it, unless there was
+	    already a DNSKEY RRset in place, in which case the existing TTL
+	    would take precedence.  Setting the default TTL to
+	    <code class="literal">0</code> or <code class="literal">none</code> removes it.
+	  </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
 	    Emit usage message and exit.
 	  </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
 <dd><p>
-            Sets the debugging level.
-          </p></dd>
+	    Sets the debugging level.
+	  </p></dd>
 <dt><span class="term">-V</span></dt>
 <dd><p>
 	    Prints version information.
@@ -128,16 +128,26 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which a key is to be published to the zone.
-            After that date, the key will be included in the zone but will
-            not be used to sign it.
-          </p></dd>
+	    Sets the date on which a key is to be published to the zone.
+	    After that date, the key will be included in the zone but will
+	    not be used to sign it.
+	  </p></dd>
+<dt><span class="term">-P sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which CDS and CDNSKEY records that match this
+	    key are to be published to the zone.
+	  </p></dd>
 <dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be deleted.  After that
-            date, the key will no longer be included in the zone.  (It
-            may remain in the key repository, however.)
-          </p></dd>
+	    Sets the date on which the key is to be deleted.  After that
+	    date, the key will no longer be included in the zone.  (It
+	    may remain in the key repository, however.)
+	  </p></dd>
+<dt><span class="term">-D sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which the CDS and CDNSKEY records that match
+	    this key are to be deleted.
+	  </p></dd>
 </dl></div>
 </div>
 <div class="refsection">
diff --git a/doc/arm/man.dnssec-keyfromlabel.html b/doc/arm/man.dnssec-keyfromlabel.html
index 70750fe0df..12d3a35a63 100644
--- a/doc/arm/man.dnssec-keyfromlabel.html
+++ b/doc/arm/man.dnssec-keyfromlabel.html
@@ -46,7 +46,7 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code>  {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code>  {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
 </div>
 <div class="refsection">
 <a name="id-1.14.9.7"></a><h2>DESCRIPTION</h2>
@@ -71,87 +71,87 @@
 <dd>
 <p>
 	    Selects the cryptographic algorithm.  The value of
-            <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
+	    <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256 or ECDSAP384SHA384.
 	    These values are case insensitive.
 	  </p>
 <p>
-            If no algorithm is specified, then RSASHA1 will be used by
-            default, unless the <code class="option">-3</code> option is specified,
-            in which case NSEC3RSASHA1 will be used instead.  (If
-            <code class="option">-3</code> is used and an algorithm is specified,
-            that algorithm will be checked for compatibility with NSEC3.)
-          </p>
+	    If no algorithm is specified, then RSASHA1 will be used by
+	    default, unless the <code class="option">-3</code> option is specified,
+	    in which case NSEC3RSASHA1 will be used instead.  (If
+	    <code class="option">-3</code> is used and an algorithm is specified,
+	    that algorithm will be checked for compatibility with NSEC3.)
+	  </p>
 <p>
-            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
-            algorithm, and DSA is recommended.
-          </p>
+	    Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
+	    algorithm, and DSA is recommended.
+	  </p>
 <p>
-            Note 2: DH automatically sets the -k flag.
-          </p>
+	    Note 2: DH automatically sets the -k flag.
+	  </p>
 </dd>
 <dt><span class="term">-3</span></dt>
 <dd><p>
 	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-            If this option is used and no algorithm is explicitly
-            set on the command line, NSEC3RSASHA1 will be used by
-            default.
-          </p></dd>
+	    If this option is used and no algorithm is explicitly
+	    set on the command line, NSEC3RSASHA1 will be used by
+	    default.
+	  </p></dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
 <dd>
 <p>
-            Specifies the cryptographic hardware to use.
-          </p>
+	    Specifies the cryptographic hardware to use.
+	  </p>
 <p>
-            When BIND is built with OpenSSL PKCS#11 support, this defaults
-            to the string "pkcs11", which identifies an OpenSSL engine
-            that can drive a cryptographic accelerator or hardware service
-            module.  When BIND is built with native PKCS#11 cryptography
-            (--enable-native-pkcs11), it defaults to the path of the PKCS#11
-            provider library specified via "--with-pkcs11".
-          </p>
+	    When BIND is built with OpenSSL PKCS#11 support, this defaults
+	    to the string "pkcs11", which identifies an OpenSSL engine
+	    that can drive a cryptographic accelerator or hardware service
+	    module.  When BIND is built with native PKCS#11 cryptography
+	    (--enable-native-pkcs11), it defaults to the path of the PKCS#11
+	    provider library specified via "--with-pkcs11".
+	  </p>
 </dd>
 <dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
 <dd>
 <p>
-            Specifies the label for a key pair in the crypto hardware.
-          </p>
+	    Specifies the label for a key pair in the crypto hardware.
+	  </p>
 <p>
-            When <acronym class="acronym">BIND</acronym> 9 is built with OpenSSL-based
-            PKCS#11 support, the label is an arbitrary string that
-            identifies a particular key.  It may be preceded by an
-            optional OpenSSL engine name, followed by a colon, as in
-            "pkcs11:<em class="replaceable"><code>keylabel</code></em>".
-          </p>
+	    When <acronym class="acronym">BIND</acronym> 9 is built with OpenSSL-based
+	    PKCS#11 support, the label is an arbitrary string that
+	    identifies a particular key.  It may be preceded by an
+	    optional OpenSSL engine name, followed by a colon, as in
+	    "pkcs11:<em class="replaceable"><code>keylabel</code></em>".
+	  </p>
 <p>
-            When <acronym class="acronym">BIND</acronym> 9 is built with native PKCS#11
-            support, the label is a PKCS#11 URI string in the format
-            "pkcs11:<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>[<span class="optional">;<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>;...</span>]"
-            Keywords include "token", which identifies the HSM; "object", which
-            identifies the key; and "pin-source", which identifies a file from
-            which the HSM's PIN code can be obtained.  The label will be
-            stored in the on-disk "private" file.
-          </p>
+	    When <acronym class="acronym">BIND</acronym> 9 is built with native PKCS#11
+	    support, the label is a PKCS#11 URI string in the format
+	    "pkcs11:<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>[<span class="optional">;<code class="option">keyword</code>=<em class="replaceable"><code>value</code></em>;...</span>]"
+	    Keywords include "token", which identifies the HSM; "object", which
+	    identifies the key; and "pin-source", which identifies a file from
+	    which the HSM's PIN code can be obtained.  The label will be
+	    stored in the on-disk "private" file.
+	  </p>
 <p>
-            If the label contains a
-            <code class="option">pin-source</code> field, tools using the generated
-            key files will be able to use the HSM for signing and other
-            operations without any need for an operator to manually enter
-            a PIN.  Note: Making the HSM's PIN accessible in this manner
-            may reduce the security advantage of using an HSM; be sure
-            this is what you want to do before making use of this feature.
-          </p>
+	    If the label contains a
+	    <code class="option">pin-source</code> field, tools using the generated
+	    key files will be able to use the HSM for signing and other
+	    operations without any need for an operator to manually enter
+	    a PIN.  Note: Making the HSM's PIN accessible in this manner
+	    may reduce the security advantage of using an HSM; be sure
+	    this is what you want to do before making use of this feature.
+	  </p>
 </dd>
 <dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
 <dd><p>
-            Specifies the owner type of the key.  The value of
-            <code class="option">nametype</code> must either be ZONE (for a DNSSEC
-            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-            a host (KEY)),
-            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-            These values are case insensitive.
-          </p></dd>
+	    Specifies the owner type of the key.  The value of
+	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
+	    a host (KEY)),
+	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
+	    These values are case insensitive.
+	  </p></dd>
 <dt><span class="term">-C</span></dt>
 <dd><p>
 	    Compatibility mode:  generates an old-style key, without
@@ -161,84 +161,84 @@
 	    (publication date, activation date, etc).  Keys that include
 	    this data may be incompatible with older versions of BIND; the
 	    <code class="option">-C</code> option suppresses them.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd><p>
-            Indicates that the DNS record containing the key should have
-            the specified class.  If not specified, class IN is used.
-          </p></dd>
+	    Indicates that the DNS record containing the key should have
+	    the specified class.  If not specified, class IN is used.
+	  </p></dd>
 <dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
 <dd><p>
-            Set the specified flag in the flag field of the KEY/DNSKEY record.
-            The only recognized flags are KSK (Key Signing Key) and REVOKE.
-          </p></dd>
+	    Set the specified flag in the flag field of the KEY/DNSKEY record.
+	    The only recognized flags are KSK (Key Signing Key) and REVOKE.
+	  </p></dd>
 <dt><span class="term">-G</span></dt>
 <dd><p>
-            Generate a key, but do not publish it or sign with it.  This
-            option is incompatible with -P and -A.
-          </p></dd>
+	    Generate a key, but do not publish it or sign with it.  This
+	    option is incompatible with -P and -A.
+	  </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
-            Prints a short summary of the options and arguments to
-            <span class="command"><strong>dnssec-keyfromlabel</strong></span>.
-          </p></dd>
+	    Prints a short summary of the options and arguments to
+	    <span class="command"><strong>dnssec-keyfromlabel</strong></span>.
+	  </p></dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            Sets the directory in which the key files are to be written.
-          </p></dd>
+	    Sets the directory in which the key files are to be written.
+	  </p></dd>
 <dt><span class="term">-k</span></dt>
 <dd><p>
-            Generate KEY records rather than DNSKEY records.
-          </p></dd>
+	    Generate KEY records rather than DNSKEY records.
+	  </p></dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
 <dd><p>
-            Sets the default TTL to use for this key when it is converted
-            into a DNSKEY RR.  If the key is imported into a zone,
-            this is the TTL that will be used for it, unless there was
-            already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <code class="literal">0</code> or <code class="literal">none</code> removes it.
-          </p></dd>
+	    Sets the default TTL to use for this key when it is converted
+	    into a DNSKEY RR.  If the key is imported into a zone,
+	    this is the TTL that will be used for it, unless there was
+	    already a DNSKEY RRset in place, in which case the existing TTL
+	    would take precedence.  Setting the default TTL to
+	    <code class="literal">0</code> or <code class="literal">none</code> removes it.
+	  </p></dd>
 <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
 <dd><p>
-            Sets the protocol value for the key.  The protocol
-            is a number between 0 and 255.  The default is 3 (DNSSEC).
-            Other possible values for this argument are listed in
-            RFC 2535 and its successors.
-          </p></dd>
+	    Sets the protocol value for the key.  The protocol
+	    is a number between 0 and 255.  The default is 3 (DNSSEC).
+	    Other possible values for this argument are listed in
+	    RFC 2535 and its successors.
+	  </p></dd>
 <dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
 <dd><p>
-            Generate a key as an explicit successor to an existing key.
+	    Generate a key as an explicit successor to an existing key.
 	    The name, algorithm, size, and type of the key will be set
 	    to match the predecessor. The activation date of the new
 	    key will be set to the inactivation date of the existing
 	    one. The publication date will be set to the activation
 	    date minus the prepublication interval, which defaults to
 	    30 days.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd><p>
-            Indicates the use of the key.  <code class="option">type</code> must be
-            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-            is AUTHCONF.  AUTH refers to the ability to authenticate
-            data, and CONF the ability to encrypt data.
-          </p></dd>
+	    Indicates the use of the key.  <code class="option">type</code> must be
+	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
+	    is AUTHCONF.  AUTH refers to the ability to authenticate
+	    data, and CONF the ability to encrypt data.
+	  </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
 <dd><p>
-            Sets the debugging level.
-          </p></dd>
+	    Sets the debugging level.
+	  </p></dd>
 <dt><span class="term">-V</span></dt>
 <dd><p>
 	    Prints version information.
 	  </p></dd>
 <dt><span class="term">-y</span></dt>
 <dd><p>
-            Allows DNSSEC key files to be generated even if the key ID
+	    Allows DNSSEC key files to be generated even if the key ID
 	    would collide with that of an existing key, in the event of
 	    either key being revoked.  (This is only safe to use if you
-            are sure you won't be using RFC 5011 trust anchor maintenance
-            with either of the keys involved.)
-          </p></dd>
+	    are sure you won't be using RFC 5011 trust anchor maintenance
+	    with either of the keys involved.)
+	  </p></dd>
 </dl></div>
 </div>
 <div class="refsection">
@@ -257,36 +257,46 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which a key is to be published to the zone.
-            After that date, the key will be included in the zone but will
-            not be used to sign it.  If not set, and if the -G option has
-            not been used, the default is "now".
-          </p></dd>
+	    Sets the date on which a key is to be published to the zone.
+	    After that date, the key will be included in the zone but will
+	    not be used to sign it.  If not set, and if the -G option has
+	    not been used, the default is "now".
+	  </p></dd>
+<dt><span class="term">-P sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which the CDS and CDNSKEY records which match
+	    this key are to be published to the zone.
+	  </p></dd>
 <dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be activated.  After that
-            date, the key will be included in the zone and used to sign
-            it.  If not set, and if the -G option has not been used, the
-            default is "now".
-          </p></dd>
+	    Sets the date on which the key is to be activated.  After that
+	    date, the key will be included in the zone and used to sign
+	    it.  If not set, and if the -G option has not been used, the
+	    default is "now".
+	  </p></dd>
 <dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be revoked.  After that
-            date, the key will be flagged as revoked.  It will be included
-            in the zone and will be used to sign it.
-          </p></dd>
+	    Sets the date on which the key is to be revoked.  After that
+	    date, the key will be flagged as revoked.  It will be included
+	    in the zone and will be used to sign it.
+	  </p></dd>
 <dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be retired.  After that
-            date, the key will still be included in the zone, but it
-            will not be used to sign it.
-          </p></dd>
+	    Sets the date on which the key is to be retired.  After that
+	    date, the key will still be included in the zone, but it
+	    will not be used to sign it.
+	  </p></dd>
 <dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be deleted.  After that
-            date, the key will no longer be included in the zone.  (It
-            may remain in the key repository, however.)
-          </p></dd>
+	    Sets the date on which the key is to be deleted.  After that
+	    date, the key will no longer be included in the zone.  (It
+	    may remain in the key repository, however.)
+	  </p></dd>
+<dt><span class="term">-D sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which the CDS and CDNSKEY records which match
+	    this key are to be deleted.
+	  </p></dd>
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
 <p>
@@ -324,13 +334,13 @@
     </p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem"><p><code class="filename">nnnn</code> is the key name.
-        </p></li>
+	</p></li>
 <li class="listitem"><p><code class="filename">aaa</code> is the numeric representation
-          of the algorithm.
-        </p></li>
+	  of the algorithm.
+	</p></li>
 <li class="listitem"><p><code class="filename">iiiii</code> is the key identifier (or
-          footprint).
-        </p></li>
+	  footprint).
+	</p></li>
 </ul></div>
 <p><span class="command"><strong>dnssec-keyfromlabel</strong></span>
       creates two files, with names based
diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html
index fadad71da0..190e8062bd 100644
--- a/doc/arm/man.dnssec-keygen.html
+++ b/doc/arm/man.dnssec-keygen.html
@@ -46,7 +46,7 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-z</code>] {name}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k</code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {name}</p></div>
 </div>
 <div class="refsection">
 <a name="id-1.14.10.7"></a><h2>DESCRIPTION</h2>
@@ -68,72 +68,72 @@
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
 <p>
-            Selects the cryptographic algorithm.  For DNSSEC keys, the value
-            of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
+	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
+	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256 or ECDSAP384SHA384.
 	    For TSIG/TKEY, the value must
-            be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
-            HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512.  These values are
-            case insensitive.
-          </p>
+	    be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
+	    HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512.  These values are
+	    case insensitive.
+	  </p>
 <p>
-            If no algorithm is specified, then RSASHA1 will be used by
-            default, unless the <code class="option">-3</code> option is specified,
-            in which case NSEC3RSASHA1 will be used instead.  (If
-            <code class="option">-3</code> is used and an algorithm is specified,
-            that algorithm will be checked for compatibility with NSEC3.)
-          </p>
+	    If no algorithm is specified, then RSASHA1 will be used by
+	    default, unless the <code class="option">-3</code> option is specified,
+	    in which case NSEC3RSASHA1 will be used instead.  (If
+	    <code class="option">-3</code> is used and an algorithm is specified,
+	    that algorithm will be checked for compatibility with NSEC3.)
+	  </p>
 <p>
-            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
-            algorithm, and DSA is recommended.  For TSIG, HMAC-MD5 is
+	    Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
+	    algorithm, and DSA is recommended.  For TSIG, HMAC-MD5 is
 	    mandatory.
-          </p>
+	  </p>
 <p>
-            Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
-            automatically set the -T KEY option.
-          </p>
+	    Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
+	    automatically set the -T KEY option.
+	  </p>
 </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
 <dd>
 <p>
-            Specifies the number of bits in the key.  The choice of key
-            size depends on the algorithm used.  RSA keys must be
-            between 512 and 2048 bits.  Diffie Hellman keys must be between
-            128 and 4096 bits.  DSA keys must be between 512 and 1024
-            bits and an exact multiple of 64.  HMAC keys must be
-            between 1 and 512 bits. Elliptic curve algorithms don't need
-            this parameter.
-          </p>
+	    Specifies the number of bits in the key.  The choice of key
+	    size depends on the algorithm used.  RSA keys must be
+	    between 512 and 2048 bits.  Diffie Hellman keys must be between
+	    128 and 4096 bits.  DSA keys must be between 512 and 1024
+	    bits and an exact multiple of 64.  HMAC keys must be
+	    between 1 and 512 bits. Elliptic curve algorithms don't need
+	    this parameter.
+	  </p>
 <p>
-            The key size does not need to be specified if using a default
-            algorithm.  The default key size is 1024 bits for zone signing
-            keys (ZSKs) and 2048 bits for key signing keys (KSKs,
-            generated with <code class="option">-f KSK</code>).  However, if an
-            algorithm is explicitly specified with the <code class="option">-a</code>,
-            then there is no default key size, and the <code class="option">-b</code>
-            must be used.
-          </p>
+	    The key size does not need to be specified if using a default
+	    algorithm.  The default key size is 1024 bits for zone signing
+	    keys (ZSKs) and 2048 bits for key signing keys (KSKs,
+	    generated with <code class="option">-f KSK</code>).  However, if an
+	    algorithm is explicitly specified with the <code class="option">-a</code>,
+	    then there is no default key size, and the <code class="option">-b</code>
+	    must be used.
+	  </p>
 </dd>
 <dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
 <dd><p>
-            Specifies the owner type of the key.  The value of
-            <code class="option">nametype</code> must either be ZONE (for a DNSSEC
-            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-            a host (KEY)),
-            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-            These values are case insensitive.  Defaults to ZONE for DNSKEY
+	    Specifies the owner type of the key.  The value of
+	    <code class="option">nametype</code> must either be ZONE (for a DNSSEC
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
+	    a host (KEY)),
+	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
+	    These values are case insensitive.  Defaults to ZONE for DNSKEY
 	    generation.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-3</span></dt>
 <dd><p>
 	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-            If this option is used and no algorithm is explicitly
-            set on the command line, NSEC3RSASHA1 will be used by
-            default. Note that RSASHA256, RSASHA512, ECCGOST,
+	    If this option is used and no algorithm is explicitly
+	    set on the command line, NSEC3RSASHA1 will be used by
+	    default. Note that RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256 and ECDSAP384SHA384 algorithms
 	    are NSEC3-capable.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-C</span></dt>
 <dd><p>
 	    Compatibility mode:  generates an old-style key, without
@@ -143,142 +143,142 @@
 	    (publication date, activation date, etc).  Keys that include
 	    this data may be incompatible with older versions of BIND; the
 	    <code class="option">-C</code> option suppresses them.
-          </p></dd>
+	  </p></dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd><p>
-            Indicates that the DNS record containing the key should have
-            the specified class.  If not specified, class IN is used.
-          </p></dd>
+	    Indicates that the DNS record containing the key should have
+	    the specified class.  If not specified, class IN is used.
+	  </p></dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
 <dd>
 <p>
-            Specifies the cryptographic hardware to use, when applicable.
-          </p>
+	    Specifies the cryptographic hardware to use, when applicable.
+	  </p>
 <p>
-            When BIND is built with OpenSSL PKCS#11 support, this defaults
-            to the string "pkcs11", which identifies an OpenSSL engine
-            that can drive a cryptographic accelerator or hardware service
-            module.  When BIND is built with native PKCS#11 cryptography
-            (--enable-native-pkcs11), it defaults to the path of the PKCS#11
-            provider library specified via "--with-pkcs11".
-          </p>
+	    When BIND is built with OpenSSL PKCS#11 support, this defaults
+	    to the string "pkcs11", which identifies an OpenSSL engine
+	    that can drive a cryptographic accelerator or hardware service
+	    module.  When BIND is built with native PKCS#11 cryptography
+	    (--enable-native-pkcs11), it defaults to the path of the PKCS#11
+	    provider library specified via "--with-pkcs11".
+	  </p>
 </dd>
 <dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
 <dd><p>
-            Set the specified flag in the flag field of the KEY/DNSKEY record.
-            The only recognized flags are KSK (Key Signing Key) and REVOKE.
-          </p></dd>
+	    Set the specified flag in the flag field of the KEY/DNSKEY record.
+	    The only recognized flags are KSK (Key Signing Key) and REVOKE.
+	  </p></dd>
 <dt><span class="term">-G</span></dt>
 <dd><p>
-            Generate a key, but do not publish it or sign with it.  This
-            option is incompatible with -P and -A.
-          </p></dd>
+	    Generate a key, but do not publish it or sign with it.  This
+	    option is incompatible with -P and -A.
+	  </p></dd>
 <dt><span class="term">-g <em class="replaceable"><code>generator</code></em></span></dt>
 <dd><p>
-            If generating a Diffie Hellman key, use this generator.
-            Allowed values are 2 and 5.  If no generator
-            is specified, a known prime from RFC 2539 will be used
-            if possible; otherwise the default is 2.
-          </p></dd>
+	    If generating a Diffie Hellman key, use this generator.
+	    Allowed values are 2 and 5.  If no generator
+	    is specified, a known prime from RFC 2539 will be used
+	    if possible; otherwise the default is 2.
+	  </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
-            Prints a short summary of the options and arguments to
-            <span class="command"><strong>dnssec-keygen</strong></span>.
-          </p></dd>
+	    Prints a short summary of the options and arguments to
+	    <span class="command"><strong>dnssec-keygen</strong></span>.
+	  </p></dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            Sets the directory in which the key files are to be written.
-          </p></dd>
+	    Sets the directory in which the key files are to be written.
+	  </p></dd>
 <dt><span class="term">-k</span></dt>
 <dd><p>
-            Deprecated in favor of -T KEY.
-          </p></dd>
+	    Deprecated in favor of -T KEY.
+	  </p></dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
 <dd><p>
-            Sets the default TTL to use for this key when it is converted
-            into a DNSKEY RR.  If the key is imported into a zone,
-            this is the TTL that will be used for it, unless there was
-            already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  If this value is not set and there
-            is no existing DNSKEY RRset, the TTL will default to the
-            SOA TTL. Setting the default TTL to <code class="literal">0</code>
-            or <code class="literal">none</code> is the same as leaving it unset.
-          </p></dd>
+	    Sets the default TTL to use for this key when it is converted
+	    into a DNSKEY RR.  If the key is imported into a zone,
+	    this is the TTL that will be used for it, unless there was
+	    already a DNSKEY RRset in place, in which case the existing TTL
+	    would take precedence.  If this value is not set and there
+	    is no existing DNSKEY RRset, the TTL will default to the
+	    SOA TTL. Setting the default TTL to <code class="literal">0</code>
+	    or <code class="literal">none</code> is the same as leaving it unset.
+	  </p></dd>
 <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
 <dd><p>
-            Sets the protocol value for the generated key.  The protocol
-            is a number between 0 and 255.  The default is 3 (DNSSEC).
-            Other possible values for this argument are listed in
-            RFC 2535 and its successors.
-          </p></dd>
+	    Sets the protocol value for the generated key.  The protocol
+	    is a number between 0 and 255.  The default is 3 (DNSSEC).
+	    Other possible values for this argument are listed in
+	    RFC 2535 and its successors.
+	  </p></dd>
 <dt><span class="term">-q</span></dt>
 <dd><p>
-            Quiet mode: Suppresses unnecessary output, including
-            progress indication.  Without this option, when
-            <span class="command"><strong>dnssec-keygen</strong></span> is run interactively
-            to generate an RSA or DSA key pair, it will print a string
-            of symbols to <code class="filename">stderr</code> indicating the
-            progress of the key generation.  A '.' indicates that a
-            random number has been found which passed an initial
-            sieve test; '+' means a number has passed a single
-            round of the Miller-Rabin primality test; a space
-            means that the number has passed all the tests and is
-            a satisfactory key.
-          </p></dd>
+	    Quiet mode: Suppresses unnecessary output, including
+	    progress indication.  Without this option, when
+	    <span class="command"><strong>dnssec-keygen</strong></span> is run interactively
+	    to generate an RSA or DSA key pair, it will print a string
+	    of symbols to <code class="filename">stderr</code> indicating the
+	    progress of the key generation.  A '.' indicates that a
+	    random number has been found which passed an initial
+	    sieve test; '+' means a number has passed a single
+	    round of the Miller-Rabin primality test; a space
+	    means that the number has passed all the tests and is
+	    a satisfactory key.
+	  </p></dd>
 <dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
 <dd><p>
-            Specifies the source of randomness.  If the operating
-            system does not provide a <code class="filename">/dev/random</code>
-            or equivalent device, the default source of randomness
-            is keyboard input.  <code class="filename">randomdev</code>
-            specifies
-            the name of a character device or file containing random
-            data to be used instead of the default.  The special value
-            <code class="filename">keyboard</code> indicates that keyboard
-            input should be used.
-          </p></dd>
+	    Specifies the source of randomness.  If the operating
+	    system does not provide a <code class="filename">/dev/random</code>
+	    or equivalent device, the default source of randomness
+	    is keyboard input.  <code class="filename">randomdev</code>
+	    specifies
+	    the name of a character device or file containing random
+	    data to be used instead of the default.  The special value
+	    <code class="filename">keyboard</code> indicates that keyboard
+	    input should be used.
+	  </p></dd>
 <dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
 <dd><p>
-            Create a new key which is an explicit successor to an
-            existing key.  The name, algorithm, size, and type of the
-            key will be set to match the existing key.  The activation
-            date of the new key will be set to the inactivation date of
-            the existing one.  The publication date will be set to the
-            activation date minus the prepublication interval, which
-            defaults to 30 days.
-          </p></dd>
+	    Create a new key which is an explicit successor to an
+	    existing key.  The name, algorithm, size, and type of the
+	    key will be set to match the existing key.  The activation
+	    date of the new key will be set to the inactivation date of
+	    the existing one.  The publication date will be set to the
+	    activation date minus the prepublication interval, which
+	    defaults to 30 days.
+	  </p></dd>
 <dt><span class="term">-s <em class="replaceable"><code>strength</code></em></span></dt>
 <dd><p>
-            Specifies the strength value of the key.  The strength is
-            a number between 0 and 15, and currently has no defined
-            purpose in DNSSEC.
-          </p></dd>
+	    Specifies the strength value of the key.  The strength is
+	    a number between 0 and 15, and currently has no defined
+	    purpose in DNSSEC.
+	  </p></dd>
 <dt><span class="term">-T <em class="replaceable"><code>rrtype</code></em></span></dt>
 <dd>
 <p>
-            Specifies the resource record type to use for the key.
-            <code class="option">rrtype</code> must be either DNSKEY or KEY.  The
-            default is DNSKEY when using a DNSSEC algorithm, but it can be
-            overridden to KEY for use with SIG(0).
-          </p>
+	    Specifies the resource record type to use for the key.
+	    <code class="option">rrtype</code> must be either DNSKEY or KEY.  The
+	    default is DNSKEY when using a DNSSEC algorithm, but it can be
+	    overridden to KEY for use with SIG(0).
+	  </p>
 <p>
-          </p>
+	  </p>
 <p>
-            Using any TSIG algorithm (HMAC-* or DH) forces this option
-            to KEY.
-          </p>
+	    Using any TSIG algorithm (HMAC-* or DH) forces this option
+	    to KEY.
+	  </p>
 </dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd><p>
-            Indicates the use of the key.  <code class="option">type</code> must be
-            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-            is AUTHCONF.  AUTH refers to the ability to authenticate
-            data, and CONF the ability to encrypt data.
-          </p></dd>
+	    Indicates the use of the key.  <code class="option">type</code> must be
+	    one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
+	    is AUTHCONF.  AUTH refers to the ability to authenticate
+	    data, and CONF the ability to encrypt data.
+	  </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
 <dd><p>
-            Sets the debugging level.
-          </p></dd>
+	    Sets the debugging level.
+	  </p></dd>
 <dt><span class="term">-V</span></dt>
 <dd><p>
 	    Prints version information.
@@ -301,38 +301,48 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which a key is to be published to the zone.
-            After that date, the key will be included in the zone but will
-            not be used to sign it.  If not set, and if the -G option has
-            not been used, the default is "now".
-          </p></dd>
+	    Sets the date on which a key is to be published to the zone.
+	    After that date, the key will be included in the zone but will
+	    not be used to sign it.  If not set, and if the -G option has
+	    not been used, the default is "now".
+	  </p></dd>
+<dt><span class="term">-P sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which CDS and CDNSKEY records that match this
+	    key are to be published to the zone.
+	  </p></dd>
 <dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be activated.  After that
-            date, the key will be included in the zone and used to sign
-            it.  If not set, and if the -G option has not been used, the
-            default is "now".  If set, if and -P is not set, then
-            the publication date will be set to the activation date
-            minus the prepublication interval.
-          </p></dd>
+	    Sets the date on which the key is to be activated.  After that
+	    date, the key will be included in the zone and used to sign
+	    it.  If not set, and if the -G option has not been used, the
+	    default is "now".  If set, if and -P is not set, then
+	    the publication date will be set to the activation date
+	    minus the prepublication interval.
+	  </p></dd>
 <dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be revoked.  After that
-            date, the key will be flagged as revoked.  It will be included
-            in the zone and will be used to sign it.
-          </p></dd>
+	    Sets the date on which the key is to be revoked.  After that
+	    date, the key will be flagged as revoked.  It will be included
+	    in the zone and will be used to sign it.
+	  </p></dd>
 <dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be retired.  After that
-            date, the key will still be included in the zone, but it
-            will not be used to sign it.
-          </p></dd>
+	    Sets the date on which the key is to be retired.  After that
+	    date, the key will still be included in the zone, but it
+	    will not be used to sign it.
+	  </p></dd>
 <dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
-            Sets the date on which the key is to be deleted.  After that
-            date, the key will no longer be included in the zone.  (It
-            may remain in the key repository, however.)
-          </p></dd>
+	    Sets the date on which the key is to be deleted.  After that
+	    date, the key will no longer be included in the zone.  (It
+	    may remain in the key repository, however.)
+	  </p></dd>
+<dt><span class="term">-D sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+	    Sets the date on which the CDS and CDNSKEY records that match this
+	    key are to be deleted.
+	  </p></dd>
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
 <p>
@@ -370,14 +380,14 @@
     </p>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
 <li class="listitem"><p><code class="filename">nnnn</code> is the key name.
-        </p></li>
+	</p></li>
 <li class="listitem"><p><code class="filename">aaa</code> is the numeric representation
-          of the
-          algorithm.
-        </p></li>
+	  of the
+	  algorithm.
+	</p></li>
 <li class="listitem"><p><code class="filename">iiiii</code> is the key identifier (or
-          footprint).
-        </p></li>
+	  footprint).
+	</p></li>
 </ul></div>
 <p><span class="command"><strong>dnssec-keygen</strong></span>
       creates two files, with names based
diff --git a/doc/arm/man.dnssec-settime.html b/doc/arm/man.dnssec-settime.html
index e4768c5281..9946cd0887 100644
--- a/doc/arm/man.dnssec-settime.html
+++ b/doc/arm/man.dnssec-settime.html
@@ -46,7 +46,7 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code>  [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code>  [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D sync <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
 </div>
 <div class="refsection">
 <a name="id-1.14.12.7"></a><h2>DESCRIPTION</h2>
@@ -79,7 +79,7 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-f</span></dt>
 <dd><p>
-	    Force an update of an old-format key with no metadata fields.
+            Force an update of an old-format key with no metadata fields.
             Without this option, <span class="command"><strong>dnssec-settime</strong></span> will
             fail when attempting to update a legacy key.  With this option,
             the key will be recreated in the new format, but with the
@@ -87,7 +87,7 @@
             set to the present time.  If no other values are specified,
             then the key's publication and activation dates will also
             be set to the present time.
-	  </p></dd>
+          </p></dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
             Sets the directory in which the key files are to reside.
@@ -105,12 +105,12 @@
           </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
-	    Emit usage message and exit.
-	  </p></dd>
+            Emit usage message and exit.
+          </p></dd>
 <dt><span class="term">-V</span></dt>
 <dd><p>
-	    Prints version information.
-	  </p></dd>
+            Prints version information.
+          </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
 <dd><p>
             Sets the debugging level.
@@ -150,6 +150,11 @@
             After that date, the key will be included in the zone but will
             not be used to sign it.
           </p></dd>
+<dt><span class="term">-P sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+            Sets the date on which CDS and CDNSKEY records that match this
+            key are to be published to the zone.
+          </p></dd>
 <dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
 <dd><p>
             Sets the date on which the key is to be activated.  After that
@@ -174,6 +179,11 @@
             date, the key will no longer be included in the zone.  (It
             may remain in the key repository, however.)
           </p></dd>
+<dt><span class="term">-D sync <em class="replaceable"><code>date/offset</code></em></span></dt>
+<dd><p>
+            Sets the date on which the CDS and CDNSKEY records that match this
+            key are to be deleted.
+          </p></dd>
 <dt><span class="term">-S <em class="replaceable"><code>predecessor key</code></em></span></dt>
 <dd><p>
             Select a key for which the key being modified will be an
@@ -219,21 +229,24 @@
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-u</span></dt>
 <dd><p>
-	    Print times in UNIX epoch format.
-	  </p></dd>
-<dt><span class="term">-p <em class="replaceable"><code>C/P/A/R/I/D/all</code></em></span></dt>
+            Print times in UNIX epoch format.
+          </p></dd>
+<dt><span class="term">-p <em class="replaceable"><code>C/P/Psync/A/R/I/D/Dsync/all</code></em></span></dt>
 <dd><p>
-	    Print a specific metadata value or set of metadata values.
+            Print a specific metadata value or set of metadata values.
             The <code class="option">-p</code> option may be followed by one or more
-            of the following letters to indicate which value or values to print:
+            of the following letters or strings to indicate which value
+            or values to print:
             <code class="option">C</code> for the creation date,
             <code class="option">P</code> for the publication date,
+            <code class="option">Psync</code> for the CDS and CDNSKEY publication date,
             <code class="option">A</code> for the activation date,
             <code class="option">R</code> for the revocation date,
-            <code class="option">I</code> for the inactivation date, or
-            <code class="option">D</code> for the deletion date.
+            <code class="option">I</code> for the inactivation date,
+            <code class="option">D</code> for the deletion date, and
+            <code class="option">Dsync</code> for the CDS and CDNSKEY deletion date
             To print all of the metadata, use <code class="option">-p all</code>.
-	  </p></dd>
+          </p></dd>
 </dl></div>
 </div>
 <div class="refsection">
diff --git a/doc/arm/man.dnstap-read.html b/doc/arm/man.dnstap-read.html
index 50aa7eda6c..f1c6872c94 100644
--- a/doc/arm/man.dnstap-read.html
+++ b/doc/arm/man.dnstap-read.html
@@ -1,11 +1,11 @@
 <!--
  - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
- -
+ - 
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
- -
+ - 
  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
diff --git a/doc/arm/man.lwresd.html b/doc/arm/man.lwresd.html
index 401818692d..a9500635cd 100644
--- a/doc/arm/man.lwresd.html
+++ b/doc/arm/man.lwresd.html
@@ -1,11 +1,11 @@
 <!--
  - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
- -
+ - 
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
- -
+ - 
  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
@@ -103,7 +103,7 @@
             Use <em class="replaceable"><code>config-file</code></em> as the
             configuration file instead of the default,
             <code class="filename">/etc/lwresd.conf</code>.
-
+	    
 	    <code class="option">-c</code> can not be used with <code class="option">-C</code>.
           </p></dd>
 <dt><span class="term">-C <em class="replaceable"><code>config-file</code></em></span></dt>
@@ -117,7 +117,7 @@
 <dd><p>
             Set the daemon's debug level to <em class="replaceable"><code>debug-level</code></em>.
             Debugging traces from <span class="command"><strong>lwresd</strong></span> become
-		more verbose as the debug level increases.
+            		more verbose as the debug level increases.
           </p></dd>
 <dt><span class="term">-f</span></dt>
 <dd><p>
@@ -158,7 +158,7 @@
 <dd><p>
             Listen for lightweight resolver queries on port
             <em class="replaceable"><code>port</code></em>.  If
-		not specified, the default is port 921.
+            		not specified, the default is port 921.
           </p></dd>
 <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
 <dd><p>
diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html
index 3bfea8ff1f..2433118222 100644
--- a/doc/arm/man.named.conf.html
+++ b/doc/arm/man.named.conf.html
@@ -1,11 +1,11 @@
 <!--
  - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
- -
+ - 
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
- -
+ - 
  - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index bbe7357bff..492bc2cd8b 100644
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -439,6 +439,13 @@
 	  The following types have been implemented: CSYNC, NINFO, RKEY,
 	  SINK, TA, TALINK.
 	</p></li>
+<li class="listitem"><p>
+	  A new <span class="command"><strong>message-compression</strong></span> option can be
+	  used to specify whether or not to use name compression when
+	  answering queries. Setting this to <strong class="userinput"><code>no</code></strong>
+	  results in larger responses, but reduces CPU consumption and
+	  may improve throughput.  The default is <strong class="userinput"><code>yes</code></strong>.
+	</p></li>
 </ul></div>
 </div>
 <div class="section">

From b51391848127d0303bd385a555c76aef57d1b4eb Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Thu, 5 Nov 2015 19:51:54 -0800
Subject: [PATCH 33/39] [master] allow spaces in rndc arguments

4256.	[bug]		Allow rndc command arguments to be quoted so as
			to allow spaces. [RT #36665]
---
 CHANGES                                 |   3 +
 bin/named/control.c                     | 113 ++++---
 bin/named/include/named/server.h        |  54 +--
 bin/named/server.c                      | 417 ++++++++++++++----------
 bin/tests/system/rndc/ns4/named.conf.in |   9 +-
 bin/tests/system/rndc/tests.sh          |   9 +-
 6 files changed, 367 insertions(+), 238 deletions(-)

diff --git a/CHANGES b/CHANGES
index b7b7377131..c8c4fb4513 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4256.	[bug]		Allow rndc command arguments to be quoted so as
+			to allow spaces. [RT #36665]
+
 4255.	[func]		Add 'message-compression' option to disable DNS
 			compression in responses. [RT #40726]
 
diff --git a/bin/named/control.c b/bin/named/control.c
index aaf9dd42ea..ca6c0f2b7b 100644
--- a/bin/named/control.c
+++ b/bin/named/control.c
@@ -24,6 +24,7 @@
 
 #include <isc/app.h>
 #include <isc/event.h>
+#include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/string.h>
 #include <isc/timer.h>
@@ -36,6 +37,7 @@
 #include <isccc/result.h>
 
 #include <named/control.h>
+#include <named/globals.h>
 #include <named/log.h>
 #include <named/os.h>
 #include <named/server.h>
@@ -43,15 +45,30 @@
 #include <named/ns_smf_globals.h>
 #endif
 
-static isc_boolean_t
-command_compare(const char *text, const char *command) {
-	unsigned int commandlen = strlen(command);
-	if (strncasecmp(text, command, commandlen) == 0 &&
-	    (text[commandlen] == '\0' ||
-	     text[commandlen] == ' ' ||
-	     text[commandlen] == '\t'))
-		return (ISC_TRUE);
-	return (ISC_FALSE);
+static isc_result_t
+getcommand(isc_lex_t *lex, char **cmdp) {
+	isc_result_t result;
+	isc_token_t token;
+
+	REQUIRE(cmdp != NULL && *cmdp == NULL);
+
+	result = isc_lex_gettoken(lex, ISC_LEXOPT_EOF, &token);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	isc_lex_ungettoken(lex, &token);
+
+	if (token.type != isc_tokentype_string)
+		return (ISC_R_FAILURE);
+
+	*cmdp = token.value.as_textregion.base;
+
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_boolean_t
+command_compare(const char *str, const char *command) {
+	return ISC_TF(strcasecmp(str, command) == 0);
 }
 
 /*%
@@ -61,9 +78,12 @@ command_compare(const char *text, const char *command) {
 isc_result_t
 ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t **text) {
 	isccc_sexpr_t *data;
+	char *cmdline = NULL;
 	char *command = NULL;
 	isc_result_t result;
 	int log_level;
+	isc_buffer_t src;
+	isc_lex_t *lex = NULL;
 #ifdef HAVE_LIBSCF
 	ns_smf_want_disable = 0;
 #endif
@@ -76,7 +96,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t **text) {
 		return (ISC_R_FAILURE);
 	}
 
-	result = isccc_cc_lookupstring(data, "type", &command);
+	result = isccc_cc_lookupstring(data, "type", &cmdline);
 	if (result != ISC_R_SUCCESS) {
 		/*
 		 * We have no idea what this is.
@@ -84,6 +104,20 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t **text) {
 		return (result);
 	}
 
+	result = isc_lex_create(ns_g_mctx, strlen(cmdline), &lex);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	isc_buffer_init(&src, cmdline, strlen(cmdline));
+	isc_buffer_add(&src, strlen(cmdline));
+	result = isc_lex_openbuffer(lex, &src);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
+	result = getcommand(lex, &command);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
 	/*
 	 * Compare the 'command' parameter against all known control commands.
 	 */
@@ -93,20 +127,21 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t **text) {
 	} else {
 		log_level = ISC_LOG_INFO;
 	}
+
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 		      NS_LOGMODULE_CONTROL, log_level,
 		      "received control channel command '%s'",
 		      command);
 
 	if (command_compare(command, NS_COMMAND_RELOAD)) {
-		result = ns_server_reloadcommand(ns_g_server, command, text);
+		result = ns_server_reloadcommand(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_RECONFIG)) {
 		result = ns_server_reconfigcommand(ns_g_server);
 	} else if (command_compare(command, NS_COMMAND_REFRESH)) {
-		result = ns_server_refreshcommand(ns_g_server, command, text);
+		result = ns_server_refreshcommand(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_RETRANSFER)) {
 		result = ns_server_retransfercommand(ns_g_server,
-						     command, text);
+						     lex, text);
 	} else if (command_compare(command, NS_COMMAND_HALT)) {
 #ifdef HAVE_LIBSCF
 		/*
@@ -116,7 +151,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t **text) {
 		 */
 		if (ns_smf_got_instance == 1 && ns_smf_chroot == 1) {
 			result = ns_smf_add_message(text);
-			return (result);
+			goto cleanup;
 		}
 		/*
 		 * If we are managed by smf(5) but not in chroot,
@@ -143,7 +178,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t **text) {
 #ifdef HAVE_LIBSCF
 		if (ns_smf_got_instance == 1 && ns_smf_chroot == 1) {
 			result = ns_smf_add_message(text);
-			return (result);
+			goto cleanup;
 		}
 		if (ns_smf_got_instance == 1 && ns_smf_chroot == 0)
 			ns_smf_want_disable = 1;
@@ -155,42 +190,42 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t **text) {
 	} else if (command_compare(command, NS_COMMAND_DUMPSTATS)) {
 		result = ns_server_dumpstats(ns_g_server);
 	} else if (command_compare(command, NS_COMMAND_QUERYLOG)) {
-		result = ns_server_togglequerylog(ns_g_server, command);
+		result = ns_server_togglequerylog(ns_g_server, lex);
 	} else if (command_compare(command, NS_COMMAND_DUMPDB)) {
-		ns_server_dumpdb(ns_g_server, command);
+		ns_server_dumpdb(ns_g_server, lex);
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NS_COMMAND_SECROOTS)) {
-		result = ns_server_dumpsecroots(ns_g_server, command, text);
+		result = ns_server_dumpsecroots(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_TRACE)) {
-		result = ns_server_setdebuglevel(ns_g_server, command);
+		result = ns_server_setdebuglevel(ns_g_server, lex);
 	} else if (command_compare(command, NS_COMMAND_NOTRACE)) {
 		ns_g_debuglevel = 0;
 		isc_log_setdebuglevel(ns_g_lctx, ns_g_debuglevel);
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NS_COMMAND_FLUSH)) {
-		result = ns_server_flushcache(ns_g_server, command);
+		result = ns_server_flushcache(ns_g_server, lex);
 	} else if (command_compare(command, NS_COMMAND_FLUSHNAME)) {
-		result = ns_server_flushnode(ns_g_server, command, ISC_FALSE);
+		result = ns_server_flushnode(ns_g_server, lex, ISC_FALSE);
 	} else if (command_compare(command, NS_COMMAND_FLUSHTREE)) {
-		result = ns_server_flushnode(ns_g_server, command, ISC_TRUE);
+		result = ns_server_flushnode(ns_g_server, lex, ISC_TRUE);
 	} else if (command_compare(command, NS_COMMAND_STATUS)) {
 		result = ns_server_status(ns_g_server, text);
 	} else if (command_compare(command, NS_COMMAND_TSIGLIST)) {
 		result = ns_server_tsiglist(ns_g_server, text);
 	} else if (command_compare(command, NS_COMMAND_TSIGDELETE)) {
-		result = ns_server_tsigdelete(ns_g_server, command, text);
+		result = ns_server_tsigdelete(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_FREEZE)) {
-		result = ns_server_freeze(ns_g_server, ISC_TRUE, command,
+		result = ns_server_freeze(ns_g_server, ISC_TRUE, lex,
 					  text);
 	} else if (command_compare(command, NS_COMMAND_UNFREEZE) ||
 		   command_compare(command, NS_COMMAND_THAW)) {
-		result = ns_server_freeze(ns_g_server, ISC_FALSE, command,
+		result = ns_server_freeze(ns_g_server, ISC_FALSE, lex,
 					  text);
 	} else if (command_compare(command, NS_COMMAND_SCAN)) {
 		result = ISC_R_SUCCESS;
 		ns_server_scan_interfaces(ns_g_server);
 	} else if (command_compare(command, NS_COMMAND_SYNC)) {
-		result = ns_server_sync(ns_g_server, command, text);
+		result = ns_server_sync(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_RECURSING)) {
 		result = ns_server_dumprecursing(ns_g_server);
 	} else if (command_compare(command, NS_COMMAND_TIMERPOKE)) {
@@ -199,29 +234,29 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t **text) {
 	} else if (command_compare(command, NS_COMMAND_NULL)) {
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NS_COMMAND_NOTIFY)) {
-		result = ns_server_notifycommand(ns_g_server, command, text);
+		result = ns_server_notifycommand(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_VALIDATION)) {
-		result = ns_server_validation(ns_g_server, command, text);
+		result = ns_server_validation(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_SIGN) ||
 		   command_compare(command, NS_COMMAND_LOADKEYS)) {
-		result = ns_server_rekey(ns_g_server, command, text);
+		result = ns_server_rekey(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_ADDZONE) ||
 		   command_compare(command, NS_COMMAND_MODZONE)) {
-		result = ns_server_changezone(ns_g_server, command, text);
+		result = ns_server_changezone(ns_g_server, cmdline, text);
 	} else if (command_compare(command, NS_COMMAND_DELZONE)) {
-		result = ns_server_delzone(ns_g_server, command, text);
+		result = ns_server_delzone(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_SHOWZONE)) {
-		result = ns_server_showzone(ns_g_server, command, text);
+		result = ns_server_showzone(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_SIGNING)) {
-		result = ns_server_signing(ns_g_server, command, text);
+		result = ns_server_signing(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_ZONESTATUS)) {
-		result = ns_server_zonestatus(ns_g_server, command, text);
+		result = ns_server_zonestatus(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_NTA)) {
-		result = ns_server_nta(ns_g_server, command, text);
+		result = ns_server_nta(ns_g_server, lex, text);
 	} else if (command_compare(command, NS_COMMAND_TESTGEN)) {
-		result = ns_server_testgen(command, text);
+		result = ns_server_testgen(lex, text);
 	} else if (command_compare(command, NS_COMMAND_MKEYS)) {
-		result = ns_server_mkeys(ns_g_server, command, text);
+		result = ns_server_mkeys(ns_g_server, lex, text);
 	} else {
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
@@ -230,5 +265,9 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t **text) {
 		result = DNS_R_UNKNOWNCOMMAND;
 	}
 
+ cleanup:
+	if (lex != NULL)
+		isc_lex_destroy(&lex);
+
 	return (result);
 }
diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
index e1d354ddbb..d6b220a99c 100644
--- a/bin/named/include/named/server.h
+++ b/bin/named/include/named/server.h
@@ -534,7 +534,8 @@ ns_server_flushonshutdown(ns_server_t *server, isc_boolean_t flush);
  */
 
 isc_result_t
-ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_reloadcommand(ns_server_t *server, isc_lex_t *lex,
+			isc_buffer_t **text);
 /*%<
  * Act on a "reload" command from the command channel.
  */
@@ -546,26 +547,28 @@ ns_server_reconfigcommand(ns_server_t *server);
  */
 
 isc_result_t
-ns_server_notifycommand(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_notifycommand(ns_server_t *server, isc_lex_t *lex,
+			isc_buffer_t **text);
 /*%<
  * Act on a "notify" command from the command channel.
  */
 
 isc_result_t
-ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_refreshcommand(ns_server_t *server, isc_lex_t *lex,
+			 isc_buffer_t **text);
 /*%<
  * Act on a "refresh" command from the command channel.
  */
 
 isc_result_t
-ns_server_retransfercommand(ns_server_t *server, char *args,
+ns_server_retransfercommand(ns_server_t *server, isc_lex_t *lex,
 			    isc_buffer_t **text);
 /*%<
  * Act on a "retransfer" command from the command channel.
  */
 
 isc_result_t
-ns_server_togglequerylog(ns_server_t *server, char *args);
+ns_server_togglequerylog(ns_server_t *server, isc_lex_t *lex);
 /*%<
  * Enable/disable logging of queries.  (Takes "yes" or "no" argument,
  * but can also be used as a toggle for backward comptibility.)
@@ -593,25 +596,26 @@ ns_server_dumpstats(ns_server_t *server);
  * Dump the current cache to the dump file.
  */
 isc_result_t
-ns_server_dumpdb(ns_server_t *server, char *args);
+ns_server_dumpdb(ns_server_t *server, isc_lex_t *lex);
 
 /*%
  * Dump the current security roots to the secroots file.
  */
 isc_result_t
-ns_server_dumpsecroots(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_dumpsecroots(ns_server_t *server, isc_lex_t *lex,
+		       isc_buffer_t **text);
 
 /*%
  * Change or increment the server debug level.
  */
 isc_result_t
-ns_server_setdebuglevel(ns_server_t *server, char *args);
+ns_server_setdebuglevel(ns_server_t *server, isc_lex_t *lex);
 
 /*%
  * Flush the server's cache(s)
  */
 isc_result_t
-ns_server_flushcache(ns_server_t *server, char *args);
+ns_server_flushcache(ns_server_t *server, isc_lex_t *lex);
 
 /*%
  * Flush a particular name from the server's cache.  If 'tree' is false,
@@ -619,7 +623,8 @@ ns_server_flushcache(ns_server_t *server, char *args);
  * flush all the names under the specified name.
  */
 isc_result_t
-ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree);
+ns_server_flushnode(ns_server_t *server, isc_lex_t *lex,
+		    isc_boolean_t tree);
 
 /*%
  * Report the server's status.
@@ -637,20 +642,21 @@ ns_server_tsiglist(ns_server_t *server, isc_buffer_t **text);
  * Delete a specific key (with optional view).
  */
 isc_result_t
-ns_server_tsigdelete(ns_server_t *server, char *command, isc_buffer_t **text);
+ns_server_tsigdelete(ns_server_t *server, isc_lex_t *lex,
+		     isc_buffer_t **text);
 
 /*%
  * Enable or disable updates for a zone.
  */
 isc_result_t
-ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
-		 isc_buffer_t **text);
+ns_server_freeze(ns_server_t *server, isc_boolean_t freeze,
+		 isc_lex_t *lex, isc_buffer_t **text);
 
 /*%
  * Dump zone updates to disk, optionally removing the journal file
  */
 isc_result_t
-ns_server_sync(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_sync(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 
 /*%
  * Update a zone's DNSKEY set from the key repository.  If
@@ -660,7 +666,7 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t **text);
  * take place incrementally.
  */
 isc_result_t
-ns_server_rekey(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_rekey(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 
 /*%
  * Dump the current recursive queries.
@@ -678,57 +684,57 @@ ns_add_reserved_dispatch(ns_server_t *server, const isc_sockaddr_t *addr);
  * Enable or disable dnssec validation.
  */
 isc_result_t
-ns_server_validation(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_validation(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 
 /*%
  * Add a zone to a running process, or modify an existing zone
  */
 isc_result_t
-ns_server_changezone(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_changezone(ns_server_t *server, char *command, isc_buffer_t **text);
 
 /*%
  * Deletes a zone from a running process
  */
 isc_result_t
-ns_server_delzone(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_delzone(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 
 /*%
  * Show current configuration for a given zone
  */
 isc_result_t
-ns_server_showzone(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_showzone(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 
 /*%
  * Lists the status of the signing records for a given zone.
  */
 isc_result_t
-ns_server_signing(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_signing(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 
 /*%
  * Lists status information for a given zone (e.g., name, type, files,
  * load time, expiry, etc).
  */
 isc_result_t
-ns_server_zonestatus(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_zonestatus(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 
 /*%
  * Adds a Negative Trust Anchor (NTA) for a specified name and
  * duration, in a particular view if specified, or in all views.
  */
 isc_result_t
-ns_server_nta(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_nta(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 
 /*%
  * Generates a test sequence that is only for use in system tests. The
  * argument is the size of required output in bytes.
  */
 isc_result_t
-ns_server_testgen(char *args, isc_buffer_t **text);
+ns_server_testgen(isc_lex_t *lex, isc_buffer_t **text);
 
 /*%
  * Force fefresh or print status for managed keys zones.
  */
 isc_result_t
-ns_server_mkeys(ns_server_t *server, char *args, isc_buffer_t **text);
+ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
 
 #endif /* NAMED_SERVER_H */
diff --git a/bin/named/server.c b/bin/named/server.c
index 0e88fef90d..e850db8855 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -7620,34 +7620,71 @@ ns_server_scan_interfaces(ns_server_t *server) {
 	isc_task_endexclusive(server->task);
 }
 
+/*
+ * Get the next token from lexer 'lex'.
+ *
+ * NOTE: the token value for string tokens always uses the same pointer
+ * value.  Multiple calls to this function on the same lexer will always
+ * return either that value (lex->data) or NULL. It is necessary to copy
+ * the token into local storage if it needs to be referenced after the next
+ * call to next_token().
+ */
 static char *
-next_token(char **stringp, const char *delim) {
-	char *res;
+next_token(isc_lex_t *lex, isc_buffer_t **text) {
+	isc_result_t result;
+	isc_token_t token;
 
-	do {
-		res = strsep(stringp, delim);
-		if (res == NULL)
-			break;
-	} while (*res == '\0');
-	return (res);
+	token.type = isc_tokentype_unknown;
+	result = isc_lex_gettoken(lex, ISC_LEXOPT_EOF|ISC_LEXOPT_QSTRING,
+				  &token);
+
+	switch (result) {
+	case ISC_R_NOMORE:
+		(void) isc_lex_close(lex);
+		break;
+	case ISC_R_SUCCESS:
+		if (token.type == isc_tokentype_eof)
+			(void) isc_lex_close(lex);
+		break;
+	case ISC_R_NOSPACE:
+		if (text != NULL) {
+			(void) putstr(text, "token too large");
+			(void) putnull(text);
+		}
+		return (NULL);
+	default:
+		if (text != NULL) {
+			(void) putstr(text, isc_result_totext(result));
+			(void) putnull(text);
+		}
+		return (NULL);
+	}
+
+	if (token.type == isc_tokentype_string ||
+	    token.type == isc_tokentype_qstring)
+		return (token.value.as_textregion.base);
+
+	return (NULL);
 }
 
 /*
- * Find the zone specified in the control channel command 'args',
- * if any.  If a zone is specified, point '*zonep' at it, otherwise
- * set '*zonep' to NULL.
+ * Find the zone specified in the control channel command, if any.
+ * If a zone is specified, point '*zonep' at it, otherwise
+ * set '*zonep' to NULL, and f 'zonename' is not NULL, copy
+ * the zone name into it (N.B. 'zonename' must have space to hold
+ * a full DNS name).
  *
  * If 'zonetxt' is set, the caller has already pulled a token
- * off the command line that is to be used as the zone name.  (This
- * is done when it's necessary to check for an optional argument
- * before the zone name, as in "rndc sync [-clean] zone".)
+ * off the command line that is to be used as the zone name. (This
+ * is sometimes done when it's necessary to check for an optional
+ * argument before the zone name, as in "rndc sync [-clean] zone".)
  */
 static isc_result_t
-zone_from_args(ns_server_t *server, char *args, const char *zonetxt,
-	       dns_zone_t **zonep, const char **zonename,
+zone_from_args(ns_server_t *server, isc_lex_t *lex, const char *zonetxt,
+	       dns_zone_t **zonep, char *zonename,
 	       isc_buffer_t **text, isc_boolean_t skip)
 {
-	char *input, *ptr;
+	char *ptr;
 	char *classtxt;
 	const char *viewtxt = NULL;
 	dns_fixedname_t fname;
@@ -7656,43 +7693,42 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt,
 	dns_view_t *view = NULL;
 	dns_rdataclass_t rdclass;
 	char problem[DNS_NAME_FORMATSIZE + 500] = "";
+	char zonebuf[DNS_NAME_FORMATSIZE];
 
 	REQUIRE(zonep != NULL && *zonep == NULL);
-	REQUIRE(zonename == NULL || *zonename == NULL);
-
-	input = args;
 
 	if (skip) {
 		/* Skip the command name. */
-		ptr = next_token(&input, " \t");
+		ptr = next_token(lex, text);
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 	}
 
 	/* Look for the zone name. */
 	if (zonetxt == NULL)
-		zonetxt = next_token(&input, " \t");
+		zonetxt = next_token(lex, text);
 	if (zonetxt == NULL)
 		return (ISC_R_SUCCESS);
-	if (zonename != NULL)
-		*zonename = zonetxt;
 
-	/* Look for the optional class name. */
-	classtxt = next_token(&input, " \t");
-	if (classtxt != NULL) {
-		/* Look for the optional view name. */
-		viewtxt = next_token(&input, " \t");
-	}
+	/* Copy zonetxt because it'll be overwritten by next_token() */
+	strlcpy(zonebuf, zonetxt, DNS_NAME_FORMATSIZE);
+	if (zonename != NULL)
+		strlcpy(zonename, zonetxt, DNS_NAME_FORMATSIZE);
 
 	dns_fixedname_init(&fname);
 	name = dns_fixedname_name(&fname);
-	CHECK(dns_name_fromstring(name, zonetxt, 0, NULL));
+	CHECK(dns_name_fromstring(name, zonebuf, 0, NULL));
 
+	/* Look for the optional class name. */
+	classtxt = next_token(lex, text);
 	if (classtxt != NULL) {
 		isc_textregion_t r;
 		r.base = classtxt;
 		r.length = strlen(classtxt);
 		CHECK(dns_rdataclass_fromtext(&rdclass, &r));
+
+		/* Look for the optional view name. */
+		viewtxt = next_token(lex, text);
 	} else
 		rdclass = dns_rdataclass_in;
 
@@ -7703,11 +7739,11 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt,
 		if (result == ISC_R_NOTFOUND)
 			snprintf(problem, sizeof(problem),
 				 "no matching zone '%s' in any view",
-				 zonetxt);
+				 zonebuf);
 		else if (result == ISC_R_MULTIPLE)
 			snprintf(problem, sizeof(problem),
 				 "zone '%s' was found in multiple views",
-				 zonetxt);
+				 zonebuf);
 	} else {
 		result = dns_viewlist_find(&server->viewlist, viewtxt,
 					   rdclass, &view);
@@ -7721,7 +7757,7 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt,
 		if (result != ISC_R_SUCCESS)
 			snprintf(problem, sizeof(problem),
 				 "no matching zone '%s' in view '%s'",
-				 zonetxt, viewtxt);
+				 zonebuf, viewtxt);
 	}
 
 	/* Partial match? */
@@ -7749,7 +7785,7 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt,
  * Act on a "retransfer" command from the command channel.
  */
 isc_result_t
-ns_server_retransfercommand(ns_server_t *server, char *args,
+ns_server_retransfercommand(ns_server_t *server, isc_lex_t *lex,
 			    isc_buffer_t **text)
 {
 	isc_result_t result;
@@ -7757,7 +7793,7 @@ ns_server_retransfercommand(ns_server_t *server, char *args,
 	dns_zone_t *raw = NULL;
 	dns_zonetype_t type;
 
-	result = zone_from_args(server, args, NULL, &zone, NULL,
+	result = zone_from_args(server, lex, NULL, &zone, NULL,
 				text, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -7782,13 +7818,15 @@ ns_server_retransfercommand(ns_server_t *server, char *args,
  * Act on a "reload" command from the command channel.
  */
 isc_result_t
-ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_reloadcommand(ns_server_t *server, isc_lex_t *lex,
+			isc_buffer_t **text)
+{
 	isc_result_t result;
 	dns_zone_t *zone = NULL;
 	dns_zonetype_t type;
 	const char *msg = NULL;
 
-	result = zone_from_args(server, args, NULL, &zone, NULL,
+	result = zone_from_args(server, lex, NULL, &zone, NULL,
 				text, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -7857,12 +7895,14 @@ cleanup:
  * Act on a "notify" command from the command channel.
  */
 isc_result_t
-ns_server_notifycommand(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_notifycommand(ns_server_t *server, isc_lex_t *lex,
+			isc_buffer_t **text)
+{
 	isc_result_t result;
 	dns_zone_t *zone = NULL;
 	const char msg[] = "zone notify queued";
 
-	result = zone_from_args(server, args, NULL, &zone, NULL,
+	result = zone_from_args(server, lex, NULL, &zone, NULL,
 				text, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -7881,7 +7921,8 @@ ns_server_notifycommand(ns_server_t *server, char *args, isc_buffer_t **text) {
  * Act on a "refresh" command from the command channel.
  */
 isc_result_t
-ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t **text)
+ns_server_refreshcommand(ns_server_t *server, isc_lex_t *lex,
+			 isc_buffer_t **text)
 {
 	isc_result_t result;
 	dns_zone_t *zone = NULL, *raw = NULL;
@@ -7889,7 +7930,7 @@ ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t **text)
 	const char msg2[] = "not a slave or stub zone";
 	dns_zonetype_t type;
 
-	result = zone_from_args(server, args, NULL, &zone, NULL,
+	result = zone_from_args(server, lex, NULL, &zone, NULL,
 				text, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -7919,16 +7960,16 @@ ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t **text)
 }
 
 isc_result_t
-ns_server_togglequerylog(ns_server_t *server, char *args) {
+ns_server_togglequerylog(ns_server_t *server, isc_lex_t *lex) {
 	isc_boolean_t value;
 	char *ptr;
 
 	/* Skip the command name. */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, NULL);
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, NULL);
 	if (ptr == NULL)
 		value = server->log_queries ? ISC_FALSE : ISC_TRUE;
 	else if (strcasecmp(ptr, "yes") == 0 || strcasecmp(ptr, "on") == 0)
@@ -8281,7 +8322,7 @@ dumpdone(void *arg, isc_result_t result) {
 }
 
 isc_result_t
-ns_server_dumpdb(ns_server_t *server, char *args) {
+ns_server_dumpdb(ns_server_t *server, isc_lex_t *lex) {
 	struct dumpcontext *dctx = NULL;
 	dns_view_t *view;
 	isc_result_t result;
@@ -8289,7 +8330,7 @@ ns_server_dumpdb(ns_server_t *server, char *args) {
 	const char *sep;
 
 	/* Skip the command name. */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, NULL);
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
@@ -8318,19 +8359,19 @@ ns_server_dumpdb(ns_server_t *server, char *args) {
 	CHECKMF(isc_stdio_open(server->dumpfile, "w", &dctx->fp),
 		"could not open dump file", server->dumpfile);
 
-	sep = (args == NULL) ? "" : ": ";
+	ptr = next_token(lex, NULL);
+	sep = (ptr == NULL) ? "" : ": ";
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 		      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
-		      "dumpdb started%s%s", sep, (args != NULL) ? args : "");
+		      "dumpdb started%s%s", sep, (ptr != NULL) ? ptr : "");
 
-	ptr = next_token(&args, " \t");
 	if (ptr != NULL && strcmp(ptr, "-all") == 0) {
 		/* also dump zones */
 		dctx->dumpzones = ISC_TRUE;
-		ptr = next_token(&args, " \t");
+		ptr = next_token(lex, NULL);
 	} else if (ptr != NULL && strcmp(ptr, "-cache") == 0) {
 		/* this is the default */
-		ptr = next_token(&args, " \t");
+		ptr = next_token(lex, NULL);
 	} else if (ptr != NULL && strcmp(ptr, "-zones") == 0) {
 		/* only dump zones, suppress caches */
 		dctx->dumpadb = ISC_FALSE;
@@ -8338,25 +8379,25 @@ ns_server_dumpdb(ns_server_t *server, char *args) {
 		dctx->dumpcache = ISC_FALSE;
 		dctx->dumpfail = ISC_FALSE;
 		dctx->dumpzones = ISC_TRUE;
-		ptr = next_token(&args, " \t");
+		ptr = next_token(lex, NULL);
 	} else if (ptr != NULL && strcmp(ptr, "-adb") == 0) {
 		/* only dump adb, suppress other caches */
 		dctx->dumpbad = ISC_FALSE;
 		dctx->dumpcache = ISC_FALSE;
 		dctx->dumpfail = ISC_FALSE;
-		ptr = next_token(&args, " \t");
+		ptr = next_token(lex, NULL);
 	} else if (ptr != NULL && strcmp(ptr, "-bad") == 0) {
 		/* only dump badcache, suppress other caches */
 		dctx->dumpadb = ISC_FALSE;
 		dctx->dumpcache = ISC_FALSE;
 		dctx->dumpfail = ISC_FALSE;
-		ptr = next_token(&args, " \t");
+		ptr = next_token(lex, NULL);
 	} else if (ptr != NULL && strcmp(ptr, "-fail") == 0) {
 		/* only dump servfail cache, suppress other caches */
 		dctx->dumpadb = ISC_FALSE;
 		dctx->dumpbad = ISC_FALSE;
 		dctx->dumpcache = ISC_FALSE;
-		ptr = next_token(&args, " \t");
+		ptr = next_token(lex, NULL);
 	}
 
  nextview:
@@ -8369,7 +8410,7 @@ ns_server_dumpdb(ns_server_t *server, char *args) {
 		CHECK(add_view_tolist(dctx, view));
 	}
 	if (ptr != NULL) {
-		ptr = next_token(&args, " \t");
+		ptr = next_token(lex, NULL);
 		if (ptr != NULL)
 			goto nextview;
 	}
@@ -8383,7 +8424,9 @@ ns_server_dumpdb(ns_server_t *server, char *args) {
 }
 
 isc_result_t
-ns_server_dumpsecroots(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_dumpsecroots(ns_server_t *server, isc_lex_t *lex,
+		       isc_buffer_t **text)
+{
 	dns_view_t *view;
 	dns_keytable_t *secroots = NULL;
 	dns_ntatable_t *ntatable = NULL;
@@ -8394,14 +8437,14 @@ ns_server_dumpsecroots(ns_server_t *server, char *args, isc_buffer_t **text) {
 	char tbuf[64];
 
 	/* Skip the command name. */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, text);
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
 	/* "-" here means print the output instead of dumping to file */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, text);
 	if (ptr != NULL && strcmp(ptr, "-") == 0)
-		ptr = next_token(&args, " \t");
+		ptr = next_token(lex, text);
 	else {
 		result = isc_stdio_open(server->secrootsfile, "w", &fp);
 		if (result != ISC_R_SUCCESS) {
@@ -8448,7 +8491,7 @@ ns_server_dumpsecroots(ns_server_t *server, char *args, isc_buffer_t **text) {
 			CHECK(dns_ntatable_totext(ntatable, text));
 		}
 		if (ptr != NULL)
-			ptr = next_token(&args, " \t");
+			ptr = next_token(lex, text);
 	} while (ptr != NULL);
 
  cleanup:
@@ -8519,26 +8562,25 @@ ns_server_dumprecursing(ns_server_t *server) {
 }
 
 isc_result_t
-ns_server_setdebuglevel(ns_server_t *server, char *args) {
+ns_server_setdebuglevel(ns_server_t *server, isc_lex_t *lex) {
 	char *ptr;
-	char *levelstr;
 	char *endp;
 	long newlevel;
 
 	UNUSED(server);
 
 	/* Skip the command name. */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, NULL);
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
 	/* Look for the new level name. */
-	levelstr = next_token(&args, " \t");
-	if (levelstr == NULL) {
+	ptr = next_token(lex, NULL);
+	if (ptr == NULL) {
 		if (ns_g_debuglevel < 99)
 			ns_g_debuglevel++;
 	} else {
-		newlevel = strtol(levelstr, &endp, 10);
+		newlevel = strtol(ptr, &endp, 10);
 		if (*endp != '\0' || newlevel < 0 || newlevel > 99)
 			return (ISC_R_RANGE);
 		ns_g_debuglevel = (unsigned int)newlevel;
@@ -8551,20 +8593,22 @@ ns_server_setdebuglevel(ns_server_t *server, char *args) {
 }
 
 isc_result_t
-ns_server_validation(ns_server_t *server, char *args, isc_buffer_t **text) {
-	char *ptr, *viewname;
+ns_server_validation(ns_server_t *server, isc_lex_t *lex,
+		     isc_buffer_t **text)
+{
+	char *ptr;
 	dns_view_t *view;
 	isc_boolean_t changed = ISC_FALSE;
 	isc_result_t result;
 	isc_boolean_t enable = ISC_TRUE, set = ISC_TRUE, first = ISC_TRUE;
 
 	/* Skip the command name. */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, text);
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
 	/* Find out what we are to do. */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, text);
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
@@ -8580,7 +8624,7 @@ ns_server_validation(ns_server_t *server, char *args, isc_buffer_t **text) {
 		return (DNS_R_SYNTAX);
 
 	/* Look for the view name. */
-	viewname = next_token(&args, " \t");
+	ptr = next_token(lex, text);
 
 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -8588,7 +8632,7 @@ ns_server_validation(ns_server_t *server, char *args, isc_buffer_t **text) {
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
-		if (viewname != NULL && strcasecmp(viewname, view->name) != 0)
+		if (ptr != NULL && strcasecmp(ptr, view->name) != 0)
 			continue;
 		CHECK(dns_view_flushcache(view));
 
@@ -8621,8 +8665,8 @@ ns_server_validation(ns_server_t *server, char *args, isc_buffer_t **text) {
 }
 
 isc_result_t
-ns_server_flushcache(ns_server_t *server, char *args) {
-	char *ptr, *viewname;
+ns_server_flushcache(ns_server_t *server, isc_lex_t *lex) {
+	char *ptr;
 	dns_view_t *view;
 	isc_boolean_t flushed;
 	isc_boolean_t found;
@@ -8630,12 +8674,12 @@ ns_server_flushcache(ns_server_t *server, char *args) {
 	ns_cache_t *nsc;
 
 	/* Skip the command name. */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, NULL);
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
 	/* Look for the view name. */
-	viewname = next_token(&args, " \t");
+	ptr = next_token(lex, NULL);
 
 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -8648,7 +8692,7 @@ ns_server_flushcache(ns_server_t *server, char *args) {
 	 * list, flush these caches, and then update other views that refer to
 	 * the flushed cache DB.
 	 */
-	if (viewname != NULL) {
+	if (ptr != NULL) {
 		/*
 		 * Mark caches that need to be flushed.  This is an O(#view^2)
 		 * operation in the very worst case, but should be normally
@@ -8659,7 +8703,7 @@ ns_server_flushcache(ns_server_t *server, char *args) {
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link))
 		{
-			if (strcasecmp(viewname, view->name) != 0)
+			if (strcasecmp(ptr, view->name) != 0)
 				continue;
 			found = ISC_TRUE;
 			for (nsc = ISC_LIST_HEAD(server->cachelist);
@@ -8678,7 +8722,7 @@ ns_server_flushcache(ns_server_t *server, char *args) {
 	for (nsc = ISC_LIST_HEAD(server->cachelist);
 	     nsc != NULL;
 	     nsc = ISC_LIST_NEXT(nsc, link)) {
-		if (viewname != NULL && !nsc->needflush)
+		if (ptr != NULL && !nsc->needflush)
 			continue;
 		nsc->needflush = ISC_TRUE;
 		result = dns_view_flushcache2(nsc->primaryview, ISC_FALSE);
@@ -8732,11 +8776,11 @@ ns_server_flushcache(ns_server_t *server, char *args) {
 	}
 
 	if (flushed && found) {
-		if (viewname != NULL)
+		if (ptr != NULL)
 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
 				      "flushing cache in view '%s' succeeded",
-				      viewname);
+				      ptr);
 		else
 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
@@ -8747,7 +8791,7 @@ ns_server_flushcache(ns_server_t *server, char *args) {
 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 				      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "flushing cache in view '%s' failed: "
-				      "view not found", viewname);
+				      "view not found", ptr);
 			result = ISC_R_NOTFOUND;
 		} else
 			result = ISC_R_FAILURE;
@@ -8757,8 +8801,9 @@ ns_server_flushcache(ns_server_t *server, char *args) {
 }
 
 isc_result_t
-ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree) {
-	char *target, *viewname;
+ns_server_flushnode(ns_server_t *server, isc_lex_t *lex, isc_boolean_t tree) {
+	char *ptr, *viewname;
+	char target[DNS_NAME_FORMATSIZE];
 	dns_view_t *view;
 	isc_boolean_t flushed;
 	isc_boolean_t found;
@@ -8768,15 +8813,16 @@ ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree) {
 	dns_name_t *name;
 
 	/* Skip the command name. */
-	target = next_token(&args, " \t");
-	if (target == NULL)
+	ptr = next_token(lex, NULL);
+	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
 	/* Find the domain name to flush. */
-	target = next_token(&args, " \t");
-	if (target == NULL)
+	ptr = next_token(lex, NULL);
+	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
+	strlcpy(target, ptr, DNS_NAME_FORMATSIZE);
 	isc_buffer_constinit(&b, target, strlen(target));
 	isc_buffer_add(&b, strlen(target));
 	dns_fixedname_init(&fixed);
@@ -8786,7 +8832,7 @@ ns_server_flushnode(ns_server_t *server, char *args, isc_boolean_t tree) {
 		return (result);
 
 	/* Look for the view name. */
-	viewname = next_token(&args, " \t");
+	viewname = next_token(lex, NULL);
 
 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -8945,7 +8991,7 @@ ns_server_status(ns_server_t *server, isc_buffer_t **text) {
 }
 
 isc_result_t
-ns_server_testgen(char *args, isc_buffer_t **text) {
+ns_server_testgen(isc_lex_t *lex, isc_buffer_t **text) {
 	isc_result_t result;
 	char *ptr;
 	unsigned long count;
@@ -8953,11 +8999,11 @@ ns_server_testgen(char *args, isc_buffer_t **text) {
 	const unsigned char chars[] = "abcdefghijklmnopqrstuvwxyz0123456789";
 
 	/* Skip the command name. */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, text);
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, text);
 	if (ptr == NULL)
 		count = 26;
 	else
@@ -9037,18 +9083,24 @@ delete_keynames(dns_tsig_keyring_t *ring, char *target,
 }
 
 isc_result_t
-ns_server_tsigdelete(ns_server_t *server, char *command, isc_buffer_t **text) {
+ns_server_tsigdelete(ns_server_t *server, isc_lex_t *lex,
+		     isc_buffer_t **text)
+{
 	isc_result_t result;
 	dns_view_t *view;
 	unsigned int foundkeys = 0;
-	char *target, *viewname;
+	char *ptr, *viewname;
+	char target[DNS_NAME_FORMATSIZE];
 	char fbuf[16];
 
-	(void)next_token(&command, " \t");  /* skip command name */
-	target = next_token(&command, " \t");
-	if (target == NULL)
+	(void)next_token(lex, text);  /* skip command name */
+
+	ptr = next_token(lex, text);
+	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
-	viewname = next_token(&command, " \t");
+	strlcpy(target, ptr, DNS_NAME_FORMATSIZE);
+
+	viewname = next_token(lex, text);
 
 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
@@ -9201,18 +9253,20 @@ ns_server_tsiglist(ns_server_t *server, isc_buffer_t **text) {
  * Act on a "sign" or "loadkeys" command from the command channel.
  */
 isc_result_t
-ns_server_rekey(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_rekey(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	isc_result_t result;
 	dns_zone_t *zone = NULL;
 	dns_zonetype_t type;
 	isc_uint16_t keyopts;
 	isc_boolean_t fullsign = ISC_FALSE;
+	char *ptr;
 
-	if (strncasecmp(args, NS_COMMAND_SIGN, strlen(NS_COMMAND_SIGN)) == 0)
-	    fullsign = ISC_TRUE;
+	ptr = next_token(lex, text);
+	if (strcasecmp(ptr, NS_COMMAND_SIGN) == 0)
+		fullsign = ISC_TRUE;
 
-	result = zone_from_args(server, args, NULL, &zone, NULL,
-				text, ISC_TRUE);
+	result = zone_from_args(server, lex, NULL, &zone, NULL,
+				text, ISC_FALSE);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	if (zone == NULL)
@@ -9267,7 +9321,7 @@ synczone(dns_zone_t *zone, void *uap) {
 }
 
 isc_result_t
-ns_server_sync(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_sync(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	isc_result_t result, tresult;
 	dns_view_t *view;
 	dns_zone_t *zone = NULL;
@@ -9276,16 +9330,16 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t **text) {
 	const char *vname, *sep, *arg;
 	isc_boolean_t cleanup = ISC_FALSE;
 
-	(void) next_token(&args, " \t");
+	(void) next_token(lex, text);
 
-	arg = next_token(&args, " \t");
+	arg = next_token(lex, text);
 	if (arg != NULL &&
 	    (strcmp(arg, "-clean") == 0 || strcmp(arg, "-clear") == 0)) {
 		cleanup = ISC_TRUE;
-		arg = next_token(&args, " \t");
+		arg = next_token(lex, text);
 	}
 
-	result = zone_from_args(server, args, arg, &zone, NULL,
+	result = zone_from_args(server, lex, arg, &zone, NULL,
 				text, ISC_FALSE);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -9345,8 +9399,8 @@ ns_server_sync(ns_server_t *server, char *args, isc_buffer_t **text) {
  * Act on a "freeze" or "thaw" command from the command channel.
  */
 isc_result_t
-ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
-		 isc_buffer_t **text)
+ns_server_freeze(ns_server_t *server, isc_boolean_t freeze,
+		 isc_lex_t *lex, isc_buffer_t **text)
 {
 	isc_result_t result, tresult;
 	dns_zone_t *zone = NULL, *raw = NULL;
@@ -9358,7 +9412,7 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
 	isc_boolean_t frozen;
 	const char *msg = NULL;
 
-	result = zone_from_args(server, args, NULL, &zone, NULL,
+	result = zone_from_args(server, lex, NULL, &zone, NULL,
 				text, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -9646,7 +9700,7 @@ nzf_append(FILE *fp, const char *viewname, const cfg_obj_t *zconfig) {
 }
 
 static isc_result_t
-newzone_parse(ns_server_t *server, char *args, dns_view_t **viewp,
+newzone_parse(ns_server_t *server, char *command, dns_view_t **viewp,
 	      cfg_obj_t **zoneconfp, const cfg_obj_t **zoneobjp,
 	      isc_buffer_t **text)
 {
@@ -9664,12 +9718,12 @@ newzone_parse(ns_server_t *server, char *args, dns_view_t **viewp,
 	REQUIRE(viewp != NULL && *viewp == NULL);
 
 	/* Try to parse the argument string */
-	isc_buffer_init(&argbuf, args, (unsigned int) strlen(args));
-	isc_buffer_add(&argbuf, strlen(args));
+	isc_buffer_init(&argbuf, command, (unsigned int) strlen(command));
+	isc_buffer_add(&argbuf, strlen(command));
 
-	if (strncasecmp(args, "add", 3) == 0)
+	if (strncasecmp(command, "add", 3) == 0)
 		bn = "addzone";
-	else if (strncasecmp(args, "mod", 3) == 0)
+	else if (strncasecmp(command, "mod", 3) == 0)
 		bn = "modzone";
 	else
 		INSIST(0);
@@ -10001,7 +10055,7 @@ do_modzone(ns_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
  * Act on an "addzone" or "modzone" command from the command channel.
  */
 isc_result_t
-ns_server_changezone(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_changezone(ns_server_t *server, char *command, isc_buffer_t **text) {
 	isc_result_t result;
 	isc_boolean_t addzone;
 	ns_cfgctx_t *cfg = NULL;
@@ -10013,14 +10067,14 @@ ns_server_changezone(ns_server_t *server, char *args, isc_buffer_t **text) {
 	dns_fixedname_t fname;
 	dns_name_t *dnsname;
 
-	if (strncasecmp(args, "add", 3) == 0)
+	if (strncasecmp(command, "add", 3) == 0)
 		addzone = ISC_TRUE;
 	else {
-		INSIST(strncasecmp(args, "mod", 3) == 0);
+		INSIST(strncasecmp(command, "mod", 3) == 0);
 		addzone = ISC_FALSE;
 	}
 
-	CHECK(newzone_parse(server, args, &view, &zoneconf, &zoneobj, text));
+	CHECK(newzone_parse(server, command, &view, &zoneconf, &zoneobj, text));
 
 	/* Are we accepting new zones in this view? */
 	if (view->new_zone_file == NULL) {
@@ -10093,7 +10147,7 @@ inuse(const char* file, isc_boolean_t first, isc_buffer_t **text) {
  * Act on a "delzone" command from the command channel.
  */
 isc_result_t
-ns_server_delzone(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_delzone(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	isc_result_t result, tresult;
 	ns_cfgctx_t *cfg = NULL;
 	dns_zone_t *zone = NULL;
@@ -10101,28 +10155,28 @@ ns_server_delzone(ns_server_t *server, char *args, isc_buffer_t **text) {
 	dns_zone_t *mayberaw;
 	dns_view_t *view = NULL;
 	dns_db_t *dbp = NULL;
-	const char *zonename = NULL;
+	char zonename[DNS_NAME_FORMATSIZE];
 	isc_boolean_t exclusive = ISC_FALSE;
 	isc_boolean_t cleanup = ISC_FALSE;
-	const char *file, *arg;
+	const char *file, *ptr;
 	isc_boolean_t added;
 
 	/* Skip the command name. */
-	arg = next_token(&args, " \t");
-	if (arg == NULL)
+	ptr = next_token(lex, text);
+	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
 	/* Find out what we are to do. */
-	arg = next_token(&args, " \t");
-	if (arg == NULL)
+	ptr = next_token(lex, text);
+	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
-	if (strcmp(arg, "-clean") == 0 || strcmp(arg, "-clear") == 0) {
+	if (strcmp(ptr, "-clean") == 0 || strcmp(ptr, "-clear") == 0) {
 		cleanup = ISC_TRUE;
-		arg = next_token(&args, " \t");
+		ptr = next_token(lex, text);
 	}
 
-	CHECK(zone_from_args(server, args, arg, &zone, &zonename,
+	CHECK(zone_from_args(server, lex, ptr, &zone, zonename,
 			     text, ISC_FALSE));
 	if (zone == NULL) {
 		result = ISC_R_UNEXPECTEDEND;
@@ -10277,10 +10331,10 @@ emitzone(void *arg, const char *buf, int len) {
 }
 
 isc_result_t
-ns_server_showzone(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_showzone(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	isc_result_t result;
 	const cfg_obj_t	*vconfig = NULL, *zconfig = NULL;
-	const char *zonename = NULL;
+	char zonename[DNS_NAME_FORMATSIZE];
 	const cfg_obj_t *map;
 	dns_view_t *view = NULL;
 	dns_zone_t *zone = NULL;
@@ -10288,7 +10342,7 @@ ns_server_showzone(ns_server_t *server, char *args, isc_buffer_t **text) {
 	isc_boolean_t exclusive = ISC_FALSE;
 
 	/* Parse parameters */
-	CHECK(zone_from_args(server, args, NULL, &zone, &zonename,
+	CHECK(zone_from_args(server, lex, NULL, &zone, zonename,
 			     text, ISC_TRUE));
 	if (zone == NULL) {
 		result = ISC_R_UNEXPECTEDEND;
@@ -10404,7 +10458,7 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 }
 
 isc_result_t
-ns_server_signing(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_signing(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_zone_t *zone = NULL;
 	dns_name_t *origin;
@@ -10427,43 +10481,51 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t **text) {
 	dns_rdataset_init(&privset);
 
 	/* Skip the command name. */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, text);
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
 	/* Find out what we are to do. */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, text);
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
 	if (strcasecmp(ptr, "-list") == 0)
 		list = ISC_TRUE;
 	else if ((strcasecmp(ptr, "-clear") == 0)  ||
-		 (strcasecmp(ptr, "-clean") == 0)) {
+		 (strcasecmp(ptr, "-clean") == 0))
+	{
 		clear = ISC_TRUE;
-		ptr = next_token(&args, " \t");
+		ptr = next_token(lex, text);
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		strlcpy(keystr, ptr, sizeof(keystr));
 	} else if (strcasecmp(ptr, "-nsec3param") == 0) {
-		const char *hashstr, *flagstr, *iterstr;
-		char nbuf[512];
+		char hashbuf[64], flagbuf[64], iterbuf[64];
+		char nbuf[256];
 
 		chain = ISC_TRUE;
-		hashstr = next_token(&args, " \t");
-		if (hashstr == NULL)
+		ptr = next_token(lex, text);
+		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 
-		if (strcasecmp(hashstr, "none") == 0)
+		if (strcasecmp(ptr, "none") == 0)
 			hash = 0;
 		else {
-			flagstr = next_token(&args, " \t");
-			iterstr = next_token(&args, " \t");
-			if (flagstr == NULL || iterstr == NULL)
+			strlcpy(hashbuf, ptr, sizeof(hashbuf));
+
+			ptr = next_token(lex, text);
+			if (ptr == NULL)
 				return (ISC_R_UNEXPECTEDEND);
+			strlcpy(flagbuf, ptr, sizeof(flagbuf));
+
+			ptr = next_token(lex, text);
+			if (ptr == NULL)
+				return (ISC_R_UNEXPECTEDEND);
+			strlcpy(iterbuf, ptr, sizeof(iterbuf));
 
 			n = snprintf(nbuf, sizeof(nbuf), "%s %s %s",
-				     hashstr, flagstr, iterstr);
+				     hashbuf, flagbuf, iterbuf);
 			if (n == sizeof(nbuf))
 				return (ISC_R_NOSPACE);
 			n = sscanf(nbuf, "%hu %hu %hu", &hash, &flags, &iter);
@@ -10473,7 +10535,7 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t **text) {
 			if (hash > 0xffU || flags > 0xffU)
 				return (ISC_R_RANGE);
 
-			ptr = next_token(&args, " \t");
+			ptr = next_token(lex, text);
 			if (ptr == NULL) {
 				return (ISC_R_UNEXPECTEDEND);
 			} else if (strcasecmp(ptr, "auto") == 0) {
@@ -10494,7 +10556,7 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t **text) {
 			}
 		}
 	} else if (strcasecmp(ptr, "-serial") == 0) {
-		ptr = next_token(&args, " \t");
+		ptr = next_token(lex, text);
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 		CHECK(isc_parse_uint32(&serial, ptr, 10));
@@ -10502,7 +10564,7 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t **text) {
 	} else
 		CHECK(DNS_R_SYNTAX);
 
-	CHECK(zone_from_args(server, args, NULL, &zone, NULL,
+	CHECK(zone_from_args(server, lex, NULL, &zone, NULL,
 			     text, ISC_FALSE));
 	if (zone == NULL)
 		CHECK(ISC_R_UNEXPECTEDEND);
@@ -10613,10 +10675,13 @@ putnull(isc_buffer_t **b) {
 }
 
 isc_result_t
-ns_server_zonestatus(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_zonestatus(ns_server_t *server, isc_lex_t *lex,
+		     isc_buffer_t **text)
+{
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_zone_t *zone = NULL, *raw = NULL;
-	const char *type, *file, *zonename = NULL;
+	const char *type, *file;
+	char zonename[DNS_NAME_FORMATSIZE];
 	isc_uint32_t serial, signed_serial, nodes;
 	char serbuf[16], sserbuf[16], nodebuf[16], resignbuf[512];
 	char lbuf[ISC_FORMATHTTPTIMESTAMP_SIZE];
@@ -10640,7 +10705,7 @@ ns_server_zonestatus(ns_server_t *server, char *args, isc_buffer_t **text) {
 	isc_time_settoepoch(&refreshkeytime);
 	isc_time_settoepoch(&resigntime);
 
-	CHECK(zone_from_args(server, args, NULL, &zone, &zonename,
+	CHECK(zone_from_args(server, lex, NULL, &zone, zonename,
 			     text, ISC_TRUE));
 	if (zone == NULL) {
 		result = ISC_R_UNEXPECTEDEND;
@@ -10892,11 +10957,12 @@ argcheck(char *cmd, const char *full) {
 }
 
 isc_result_t
-ns_server_nta(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_nta(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	dns_view_t *view;
 	dns_ntatable_t *ntatable = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	char *ptr, *nametext = NULL, *viewname;
+	char namebuf[DNS_NAME_FORMATSIZE];
 	isc_stdtime_t now, when;
 	isc_time_t t;
 	char tbuf[64];
@@ -10913,13 +10979,13 @@ ns_server_nta(ns_server_t *server, char *args, isc_buffer_t **text) {
 	ntaname = dns_fixedname_name(&fn);
 
 	/* Skip the command name. */
-	ptr = next_token(&args, " \t");
+	ptr = next_token(lex, text);
 	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
 	for (;;) {
 		/* Check for options */
-		ptr = next_token(&args, " \t");
+		ptr = next_token(lex, text);
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
 
@@ -10934,7 +11000,7 @@ ns_server_nta(ns_server_t *server, char *args, isc_buffer_t **text) {
 		} else if (argcheck(ptr, "lifetime")) {
 			isc_textregion_t tr;
 
-			ptr = next_token(&args, " \t");
+			ptr = next_token(lex, text);
 			if (ptr == NULL) {
 				msg = "No lifetime specified";
 				CHECK(ISC_R_UNEXPECTEDEND);
@@ -10983,21 +11049,24 @@ ns_server_nta(ns_server_t *server, char *args, isc_buffer_t **text) {
 
 	/* Get the NTA name. */
 	if (nametext == NULL)
-		nametext = next_token(&args, " \t");
+		nametext = next_token(lex, text);
 	if (nametext == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
-	if (strcmp(nametext, ".") == 0)
+	/* Copy nametext as it'll be overwritten by next_token() */
+	strlcpy(namebuf, nametext, DNS_NAME_FORMATSIZE);
+
+	if (strcmp(namebuf, ".") == 0)
 		ntaname = dns_rootname;
 	else {
 		isc_buffer_t b;
-		isc_buffer_init(&b, nametext, strlen(nametext));
-		isc_buffer_add(&b, strlen(nametext));
+		isc_buffer_init(&b, namebuf, strlen(namebuf));
+		isc_buffer_add(&b, strlen(namebuf));
 		CHECK(dns_name_fromtext(ntaname, &b, dns_rootname, 0, NULL));
 	}
 
 	/* Look for the view name. */
-	viewname = next_token(&args, " \t");
+	viewname = next_token(lex, text);
 
 	isc_stdtime_get(&now);
 
@@ -11031,7 +11100,7 @@ ns_server_nta(ns_server_t *server, char *args, isc_buffer_t **text) {
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "flush tree '%s' in cache view '%s': %s",
-			      nametext, view->name,
+			      namebuf, view->name,
 			      isc_result_totext(result));
 
 		if (ntattl != 0) {
@@ -11043,7 +11112,7 @@ ns_server_nta(ns_server_t *server, char *args, isc_buffer_t **text) {
 			isc_time_formattimestamp(&t, tbuf, sizeof(tbuf));
 
 			CHECK(putstr(text, "Negative trust anchor added: "));
-			CHECK(putstr(text, nametext));
+			CHECK(putstr(text, namebuf));
 			CHECK(putstr(text, "/"));
 			CHECK(putstr(text, view->name));
 			CHECK(putstr(text, ", expires "));
@@ -11052,19 +11121,19 @@ ns_server_nta(ns_server_t *server, char *args, isc_buffer_t **text) {
 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
 				      "added NTA '%s' (%d sec) in view '%s'",
-				      nametext, ntattl, view->name);
+				      namebuf, ntattl, view->name);
 		} else {
 			CHECK(dns_ntatable_delete(ntatable, ntaname));
 
 			CHECK(putstr(text, "Negative trust anchor removed: "));
-			CHECK(putstr(text, nametext));
+			CHECK(putstr(text, namebuf));
 			CHECK(putstr(text, "/"));
 			CHECK(putstr(text, view->name));
 
 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
 				      "removed NTA '%s' in view %s",
-				      nametext, view->name);
+				      namebuf, view->name);
 		}
 
 		result = dns_view_saventa(view);
@@ -11298,7 +11367,7 @@ mkey_status(dns_view_t *view, isc_buffer_t **text) {
 }
 
 isc_result_t
-ns_server_mkeys(ns_server_t *server, char *args, isc_buffer_t **text) {
+ns_server_mkeys(ns_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	char *cmd, *classtxt, *viewtxt = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_view_t *view = NULL;
@@ -11309,12 +11378,12 @@ ns_server_mkeys(ns_server_t *server, char *args, isc_buffer_t **text) {
 	isc_boolean_t first = ISC_TRUE;
 
 	/* Skip rndc command name */
-	cmd = next_token(&args, " \t");
+	cmd = next_token(lex, text);
 	if (cmd == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
 	/* Get managed-keys subcommand */
-	cmd = next_token(&args, " \t");
+	cmd = next_token(lex, text);
 	if (cmd == NULL)
 		return (ISC_R_UNEXPECTEDEND);
 
@@ -11332,10 +11401,10 @@ ns_server_mkeys(ns_server_t *server, char *args, isc_buffer_t **text) {
 	}
 
 	/* Look for the optional class name. */
-	classtxt = next_token(&args, " \t");
+	classtxt = next_token(lex, text);
 	if (classtxt != NULL) {
 		/* Look for the optional view name. */
-		viewtxt = next_token(&args, " \t");
+		viewtxt = next_token(lex, text);
 	}
 
 	if (classtxt == NULL) {
diff --git a/bin/tests/system/rndc/ns4/named.conf.in b/bin/tests/system/rndc/ns4/named.conf.in
index 1eb442e230..51d0491865 100644
--- a/bin/tests/system/rndc/ns4/named.conf.in
+++ b/bin/tests/system/rndc/ns4/named.conf.in
@@ -14,8 +14,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id$ */
-
 controls { /* empty */ };
 
 options {
@@ -26,3 +24,10 @@ options {
 	recursion yes;
 };
 
+view normal {
+	match-clients { any; };
+};
+
+view "view with a space" {
+	match-clients { none; };
+};
diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
index cc3ad4eac8..4492ceb85e 100644
--- a/bin/tests/system/rndc/tests.sh
+++ b/bin/tests/system/rndc/tests.sh
@@ -344,7 +344,7 @@ status=`expr $status + $ret`
 echo "I:testing automatic zones are reported"
 ret=0
 $RNDC -s 10.53.0.4 -p 9956 -c ns4/key6.conf status > rndc.status || ret=1
-grep "number of zones: 99 (98 automatic)" rndc.status > /dev/null || ret=1
+grep "number of zones: 198 (196 automatic)" rndc.status > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
@@ -411,6 +411,13 @@ grep "ISC_R_SUCCESS 0" rndc.output > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:testing rndc with a token containing a space"
+ret=0
+$RNDC -s 10.53.0.4 -p 9956 -c ns4/key6.conf -r flush '"view with a space"' 2>&1 > rndc.output || ret=1
+grep "not found" rndc.output > /dev/null && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:test 'rndc reconfig' with a broken config"
 ret=0
 $RNDC -s 10.53.0.4 -p 9956 -c ns4/key6.conf reconfig > /dev/null || ret=1

From 17834caa6cf2d05656d3162ab525023d2de06fe2 Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Fri, 6 Nov 2015 13:44:28 -0800
Subject: [PATCH 34/39] [master] clarify message-compression doc

- mention TCP and RFC compliance issues
---
 doc/arm/Bv9ARM-book.xml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index b7e268bd09..01a7041a10 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -6154,12 +6154,15 @@ options {
 	    <varlistentry>
 	      <term><command>message-compression</command></term> <listitem>
 		<para>
-		  If <userinput>yes</userinput>, DNS name compression will
-		  be used for responses to regular queries (not including
+		  If <userinput>yes</userinput>, DNS name compression is
+		  used in responses to regular queries (not including
 		  AXFR or IXFR, which always uses compression).  Setting
-		  this option to <userinput>no</userinput> can result in
-		  larger responses, but will reduce CPU usage on servers.
-		  The default is <userinput>yes</userinput>.
+		  this option to <userinput>no</userinput> reduces CPU
+		  usage on servers and may improve throughput.  However,
+		  it increases response size, which may cause more queries
+		  to be processed using TCP; a server with compression
+		  disabled is out of compiance with RFC 1123 Section
+		  6.1.3.2. The default is <userinput>yes</userinput>.
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -6699,7 +6702,7 @@ options {
 	    <varlistentry>
 	      <term><command>auto-dnssec</command></term>
 	      <listitem>
-	        <para>
+		<para>
 		  Zones configured for dynamic DNS may use this
 		  option to allow varying levels of automatic DNSSEC key
 		  management. There are three possible settings:

From 5ec43255341c8ae12eac2ff340d6c378d9aca7cc Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Fri, 6 Nov 2015 23:30:04 +0000
Subject: [PATCH 35/39] newcopyrights

---
 util/copyrights | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util/copyrights b/util/copyrights
index 12af4428ea..78571b71f2 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -1810,7 +1810,7 @@
 ./bin/tests/system/rndc/ns2/named.conf		CONF-C	2011,2012,2013
 ./bin/tests/system/rndc/ns2/secondkey.conf	CONF-C	2012,2013
 ./bin/tests/system/rndc/ns3/named.conf		CONF-C	2012,2013
-./bin/tests/system/rndc/ns4/named.conf.in	CONF-C	2013,2014
+./bin/tests/system/rndc/ns4/named.conf.in	CONF-C	2013,2014,2015
 ./bin/tests/system/rndc/setup.sh		SH	2011,2012,2013,2014
 ./bin/tests/system/rndc/tests.sh		SH	2011,2012,2013,2014,2015
 ./bin/tests/system/rpz/.gitignore		X	2012

From dae43e88b785d15f4b8048c793f5e62904c66cdc Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Fri, 6 Nov 2015 23:45:24 +0000
Subject: [PATCH 36/39] update copyright notice / whitespace

---
 bin/tests/system/rndc/ns4/named.conf.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/tests/system/rndc/ns4/named.conf.in b/bin/tests/system/rndc/ns4/named.conf.in
index 51d0491865..ebe54d6ea8 100644
--- a/bin/tests/system/rndc/ns4/named.conf.in
+++ b/bin/tests/system/rndc/ns4/named.conf.in
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2013-2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above

From 58021df88940e55ec62b2788dc727988208bd065 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Sat, 7 Nov 2015 01:04:14 +0000
Subject: [PATCH 37/39] regen master

---
 doc/arm/Bv9ARM.ch06.html | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 27d9c86b61..14835edb60 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -3777,12 +3777,15 @@ options {
                 </p></dd>
 <dt><span class="term"><span class="command"><strong>message-compression</strong></span></span></dt>
 <dd><p>
-                  If <strong class="userinput"><code>yes</code></strong>, DNS name compression will
-                  be used for responses to regular queries (not including
+                  If <strong class="userinput"><code>yes</code></strong>, DNS name compression is
+                  used in responses to regular queries (not including
                   AXFR or IXFR, which always uses compression).  Setting
-                  this option to <strong class="userinput"><code>no</code></strong> can result in
-                  larger responses, but will reduce CPU usage on servers.
-                  The default is <strong class="userinput"><code>yes</code></strong>.
+                  this option to <strong class="userinput"><code>no</code></strong> reduces CPU
+                  usage on servers and may improve throughput.  However,
+                  it increases response size, which may cause more queries
+                  to be processed using TCP; a server with compression
+                  disabled is out of compiance with RFC 1123 Section
+                  6.1.3.2. The default is <strong class="userinput"><code>yes</code></strong>.
                 </p></dd>
 <dt><span class="term"><span class="command"><strong>minimal-responses</strong></span></span></dt>
 <dd><p>

From e13d04fda918c0c14c2247475bb99e0760d9a6a4 Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Sun, 8 Nov 2015 21:34:24 -0800
Subject: [PATCH 38/39] [master] fix python script versions

4257.	[cleanup]	Python scripts reported incorrect version. [RT #41080]
---
 CHANGES                                     |  2 ++
 Makefile.in                                 |  2 +-
 bin/check/Makefile.in                       |  2 +-
 bin/confgen/Makefile.in                     |  2 +-
 bin/delv/Makefile.in                        |  2 +-
 bin/dig/Makefile.in                         |  2 +-
 bin/dnssec/Makefile.in                      |  2 +-
 bin/named/Makefile.in                       |  2 +-
 bin/nsupdate/Makefile.in                    |  2 +-
 bin/python/dnssec-checkds.py.in             |  3 ++-
 bin/python/dnssec-coverage.py.in            |  3 ++-
 bin/rndc/Makefile.in                        |  2 +-
 bin/tests/system/builtin/Makefile.in        |  2 +-
 bin/tests/system/dlzexternal/Makefile.in    |  2 +-
 bin/tests/system/dyndb/Makefile.in          |  2 +-
 bin/tests/system/filter-aaaa/Makefile.in    |  2 +-
 bin/tests/system/geoip/Makefile.in          |  2 +-
 bin/tests/system/lwresd/Makefile.in         |  2 +-
 bin/tests/system/pipelined/Makefile.in      |  2 +-
 bin/tests/system/resolver/Makefile.in       |  2 +-
 bin/tests/system/rndc/Makefile.in           |  2 +-
 bin/tests/system/rpz/Makefile.in            |  2 +-
 bin/tests/system/rsabigexponent/Makefile.in |  2 +-
 bin/tests/system/statistics/Makefile.in     |  2 +-
 bin/tests/system/tkey/Makefile.in           |  2 +-
 bin/tests/system/tsiggss/Makefile.in        |  2 +-
 bin/tools/Makefile.in                       |  2 +-
 configure                                   |  7 +++++--
 configure.in                                |  5 ++++-
 contrib/dlz/bin/dlzbdb/Makefile.in          |  2 +-
 doc/arm/Makefile.in                         | 15 ---------------
 doc/arm/noteversion.xml.in                  |  1 +
 doc/arm/pkgversion.xml.in                   |  1 +
 doc/arm/releaseinfo.xml.in                  |  1 +
 doc/doxygen/Makefile.in                     |  2 +-
 isc-config.sh.in                            |  2 +-
 lib/bind9/Makefile.in                       |  2 +-
 lib/bind9/include/bind9/Makefile.in         |  2 +-
 lib/dns/Makefile.in                         |  2 +-
 lib/dns/include/dns/Makefile.in             |  2 +-
 lib/dns/include/dst/Makefile.in             |  2 +-
 lib/dns/tests/Makefile.in                   |  2 +-
 lib/irs/Makefile.in                         |  2 +-
 lib/isc/Makefile.in                         |  2 +-
 lib/isc/alpha/include/isc/Makefile.in       |  2 +-
 lib/isc/ia64/include/isc/Makefile.in        |  2 +-
 lib/isc/include/isc/Makefile.in             |  2 +-
 lib/isc/include/pk11/Makefile.in            |  2 +-
 lib/isc/include/pkcs11/Makefile.in          |  2 +-
 lib/isc/mips/include/isc/Makefile.in        |  2 +-
 lib/isc/noatomic/include/isc/Makefile.in    |  2 +-
 lib/isc/nothreads/include/isc/Makefile.in   |  2 +-
 lib/isc/powerpc/include/isc/Makefile.in     |  2 +-
 lib/isc/pthreads/include/isc/Makefile.in    |  2 +-
 lib/isc/sparc64/include/isc/Makefile.in     |  2 +-
 lib/isc/tests/Makefile.in                   |  2 +-
 lib/isc/unix/include/isc/Makefile.in        |  2 +-
 lib/isc/win32/include/isc/Makefile.in       |  2 +-
 lib/isc/x86_32/include/isc/Makefile.in      |  2 +-
 lib/isc/x86_64/include/isc/Makefile.in      |  2 +-
 lib/isccc/Makefile.in                       |  2 +-
 lib/isccc/include/isccc/Makefile.in         |  2 +-
 lib/isccfg/Makefile.in                      |  2 +-
 lib/isccfg/include/isccfg/Makefile.in       |  2 +-
 lib/lwres/Makefile.in                       |  2 +-
 lib/lwres/man/Makefile.in                   |  2 +-
 lib/lwres/tests/Makefile.in                 |  2 +-
 lib/samples/Makefile.in                     |  2 +-
 lib/tests/include/tests/Makefile.in         |  2 +-
 69 files changed, 78 insertions(+), 80 deletions(-)
 create mode 100644 doc/arm/noteversion.xml.in
 create mode 100644 doc/arm/pkgversion.xml.in
 create mode 100644 doc/arm/releaseinfo.xml.in

diff --git a/CHANGES b/CHANGES
index c8c4fb4513..7c02d40f4c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4257.	[cleanup]	Python scripts reported incorrect version. [RT #41080]
+
 4256.	[bug]		Allow rndc command arguments to be quoted so as
 			to allow spaces. [RT #36665]
 
diff --git a/Makefile.in b/Makefile.in
index e6d2699df0..b5a0b2ad62 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 SUBDIRS =	make unit lib bin doc
 TARGETS =
diff --git a/bin/check/Makefile.in b/bin/check/Makefile.in
index b88be3cb85..5db667186d 100644
--- a/bin/check/Makefile.in
+++ b/bin/check/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/confgen/Makefile.in b/bin/confgen/Makefile.in
index 409dffd1c6..176ce54af7 100644
--- a/bin/confgen/Makefile.in
+++ b/bin/confgen/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/delv/Makefile.in b/bin/delv/Makefile.in
index 7569bd7fe4..5a59cf5392 100644
--- a/bin/delv/Makefile.in
+++ b/bin/delv/Makefile.in
@@ -16,7 +16,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/dig/Makefile.in b/bin/dig/Makefile.in
index 730f1b57ef..b5f2344931 100644
--- a/bin/dig/Makefile.in
+++ b/bin/dig/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/dnssec/Makefile.in b/bin/dnssec/Makefile.in
index 4f1bf9095d..4409100fbe 100644
--- a/bin/dnssec/Makefile.in
+++ b/bin/dnssec/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/named/Makefile.in b/bin/named/Makefile.in
index 899756a1de..05810bcac8 100644
--- a/bin/named/Makefile.in
+++ b/bin/named/Makefile.in
@@ -17,7 +17,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_PRODUCT@
 
diff --git a/bin/nsupdate/Makefile.in b/bin/nsupdate/Makefile.in
index 5dc20ad907..4ac3331ca0 100644
--- a/bin/nsupdate/Makefile.in
+++ b/bin/nsupdate/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/python/dnssec-checkds.py.in b/bin/python/dnssec-checkds.py.in
index 3a66ee24b4..d821c097ce 100644
--- a/bin/python/dnssec-checkds.py.in
+++ b/bin/python/dnssec-checkds.py.in
@@ -303,7 +303,8 @@ def parse_args():
                         default=os.path.join(prefix(sbindir),
                                              'dnssec-dsfromkey'),
                         type=str, help='path to \'dig\'')
-    parser.add_argument('-v', '--version', action='version', version='9.9.1')
+    parser.add_argument('-v', '--version', action='version',
+                        version='@BIND9_VERSION@')
     args = parser.parse_args()
 
     args.zone = args.zone.strip('.')
diff --git a/bin/python/dnssec-coverage.py.in b/bin/python/dnssec-coverage.py.in
index 39ec549ec9..ccd01a9cc1 100755
--- a/bin/python/dnssec-coverage.py.in
+++ b/bin/python/dnssec-coverage.py.in
@@ -694,7 +694,8 @@ def parse_args():
     parser.add_argument('-D', '--debug', dest='debug_mode',
                         action='store_true', default=False,
                         help='Turn on debugging output')
-    parser.add_argument('-v', '--version', action='version', version='9.9.1')
+    parser.add_argument('-v', '--version', action='version',
+                        version='@BIND9_VERSION@')
 
     args = parser.parse_args()
 
diff --git a/bin/rndc/Makefile.in b/bin/rndc/Makefile.in
index 8d7f38dcd6..8c57d892e6 100644
--- a/bin/rndc/Makefile.in
+++ b/bin/rndc/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/builtin/Makefile.in b/bin/tests/system/builtin/Makefile.in
index 135c1f9cb4..2fb4dcd398 100644
--- a/bin/tests/system/builtin/Makefile.in
+++ b/bin/tests/system/builtin/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/dlzexternal/Makefile.in b/bin/tests/system/dlzexternal/Makefile.in
index e2225704ce..5c15df1a24 100644
--- a/bin/tests/system/dlzexternal/Makefile.in
+++ b/bin/tests/system/dlzexternal/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/dyndb/Makefile.in b/bin/tests/system/dyndb/Makefile.in
index c7792f2133..f27231309e 100644
--- a/bin/tests/system/dyndb/Makefile.in
+++ b/bin/tests/system/dyndb/Makefile.in
@@ -16,7 +16,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/filter-aaaa/Makefile.in b/bin/tests/system/filter-aaaa/Makefile.in
index 3a03de5aaa..8aa47fde15 100644
--- a/bin/tests/system/filter-aaaa/Makefile.in
+++ b/bin/tests/system/filter-aaaa/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/geoip/Makefile.in b/bin/tests/system/geoip/Makefile.in
index 1cf9d4ab80..1b481af091 100644
--- a/bin/tests/system/geoip/Makefile.in
+++ b/bin/tests/system/geoip/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/lwresd/Makefile.in b/bin/tests/system/lwresd/Makefile.in
index 9623ff91a5..65ba897d92 100644
--- a/bin/tests/system/lwresd/Makefile.in
+++ b/bin/tests/system/lwresd/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/pipelined/Makefile.in b/bin/tests/system/pipelined/Makefile.in
index 9d87982dcf..6876ea1f5d 100644
--- a/bin/tests/system/pipelined/Makefile.in
+++ b/bin/tests/system/pipelined/Makefile.in
@@ -16,7 +16,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/resolver/Makefile.in b/bin/tests/system/resolver/Makefile.in
index 995ec2cfe9..4d8a4583b3 100644
--- a/bin/tests/system/resolver/Makefile.in
+++ b/bin/tests/system/resolver/Makefile.in
@@ -16,7 +16,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/rndc/Makefile.in b/bin/tests/system/rndc/Makefile.in
index 01df4e6c9a..2e7e6795fa 100644
--- a/bin/tests/system/rndc/Makefile.in
+++ b/bin/tests/system/rndc/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/rpz/Makefile.in b/bin/tests/system/rpz/Makefile.in
index 4042217def..dec82e8216 100644
--- a/bin/tests/system/rpz/Makefile.in
+++ b/bin/tests/system/rpz/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/rsabigexponent/Makefile.in b/bin/tests/system/rsabigexponent/Makefile.in
index 0f7f711ebc..5f1fccbc0a 100644
--- a/bin/tests/system/rsabigexponent/Makefile.in
+++ b/bin/tests/system/rsabigexponent/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/statistics/Makefile.in b/bin/tests/system/statistics/Makefile.in
index c1823ad904..4c7d49dea5 100644
--- a/bin/tests/system/statistics/Makefile.in
+++ b/bin/tests/system/statistics/Makefile.in
@@ -16,7 +16,7 @@ srcdir=	@srcdir@
 VPATH=		@srcdir@
 top_srcdir=	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/tkey/Makefile.in b/bin/tests/system/tkey/Makefile.in
index b2f40d7999..419052ba73 100644
--- a/bin/tests/system/tkey/Makefile.in
+++ b/bin/tests/system/tkey/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tests/system/tsiggss/Makefile.in b/bin/tests/system/tsiggss/Makefile.in
index b5124ab101..2aab42a8b3 100644
--- a/bin/tests/system/tsiggss/Makefile.in
+++ b/bin/tests/system/tsiggss/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/bin/tools/Makefile.in b/bin/tools/Makefile.in
index dfc2951b02..831c96aac9 100644
--- a/bin/tools/Makefile.in
+++ b/bin/tools/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/configure b/configure
index 864645b6bd..a683b8d1a0 100755
--- a/configure
+++ b/configure
@@ -21242,7 +21242,7 @@ BIND9_PRODUCT="PRODUCT=\"${PRODUCT}\""
 
 BIND9_DESCRIPTION="DESCRIPTION=\"${DESCRIPTION}\""
 
-BIND9_VERSION="VERSION=${MAJORVER}.${MINORVER}${PATCHVER:+.}${PATCHVER}${RELEASETYPE}${RELEASEVER}${EXTENSIONS}"
+BIND9_VERSION="${MAJORVER}.${MINORVER}${PATCHVER:+.}${PATCHVER}${RELEASETYPE}${RELEASEVER}${EXTENSIONS}"
 
 BIND9_MAJOR="MAJOR=${MAJORVER}.${MINORVER}"
 
@@ -22470,7 +22470,7 @@ ac_config_commands="$ac_config_commands chmod"
 # elsewhere if there's a good reason for doing so.
 #
 
-ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/rndc/Makefile bin/tests/Makefile bin/tests/atomic/Makefile bin/tests/db/Makefile bin/tests/dst/Makefile bin/tests/dst/Kdh.+002+18602.key bin/tests/dst/Kdh.+002+18602.private bin/tests/dst/Kdh.+002+48957.key bin/tests/dst/Kdh.+002+48957.private bin/tests/dst/Ktest.+001+00002.key bin/tests/dst/Ktest.+001+54622.key bin/tests/dst/Ktest.+001+54622.private bin/tests/dst/Ktest.+003+23616.key bin/tests/dst/Ktest.+003+23616.private bin/tests/dst/Ktest.+003+49667.key bin/tests/dst/dst_2_data bin/tests/dst/t2_data_1 bin/tests/dst/t2_data_2 bin/tests/dst/t2_dsasig bin/tests/dst/t2_rsasig bin/tests/hashes/Makefile bin/tests/headerdep_test.sh bin/tests/master/Makefile bin/tests/mem/Makefile bin/tests/names/Makefile bin/tests/net/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/rbt/Makefile bin/tests/resolver/Makefile bin/tests/sockaddr/Makefile bin/tests/system/Makefile bin/tests/system/builtin/Makefile bin/tests/system/conf.sh bin/tests/system/dlz/prereq.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/named.conf bin/tests/system/dyndb/Makefile bin/tests/system/dyndb/driver/Makefile bin/tests/system/filter-aaaa/Makefile bin/tests/system/geoip/Makefile bin/tests/system/inline/checkdsa.sh bin/tests/system/lwresd/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/resolver/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/statistics/Makefile bin/tests/system/tkey/Makefile bin/tests/system/tsiggss/Makefile bin/tests/tasks/Makefile bin/tests/timers/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/tex/Makefile doc/tex/armstyle.sty doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/tests/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/tests/Makefile lib/tests/include/Makefile lib/tests/include/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/Makefile unit/unittest.sh"
+ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/rndc/Makefile bin/tests/Makefile bin/tests/atomic/Makefile bin/tests/db/Makefile bin/tests/dst/Makefile bin/tests/dst/Kdh.+002+18602.key bin/tests/dst/Kdh.+002+18602.private bin/tests/dst/Kdh.+002+48957.key bin/tests/dst/Kdh.+002+48957.private bin/tests/dst/Ktest.+001+00002.key bin/tests/dst/Ktest.+001+54622.key bin/tests/dst/Ktest.+001+54622.private bin/tests/dst/Ktest.+003+23616.key bin/tests/dst/Ktest.+003+23616.private bin/tests/dst/Ktest.+003+49667.key bin/tests/dst/dst_2_data bin/tests/dst/t2_data_1 bin/tests/dst/t2_data_2 bin/tests/dst/t2_dsasig bin/tests/dst/t2_rsasig bin/tests/hashes/Makefile bin/tests/headerdep_test.sh bin/tests/master/Makefile bin/tests/mem/Makefile bin/tests/names/Makefile bin/tests/net/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/rbt/Makefile bin/tests/resolver/Makefile bin/tests/sockaddr/Makefile bin/tests/system/Makefile bin/tests/system/builtin/Makefile bin/tests/system/conf.sh bin/tests/system/dlz/prereq.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/named.conf bin/tests/system/dyndb/Makefile bin/tests/system/dyndb/driver/Makefile bin/tests/system/filter-aaaa/Makefile bin/tests/system/geoip/Makefile bin/tests/system/inline/checkdsa.sh bin/tests/system/lwresd/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/resolver/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/statistics/Makefile bin/tests/system/tkey/Makefile bin/tests/system/tsiggss/Makefile bin/tests/tasks/Makefile bin/tests/timers/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/arm/noteversion.xml doc/arm/pkgversion.xml doc/arm/releaseinfo.xml doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/tex/Makefile doc/tex/armstyle.sty doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/tests/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/tests/Makefile lib/tests/include/Makefile lib/tests/include/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/Makefile unit/unittest.sh"
 
 
 #
@@ -23541,6 +23541,9 @@ do
     "contrib/scripts/zone-edit.sh") CONFIG_FILES="$CONFIG_FILES contrib/scripts/zone-edit.sh" ;;
     "doc/Makefile") CONFIG_FILES="$CONFIG_FILES doc/Makefile" ;;
     "doc/arm/Makefile") CONFIG_FILES="$CONFIG_FILES doc/arm/Makefile" ;;
+    "doc/arm/noteversion.xml") CONFIG_FILES="$CONFIG_FILES doc/arm/noteversion.xml" ;;
+    "doc/arm/pkgversion.xml") CONFIG_FILES="$CONFIG_FILES doc/arm/pkgversion.xml" ;;
+    "doc/arm/releaseinfo.xml") CONFIG_FILES="$CONFIG_FILES doc/arm/releaseinfo.xml" ;;
     "doc/doxygen/Doxyfile") CONFIG_FILES="$CONFIG_FILES doc/doxygen/Doxyfile" ;;
     "doc/doxygen/Makefile") CONFIG_FILES="$CONFIG_FILES doc/doxygen/Makefile" ;;
     "doc/doxygen/doxygen-input-filter") CONFIG_FILES="$CONFIG_FILES doc/doxygen/doxygen-input-filter" ;;
diff --git a/configure.in b/configure.in
index cf06cd9ad0..eaf9411cee 100644
--- a/configure.in
+++ b/configure.in
@@ -4371,7 +4371,7 @@ BIND9_PRODUCT="PRODUCT=\"${PRODUCT}\""
 AC_SUBST(BIND9_PRODUCT)
 BIND9_DESCRIPTION="DESCRIPTION=\"${DESCRIPTION}\""
 AC_SUBST(BIND9_DESCRIPTION)
-BIND9_VERSION="VERSION=${MAJORVER}.${MINORVER}${PATCHVER:+.}${PATCHVER}${RELEASETYPE}${RELEASEVER}${EXTENSIONS}"
+BIND9_VERSION="${MAJORVER}.${MINORVER}${PATCHVER:+.}${PATCHVER}${RELEASETYPE}${RELEASEVER}${EXTENSIONS}"
 AC_SUBST(BIND9_VERSION)
 BIND9_MAJOR="MAJOR=${MAJORVER}.${MINORVER}"
 AC_SUBST(BIND9_MAJOR)
@@ -4808,6 +4808,9 @@ AC_CONFIG_FILES([
 	contrib/scripts/zone-edit.sh
 	doc/Makefile
 	doc/arm/Makefile
+        doc/arm/noteversion.xml
+        doc/arm/pkgversion.xml
+        doc/arm/releaseinfo.xml
 	doc/doxygen/Doxyfile
 	doc/doxygen/Makefile
 	doc/doxygen/doxygen-input-filter
diff --git a/contrib/dlz/bin/dlzbdb/Makefile.in b/contrib/dlz/bin/dlzbdb/Makefile.in
index 8a4f8c4c79..e9dd88aed7 100644
--- a/contrib/dlz/bin/dlzbdb/Makefile.in
+++ b/contrib/dlz/bin/dlzbdb/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/doc/arm/Makefile.in b/doc/arm/Makefile.in
index 4b2aa72822..07f1abfc31 100644
--- a/doc/arm/Makefile.in
+++ b/doc/arm/Makefile.in
@@ -19,10 +19,6 @@ top_srcdir =	@top_srcdir@
 
 @BIND9_MAKE_RULES@
 
-@BIND9_VERSION@
-
-PKGVERSION = @PACKAGE_VERSION@
-
 MANOBJS = Bv9ARM.html notes.html
 
 PDFOBJS = Bv9ARM.pdf notes.pdf
@@ -64,14 +60,3 @@ Bv9ARM.pdf: Bv9ARM-book.xml releaseinfo.xml pkgversion.xml noteversion.xml
 	expand Bv9ARM-book.xml | \
 	${XSLTPROC} ${top_srcdir}/doc/xsl/pre-latex.xsl - | \
 	${DBLATEX} -c Bv9ARM.conf -o Bv9ARM.pdf -
-
-FORCE:
-
-releaseinfo.xml: FORCE
-	echo >$@ '<releaseinfo>BIND Version ${VERSION}</releaseinfo>'
-
-noteversion.xml: FORCE
-	echo >$@ '<title>Release Notes for BIND Version ${VERSION}</title>'
-
-pkgversion.xml: FORCE
-	echo >$@ '      <para>This version of the manual corresponds to BIND version ${PKGVERSION}.</para>'
diff --git a/doc/arm/noteversion.xml.in b/doc/arm/noteversion.xml.in
new file mode 100644
index 0000000000..d6bc8de6a6
--- /dev/null
+++ b/doc/arm/noteversion.xml.in
@@ -0,0 +1 @@
+<title>Release Notes for BIND Version @BIND9_VERSION@</title>
diff --git a/doc/arm/pkgversion.xml.in b/doc/arm/pkgversion.xml.in
new file mode 100644
index 0000000000..c0e32dce86
--- /dev/null
+++ b/doc/arm/pkgversion.xml.in
@@ -0,0 +1 @@
+      <para>This version of the manual corresponds to BIND version @PACKAGE_VERSION@.</para>
diff --git a/doc/arm/releaseinfo.xml.in b/doc/arm/releaseinfo.xml.in
new file mode 100644
index 0000000000..facf35e77f
--- /dev/null
+++ b/doc/arm/releaseinfo.xml.in
@@ -0,0 +1 @@
+<releaseinfo>BIND Version @BIND9_VERSION@</releaseinfo>
diff --git a/doc/doxygen/Makefile.in b/doc/doxygen/Makefile.in
index ec623986ab..c336635061 100644
--- a/doc/doxygen/Makefile.in
+++ b/doc/doxygen/Makefile.in
@@ -23,7 +23,7 @@ TARGETS =
 
 @BIND9_MAKE_RULES@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 # Until and unless we decide to ship all umptyzillion Doxygen output
 # files, distclean for this directory implies docclean.
diff --git a/isc-config.sh.in b/isc-config.sh.in
index 04a9e5c6f4..056c4875a1 100644
--- a/isc-config.sh.in
+++ b/isc-config.sh.in
@@ -74,7 +74,7 @@ while test $# -gt 0; do
 		echo_exec_prefix=true
 		;;
 	--version)
-		echo @BIND9_VERSION@
+		echo VERSION=@BIND9_VERSION@
 		exit 0
 		;;
 	--cflags)
diff --git a/lib/bind9/Makefile.in b/lib/bind9/Makefile.in
index e9e65daa96..648fc7b1a8 100644
--- a/lib/bind9/Makefile.in
+++ b/lib/bind9/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @LIBBIND9_API@
 
diff --git a/lib/bind9/include/bind9/Makefile.in b/lib/bind9/include/bind9/Makefile.in
index 11ae586205..d531f97a61 100644
--- a/lib/bind9/include/bind9/Makefile.in
+++ b/lib/bind9/include/bind9/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 #
 # Only list headers that are to be installed and are not
diff --git a/lib/dns/Makefile.in b/lib/dns/Makefile.in
index 3d3658f303..ee40594ed8 100644
--- a/lib/dns/Makefile.in
+++ b/lib/dns/Makefile.in
@@ -21,7 +21,7 @@ top_srcdir =	@top_srcdir@
 .NOTPARALLEL:
 .NO_PARALLEL:
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 @BIND9_MAJOR@
 
 @LIBDNS_MAPAPI@
diff --git a/lib/dns/include/dns/Makefile.in b/lib/dns/include/dns/Makefile.in
index 3e9536e53f..f06f338810 100644
--- a/lib/dns/include/dns/Makefile.in
+++ b/lib/dns/include/dns/Makefile.in
@@ -17,7 +17,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	acache.h acl.h adb.h badcache.h bit.h byaddr.h \
 		cache.h callbacks.h cert.h \
diff --git a/lib/dns/include/dst/Makefile.in b/lib/dns/include/dst/Makefile.in
index cece67dd33..628c160e70 100644
--- a/lib/dns/include/dst/Makefile.in
+++ b/lib/dns/include/dst/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	dst.h gssapi.h lib.h result.h
 
diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
index 2416c065f2..427b14677c 100644
--- a/lib/dns/tests/Makefile.in
+++ b/lib/dns/tests/Makefile.in
@@ -22,7 +22,7 @@ top_srcdir =	@top_srcdir@
 .NOTPARALLEL:
 .NO_PARALLEL:
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/lib/irs/Makefile.in b/lib/irs/Makefile.in
index ba802bf478..cbba88dd33 100644
--- a/lib/irs/Makefile.in
+++ b/lib/irs/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @LIBIRS_API@
 
diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
index 1a58783d31..d3a5de8299 100644
--- a/lib/isc/Makefile.in
+++ b/lib/isc/Makefile.in
@@ -17,7 +17,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @LIBISC_API@
 
diff --git a/lib/isc/alpha/include/isc/Makefile.in b/lib/isc/alpha/include/isc/Makefile.in
index 4927e210f3..1dd56da4eb 100644
--- a/lib/isc/alpha/include/isc/Makefile.in
+++ b/lib/isc/alpha/include/isc/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	atomic.h
 
diff --git a/lib/isc/ia64/include/isc/Makefile.in b/lib/isc/ia64/include/isc/Makefile.in
index 4927e210f3..1dd56da4eb 100644
--- a/lib/isc/ia64/include/isc/Makefile.in
+++ b/lib/isc/ia64/include/isc/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	atomic.h
 
diff --git a/lib/isc/include/isc/Makefile.in b/lib/isc/include/isc/Makefile.in
index 0a0b0773ae..e27a69117e 100644
--- a/lib/isc/include/isc/Makefile.in
+++ b/lib/isc/include/isc/Makefile.in
@@ -17,7 +17,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 #
 # Only list headers that are to be installed and are not
diff --git a/lib/isc/include/pk11/Makefile.in b/lib/isc/include/pk11/Makefile.in
index 744c40e903..e29713115f 100644
--- a/lib/isc/include/pk11/Makefile.in
+++ b/lib/isc/include/pk11/Makefile.in
@@ -16,7 +16,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 #
 # Only list headers that are to be installed and are not
diff --git a/lib/isc/include/pkcs11/Makefile.in b/lib/isc/include/pkcs11/Makefile.in
index 6e986886d3..c5ec7a4968 100644
--- a/lib/isc/include/pkcs11/Makefile.in
+++ b/lib/isc/include/pkcs11/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 #
 # Only list headers that are to be installed and are not
diff --git a/lib/isc/mips/include/isc/Makefile.in b/lib/isc/mips/include/isc/Makefile.in
index 4927e210f3..1dd56da4eb 100644
--- a/lib/isc/mips/include/isc/Makefile.in
+++ b/lib/isc/mips/include/isc/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	atomic.h
 
diff --git a/lib/isc/noatomic/include/isc/Makefile.in b/lib/isc/noatomic/include/isc/Makefile.in
index 4927e210f3..1dd56da4eb 100644
--- a/lib/isc/noatomic/include/isc/Makefile.in
+++ b/lib/isc/noatomic/include/isc/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	atomic.h
 
diff --git a/lib/isc/nothreads/include/isc/Makefile.in b/lib/isc/nothreads/include/isc/Makefile.in
index a2c347eaa2..3180cd5e03 100644
--- a/lib/isc/nothreads/include/isc/Makefile.in
+++ b/lib/isc/nothreads/include/isc/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	condition.h mutex.h once.h thread.h
 
diff --git a/lib/isc/powerpc/include/isc/Makefile.in b/lib/isc/powerpc/include/isc/Makefile.in
index 4927e210f3..1dd56da4eb 100644
--- a/lib/isc/powerpc/include/isc/Makefile.in
+++ b/lib/isc/powerpc/include/isc/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	atomic.h
 
diff --git a/lib/isc/pthreads/include/isc/Makefile.in b/lib/isc/pthreads/include/isc/Makefile.in
index 7cadcf4b6f..b8c802f458 100644
--- a/lib/isc/pthreads/include/isc/Makefile.in
+++ b/lib/isc/pthreads/include/isc/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	condition.h mutex.h once.h thread.h
 
diff --git a/lib/isc/sparc64/include/isc/Makefile.in b/lib/isc/sparc64/include/isc/Makefile.in
index 4927e210f3..1dd56da4eb 100644
--- a/lib/isc/sparc64/include/isc/Makefile.in
+++ b/lib/isc/sparc64/include/isc/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	atomic.h
 
diff --git a/lib/isc/tests/Makefile.in b/lib/isc/tests/Makefile.in
index 6735e5d930..b418366554 100644
--- a/lib/isc/tests/Makefile.in
+++ b/lib/isc/tests/Makefile.in
@@ -22,7 +22,7 @@ top_srcdir =	@top_srcdir@
 .NOTPARALLEL:
 .NO_PARALLEL:
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/lib/isc/unix/include/isc/Makefile.in b/lib/isc/unix/include/isc/Makefile.in
index 9cd96d71b7..b0b9bc7610 100644
--- a/lib/isc/unix/include/isc/Makefile.in
+++ b/lib/isc/unix/include/isc/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	dir.h int.h keyboard.h net.h netdb.h offset.h stat.h \
 		stdtime.h strerror.h syslog.h time.h
diff --git a/lib/isc/win32/include/isc/Makefile.in b/lib/isc/win32/include/isc/Makefile.in
index fe2b022952..8e0e3cb619 100644
--- a/lib/isc/win32/include/isc/Makefile.in
+++ b/lib/isc/win32/include/isc/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	dir.h int.h keyboard.h mutex.h net.h netdb.h once.h \
 		stat.h stdtime.h thread.h time.h
diff --git a/lib/isc/x86_32/include/isc/Makefile.in b/lib/isc/x86_32/include/isc/Makefile.in
index 4927e210f3..1dd56da4eb 100644
--- a/lib/isc/x86_32/include/isc/Makefile.in
+++ b/lib/isc/x86_32/include/isc/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	atomic.h
 
diff --git a/lib/isc/x86_64/include/isc/Makefile.in b/lib/isc/x86_64/include/isc/Makefile.in
index 9a988bb761..6400bad6fe 100644
--- a/lib/isc/x86_64/include/isc/Makefile.in
+++ b/lib/isc/x86_64/include/isc/Makefile.in
@@ -18,7 +18,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 HEADERS =	atomic.h
 
diff --git a/lib/isccc/Makefile.in b/lib/isccc/Makefile.in
index 843e510a6f..b9561fbf7e 100644
--- a/lib/isccc/Makefile.in
+++ b/lib/isccc/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @LIBISCCC_API@
 
diff --git a/lib/isccc/include/isccc/Makefile.in b/lib/isccc/include/isccc/Makefile.in
index c4af19a749..18d9794bb5 100644
--- a/lib/isccc/include/isccc/Makefile.in
+++ b/lib/isccc/include/isccc/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 #
 # Only list headers that are to be installed and are not
diff --git a/lib/isccfg/Makefile.in b/lib/isccfg/Makefile.in
index 6ad279b3f2..54b75fe08c 100644
--- a/lib/isccfg/Makefile.in
+++ b/lib/isccfg/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @LIBISCCFG_API@
 
diff --git a/lib/isccfg/include/isccfg/Makefile.in b/lib/isccfg/include/isccfg/Makefile.in
index d6f395ca72..83c019e6a2 100644
--- a/lib/isccfg/include/isccfg/Makefile.in
+++ b/lib/isccfg/include/isccfg/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 #
 # Only list headers that are to be installed and are not
diff --git a/lib/lwres/Makefile.in b/lib/lwres/Makefile.in
index dd8eb65eed..acee2c4297 100644
--- a/lib/lwres/Makefile.in
+++ b/lib/lwres/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @LIBLWRES_API@
 
diff --git a/lib/lwres/man/Makefile.in b/lib/lwres/man/Makefile.in
index 80db9f2ff5..5194aca344 100644
--- a/lib/lwres/man/Makefile.in
+++ b/lib/lwres/man/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_RULES@
 
diff --git a/lib/lwres/tests/Makefile.in b/lib/lwres/tests/Makefile.in
index e80ad3f69a..704fe763f7 100644
--- a/lib/lwres/tests/Makefile.in
+++ b/lib/lwres/tests/Makefile.in
@@ -22,7 +22,7 @@ top_srcdir =	@top_srcdir@
 .NOTPARALLEL:
 .NO_PARALLEL:
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/lib/samples/Makefile.in b/lib/samples/Makefile.in
index 41a54e1953..a44c8540b8 100644
--- a/lib/samples/Makefile.in
+++ b/lib/samples/Makefile.in
@@ -16,7 +16,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
diff --git a/lib/tests/include/tests/Makefile.in b/lib/tests/include/tests/Makefile.in
index cfadac7865..2dedea5277 100644
--- a/lib/tests/include/tests/Makefile.in
+++ b/lib/tests/include/tests/Makefile.in
@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-@BIND9_VERSION@
+VERSION=@BIND9_VERSION@
 
 SUBDIRS =
 TARGETS =

From 517b58429c816da1f27526b8f2df70e95c91078f Mon Sep 17 00:00:00 2001
From: Mukund Sivaraman <muks@isc.org>
Date: Mon, 9 Nov 2015 15:17:44 +0530
Subject: [PATCH 39/39] Fix typo

---
 doc/arm/Bv9ARM-book.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 01a7041a10..d3bb4a18ad 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -6161,7 +6161,7 @@ options {
 		  usage on servers and may improve throughput.  However,
 		  it increases response size, which may cause more queries
 		  to be processed using TCP; a server with compression
-		  disabled is out of compiance with RFC 1123 Section
+		  disabled is out of compliance with RFC 1123 Section
 		  6.1.3.2. The default is <userinput>yes</userinput>.
 		</para>
 	      </listitem>