Add 'tls' configuration support for the 'forwarders' option

A 'tls' statement can be specified both for individual addresses
and for the whole list (as a default value when an individual
address doesn't have its own 'tls' set), just as it was done
before for the 'port' value.

Create a new function 'print_rawqstring()' to print a string residing
in a 'isc_textregion_t' type parameter.

Create a new function 'copy_string()' to copy a string from a
'cfg_obj_t' object into a 'isc_textregion_t'.

doc/misc/forward.zoneopt

@@ -2,5 +2,5 @@ zone <string> [ <class> ] {
 	type forward;
 	delegation-only <boolean>;
 	forward ( first | only );
-	forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
 };

doc/misc/mirror.zoneopt

@@ -5,7 +5,7 @@ zone <string> [ <class> ] {
 	allow-query-on { <address_match_element>; ... };
 	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
 	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	check-names ( fail | warn | ignore );
 	database <string>;
 	file <quoted_string>;
@@ -27,13 +27,13 @@ zone <string> [ <class> ] {
 	multi-master <boolean>;
 	notify ( explicit | master-only | primary-only | <boolean> );
 	notify-delay <integer>;
-	notify-source ( <ipv4_address> | * ) ;
-	notify-source-v6 ( <ipv6_address> | * ) ;
-	primaries [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	request-expire <boolean>;
 	request-ixfr <boolean>;
-	transfer-source ( <ipv4_address> | * ) ;
-	transfer-source-v6 ( <ipv6_address> | * ) ;
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
 	try-tcp-refresh <boolean>;
 	zero-no-soa-ttl <boolean>;
 	zone-statistics ( full | terse | none | <boolean> );

doc/misc/options

@@ -69,7 +69,7 @@ options {
 	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
 	allow-update { <address_match_element>; ... };
 	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	answer-cookie <boolean>;
 	attach-cache <string>;
 	auth-nxdomain <boolean>;
@@ -79,7 +79,7 @@ options {
 	avoid-v6-udp-ports { <portrange>; ... }; // deprecated
 	bindkeys-file <quoted_string>;
 	blackhole { <address_match_element>; ... };
-	catalog-zones { zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
+	catalog-zones { zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <boolean>;
 	check-mx ( fail | warn | ignore );
@@ -136,7 +136,7 @@ options {
 	fetches-per-zone <integer> [ ( drop | fail ) ];
 	flush-zones-on-shutdown <boolean>;
 	forward ( first | only );
-	forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
 	fstrm-set-buffer-hint <integer>; // not configured
 	fstrm-set-flush-timeout <integer>; // not configured
 	fstrm-set-input-queue-size <integer>; // not configured
@@ -202,15 +202,15 @@ options {
 	notify ( explicit | master-only | primary-only | <boolean> );
 	notify-delay <integer>;
 	notify-rate <integer>;
-	notify-source ( <ipv4_address> | * ) ;
-	notify-source-v6 ( <ipv6_address> | * ) ;
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
 	notify-to-soa <boolean>;
 	nsec3-test-zone <boolean>; // test only
 	nta-lifetime <duration>;
 	nta-recheck <duration>;
 	nxdomain-redirect <string>;
-	parental-source ( <ipv4_address> | * ) ;
-	parental-source-v6 ( <ipv6_address> | * ) ;
+	parental-source ( <ipv4_address> | * );
+	parental-source-v6 ( <ipv6_address> | * );
 	pid-file ( <quoted_string> | none );
 	port <integer>;
 	preferred-glue <string>;
@@ -292,8 +292,8 @@ options {
 	tls-port <integer>;
 	transfer-format ( many-answers | one-answer );
 	transfer-message-size <integer>;
-	transfer-source ( <ipv4_address> | * ) ;
-	transfer-source-v6 ( <ipv6_address> | * ) ;
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
 	transfers-in <integer>;
 	transfers-out <integer>;
 	transfers-per-ns <integer>;
@@ -312,11 +312,11 @@ options {
 	zone-statistics ( full | terse | none | <boolean> );
 };
 
-parental-agents <string> [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
+parental-agents <string> [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
 
 plugin ( query ) <string> [ { <unspecified-text> } ]; // may occur multiple times
 
-primaries <string> [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
+primaries <string> [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... }; // may occur multiple times
 
 server <netprefix> {
 	bogus <boolean>;
@@ -325,8 +325,8 @@ server <netprefix> {
 	edns-version <integer>;
 	keys <server_key>;
 	max-udp-size <integer>;
-	notify-source ( <ipv4_address> | * ) ;
-	notify-source-v6 ( <ipv6_address> | * ) ;
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
 	padding <integer>;
 	provide-ixfr <boolean>;
 	query-source [ address ] ( <ipv4_address> | * );
@@ -339,8 +339,8 @@ server <netprefix> {
 	tcp-keepalive <boolean>;
 	tcp-only <boolean>;
 	transfer-format ( many-answers | one-answer );
-	transfer-source ( <ipv4_address> | * ) ;
-	transfer-source-v6 ( <ipv6_address> | * ) ;
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
 	transfers <integer>;
 }; // may occur multiple times
 
@@ -376,11 +376,11 @@ view <string> [ <class> ] {
 	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
 	allow-update { <address_match_element>; ... };
 	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	attach-cache <string>;
 	auth-nxdomain <boolean>;
 	auto-dnssec ( allow | maintain | off ); // deprecated
-	catalog-zones { zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
+	catalog-zones { zone <string> [ default-primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... } ] [ zone-directory <quoted_string> ] [ in-memory <boolean> ] [ min-update-interval <duration> ]; ... };
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <boolean>;
 	check-mx ( fail | warn | ignore );
@@ -434,7 +434,7 @@ view <string> [ <class> ] {
 	fetches-per-server <integer> [ ( drop | fail ) ];
 	fetches-per-zone <integer> [ ( drop | fail ) ];
 	forward ( first | only );
-	forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
 	ipv4only-contact <string>;
 	ipv4only-enable <boolean>;
 	ipv4only-server <string>;
@@ -483,15 +483,15 @@ view <string> [ <class> ] {
 	nocookie-udp-size <integer>;
 	notify ( explicit | master-only | primary-only | <boolean> );
 	notify-delay <integer>;
-	notify-source ( <ipv4_address> | * ) ;
-	notify-source-v6 ( <ipv6_address> | * ) ;
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
 	notify-to-soa <boolean>;
 	nsec3-test-zone <boolean>; // test only
 	nta-lifetime <duration>;
 	nta-recheck <duration>;
 	nxdomain-redirect <string>;
-	parental-source ( <ipv4_address> | * ) ;
-	parental-source-v6 ( <ipv6_address> | * ) ;
+	parental-source ( <ipv4_address> | * );
+	parental-source-v6 ( <ipv6_address> | * );
 	plugin ( query ) <string> [ { <unspecified-text> } ]; // may occur multiple times
 	preferred-glue <string>;
 	prefetch <integer> [ <integer> ];
@@ -538,8 +538,8 @@ view <string> [ <class> ] {
 		edns-version <integer>;
 		keys <server_key>;
 		max-udp-size <integer>;
-		notify-source ( <ipv4_address> | * ) ;
-		notify-source-v6 ( <ipv6_address> | * ) ;
+		notify-source ( <ipv4_address> | * );
+		notify-source-v6 ( <ipv6_address> | * );
 		padding <integer>;
 		provide-ixfr <boolean>;
 		query-source [ address ] ( <ipv4_address> | * );
@@ -552,8 +552,8 @@ view <string> [ <class> ] {
 		tcp-keepalive <boolean>;
 		tcp-only <boolean>;
 		transfer-format ( many-answers | one-answer );
-		transfer-source ( <ipv4_address> | * ) ;
-		transfer-source-v6 ( <ipv6_address> | * ) ;
+		transfer-source ( <ipv4_address> | * );
+		transfer-source-v6 ( <ipv6_address> | * );
 		transfers <integer>;
 	}; // may occur multiple times
 	servfail-ttl <duration>;
@@ -570,8 +570,8 @@ view <string> [ <class> ] {
 	suppress-initial-notify <boolean>; // obsolete
 	synth-from-dnssec <boolean>;
 	transfer-format ( many-answers | one-answer );
-	transfer-source ( <ipv4_address> | * ) ;
-	transfer-source-v6 ( <ipv6_address> | * ) ;
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
 	trust-anchor-telemetry <boolean>; // experimental
 	trust-anchors { <string> ( static-key | initial-key | static-ds | initial-ds ) <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times
 	trusted-keys { <string> <integer> <integer> <integer> <quoted_string>; ... }; // may occur multiple times, deprecated

doc/misc/primary.zoneopt

@@ -4,7 +4,7 @@ zone <string> [ <class> ] {
 	allow-query-on { <address_match_element>; ... };
 	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
 	allow-update { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	auto-dnssec ( allow | maintain | off ); // deprecated
 	check-dup-records ( fail | warn | ignore );
 	check-integrity <boolean>;
@@ -27,7 +27,7 @@ zone <string> [ <class> ] {
 	dnssec-update-mode ( maintain | no-resign );
 	file <quoted_string>;
 	forward ( first | only );
-	forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
 	inline-signing <boolean>;
 	ixfr-from-differences <boolean>;
 	journal <quoted_string>;
@@ -42,13 +42,13 @@ zone <string> [ <class> ] {
 	max-zone-ttl ( unlimited | <duration> ); // deprecated
 	notify ( explicit | master-only | primary-only | <boolean> );
 	notify-delay <integer>;
-	notify-source ( <ipv4_address> | * ) ;
-	notify-source-v6 ( <ipv6_address> | * ) ;
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
 	notify-to-soa <boolean>;
 	nsec3-test-zone <boolean>; // test only
-	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-	parental-source ( <ipv4_address> | * ) ;
-	parental-source-v6 ( <ipv6_address> | * ) ;
+	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	parental-source ( <ipv4_address> | * );
+	parental-source-v6 ( <ipv6_address> | * );
 	serial-update-method ( date | increment | unixtime );
 	sig-signing-nodes <integer>;
 	sig-signing-signatures <integer>;

doc/misc/redirect.zoneopt

@@ -8,6 +8,6 @@ zone <string> [ <class> ] {
 	masterfile-style ( full | relative );
 	max-records <integer>;
 	max-zone-ttl ( unlimited | <duration> ); // deprecated
-	primaries [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	zone-statistics ( full | terse | none | <boolean> );
 };

doc/misc/secondary.zoneopt

@@ -5,7 +5,7 @@ zone <string> [ <class> ] {
 	allow-query-on { <address_match_element>; ... };
 	allow-transfer [ port <integer> ] [ transport <string> ] { <address_match_element>; ... };
 	allow-update-forwarding { <address_match_element>; ... };
-	also-notify [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	also-notify [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	auto-dnssec ( allow | maintain | off ); // deprecated
 	check-names ( fail | warn | ignore );
 	database <string>;
@@ -18,7 +18,7 @@ zone <string> [ <class> ] {
 	dnssec-update-mode ( maintain | no-resign );
 	file <quoted_string>;
 	forward ( first | only );
-	forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
 	inline-signing <boolean>;
 	ixfr-from-differences <boolean>;
 	journal <quoted_string>;
@@ -39,22 +39,22 @@ zone <string> [ <class> ] {
 	multi-master <boolean>;
 	notify ( explicit | master-only | primary-only | <boolean> );
 	notify-delay <integer>;
-	notify-source ( <ipv4_address> | * ) ;
-	notify-source-v6 ( <ipv6_address> | * ) ;
+	notify-source ( <ipv4_address> | * );
+	notify-source-v6 ( <ipv6_address> | * );
 	notify-to-soa <boolean>;
 	nsec3-test-zone <boolean>; // test only
-	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-	parental-source ( <ipv4_address> | * ) ;
-	parental-source-v6 ( <ipv6_address> | * ) ;
-	primaries [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	parental-agents [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	parental-source ( <ipv4_address> | * );
+	parental-source-v6 ( <ipv6_address> | * );
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
 	request-expire <boolean>;
 	request-ixfr <boolean>;
 	sig-signing-nodes <integer>;
 	sig-signing-signatures <integer>;
 	sig-signing-type <integer>;
 	sig-validity-interval <integer> [ <integer> ];
-	transfer-source ( <ipv4_address> | * ) ;
-	transfer-source-v6 ( <ipv6_address> | * ) ;
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
 	try-tcp-refresh <boolean>;
 	update-check-ksk <boolean>;
 	zero-no-soa-ttl <boolean>;

doc/misc/static-stub.zoneopt

@@ -3,7 +3,7 @@ zone <string> [ <class> ] {
 	allow-query { <address_match_element>; ... };
 	allow-query-on { <address_match_element>; ... };
 	forward ( first | only );
-	forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
 	max-records <integer>;
 	server-addresses { ( <ipv4_address> | <ipv6_address> ); ... };
 	server-names { <string>; ... };

doc/misc/stub.zoneopt

@@ -8,7 +8,7 @@ zone <string> [ <class> ] {
 	dialup ( notify | notify-passive | passive | refresh | <boolean> );
 	file <quoted_string>;
 	forward ( first | only );
-	forwarders [ port <integer> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ]; ... };
+	forwarders [ port <integer> ] [ tls <string> ] { ( <ipv4_address> | <ipv6_address> ) [ port <integer> ] [ tls <string> ]; ... };
 	masterfile-format ( raw | text );
 	masterfile-style ( full | relative );
 	max-records <integer>;
@@ -19,8 +19,8 @@ zone <string> [ <class> ] {
 	min-refresh-time <integer>;
 	min-retry-time <integer>;
 	multi-master <boolean>;
-	primaries [ port <integer> ] [ source ( <ipv4_address> | * )  ] [ source-v6 ( <ipv6_address> | * )  ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
-	transfer-source ( <ipv4_address> | * ) ;
-	transfer-source-v6 ( <ipv6_address> | * ) ;
+	primaries [ port <integer> ] [ source ( <ipv4_address> | * ) ] [ source-v6 ( <ipv6_address> | * ) ] { ( <remote-servers> | <ipv4_address> [ port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key <string> ] [ tls <string> ]; ... };
+	transfer-source ( <ipv4_address> | * );
+	transfer-source-v6 ( <ipv6_address> | * );
 	zone-statistics ( full | terse | none | <boolean> );
 };