put A and AAAA in additional section when responding to type=ANAME queries

initial implementation of ANAME rrtype, using type code point 65532
- this is only the bare type represetation, with no special processing
2018-03-18 14:27:22 +00:00 · 2018-03-18 11:40:51 +00:00
2108 changed files with 87257 additions and 16746 deletions
@@ -7,8 +7,6 @@ libtool
 /isc-config.sh
 /configure.lineno
 autom4te.cache/
-*.rej
-*.orig
 *.o
 *.lo
 *.so
@@ -15,84 +15,72 @@ stages:
  tags:
    - linux
    - docker
-    - amd64

 .debian-jessie-i386: &debian_jessie_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-jessie-i386"
  tags:
    - linux
    - docker
-    - i386

 .debian-stretch-amd64: &debian_stretch_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-stretch-amd64"
  tags:
    - linux
    - docker
-    - amd64

 .debian-stretch-i386:: &debian_stretch_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-stretch-i386"
  tags:
    - linux
    - docker
-    - i386

 .debian-buster-amd64: &debian_buster_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
  tags:
    - linux
    - docker
-    - amd64

 .debian-buster-i386:: &debian_buster_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-buster-i386"
  tags:
    - linux
    - docker
-    - i386

 .debian-sid-amd64: &debian_sid_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
  tags:
    - linux
    - docker
-    - amd64

 .debian-sid-i386: &debian_sid_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-i386"
  tags:
    - linux
    - docker
-    - i386

 .ubuntu-trusty-amd64: &ubuntu_trusty_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-amd64"
  tags:
    - linux
    - docker
-    - amd64

 .ubuntu-trusty-i386: &ubuntu_trusty_i386_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-i386"
  tags:
    - linux
    - docker
-    - i386

 .ubuntu-xenial-amd64: &ubuntu_xenial_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-amd64"
  tags:
    - linux
    - docker
-    - amd64

 .ubuntu-xenial-i386: &ubuntu_xenial_i386_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-i386"
  tags:
    - linux
    - docker
-    - i386

 .build: &build_job
  stage: build
@@ -112,8 +100,7 @@ stages:
    - rm -rf .ccache
    - bash -x bin/tests/system/ifconfig.sh up
  script:
-    - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
-    - test -s bin/tests/system/systests.output
+    - cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1
  artifacts:
    untracked: true
    expire_in: '1 week'
@@ -174,31 +161,11 @@ precheck:debian:sid:amd64:
 #  <<: *ubuntu_xenial_i386_image
 #  <<: *build_job

-build:clang:debian:sid:amd64:
-  variables:
-    CC: clang-6.0
-    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-  <<: *debian_sid_amd64_image
-  <<: *build_job
-
 build:debian:sid:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
  <<: *debian_sid_amd64_image
  <<: *build_job
-
-build:clang:debian:sid:i386:
-  variables:
-    CC: clang-6.0
-    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-  <<: *debian_sid_i386_image
-  <<: *build_job
-
+    
 build:debian:sid:i386:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
  <<: *debian_sid_i386_image
  <<: *build_job

@@ -207,13 +174,7 @@ unittest:debian:sid:amd64:
  <<: *unit_test_job
  dependencies:
    - build:debian:sid:amd64
-
-unittest:clang:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:clang:debian:sid:amd64
-
+    
 unittest:debian:sid:i386:
  <<: *debian_sid_i386_image
  <<: *unit_test_job
@@ -225,7 +186,7 @@ systemtest:debian:sid:amd64:
  <<: *system_test_job
  dependencies:
    - build:debian:sid:amd64
-
+    
 systemtest:debian:sid:i386:
  <<: *debian_sid_i386_image
  <<: *system_test_job
@@ -1,225 +1,3 @@
-4977.	[cleanup]	Fixed an inconsistency in setting up the
-			default "allow-notify" ACL. [GL !342]
-
-4976.	[bug]		Log the label with invalid prefix length correctly
-			when loading RPZ zones. [GL #254]
-
-4975.	[bug]		The server cookie computation for sha1 and sha256 did
-			not match the method described in RFC 7873. [GL #356]
-
-4974.	[bug]		Restore default rrset-order to random. [GL #336]
-
-4973.	[func]		verifyzone() and the functions it uses were moved to
-			libdns and refactored to prevent exit() from being
-			called upon failure.  A side effect of that is that
-			dnssec-signzone and dnssec-verify now check for memory
-			leaks upon shutdown. [GL #266]
-
-4972.	[func]		Declare the 'rdata' argument for dns_rdata_tostruct()
-			to be const. [GL #341]
-
-4971.	[bug]		dnssec-signzone and dnssec-verify did not treat records
-			below a DNAME as out-of-zone data. [GL #298]
-
-4970.	[func]		Add QNAME minimization option to resolver. [GL #16]
-
-4969.	[cleanup]	Refactor zone logging functions. [GL #269]
-
-	--- 9.13.1 released ---
-
-4968.	[bug]		If glue records are signed, attempt to validate them.
-			[GL #209]
-
-4967.	[cleanup]	Add "answer-cookie" to the parser, marked obsolete.
-
-4966.	[placeholder]
-
-4965.	[func]		Add support for marking options as deprecated.
-			[GL #322]
-
-4964.	[bug]		Reduce the probabilty of double signature when deleting
-			a DNSKEY by checking if the node is otherwise signed
-			by the algorithm of the key to be deleted. [GL #240]
-
-4963.	[test]		ifconfig.sh now uses "ip" instead of "ifconfig",
-			if available, to configure the test interfaces on
-			linux.  [GL #302]
-
-4962.	[cleanup]	Move 'named -T' processing to its own function.
-			[GL #316]
-
-4961.	[protocol]	Remove support for ECC-GOST (GOST R 34.11-94).
-			[GL #295]
-
-4960.	[security]	When recursion is enabled, but the "allow-recursion"
-			and "allow-query-cache" ACLs are not specified,
-			they should be limited to local networks,
-			but were inadvertently set to match the default
-			"allow-query", thus allowing remote queries.
-			(CVE-2018-5738) [GL #309]
-
-4959.	[func]		NSID logging (enabled by the "request-nsid" option)
-			now has its own "nsid" category, instead of using the
-			"resolver" category. [GL !332]
-
-4958.	[bug]		Remove redundant space from NSEC3 record. [GL #281]
-
-4957.	[func]		The default setting for "dnssec-validation" is now
-			"auto", which activates DNSSEC validation using the
-			IANA root key. (The default can be changed back to
-			"yes", which activates DNSSEC validation only when keys
-			are explicitly configured in named.conf, by building
-			BIND with "configure --disable-auto-validation".)
-			[GL #30]
-
-4956.	[func]		Change isc_random() to be just PRNG using xoshiro128**,
-			and add isc_nonce_buf() that uses CSPRNG. [GL #289]
-
-4955.	[cleanup]	Silence cppcheck warnings in lib/dns/master.c.
-			[GL #286]
-
-4954.	[func]		Messages about serving of stale answers are now
-			directed to the "serve-stale" logging category.
-			Also clarified serve-stale documentation. [GL !323]
-
-4953.	[bug]		Removed the option to build the red black tree
-			database without a hash table; the non-hashing
-			version was buggy and is not needed. [GL #184]
-
-4952.	[func]		Authoritative server support in named for the
-			EDNS CLIENT-SUBNET option (which was experimental
-			and not practical to deploy) has been removed.
-
-			The ECS option is still supported in dig and mdig
-			via the +subnet option, and can be parsed and logged
-			when received by named, but it is no longer used
-			for ACL processing. The "geoip-use-ecs" option
-			is now obsolete; a warning will be logged if it is
-			used in named.conf. "ecs" tags in an ACL definition
-			are also obsolete and will cause the configuration
-			to fail to load.  [GL #32]
-
-4951.	[protocol]	Add "HOME.ARPA" to list of built in empty zones as
-			per RFC 8375. [GL #273]
-
-	--- 9.13.0 released ---
-
-4950.	[bug]		ISC_SOCKEVENTATTR_TRUNC was not be set. [GL #238]
-
-4949.	[placeholder]
-
-4948.	[bug]		When request-nsid is turned on, EDNS NSID options
-			should be logged at level info. Since change 3741
-			they have been logged at debug(3) by mistake.
-			[GL !290]
-
-4947.	[func]		Replace all random functions with isc_random(),
-			isc_random_buf() and isc_random_uniform() API.
-			[GL #221]
-
-4946.	[bug]		Additional glue was not being returned by resolver
-			for unsigned zones since change 4596. [GL #209]
-
-4945.	[func]		BIND can no longer be built without DNSSEC support.
-			A cryptography provder (i.e., OpenSSL or a hardware
-			service module with PKCS#11 support) must be
-			available. [GL #244]
-
-4944.	[cleanup]	Silence cppcheck portability warnings in
-			lib/isc/tests/buffer_test.c. [GL #239]
-
-4943.	[bug]		Change 4687 consumed too much memory when running
-			system tests with --with-tuning=large.  Reduced the
-			hash table size to 512 entries for 'named -m record'
-			restoring the previous memory footprint. [GL #248]
-
-4942.	[cleanup]	Consolidate multiple instances of splitting of
-			batchline in dig into a single function. [GL #196]
-
-4941.	[cleanup]	Silence clang static analyzer warnings. [GL #196]
-
-4940.	[cleanup]	Extract the loop in dns__zone_updatesigs() into
-			separate functions to improve code readability.
-			[GL #135]
-
-4939.	[test]		Add basic unit tests for update_sigs(). [GL #135]
-
-4938.	[placeholder]
-
-4937.	[func]		Remove support for OpenSSL < 1.0.0 [GL #191]
-
-4936.	[func]		Always use OpenSSL or PKCS#11 random data providers,
-			and remove the --{enable,disable}-crypto-rand configure
-			options. [GL #165]
-
-4935.	[func]		Add support for LibreSSL >= 2.7.0 (some OpenSSL 1.1.0
-			call were added). [GL #191]
-
-4934.	[security]	The serve-stale feature could cause an assertion failure
-			in rbtdb.c even when stale-answer-enable was false.
-			Simultaneous use of stale cache records and NSEC
-			aggressive negative caching could trigger a recursion
-			loop. (CVE-2018-5737) [GL #185]
-
-4933.	[bug]		Not creating signing keys for an inline signed zone
-			prevented changes applied to the raw zone from being
-			reflected in the secure zone until signing keys were
-			made available. [GL #159]
-
-4932.	[bug]		Bumped signed serial of an inline signed zone was
-			logged even when an error occurred while updating
-			signatures. [GL #159]
-
-4931.	[func]		Removed the "rbtdb64" database implementation.
-			[GL #217]
-
-4930.	[bug]		Remove a bogus check in nslookup command line
-			argument processing. [GL #206]
-
-4929.	[func]		Add the ability to set RA and TC in queries made by
-			dig (+[no]raflag, +[no]tcflag). [GL #213]
-
-4928.	[func]		The "dnskey-sig-validity" option allows
-			"sig-validity-interval" to be overriden for signatures
-			covering DNSKEY RRsets. [GL #145]
-
-4927.	[placeholder]
-
-4926.	[func]		Add root key sentinel support.  To disable, add
-			'root-key-sentinel no;' to named.conf. [GL #37]
-
-4925.	[func]		Several configuration options that define intervals
-			can now take TTL value suffixes (for example, 2h or 1d)
-			in addition to integer parameters. These include
-			max-cache-ttl, max-ncache-ttl, max-policy-ttl,
-			fstrm-set-reopen-interval, interface-interval, and
-			min-update-interval. [GL #203]
-
-4924.	[cleanup]	Clean up the isc_string_* namespace and leave
-			only strlcpy and strlcat. [GL #178]
-
-4923.	[cleanup]	Refactor socket and socket event options into
-			enum types. [GL !135]
-
-4922.	[bug]		dnstap: Log the destination address of client
-			packets rather than the interface address.
-			[GL #197]
-
-4921.	[cleanup]	Add dns_fixedname_initname() and refactor the caller
-			code to make usage of the new function, as a part of
-			refactoring dns_fixedname_*() macros were turned into
-			functions. [GL #183]
-
-4920.	[cleanup]	Clean up libdns removing most of the backwards
-			compatibility wrappers.
-
-4919.	[cleanup]	Clean up the isc_hash_* namespace and leave only
-			the FNV-1a hash implementation. [GL #178]
-
-4918.	[bug]		Fix double free after keygen error in dnssec-keygen
-			when OpenSSL >= 1.1.0 is used and RSA_generate_key_ex
-			fails. [GL #109]
-
 4917.	[func]		Support 64 RPZ policy zones by default. [GL #123]

 4916.	[func]		Remove IDNA2003 support and the bundled idnkit-1.0
@@ -231,10 +9,10 @@
 			like dig without IDN support.  libidn2 version 2.0
 			or higher is needed for +idnout enabled by default.

-4914.	[security]	A bug in zone database reference counting could lead to
+4914.	[bug]		A bug in zone database reference counting could lead to
 			a crash when multiple versions of a slave zone were
 			transferred from a master in close succession.
-			(CVE-2018-5736) [GL #134]
+			[GL #134]

 4913.	[test]		Re-implemented older unit tests in bin/tests as ATF,
 			removed the lib/tests unit testing library. [GL #115]
@@ -522,3 +522,4 @@ BIND 9.2.0
    DNSSEC implementation is still considered experimental. For detailed
    information about the state of the DNSSEC implementation, see the file
    doc/misc/dnssec.
+
@@ -22,8 +22,7 @@ MANPAGES =	isc-config.sh.1

 HTMLPAGES =	isc-config.sh.html

-MANOBJS =	README HISTORY OPTIONS CONTRIBUTING PLATFORMS \
-		${MANPAGES} ${HTMLPAGES}
+MANOBJS =	README HISTORY OPTIONS CONTRIBUTING ${MANPAGES} ${HTMLPAGES}

@BIND9_MAKE_RULES@

@@ -75,7 +74,7 @@ tags:
 	find lib bin -name "*.[ch]" -print | @ETAGS@ -

 test check:
-	@if test -n "`${PERL} ${top_srcdir}/bin/tests/system/testsock.pl 2>/dev/null || echo fail`"; then \
+	@if test -n "`${PERL} ${top_srcdir}/bin/tests/system/testsock.pl 2>&- || echo fail`"; then \
 	echo I: NOTE: The tests were not run because they require that; \
 	echo I:	the IP addresses 10.53.0.1 through 10.53.0.8 are configured; \
 	echo I:	as alias addresses on the loopback interface.  Please run; \
@@ -115,11 +114,6 @@ CONTRIBUTING: CONTRIBUTING.md
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@

-PLATFORMS: PLATFORMS.md
-	${PANDOC} --email-obfuscation=none -s -t html PLATFORMS.md | \
-		${W3M} -dump -cols 75 -O ascii -T text/html | \
-		sed -e '$${/^$$/d;}' > $@
-
 unit::
 	sh ${top_builddir}/unit/unittest.sh

@@ -24,3 +24,4 @@ Setting                   Description
                          may be useful when debugging
 -DISC_HEAP_CHECK          Test heap consistency after every heap
                          operation; used when debugging
+
@@ -1,56 +0,0 @@
-Supported platforms
-
-In general, this version of BIND will build and run on any POSIX-compliant
-system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
-cryptography library. To build with multiprocessing support, a
-C11-compliant C compiler will be needed for standard atomics.
-
-ISC regularly tests BIND on many operating systems and architectures, but
-lacks the resources to test all of them. Consequently, ISC is only able to
-offer support on a "best effort" basis for some.
-
-Regularly tested platforms
-
-As of May 2018, BIND 9.13 is tested on the following systems:
-
-  * Debian 8, 9
-  * Ubuntu 16.04, 18.04
-  * Fedora 27, 28
-  * Red Hat/CentOS 6, 7
-  * FreeBSD 10.x, 11.x
-  * OpenBSD 6.3
-
-The amd64, i386, armhf and arm64 CPU architectures are all fully
-supported.
-
-Best effort
-
-The following are platforms on which BIND is known to build and run, but
-on which it is not routinely tested. ISC makes every effort to fix bugs on
-these platforms, but may be unable to do so quickly due to lack of
-hardware, less familiarity on the part of engineering staff, and other
-constraints.
-
-  * Windows 10 / x64
-  * Windows Server 2012 R2, 2016 / x64
-  * macOS 10.12+
-  * Solaris 10
-  * FreeBSD 12+
-  * OpenBSD 6.2
-  * NetBSD
-  * Older or less popular Linux distributions still supported by their
-    vendors, such as:
-      + Ubuntu 14.04, 18.10+
-      + Gentoo
-      + ArchLinux
-      + Alpine Linux
-  * OpenWRT/LEDE 17.0
-  * Other CPU architectures (mips, mipsel, sparc, ...)
-
-Unsupported platforms
-
-These are platforms on which BIND is known not to build or run:
-
-  * Platforms without at least OpenSSL 1.0.2
-  * Windows 10 / x86
-  * Windows Server 2012
@@ -1,64 +0,0 @@
-<!--
- - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
- -
- - See the COPYRIGHT file distributed with this work for additional
- - information regarding copyright ownership.
-->
-## Supported platforms
-
-In general, this version of BIND will build and run on any POSIX-compliant
-system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
-cryptography library. To build with multiprocessing support, a
-C11-compliant C compiler will be needed for standard atomics.
-
-ISC regularly tests BIND on many operating systems and architectures, but
-lacks the resources to test all of them. Consequently, ISC is only able to
-offer support on a "best effort" basis for some.
-
-### Regularly tested platforms
-
-As of May 2018, BIND 9.13 is tested on the following systems:
-
-* Debian 8, 9
-* Ubuntu 16.04, 18.04
-* Fedora 27, 28
-* Red Hat/CentOS 6, 7
-* FreeBSD 10.x, 11.x
-* OpenBSD 6.3
-
-The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
-
-### Best effort
-
-The following are platforms on which BIND is known to build and run,
-but on which it is not routinely tested. ISC makes every effort to fix bugs
-on these platforms, but may be unable to do so quickly due to lack of
-hardware, less familiarity on the part of engineering staff, and other
-constraints.
-
-* Windows 10 / x64
-* Windows Server 2012 R2, 2016 / x64
-* macOS 10.12+
-* Solaris 10
-* FreeBSD 12+
-* OpenBSD 6.2
-* NetBSD
-* Older or less popular Linux distributions still supported by their vendors, such as:
-    * Ubuntu 14.04, 18.10+
-    * Gentoo
-    * ArchLinux
-    * Alpine Linux
-* OpenWRT/LEDE 17.0
-* Other CPU architectures (mips, mipsel, sparc, ...)
-
-## Unsupported platforms
-
-These are platforms on which BIND is known *not* to build or run:
-
-* Platforms without at least OpenSSL 1.0.2
-* Windows 10 / x86
-* Windows Server 2012
@@ -31,9 +31,9 @@ administrative tools, including the dig and delv DNS lookup tools,
 nsupdate for dynamic DNS zone updates, rndc for remote name server
 administration, and more.

-BIND 9 began as a complete re-write of the BIND architecture that was used
-in versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a
-501(c)(3) public benefit corporation dedicated to providing software and
+BIND 9 is a complete re-write of the BIND architecture that was used in
+versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a 501
+(c)(3) public benefit corporation dedicated to providing software and
 services in support of the Internet infrastructure, developed BIND 9 and
 is responsible for its ongoing maintenance and improvement. BIND is open
 source software licenced under the terms of the Mozilla Public License,
@@ -48,8 +48,6 @@ the file CHANGES. See below for details on the CHANGES file format.
 For up-to-date release notes and errata, see http://www.isc.org/software/
 bind9/releasenotes

-For information about supported platforms, see PLATFORMS.
-
 Reporting bugs and getting help

 To report non-security-sensitive bugs or request new features, you may
@@ -101,20 +99,11 @@ format-patch.

 BIND 9.13 features

-BIND 9.13 is the newest development branch of BIND 9. It includes a number
-of changes from BIND 9.12 and earlier releases. New features include:
+BIND 9.13.0 is the newest development branch of BIND 9. It includes a
+number of changes from BIND 9.12 and earlier releases. New features
+include:

-  * The default value of "dnssec-validation" is now "auto".
-  * Support for IDNA2008 when linking with libidn2.
-  * "Root key sentinel" support, enabling validating resolvers to indicate
-    via a special query which trust anchors are configured for the root
-    zone.
-
-In addition, cryptographic support has been modernized. BIND now uses the
-best available pseudo-random number generator for the platform on which
-it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory; building BIND without DNSSEC is now longer
-supported.
+  * TBD

 Building BIND

@@ -41,8 +41,8 @@ administrative tools, including the `dig` and `delv` DNS lookup tools,
 `nsupdate` for dynamic DNS zone updates, `rndc` for remote name server
 administration, and more.

-BIND 9 began as a complete re-write of the BIND architecture that was
-used in versions 4 and 8.  Internet Systems Consortium
+BIND 9 is a complete re-write of the BIND architecture that was used in
+versions 4 and 8.  Internet Systems Consortium
 ([https://www.isc.org](https://www.isc.org)), a 501(c)(3) public benefit
 corporation dedicated to providing software and services in support of the
 Internet infrastructure, developed BIND 9 and is responsible for its
@@ -59,8 +59,6 @@ CHANGES file format.
 For up-to-date release notes and errata, see
 [http://www.isc.org/software/bind9/releasenotes](http://www.isc.org/software/bind9/releasenotes)

-For information about supported platforms, see [PLATFORMS](PLATFORMS.md).
-
 ### <a name="help"/> Reporting bugs and getting help

 To report non-security-sensitive bugs or request new features, you may
@@ -118,20 +116,11 @@ including your patch as an attachment, preferably generated by

 ### <a name="features"/> BIND 9.13 features

-BIND 9.13 is the newest development branch of BIND 9. It includes a
+BIND 9.13.0 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.12 and earlier releases.  New features
 include:

-* The default value of "dnssec-validation" is now "auto".
-* Support for IDNA2008 when linking with `libidn2`.
-* "Root key sentinel" support, enabling validating resolvers to indicate
-  via a special query which trust anchors are configured for the root zone.
-
-In addition, cryptographic support has been modernized. BIND now uses the
-best available pseudo-random number generator for the platform on which
-it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory; building BIND without DNSSEC is now
-longer supported.
+* TBD

 ### <a name="build"/> Building BIND

@@ -1,295 +1,17 @@
-# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
+sinclude(libtool.m4/libtool.m4)dnl
+sinclude(libtool.m4/ltoptions.m4)dnl
+sinclude(libtool.m4/ltsugar.m4)dnl
+sinclude(libtool.m4/ltversion.m4)dnl
+sinclude(libtool.m4/lt~obsolete.m4)dnl

-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+m4_divert_text(HELP_CANON, [[
+  NOTE: If PREFIX is not set, then the default values for --sysconfdir
+  and --localstatedir are /etc and /var, respectively.]])
+m4_divert_text(HELP_END, [[
+Professional support for BIND is provided by Internet Systems Consortium,
+Inc.  Information about paid support and training options is available at
+https://www.isc.org/support.

-# This file is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
-# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-# PARTICULAR PURPOSE.
-
-m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
-# pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
-# serial 12 (pkg-config-0.29.2)
-
-dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
-dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
-dnl
-dnl This program is free software; you can redistribute it and/or modify
-dnl it under the terms of the GNU General Public License as published by
-dnl the Free Software Foundation; either version 2 of the License, or
-dnl (at your option) any later version.
-dnl
-dnl This program is distributed in the hope that it will be useful, but
-dnl WITHOUT ANY WARRANTY; without even the implied warranty of
-dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-dnl General Public License for more details.
-dnl
-dnl You should have received a copy of the GNU General Public License
-dnl along with this program; if not, write to the Free Software
-dnl Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
-dnl 02111-1307, USA.
-dnl
-dnl As a special exception to the GNU General Public License, if you
-dnl distribute this file as part of a program that contains a
-dnl configuration script generated by Autoconf, you may include it under
-dnl the same distribution terms that you use for the rest of that
-dnl program.
-
-dnl PKG_PREREQ(MIN-VERSION)
-dnl -----------------------
-dnl Since: 0.29
-dnl
-dnl Verify that the version of the pkg-config macros are at least
-dnl MIN-VERSION. Unlike PKG_PROG_PKG_CONFIG, which checks the user's
-dnl installed version of pkg-config, this checks the developer's version
-dnl of pkg.m4 when generating configure.
-dnl
-dnl To ensure that this macro is defined, also add:
-dnl m4_ifndef([PKG_PREREQ],
-dnl     [m4_fatal([must install pkg-config 0.29 or later before running autoconf/autogen])])
-dnl
-dnl See the "Since" comment for each macro you use to see what version
-dnl of the macros you require.
-m4_defun([PKG_PREREQ],
-[m4_define([PKG_MACROS_VERSION], [0.29.2])
-m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
-    [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
-])dnl PKG_PREREQ
-
-dnl PKG_PROG_PKG_CONFIG([MIN-VERSION])
-dnl ----------------------------------
-dnl Since: 0.16
-dnl
-dnl Search for the pkg-config tool and set the PKG_CONFIG variable to
-dnl first found in the path. Checks that the version of pkg-config found
-dnl is at least MIN-VERSION. If MIN-VERSION is not specified, 0.9.0 is
-dnl used since that's the first version where most current features of
-dnl pkg-config existed.
-AC_DEFUN([PKG_PROG_PKG_CONFIG],
-[m4_pattern_forbid([^_?PKG_[A-Z_]+$])
-m4_pattern_allow([^PKG_CONFIG(_(PATH|LIBDIR|SYSROOT_DIR|ALLOW_SYSTEM_(CFLAGS|LIBS)))?$])
-m4_pattern_allow([^PKG_CONFIG_(DISABLE_UNINSTALLED|TOP_BUILD_DIR|DEBUG_SPEW)$])
-AC_ARG_VAR([PKG_CONFIG], [path to pkg-config utility])
-AC_ARG_VAR([PKG_CONFIG_PATH], [directories to add to pkg-config's search path])
-AC_ARG_VAR([PKG_CONFIG_LIBDIR], [path overriding pkg-config's built-in search path])
-
-if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then
-	AC_PATH_TOOL([PKG_CONFIG], [pkg-config])
-fi
-if test -n "$PKG_CONFIG"; then
-	_pkg_min_version=m4_default([$1], [0.9.0])
-	AC_MSG_CHECKING([pkg-config is at least version $_pkg_min_version])
-	if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then
-		AC_MSG_RESULT([yes])
-	else
-		AC_MSG_RESULT([no])
-		PKG_CONFIG=""
-	fi
-fi[]dnl
-])dnl PKG_PROG_PKG_CONFIG
-
-dnl PKG_CHECK_EXISTS(MODULES, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
-dnl -------------------------------------------------------------------
-dnl Since: 0.18
-dnl
-dnl Check to see whether a particular set of modules exists. Similar to
-dnl PKG_CHECK_MODULES(), but does not set variables or print errors.
-dnl
-dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG])
-dnl only at the first occurence in configure.ac, so if the first place
-dnl it's called might be skipped (such as if it is within an "if", you
-dnl have to call PKG_CHECK_EXISTS manually
-AC_DEFUN([PKG_CHECK_EXISTS],
-[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
-if test -n "$PKG_CONFIG" && \
-    AC_RUN_LOG([$PKG_CONFIG --exists --print-errors "$1"]); then
-  m4_default([$2], [:])
-m4_ifvaln([$3], [else
-  $3])dnl
-fi])
-
-dnl _PKG_CONFIG([VARIABLE], [COMMAND], [MODULES])
-dnl ---------------------------------------------
-dnl Internal wrapper calling pkg-config via PKG_CONFIG and setting
-dnl pkg_failed based on the result.
-m4_define([_PKG_CONFIG],
-[if test -n "$$1"; then
-    pkg_cv_[]$1="$$1"
- elif test -n "$PKG_CONFIG"; then
-    PKG_CHECK_EXISTS([$3],
-                     [pkg_cv_[]$1=`$PKG_CONFIG --[]$2 "$3" 2>/dev/null`
-		      test "x$?" != "x0" && pkg_failed=yes ],
-		     [pkg_failed=yes])
- else
-    pkg_failed=untried
-fi[]dnl
-])dnl _PKG_CONFIG
-
-dnl _PKG_SHORT_ERRORS_SUPPORTED
-dnl ---------------------------
-dnl Internal check to see if pkg-config supports short errors.
-AC_DEFUN([_PKG_SHORT_ERRORS_SUPPORTED],
-[AC_REQUIRE([PKG_PROG_PKG_CONFIG])
-if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
-        _pkg_short_errors_supported=yes
-else
-        _pkg_short_errors_supported=no
-fi[]dnl
-])dnl _PKG_SHORT_ERRORS_SUPPORTED
-
-
-dnl PKG_CHECK_MODULES(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
-dnl   [ACTION-IF-NOT-FOUND])
-dnl --------------------------------------------------------------
-dnl Since: 0.4.0
-dnl
-dnl Note that if there is a possibility the first call to
-dnl PKG_CHECK_MODULES might not happen, you should be sure to include an
-dnl explicit call to PKG_PROG_PKG_CONFIG in your configure.ac
-AC_DEFUN([PKG_CHECK_MODULES],
-[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
-AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
-AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl
-
-pkg_failed=no
-AC_MSG_CHECKING([for $2])
-
-_PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
-_PKG_CONFIG([$1][_LIBS], [libs], [$2])
-
-m4_define([_PKG_TEXT], [Alternatively, you may set the environment variables $1[]_CFLAGS
-and $1[]_LIBS to avoid the need to call pkg-config.
-See the pkg-config man page for more details.])
-
-if test $pkg_failed = yes; then
-        AC_MSG_RESULT([no])
-        _PKG_SHORT_ERRORS_SUPPORTED
-        if test $_pkg_short_errors_supported = yes; then
-	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
-        else
-	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
-        fi
-	# Put the nasty error message in config.log where it belongs
-	echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD
-
-	m4_default([$4], [AC_MSG_ERROR(
-[Package requirements ($2) were not met:
-
-$$1_PKG_ERRORS
-
-Consider adjusting the PKG_CONFIG_PATH environment variable if you
-installed software in a non-standard prefix.
-
-_PKG_TEXT])[]dnl
-        ])
-elif test $pkg_failed = untried; then
-        AC_MSG_RESULT([no])
-	m4_default([$4], [AC_MSG_FAILURE(
-[The pkg-config script could not be found or is too old.  Make sure it
-is in your PATH or set the PKG_CONFIG environment variable to the full
-path to pkg-config.
-
-_PKG_TEXT
-
-To get pkg-config, see <http://pkg-config.freedesktop.org/>.])[]dnl
-        ])
-else
-	$1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
-	$1[]_LIBS=$pkg_cv_[]$1[]_LIBS
-        AC_MSG_RESULT([yes])
-	$3
-fi[]dnl
-])dnl PKG_CHECK_MODULES
-
-
-dnl PKG_CHECK_MODULES_STATIC(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
-dnl   [ACTION-IF-NOT-FOUND])
-dnl ---------------------------------------------------------------------
-dnl Since: 0.29
-dnl
-dnl Checks for existence of MODULES and gathers its build flags with
-dnl static libraries enabled. Sets VARIABLE-PREFIX_CFLAGS from --cflags
-dnl and VARIABLE-PREFIX_LIBS from --libs.
-dnl
-dnl Note that if there is a possibility the first call to
-dnl PKG_CHECK_MODULES_STATIC might not happen, you should be sure to
-dnl include an explicit call to PKG_PROG_PKG_CONFIG in your
-dnl configure.ac.
-AC_DEFUN([PKG_CHECK_MODULES_STATIC],
-[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
-_save_PKG_CONFIG=$PKG_CONFIG
-PKG_CONFIG="$PKG_CONFIG --static"
-PKG_CHECK_MODULES($@)
-PKG_CONFIG=$_save_PKG_CONFIG[]dnl
-])dnl PKG_CHECK_MODULES_STATIC
-
-
-dnl PKG_INSTALLDIR([DIRECTORY])
-dnl -------------------------
-dnl Since: 0.27
-dnl
-dnl Substitutes the variable pkgconfigdir as the location where a module
-dnl should install pkg-config .pc files. By default the directory is
-dnl $libdir/pkgconfig, but the default can be changed by passing
-dnl DIRECTORY. The user can override through the --with-pkgconfigdir
-dnl parameter.
-AC_DEFUN([PKG_INSTALLDIR],
-[m4_pushdef([pkg_default], [m4_default([$1], ['${libdir}/pkgconfig'])])
-m4_pushdef([pkg_description],
-    [pkg-config installation directory @<:@]pkg_default[@:>@])
-AC_ARG_WITH([pkgconfigdir],
-    [AS_HELP_STRING([--with-pkgconfigdir], pkg_description)],,
-    [with_pkgconfigdir=]pkg_default)
-AC_SUBST([pkgconfigdir], [$with_pkgconfigdir])
-m4_popdef([pkg_default])
-m4_popdef([pkg_description])
-])dnl PKG_INSTALLDIR
-
-
-dnl PKG_NOARCH_INSTALLDIR([DIRECTORY])
-dnl --------------------------------
-dnl Since: 0.27
-dnl
-dnl Substitutes the variable noarch_pkgconfigdir as the location where a
-dnl module should install arch-independent pkg-config .pc files. By
-dnl default the directory is $datadir/pkgconfig, but the default can be
-dnl changed by passing DIRECTORY. The user can override through the
-dnl --with-noarch-pkgconfigdir parameter.
-AC_DEFUN([PKG_NOARCH_INSTALLDIR],
-[m4_pushdef([pkg_default], [m4_default([$1], ['${datadir}/pkgconfig'])])
-m4_pushdef([pkg_description],
-    [pkg-config arch-independent installation directory @<:@]pkg_default[@:>@])
-AC_ARG_WITH([noarch-pkgconfigdir],
-    [AS_HELP_STRING([--with-noarch-pkgconfigdir], pkg_description)],,
-    [with_noarch_pkgconfigdir=]pkg_default)
-AC_SUBST([noarch_pkgconfigdir], [$with_noarch_pkgconfigdir])
-m4_popdef([pkg_default])
-m4_popdef([pkg_description])
-])dnl PKG_NOARCH_INSTALLDIR
-
-
-dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
-dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
-dnl -------------------------------------------
-dnl Since: 0.28
-dnl
-dnl Retrieves the value of the pkg-config variable for the given module.
-AC_DEFUN([PKG_CHECK_VAR],
-[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
-AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
-
-_PKG_CONFIG([$1], [variable="][$3]["], [$2])
-AS_VAR_COPY([$1], [pkg_cv_][$1])
-
-AS_VAR_IF([$1], [""], [$5], [$4])dnl
-])dnl PKG_CHECK_VAR
-
-m4_include([libtool.m4/libtool.m4])
-m4_include([libtool.m4/ltoptions.m4])
-m4_include([libtool.m4/ltsugar.m4])
-m4_include([libtool.m4/ltversion.m4])
-m4_include([libtool.m4/lt~obsolete.m4])
+Help can also often be found on the BIND Users mailing list
+(https://lists.isc.org/mailman/listinfo/bind-users) or in the #bind
+channel of the Freenode IRC service.]])
@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
 		${ISC_INCLUDES} @DST_OPENSSL_INC@

-CDEFINES = 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
+CDEFINES = 	@CRYPTO@ -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: check-tool.c,v 1.44 2011/12/22 07:32:39 each Exp $ */

 /*! \file */

@@ -98,17 +99,18 @@ isc_boolean_t docheckmx = ISC_FALSE;
 isc_boolean_t dochecksrv = ISC_FALSE;
 isc_boolean_t docheckns = ISC_FALSE;
 #endif
-dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS |
-			     DNS_ZONEOPT_CHECKMX |
-			     DNS_ZONEOPT_MANYERRORS |
-			     DNS_ZONEOPT_CHECKNAMES |
-			     DNS_ZONEOPT_CHECKINTEGRITY |
+unsigned int zone_options = DNS_ZONEOPT_CHECKNS |
+			    DNS_ZONEOPT_CHECKMX |
+			    DNS_ZONEOPT_MANYERRORS |
+			    DNS_ZONEOPT_CHECKNAMES |
+			    DNS_ZONEOPT_CHECKINTEGRITY |
 #if CHECK_SIBLING
-			     DNS_ZONEOPT_CHECKSIBLING |
+			    DNS_ZONEOPT_CHECKSIBLING |
 #endif
-			     DNS_ZONEOPT_CHECKWILDCARD |
-			     DNS_ZONEOPT_WARNMXCNAME |
-			     DNS_ZONEOPT_WARNSRVCNAME;
+			    DNS_ZONEOPT_CHECKWILDCARD |
+			    DNS_ZONEOPT_WARNMXCNAME |
+			    DNS_ZONEOPT_WARNSRVCNAME;
+unsigned int zone_options2 = 0;

 /*
 * This needs to match the list in bin/named/log.c.
@@ -588,7 +590,8 @@ check_ttls(dns_zone_t *zone, dns_ttl_t maxttl) {
 	dns_rdataset_t rdataset;
 	dns_fixedname_t fname;
 	dns_name_t *name;
-	name = dns_fixedname_initname(&fname);
+	dns_fixedname_init(&fname);
+	name = dns_fixedname_name(&fname);
 	dns_rdataset_init(&rdataset);

 	CHECK(dns_zone_getdb(zone, &db));
@@ -683,12 +686,12 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,

 	isc_buffer_constinit(&buffer, zonename, strlen(zonename));
 	isc_buffer_add(&buffer, strlen(zonename));
-	origin = dns_fixedname_initname(&fixorigin);
+	dns_fixedname_init(&fixorigin);
+	origin = dns_fixedname_name(&fixorigin);
 	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
 	CHECK(dns_zone_setorigin(zone, origin));
 	CHECK(dns_zone_setdbtype(zone, 1, (const char * const *) dbtype));
-	CHECK(dns_zone_setfile(zone, filename, fileformat,
-			       &dns_master_style_default));
+	CHECK(dns_zone_setfile2(zone, filename, fileformat));
 	if (journal != NULL)
 		CHECK(dns_zone_setjournal(zone, journal));

@@ -698,6 +701,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,

 	dns_zone_setclass(zone, rdclass);
 	dns_zone_setoption(zone, zone_options, ISC_TRUE);
+	dns_zone_setoption2(zone, zone_options2, ISC_TRUE);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOMERGE, nomerge);

 	dns_zone_setmaxttl(zone, maxttl);
@@ -760,8 +764,8 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 		}
 	}

-	result = dns_zone_dumptostream(zone, output, fileformat, style,
-				       rawversion);
+	result = dns_zone_dumptostream3(zone, output, fileformat, style,
+					rawversion);
 	if (output != stdout)
 		(void)isc_stdio_close(output);

@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: check-tool.h,v 1.18 2011/12/09 23:47:02 tbox Exp $ */

 #ifndef CHECK_TOOL_H
 #define CHECK_TOOL_H
@@ -21,7 +22,6 @@

 #include <dns/masterdump.h>
 #include <dns/types.h>
-#include <dns/zone.h>

 ISC_LANG_BEGINDECLS

@@ -49,7 +49,8 @@ extern isc_boolean_t nomerge;
 extern isc_boolean_t docheckmx;
 extern isc_boolean_t docheckns;
 extern isc_boolean_t dochecksrv;
-extern dns_zoneopt_t zone_options;
+extern unsigned int zone_options;
+extern unsigned int zone_options2;

 ISC_LANG_ENDDECLS

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -136,5 +136,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: named-checkconf.c,v 1.56 2011/03/12 04:59:46 tbox Exp $ */

 /*! \file */

@@ -20,6 +21,7 @@

 #include <isc/commandline.h>
 #include <isc/dir.h>
+#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -406,7 +408,7 @@ configure_zone(const char *vclass, const char *view,
 	obj = NULL;
 	if (get_maps(maps, "max-zone-ttl", &obj)) {
 		maxttl = cfg_obj_asuint32(obj);
-		zone_options |= DNS_ZONEOPT_CHECKTTL;
+		zone_options2 |= DNS_ZONEOPT2_CHECKTTL;
 	}

 	result = load_zone(mctx, zname, zfile, masterformat,
@@ -537,6 +539,7 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t result;
 	int exit_status = 0;
+	isc_entropy_t *ectx = NULL;
 	isc_boolean_t load_zones = ISC_FALSE;
 	isc_boolean_t list_zones = ISC_FALSE;
 	isc_boolean_t print = ISC_FALSE;
@@ -652,6 +655,10 @@ main(int argc, char **argv) {

 	RUNTIME_CHECK(setup_logging(mctx, stdout, &logc) == ISC_R_SUCCESS);

+	RUNTIME_CHECK(isc_entropy_create(mctx, &ectx) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE)
+		      == ISC_R_SUCCESS);
+
 	dns_result_register();

 	RUNTIME_CHECK(cfg_parser_create(mctx, logc, &parser) == ISC_R_SUCCESS);
@@ -682,6 +689,9 @@ main(int argc, char **argv) {

 	isc_log_destroy(&logc);

+	isc_hash_destroy();
+	isc_entropy_detach(&ectx);
+
 	isc_mem_destroy(&mctx);

 #ifdef _WIN32
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -325,5 +325,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004-2007, 2009-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: named-checkzone.c,v 1.65.32.2 2012/02/07 02:45:21 each Exp $ */

 /*! \file */

@@ -19,6 +20,7 @@
 #include <isc/app.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
+#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -45,6 +47,7 @@

 static int quiet = 0;
 static isc_mem_t *mctx = NULL;
+static isc_entropy_t *ectx = NULL;
 dns_zone_t *zone = NULL;
 dns_zonetype_t zonetype = dns_zone_master;
 static int dumpzone = 0;
@@ -257,7 +260,7 @@ main(int argc, char **argv) {
 			break;

 		case 'l':
-			zone_options |= DNS_ZONEOPT_CHECKTTL;
+			zone_options2 |= DNS_ZONEOPT2_CHECKTTL;
 			endp = NULL;
 			maxttl = strtol(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0') {
@@ -519,6 +522,9 @@ main(int argc, char **argv) {
 	if (!quiet)
 		RUNTIME_CHECK(setup_logging(mctx, errout, &lctx)
 			      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_entropy_create(mctx, &ectx) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE)
+		      == ISC_R_SUCCESS);

 	dns_result_register();

@@ -550,6 +556,8 @@ main(int argc, char **argv) {
 	destroy();
 	if (lctx != NULL)
 		isc_log_destroy(&lctx);
+	isc_hash_destroy();
+	isc_entropy_detach(&ectx);
 	isc_mem_destroy(&mctx);
 #ifdef _WIN32
 	DestroySockets();
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004-2007, 2009-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,7 @@
 ddns-confgen \- ddns key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBtsig\-keygen\fR\ 'u
-\fBtsig\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [name]
+\fBtsig\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [name]
 .HP \w'\fBddns\-confgen\fR\ 'u
 \fBddns\-confgen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-q\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\-s\ \fIname\fR | \-z\ \fIzone\fR]
 .SH "DESCRIPTION"
@@ -109,6 +109,17 @@ only\&.) Quiet mode: Print only the key, with no explanatory text or usage examp
 \fBtsig\-keygen\fR\&.
 .RE
 .PP
+\-r \fIrandomfile\fR
+.RS 4
+Specifies a source of random data for generating the authorization\&. If the operating system does not provide a
+/dev/random
+or equivalent device, the default source of randomness is keyboard input\&.
+randomdev
+specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
+keyboard
+indicates that keyboard input should be used\&.
+.RE
+.PP
 \-s \fIname\fR
 .RS 4
 (\fBddns\-confgen\fR
@@ -144,5 +155,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -26,6 +26,7 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -36,7 +37,7 @@
 #include <isc/time.h>
 #include <isc/util.h>

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -66,9 +67,10 @@ usage(int status) {
 	if (progmode == progmode_confgen) {
 		fprintf(stderr, "\
 Usage:\n\
- %s [-a alg] [-k keyname] [-q] [-s name | -z zone]\n\
+ %s [-a alg] [-k keyname] [-r randomfile] [-q] [-s name | -z zone]\n\
  -a alg:        algorithm (default hmac-sha256)\n\
  -k keyname:    name of the key as it will be used in named.conf\n\
+  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
  -s name:       domain name to be updated using the created key\n\
  -z zone:       name of the zone as it will be used in named.conf\n\
  -q:            quiet mode: print the key, with no explanatory text\n",
@@ -76,8 +78,9 @@ Usage:\n\
 	} else {
 		fprintf(stderr, "\
 Usage:\n\
- %s [-a alg] [keyname]\n\
-  -a alg:        algorithm (default hmac-sha256)\n\n",
+ %s [-a alg] [-r randomfile] [keyname]\n\
+  -a alg:        algorithm (default hmac-sha256)\n\
+  -r randomfile: source of random data (use \"keyboard\" for key timing)\n",
 			 progname);
 	}

@@ -92,6 +95,7 @@ main(int argc, char **argv) {
 	isc_buffer_t key_txtbuffer;
 	char key_txtsecret[256];
 	isc_mem_t *mctx = NULL;
+	const char *randomfile = NULL;
 	const char *keyname = NULL;
 	const char *zone = NULL;
 	const char *self_domain = NULL;
@@ -102,7 +106,7 @@ main(int argc, char **argv) {
 	int len = 0;
 	int ch;

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -164,7 +168,7 @@ main(int argc, char **argv) {
 				usage(1);
 			break;
 		case 'r':
-			fatal("The -r option has been deprecated.");
+			randomfile = isc_commandline_argument;
 			break;
 		case 's':
 			if (progmode == progmode_confgen)
@@ -231,7 +235,7 @@ main(int argc, char **argv) {

 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));

-	generate_key(mctx, alg, keysize, &key_txtbuffer);
+	generate_key(mctx, randomfile, alg, keysize, &key_txtbuffer);


 	if (!quiet)
@@ -46,6 +46,7 @@
      <command>tsig-keygen</command>
      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-h</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomfile</replaceable></option></arg>
      <arg choice="opt" rep="norepeat">name</arg>
    </cmdsynopsis>
    <cmdsynopsis sepchar=" ">
@@ -156,6 +157,23 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-r <replaceable class="parameter">randomfile</replaceable></term>
+	<listitem>
+	  <para>
+            Specifies a source of random data for generating the
+            authorization.  If the operating system does not provide a
+            <filename>/dev/random</filename> or equivalent device, the
+            default source of randomness is keyboard input.
+            <filename>randomdev</filename> specifies the name of a
+            character device or file containing random data to be used
+            instead of the default.  The special value
+            <filename>keyboard</filename> indicates that keyboard input
+            should be used.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-s <replaceable class="parameter">name</replaceable></term>
 	<listitem>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -35,6 +35,7 @@
      <code class="command">tsig-keygen</code> 
       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
       [<code class="option">-h</code>]
+       [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>]
       [name]
    </p></div>
    <div class="cmdsynopsis"><p>
@@ -135,6 +136,20 @@
            This is essentially identical to <span class="command"><strong>tsig-keygen</strong></span>.
 	  </p>
 	</dd>
+<dt><span class="term">-r <em class="replaceable"><code>randomfile</code></em></span></dt>
+<dd>
+	  <p>
+            Specifies a source of random data for generating the
+            authorization.  If the operating system does not provide a
+            <code class="filename">/dev/random</code> or equivalent device, the
+            default source of randomness is keyboard input.
+            <code class="filename">randomdev</code> specifies the name of a
+            character device or file containing random data to be used
+            instead of the default.  The special value
+            <code class="filename">keyboard</code> indicates that keyboard input
+            should be used.
+	  </p>
+	</dd>
 <dt><span class="term">-s <em class="replaceable"><code>name</code></em></span></dt>
 <dd>
 	  <p>
@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: os.h,v 1.3 2009/06/11 23:47:55 tbox Exp $ */

 /*! \file */

@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: keygen.c,v 1.4 2009/11/12 14:02:38 marka Exp $ */

 /*! \file */

@@ -19,6 +20,7 @@

 #include <isc/base64.h>
 #include <isc/buffer.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -112,12 +114,17 @@ alg_bits(dns_secalg_t alg) {
 }

 /*%
- * Generate a key of size 'keysize' and place it in 'key_txtbuffer'
+ * Generate a key of size 'keysize' using entropy source 'randomfile',
+ * and place it in 'key_txtbuffer'
 */
 void
-generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
-	     isc_buffer_t *key_txtbuffer) {
+generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
+	     int keysize, isc_buffer_t *key_txtbuffer) {
 	isc_result_t result = ISC_R_SUCCESS;
+	isc_entropysource_t *entropy_source = NULL;
+	int open_keyboard = ISC_ENTROPY_KEYBOARDMAYBE;
+	int entropy_flags = 0;
+	isc_entropy_t *ectx = NULL;
 	isc_buffer_t key_rawbuffer;
 	isc_region_t key_rawregion;
 	char key_rawsecret[64];
@@ -144,12 +151,31 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 		fatal("unsupported algorithm %d\n", alg);
 	}

-	DO("initialize dst library", dst_lib_init(mctx, NULL));
+
+	DO("create entropy context", isc_entropy_create(mctx, &ectx));
+
+#ifdef ISC_PLATFORM_CRYPTORANDOM
+	if (randomfile == NULL) {
+		isc_entropy_usehook(ectx, ISC_TRUE);
+	}
+#endif
+	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
+		randomfile = NULL;
+		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
+	}
+	DO("start entropy source", isc_entropy_usebestsource(ectx,
+							     &entropy_source,
+							     randomfile,
+							     open_keyboard));
+
+	entropy_flags = ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY;
+
+	DO("initialize dst library", dst_lib_init(mctx, ectx, entropy_flags));

 	DO("generate key", dst_key_generate(dns_rootname, alg,
-					    keysize, 0, 0, DNS_KEYPROTO_ANY,
-					    dns_rdataclass_in, mctx, &key,
-					    NULL));
+					    keysize, 0, 0,
+					    DNS_KEYPROTO_ANY,
+					    dns_rdataclass_in, mctx, &key));

 	isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));

@@ -160,9 +186,17 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 	DO("bsse64 encode secret", isc_base64_totext(&key_rawregion, -1, "",
 						     key_txtbuffer));

+	/*
+	 * Shut down the entropy source now so the "stop typing" message
+	 * does not muck with the output.
+	 */
+	if (entropy_source != NULL)
+		isc_entropy_destroysource(&entropy_source);
+
 	if (key != NULL)
 		dst_key_free(&key);

+	isc_entropy_detach(&ectx);
 	dst_lib_destroy();
 }

@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: keygen.h,v 1.3 2009/06/11 23:47:55 tbox Exp $ */

 #ifndef RNDC_KEYGEN_H
 #define RNDC_KEYGEN_H 1
@@ -19,8 +20,8 @@

 ISC_LANG_BEGINDECLS

-void generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
-		  isc_buffer_t *key_txtbuffer);
+void generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
+		  int keysize, isc_buffer_t *key_txtbuffer);

 void write_key_file(const char *keyfile, const char *user,
 		    const char *keyname, isc_buffer_t *secret,
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,7 @@
 rndc-confgen \- rndc key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBrndc\-confgen\fR\ 'u
-\fBrndc\-confgen\fR [\fB\-a\fR] [\fB\-A\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-c\ \fR\fB\fIkeyfile\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\ \fR\fB\fIaddress\fR\fR] [\fB\-t\ \fR\fB\fIchrootdir\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR]
+\fBrndc\-confgen\fR [\fB\-a\fR] [\fB\-A\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-c\ \fR\fB\fIkeyfile\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\fB\-s\ \fR\fB\fIaddress\fR\fR] [\fB\-t\ \fR\fB\fIchrootdir\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR]
 .SH "DESCRIPTION"
 .PP
 \fBrndc\-confgen\fR
@@ -147,6 +147,17 @@ listens for connections from
 \fBrndc\fR\&. The default is 953\&.
 .RE
 .PP
+\-r \fIrandomfile\fR
+.RS 4
+Specifies a source of random data for generating the authorization\&. If the operating system does not provide a
+/dev/random
+or equivalent device, the default source of randomness is keyboard input\&.
+randomdev
+specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
+keyboard
+indicates that keyboard input should be used\&.
+.RE
+.PP
 \-s \fIaddress\fR
 .RS 4
 Specifies the IP address where
@@ -206,5 +217,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -29,6 +29,7 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -69,7 +70,7 @@ usage(int status) {

 	fprintf(stderr, "\
 Usage:\n\
- %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] \
+ %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
 [-s addr] [-t chrootdir] [-u user]\n\
  -a:		 generate just the key clause and write it to keyfile (%s)\n\
  -A alg:	 algorithm (default hmac-sha256)\n\
@@ -77,6 +78,7 @@ Usage:\n\
  -c keyfile:	 specify an alternate key file (requires -a)\n\
  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
  -p port:	 the port named will listen on and rndc will connect to\n\
+  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
  -s addr:	 the address to which rndc should connect\n\
  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
@@ -93,6 +95,7 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	const char *keyname = NULL;
+	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
 	const char *algname;
@@ -162,7 +165,7 @@ main(int argc, char **argv) {
 				      isc_commandline_argument);
 			break;
 		case 'r':
-			fatal("The -r option has been deprecated.");
+			randomfile = isc_commandline_argument;
 			break;
 		case 's':
 			serveraddr = isc_commandline_argument;
@@ -214,7 +217,7 @@ main(int argc, char **argv) {
 	DO("create memory context", isc_mem_create(0, 0, &mctx));
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));

-	generate_key(mctx, alg, keysize, &key_txtbuffer);
+	generate_key(mctx, randomfile, alg, keysize, &key_txtbuffer);

 	if (keyonly) {
 		write_key_file(keyfile, chrootdir == NULL ? user : NULL,
@@ -58,6 +58,7 @@
      <arg choice="opt" rep="norepeat"><option>-h</option></arg>
      <arg choice="opt" rep="norepeat"><option>-k <replaceable class="parameter">keyname</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">port</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomfile</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">address</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">chrootdir</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-u <replaceable class="parameter">user</replaceable></option></arg>
@@ -190,6 +191,24 @@
        </listitem>
      </varlistentry>

+      <varlistentry>
+        <term>-r <replaceable class="parameter">randomfile</replaceable></term>
+        <listitem>
+          <para>
+            Specifies a source of random data for generating the
+            authorization.  If the operating
+            system does not provide a <filename>/dev/random</filename>
+            or equivalent device, the default source of randomness
+            is keyboard input.  <filename>randomdev</filename>
+            specifies
+            the name of a character device or file containing random
+            data to be used instead of the default.  The special value
+            <filename>keyboard</filename> indicates that keyboard
+            input should be used.
+          </para>
+        </listitem>
+      </varlistentry>
+
      <varlistentry>
        <term>-s <replaceable class="parameter">address</replaceable></term>
        <listitem>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -40,6 +40,7 @@
       [<code class="option">-h</code>]
       [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>]
       [<code class="option">-p <em class="replaceable"><code>port</code></em></code>]
+       [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>]
       [<code class="option">-s <em class="replaceable"><code>address</code></em></code>]
       [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>]
       [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]
@@ -153,6 +154,21 @@
            The default is 953.
          </p>
        </dd>
+<dt><span class="term">-r <em class="replaceable"><code>randomfile</code></em></span></dt>
+<dd>
+          <p>
+            Specifies a source of random data for generating the
+            authorization.  If the operating
+            system does not provide a <code class="filename">/dev/random</code>
+            or equivalent device, the default source of randomness
+            is keyboard input.  <code class="filename">randomdev</code>
+            specifies
+            the name of a character device or file containing random
+            data to be used instead of the default.  The special value
+            <code class="filename">keyboard</code> indicates that keyboard
+            input should be used.
+          </p>
+        </dd>
 <dt><span class="term">-s <em class="replaceable"><code>address</code></em></span></dt>
 <dd>
          <p>
@@ -7,6 +7,8 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+# $Id: Makefile.in,v 1.3 2009/06/11 23:47:55 tbox Exp $
+
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: os.c,v 1.3 2009/06/11 23:47:55 tbox Exp $ */

 /*! \file */

@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: util.c,v 1.3 2009/06/11 23:47:55 tbox Exp $ */

 /*! \file */

@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: util.h,v 1.4 2009/09/29 15:06:05 fdupont Exp $ */

 #ifndef RNDC_UTIL_H
 #define RNDC_UTIL_H 1
@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: os.c,v 1.3 2009/06/11 23:47:55 tbox Exp $ */

 #include <config.h>

@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${ISC_INCLUDES} \
 		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @DST_OPENSSL_INC@

-CDEFINES =	-DVERSION=\"${VERSION}\" \
+CDEFINES =	@CRYPTO@ -DVERSION=\"${VERSION}\" \
 		-DSYSCONFDIR=\"${sysconfdir}\"
 CWARNINGS =

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -437,5 +437,5 @@ RFC5155\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -521,17 +521,17 @@ setup_style(dns_master_style_t **stylep) {
 	}

 	if (multiline || (nottl && noclass))
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 24, 24, 32, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 24, 24, 32, 80, 8,
+						 splitwidth, mctx);
 	else if (nottl || noclass)
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 24, 32, 40, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 24, 32, 40, 80, 8,
+						 splitwidth, mctx);
 	else
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 32, 40, 48, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 32, 40, 48, 80, 8,
+						 splitwidth, mctx);

 	if (result == ISC_R_SUCCESS)
 		*stylep = style;
@@ -550,7 +550,8 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {

 	isc_buffer_constinit(&b, text, len);
 	isc_buffer_add(&b, len);
-	n = dns_fixedname_initname(fn);
+	dns_fixedname_init(fn);
+	n = dns_fixedname_name(fn);

 	result = dns_name_fromtext(n, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
@@ -943,6 +944,18 @@ cleanup:
 	return (result);
 }

+static char *
+next_token(char **stringp, const char *delim) {
+	char *res;
+
+	do {
+		res = strsep(stringp, delim);
+		if (res == NULL)
+			break;
+	} while (*res == '\0');
+	return (res);
+}
+
 static isc_result_t
 parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc) {
@@ -962,23 +975,23 @@ parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 static void
 plus_option(char *option) {
 	isc_result_t result;
-	char *cmd, *value, *last = NULL;
+	char option_store[256];
+	char *cmd, *value, *ptr;
 	isc_boolean_t state = ISC_TRUE;

-	INSIST(option != NULL);
-
-	cmd = strtok_r(option, "=", &last);
+	strlcpy(option_store, option, sizeof(option_store));
+	ptr = option_store;
+	cmd = next_token(&ptr,"=");
 	if (cmd == NULL) {
-		printf(";; Invalid option %s\n", option);
+		printf(";; Invalid option %s\n", option_store);
 		return;
 	}
+	value = ptr;
 	if (strncasecmp(cmd, "no", 2)==0) {
 		cmd += 2;
 		state = ISC_FALSE;
 	}

-	value = strtok_r(NULL, "\0", &last);
-
 #define FULLCHECK(A) \
 	do { \
 		size_t _l = strlen(cmd); \
@@ -1525,8 +1538,9 @@ get_reverse(char *reverse, size_t len, char *value, isc_boolean_t strict) {
 		dns_name_t *name;
 		unsigned int options = 0;

-		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname(&addr, options, name);
+		dns_fixedname_init(&fname);
+		name = dns_fixedname_name(&fname);
+		result = dns_byaddr_createptrname2(&addr, options, name);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		dns_name_format(name, reverse, (unsigned int)len);
@@ -1610,8 +1624,8 @@ main(int argc, char *argv[]) {

 	/* Create client */
 	clopt = DNS_CLIENTCREATEOPT_USECACHE;
-	result = dns_client_createx(mctx, actx, taskmgr, socketmgr, timermgr,
-				    clopt, &client, srcaddr4, srcaddr6);
+	result = dns_client_createx2(mctx, actx, taskmgr, socketmgr, timermgr,
+				     clopt, &client, srcaddr4, srcaddr6);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
 			  isc_result_totext(result));
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -21,7 +21,7 @@ CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
 		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @DST_OPENSSL_INC@

-CDEFINES =	-DVERSION=\"${VERSION}\"
+CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@
 CWARNINGS =

 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -176,7 +176,7 @@ using the command\-line interface\&.
 .PP
 \-i
 .RS 4
-Do reverse IPv6 lookups using the obsolete RFC 1886 IP6\&.INT domain, which is no longer in use\&. Obsolete bit string label queries (RFC 2874) are not attempted\&.
+Do reverse IPv6 lookups using the obsolete RFC1886 IP6\&.INT domain, which is no longer in use\&. Obsolete bit string label queries (RFC2874) are not attempted\&.
 .RE
 .PP
 \-k \fIkeyfile\fR
@@ -210,15 +210,13 @@ from other arguments\&.
 .PP
 \-t \fItype\fR
 .RS 4
-The resource record type to query\&. It can be any valid query type\&. If it is a resource record type supported in BIND 9, it can be given by the type mnemonic (such as "NS" or "AAAA")\&. The default query type is "A", unless the
+The resource record type to query\&. It can be any valid query type which is supported in BIND 9\&. The default query type is "A", unless the
 \fB\-x\fR
 option is supplied to indicate a reverse lookup\&. A zone transfer can be requested by specifying a type of AXFR\&. When an incremental zone transfer (IXFR) is required, set the
 \fItype\fR
 to
 ixfr=N\&. The incremental zone transfer will contain the changes made to the zone since the serial number in the zone\*(Aqs SOA record was
 \fIN\fR\&.
-.sp
-All resource record types can be expressed as "TYPEnn", where "nn" is the number of the type\&. If the resource record type is not supported in BIND 9, the result will be displayed as described in RFC 3597\&.
 .RE
 .PP
 \-u
@@ -466,11 +464,6 @@ Show [or do not show] the IP address and port number that supplied the answer wh
 option is enabled\&. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer\&.
 .RE
 .PP
-\fB+[no]idnin\fR
-.RS 4
-Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to process IDN input\&.
-.RE
-.PP
 \fB+[no]idnout\fR
 .RS 4
 Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to convert output\&.
@@ -532,7 +525,7 @@ Include an EDNS name server ID request when sending a query\&.
 .RS 4
 When this option is set,
 \fBdig\fR
-attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone\&. Addresses of servers that that did not respond are also printed\&.
+attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone\&.
 .RE
 .PP
 \fB+[no]onesoa\fR
@@ -564,11 +557,6 @@ Print [do not print] the query as it is sent\&. By default, the query is not pri
 Print [do not print] the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
 .RE
 .PP
-\fB+[no]raflag\fR
-.RS 4
-Set [do not set] the RA (Recursion Available) bit in the query\&. The default is +noraflag\&. This bit should be ignored by the server for QUERY\&.
-.RE
-.PP
 \fB+[no]rdflag\fR
 .RS 4
 A synonym for
@@ -658,11 +646,6 @@ for short, sends an EDNS CLIENT\-SUBNET option with an empty address and a sourc
 be used when resolving this query\&.
 .RE
 .PP
-\fB+[no]tcflag\fR
-.RS 4
-Set [do not set] the TC (TrunCation) bit in the query\&. The default is +notcflag\&. This bit should be ignored by the server for QUERY\&.
-.RE
-.PP
 \fB+[no]tcp\fR
 .RS 4
 Use [do not use] TCP when querying name servers\&. The default behavior is to use UDP unless a type
@@ -792,10 +775,11 @@ If
 \fBdig\fR
 has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
 \fBdig\fR
-appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, use parameters
-\fI+noidnin\fR
-and
-\fI+noidnout\fR\&.
+appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, defines the
+\fBIDN_DISABLE\fR
+environment variable\&. The IDN support is disabled if the variable is set when
+\fBdig\fR
+runs\&.
 .SH "FILES"
 .PP
 /etc/resolv\&.conf
@@ -807,7 +791,7 @@ ${HOME}/\&.digrc
 \fBhost\fR(1),
 \fBnamed\fR(8),
 \fBdnssec-keygen\fR(8),
-RFC 1035\&.
+RFC1035\&.
 .SH "BUGS"
 .PP
 There are probably too many query options\&.
@@ -205,7 +205,6 @@ help(void) {
 "                 +padding=###        (Set padding block size [0])\n"
 "                 +[no]qr             (Print question before sending)\n"
 "                 +[no]question       (Control display of question section)\n"
-"                 +[no]raflag         (Set RA flag in query (+[no]raflag))\n"
 "                 +[no]rdflag         (Recursive mode (+[no]recurse))\n"
 "                 +[no]recurse        (Recursive mode (+[no]rdflag))\n"
 "                 +retry=###          (Set number of UDP retries) [2]\n"
@@ -218,7 +217,6 @@ help(void) {
 "                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
 "                 +[no]stats          (Control display of statistics)\n"
 "                 +subnet=addr        (Set edns-client-subnet option)\n"
-"                 +[no]tcflag         (Set TC flag in query (+[no]tcflag))\n"
 "                 +[no]tcp            (TCP mode (+[no]vc))\n"
 "                 +timeout=###        (Set query timeout) [5]\n"
 "                 +[no]trace          (Trace delegation down from root [+dnssec])\n"
@@ -287,12 +285,12 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		} else {
 			printf(";; MSG SIZE  rcvd: %u\n", bytes);
 		}
-		if (tsigkey != NULL) {
+		if (key != NULL) {
 			if (!validated)
 				puts(";; WARNING -- Some TSIG could not "
 				     "be validated");
 		}
-		if ((tsigkey == NULL) && (keysecret[0] != 0)) {
+		if ((key == NULL) && (keysecret[0] != 0)) {
 			puts(";; WARNING -- TSIG key was not used.");
 		}
 		puts("");
@@ -482,17 +480,17 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	}
 	if (query->lookup->multiline ||
 	    (query->lookup->nottl && query->lookup->noclass))
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 24, 24, 32, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 24, 24, 32, 80, 8,
+						 splitwidth, mctx);
 	else if (query->lookup->nottl || query->lookup->noclass)
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 24, 32, 40, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 24, 32, 40, 80, 8,
+						 splitwidth, mctx);
 	else
-		result = dns_master_stylecreate(&style, styleflags,
-						24, 32, 40, 48, 80, 8,
-						splitwidth, mctx);
+		result = dns_master_stylecreate2(&style, styleflags,
+						 24, 32, 40, 48, 80, 8,
+						 splitwidth, mctx);
 	check_result(result, "dns_master_stylecreate");

 	if (query->lookup->cmdline[0] != 0) {
@@ -731,27 +729,28 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 */

 static void
-plus_option(char *option, isc_boolean_t is_batchfile,
+plus_option(const char *option, isc_boolean_t is_batchfile,
 	    dig_lookup_t *lookup)
 {
 	isc_result_t result;
-	char *cmd, *value, *last = NULL, *code, *extra;
+	char option_store[256];
+	char *cmd, *value, *ptr, *code;
 	isc_uint32_t num;
 	isc_boolean_t state = ISC_TRUE;
 	size_t n;

-	INSIST(option != NULL);
-
-	if ((cmd = strtok_r(option, "=", &last)) == NULL) {
-		printf(";; Invalid option %s\n", option);
+	strlcpy(option_store, option, sizeof(option_store));
+	ptr = option_store;
+	cmd = next_token(&ptr, "=");
+	if (cmd == NULL) {
+		printf(";; Invalid option %s\n", option_store);
 		return;
 	}
+	value = ptr;
 	if (strncasecmp(cmd, "no", 2)==0) {
 		cmd += 2;
 		state = ISC_FALSE;
 	}
-	/* parse the rest of the string */
-	value = strtok_r(NULL, "", &last);

 #define FULLCHECK(A) \
 	do { \
@@ -1007,9 +1006,8 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 							     "specified");
 							goto exit_or_usage;
 						}
-						code = strtok_r(value, ":", &last);
-						extra = strtok_r(NULL, "\0", &last);
-						save_opt(lookup, code, extra);
+						code = next_token(&value, ":");
+						save_opt(lookup, code, value);
 						break;
 					default:
 						goto invalid_option;
@@ -1053,7 +1051,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 					FULLCHECK("idnin");
 #ifndef WITH_IDN_SUPPORT
 					fprintf(stderr, ";; IDN input support"
-						" not enabled\n");
+					        " not enabled\n");
 #else
 					lookup->idnin = state;
 #endif
@@ -1062,7 +1060,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 					FULLCHECK("idnout");
 #ifndef WITH_IDN_OUT_SUPPORT
 					fprintf(stderr, ";; IDN output support"
-						" not enabled\n");
+					        " not enabled\n");
 #else
 					lookup->idnout = state;
 #endif
@@ -1244,10 +1242,6 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 		break;
 	case 'r':
 		switch (cmd[1]) {
-		case 'a': /* raflag */
-			FULLCHECK("raflag");
-			lookup->raflag = state;
-			break;
 		case 'd': /* rdflag */
 			FULLCHECK("rdflag");
 			lookup->recurse = state;
@@ -1391,20 +1385,10 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 	case 't':
 		switch (cmd[1]) {
 		case 'c': /* tcp */
-			switch (cmd[2]) {
-			case 'f':
-				FULLCHECK("tcflag");
-				lookup->tcflag = state;
-				break;
-			case 'p':
-				FULLCHECK("tcp");
-				if (!is_batchfile) {
-					lookup->tcp_mode = state;
-					lookup->tcp_mode_set = ISC_TRUE;
-				}
-				break;
-			default:
-				goto invalid_option;
+			FULLCHECK("tcp");
+			if (!is_batchfile) {
+				lookup->tcp_mode = state;
+				lookup->tcp_mode_set = ISC_TRUE;
 			}
 			break;
 		case 'i': /* timeout */
@@ -1540,7 +1524,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 	    isc_boolean_t config_only, int argc, char **argv,
 	    isc_boolean_t *firstarg)
 {
-	char opt, *value, *ptr, *ptr2, *ptr3, *last;
+	char opt, *value, *ptr, *ptr2, *ptr3;
 	isc_result_t result;
 	isc_boolean_t value_from_next;
 	isc_textregion_t tr;
@@ -1754,13 +1738,15 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				 value);
 		return (value_from_next);
 	case 'y':
-		if ((ptr = strtok_r(value, ":", &last)) == NULL) {
+		ptr = next_token(&value, ":");	/* hmac type or name */
+		if (ptr == NULL) {
 			usage();
 		}
-		if ((ptr2 = strtok_r(NULL, ":", &last)) == NULL) {	/* name or secret */
+		ptr2 = next_token(&value, ":");	/* name or secret */
+		if (ptr2 == NULL)
 			usage();
-		}
-		if ((ptr3 = strtok_r(NULL, ":", &last)) != NULL) { /* secret or NULL */
+		ptr3 = next_token(&value, ":"); /* secret or NULL */
+		if (ptr3 != NULL) {
 			parse_hmac(ptr);
 			ptr = ptr2;
 			ptr2 = ptr3;
@@ -1772,7 +1758,6 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 #endif
 			digestbits = 0;
 		}
-		/* XXXONDREJ: FIXME */
 		strlcpy(keynametext, ptr, sizeof(keynametext));
 		strlcpy(keysecret, ptr2, sizeof(keysecret));
 		return (value_from_next);
@@ -1856,22 +1841,6 @@ preparse_args(int argc, char **argv) {
 	}
 }

-static int
-split_batchline(char *batchline, char **bargv, int len, const char *msg) {
-	int bargc;
-	char *last = NULL;
-
-	REQUIRE(batchline != NULL);
-
-	for (bargc = 1, bargv[bargc] = strtok_r(batchline, " \t\r\n", &last);
-	     bargc < len && bargv[bargc];
-	     bargv[++bargc] = strtok_r(NULL,  " \t\r\n", &last))
-	{
-		debug("%s %d: %s", msg, bargc, bargv[bargc]);
-	}
-	return (bargc);
-}
-
 static void
 parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 	   int argc, char **argv)
@@ -1890,8 +1859,10 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 	char **rv;
 #ifndef NOPOSIX
 	char *homedir;
-	char rcfile[PATH_MAX];
+	char rcfile[256];
 #endif
+	char *input;
+	int i;
 	isc_boolean_t need_clone = ISC_TRUE;

 	/*
@@ -1923,21 +1894,30 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			unsigned int n;
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
 				     homedir);
-			if (n < sizeof(rcfile)) {
+			if (n < sizeof(rcfile))
 				batchfp = fopen(rcfile, "r");
-			}
 		}
 		if (batchfp != NULL) {
 			while (fgets(batchline, sizeof(batchline),
-				     batchfp) != 0)
-			{
+				     batchfp) != 0) {
 				debug("config line %s", batchline);
-				bargc = split_batchline(batchline, bargv, 62,
-							".digrc argv");
+				bargc = 1;
+				input = batchline;
+				bargv[bargc] = next_token(&input, " \t\r\n");
+				while ((bargc < 62) && (bargv[bargc] != NULL)) {
+					bargc++;
+					bargv[bargc] =
+						next_token(&input, " \t\r\n");
+				}
+
 				bargv[0] = argv[0];
 				argv0 = argv[0];
-				parse_args(ISC_TRUE, ISC_TRUE,
-					   bargc, (char **)bargv);
+
+				for(i = 0; i < bargc; i++)
+					debug(".digrc argv %d: %s",
+					      i, bargv[i]);
+				parse_args(ISC_TRUE, ISC_TRUE, bargc,
+					   (char **)bargv);
 			}
 			fclose(batchfp);
 		}
@@ -1948,9 +1928,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		/* Processing '-f batchfile'. */
 		lookup = clone_lookup(default_lookup, ISC_TRUE);
 		need_clone = ISC_FALSE;
-	} else {
+	} else
 		lookup = default_lookup;
-	}

 	rc = argc;
 	rv = argv;
@@ -2117,14 +2096,23 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		/* XXX Remove code dup from shutdown code */
 	next_line:
 		if (fgets(batchline, sizeof(batchline), batchfp) != 0) {
+			bargc = 1;
 			debug("batch line %s", batchline);
-			if (batchline[0] == '\r' || batchline[0] == '\n' ||
-			    batchline[0] == '#' || batchline[0] == ';')
+			if (batchline[0] == '\r' || batchline[0] == '\n'
+			    || batchline[0] == '#' || batchline[0] == ';')
 				goto next_line;
-			bargc = split_batchline(batchline, bargv, 14,
-						"batch argv");
+			input = batchline;
+			bargv[bargc] = next_token(&input, " \t\r\n");
+			while ((bargc < 14) && (bargv[bargc] != NULL)) {
+				bargc++;
+				bargv[bargc] = next_token(&input, " \t\r\n");
+			}
+
 			bargv[0] = argv[0];
 			argv0 = argv[0];
+
+			for(i = 0; i < bargc; i++)
+				debug("batch argv %d: %s", i, bargv[i]);
 			parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 			return;
 		}
@@ -2163,6 +2151,8 @@ query_finished(void) {
 	char batchline[MXNAME];
 	int bargc;
 	char *bargv[16];
+	char *input;
+	int i;

 	if (batchname == NULL) {
 		isc_app_shutdown();
@@ -2180,8 +2170,18 @@ query_finished(void) {

 	if (fgets(batchline, sizeof(batchline), batchfp) != 0) {
 		debug("batch line %s", batchline);
-		bargc = split_batchline(batchline, bargv, 14, "batch argv");
+		bargc = 1;
+		input = batchline;
+		bargv[bargc] = next_token(&input, " \t\r\n");
+		while ((bargc < 14) && (bargv[bargc] != NULL)) {
+			bargc++;
+			bargv[bargc] = next_token(&input, " \t\r\n");
+		}
+
 		bargv[0] = argv0;
+
+		for(i = 0; i < bargc; i++)
+			debug("batch argv %d: %s", i, bargv[i]);
 		parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 		start_lookup();
 	} else {
@@ -275,9 +275,9 @@
 	<term>-i</term>
 	<listitem>
 	  <para>
-	    Do reverse IPv6 lookups using the obsolete RFC 1886 IP6.INT
+	    Do reverse IPv6 lookups using the obsolete RFC1886 IP6.INT
 	    domain, which is no longer in use. Obsolete bit string
-	    label queries (RFC 2874) are not attempted.
+	    label queries (RFC2874) are not attempted.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -338,12 +338,11 @@
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>
 	  <para>
-	    The resource record type to query. It can be any valid query
-	    type.  If it is a resource record type supported in BIND 9, it
-	    can be given by the type mnemonic (such as "NS" or "AAAA").
-	    The default query type is "A", unless the <option>-x</option>
-	    option is supplied to indicate a reverse lookup.  A zone
-	    transfer can be requested by specifying a type of AXFR.  When
+	    The resource record type to query. It can be any valid query type
+	    which is
+	    supported in BIND 9.  The default query type is "A", unless the
+	    <option>-x</option> option is supplied to indicate a reverse lookup.
+	    A zone transfer can be requested by specifying a type of AXFR.  When
 	    an incremental zone transfer (IXFR) is required, set the
 	    <parameter>type</parameter> to <literal>ixfr=N</literal>.
 	    The incremental zone transfer will contain the changes
@@ -351,12 +350,6 @@
 	    record was
 	    <parameter>N</parameter>.
 	  </para>
-	  <para>
-	    All resource record types can be expressed as "TYPEnn", where
-	    "nn" is the number of the type. If the resource record type is
-	    not supported in BIND 9, the result will be displayed as
-	    described in RFC 3597.
-	  </para>
 	</listitem>
      </varlistentry>

@@ -960,17 +953,6 @@
 	  </listitem>
 	</varlistentry>

-	<varlistentry>
-	  <term><option>+[no]raflag</option></term>
-	  <listitem>
-	    <para>
-	      Set [do not set] the RA (Recursion Available) bit in
-	      the query. The default is +noraflag. This bit should
-	      be ignored by the server for QUERY.
-	    </para>
-	  </listitem>
-	</varlistentry>
-
 	<varlistentry>
 	  <term><option>+[no]rdflag</option></term>
 	  <listitem>
@@ -1062,7 +1044,7 @@
 	  <listitem>
 	    <para>
 	      This feature is now obsolete and has been removed;
-	      use <command>delv</command> instead.
+              use <command>delv</command> instead.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1114,17 +1096,6 @@
 	  </listitem>
 	</varlistentry>

-	<varlistentry>
-	  <term><option>+[no]tcflag</option></term>
-	  <listitem>
-	    <para>
-	      Set [do not set] the TC (TrunCation) bit in the query.
-	      The default is +notcflag.  This bit should be ignored
-	      by the server for QUERY.
-	    </para>
-	  </listitem>
-	</varlistentry>
-
 	<varlistentry>
 	  <term><option>+[no]tcp</option></term>
 	  <listitem>
@@ -1158,8 +1129,8 @@
 	  <listitem>
 	    <para>
 	      This feature is related to <command>dig +sigchase</command>,
-	      which is obsolete and has been removed. Use
-	      <command>delv</command> instead.
+              which is obsolete and has been removed. Use
+              <command>delv</command> instead.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1204,9 +1175,9 @@
 	  <listitem>
 	    <para>
 	      Formerly specified trusted keys for use with
-	      <command>dig +sigchase</command>.  This feature is now
-	      obsolete and has been removed; use
-	      <command>delv</command> instead.
+              <command>dig +sigchase</command>.  This feature is now
+              obsolete and has been removed; use
+              <command>delv</command> instead.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1328,7 +1299,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
      <command>dig</command> appropriately converts character encoding of
      domain name before sending a request to DNS server or displaying a
      reply from the server.
-      If you'd like to turn off the IDN support for some reason, use
+      If you'd like to turn off the IDN support for some reason, use 
      parameters <parameter>+noidnin</parameter> and
      <parameter>+noidnout</parameter>.
    </para>
@@ -1356,7 +1327,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
      <citerefentry>
 	<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
-      <citetitle>RFC 1035</citetitle>.
+      <citetitle>RFC1035</citetitle>.
    </para>
  </refsection>

@@ -230,9 +230,9 @@
 <dt><span class="term">-i</span></dt>
 <dd>
 	  <p>
-	    Do reverse IPv6 lookups using the obsolete RFC 1886 IP6.INT
+	    Do reverse IPv6 lookups using the obsolete RFC1886 IP6.INT
 	    domain, which is no longer in use. Obsolete bit string
-	    label queries (RFC 2874) are not attempted.
+	    label queries (RFC2874) are not attempted.
 	  </p>
 	</dd>
 <dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
@@ -277,12 +277,11 @@
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
 	  <p>
-	    The resource record type to query. It can be any valid query
-	    type.  If it is a resource record type supported in BIND 9, it
-	    can be given by the type mnemonic (such as "NS" or "AAAA").
-	    The default query type is "A", unless the <code class="option">-x</code>
-	    option is supplied to indicate a reverse lookup.  A zone
-	    transfer can be requested by specifying a type of AXFR.  When
+	    The resource record type to query. It can be any valid query type
+	    which is
+	    supported in BIND 9.  The default query type is "A", unless the
+	    <code class="option">-x</code> option is supplied to indicate a reverse lookup.
+	    A zone transfer can be requested by specifying a type of AXFR.  When
 	    an incremental zone transfer (IXFR) is required, set the
 	    <em class="parameter"><code>type</code></em> to <code class="literal">ixfr=N</code>.
 	    The incremental zone transfer will contain the changes
@@ -290,12 +289,6 @@
 	    record was
 	    <em class="parameter"><code>N</code></em>.
 	  </p>
-	  <p>
-	    All resource record types can be expressed as "TYPEnn", where
-	    "nn" is the number of the type. If the resource record type is
-	    not supported in BIND 9, the result will be displayed as
-	    described in RFC 3597.
-	  </p>
 	</dd>
 <dt><span class="term">-u</span></dt>
 <dd>
@@ -626,14 +619,6 @@
 	      server that provided the answer.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]idnin</code></span></dt>
-<dd>
-	    <p>
-	      Process [do not process] IDN domain names on input.
-	      This requires IDN SUPPORT to have been enabled at
-	      compile time.  The default is to process IDN input.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]idnout</code></span></dt>
 <dd>
 	    <p>
@@ -710,8 +695,7 @@
 	      attempts to find the authoritative name servers for
 	      the zone containing the name being looked up and
 	      display the SOA record that each name server has for
-	      the zone. Addresses of servers that that did not
-	      respond are also printed.
+	      the zone.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]onesoa</code></span></dt>
@@ -758,14 +742,6 @@
 	      the question section as a comment.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]raflag</code></span></dt>
-<dd>
-	    <p>
-	      Set [do not set] the RA (Recursion Available) bit in
-	      the query. The default is +noraflag. This bit should
-	      be ignored by the server for QUERY.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]rdflag</code></span></dt>
 <dd>
 	    <p>
@@ -835,7 +811,7 @@
 <dd>
 	    <p>
 	      This feature is now obsolete and has been removed;
-	      use <span class="command"><strong>delv</strong></span> instead.
+              use <span class="command"><strong>delv</strong></span> instead.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+split=W</code></span></dt>
@@ -876,14 +852,6 @@
 	      this query.
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+[no]tcflag</code></span></dt>
-<dd>
-	    <p>
-	      Set [do not set] the TC (TrunCation) bit in the query.
-	      The default is +notcflag.  This bit should be ignored
-	      by the server for QUERY.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
 <dd>
 	    <p>
@@ -910,8 +878,8 @@
 <dd>
 	    <p>
 	      This feature is related to <span class="command"><strong>dig +sigchase</strong></span>,
-	      which is obsolete and has been removed. Use
-	      <span class="command"><strong>delv</strong></span> instead.
+              which is obsolete and has been removed. Use
+              <span class="command"><strong>delv</strong></span> instead.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]trace</code></span></dt>
@@ -947,9 +915,9 @@
 <dd>
 	    <p>
 	      Formerly specified trusted keys for use with
-	      <span class="command"><strong>dig +sigchase</strong></span>.  This feature is now
-	      obsolete and has been removed; use
-	      <span class="command"><strong>delv</strong></span> instead.
+              <span class="command"><strong>dig +sigchase</strong></span>.  This feature is now
+              obsolete and has been removed; use
+              <span class="command"><strong>delv</strong></span> instead.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]ttlid</code></span></dt>
@@ -1059,9 +1027,10 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
      <span class="command"><strong>dig</strong></span> appropriately converts character encoding of
      domain name before sending a request to DNS server or displaying a
      reply from the server.
-      If you'd like to turn off the IDN support for some reason, use
-      parameters <em class="parameter"><code>+noidnin</code></em> and
-      <em class="parameter"><code>+noidnout</code></em>.
+      If you'd like to turn off the IDN support for some reason, defines
+      the <code class="envar">IDN_DISABLE</code> environment variable.
+      The IDN support is disabled if the variable is set when
+      <span class="command"><strong>dig</strong></span> runs.
    </p>
  </div>

@@ -1089,7 +1058,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
      <span class="citerefentry">
 	<span class="refentrytitle">dnssec-keygen</span>(8)
      </span>,
-      <em class="citetitle">RFC 1035</em>.
+      <em class="citetitle">RFC1035</em>.
    </p>
  </div>

@@ -57,13 +57,13 @@

 #include <isc/app.h>
 #include <isc/base64.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hex.h>
 #include <isc/lang.h>
 #include <isc/log.h>
 #include <isc/netaddr.h>
 #include <isc/netdb.h>
-#include <isc/nonce.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/random.h>
@@ -87,7 +87,7 @@

 #include <dig/dig.h>

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -176,8 +176,9 @@ unsigned char cookie[8];
 const dns_name_t *hmacname = NULL;
 unsigned int digestbits = 0;
 isc_buffer_t *namebuf = NULL;
-dns_tsigkey_t *tsigkey = NULL;
+dns_tsigkey_t *key = NULL;
 isc_boolean_t validated = ISC_TRUE;
+isc_entropy_t *entp = NULL;
 isc_mempool_t *commctx = NULL;
 isc_boolean_t debugging = ISC_FALSE;
 isc_boolean_t debugtiming = ISC_FALSE;
@@ -241,6 +242,18 @@ check_next_lookup(dig_lookup_t *lookup);
 static isc_boolean_t
 next_origin(dig_lookup_t *oldlookup);

+char *
+next_token(char **stringp, const char *delim) {
+	char *res;
+
+	do {
+		res = strsep(stringp, delim);
+		if (res == NULL)
+			break;
+	} while (*res == '\0');
+	return (res);
+}
+
 static int
 count_dots(char *string) {
 	char *s;
@@ -340,8 +353,9 @@ get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,

 		if (ip6_int)
 			options |= DNS_BYADDROPT_IPV6INT;
-		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname(&addr, options, name);
+		dns_fixedname_init(&fname);
+		name = dns_fixedname_name(&fname);
+		result = dns_byaddr_createptrname2(&addr, options, name);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		dns_name_format(name, reverse, (unsigned int)len);
@@ -654,8 +668,6 @@ make_empty_lookup(void) {
 	looknew->aaonly = ISC_FALSE;
 	looknew->adflag = ISC_FALSE;
 	looknew->cdflag = ISC_FALSE;
-	looknew->raflag = ISC_FALSE;
-	looknew->tcflag = ISC_FALSE;
 	looknew->print_unknown_format = ISC_FALSE;
 	looknew->zflag = ISC_FALSE;
 	looknew->ns_search_only = ISC_FALSE;
@@ -798,8 +810,6 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->aaonly = lookold->aaonly;
 	looknew->adflag = lookold->adflag;
 	looknew->cdflag = lookold->cdflag;
-	looknew->raflag = lookold->raflag;
-	looknew->tcflag = lookold->tcflag;
 	looknew->print_unknown_format = lookold->print_unknown_format;
 	looknew->zflag = lookold->zflag;
 	looknew->ns_search_only = lookold->ns_search_only;
@@ -904,13 +914,13 @@ setup_text_key(void) {

 	result = dns_tsigkey_create(&keyname, hmacname, secretstore,
 				    (int)secretsize, ISC_FALSE, NULL, 0, 0,
-				    mctx, NULL, &tsigkey);
+				    mctx, NULL, &key);
 failure:
 	if (result != ISC_R_SUCCESS)
 		printf(";; Couldn't create key %s: %s\n",
 		       keynametext, isc_result_totext(result));
 	else
-		dst_key_setbits(tsigkey->key, digestbits);
+		dst_key_setbits(key->key, digestbits);

 	isc_mem_free(mctx, secretstore);
 	dns_name_invalidate(&keyname);
@@ -1197,7 +1207,7 @@ setup_file_key(void) {
 	}
 	result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmacname,
 					   dstkey, ISC_FALSE, NULL, 0, 0,
-					   mctx, NULL, &tsigkey);
+					   mctx, NULL, &key);
 	if (result != ISC_R_SUCCESS) {
 		printf(";; Couldn't create key %s: %s\n",
 		       keynametext, isc_result_totext(result));
@@ -1315,8 +1325,10 @@ setup_system(isc_boolean_t ipv4only, isc_boolean_t ipv6only) {
 		setup_file_key();
 	else if (keysecret[0] != 0)
 		setup_text_key();
-
-	isc_nonce_buf(cookie_secret, sizeof(cookie_secret));
+	result = isc_entropy_getdata(entp, cookie_secret,
+				     sizeof(cookie_secret), NULL, 0);
+	if (result != ISC_R_SUCCESS)
+		fatal("unable to generate cookie secret");
 }

 /*%
@@ -1341,7 +1353,7 @@ setup_libs(void) {

 	debug("setup_libs()");

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -1385,7 +1397,10 @@ setup_libs(void) {
 	result = isc_socketmgr_create(mctx, &socketmgr);
 	check_result(result, "isc_socketmgr_create");

-	result = dst_lib_init(mctx, NULL);
+	result = isc_entropy_create(mctx, &entp);
+	check_result(result, "isc_entropy_create");
+
+	result = dst_lib_init(mctx, entp, 0);
 	check_result(result, "dst_lib_init");
 	is_dst_up = ISC_TRUE;

@@ -1871,7 +1886,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 		     srv != NULL;
 		     srv = ISC_LIST_HEAD(lookup->my_server_list)) {
 			INSIST(i > 0);
-			j = isc_random_uniform(i);
+			isc_random_get(&j);
+			j %= i;
 			next = ISC_LIST_NEXT(srv, link);
 			while (j-- > 0 && next != NULL) {
 				srv = next;
@@ -1917,7 +1933,8 @@ next_origin(dig_lookup_t *oldlookup) {
 	/*
 	 * Check for a absolute name or ndots being met.
 	 */
-	name = dns_fixedname_initname(&fixed);
+	dns_fixedname_init(&fixed);
+	name = dns_fixedname_name(&fixed);
 	result = dns_name_fromstring2(name, oldlookup->textname, NULL,
 				      0, NULL);
 	if (result == ISC_R_SUCCESS &&
@@ -2023,6 +2040,7 @@ compute_cookie(unsigned char *clientcookie, size_t len) {
 isc_boolean_t
 setup_lookup(dig_lookup_t *lookup) {
 	isc_result_t result;
+	isc_uint32_t id;
 	unsigned int len;
 	dig_server_t *serv;
 	dig_query_t *query;
@@ -2078,7 +2096,8 @@ setup_lookup(dig_lookup_t *lookup) {
 	textname = lookup->textname;
 #ifdef WITH_IDN_SUPPORT
 	if (lookup->idnin) {
-		result = idn_locale_to_ace(textname, idn_textname, sizeof(idn_textname));
+		result = idn_locale_to_ace(lookup->textname, idn_textname,
+					    sizeof(idn_textname));
 		check_result(result, "convert textname to IDN encoding");
 		debug("idn_textname: %s", idn_textname);
 		textname = idn_textname;
@@ -2114,7 +2133,8 @@ setup_lookup(dig_lookup_t *lookup) {
 		origin = lookup->origin->origin;
 #ifdef WITH_IDN_SUPPORT
 		if (lookup->idnin) {
-			result = idn_locale_to_ace(origin, idn_origin, sizeof(idn_origin));
+			result = idn_locale_to_ace(lookup->origin->origin,
+						idn_origin, sizeof(idn_origin));
 			check_result(result, "convert origin to IDN encoding");
 			debug("trying idn origin %s", idn_origin);
 			origin = idn_origin;
@@ -2140,7 +2160,8 @@ setup_lookup(dig_lookup_t *lookup) {
 			dns_fixedname_t fixed;
 			dns_name_t *name;

-			name = dns_fixedname_initname(&fixed);
+			dns_fixedname_init(&fixed);
+			name = dns_fixedname_name(&fixed);
 			len = (unsigned int) strlen(textname);
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
@@ -2197,7 +2218,8 @@ setup_lookup(dig_lookup_t *lookup) {
 	dighost_trying(store, lookup);
 	INSIST(dns_name_isabsolute(lookup->name));

-	lookup->sendmsg->id = (dns_messageid_t)isc_random16();
+	isc_random_get(&id);
+	lookup->sendmsg->id = (unsigned short)id & 0xFFFF;
 	lookup->sendmsg->opcode = lookup->opcode;
 	lookup->msgcounter = 0;
 	/*
@@ -2230,16 +2252,6 @@ setup_lookup(dig_lookup_t *lookup) {
 		lookup->sendmsg->flags |= DNS_MESSAGEFLAG_CD;
 	}

-	if (lookup->raflag) {
-		debug("RA query");
-		lookup->sendmsg->flags |= DNS_MESSAGEFLAG_RA;
-	}
-
-	if (lookup->tcflag) {
-		debug("TC query");
-		lookup->sendmsg->flags |= DNS_MESSAGEFLAG_TC;
-	}
-
 	if (lookup->zflag) {
 		debug("Z query");
 		lookup->sendmsg->flags |= 0x0040U;
@@ -2277,9 +2289,9 @@ setup_lookup(dig_lookup_t *lookup) {
 	/* XXX Insist this? */
 	lookup->tsigctx = NULL;
 	lookup->querysig = NULL;
-	if (tsigkey != NULL) {
+	if (key != NULL) {
 		debug("initializing keys");
-		result = dns_message_settsigkey(lookup->sendmsg, tsigkey);
+		result = dns_message_settsigkey(lookup->sendmsg, key);
 		check_result(result, "dns_message_settsigkey");
 	}

@@ -3644,7 +3656,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	result = dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);
 	check_result(result, "dns_message_create");

-	if (tsigkey != NULL) {
+	if (key != NULL) {
 		if (l->querysig == NULL) {
 			debug("getting initial querysig");
 			result = dns_message_getquerytsig(l->sendmsg, mctx,
@@ -3653,7 +3665,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 		result = dns_message_setquerytsig(msg, l->querysig);
 		check_result(result, "dns_message_setquerytsig");
-		result = dns_message_settsigkey(msg, tsigkey);
+		result = dns_message_settsigkey(msg, key);
 		check_result(result, "dns_message_settsigkey");
 		msg->tsigctx = l->tsigctx;
 		l->tsigctx = NULL;
@@ -3829,7 +3841,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 	}

-	if (tsigkey != NULL) {
+	if (key != NULL) {
 		result = dns_tsig_verify(&query->recvbuf, msg, NULL, NULL);
 		if (result != ISC_R_SUCCESS) {
 			printf(";; Couldn't verify signature: %s\n",
@@ -4196,9 +4208,9 @@ destroy_libs(void) {
 		debug("freeing timermgr");
 		isc_timermgr_destroy(&timermgr);
 	}
-	if (tsigkey != NULL) {
-		debug("freeing key %p", tsigkey);
-		dns_tsigkey_detach(&tsigkey);
+	if (key != NULL) {
+		debug("freeing key %p", key);
+		dns_tsigkey_detach(&key);
 	}
 	if (namebuf != NULL)
 		isc_buffer_free(&namebuf);
@@ -4208,6 +4220,10 @@ destroy_libs(void) {
 		dst_lib_destroy();
 		is_dst_up = ISC_FALSE;
 	}
+	if (entp != NULL) {
+		debug("detach from entropy");
+		isc_entropy_detach(&entp);
+	}

 	UNLOCK_LOOKUP;
 	DESTROYLOCK(&lookup_lock);
@@ -4257,19 +4273,21 @@ output_filter(isc_buffer_t *buffer, unsigned int used_org,
 	if (result != ISC_R_SUCCESS) {
 		return (ISC_R_SUCCESS);
 	}
+	strlcpy(tmp1, tmp2, MAXDLEN);
+
 	/*
 	 * Copy the converted contents in 'tmp1' back to 'buffer'.
 	 * If we have appended trailing dot, remove it.
 	 */
-	tolen = strlen(tmp2);
-	if (absolute && !end_with_dot && tmp2[tolen - 1] == '.')
+	tolen = strlen(tmp1);
+	if (absolute && !end_with_dot && tmp1[tolen - 1] == '.')
 		tolen--;

 	if (isc_buffer_length(buffer) < used_org + tolen)
 		return (ISC_R_NOSPACE);

 	isc_buffer_subtract(buffer, isc_buffer_usedlength(buffer) - used_org);
-	memmove(isc_buffer_used(buffer), tmp2, tolen);
+	memmove(isc_buffer_used(buffer), tmp1, tolen);
 	isc_buffer_add(buffer, (unsigned int)tolen);

 	return (ISC_R_SUCCESS);
@@ -4287,28 +4305,11 @@ idn_locale_to_ace(const char *from, char *to, size_t tolen) {
 	int res;
 	char *tmp_str = NULL;

-	res = idn2_to_ascii_lz(from, &tmp_str, IDN2_NONTRANSITIONAL|IDN2_NFC_INPUT);
-	if (res == IDN2_DISALLOWED) {
-		res = idn2_to_ascii_lz(from, &tmp_str, IDN2_TRANSITIONAL|IDN2_NFC_INPUT);
-	}
+	res = idn2_lookup_ul(from, &tmp_str, IDN2_NONTRANSITIONAL);
+	if (res == IDN2_DISALLOWED)
+		res = idn2_lookup_ul(from, &tmp_str, IDN2_TRANSITIONAL);

 	if (res == IDN2_OK) {
-		/*
-		 * idn2_to_ascii_lz() normalizes all strings to lowerl case,
-		 * but we generally don't want to lowercase all input strings;
-		 * make sure to return the original case if the two strings
-		 * differ only in case
-		 */
-		if (!strcasecmp(from, tmp_str)) {
-			if (strlen(from) >= tolen) {
-				debug("from string is too long");
-				idn2_free(tmp_str);
-				return ISC_R_NOSPACE;
-			}
-			idn2_free(tmp_str);
-			(void) strlcpy(to, from, tolen);
-			return ISC_R_SUCCESS;
-		}
 		/* check the length */
 		if (strlen(tmp_str) >= tolen) {
 			debug("ACE string is too long");
@@ -4321,7 +4322,7 @@ idn_locale_to_ace(const char *from, char *to, size_t tolen) {
 		return ISC_R_SUCCESS;
 	}

-	fatal("'%s' is not a legal IDN name (%s), use +noidnin", from, idn2_strerror(res));
+	fatal("idn2_lookup_ul failed: %s", idn2_strerror(res));
 	return ISC_R_FAILURE;
 }

@@ -4332,7 +4333,7 @@ idn_ace_to_locale(const char *from, char *to, size_t tolen) {
 	char *tmp_str = NULL;

 	res = idn2_to_unicode_8zlz(from, &tmp_str,
-				   IDN2_NONTRANSITIONAL|IDN2_NFC_INPUT);
+			       IDN2_NONTRANSITIONAL|IDN2_NFC_INPUT);

 	if (res == IDN2_OK) {
 		/* check the length */
@@ -4342,12 +4343,14 @@ idn_ace_to_locale(const char *from, char *to, size_t tolen) {
 			return ISC_R_FAILURE;
 		}

-		(void) strlcpy(to, tmp_str, tolen);
-		idn2_free(tmp_str);
+		(void) strncpy(to, tmp_str, tolen);
+		free(tmp_str);
 		return ISC_R_SUCCESS;
+	} else {
+		debug("idn2_to_unicode_8zlz failed: %s",
+		      idn2_strerror(res));
 	}

-	fatal("'%s' is not a legal IDN name (%s), use +noidnout", from, idn2_strerror(res));
 	return ISC_R_FAILURE;
 }
 #endif /* WITH_IDN_OUT_SUPPORT */
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -274,5 +274,5 @@ runs\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -452,7 +452,8 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		dns_name_t *name;

 		/* Add AAAA and MX lookups. */
-		name = dns_fixedname_initname(&fixed);
+		dns_fixedname_init(&fixed);
+		name = dns_fixedname_name(&fixed);
 		dns_name_copy(query->lookup->name, name, NULL);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -94,8 +94,6 @@ struct dig_lookup {
 		aaonly,
 		adflag,
 		cdflag,
-		raflag,
-		tcflag,
 		zflag,
 		trace, /*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
@@ -259,7 +257,7 @@ extern char keyfile[MXNAME];
 extern char keysecret[MXNAME];
 extern const dns_name_t *hmacname;
 extern unsigned int digestbits;
-extern dns_tsigkey_t *tsigkey;
+extern dns_tsigkey_t *key;
 extern isc_boolean_t validated;
 extern isc_taskmgr_t *taskmgr;
 extern isc_task_t *global_task;
@@ -371,6 +369,9 @@ destroy_libs(void);
 void
 set_search_domain(char *domain);

+char *
+next_token(char **stringp, const char *delim);
+
 /*
 * Routines to be defined in dig.c, host.c, and nslookup.c. and
 * then assigned to the appropriate function pointer
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2010, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -290,5 +290,5 @@ returns with an exit status of 1 if any query failed, and 0 otherwise\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2007, 2010, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -475,7 +475,8 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		dns_name_t *name;

 		/* Add AAAA lookup. */
-		name = dns_fixedname_initname(&fixed);
+		dns_fixedname_init(&fixed);
+		name = dns_fixedname_name(&fixed);
 		dns_name_copy(query->lookup->name, name, NULL);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
@@ -709,31 +710,31 @@ setoption(char *opt) {
 		usesearch = ISC_TRUE;
 	} else if (CHECKOPT("nodefname", 5)) {
 		usesearch = ISC_FALSE;
-	} else if (CHECKOPT("vc", 2)) {
+	} else if (CHECKOPT("vc", 2) == 0) {
 		tcpmode = ISC_TRUE;
 		tcpmode_set = ISC_TRUE;
-	} else if (CHECKOPT("novc", 4)) {
+	} else if (CHECKOPT("novc", 4) == 0) {
 		tcpmode = ISC_FALSE;
 		tcpmode_set = ISC_TRUE;
-	} else if (CHECKOPT("debug", 3)) {
+	} else if (CHECKOPT("debug", 3) == 0) {
 		short_form = ISC_FALSE;
 		showsearch = ISC_TRUE;
-	} else if (CHECKOPT("nodebug", 5)) {
+	} else if (CHECKOPT("nodebug", 5) == 0) {
 		short_form = ISC_TRUE;
 		showsearch = ISC_FALSE;
-	} else if (CHECKOPT("d2", 2)) {
+	} else if (CHECKOPT("d2", 2) == 0) {
 		debugging = ISC_TRUE;
-	} else if (CHECKOPT("nod2", 4)) {
+	} else if (CHECKOPT("nod2", 4) == 0) {
 		debugging = ISC_FALSE;
-	} else if (CHECKOPT("search", 3)) {
+	} else if (CHECKOPT("search", 3) == 0) {
 		usesearch = ISC_TRUE;
-	} else if (CHECKOPT("nosearch", 5)) {
+	} else if (CHECKOPT("nosearch", 5) == 0) {
 		usesearch = ISC_FALSE;
-	} else if (CHECKOPT("sil", 3)) {
+	} else if (CHECKOPT("sil", 3) == 0) {
 		/* deprecation_msg = ISC_FALSE; */
-	} else if (CHECKOPT("fail", 3)) {
+	} else if (CHECKOPT("fail", 3) == 0) {
 		nofail=ISC_FALSE;
-	} else if (CHECKOPT("nofail", 5)) {
+	} else if (CHECKOPT("nofail", 5) == 0) {
 		nofail=ISC_TRUE;
 	} else if (strncasecmp(opt, "ndots=", 6) == 0) {
 		set_ndots(&opt[6]);
@@ -813,12 +814,12 @@ addlookup(char *opt) {

 static void
 do_next_command(char *input) {
-	char *ptr, *arg, *last;
+	char *ptr, *arg;

-	if ((ptr = strtok_r(input, " \t\r\n", &last)) == NULL) {
+	ptr = next_token(&input, " \t\r\n");
+	if (ptr == NULL)
 		return;
-	}
-	arg = strtok_r(NULL, " \t\r\n", &last);
+	arg = next_token(&input, " \t\r\n");
 	if ((strcasecmp(ptr, "set") == 0) &&
 	    (arg != NULL))
 		setoption(arg);
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@

 CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
-		-DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
+		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
@@ -102,7 +102,7 @@ Specify a digest algorithm to use when converting CDNSKEY records to DS records\
 .sp
 The
 \fIalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST, or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
 .RE
 .PP
 \-c \fIclass\fR
@@ -23,6 +23,7 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -53,7 +54,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -71,6 +72,7 @@ int verbose;
 */
 static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;
+static isc_entropy_t *ectx = NULL;

 /*
 * The domain we are working on
@@ -171,7 +173,8 @@ initname(char *setname) {
 	isc_result_t result;
 	isc_buffer_t buf;

-	name = dns_fixedname_initname(&fixed);
+	dns_fixedname_init(&fixed);
+	name = dns_fixedname_name(&fixed);
 	namestr = setname;

 	isc_buffer_init(&buf, setname, strlen(setname));
@@ -251,8 +254,8 @@ load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 			       rdclass, 0, NULL, dbp);
 	check_result(result, "dns_db_create()");

-	result = dns_db_load(*dbp, filename,
-			     dns_masterformat_text, DNS_MASTER_HINT);
+	result = dns_db_load3(*dbp, filename,
+			      dns_masterformat_text, DNS_MASTER_HINT);
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) {
 		fatal("can't load %s: %s", filename,
 		      isc_result_totext(result));
@@ -376,9 +379,9 @@ formatset(dns_rdataset_t *rdataset) {
 	 * which just separates fields with spaces. The huge tab stop width
 	 * eliminates any tab characters.
 	 */
-	result = dns_master_stylecreate(&style, styleflags,
-					0, 0, 0, 0, 0, 1000000, 0,
-					mctx);
+	result = dns_master_stylecreate2(&style, styleflags,
+					 0, 0, 0, 0, 0, 1000000, 0,
+					 mctx);
 	check_result(result, "dns_master_stylecreate2 failed");

 	result = isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
@@ -668,11 +671,8 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 			}

 			result = dns_dnssec_verify(name, rdataset, ki->dst,
-						   ISC_FALSE, 0, mctx,
-						   &sigrdata, NULL);
-
-			if (result != ISC_R_SUCCESS &&
-			    result != DNS_R_FROMWILDCARD) {
+						   ISC_FALSE, mctx, &sigrdata);
+			if (result != ISC_R_SUCCESS) {
 				vbprintf(1, "skip RRSIG by key %d:"
 					 " verification failed: %s\n",
 					 sig.keyid, isc_result_totext(result));
@@ -1115,7 +1115,7 @@ usage(void) {
 		program);
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "Options:\n"
-"    -a <algorithm>     digest algorithm (SHA-1 / SHA-256 / SHA-384)\n"
+"    -a <algorithm>     digest algorithm (SHA-1 / SHA-256 / GOST / SHA-384)\n"
 "    -c <class>         of domain (default IN)\n"
 "    -D                 prefer CDNSKEY records instead of CDS\n"
 "    -d <file|dir>      where to find parent dsset- file\n"
@@ -1147,7 +1147,7 @@ main(int argc, char *argv[]) {
 		fatal("out of memory");
 	}

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -1231,11 +1231,20 @@ main(int argc, char *argv[]) {

 	setup_logging(mctx, &lctx);

-	result = dst_lib_init(mctx, NULL);
+	if (ectx == NULL) {
+		setup_entropy(mctx, NULL, &ectx);
+	}
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize hash");
+	}
+	result = dst_lib_init(mctx, ectx,
+			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS) {
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 	}
+	isc_entropy_stopcallbacksources(ectx);

 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1385,6 +1394,8 @@ main(int argc, char *argv[]) {
 	free_all_sets();
 	cleanup_logging(&lctx);
 	dst_lib_destroy();
+	isc_hash_destroy();
+	cleanup_entropy(&ectx);
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -144,7 +144,7 @@
          </para>
          <para>
 	    The <replaceable>algorithm</replaceable> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
+	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
 	    values are case insensitive. If no algorithm is specified,
 	    the default is SHA-256.
          </para>
@@ -130,7 +130,7 @@
          </p>
          <p>
 	    The <em class="replaceable"><code>algorithm</code></em> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
+	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
 	    values are case insensitive. If no algorithm is specified,
 	    the default is SHA-256.
          </p>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -64,7 +64,7 @@ Use SHA\-256 as the digest algorithm\&.
 .RS 4
 Select the digest algorithm\&. The value of
 \fBalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256) or SHA\-384 (SHA384)\&. These values are case insensitive\&.
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST or SHA\-384 (SHA384)\&. These values are case insensitive\&.
 .RE
 .PP
 \-C
@@ -178,5 +178,5 @@ RFC 4509\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -17,6 +17,7 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/print.h>
@@ -41,7 +42,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -66,7 +67,8 @@ initname(char *setname) {
 	isc_result_t result;
 	isc_buffer_t buf;

-	name = dns_fixedname_initname(&fixed);
+	dns_fixedname_init(&fixed);
+	name = dns_fixedname_name(&fixed);

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
@@ -112,7 +114,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 		db_load_from_stream(db, stdin);
 		filename = "input";
 	} else {
-		result = dns_db_load(db, filename, dns_masterformat_text, 0);
+		result = dns_db_load(db, filename);
 		if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 			fatal("can't load %s: %s", filename,
 			      isc_result_totext(result));
@@ -204,7 +206,8 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,

 	rdclass = dst_key_class(key);

-	name = dns_fixedname_initname(&fixed);
+	dns_fixedname_init(&fixed);
+	name = dns_fixedname_name(&fixed);
 	result = dns_name_copy(dst_key_name(key), name, NULL);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't copy name");
@@ -358,6 +361,7 @@ main(int argc, char **argv) {
 	isc_boolean_t	showall = ISC_FALSE;
 	isc_result_t	result;
 	isc_log_t	*log = NULL;
+	isc_entropy_t	*ectx = NULL;
 	dns_rdataset_t	rdataset;
 	dns_rdata_t	rdata;

@@ -370,7 +374,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -473,10 +477,17 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("extraneous arguments");

-	result = dst_lib_init(mctx, NULL);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	result = dst_lib_init(mctx, ectx,
+			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("could not initialize hash");
+	isc_entropy_stopcallbacksources(ectx);

 	setup_logging(mctx, &log);

@@ -537,7 +548,9 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
+	isc_hash_destroy();
 	dst_lib_destroy();
+	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -117,7 +117,7 @@
 	  <para>
 	    Select the digest algorithm. The value of
 	    <option>algorithm</option> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256) or SHA-384 (SHA384).
+	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
 	    These values are case insensitive.
 	  </para>
 	</listitem>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -97,7 +97,7 @@
 	  <p>
 	    Select the digest algorithm. The value of
 	    <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
-	    SHA-256 (SHA256) or SHA-384 (SHA384).
+	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
 	    These values are case insensitive.
 	  </p>
 	</dd>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -134,5 +134,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -17,6 +17,7 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/print.h>
@@ -41,7 +42,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -71,7 +72,8 @@ initname(char *setname) {
 	isc_result_t result;
 	isc_buffer_t buf;

-	name = dns_fixedname_initname(&fixed);
+	dns_fixedname_init(&fixed);
+	name = dns_fixedname_name(&fixed);

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
@@ -117,8 +119,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 		db_load_from_stream(db, stdin);
 		filename = "input";
 	} else {
-		result = dns_db_load(db, filename, dns_masterformat_text,
-				     DNS_MASTER_NOTTL);
+		result = dns_db_load3(db, filename, dns_masterformat_text,
+				      DNS_MASTER_NOTTL);
 		if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 			fatal("can't load %s: %s", filename,
 			      isc_result_totext(result));
@@ -179,7 +181,8 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,

 	rdclass = dst_key_class(key);

-	name = dns_fixedname_initname(&fixed);
+	dns_fixedname_init(&fixed);
+	name = dns_fixedname_name(&fixed);
 	result = dns_name_copy(dst_key_name(key), name, NULL);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't copy name");
@@ -296,6 +299,7 @@ main(int argc, char **argv) {
 	int		ch;
 	isc_result_t	result;
 	isc_log_t	*log = NULL;
+	isc_entropy_t	*ectx = NULL;
 	dns_rdataset_t	rdataset;
 	dns_rdata_t	rdata;
 	isc_stdtime_t   now;
@@ -310,7 +314,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -402,10 +406,17 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("extraneous arguments");

-	result = dst_lib_init(mctx, NULL);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	result = dst_lib_init(mctx, ectx,
+			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("could not initialize hash");
+	isc_entropy_stopcallbacksources(ectx);

 	setup_logging(mctx, &log);

@@ -448,7 +459,9 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
+	isc_hash_destroy();
 	dst_lib_destroy();
+	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -55,7 +55,7 @@ of the key is specified on the command line\&. This must match the name of the z
 .RS 4
 Selects the cryptographic algorithm\&. The value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
 .sp
 If no algorithm is specified, then RSASHA1 will be used by default, unless the
 \fB\-3\fR
@@ -307,5 +307,5 @@ The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13)\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -18,6 +18,7 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/print.h>
@@ -37,7 +38,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -64,12 +65,12 @@ usage(void) {
 	fprintf(stderr, "    -a algorithm: \n"
 			"        RSA | RSAMD5 | DH | DSA | RSASHA1 |\n"
 			"        NSEC3DSA | NSEC3RSASHA1 |\n"
-			"        RSASHA256 | RSASHA512 |\n"
+			"        RSASHA256 | RSASHA512 | ECCGOST |\n"
 			"        ECDSAP256SHA256 | ECDSAP384SHA384\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if HAVE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "        path to PKCS#11 provider library "
 				"(default is %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -145,6 +146,7 @@ main(int argc, char **argv) {
 	char		filename[255];
 	isc_buffer_t	buf;
 	isc_log_t	*log = NULL;
+	isc_entropy_t	*ectx = NULL;
 	dns_rdataclass_t rdclass;
 	int		options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	char		*label = NULL;
@@ -173,7 +175,7 @@ main(int argc, char **argv) {

 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -345,7 +347,10 @@ main(int argc, char **argv) {
 		}
 	}

-	ret = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	ret = dst_lib_init2(mctx, ectx, engine,
+			    ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (ret != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(ret));
@@ -360,7 +365,8 @@ main(int argc, char **argv) {
 		if (argc > isc_commandline_index + 1)
 			fatal("extraneous arguments");

-		name = dns_fixedname_initname(&fname);
+		dns_fixedname_init(&fname);
+		name = dns_fixedname_name(&fname);
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
@@ -427,6 +433,7 @@ main(int argc, char **argv) {
 			case DST_ALG_NSEC3RSASHA1:
 			case DST_ALG_RSASHA256:
 			case DST_ALG_RSASHA512:
+			case DST_ALG_ECCGOST:
 			case DST_ALG_ECDSA256:
 			case DST_ALG_ECDSA384:
 			case DST_ALG_ED25519:
@@ -606,12 +613,13 @@ main(int argc, char **argv) {

 	/* associate the key */
 	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass,
-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 				"pkcs11",
 #else
 				engine,
 #endif
 				label, NULL, mctx, &key);
+	isc_entropy_stopcallbacksources(ectx);

 	if (ret != ISC_R_SUCCESS) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -730,6 +738,7 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);

 	cleanup_logging(&log);
+	cleanup_entropy(&ectx);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)
@@ -106,7 +106,7 @@
 	  <para>
 	    Selects the cryptographic algorithm.  The value of
 	    <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </para>
 	  <para>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -90,7 +90,7 @@
 	  <p>
 	    Selects the cryptographic algorithm.  The value of
 	    <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
 	  </p>
 	  <p>
@@ -39,7 +39,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -62,7 +62,7 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
 \fB\-T KEY\fR
 option as well\&.
 .sp
@@ -178,6 +178,21 @@ stderr
 indicating the progress of the key generation\&. A \*(Aq\&.\*(Aq indicates that a random number has been found which passed an initial sieve test; \*(Aq+\*(Aq means a number has passed a single round of the Miller\-Rabin primality test; a space means that the number has passed all the tests and is a satisfactory key\&.
 .RE
 .PP
+\-r \fIrandomdev\fR
+.RS 4
+Specifies a source of randomness\&. Normally, when generating DNSSEC keys, this option has no effect; the random number generation function provided by the cryptographic library will be used\&.
+.sp
+If that behavior is disabled at compile time, however, the specified file will be used as entropy source for key generation\&.
+randomdev
+is the name of a character device or file containing random data to be used\&. The special value
+keyboard
+indicates that keyboard input should be used\&.
+.sp
+The default is
+/dev/random
+if the operating system provides it or an equivalent device; if not, the default source of randomness is keyboard input\&.
+.RE
+.PP
 \-S \fIkey\fR
 .RS 4
 Create a new key which is an explicit successor to an existing key\&. The name, algorithm, size, and type of the key will be set to match the existing key\&. The activation date of the new key will be set to the inactivation date of the existing one\&. The publication date will be set to the activation date minus the prepublication interval, which defaults to 30 days\&.
@@ -33,6 +33,7 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/region.h>
@@ -52,7 +53,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -79,7 +80,7 @@ usage(void) {
 	fprintf(stderr, "    -a <algorithm>:\n");
 	fprintf(stderr, "        RSA | RSAMD5 | DSA | RSASHA1 | NSEC3RSASHA1"
 				" | NSEC3DSA |\n");
-	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
+	fprintf(stderr, "        RSASHA256 | RSASHA512 | ECCGOST |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
 	fprintf(stderr, "        ED25519 | ED448 | DH\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
@@ -106,7 +107,7 @@ usage(void) {
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if HAVE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "        path to PKCS#11 provider library "
 				"(default is %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -120,6 +121,7 @@ usage(void) {
 			"(DH only)\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
+	fprintf(stderr, "    -r <randomdev>: a file containing random data\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
 			"records with (default: 0)\n");
 	fprintf(stderr, "    -T <rrtype>: DNSKEY | KEY (default: DNSKEY; "
@@ -216,6 +218,7 @@ main(int argc, char **argv) {
 	dst_key_t	*prevkey = NULL;
 	isc_buffer_t	buf;
 	isc_log_t	*log = NULL;
+	isc_entropy_t	*ectx = NULL;
 #ifdef USE_PKCS11
 	const char	*engine = PKCS11_ENGINE;
 #else
@@ -247,7 +250,7 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -362,8 +365,7 @@ main(int argc, char **argv) {
 			quiet = ISC_TRUE;
 			break;
 		case 'r':
-			fatal("The -r option has been deprecated.\n"
-			      "System random data is always used.\n");
+			setup_entropy(mctx, isc_commandline_argument, &ectx);
 			break;
 		case 's':
 			signatory = strtol(isc_commandline_argument,
@@ -492,7 +494,10 @@ main(int argc, char **argv) {
 	if (!isatty(0))
 		quiet = ISC_TRUE;

-	ret = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	ret = dst_lib_init2(mctx, ectx, engine,
+			    ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (ret != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(ret));
@@ -508,7 +513,8 @@ main(int argc, char **argv) {
 		if (argc > isc_commandline_index + 1)
 			fatal("extraneous arguments");

-		name = dns_fixedname_initname(&fname);
+		dns_fixedname_init(&fname);
+		name = dns_fixedname_name(&fname);
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
@@ -856,17 +862,19 @@ main(int argc, char **argv) {

 		if (!quiet && show_progress) {
 			fprintf(stderr, "Generating key pair.");
-			ret = dst_key_generate(name, alg, size, param, flags,
-					       protocol, rdclass, mctx, &key,
-					       &progress);
+			ret = dst_key_generate2(name, alg, size, param, flags,
+						protocol, rdclass, mctx, &key,
+						&progress);
 			putc('\n', stderr);
 			fflush(stderr);
 		} else {
-			ret = dst_key_generate(name, alg, size, param, flags,
-					       protocol, rdclass, mctx, &key,
-					       NULL);
+			ret = dst_key_generate2(name, alg, size, param, flags,
+						protocol, rdclass, mctx, &key,
+						NULL);
 		}

+		isc_entropy_stopcallbacksources(ectx);
+
 		if (ret != ISC_R_SUCCESS) {
 			char namestr[DNS_NAME_FORMATSIZE];
 			char algstr[DNS_SECALG_FORMATSIZE];
@@ -1019,6 +1027,7 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);

 	cleanup_logging(&log);
+	cleanup_entropy(&ectx);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)
@@ -81,6 +81,7 @@
      <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-q</option></arg>
      <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
@@ -123,7 +124,7 @@
 	  <para>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <option>-T KEY</option>
@@ -348,6 +349,31 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
+	<listitem>
+	  <para>
+	    Specifies a source of randomness.  Normally, when generating
+	    DNSSEC keys, this option has no effect; the random number
+	    generation function provided by the cryptographic library will
+	    be used.
+	  </para>
+	  <para>
+	    If that behavior is disabled at compile time, however,
+	    the specified file will be used as entropy source
+	    for key generation.  <filename>randomdev</filename> is
+	    the name of a character device or file containing random
+	    data to be used.  The special value <filename>keyboard</filename>
+	    indicates that keyboard input should be used.
+	  </para>
+	  <para>
+	    The default is <filename>/dev/random</filename> if the
+	    operating system provides it or an equivalent device;
+	    if not, the default source of randomness is keyboard input.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-S <replaceable class="parameter">key</replaceable></term>
 	<listitem>
@@ -57,6 +57,7 @@
       [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
       [<code class="option">-q</code>]
       [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>]
       [<code class="option">-S <em class="replaceable"><code>key</code></em></code>]
       [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>]
       [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
@@ -100,7 +101,7 @@
 	  <p>
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
 	    TKEY, the value must be DH (Diffie Hellman); specifying
 	    his value will automatically set the <code class="option">-T KEY</code>
@@ -278,6 +279,28 @@
 	    a satisfactory key.
 	  </p>
 	</dd>
+<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
+<dd>
+	  <p>
+	    Specifies a source of randomness.  Normally, when generating
+	    DNSSEC keys, this option has no effect; the random number
+	    generation function provided by the cryptographic library will
+	    be used.
+	  </p>
+	  <p>
+	    If that behavior is disabled at compile time, however,
+	    the specified file will be used as entropy source
+	    for key generation.  <code class="filename">randomdev</code> is
+	    the name of a character device or file containing random
+	    data to be used.  The special value <code class="filename">keyboard</code>
+	    indicates that keyboard input should be used.
+	  </p>
+	  <p>
+	    The default is <code class="filename">/dev/random</code> if the
+	    operating system provides it or an equivalent device;
+	    if not, the default source of randomness is keyboard input.
+	  </p>
+	</dd>
 <dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
 <dd>
 	  <p>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2011, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -99,5 +99,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2011, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -18,6 +18,7 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -30,7 +31,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -49,7 +50,7 @@ usage(void) {
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
-#if HAVE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "    -E engine:    specify PKCS#11 provider "
 					"(default: %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -86,6 +87,7 @@ main(int argc, char **argv) {
 	char keystr[DST_KEY_FORMATSIZE];
 	char *endp;
 	int ch;
+	isc_entropy_t *ectx = NULL;
 	dst_key_t *key = NULL;
 	isc_uint32_t flags;
 	isc_buffer_t buf;
@@ -100,7 +102,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("Out of memory");

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -178,10 +180,17 @@ main(int argc, char **argv) {
 		}
 	}

-	result = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	result = dst_lib_init2(mctx, ectx, engine,
+			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS)
 		fatal("Could not initialize dst: %s",
 		      isc_result_totext(result));
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("Could not initialize hash");
+	isc_entropy_stopcallbacksources(ectx);

 	result = dst_key_fromnamedfile(filename, dir,
 				       DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
@@ -262,7 +271,9 @@ main(int argc, char **argv) {

 cleanup:
 	dst_key_free(&key);
+	isc_hash_destroy();
 	dst_lib_destroy();
+	cleanup_entropy(&ectx);
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	if (dir != NULL)
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2011, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -200,5 +200,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009-2011, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -20,6 +20,7 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -33,7 +34,7 @@

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -53,7 +54,7 @@ usage(void) {
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "General options:\n");
-#if HAVE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "    -E engine:          specify PKCS#11 provider "
 					"(default: %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -138,6 +139,7 @@ main(int argc, char **argv) {
 	char		keystr[DST_KEY_FORMATSIZE];
 	char		*endp, *p;
 	int		ch;
+	isc_entropy_t	*ectx = NULL;
 	const char	*predecessor = NULL;
 	dst_key_t	*prevkey = NULL;
 	dst_key_t	*key = NULL;
@@ -178,7 +180,7 @@ main(int argc, char **argv) {

 	setup_logging(mctx, &log);

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -376,10 +378,17 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("Extraneous arguments");

-	result = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	result = dst_lib_init2(mctx, ectx, engine,
+			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS)
 		fatal("Could not initialize dst: %s",
 		      isc_result_totext(result));
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("Could not initialize hash");
+	isc_entropy_stopcallbacksources(ectx);

 	if (predecessor != NULL) {
 		int major, minor;
@@ -663,7 +672,9 @@ main(int argc, char **argv) {
 	if (prevkey != NULL)
 		dst_key_free(&prevkey);
 	dst_key_free(&key);
+	isc_hash_destroy();
 	dst_lib_destroy();
+	cleanup_entropy(&ectx);
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	cleanup_logging(&log);
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2009, 2011-2017 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,7 @@
 dnssec-signzone \- DNSSEC zone signing tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-signzone\fR\ 'u
-\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fImaxttl\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-Q\fR] [\fB\-R\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
+\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fImaxttl\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-p\fR] [\fB\-Q\fR] [\fB\-R\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-signzone\fR
@@ -278,6 +278,11 @@ specifies the format version of the raw zone file: if N is 0, the raw file can b
 \fBnamed\fR; if N is 1, the file can be read by release 9\&.9\&.0 or higher; the default is 1\&.
 .RE
 .PP
+\-p
+.RS 4
+Use pseudo\-random data when signing the zone\&. This is faster, but less secure, than using real random data\&. This option may be useful when signing large zones or when the entropy source is limited\&.
+.RE
+.PP
 \-P
 .RS 4
 Disable post sign verification tests\&.
@@ -306,6 +311,17 @@ This option is similar to
 to signatures from keys that are no longer published\&. This enables ZSK rollover using the procedure described in RFC 4641, section 4\&.2\&.1\&.2 ("Double Signature Zone Signing Key Rollover")\&.
 .RE
 .PP
+\-r \fIrandomdev\fR
+.RS 4
+Specifies the source of randomness\&. If the operating system does not provide a
+/dev/random
+or equivalent device, the default source of randomness is keyboard input\&.
+randomdev
+specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
+keyboard
+indicates that keyboard input should be used\&.
+.RE
+.PP
 \-S
 .RS 4
 Smart signing: Instructs
@@ -468,5 +484,5 @@ RFC 4641\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2009, 2011-2017 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -34,6 +34,7 @@
 #include <isc/app.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
@@ -76,11 +77,10 @@
 #include <dns/soa.h>
 #include <dns/time.h>
 #include <dns/update.h>
-#include <dns/zoneverify.h>

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -97,10 +97,6 @@ typedef struct hashlist hashlist_t;

 static int nsec_datatype = dns_rdatatype_nsec;

-#define check_dns_dbiterator_current(result) \
-	check_result((result == DNS_R_NEWORIGIN) ? ISC_R_SUCCESS : result, \
-		     "dns_dbiterator_current()")
-
 #define IS_NSEC3	(nsec_datatype == dns_rdatatype_nsec3)
 #define OPTOUT(x)	(((x) & DNS_NSEC3FLAG_OPTOUT) != 0)

@@ -134,6 +130,7 @@ static int jitter = 0;
 static isc_boolean_t tryverify = ISC_FALSE;
 static isc_boolean_t printstats = ISC_FALSE;
 static isc_mem_t *mctx = NULL;
+static isc_entropy_t *ectx = NULL;
 static dns_ttl_t zone_soa_min_ttl;
 static dns_ttl_t soa_ttl;
 static FILE *outfp = NULL;
@@ -194,19 +191,6 @@ static dns_ttl_t maxttl = 0;
 static void
 sign(isc_task_t *task, isc_event_t *event);

-/*%
- * Store a copy of 'name' in 'fzonecut' and return a pointer to that copy.
- */
-static dns_name_t *
-savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
-	dns_name_t *result;
-
-	result = dns_fixedname_initname(fzonecut);
-	dns_name_copy(name, result, NULL);
-
-	return (result);
-}
-
 static void
 dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 	dns_rdataset_t rds;
@@ -298,10 +282,11 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
 	else
 		expiry = endtime;

-	jendtime = (jitter != 0) ? expiry - isc_random_uniform(jitter) : expiry;
+	jendtime = (jitter != 0) ? isc_random_jitter(expiry, jitter) : expiry;
 	isc_buffer_init(&b, array, sizeof(array));
 	result = dns_dnssec_sign(name, rdataset, key, &starttime, &jendtime,
 				 mctx, &b, &trdata);
+	isc_entropy_stopcallbacksources(ectx);
 	if (result != ISC_R_SUCCESS) {
 		fatal("dnskey '%s' failed to sign data: %s",
 		      keystr, isc_result_totext(result));
@@ -310,8 +295,8 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,

 	if (tryverify) {
 		result = dns_dnssec_verify(name, rdataset, key,
-					   ISC_TRUE, 0, mctx, &trdata, NULL);
-		if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
+					   ISC_TRUE, mctx, &trdata);
+		if (result == ISC_R_SUCCESS) {
 			vbprintf(3, "\tsignature verified\n");
 			INCSTAT(nverified);
 		} else {
@@ -471,9 +456,8 @@ setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	    dns_rdata_t *rrsig)
 {
 	isc_result_t result;
-	result = dns_dnssec_verify(name, set, key, ISC_FALSE, 0, mctx, rrsig,
-				   NULL);
-	if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
+	result = dns_dnssec_verify(name, set, key, ISC_FALSE, mctx, rrsig);
+	if (result == ISC_R_SUCCESS) {
 		INCSTAT(nverified);
 		return (ISC_TRUE);
 	} else {
@@ -503,11 +487,11 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	dns_ttl_t ttl;
 	int i;
 	char namestr[DNS_NAME_FORMATSIZE];
-	char typestr[DNS_RDATATYPE_FORMATSIZE];
+	char typestr[TYPE_FORMATSIZE];
 	char sigstr[SIG_FORMATSIZE];

 	dns_name_format(name, namestr, sizeof(namestr));
-	dns_rdatatype_format(set->type, typestr, sizeof(typestr));
+	type_format(set->type, typestr, sizeof(typestr));

 	ttl = ISC_MIN(set->ttl, endtime - starttime);

@@ -865,7 +849,8 @@ addnowildcardhash(hashlist_t *l, /*const*/ dns_name_t *name,
 	isc_result_t result;
 	char namestr[DNS_NAME_FORMATSIZE];

-	wild = dns_fixedname_initname(&fixed);
+	dns_fixedname_init(&fixed);
+	wild = dns_fixedname_name(&fixed);

 	result = dns_name_concatenate(dns_wildcardname, name, wild, NULL);
 	if (result == ISC_R_NOSPACE)
@@ -920,7 +905,7 @@ opendb(const char *prefix, dns_name_t *name, dns_rdataclass_t rdclass,
 			       rdclass, 0, NULL, dbp);
 	check_result(result, "dns_db_create()");

-	result = dns_db_load(*dbp, filename, inputformat, DNS_MASTER_HINT);
+	result = dns_db_load3(*dbp, filename, inputformat, DNS_MASTER_HINT);
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 		dns_db_detach(dbp);
 }
@@ -1047,47 +1032,6 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 	return (ISC_TF(result == ISC_R_SUCCESS));
 }

-static isc_boolean_t
-is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
-	      dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp)
-{
-	dns_rdataset_t nsset;
-	isc_result_t result;
-
-	if (dns_name_equal(name, origin))
-		return (ISC_FALSE);
-
-	dns_rdataset_init(&nsset);
-	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_ns,
-				     0, 0, &nsset, NULL);
-	if (dns_rdataset_isassociated(&nsset)) {
-		if (ttlp != NULL)
-			*ttlp = nsset.ttl;
-		dns_rdataset_disassociate(&nsset);
-	}
-
-	return (ISC_TF(result == ISC_R_SUCCESS));
-}
-
-/*%
- * Return ISC_TRUE if version 'ver' of database 'db' contains a DNAME RRset at
- * 'node'; return ISC_FALSE otherwise.
- */
-static isc_boolean_t
-has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
-	dns_rdataset_t dnameset;
-	isc_result_t result;
-
-	dns_rdataset_init(&dnameset);
-	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_dname, 0, 0,
-				     &dnameset, NULL);
-	if (dns_rdataset_isassociated(&dnameset)) {
-		dns_rdataset_disassociate(&dnameset);
-	}
-
-	return (ISC_TF(result == ISC_R_SUCCESS));
-}
-
 /*%
 * Signs all records at a name.
 */
@@ -1292,7 +1236,8 @@ get_soa_ttls(void) {
 	isc_result_t result;
 	dns_rdata_t rdata = DNS_RDATA_INIT;

-	name = dns_fixedname_initname(&fname);
+	dns_fixedname_init(&fname);
+	name = dns_fixedname_name(&fname);
 	dns_rdataset_init(&soaset);
 	result = dns_db_find(gdb, gorigin, gversion, dns_rdatatype_soa,
 			     0, 0, NULL, name, &soaset, NULL);
@@ -1461,7 +1406,8 @@ signapex(void) {
 	dns_name_t *name;
 	isc_result_t result;

-	name = dns_fixedname_initname(&fixed);
+	dns_fixedname_init(&fixed);
+	name = dns_fixedname_name(&fixed);
 	result = dns_dbiterator_seek(gdbiter, gorigin);
 	check_result(result, "dns_dbiterator_seek()");
 	result = dns_dbiterator_current(gdbiter, &node, name);
@@ -1511,7 +1457,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	fname = isc_mem_get(mctx, sizeof(dns_fixedname_t));
 	if (fname == NULL)
 		fatal("out of memory");
-	name = dns_fixedname_initname(fname);
+	dns_fixedname_init(fname);
+	name = dns_fixedname_name(fname);
 	node = NULL;
 	found = ISC_FALSE;
 	while (!found) {
@@ -1544,19 +1491,15 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 			if (dns_name_issubdomain(name, gorigin) &&
 			    (zonecut == NULL ||
 			     !dns_name_issubdomain(name, zonecut))) {
-				if (is_delegation(gdb, gversion, gorigin,
-						  name, node, NULL))
-				{
-					zonecut = savezonecut(&fzonecut, name);
+				if (is_delegation(gdb, gversion, gorigin, name, node, NULL)) {
+					dns_fixedname_init(&fzonecut);
+					zonecut = dns_fixedname_name(&fzonecut);
+					dns_name_copy(name, zonecut, NULL);
 					if (!OPTOUT(nsec3flags) ||
 					    secure(name, node))
 						found = ISC_TRUE;
-				} else if (has_dname(gdb, gversion, node)) {
-					zonecut = savezonecut(&fzonecut, name);
+				} else
 					found = ISC_TRUE;
-				} else {
-					found = ISC_TRUE;
-				}
 			}
 		}

@@ -1793,8 +1736,11 @@ nsecify(void) {
 	isc_uint32_t nsttl = 0;

 	dns_rdataset_init(&rdataset);
-	name = dns_fixedname_initname(&fname);
-	nextname = dns_fixedname_initname(&fnextname);
+	dns_fixedname_init(&fname);
+	name = dns_fixedname_name(&fname);
+	dns_fixedname_init(&fnextname);
+	nextname = dns_fixedname_name(&fnextname);
+	dns_fixedname_init(&fzonecut);
 	zonecut = NULL;

 	/*
@@ -1856,12 +1802,11 @@ nsecify(void) {
 		}

 		if (is_delegation(gdb, gversion, gorigin, name, node, &nsttl)) {
-			zonecut = savezonecut(&fzonecut, name);
+			zonecut = dns_fixedname_name(&fzonecut);
+			dns_name_copy(name, zonecut, NULL);
 			remove_sigs(node, ISC_TRUE, 0);
 			if (generateds)
 				add_ds(name, node, nsttl);
-		} else if (has_dname(gdb, gversion, node)) {
-			zonecut = savezonecut(&fzonecut, name);
 		}

 		result = dns_dbiterator_next(dbiter);
@@ -2136,10 +2081,10 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset,
 	unsigned int count1 = 0;
 	dns_rdataset_t tmprdataset;
 	char namestr[DNS_NAME_FORMATSIZE];
-	char typestr[DNS_RDATATYPE_FORMATSIZE];
+	char typestr[TYPE_FORMATSIZE];

 	dns_name_format(name, namestr, sizeof(namestr));
-	dns_rdatatype_format(rdataset->type, typestr, sizeof(typestr));
+	type_format(rdataset->type, typestr, sizeof(typestr));

 	dns_rdataset_init(&tmprdataset);
 	for (result = dns_rdataset_first(rdataset);
@@ -2206,7 +2151,8 @@ cleanup_zone(void) {

 	dns_diff_init(mctx, &add);
 	dns_diff_init(mctx, &del);
-	name = dns_fixedname_initname(&fname);
+	dns_fixedname_init(&fname);
+	name = dns_fixedname_name(&fname);
 	dns_rdataset_init(&rdataset);

 	result = dns_db_createiterator(gdb, 0, &dbiter);
@@ -2266,8 +2212,11 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 	unsigned int count, nlabels;

 	dns_rdataset_init(&rdataset);
-	name = dns_fixedname_initname(&fname);
-	nextname = dns_fixedname_initname(&fnextname);
+	dns_fixedname_init(&fname);
+	name = dns_fixedname_name(&fname);
+	dns_fixedname_init(&fnextname);
+	nextname = dns_fixedname_name(&fnextname);
+	dns_fixedname_init(&fzonecut);
 	zonecut = NULL;

 	/*
@@ -2301,10 +2250,6 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			(void)active_node(node);
 		}

-		if (has_dname(gdb, gversion, node)) {
-			zonecut = savezonecut(&fzonecut, name);
-		}
-
 		result = dns_dbiterator_next(dbiter);
 		nextnode = NULL;
 		while (result == ISC_R_SUCCESS) {
@@ -2328,7 +2273,8 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			if (is_delegation(gdb, gversion, gorigin,
 					  nextname, nextnode, &nsttl))
 			{
-				zonecut = savezonecut(&fzonecut, nextname);
+				zonecut = dns_fixedname_name(&fzonecut);
+				dns_name_copy(nextname, zonecut, NULL);
 				remove_sigs(nextnode, ISC_TRUE, 0);
 				if (generateds)
 					add_ds(nextname, nextnode, nsttl);
@@ -2338,8 +2284,6 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 					result = dns_dbiterator_next(dbiter);
 					continue;
 				}
-			} else if (has_dname(gdb, gversion, nextnode)) {
-				zonecut = savezonecut(&fzonecut, nextname);
 			}
 			dns_db_detachnode(gdb, &nextnode);
 			break;
@@ -2438,11 +2382,6 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			dns_db_detachnode(gdb, &node);
 			continue;
 		}
-
-		if (has_dname(gdb, gversion, node)) {
-			zonecut = savezonecut(&fzonecut, name);
-		}
-
 		result = dns_dbiterator_next(dbiter);
 		nextnode = NULL;
 		while (result == ISC_R_SUCCESS) {
@@ -2465,15 +2404,14 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			if (is_delegation(gdb, gversion, gorigin,
 					  nextname, nextnode, NULL))
 			{
-				zonecut = savezonecut(&fzonecut, nextname);
+				zonecut = dns_fixedname_name(&fzonecut);
+				dns_name_copy(nextname, zonecut, NULL);
 				if (OPTOUT(nsec3flags) &&
 				    !secure(nextname, nextnode)) {
 					dns_db_detachnode(gdb, &nextnode);
 					result = dns_dbiterator_next(dbiter);
 					continue;
 				}
-			} else if (has_dname(gdb, gversion, nextnode)) {
-				zonecut = savezonecut(&fzonecut, nextname);
 			}
 			dns_db_detachnode(gdb, &nextnode);
 			break;
@@ -2521,7 +2459,8 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_init(&b, origin, len);
 	isc_buffer_add(&b, len);

-	name = dns_fixedname_initname(&fname);
+	dns_fixedname_init(&fname);
+	name = dns_fixedname_name(&fname);
 	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS)
 		fatal("failed converting name '%s' to dns format: %s",
@@ -2531,7 +2470,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 			       rdclass, 0, NULL, db);
 	check_result(result, "dns_db_create()");

-	result = dns_db_load(*db, file, inputformat, 0);
+	result = dns_db_load2(*db, file, inputformat);
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 		fatal("failed loading zone from '%s': %s",
 		      file, isc_result_totext(result));
@@ -2697,7 +2636,7 @@ build_final_keylist(void) {
 	 * Find keys that match this zone in the key repository.
 	 */
 	result = dns_dnssec_findmatchingkeys(gorigin, directory,
-					     now, mctx, &matchkeys);
+					     mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
 		result = ISC_R_SUCCESS;
 	}
@@ -2869,7 +2808,8 @@ set_nsec3params(isc_boolean_t update, isc_boolean_t set_salt,
 	 * (This assumes all NSEC3 records agree.)
 	 */

-	hashname = dns_fixedname_initname(&fname);
+	dns_fixedname_init(&fname);
+	hashname = dns_fixedname_name(&fname);
 	result = dns_nsec3_hashname(&fname, NULL, NULL,
 				    gorigin, gorigin, dns_hash_sha1,
 				    orig_iter, orig_salt, orig_saltlen);
@@ -2958,7 +2898,8 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 		unsigned int labels;

 		dns_name_init(&tname, NULL);
-		name = dns_fixedname_initname(&fixed);
+		dns_fixedname_init(&fixed);
+		name = dns_fixedname_name(&fixed);
 		labels = dns_name_countlabels(gorigin);
 		dns_name_getlabelsequence(gorigin, 0, labels - 1, &tname);
 		result = dns_name_concatenate(&tname, dlv, name, NULL);
@@ -3044,8 +2985,7 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	check_result(result, "dns_diff_apply");
 	dns_diff_clear(&diff);

-	result = dns_master_dump(mctx, db, dbversion, style, filename,
-				 dns_masterformat_text, NULL);
+	result = dns_master_dump(mctx, db, dbversion, style, filename);
 	check_result(result, "dns_master_dump");

 	isc_mem_put(mctx, filename, filenamelen);
@@ -3127,11 +3067,13 @@ usage(void) {
 	fprintf(stderr, "\t\tsoa serial format of signed zone file (keep)\n");
 	fprintf(stderr, "\t-D:\n");
 	fprintf(stderr, "\t\toutput only DNSSEC-related records\n");
+	fprintf(stderr, "\t-r randomdev:\n");
+	fprintf(stderr,	"\t\ta file containing random data\n");
 	fprintf(stderr, "\t-a:\t");
 	fprintf(stderr, "verify generated signatures\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#if HAVE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "\t\tpath to PKCS#11 provider library "
 		"(default is %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -3140,6 +3082,8 @@ usage(void) {
 #else
 	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 #endif
+	fprintf(stderr, "\t-p:\t");
+	fprintf(stderr, "use pseudorandom data (faster but less secure)\n");
 	fprintf(stderr, "\t-P:\t");
 	fprintf(stderr, "disable post-sign verification\n");
 	fprintf(stderr, "\t-Q:\t");
@@ -3227,13 +3171,15 @@ main(int argc, char *argv[]) {
 	isc_time_t timer_start, timer_finish;
 	isc_time_t sign_start, sign_finish;
 	dns_dnsseckey_t *key;
-	isc_result_t result, vresult;
+	isc_result_t result;
 	isc_log_t *log = NULL;
+	isc_boolean_t pseudorandom = ISC_FALSE;
 #ifdef USE_PKCS11
 	const char *engine = PKCS11_ENGINE;
 #else
 	const char *engine = NULL;
 #endif
+	unsigned int eflags;
 	isc_boolean_t free_output = ISC_FALSE;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
@@ -3286,7 +3232,7 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -3418,7 +3364,8 @@ main(int argc, char *argv[]) {
 			isc_buffer_init(&b, isc_commandline_argument, len);
 			isc_buffer_add(&b, len);

-			dlv = dns_fixedname_initname(&dlv_fixed);
+			dns_fixedname_init(&dlv_fixed);
+			dlv = dns_fixedname_name(&dlv_fixed);
 			result = dns_name_fromtext(dlv, &b, dns_rootname, 0,
 						   NULL);
 			check_result(result, "dns_name_fromtext(dlv)");
@@ -3462,7 +3409,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'p':
-			fatal("The -p option has been deprecated.\n");
+			pseudorandom = ISC_TRUE;
 			break;

 		case 'Q':
@@ -3474,7 +3421,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'r':
-			fatal("The -r options has been deprecated.\n");
+			setup_entropy(mctx, isc_commandline_argument, &ectx);
 			break;

 		case 'S':
@@ -3550,11 +3497,21 @@ main(int argc, char *argv[]) {
 		}
 	}

-	result = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+	eflags = ISC_ENTROPY_BLOCKING;
+	if (!pseudorandom)
+		eflags |= ISC_ENTROPY_GOODONLY;
+
+	result = dst_lib_init2(mctx, ectx, engine, eflags);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));

+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("could not create hash context");
+
 	isc_stdtime_get(&now);

 	if (startstr != NULL) {
@@ -3680,8 +3637,8 @@ main(int argc, char *argv[]) {
 	if (output_dnssec_only && set_maxttl)
 		fatal("option -D cannot be used with -M");

-	result = dns_master_stylecreate(&dsstyle, DNS_STYLEFLAG_NO_TTL,
-					0, 24, 0, 0, 0, 8, 0xffffffff, mctx);
+	result = dns_master_stylecreate(&dsstyle,  DNS_STYLEFLAG_NO_TTL,
+					0, 24, 0, 0, 0, 8, mctx);
 	check_result(result, "dns_master_stylecreate");

 	gdb = NULL;
@@ -3912,18 +3869,9 @@ main(int argc, char *argv[]) {
 	postsign();
 	TIME_NOW(&sign_finish);

-	if (disable_zone_check) {
-		vresult = ISC_R_SUCCESS;
-	} else {
-		vresult = dns_zoneverify_dnssec(NULL, gdb, gversion, gorigin,
-						mctx, ignore_kskflag,
-						keyset_kskonly);
-		if (vresult != ISC_R_SUCCESS) {
-			fprintf(output_stdout ? stderr : stdout,
-				"Zone verification failed (%s)\n",
-				isc_result_totext(vresult));
-		}
-	}
+	if (!disable_zone_check)
+		verifyzone(gdb, gversion, gorigin, mctx,
+			   ignore_kskflag, keyset_kskonly);

 	if (outputformat != dns_masterformat_text) {
 		dns_masterrawheader_t header;
@@ -3934,9 +3882,9 @@ main(int argc, char *argv[]) {
 			header.flags = DNS_MASTERRAW_SOURCESERIALSET;
 			header.sourceserial = serialnum;
 		}
-		result = dns_master_dumptostream(mctx, gdb, gversion,
-						 masterstyle, outputformat,
-						 &header, outfp);
+		result = dns_master_dumptostream3(mctx, gdb, gversion,
+						  masterstyle, outputformat,
+						  &header, outfp);
 		check_result(result, "dns_master_dumptostream3");
 	}

@@ -3949,16 +3897,12 @@ main(int argc, char *argv[]) {
 		check_result(result, "isc_stdio_close");
 		removefile = ISC_FALSE;

-		if (vresult == ISC_R_SUCCESS) {
-			result = isc_file_rename(tempfile, output);
-			if (result != ISC_R_SUCCESS) {
-				fatal("failed to rename temp file to %s: %s",
-				      output, isc_result_totext(result));
-			}
-			printf("%s\n", output);
-		} else {
-			isc_file_remove(tempfile);
-		}
+		result = isc_file_rename(tempfile, output);
+		if (result != ISC_R_SUCCESS)
+			fatal("failed to rename temp file to %s: %s",
+			      output, isc_result_totext(result));
+
+		printf("%s\n", output);
 	}

 	dns_db_closeversion(gdb, &gversion, ISC_FALSE);
@@ -3981,7 +3925,9 @@ main(int argc, char *argv[]) {
 	dns_master_styledestroy(&dsstyle, mctx);

 	cleanup_logging(&log);
+	isc_hash_destroy();
 	dst_lib_destroy();
+	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -3998,5 +3944,5 @@ main(int argc, char *argv[]) {
 #ifdef _WIN32
 	DestroySockets();
 #endif
-	return (vresult == ISC_R_SUCCESS ? 0 : 1);
+	return (0);
 }
@@ -78,8 +78,10 @@
      <arg choice="opt" rep="norepeat"><option>-o <replaceable class="parameter">origin</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-O <replaceable class="parameter">output-format</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-p</option></arg>
      <arg choice="opt" rep="norepeat"><option>-Q</option></arg>
      <arg choice="opt" rep="norepeat"><option>-R</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-S</option></arg>
      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">start-time</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">ttl</replaceable></option></arg>
@@ -506,6 +508,18 @@
        </listitem>
      </varlistentry>

+      <varlistentry>
+        <term>-p</term>
+        <listitem>
+          <para>
+            Use pseudo-random data when signing the zone.  This is faster,
+            but less secure, than using real random data.  This option
+            may be useful when signing large zones or when the entropy
+            source is limited.
+          </para>
+        </listitem>
+      </varlistentry>
+
      <varlistentry>
        <term>-P</term>
        <listitem>
@@ -557,6 +571,23 @@
          </para>
        </listitem>
      </varlistentry>
+      <varlistentry>
+        <term>-r <replaceable class="parameter">randomdev</replaceable></term>
+        <listitem>
+          <para>
+            Specifies the source of randomness.  If the operating
+            system does not provide a <filename>/dev/random</filename>
+            or equivalent device, the default source of randomness
+            is keyboard input.  <filename>randomdev</filename>
+            specifies
+            the name of a character device or file containing random
+            data to be used instead of the default.  The special value
+            <filename>keyboard</filename> indicates that keyboard
+            input should be used.
+          </para>
+        </listitem>
+      </varlistentry>
+
      <varlistentry>
        <term>-S</term>
        <listitem>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2009, 2011-2017 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -54,8 +54,10 @@
       [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>]
       [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>]
       [<code class="option">-P</code>]
+       [<code class="option">-p</code>]
       [<code class="option">-Q</code>]
       [<code class="option">-R</code>]
+       [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>]
       [<code class="option">-S</code>]
       [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>]
       [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>]
@@ -398,6 +400,15 @@
            can be read by release 9.9.0 or higher; the default is 1.
          </p>
        </dd>
+<dt><span class="term">-p</span></dt>
+<dd>
+          <p>
+            Use pseudo-random data when signing the zone.  This is faster,
+            but less secure, than using real random data.  This option
+            may be useful when signing large zones or when the entropy
+            source is limited.
+          </p>
+        </dd>
 <dt><span class="term">-P</span></dt>
 <dd>
          <p>
@@ -442,6 +453,20 @@
            ("Double Signature Zone Signing Key Rollover").
          </p>
        </dd>
+<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
+<dd>
+          <p>
+            Specifies the source of randomness.  If the operating
+            system does not provide a <code class="filename">/dev/random</code>
+            or equivalent device, the default source of randomness
+            is keyboard input.  <code class="filename">randomdev</code>
+            specifies
+            the name of a character device or file containing random
+            data to be used instead of the default.  The special value
+            <code class="filename">keyboard</code> indicates that keyboard
+            input should be used.
+          </p>
+        </dd>
 <dt><span class="term">-S</span></dt>
 <dd>
          <p>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -113,5 +113,5 @@ RFC 4033\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -19,6 +19,7 @@
 #include <isc/app.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
+#include <isc/entropy.h>
 #include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
@@ -58,11 +59,10 @@
 #include <dns/result.h>
 #include <dns/soa.h>
 #include <dns/time.h>
-#include <dns/zoneverify.h>

 #include <dst/dst.h>

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -73,6 +73,7 @@ int verbose;

 static isc_stdtime_t now;
 static isc_mem_t *mctx = NULL;
+static isc_entropy_t *ectx = NULL;
 static dns_masterformat_t inputformat = dns_masterformat_text;
 static dns_db_t *gdb;			/* The database */
 static dns_dbversion_t *gversion;	/* The database version */
@@ -96,7 +97,8 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_init(&b, origin, len);
 	isc_buffer_add(&b, len);

-	name = dns_fixedname_initname(&fname);
+	dns_fixedname_init(&fname);
+	name = dns_fixedname_name(&fname);
 	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS)
 		fatal("failed converting name '%s' to dns format: %s",
@@ -106,7 +108,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 			       rdclass, 0, NULL, db);
 	check_result(result, "dns_db_create()");

-	result = dns_db_load(*db, file, inputformat, 0);
+	result = dns_db_load2(*db, file, inputformat);
 	switch (result) {
 	case DNS_R_SEENINCLUDE:
 	case ISC_R_SUCCESS:
@@ -150,7 +152,7 @@ usage(void) {
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#if HAVE_PKCS11
+#if defined(PKCS11CRYPTO)
 	fprintf(stderr, "\t\tpath to PKCS#11 provider library "
 		"(default is %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -212,7 +214,7 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -276,11 +278,18 @@ main(int argc, char *argv[]) {
 		}
 	}

-	result = dst_lib_init(mctx, engine);
+	if (ectx == NULL)
+		setup_entropy(mctx, NULL, &ectx);
+
+	result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));

+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("could not create hash context");
+
 	isc_stdtime_get(&now);

 	rdclass = strtoclass(classname);
@@ -323,14 +332,16 @@ main(int argc, char *argv[]) {
 	result = dns_db_newversion(gdb, &gversion);
 	check_result(result, "dns_db_newversion()");

-	result = dns_zoneverify_dnssec(NULL, gdb, gversion, gorigin, mctx,
-				       ignore_kskflag, keyset_kskonly);
+	verifyzone(gdb, gversion, gorigin, mctx,
+		   ignore_kskflag, keyset_kskonly);

 	dns_db_closeversion(gdb, &gversion, ISC_FALSE);
 	dns_db_detach(&gdb);

 	cleanup_logging(&log);
 	dst_lib_destroy();
+	isc_hash_destroy();
+	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -338,5 +349,5 @@ main(int argc, char *argv[]) {

 	(void) isc_app_finish();

-	return (result == ISC_R_SUCCESS ? 0 : 1);
+	return (0);
 }
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: dnssectool.h,v 1.33 2011/10/20 23:46:51 tbox Exp $ */

 #ifndef DNSSECTOOL_H
 #define DNSSECTOOL_H 1
@@ -18,6 +19,11 @@
 #include <dns/rdatastruct.h>
 #include <dst/dst.h>

+#define check_dns_dbiterator_current(result) \
+	check_result((result == DNS_R_NEWORIGIN) ? ISC_R_SUCCESS : result, \
+		     "dns_dbiterator_current()")
+
+
 typedef void (fatalcallback_t)(void);

 ISC_PLATFORM_NORETURN_PRE void
@@ -36,6 +42,10 @@ vbprintf(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 ISC_PLATFORM_NORETURN_PRE void
 version(const char *program) ISC_PLATFORM_NORETURN_POST;

+void
+type_format(const dns_rdatatype_t type, char *cp, unsigned int size);
+#define TYPE_FORMATSIZE 20
+
 void
 sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
 #define SIG_FORMATSIZE (DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + sizeof("65535"))
@@ -46,6 +56,12 @@ setup_logging(isc_mem_t *mctx, isc_log_t **logp);
 void
 cleanup_logging(isc_log_t **logp);

+void
+setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx);
+
+void
+cleanup_entropy(isc_entropy_t **ectx);
+
 dns_ttl_t strtottl(const char *str);

 isc_stdtime_t
@@ -71,6 +87,15 @@ isc_boolean_t
 key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
 	      isc_mem_t *mctx, isc_boolean_t *exact);

+isc_boolean_t
+is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
+		      dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp);
+
+void
+verifyzone(dns_db_t *db, dns_dbversion_t *ver,
+		   dns_name_t *origin, isc_mem_t *mctx,
+		   isc_boolean_t ignore_kskflag, isc_boolean_t keyset_kskonly);
+
 isc_boolean_t
 isoptarg(const char *arg, char **argv, void (*usage)(void));

@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
 		${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@

-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@
+CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@

 CWARNINGS =

@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: builtin.c,v 1.26 2012/01/21 19:44:18 each Exp $ */

 /*! \file
 * \brief
@@ -27,7 +27,6 @@

 #include <pk11/site.h>

-#include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>

 #include <dns/fixedname.h>
@@ -47,7 +46,6 @@
 /*% default configuration */
 static char defaultconf[] = "\
 options {\n\
-#	answer-cookie <obsolete>;\n\
 	automatic-interface-scan yes;\n\
 	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
 #	blackhole {none;};\n"
@@ -90,13 +88,17 @@ options {\n\
 	nta-recheck 300;\n\
 #	pid-file \"" NAMED_LOCALSTATEDIR "/run/named/named.pid\"; \n\
 	port 53;\n\
-	prefetch 2 9;\n\
-	recursing-file \"named.recursing\";\n\
+	prefetch 2 9;\n"
+#if defined(ISC_PLATFORM_CRYPTORANDOM)
+"	random-device none;\n"
+#elif defined(PATH_RANDOMDEV)
+"	random-device \"" PATH_RANDOMDEV "\";\n"
+#endif
+"	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
 	reserved-sockets 512;\n\
 	resolver-query-timeout 10;\n\
-	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
 #	serial-queries <obsolete>;\n\
@@ -149,7 +151,7 @@ options {\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-enable yes;\n\
-	dnssec-validation " VALIDATION_DEFAULT "; \n"
+	dnssec-validation yes; \n"
 #ifdef HAVE_DNSTAP
 "	dnstap-identity hostname;\n"
 #endif
@@ -184,7 +186,6 @@ options {\n\
 	notify-source-v6 *;\n\
 	nsec3-test-zone no;\n\
 	provide-ixfr true;\n\
-	qname-minimization relaxed;\n\
 	query-source address *;\n\
 	query-source-v6 address *;\n\
 	recursion true;\n\
@@ -194,7 +195,6 @@ options {\n\
 	resolver-nonbackoff-tries 3;\n\
 	resolver-retry-interval 800; /* in milliseconds */\n\
 #	rfc2308-type1 <obsolete>;\n\
-	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
 #	sortlist <none>\n\
 	stale-answer-enable false;\n\
@@ -247,7 +247,6 @@ options {\n\
 	sig-signing-signatures 10;\n\
 	sig-signing-type 65534;\n\
 	sig-validity-interval 30; /* days */\n\
-	dnskey-sig-validity 0; /* default: sig-validity-interval */\n\
 	transfer-source *;\n\
 	transfer-source-v6 *;\n\
 	try-tcp-refresh yes; /* BIND 8 compat */\n\
@@ -312,9 +311,8 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {

 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return (cfg_parse_buffer4(parser, &b, __FILE__, 0,
-				  &cfg_type_namedconf,
-				  CFG_PCTX_NODEPRECATED, conf));
+	return (cfg_parse_buffer3(parser, &b, __FILE__, 0,
+				  &cfg_type_namedconf, conf));
 }

 isc_result_t
@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: control.c,v 1.49 2012/01/31 23:47:31 tbox Exp $ */

 /*! \file */

@@ -20,7 +20,6 @@
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netaddr.h>
-#include <isc/nonce.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/stdtime.h>
@@ -232,11 +231,11 @@ address_ok(isc_sockaddr_t *sockaddr, dns_acl_t *acl) {
 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);

 	result = dns_acl_match(&netaddr, NULL, acl, env, &match, NULL);
-	if (result != ISC_R_SUCCESS || match <= 0) {
+
+	if (result != ISC_R_SUCCESS || match <= 0)
 		return (ISC_FALSE);
-	} else {
+	else
 		return (ISC_TRUE);
-	}
 }

 static isc_result_t
@@ -326,6 +325,7 @@ static void
 control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	controlconnection_t *conn = NULL;
 	controllistener_t *listener = NULL;
+	named_server_t *server = NULL;
 	controlkey_t *key = NULL;
 	isccc_sexpr_t *request = NULL;
 	isccc_sexpr_t *response = NULL;
@@ -347,6 +347,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

 	conn = event->ev_arg;
 	listener = conn->listener;
+	server = listener->controls->server;
 	algorithm = DST_ALG_UNKNOWN;
 	secret.rstart = NULL;
 	text = NULL;
@@ -458,7 +459,8 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (conn->nonce == 0) {
 		while (conn->nonce == 0) {
-			isc_nonce_buf(&conn->nonce, sizeof(conn->nonce));
+			isc_rng_randombytes(server->sctx->rngctx, &conn->nonce,
+					    sizeof(conn->nonce));
 		}
 		eresult = ISC_R_SUCCESS;
 	} else
@@ -9,6 +9,8 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+# $Id: convertxsl.pl,v 1.14 2008/07/17 23:43:26 jinmei Exp $
+
 use strict;
 use warnings;

@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: dlz_dlopen_driver.h,v 1.4 2011/03/17 09:25:53 fdupont Exp $ */

 #ifndef DLZ_DLOPEN_DRIVER_H
 #define DLZ_DLOPEN_DRIVER_H
@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: config.h,v 1.16 2009/06/11 23:47:55 tbox Exp $ */

 #ifndef NAMED_CONFIG_H
 #define NAMED_CONFIG_H 1
@@ -48,6 +48,8 @@ EXTERN unsigned int		named_g_cpus		INIT(0);
 EXTERN unsigned int		named_g_udpdisp		INIT(0);
 EXTERN isc_taskmgr_t *		named_g_taskmgr		INIT(NULL);
 EXTERN dns_dispatchmgr_t *	named_g_dispatchmgr	INIT(NULL);
+EXTERN isc_entropy_t *		named_g_entropy		INIT(NULL);
+EXTERN isc_entropy_t *		named_g_fallbackentropy	INIT(NULL);
 EXTERN unsigned int		named_g_cpus_detected	INIT(1);

 #ifdef ENABLE_AFL
@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */

+/* $Id: logconf.h,v 1.17 2007/06/19 23:46:59 tbox Exp $ */

 #ifndef NAMED_LOGCONF_H
 #define NAMED_LOGCONF_H 1
@@ -23,7 +23,7 @@ ISC_LANG_BEGINDECLS

 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
-			 dns_tkeyctx_t **tctxp);
+			 isc_entropy_t *ectx, dns_tkeyctx_t **tctxp);
 /*%<
 * 	Create a TKEY context and configure it, including the default DH key
 *	and default domain, according to 'options'.
@@ -31,6 +31,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 *	Requires:
 *\li		'cfg' is a valid configuration options object.
 *\li		'mctx' is not NULL
+ *\li		'ectx' is not NULL
 *\li		'tctx' is not NULL
 *\li		'*tctx' is NULL
 *
@@ -21,6 +21,7 @@
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
+#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
@@ -44,7 +45,7 @@
 #include <dns/view.h>

 #include <dst/result.h>
-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 #include <pk11/result.h>
 #endif

@@ -75,7 +76,7 @@
 #include <named/smf_globals.h>
 #endif

-#if HAVE_OPENSSL
+#ifdef OPENSSL
 #include <openssl/opensslv.h>
 #include <openssl/crypto.h>
 #endif
@@ -129,7 +130,6 @@ static unsigned int delay = 0;
 static isc_boolean_t nonearest = ISC_FALSE;
 static isc_boolean_t notcp = ISC_FALSE;
 static isc_boolean_t fixedlocal = ISC_FALSE;
-static isc_boolean_t sigvalinsecs = ISC_FALSE;

 /*
 * -4 and -6
@@ -465,92 +465,6 @@ parse_fuzz_arg(void) {
 	}
 }

-static void
-parse_T_opt(char *option) {
-	const char *p;
-	char *last = NULL;
-	/*
-	 * force the server to behave (or misbehave) in
-	 * specified ways for testing purposes.
-	 *
-	 * clienttest: make clients single shot with their
-	 * 	       own memory context.
-	 * delay=xxxx: delay client responses by xxxx ms to
-	 *	       simulate remote servers.
-	 * dscp=x:     check that dscp values are as
-	 * 	       expected and assert otherwise.
-	 */
-	if (!strcmp(option, "clienttest")) {
-		clienttest = ISC_TRUE;
-	} else if (!strncmp(option, "delay=", 6)) {
-		delay = atoi(option + 6);
-	} else if (!strcmp(option, "dropedns")) {
-		dropedns = ISC_TRUE;
-	} else if (!strncmp(option, "dscp=", 5)) {
-		isc_dscp_check_value = atoi(option + 5);
-	} else if (!strcmp(option, "fixedlocal")) {
-		fixedlocal = ISC_TRUE;
-	} else if (!strcmp(option, "keepstderr")) {
-		named_g_keepstderr = ISC_TRUE;
-	} else if (!strcmp(option, "noaa")) {
-		noaa = ISC_TRUE;
-	} else if (!strcmp(option, "noedns")) {
-		noedns = ISC_TRUE;
-	} else if (!strcmp(option, "nonearest")) {
-		nonearest = ISC_TRUE;
-	} else if (!strcmp(option, "nosoa")) {
-		nosoa = ISC_TRUE;
-	} else if (!strcmp(option, "nosyslog")) {
-		named_g_nosyslog = ISC_TRUE;
-	} else if (!strcmp(option, "notcp")) {
-		notcp = ISC_TRUE;
-	} else if (!strcmp(option, "maxudp512")) {
-		maxudp = 512;
-	} else if (!strcmp(option, "maxudp1460")) {
-		maxudp = 1460;
-	} else if (!strncmp(option, "maxudp=", 7)) {
-		maxudp = atoi(option + 7);
-	} else if (!strncmp(option, "mkeytimers=", 11)) {
-		p = strtok_r(option + 11, "/", &last);
-		if (p == NULL) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-
-		dns_zone_mkey_hour = atoi(p);
-		if (dns_zone_mkey_hour == 0) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-
-		p = strtok_r(NULL, "/", &last);
-		if (p == NULL) {
-			dns_zone_mkey_day = (24 * dns_zone_mkey_hour);
-			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
-			return;
-		}
-
-		dns_zone_mkey_day = atoi(p);
-		if (dns_zone_mkey_day < dns_zone_mkey_hour)
-			named_main_earlyfatal("bad mkeytimer");
-
-		p = strtok_r(NULL, "/", &last);
-		if (p == NULL) {
-			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
-			return;
-		}
-
-		dns_zone_mkey_month = atoi(p);
-		if (dns_zone_mkey_month < dns_zone_mkey_day) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-	} else if (!strcmp(option, "sigvalinsecs")) {
-		sigvalinsecs = ISC_TRUE;
-	} else if (!strncmp(option, "tat=", 4)) {
-		named_g_tat_interval = atoi(option + 4);
-	} else {
-		fprintf(stderr, "unknown -T flag '%s\n", option);
-	}
-}
-
 static void
 parse_command_line(int argc, char *argv[]) {
 	int ch;
@@ -650,7 +564,95 @@ parse_command_line(int argc, char *argv[]) {
 			named_g_chrootdir = isc_commandline_argument;
 			break;
 		case 'T':	/* NOT DOCUMENTED */
-			parse_T_opt(isc_commandline_argument);
+			/*
+			 * force the server to behave (or misbehave) in
+			 * specified ways for testing purposes.
+			 *
+			 * clienttest: make clients single shot with their
+			 * 	       own memory context.
+			 * delay=xxxx: delay client responses by xxxx ms to
+			 *	       simulate remote servers.
+			 * dscp=x:     check that dscp values are as
+			 * 	       expected and assert otherwise.
+			 */
+			if (!strcmp(isc_commandline_argument, "clienttest"))
+				clienttest = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "nosoa"))
+				nosoa = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "noaa"))
+				noaa = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument,
+					 "maxudp512"))
+				maxudp = 512;
+			else if (!strcmp(isc_commandline_argument,
+					 "maxudp1460"))
+				maxudp = 1460;
+			else if (!strcmp(isc_commandline_argument, "dropedns"))
+				dropedns = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "noedns"))
+				noedns = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument,
+					  "maxudp=", 7))
+				maxudp = atoi(isc_commandline_argument + 7);
+			else if (!strncmp(isc_commandline_argument,
+					  "delay=", 6))
+				delay = atoi(isc_commandline_argument + 6);
+			else if (!strcmp(isc_commandline_argument, "nosyslog"))
+				named_g_nosyslog = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "nonearest"))
+				nonearest = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument, "dscp=", 5))
+				isc_dscp_check_value =
+					   atoi(isc_commandline_argument + 5);
+			else if (!strncmp(isc_commandline_argument,
+					  "mkeytimers=", 11))
+			{
+				p = strtok(isc_commandline_argument + 11, "/");
+				if (p == NULL)
+					named_main_earlyfatal("bad mkeytimer");
+				dns_zone_mkey_hour = atoi(p);
+				if (dns_zone_mkey_hour == 0)
+					named_main_earlyfatal("bad mkeytimer");
+
+				p = strtok(NULL, "/");
+				if (p == NULL) {
+					dns_zone_mkey_day =
+						(24 * dns_zone_mkey_hour);
+					dns_zone_mkey_month =
+						(30 * dns_zone_mkey_day);
+					break;
+				}
+				dns_zone_mkey_day = atoi(p);
+				if (dns_zone_mkey_day < dns_zone_mkey_hour)
+					named_main_earlyfatal("bad mkeytimer");
+
+				p = strtok(NULL, "/");
+				if (p == NULL) {
+					dns_zone_mkey_month =
+						(30 * dns_zone_mkey_day);
+					break;
+				}
+				dns_zone_mkey_month = atoi(p);
+				if (dns_zone_mkey_month < dns_zone_mkey_day)
+					named_main_earlyfatal("bad mkeytimer");
+			} else if (!strcmp(isc_commandline_argument, "notcp"))
+				notcp = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument, "tat=", 4))
+			{
+				named_g_tat_interval =
+					   atoi(isc_commandline_argument + 4);
+			} else if (!strcmp(isc_commandline_argument,
+					 "keepstderr"))
+			{
+				named_g_keepstderr = ISC_TRUE;
+			} else if (!strcmp(isc_commandline_argument,
+					   "fixedlocal"))
+			{
+				fixedlocal = ISC_TRUE;
+			} else {
+				fprintf(stderr, "unknown -T flag '%s\n",
+					isc_commandline_argument);
+			}
 			break;
 		case 'U':
 			named_g_udpdisp = parse_int(isc_commandline_argument,
@@ -691,7 +693,7 @@ parse_command_line(int argc, char *argv[]) {
 #ifdef __SUNPRO_C
 			printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif
-#if HAVE_OPENSSL
+#ifdef OPENSSL
 			printf("compiled with OpenSSL version: %s\n",
 			       OPENSSL_VERSION_TEXT);
 #if !defined(LIBRESSL_VERSION_NUMBER) && \
@@ -842,6 +844,23 @@ create_managers(void) {
 			      ISC_LOG_INFO, "using up to %u sockets", socks);
 	}

+	result = isc_entropy_create(named_g_mctx, &named_g_entropy);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_entropy_create() failed: %s",
+				 isc_result_totext(result));
+		return (ISC_R_UNEXPECTED);
+	}
+
+	result = isc_hash_create(named_g_mctx, named_g_entropy,
+				 DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_hash_create() failed: %s",
+				 isc_result_totext(result));
+		return (ISC_R_UNEXPECTED);
+	}
+
 	return (ISC_R_SUCCESS);
 }

@@ -853,6 +872,13 @@ destroy_managers(void) {
 	isc_taskmgr_destroy(&named_g_taskmgr);
 	isc_timermgr_destroy(&named_g_timermgr);
 	isc_socketmgr_destroy(&named_g_socketmgr);
+
+	/*
+	 * isc_hash_destroy() cannot be called as long as a resolver may be
+	 * running.  Calling this after isc_taskmgr_destroy() ensures the
+	 * call is safe.
+	 */
+	isc_hash_destroy();
 }

 static void
@@ -919,6 +945,30 @@ setup(void) {
 		isc_mem_free(named_g_mctx, instance);
 #endif /* HAVE_LIBSCF */

+#ifdef PATH_RANDOMDEV
+	/*
+	 * Initialize system's random device as fallback entropy source
+	 * if running chroot'ed.
+	 */
+	if (named_g_chrootdir != NULL) {
+		result = isc_entropy_create(named_g_mctx,
+					    &named_g_fallbackentropy);
+		if (result != ISC_R_SUCCESS)
+			named_main_earlyfatal("isc_entropy_create() failed: %s",
+					   isc_result_totext(result));
+
+		result = isc_entropy_createfilesource(named_g_fallbackentropy,
+						      PATH_RANDOMDEV);
+		if (result != ISC_R_SUCCESS) {
+			named_main_earlywarning("could not open pre-chroot "
+					     "entropy source %s: %s",
+					     PATH_RANDOMDEV,
+					     isc_result_totext(result));
+			isc_entropy_detach(&named_g_fallbackentropy);
+		}
+	}
+#endif
+
 #ifdef ISC_PLATFORM_USETHREADS
 	/*
 	 * Check for the number of cpu's before named_os_chroot().
@@ -1114,8 +1164,6 @@ setup(void) {
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, ISC_TRUE);
 	if (disable6)
 		ns_server_setoption(sctx, NS_SERVER_DISABLE6, ISC_TRUE);
-	if (sigvalinsecs)
-		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, ISC_TRUE);

 	named_g_server->sctx->delay = delay;
 }
@@ -1127,6 +1175,10 @@ cleanup(void) {
 	if (named_g_mapped != NULL)
 		dns_acl_detach(&named_g_mapped);

+	isc_entropy_detach(&named_g_entropy);
+	if (named_g_fallbackentropy != NULL)
+		isc_entropy_detach(&named_g_fallbackentropy);
+
 	named_server_destroy(&named_g_server);

 	named_builtin_deinit();
@@ -1279,7 +1331,7 @@ main(int argc, char *argv[]) {
 	dns_result_register();
 	dst_result_register();
 	isccc_result_register();
-#if HAVE_PKCS11
+#ifdef PKCS11CRYPTO
 	pk11_result_register();
 #endif

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Evan Hunt	3063f34e47	put A and AAAA in additional section when responding to type=ANAME queries	2018-03-18 14:27:22 +00:00
Evan Hunt	8c0f8a7c0c	initial implementation of ANAME rrtype, using type code point 65532 - this is only the bare type represetation, with no special processing	2018-03-18 11:40:51 +00:00