regenerate

(cherry picked from commit fe1ad70e51)

.gitattributes

@@ -1,3 +1,2 @@
-*.sln.in eol=crlf
 *.vcxproj.in eol=crlf
 *.vcxproj.filters.in eol=crlf

.gitignore

@@ -18,6 +18,7 @@ autom4te.cache/
 *-symtbl.c
 timestamp
 ans.run
+lwresd.run
 named.run
 named.memstats
 gen.dSYM/

CHANGES

@@ -1,777 +1,4 @@
-4789.	[cleanup]	Check writability of new-zones-directory. [RT #46308]
-
-4788.	[cleanup]	When using "update-policy local", log a warning
-			when an update matching the session key is received
-			from a remote host. [RT #46213]
-
-4787.	[cleanup]	Turn nsec3param_salt_totext() into a public function,
-			dns_nsec3param_salttotext(), and add unit tests for it.
-			[RT #46289]
-
-4786.	[func]		The "filter-aaaa-on-v4" and "filter-aaaa-on-v6"
-			options are no longer conditionally compiled.
-			[RT #46340]
-
-4785.	[func]		The hmac-md5 algorithm is no longer recommended for
-			use with RNDC keys. For compatibility reasons, it
-			it is still the default algorithm in rndc-confgen,
-			but this will be changed to hmac-sha256 in a future
-			release. [RT #42272]
-
-4784.	[func]		The use of dnssec-keygen to generate HMAC keys is
-			deprecated in favor of tsig-keygen.  dnssec-keygen
-			will print a warning when used for this purpose.
-			All HMAC algorithms will be removed from
-			dnssec-keygen in a future release. [RT #42272]
-
-4783.	[test]		dnssec: 'check that NOTIFY is sent at the end of
-			NSEC3 chain generation failed' required more time
-			on some machines for the IXFR to complete. [RT #46388]
-
-4782.	[test]		dnssec: 'checking positive and negative validation
-			with negative trust anchors' required more time to
-			complete on some machines. [RT #46386]
-
-4781.	[maint]		B.ROOT-SERVERS.NET is now 199.9.14.201. [RT #45889]
-
-4780.	[bug]		When answering ANY queries, don't include the NS
-			RRset in the authority section if it was already
-			in the answer section. [RT #44543]
-
-4779.	[bug]		Expire NTA at the start of the second. Don't update
-			the expiry value if the record has already expired
-			after a successful check. [RT #46368]
-
-4778.	[test]		Improve synth-from-dnssec testing. [RT #46352]
-
-4777.	[cleanup]	Removed a redundant call to configure_view_acl().
-			[RT #46369]
-
-4776.	[bug]		Improve portability of ht_test. [RT #46333]
-
-4775.	[bug]		Address Coverity warnings in ht_test.c and mem_test.c
-			[RT #46281]
-
-4774.	[bug]		<isc/util.h> was incorrectly included in several
-			header files. [RT #46311]
-
-4773.	[doc]		Fixed generating Doxygen documentation for functions
-			annotated using certain macros.  Miscellaneous
-			Doxygen-related cleanups. [RT #46276]
-
-	--- 9.12.0b1 released ---
-
-4772.	[test]		Expanded unit testing framework for libns, using
-			hooks to interrupt query flow and inspect state
-			at specified locations. [RT #46173]
-
-4771.	[bug]		When sending RFC 5011 refresh queries, disregard
-			cached DNSKEY rrsets. [RT #46251]
-
-4770.	[bug]		Cache additional data from priming queries as glue.
-			Previously they were ignored as unsigned
-			non-answer data from a secure zone, and never
-			actually got added to the cache, causing hints
-			to be used frequently for root-server
-			addresses, which triggered re-priming. [RT #45241]
-
-4769.	[func]		The working directory and managed-keys directory has
-			to be writeable (and seekable). [RT #46077]
-
-4768.	[func]		By default, memory is no longer filled with tag values
-			when it is allocated or freed; this improves
-			performance but makes debugging of certain memory
-			issues more difficult. "named -M fill" turns memory
-			filling back on. (Building "configure
-			--enable-developer", turns memory fill on by
-			default again; it can then be disabled with
-			"named -M nofill".) [RT #45123]
-
-4767.	[func]		Add a new function, isc_buffer_printf(), which can be
-			used to append a formatted string to the used region of
-			a buffer. [RT #46201]
-
-4766.	[cleanup]	Addresss Coverity warnings. [RT #46150]
-
-4765.	[bug]		Address potential INSIST in dnssec-cds. [RT #46150]
-
-4764.	[bug]		Address portability issues in cds system test.
-			[RT #46214]
-
-4763.	[contrib]	Improve compatibility when building MySQL DLZ
-			module by using mysql_config if available.
-			[RT #45558]
-
-4762.	[func]		"update-policy local" is now restricted to updates
-			from local addresses. (Previously, other addresses
-			were allowed so long as updates were signed by the
-			local session key.) [RT #45492]
-
-4761.	[protocol]	Add support for DOA. [RT #45612]
-
-4760.	[func]		Add glue cache statistics counters. [RT #46028]
-
-4759.	[func]		Add logging channel "trust-anchor-telementry" to
-			record trust-anchor-telementry in incoming requests.
-			Both _ta-XXXX.<anchor>/NULL and EDNS KEY-TAG options
-			are logged.  [RT #46124]
-
-4758.	[doc]		Remove documentation of unimplemented "topology".
-			[RT #46161]
-
-4757.	[func]		New "dnssec-cds" command creates a new parent DS
-			RRset based on CDS or CDNSKEY RRsets found in
-			a child zone, and generates either a dsset file
-			or stream of nsupdate commands to update the
-			parent. Thanks to Tony Finch. [RT #46090]
-
-4756.	[bug]		Interrupting dig could lead to an INSIST failure after
-			certain errors were encountered while querying a host
-			whose name resolved to more than one address.  Change
-			4537 increased the odds of triggering this issue by
-			causing dig to hang indefinitely when certain error
-			paths were evaluated.  dig now also retries TCP queries
-			(once) if the server gracefully closes the connection
-			before sending a response. [RT #42832, #45159]
-
-4755.	[cleanup]	Silence unnecessary log message when NZF file doesn't
-			exist. [RT #46186]
-
-4754.	[bug]		dns_zone_setview needs a two stage commit to properly
-			handle errors. [RT #45841]
-
-4753.	[contrib]	Software obtainable from known upstream locations
-			(i.e., zkt, nslint, query-loc) has been removed.
-			Links to these and other packages can be found at
-			https://www.isc.org/community/tools [RT #46182]
-
-4752.	[test]		Add unit test for isc_net_pton. [RT #46171]
-
-4751.	[func]		"dnssec-signzone -S" can now automatically add parent
-			synchronization records (CDS and CDNSKEY) according
-			to key metadata set using the -Psync and -Dsync
-			options to dnssec-keygen and dnssec-settime.
-			[RT #46149]
-
-4750.	[func]		"rndc managed-keys destroy" shuts down RFC 5011 key
-			maintenance and deletes the managed-keys database.
-			If followed by "rndc reconfig" or a server restart,
-			key maintenance is reinitialized from scratch.
-			This is primarily intended for testing. [RT #32456]
-
-4749.	[func]		The ISC DLV service has been shut down, and all
-			DLV records have been removed from dlv.isc.org.
-			- Removed references to ISC DLV in documentation
-			- Removed DLV key from bind.keys
-			- No longer use ISC DLV by default in delv
-			- "dnssec-lookaside auto" and configuration of
-			  "dnssec-lookaide" with dlv.isc.org as trust
-			  anchor are both now fatal errors.
-			[RT #46155]
-
-4748.	[cleanup]	Sprintf to snprintf coversions. [RT #46132]
-
-4747.	[func]		Synthesis of responses from DNSSEC-verified records.
-			Stage 3 - synthesize NODATA responses. [RT #40138]
-
-4746.	[cleanup]	Add configured prefixes to configure summary
-			output. [RT #46153]
-
-4745.	[test]		Add color-coded pass/fail messages to system
-			tests when running on terminals that support them.
-			[RT #45977]
-
-4744.	[bug]		Suppress trust-anchor-telementry queries if
-			validation is disabled. [RT #46131]
-
-4743.	[func]		Exclude trust-anchor-telementry queries from
-			synth-from-dnssec processing. [RT #46123]
-
-4742.	[func]		Synthesis of responses from DNSSEC-verified records.
-			Stage 2 - synthesis of records from wildcard data.
-			If the dns64 or filter-aaaa* is configured then the
-			involved lookups are currently excluded. [RT #40138]
-
-4741.	[bug]		Make isc_refcount_current() atomically read the
-			counter value. [RT #46074]
-
-4740.	[cleanup]	Avoid triggering format-truncated warnings. [RT #46107]
-
-4739.	[cleanup]	Address clang static analysis warnings. [RT #45952]
-
-4738.	[port]		win32: strftime mishandles %Z. [RT #46039]
-
-4737.	[cleanup]	Address Coverity warnings. [RT #46012]
-
-4736.	[cleanup]	(a) Added comments to NSEC3-related functions in
-			lib/dns/zone.c.  (b) Refactored NSEC3 salt formatting
-			code.  (c) Minor tweaks to lock and result handling.
-			[RT #46053]
-
-4735.	[bug]		Add @ISC_OPENSSL_LIBS@ to isc-config. [RT #46078]
-
-4734.	[contrib]	Added sample configuration for DNS-over-TLS in
-			contrib/dnspriv.
-
-4733.	[bug]		Change #4706 introduced a bug causing TCP clients
-			not be reused correctly, leading to unconstrained
-			memory growth. [RT #46029]
-
-4732.	[func]		Change default minimal-responses setting to
-			no-auth-recursive. [RT #46016]
-
-4731.	[bug]		Fix use after free when closing an LMDB. [RT #46000]
-
-4730.	[bug]		Fix out of bounds access in DHCID totext() method.
-			[RT #46001]
-
-4729.	[bug]		Don't use memset() to wipe memory, as it may be
-			removed by compiler optimizations when the
-			memset() occurs on automatic stack allocation
-			just before function return. [RT #45947]
-
-4728.	[func]		Use C11's stdatomic.h instead of isc_atomic
-			where available. [RT #40668]
-
-4727.	[bug]		Retransferring an inline-signed slave using NSEC3
-			around the time its NSEC3 salt was changed could result
-			in an infinite signing loop. [RT #45080]
-
-4726.	[port]		Prevent setsockopt() errors related to TCP_FASTOPEN
-			from being logged on FreeBSD if the kernel does not
-			support it.  Notify the user when the kernel does
-			support TCP_FASTOPEN, but it is disabled by sysctl.
-			Add a new configure option, --disable-tcp-fastopen, to
-			disable use of TCP_FASTOPEN altogether. [RT #44754]
-
-4725.	[bug]		Nsupdate: "recvsoa" was incorrectly reported for
-			failures in sending the update message.  The correct
-			location to be reported is "update_completed".
-			[RT #46014]
-
-4724.	[func]		By default, BIND now uses the random number
-			functions provided by the crypto library (i.e.,
-			OpenSSL or a PKCS#11 provider) as a source of
-			randomness rather than /dev/random.  This is
-			suitable for virtual machine environments
-			which have limited entropy pools and lack
-			hardware random number generators.
-
-			This can be overridden by specifying another
-			entropy source via the "random-device" option
-			in named.conf, or via the -r command line option;
-			however, for functions requiring full cryptographic
-			strength, such as DNSSEC key generation, this
-			cannot be overridden. In particular, the -r
-			command line option no longer has any effect on
-			dnssec-keygen.
-
-			This can be disabled by building with
-			"configure --disable-crypto-rand".
-			[RT #31459] [RT #46047]
-
-4723.	[bug]		Statistics counter DNSTAPdropped was misidentified
-			as DNSSECdropped. [RT #46002]
-
-4722.	[cleanup]	Clean up uses of strcpy() and strcat() in favor of
-			strlcpy() and strlcat() for safety. [RT #45981]
-
-4721.	[func]		'dnssec-signzone -x' and 'dnssec-dnskey-kskonly'
-			options now apply to CDNSKEY and DS records as well
-			as DNSKEY. Thanks to Tony Finch. [RT #45689]
-
-4720.	[func]		Added a statistics counter to track prefetch
-			queries. [RT #45847]
-
-4719.	[bug]		Address PVS static analyzer warnings. [RT #45946]
-
-4718.	[func]		Avoid seaching for a owner name compression pointer
-			more than once when writing out a RRset. [RT #45802]
-
-4717.	[bug]		Treat replies with QCOUNT=0 as truncated if TC=1,
-			FORMERR if TC=0, and log the error correctly.
-			[RT #45836]
-
-4716.	[placeholder]
-
-	--- 9.12.0a1 released ---
-
-4715.	[bug]		TreeMemMax was mis-identified as a second HeapMemMax
-			in the Json cache statistics. [RT #45980]
-
-4714.	[port]		openbsd/libressl: add support for building with
-			--enable-openssl-hash. [RT #45982]
-
-4713.	[func]		Added support for the DNS Response Policy Service
-			(DNSRPS) API, which allows named to use an external
-			response policy daemon when built with
-			"configure --enable-dnsrps".  Thanks to Vernon
-			Schryver and Farsight Security. [RT #43376]
-
-4712.	[bug]		"dig +domain" and "dig +search" didn't retain the
-			search domain when retrying with TCP. [RT #45547]
-
-4711.	[test]		Some RR types were missing from genzones.sh.
-			[RT #45782]
-
-4710.	[cleanup]	Changed the --enable-openssl-hash default to yes.
-			[RT #45019]
-
-4709.	[cleanup]	Use dns_name_fullhash() to hash names for RRL.
-			[RT #45435]
-
-4708.	[cleanup]	Legacy Windows builds (i.e. for XP and earlier)
-			are no longer supported. [RT #45186]
-
-4707.	[func]		The lightweight resolver daemon and library (lwresd
-			and liblwres) have been removed. [RT #45186]
-
-4706.	[func]		Code implementing name server query processing has
-			been moved from bin/named to a new library "libns".
-			Functions remaining in bin/named are now prefixed
-			with "named_" rather than "ns_".  This will make it
-			easier to write unit tests for name server code, or
-			link name server functionality into new tools.
-			[RT #45186]
-
-4705.	[placeholder]
-
-4704.	[cleanup]	Silence Visual Studio compiler warnings. [RT #45898]
-
-4703.	[bug]		BINDInstall.exe was missing some buffer length checks.
-			[RT #45898]
-
-4702.	[func]		Update function declarations to use
-			dns_masterstyle_flags_t for style flags. [RT #45924]
-
-4701.	[cleanup]	Refactored lib/dns/tsig.c to reduce code
-			duplication and simplify the disabling of MD5.
-			[RT #45490]
-
-4700.	[func]		Serving of stale answers is now supported. This
-			allows named to provide stale cached answers when
-			the authoritative server is under attack.
-			See max-stale-ttl, stale-answer-enable,
-			stale-answer-ttl. [RT #44790]
-
-4699.	[func]		Multiple cookie-secret clauses can now be specified.
-			The first one specified is used to generate new
-			server cookies.  [RT #45672]
-
-4698.	[port]		Add --with-python-install-dir configure option to allow
-			specifying a nonstandard installation directory for
-			Python modules. [RT #45407]
-
-4697.	[bug]		Restore workaround for Microsoft Windows TSIG hash
-			computation bug. [RT #45854]
-
-4696.	[port]		Enable filter-aaaa support by default on Windows
-			builds. [RT #45883]
-
-4695.	[bug]		cookie-secrets were not being properly checked by
-			named-checkconf. [RT #45886]
-
-4694.	[func]		dnssec-keygen no longer uses RSASHA1 by default;
-			the signing algorithm must be specified on
-			the command line with the "-a" option.  Signing
-			scripts that rely on the existing default behavior
-			will break; use "dnssec-keygen -a RSASHA1" to
-			repair them. (The goal of this change is to make
-			it easier to find scripts using RSASHA1 so they
-			can be changed in the event of that algorithm
-			being deprecated in the future.) [RT #44755]
-
-4693.	[func]		Synthesis of responses from DNSSEC-verified records.
-			Stage 1 covers NXDOMAIN synthesis from NSEC records.
-			This is controlled by synth-from-dnssec and is enabled
-			by default. [RT #40138]
-
-4692.	[bug]		Fix build failures with libressl introduced in 4676.
-			[RT #45879]
-
-4691.	[func]		Add -4/-6 command line options to nsupdate and rndc.
-			[RT #45632]
-
-4690.	[bug]		Command line options -4/-6 were handled inconsistently
-			between tools. [RT #45632]
-
-4689.	[cleanup]	Turn on minimal responses for CDNSKEY and CDS in
-			addition to DNSKEY and DS. Thanks to Tony Finch.
-			[RT #45690]
-
-4688.	[protocol]	Check and display EDNS KEY TAG options (RFC 8145) in
-			messages. [RT #44804]
-
-4687.	[func]		Refactor tracklines code. [RT #45126]
-
-4686.	[bug]		dnssec-settime -p could print a bogus warning about
-			key deletion scheduled before its inactivation when a
-			key had an inactivation date set but no deletion date
-			set. [RT #45807]
-
-4685.	[bug]		dnssec-settime incorrectly calculated publication and
-			activation dates for a successor key. [RT #45806]
-
-4684.	[bug]		delv could send bogus DNS queries when an explicit
-			server address was specified on the command line along
-			with -4/-6. [RT #45804]
-
-4683.	[bug]		Prevent nsupdate from immediately exiting on invalid
-			user input in interactive mode. [RT #28194]
-
-4682.	[bug]		Don't report errors on records below a DNAME.
-			[RT #44880]
-
-4681.	[bug]		Log messages from the validator now include the
-			associated view unless the view is "_default/IN"
-			or "_dnsclient/IN". [RT #45770]
-
-4680.	[bug]		Fix failing over to another master server address when
-			nsupdate is used with GSS-API. [RT #45380]
-
-4679.	[cleanup]	Suggest using -o when dnssec-verify finds a SOA record
-			not at top of zone and -o is not used. [RT #45519]
-
-4678.	[bug]		geoip-use-ecs has the wrong type when geoip support
-			is disabled at configure time. [RT #45763]
-
-4677.	[cleanup]	Split up the main function in dig to better support
-			the iOS app version. [RT #45508]
-
-4676.	[cleanup]	Allow BIND to be built using OpenSSL 1.0.X with
-			deprecated functions removed. [RT #45706]
-
-4675.	[cleanup]	Don't use C++ keyword class. [RT #45726]
-
-4674.	[func]		"dig +sigchase", and related options "+topdown" and
-			"+trusted-keys", have been removed. Use "delv" for
-			queries with DNSSEC validation. [RT #42793]
-
-4673.	[port]		Silence GCC 7 warnings. [RT #45592]
-
-4672.	[placeholder]
-
-4671.	[bug]		Fix a race condition that could cause the
-			resolver to crash with assertion failure when
-			chasing DS in specific conditions with a very
-			short RTT to the upstream nameserver. [RT #45168]
-
-4670.	[cleanup]	Ensure that a request MAC is never sent back
-			in an XFR response unless the signature was
-			verified. [RT #45494]
-
-4669.	[func]		Iterative query logic in resolver.c has been
-			refactored into smaller functions and commented,
-			for improved readability, maintainability and
-			testability. [RT #45362]
-
-4668.	[bug]		Use localtime_r and gmtime_r for thread safety.
-			[RT #45664]
-
-4667.	[cleanup]	Refactor RDATA unit tests. [RT #45610]
-
-4666.	[bug]		dnssec-keymgr: Domain names beginning with digits (0-9)
-			could cause a parser error when reading the policy
-			file. This now works correctly so long as the domain
-			name is quoted. [RT #45641]
-
-4665.	[protocol]	Added support for ED25519 and ED448 DNSSEC signing
-			algorithms (RFC 8080). (Note: these algorithms
-			depend on code currently in the development branch
-			of OpenSSL which has not yet been released.)
-			[RT #44696]
-
-4664.	[func]		Add a "glue-cache" option to enable or disable the
-			glue cache. The default is "yes". [RT #45125]
-
-4663.	[cleanup]	Clarify error message printed by dnssec-dsfromkey.
-			[RT #21731]
-
-4662.	[performance]	Improve cache memory cleanup of zero TTL records
-			by putting them at the tail of LRU header lists.
-			[RT #45274]
-
-4661.	[bug]		A race condition could occur if a zone was reloaded
-			while resigning, triggering a crash in
-			rbtdb.c:closeversion(). [RT #45276]
-
-4660.	[bug]		Remove spurious "peer" from Windows socket log
-			messages. [RT #45617]
-
-4659.	[bug]		Remove spurious log message about lmdb-mapsize
-			not being supported when parsing builtin
-			configuration file. [RT #45618]
-
-4658.	[bug]		Clean up build directory created by "setup.py install"
-			immediately.  [RT #45628]
-
-4657.	[bug]		rrchecker system test result could be improperly
-			determined. [RT #45602]
-
-4656.	[bug]		Apply "port" and "dscp" values specified in catalog
-			zone's "default-masters" option to the generated
-			configuration of its member zones. [RT #45545]
-
-4655.	[bug]		Lack of seccomp could be falsely reported. [RT #45599]
-
-4654.	[cleanup]	Don't use C++ keywords delete, new and namespace.
-			[RT #45538]
-
-4653.	[bug]		Reorder includes to move @DST_OPENSSL_INC@ and
-			@ISC_OPENSSL_INC@ after shipped include directories.
-			[RT #45581]
-
-4652.	[bug]		Nsupdate could attempt to use a zeroed address on
-			server timeout. [RT #45417]
-
-4651.	[test]		Silence coverity warnings in tsig_test.c. [RT #45528]
-
-4650.	[placeholder]
-
-4649.	[bug]		The wrong zone was logged when a catalog zone is added.
-			[RT #45520]
-
-4648.	[bug]		"rndc reconfig" on a slave no longer causes all member
-			zones of configured catalog zones to be removed from
-			configuration. [RT #45310]
-
-4647.	[bug]		Change 4643 broke verification of TSIG signed TCP
-			message sequences where not all the messages contain
-			TSIG records.  These may be used in AXFR and IXFR
-			responses. [RT #45509]
-
-4646.	[placeholder]
-
-4645.	[bug]		Fix PKCS#11 RSA parsing when MD5 is disabled.
-			[RT #45300]
-
-4644.	[placeholder]
-
-4643.	[security]	An error in TSIG handling could permit unauthorized
-			zone transfers or zone updates. (CVE-2017-3142)
-			(CVE-2017-3143) [RT #45383]
-
-4642.	[cleanup]	Add more logging of RFC 5011 events affecting the
-			status of managed keys: newly observed keys,
-			deletion of revoked keys, etc. [RT #45354]
-
-4641.	[cleanup]	Parallel builds (make -j) could fail with --with-atf /
-			--enable-developer. [RT #45373]
-
-4640.	[bug]		If query_findversion failed in query_getdb due to
-			memory failure the error status was incorrectly
-			discarded. [RT #45331]
-
-4639.	[bug]		Fix a regression in --with-tuning reporting introduced
-			by change 4488. [RT #45396]
-
-4638.	[bug]		Reloading or reconfiguring named could fail on
-			some platforms when LMDB was in use. [RT #45203]
-
-4637.	[func]		"nsec3hash -r" option ("rdata order") takes arguments
-			in the same order as they appear in NSEC3 or
-			NSEC3PARAM records, so that NSEC3 parameters can
-			be cut and pasted from an existing record. Thanks
-			to Tony Finch for the contribution. [RT #45183]
-
-4636.	[bug]		Normalize rpz policy zone names when checking for
-			existence. [RT #45358]
-
-4635.	[bug]		Fix RPZ NSDNAME logging that was logging
-			failures as NSIP. [RT #45052]
-
-4634.	[contrib]	check5011.pl needs to handle optional space before
-			semi-colon in +multi-line output. [RT #45352]
-
-4633.	[maint]		Updated AAAA (2001:500:200::b) for B.ROOT-SERVERS.NET.
-
-4632.	[security]	The BIND installer on Windows used an unquoted
-			service path, which can enable privilege escalation.
-			(CVE-2017-3141) [RT #45229]
-
-4631.	[security]	Some RPZ configurations could go into an infinite
-			query loop when encountering responses with TTL=0.
-			(CVE-2017-3140) [RT #45181]
-
-4630.	[bug]		"dyndb" is dependent on dlopen existing / being
-			enabled. [RT #45291]
-
-4629.	[bug]		dns_client_startupdate could not be called with a
-			running client. [RT #45277]
-
-4628.	[bug]		Fixed a potential reference leak in query_getdb().
-			[RT #45247]
-
-4627.	[placeholder]
-
-4626.	[test]		Added more tests for handling of different record
-			ordering in CNAME and DNAME responses. [QA #430]
-
-4625.	[bug]		Running "rndc addzone" and "rndc delzone" at close
-			to the same time could trigger a deadlock if using
-			LMDB. [RT #45209]
-
-4624.	[placeholder]
-
-4623.	[bug]		Use --with-protobuf-c and --with-libfstrm to find
-			protoc-c and fstrm_capture. [RT #45187]
-
-4622.	[bug]		Remove unnecessary escaping of semicolon in CAA and
-			URI records. [RT #45216]
-
-4621.	[port]		Force alignment of oid arrays to silence loader
-			warnings. [RT #45131]
-
-4620.	[port]		Handle EPFNOSUPPORT being returned when probing
-			to see if a socket type is supported. [RT #45214]
-
-4619.	[bug]		Call isc_mem_put instead of isc_mem_free in
-			bin/named/server.c:setup_newzones. [RT #45202]
-
-4618.	[bug]		Check isc_mem_strdup results in dns_view_setnewzones.
-			Add logging for lmdb call failures. [RT #45204]
-
-4617.	[test]		Update rndc system test to be more delay tolerant.
-			[RT #45177]
-
-4616.	[bug]		When using LMDB, zones deleted using "rndc delzone"
-			were not correctly removed from the new-zone
-			database. [RT #45185]
-
-4615.	[bug]		AD could be set on truncated answer with no records
-			present in the answer and authority sections.
-			[RT #45140]
-
-4614.	[test]		Fixed an error in the sockaddr unit test. [RT #45146]
-
-4613.	[func]		By default, the maximum size of a zone journal file
-			is now twice the size of the zone's contents (there
-			is little benefit to a journal larger than this).
-			This can be overridden by setting "max-journal-size"
-			to "unlimited" or to an explicit value up to 2G.
-			Thanks to Tony Finch. [RT #38324]
-
-4612.	[bug]		Silence 'may be use uninitalised' warning and simplify
-			the code in lwres/getaddinfo:process_answer.
-			[RT #45158]
-
-4611.	[bug]		The default LMDB mapsize was too low and caused
-			errors after few thousand zones were added using
-			rndc addzone. A new config option "lmdb-mapsize"
-			has been introduced to configure the LMDB
-			mapsize depending on operational needs.
-			[RT #44954]
-
-4610.	[func]		The "new-zones-directory" option specifies the
-			location of NZF or NZD files for storing
-			configuration of zones added by "rndc addzone".
-			Thanks to Petr Menšík. [RT #44853]
-
-4609.	[cleanup]	Rearrange makefiles to enable parallel execution
-			(i.e. "make -j"). [RT #45078]
-
-4608.	[func]		DiG now warns about .local queries which are reserved
-			for Multicast DNS. [RT #44783]
-
-4607.	[bug]		The memory context's malloced and maxmalloced counters
-			were being updated without the appropriate lock being
-			held.  [RT #44869]
-
-4606.	[port]		Stop using experimental "Experimental keys on scalar"
-			feature of perl as it has been removed. [RT #45012]
-
-4605.	[performance]	Improve performance for delegation heavy answers
-			and also general query performance. Removes the
-			acache feature that didn't significantly improve
-			performance. Adds a glue cache. Removes
-			additional-from-cache and additional-from-auth
-			features. Enables minimal-responses by
-			default. Improves performance of compression
-			code, owner case restoration, hash function,
-			etc. Uses inline buffer implementation by
-			default. Many other performance changes and fixes.
-			[RT #44029]
-
-4604.	[bug]		Don't use ERR_load_crypto_strings() when building
-			with OpenSSL 1.1.0. [RT #45117]
-
-4603.	[doc]		Automatically generate named.conf(5) man page
-			from doc/misc/options. Thanks to Tony Finch.
-			[RT #43525]
-
-4602.	[func]		Threads are now set to human-readable
-			names to assist debugging, when supported by
-			the OS. [RT #43234]
-
-4601.	[bug]		Reject incorrect RSA key lengths during key
-			generation and and sign/verify context
-			creation. [RT #45043]
-
-4600.	[bug]		Adjust RPZ trigger counts only when the entry
-			being deleted exists. [RT #43386]
-
-4599.	[bug]		Fix inconsistencies in inline signing time
-			comparison that were introduced with the
-			introduction of rdatasetheader->resign_lsb.
-			[RT #42112]
-
-4598.	[func]		Update fuzzing code to (1) reply to a DNSKEY
-			query from named with appropriate DNSKEY used in
-			fuzzing; (2) patch the QTYPE correctly in
-			resolver fuzzing; (3) comment things so the rest
-			of us are able to understand how fuzzing is
-			implemented in named; (4) Coding style changes,
-			cleanup, etc. [RT #44787]
-
-4597.	[bug]		The validator now ignores SHA-1 DS digest type
-			when a DS record with SHA-384 digest type is
-			present and is a supported digest type.
-			[RT #45017]
-
-4596.	[bug]		Validate glue before adding it to the additional
-			section. This also fixes incorrect TTL capping
-			when the RRSIG expired earlier than the TTL.
-			[RT #45062]
-
-4595.	[func]		dnssec-keygen will no longer generate RSA keys
-			less than 1024 bits in length. dnssec-keymgr
-			was similarly updated. [RT #36895]
-
-4594.	[func]		"dnstap-read -x" prints a hex dump of the wire
-			format of each logged DNS message. [RT #44816]
-
-4593.	[doc]		Update README using markdown, remove outdated FAQ
-			file in favor of the knowledge base.
-
-4592.	[bug]		A race condition on shutdown could trigger an
-			assertion failure in dispatch.c. [RT #43822]
-
-4591.	[port]		Addressed some python 3 compatibility issues.
-			Thanks to Ville Skytta. [RT #44955] [RT #44956]
-
-4590.	[bug]		Support for PTHREAD_MUTEX_ADAPTIVE_NP was not being
-			properly detected. [RT #44871]
-
-4589.	[cleanup]	"configure -q" is now silent. [RT #44829]
-
-4588.	[bug]		nsupdate could send queries for TKEY to the wrong
-			server when using GSSAPI. Thanks to Tomas Hozza.
-			[RT #39893]
-
-4587.	[bug]		named-checkzone failed to handle occulted data below
-			DNAMEs correctly. [RT #44877]
-
-4586.	[func]		dig, host and nslookup now use TCP for ANY queries.
-			[RT #44687]
-
-4585.	[port]		win32: Set CompileAS value. [RT #42474]
-
-4584.	[bug]		A number of memory usage statistics were not properly
-			reported when they exceeded 4G.  [RT #44750]
-
-4583.	[func]		"host -A" returns most records for a name but
-			omits RRSIG, NSEC and NSEC3. (Thanks to Tony Finch.)
-			[RT #43032]
+	--- 9.11.1rc3 released ---
 
 4582.	[security]	'rndc ""' could trigger a assertion failure in named.
 			(CVE-2017-3138) [RT #44924]
@@ -782,39 +9,16 @@
 4580.	[bug]		4578 introduced a regression when handling CNAME to
 			referral below the current domain. [RT #44850]
 
-4579.	[func]		Logging channels and dnstap output files can now
-			be configured with a "suffix" option, set to
-			either "increment" or "timestamp", indicating
-			whether to use incrementing numbers or timestamps
-			as the file suffix when rolling over a log file.
-			[RT #42838]
+	--- 9.11.1rc2 released ---
 
 4578.	[security]	Some chaining (CNAME or DNAME) responses to upstream
 			queries could trigger assertion failures.
 			(CVE-2017-3137) [RT #44734]
 
-4577.	[func]		Make qtype of resolver fuzzing packet configurable
-			via command line. [RT #43540]
-
-4576.	[func]		The RPZ implementation has been substantially
-			refactored for improved performance and reliability.
-			[RT #43449]
-
 4575.	[security]	DNS64 with "break-dnssec yes;" can result in an
 			assertion failure. (CVE-2017-3136) [RT #44653]
 
-4574.	[bug]		Dig leaked memory with multiple +subnet options.
-			[RT #44683]
-
-4573.	[func]		Query logic has been substantially refactored (e.g.
-			query_find function has been split into smaller
-			functions) for improved readability, maintainability
-			and testability. [RT #43929]
-
-4572.	[func]		The "dnstap-output" option can now take "size" and
-			"versions" parameters to indicate the maximum size
-			a dnstap log file can grow before rolling to a new
-			file, and how many old files to retain. [RT #44502]
+	--- 9.11.1rc1 released ---
 
 4571.	[bug]		Out-of-tree builds of backtrace_test failed.
 
@@ -832,9 +36,6 @@
 4567.	[port]		Call getprotobyname and getservbyname prior to calling
 			chroot so that shared libraries get loaded. [RT #44537]
 
-4566.	[func]		Query logging now includes the ECS option if one
-			was included in the query. [RT #44476]
-
 4565.	[cleanup]	The inline macro versions of isc_buffer_put*()
 			did not implement automatic buffer reallocation.
 			[RT #44216]
@@ -845,9 +46,6 @@
 4563.	[bug]		Modified zones would occasionally fail to reload.
 			[RT #39424]
 
-4562.	[func]		Add additional memory statistics currently malloced
-			and maxmalloced per memory context. [RT #43593]
-
 4561.	[port]		Silence a warning in strict C99 compilers. [RT #44414]
 
 4560.	[bug]		mdig: add -m option to enable memory debugging rather
@@ -862,12 +60,6 @@
 4557.	[security]	Combining dns64 and rpz can result in dereferencing
 			a NULL pointer (read).  (CVE-2017-3135) [RT#44434]
 
-4556.	[bug]		Sending an EDNS Padding option using "dig
-			+ednsopt" could cause a crash in dig. [RT #44462]
-
-4555.	[func]		dig +ednsopt: EDNS options can now be specified by
-			name in addition to numeric value. [RT #44461]
-
 4554.	[bug]		Remove double unlock in dns_dispatchmgr_setudp.
 			[RT #44336]
 
@@ -884,16 +76,10 @@
 4550.	[cleanup]	Increased the number of available master file
 			output style flags from 32 to 64. [RT #44043]
 
-4549.	[func]		Added support for the EDNS TCP Keepalive option
-			(RFC 7828). [RT #42126]
-
-4548.	[func]		Added support for the EDNS Padding option (RFC 7830).
-			[RT #42094]
-
 4547.	[port]		Add support for --enable-native-pkcs11 on the AEP
 			Keyper HSM. [RT #42463]
 
-4546.	[func]		Extend the use of const declarations. [RT #43379]
+	--- 9.11.1b1 released ---
 
 4545.	[func]		Expand YAML output from dnstap-read to include
 			a detailed breakdown of the DNS message contents.
@@ -906,10 +92,6 @@
 			request until isc_app_ctxrun has been called.
 			[RT #43976]
 
-4542.	[func]		Allow rndc to manipulate redirect zones with using
-			-redirect as the zone name (use "-redirect." to
-			manipulate a zone named "-redirect"). [RT #43971]
-
 4541.	[bug]		rndc addzone should properly reject non master/slave
 			zones. [RT #43665]
 
@@ -978,13 +160,6 @@
 
 4519.	[port]		win32: handle ERROR_MORE_DATA. [RT #43534]
 
-4518.	[func]		The "print-time" option in the logging configuration
-			can now take arguments "local", "iso8601" or
-			"iso8601-utc" to indicate the format in which the
-			date and time should be logged. For backward
-			compatibility, "yes" is a synonym for "local".
-			[RT #42585]
-
 4517.	[security]	Named could mishandle authority sections that were
 			missing RRSIGs triggering an assertion failure.
 			(CVE-2016-9444) [RT # 43632]
@@ -1020,9 +195,6 @@
 4507.	[bug]		Named could incorrectly log 'allows updates by IP
 			address, which is insecure' [RT #43432]
 
-4506.	[func]		'named-checkconf -l' will now list the zones found in
-			named.conf. [RT #43154]
-
 4505.	[port]		Use IP_PMTUDISC_OMIT if available. [RT #35494]
 
 4504.	[security]	Allow the maximum number of records in a zone to
@@ -1031,13 +203,11 @@
 
 4503.	[cleanup]	"make uninstall" now removes files installed by
 			BIND. (This currently excludes Python files
-			due to lack of support in setup.py.) [RT #42192]
+			due to lack of support in setup.py.) [RT #42912]
 
 4502.	[func]		Report multiple and experimental options when printing
 			grammar. [RT #43134]
 
-4501.	[placeholder]
-
 4500.	[bug]		Support modifier I64 in isc__print_printf. [RT #43526]
 
 4499.	[port]		MacOSX: silence deprecated function warning
@@ -1094,14 +264,6 @@
 
 4482.	[cleanup]	Change #4455 was incomplete. [RT #43252]
 
-4481.	[func]		dig: make +class, +crypto, +multiline, +rrcomments,
-			+onesoa, +qr, +ttlid, +ttlunits and -u per lookup
-			rather than global. [RT #42450]
-
-4480.	[placeholder]
-
-4479.	[placeholder]
-
 4478.	[func]		Add +continue option to mdig, allow continue on socket
 			errors. [RT #43281]
 
@@ -1133,8 +295,6 @@
 4470.	[bug]		Reset message with intent parse before
 			calling dns_dispatch_getnext. [RT #43229]
 
-4469.	[placeholder]
-
 	--- 9.11.0rc2 released ---
 
 4468.	[bug]		Address ECS option handling issues. [RT #43191]
@@ -13802,7 +12962,7 @@
 
  586.	[bug]		multiple views with the same name were fatal. [RT #516]
 
- 585.	[func]		dns_db_addrdataset() and dns_rdataslab_merge()
+ 585.	[func]		dns_db_addrdataset() and and dns_rdataslab_merge()
 			now support 'exact' additions in a similar manner to
 			dns_db_subtractrdataset() and dns_rdataslab_subtract().
 

FAQ

@@ -0,0 +1,890 @@
+Copyright ? 2000-2010, 2013-2016 Internet Systems Consortium, Inc.
+("ISC")
+
+-----------------------------------------------------------------------
+
+1. Compilation and Installation Questions
+
+Q: I'm trying to compile BIND 9, and "make" is failing due to files not
+   being found. Why?
+
+A: Using a parallel or distributed "make" to build BIND 9 is not
+   supported, and doesn't work. If you are using one of these, use normal
+   make or gmake instead.
+
+Q: Isn't "make install" supposed to generate a default named.conf?
+
+A: Short Answer: No.
+
+   Long Answer: There really isn't a default configuration which fits any
+   site perfectly. There are lots of decisions that need to be made and
+   there is no consensus on what the defaults should be. For example
+   FreeBSD uses /etc/namedb as the location where the configuration files
+   for named are stored. Others use /var/named.
+
+   What addresses to listen on? For a laptop on the move a lot you may
+   only want to listen on the loop back interfaces.
+
+   To whom do you offer recursive service? Is there a firewall to
+   consider? If so, is it stateless or stateful? Are you directly on the
+   Internet? Are you on a private network? Are you on a NAT'd network? The
+   answers to all these questions change how you configure even a caching
+   name server.
+
+2. Configuration and Setup Questions
+
+Q: Why does named log the warning message "no TTL specified - using SOA
+   MINTTL instead"?
+
+A: Your zone file is illegal according to RFC1035. It must either have a
+   line like:
+
+   $TTL 86400
+
+   at the beginning, or the first record in it must have a TTL field, like
+   the "84600" in this example:
+
+   example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 )
+
+Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master
+   file bar: ran out of space"?
+
+A: This is often caused by TXT records with missing close quotes. Check
+   that all TXT records containing quoted strings have both open and close
+   quotes.
+
+Q: How do I restrict people from looking up the server version?
+
+A: Put a "version" option containing something other than the real version
+   in the "options" section of named.conf. Note doing this will not
+   prevent attacks and may impede people trying to diagnose problems with
+   your server. Also it is possible to "fingerprint" nameservers to
+   determine their version.
+
+Q: How do I restrict only remote users from looking up the server version?
+
+A: The following view statement will intercept lookups as the internal
+   view that holds the version information will be matched last. The
+   caveats of the previous answer still apply, of course.
+
+   view "chaos" chaos {
+           match-clients { <those to be refused>; };
+           allow-query { none; };
+           zone "." {
+                   type hint;
+                   file "/dev/null";  // or any empty file
+           };
+   };
+
+Q: What do "no source of entropy found" or "could not open entropy source
+   foo" mean?
+
+A: The server requires a source of entropy to perform certain operations,
+   mostly DNSSEC related. These messages indicate that you have no source
+   of entropy. On systems with /dev/random or an equivalent, it is used by
+   default. A source of entropy can also be defined using the
+   random-device option in named.conf.
+
+Q: I'm trying to use TSIG to authenticate dynamic updates or zone
+   transfers. I'm sure I have the keys set up correctly, but the server is
+   rejecting the TSIG. Why?
+
+A: This may be a clock skew problem. Check that the the clocks on the
+   client and server are properly synchronized (e.g., using ntp).
+
+Q: I see a log message like the following. Why?
+
+   couldn't open pid file '/var/run/named.pid': Permission denied
+
+A: You are most likely running named as a non-root user, and that user
+   does not have permission to write in /var/run. The common ways of
+   fixing this are to create a /var/run/named directory owned by the named
+   user and set pid-file to "/var/run/named/named.pid", or set pid-file to
+   "named.pid", which will put the file in the directory specified by the
+   directory option (which, in this case, must be writable by the user
+   named is running as).
+
+Q: I can query the nameserver from the nameserver but not from other
+   machines. Why?
+
+A: This is usually the result of the firewall configuration stopping the
+   queries and / or the replies.
+
+Q: How can I make a server a slave for both an internal and an external
+   view at the same time? When I tried, both views on the slave were
+   transferred from the same view on the master.
+
+A: You will need to give the master and slave multiple IP addresses and
+   use those to make sure you reach the correct view on the other machine.
+
+   Master: 10.0.1.1 (internal), 10.0.1.2 (external, IP alias)
+       internal:
+           match-clients { !10.0.1.2; !10.0.1.4; 10.0.1/24; };
+                   notify-source 10.0.1.1;
+                   transfer-source 10.0.1.1;
+                   query-source address 10.0.1.1;
+       external:
+           match-clients { any; };
+           recursion no;   // don't offer recursion to the world
+           notify-source 10.0.1.2;
+           transfer-source 10.0.1.2;
+           query-source address 10.0.1.2;
+
+   Slave: 10.0.1.3 (internal), 10.0.1.4 (external, IP alias)
+       internal:
+           match-clients { !10.0.1.2; !10.0.1.4; 10.0.1/24; };
+           notify-source 10.0.1.3;
+           transfer-source 10.0.1.3;
+           query-source address 10.0.1.3;
+      external:
+           match-clients { any; };
+           recursion no;   // don't offer recursion to the world
+           notify-source 10.0.1.4;
+           transfer-source 10.0.1.4;
+           query-source address 10.0.1.4;
+
+   You put the external address on the alias so that all the other dns
+   clients on these boxes see the internal view by default.
+
+A: BIND 9.3 and later: Use TSIG to select the appropriate view.
+
+   Master 10.0.1.1:
+           key "external" {
+                   algorithm hmac-sha256;
+                   secret "xxxxxxxxxxxxxxxxxxxxxxxx";
+           };
+           view "internal" {
+                   match-clients { !key external; // reject message ment for the
+                                                  // external view.
+                                   10.0.1/24; };  // accept from these addresses.
+                   ...
+           };
+           view "external" {
+                   match-clients { key external; any; };
+                   server 10.0.1.2 { keys external; };  // tag messages from the
+                                                        // external view to the
+                                                        // other servers for the
+                                                        // view.
+                   recursion no;
+                   ...
+           };
+
+   Slave 10.0.1.2:
+           key "external" {
+                   algorithm hmac-sha256;
+                   secret "xxxxxxxxxxxxxxxxxxxxxxxx";
+           };
+           view "internal" {
+                   match-clients { !key external; 10.0.1/24; };
+                   ...
+           };
+           view "external" {
+                   match-clients { key external; any; };
+                   server 10.0.1.1 { keys external; };
+                   recursion no;
+                   ...
+           };
+
+Q: I get error messages like "multiple RRs of singleton type" and "CNAME
+   and other data" when transferring a zone. What does this mean?
+
+A: These indicate a malformed master zone. You can identify the exact
+   records involved by transferring the zone using dig then running
+   named-checkzone on it.
+
+   dig axfr example.com @master-server > tmp
+   named-checkzone example.com tmp
+
+   A CNAME record cannot exist with the same name as another record except
+   for the DNSSEC records which prove its existence (NSEC).
+
+   RFC 1034, Section 3.6.2: "If a CNAME RR is present at a node, no other
+   data should be present; this ensures that the data for a canonical name
+   and its aliases cannot be different. This rule also insures that a
+   cached CNAME can be used without checking with an authoritative server
+   for other RR types."
+
+Q: I get error messages like "named.conf:99: unexpected end of input"
+   where 99 is the last line of named.conf.
+
+A: There are unbalanced quotes in named.conf.
+
+A: Some text editors (notepad and wordpad) fail to put a line title
+   indication (e.g. CR/LF) on the last line of a text file. This can be
+   fixed by "adding" a blank line to the end of the file. Named expects to
+   see EOF immediately after EOL and treats text files where this is not
+   met as truncated.
+
+Q: How do I share a dynamic zone between multiple views?
+
+A: You choose one view to be master and the second a slave and transfer
+   the zone between views.
+
+   Master 10.0.1.1:
+           key "external" {
+                   algorithm hmac-sha256;
+                   secret "xxxxxxxxxxxxxxxxxxxxxxxx";
+           };
+
+           key "mykey" {
+                   algorithm hmac-sha256;
+                   secret "yyyyyyyyyyyyyyyyyyyyyyyy";
+           };
+
+           view "internal" {
+                   match-clients { !key external; 10.0.1/24; };
+                   server 10.0.1.1 {
+                           /* Deliver notify messages to external view. */
+                           keys { external; };
+                   };
+                   zone "example.com" {
+                           type master;
+                           file "internal/example.db";
+                           allow-update { key mykey; };
+                           also-notify { 10.0.1.1; };
+                   };
+           };
+
+           view "external" {
+                   match-clients { key external; any; };
+                   zone "example.com" {
+                           type slave;
+                           file "external/example.db";
+                           masters { 10.0.1.1; };
+                           transfer-source 10.0.1.1;
+                           // allow-update-forwarding { any; };
+                           // allow-notify { ... };
+                   };
+           };
+
+Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading
+   master file primaries/wireless.ietf56.ietf.org: no owner".
+
+A: This error is produced when a line in the master file contains leading
+   white space (tab/space) but there is no current record owner name to
+   inherit the name from. Usually this is the result of putting white
+   space before a comment, forgetting the "@" for the SOA record, or
+   indenting the master file.
+
+Q: Why are my logs in GMT (UTC).
+
+A: You are running chrooted (-t) and have not supplied local timezone
+   information in the chroot area.
+
+   FreeBSD: /etc/localtime
+   Solaris: /etc/TIMEZONE and /usr/share/lib/zoneinfo
+   OSF: /etc/zoneinfo/localtime
+
+   See also tzset(3) and zic(8).
+
+Q: I get "rndc: connect failed: connection refused" when I try to run
+   rndc.
+
+A: This is usually a configuration error.
+
+   First ensure that named is running and no errors are being reported at
+   startup (/var/log/messages or equivalent). Running "named -g <usual
+   arguments>" from a title can help at this point.
+
+   Secondly ensure that named is configured to use rndc either by
+   "rndc-confgen -a", rndc-confgen or manually. The Administrators
+   Reference manual has details on how to do this.
+
+   Old versions of rndc-confgen used localhost rather than 127.0.0.1 in /
+   etc/rndc.conf for the default server. Update /etc/rndc.conf if
+   necessary so that the default server listed in /etc/rndc.conf matches
+   the addresses used in named.conf. "localhost" has two address
+   (127.0.0.1 and ::1).
+
+   If you use "rndc-confgen -a" and named is running with -t or -u ensure
+   that /etc/rndc.conf has the correct ownership and that a copy is in the
+   chroot area. You can do this by re-running "rndc-confgen -a" with
+   appropriate -t and -u arguments.
+
+Q: I get "transfer of 'example.net/IN' from 192.168.4.12#53: failed while
+   receiving responses: permission denied" error messages.
+
+A: These indicate a filesystem permission error preventing named creating
+   / renaming the temporary file. These will usually also have other
+   associated error messages like
+
+   "dumping master file: sl/tmp-XXXX5il3sQ: open: permission denied"
+
+   Named needs write permission on the directory containing the file.
+   Named writes the new cache file to a temporary file then renames it to
+   the name specified in named.conf to ensure that the contents are always
+   complete. This is to prevent named loading a partial zone in the event
+   of power failure or similar interrupting the write of the master file.
+
+   Note file names are relative to the directory specified in options and
+   any chroot directory ([<chroot dir>/][<options dir>]).
+
+   If named is invoked as "named -t /chroot/DNS" with the following
+   named.conf then "/chroot/DNS/var/named/sl" needs to be writable by the
+   user named is running as.
+
+   options {
+           directory "/var/named";
+   };
+
+   zone "example.net" {
+           type slave;
+           file "sl/example.net";
+           masters { 192.168.4.12; };
+   };
+
+Q: I want to forward all DNS queries from my caching nameserver to another
+   server. But there are some domains which have to be served locally, via
+   rbldnsd.
+
+   How do I achieve this ?
+
+A: options {
+           forward only;
+           forwarders { <ip.of.primary.nameserver>; };
+   };
+
+   zone "sbl-xbl.spamhaus.org" {
+           type forward; forward only;
+           forwarders { <ip.of.rbldns.server> port 530; };
+   };
+
+   zone "list.dsbl.org" {
+           type forward; forward only;
+           forwarders { <ip.of.rbldns.server> port 530; };
+   };
+
+
+Q: Can you help me understand how BIND 9 uses memory to store DNS zones?
+
+   Some times it seems to take several times the amount of memory it needs
+   to store the zone.
+
+A: When reloading a zone named my have multiple copies of the zone in
+   memory at one time. The zone it is serving and the one it is loading.
+   If reloads are ultra fast it can have more still.
+
+   e.g. Ones that are transferring out, the one that it is serving and the
+   one that is loading.
+
+   BIND 8 destroyed the zone before loading and also killed off outgoing
+   transfers of the zone.
+
+   The new strategy allows slaves to get copies of the new zone regardless
+   of how often the master is loaded compared to the transfer time. The
+   slave might skip some intermediate versions but the transfers will
+   complete and it will keep reasonably in sync with the master.
+
+   The new strategy also allows the master to recover from syntax and
+   other errors in the master file as it still has an in-core copy of the
+   old contents.
+
+Q: I want to use IPv6 locally but I don't have a external IPv6 connection.
+   External lookups are slow.
+
+A: You can use server clauses to stop named making external lookups over
+   IPv6.
+
+   server fd81:ec6c:bd62::/48 { bogus no; }; // site ULA prefix
+   server ::/0 { bogus yes; };
+
+3. Operations Questions
+
+Q: How to change the nameservers for a zone?
+
+A: Step 1: Ensure all nameservers, new and old, are serving the same zone
+   content.
+
+   Step 2: Work out the maximum TTL of the NS RRset in the parent and
+   child zones. This is the time it will take caches to be clear of a
+   particular version of the NS RRset. If you are just removing
+   nameservers you can skip to Step 6.
+
+   Step 3: Add new nameservers to the NS RRset for the zone and wait until
+   all the servers for the zone are answering with this new NS RRset.
+
+   Step 4: Inform the parent zone of the new NS RRset then wait for all
+   the parent servers to be answering with the new NS RRset.
+
+   Step 5: Wait for cache to be clear of the old NS RRset. See Step 2 for
+   how long. If you are just adding nameservers you are done.
+
+   Step 6: Remove any old nameservers from the zones NS RRset and wait for
+   all the servers for the zone to be serving the new NS RRset.
+
+   Step 7: Inform the parent zone of the new NS RRset then wait for all
+   the parent servers to be answering with the new NS RRset.
+
+   Step 8: Wait for cache to be clear of the old NS RRset. See Step 2 for
+   how long.
+
+   Step 9: Turn off the old nameservers or remove the zone entry from the
+   configuration of the old nameservers.
+
+   Step 10: Increment the serial number and wait for the change to be
+   visible in all nameservers for the zone. This ensures that zone
+   transfers are still working after the old servers are decommissioned.
+
+   Note: the above procedure is designed to be transparent to dns clients.
+   Decommissioning the old servers too early will result in some clients
+   not being able to look up answers in the zone.
+
+   Note: while it is possible to run the addition and removal stages
+   together it is not recommended.
+
+4. General Questions
+
+Q: I keep getting log messages like the following. Why?
+
+   Dec 4 23:47:59 client 10.0.0.1#1355: updating zone 'example.com/IN':
+   update failed: 'RRset exists (value dependent)' prerequisite not
+   satisfied (NXRRSET)
+
+A: DNS updates allow the update request to test to see if certain
+   conditions are met prior to proceeding with the update. The message
+   above is saying that conditions were not met and the update is not
+   proceeding. See doc/rfc/rfc2136.txt for more details on prerequisites.
+
+Q: I keep getting log messages like the following. Why?
+
+   Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied
+
+A: Someone is trying to update your DNS data using the RFC2136 Dynamic
+   Update protocol. Windows 2000 machines have a habit of sending dynamic
+   update requests to DNS servers without being specifically configured to
+   do so. If the update requests are coming from a Windows 2000 machine,
+   see <http://support.microsoft.com/support/kb/articles/q246/8/04.asp>
+   for information about how to turn them off.
+
+Q: When I do a "dig . ns", many of the A records for the root servers are
+   missing. Why?
+
+A: This is normal and harmless. It is a somewhat confusing side effect of
+   the way BIND 9 does RFC2181 trust ranking and of the efforts BIND 9
+   makes to avoid promoting glue into answers.
+
+   When BIND 9 first starts up and primes its cache, it receives the root
+   server addresses as additional data in an authoritative response from a
+   root server, and these records are eligible for inclusion as additional
+   data in responses. Subsequently it receives a subset of the root server
+   addresses as additional data in a non-authoritative (referral) response
+   from a root server. This causes the addresses to now be considered
+   non-authoritative (glue) data, which is not eligible for inclusion in
+   responses.
+
+   The server does have a complete set of root server addresses cached at
+   all times, it just may not include all of them as additional data,
+   depending on whether they were last received as answers or as glue. You
+   can always look up the addresses with explicit queries like "dig
+   a.root-servers.net A".
+
+Q: Why don't my zones reload when I do an "rndc reload" or SIGHUP?
+
+A: A zone can be updated either by editing zone files and reloading the
+   server or by dynamic update, but not both. If you have enabled dynamic
+   update for a zone using the "allow-update" option, you are not supposed
+   to edit the zone file by hand, and the server will not attempt to
+   reload it.
+
+Q: Why is named listening on UDP port other than 53?
+
+A: Named uses a system selected port to make queries of other nameservers.
+   This behaviour can be overridden by using query-source to lock down the
+   port and/or address. See also notify-source and transfer-source.
+
+Q: I get warning messages like "zone example.com/IN: refresh: failure
+   trying master 1.2.3.4#53: timed out".
+
+A: Check that you can make UDP queries from the slave to the master
+
+   dig +norec example.com soa @1.2.3.4
+
+   You could be generating queries faster than the slave can cope with.
+   Lower the serial query rate.
+
+   serial-query-rate 5; // default 20
+
+Q: I don't get RRSIG's returned when I use "dig +dnssec".
+
+A: You need to ensure DNSSEC is enabled (dnssec-enable yes;).
+
+Q: Can a NS record refer to a CNAME.
+
+A: No. The rules for glue (copies of the *address* records in the parent
+   zones) and additional section processing do not allow it to work.
+
+   You would have to add both the CNAME and address records (A/AAAA) as
+   glue to the parent zone and have CNAMEs be followed when doing
+   additional section processing to make it work. No nameserver
+   implementation supports either of these requirements.
+
+Q: What does "RFC 1918 response from Internet for 0.0.0.10.IN-ADDR.ARPA"
+   mean?
+
+A: If the IN-ADDR.ARPA name covered refers to a internal address space you
+   are using then you have failed to follow RFC 1918 usage rules and are
+   leaking queries to the Internet. You should establish your own zones
+   for these addresses to prevent you querying the Internet's name servers
+   for these addresses. Please see <http://as112.net/> for details of the
+   problems you are causing and the counter measures that have had to be
+   deployed.
+
+   If you are not using these private addresses then a client has queried
+   for them. You can just ignore the messages, get the offending client to
+   stop sending you these messages as they are most probably leaking them
+   or setup your own zones empty zones to serve answers to these queries.
+
+   zone "10.IN-ADDR.ARPA" {
+           type master;
+           file "empty";
+   };
+
+   zone "16.172.IN-ADDR.ARPA" {
+           type master;
+           file "empty";
+   };
+
+   ...
+
+   zone "31.172.IN-ADDR.ARPA" {
+           type master;
+           file "empty";
+   };
+
+   zone "168.192.IN-ADDR.ARPA" {
+           type master;
+           file "empty";
+   };
+
+   empty:
+   @ 10800 IN SOA <name-of-server>. <contact-email>. (
+                  1 3600 1200 604800 10800 )
+   @ 10800 IN NS <name-of-server>.
+
+   Note
+
+   Future versions of named are likely to do this automatically.
+
+Q: Will named be affected by the 2007 changes to daylight savings rules in
+   the US.
+
+A: No, so long as the machines internal clock (as reported by "date -u")
+   remains at UTC. The only visible change if you fail to upgrade your OS,
+   if you are in a affected area, will be that log messages will be a hour
+   out during the period where the old rules do not match the new rules.
+
+   For most OS's this change just means that you need to update the
+   conversion rules from UTC to local time. Normally this involves
+   updating a file in /etc (which sets the default timezone for the
+   machine) and possibly a directory which has all the conversion rules
+   for the world (e.g. /usr/share/zoneinfo). When updating the OS do not
+   forget to update any chroot areas as well. See your OS's documentation
+   for more details.
+
+   The local timezone conversion rules can also be done on a individual
+   basis by setting the TZ environment variable appropriately. See your
+   OS's documentation for more details.
+
+Q: Is there a bugzilla (or other tool) database that mere mortals can have
+   (read-only) access to for bind?
+
+A: No. The BIND 9 bug database is kept closed for a number of reasons.
+   These include, but are not limited to, that the database contains
+   proprietory information from people reporting bugs. The database has in
+   the past and may in future contain unfixed bugs which are capable of
+   bringing down most of the Internet's DNS infrastructure.
+
+   The release pages for each version contain up to date lists of bugs
+   that have been fixed post release. That is as close as we can get to
+   providing a bug database.
+
+Q: Why do queries for NSEC3 records fail to return the NSEC3 record?
+
+A: NSEC3 records are strictly meta data and can only be returned in the
+   authority section. This is done so that signing the zone using NSEC3
+   records does not bring names into existence that do not exist in the
+   unsigned version of the zone.
+
+5. Operating-System Specific Questions
+
+5.1. HPUX
+
+Q: I get the following error trying to configure BIND:
+
+   checking if unistd.h or sys/types.h defines fd_set... no
+   configure: error: need either working unistd.h or sys/select.h
+
+A: You have attempted to configure BIND with the bundled C compiler. This
+   compiler does not meet the minimum compiler requirements to for
+   building BIND. You need to install a ANSI C compiler and / or teach
+   configure how to find the ANSI C compiler. The later can be done by
+   adjusting the PATH environment variable and / or specifying the
+   compiler via CC.
+
+   ./configure CC=<compiler> ...
+
+5.2. Linux
+
+Q: Why do I get the following errors:
+
+   general: errno2result.c:109: unexpected error:
+   general: unable to convert errno to isc_result: 14: Bad address
+   client: UDP client handler shutting down due to fatal receive error: unexpected error
+
+A: This is the result of a Linux kernel bug.
+
+   See: <http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=
+   2>
+
+Q: Why does named lock up when it attempts to connect over IPSEC tunnels?
+
+A: This is due to a kernel bug where the fact that a socket is marked
+   non-blocking is ignored. It is reported that setting xfrm_larval_drop
+   to 1 helps but this may have negative side effects. See: <https://
+   bugzilla.redhat.com/show_bug.cgi?id=427629> and <http://lkml.org/lkml/
+   2007/12/4/260>.
+
+   xfrm_larval_drop can be set to 1 by the following procedure:
+
+   echo "1" > proc/sys/net/core/xfrm_larval_drop
+
+Q: Why do I see 5 (or more) copies of named on Linux?
+
+A: Linux threads each show up as a process under ps. The approximate
+   number of threads running is n+4, where n is the number of CPUs. Note
+   that the amount of memory used is not cumulative; if each process is
+   using 10M of memory, only a total of 10M is used.
+
+   Newer versions of Linux's ps command hide the individual threads and
+   require -L to display them.
+
+Q: Why does BIND 9 log "permission denied" errors accessing its
+   configuration files or zones on my Linux system even though it is
+   running as root?
+
+A: On Linux, BIND 9 drops most of its root privileges on startup. This
+   including the privilege to open files owned by other users. Therefore,
+   if the server is running as root, the configuration files and zone
+   files should also be owned by root.
+
+Q: I get the error message "named: capset failed: Operation not permitted"
+   when starting named.
+
+A: The capability module, part of "Linux Security Modules/LSM", has not
+   been loaded into the kernel. See insmod(8), modprobe(8).
+
+   The relevant modules can be loaded by running:
+
+   modprobe commoncap
+   modprobe capability
+
+Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core -
+
+   Why can't named update slave zone database files?
+
+   Why can't named create DDNS journal files or update the master zones
+   from journals?
+
+   Why can't named create custom log files?
+
+A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
+
+   Red Hat have adopted the National Security Agency's SELinux security
+   policy (see <http://www.nsa.gov/selinux>) and recommendations for BIND
+   security , which are more secure than running named in a chroot and
+   make use of the bind-chroot environment unnecessary .
+
+   By default, named is not allowed by the SELinux policy to write, create
+   or delete any files EXCEPT in these directories:
+
+   $ROOTDIR/var/named/slaves
+   $ROOTDIR/var/named/data
+   $ROOTDIR/var/tmp
+
+
+   where $ROOTDIR may be set in /etc/sysconfig/named if bind-chroot is
+   installed.
+
+   The SELinux policy particularly does NOT allow named to modify the
+   $ROOTDIR/var/named directory, the default location for master zone
+   database files.
+
+   SELinux policy overrules file access permissions - so even if all the
+   files under /var/named have ownership named:named and mode rw-rw-r--,
+   named will still not be able to write or create files except in the
+   directories above, with SELinux in Enforcing mode.
+
+   So, to allow named to update slave or DDNS zone files, it is best to
+   locate them in $ROOTDIR/var/named/slaves, with named.conf zone
+   statements such as:
+
+   zone "slave.zone." IN {
+           type slave;
+           file "slaves/slave.zone.db";
+           ...
+   };
+   zone "ddns.zone." IN  {
+           type master;
+           allow-updates {...};
+           file "slaves/ddns.zone.db";
+   };
+
+
+   To allow named to create its cache dump and statistics files, for
+   example, you could use named.conf options statements such as:
+
+   options {
+           ...
+           dump-file "/var/named/data/cache_dump.db";
+           statistics-file "/var/named/data/named_stats.txt";
+           ...
+   };
+
+
+   You can also tell SELinux to allow named to update any zone database
+   files, by setting the SELinux tunable boolean parameter
+   'named_write_master_zones=1', using the system-config-securitylevel
+   GUI, using the 'setsebool' command, or in /etc/selinux/targeted/
+   booleans.
+
+   You can disable SELinux protection for named entirely by setting the
+   'named_disable_trans=1' SELinux tunable boolean parameter.
+
+   The SELinux named policy defines these SELinux contexts for named:
+
+   named_zone_t : for zone database files       - $ROOTDIR/var/named/*
+   named_conf_t : for named configuration files - $ROOTDIR/etc/{named,rndc}.*
+   named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,data}}
+
+
+   If you want to retain use of the SELinux policy for named, and put
+   named files in different locations, you can do so by changing the
+   context of the custom file locations .
+
+   To create a custom configuration file location, e.g. '/root/
+   named.conf', to use with the 'named -c' option, do:
+
+   # chcon system_u:object_r:named_conf_t /root/named.conf
+
+
+   To create a custom modifiable named data location, e.g. '/var/log/
+   named' for a log file, do:
+
+   # chcon system_u:object_r:named_cache_t /var/log/named
+
+
+   To create a custom zone file location, e.g. /root/zones/, do:
+
+   # chcon system_u:object_r:named_zone_t /root/zones/{.,*}
+
+
+   See these man-pages for more information : selinux(8), named_selinux
+   (8), chcon(1), setsebool(8)
+
+Q: I'm running BIND on Ubuntu -
+
+   Why can't named update slave zone database files?
+
+   Why can't named create DDNS journal files or update the master zones
+   from journals?
+
+   Why can't named create custom log files?
+
+A: Ubuntu uses AppArmor <http://en.wikipedia.org/wiki/AppArmor> in
+   addition to normal file system permissions to protect the system.
+
+   Adjust the paths to use those specified in /etc/apparmor.d/
+   usr.sbin.named or adjust /etc/apparmor.d/usr.sbin.named to allow named
+   to write at the location specified in named.conf.
+
+Q: Listening on individual IPv6 interfaces does not work.
+
+A: This is usually due to "/proc/net/if_inet6" not being available in the
+   chroot file system. Mount another instance of "proc" in the chroot file
+   system.
+
+   This can be be made permanent by adding a second instance to /etc/
+   fstab.
+
+   proc /proc           proc defaults 0 0
+   proc /var/named/proc proc defaults 0 0
+
+5.3. Windows
+
+Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail.
+   Why?
+
+A: This may be caused by a bug in the Windows 2000 DNS server where DNS
+   messages larger than 16K are not handled properly. This can be worked
+   around by setting the option "transfer-format one-answer;". Also check
+   whether your zone contains domain names with embedded spaces or other
+   special characters, like "John\032Doe\213s\032Computer", since such
+   names have been known to cause Windows 2000 slaves to incorrectly
+   reject the zone.
+
+Q: I get "Error 1067" when starting named under Windows.
+
+A: This is the service manager saying that named exited. You need to
+   examine the Application log in the EventViewer to find out why.
+
+   Common causes are that you failed to create "named.conf" (usually "C:\
+   windows\dns\etc\named.conf") or failed to specify the directory in
+   named.conf.
+
+   options {
+           Directory "C:\windows\dns\etc";
+   };
+
+5.4. FreeBSD
+
+Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
+
+A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to
+   use certain interrupts as a source of random events. You can make this
+   permanent by setting rand_irqs in /etc/rc.conf.
+
+   rand_irqs="3 14 15"
+
+   See also <http://people.freebsd.org/~dougb/randomness.html>.
+
+5.5. Solaris
+
+Q: How do I integrate BIND 9 and Solaris SMF
+
+A: Sun has a blog entry describing how to do this.
+
+   <http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris>
+
+5.6. Apple Mac OS X
+
+Q: How do I run BIND 9 on Apple Mac OS X?
+
+A: If you run Tiger(Mac OS 10.4) or later then this is all you need to do:
+
+   % sudo rndc-confgen  > /etc/rndc.conf
+
+   Copy the key statement from /etc/rndc.conf into /etc/rndc.key, e.g.:
+
+   key "rndc-key" {
+           algorithm hmac-sha256;
+           secret "uvceheVuqf17ZwIcTydddw==";
+   };
+
+   Then start the relevant service:
+
+   % sudo service org.isc.named start
+
+   This is persistent upon a reboot, so you will have to do it only once.
+
+A: Alternatively you can just generate /etc/rndc.key by running:
+
+   % sudo rndc-confgen -a
+
+   Then start the relevant service:
+
+   % sudo service org.isc.named start
+
+   Named will look for /etc/rndc.key when it starts if it doesn't have a
+   controls section or the existing controls are missing keys sub-clauses.
+   This is persistent upon a reboot, so you will have to do it only once.
+

HISTORY.md

@@ -1,539 +0,0 @@
-<!--
- - Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-### Functional enhancements from prior major releases of BIND 9
-
-#### BIND 9.11
-
-BIND 9.11.0 includes a number of changes from BIND 9.10 and earlier
-releases.  New features include:
-
-- Added support for Catalog Zones, a new method for provisioning servers: a
-  list of zones to be served is stored in a DNS zone, along with their
-  configuration parameters. Changes to the catalog zone are propagated to
-  slaves via normal AXFR/IXFR, whereupon the zones that are listed in it
-  are automatically added, deleted or reconfigured.
-- Added support for "dnstap", a fast and flexible method of capturing and
-  logging DNS traffic.
-- Added support for "dyndb", a new API for loading zone data from an
-  external database, developed by Red Hat for the FreeIPA project.
-- "fetchlimit" quotas are now compiled in by default.  These are for the
-  use of recursive resolvers that are are under high query load for domains
-  whose authoritative servers are nonresponsive or are experiencing a
-  denial of service attack:
-    - "fetches-per-server" limits the number of simultaneous queries that
-      can be sent to any single authoritative server.  The configured value
-      is a starting point; it is automatically adjusted downward if the
-      server is partially or completely non-responsive. The algorithm used
-      to adjust the quota can be configured via the "fetch-quota-params"
-      option.
-    - "fetches-per-zone" limits the number of simultaneous queries that can
-      be sent for names within a single domain.  (Note: Unlike
-      "fetches-per-server", this value is not self-tuning.)
-    - New stats counters have been added to count queries spilled due to
-      these quotas.
-- Added a new "dnssec-keymgr" key mainenance utility, which can generate or
-  update keys as needed to ensure that a zone's keys match a defined DNSSEC
-  policy.
-- The experimental "SIT" feature in BIND 9.10 has been renamed "COOKIE" and
-  is no longer optional. EDNS COOKIE is a mechanism enabling clients to
-  detect off-path spoofed responses, and servers to detect spoofed-source
-  queries.  Clients that identify themselves using COOKIE options are not
-  subject to response rate limiting (RRL) and can receive larger UDP
-  responses.
-- SERVFAIL responses can now be cached for a limited time (defaulting to 1
-  second, with an upper limit of 30).  This can reduce the frequency of
-  retries when a query is persistently failing.
-- Added an "nsip-wait-recurse" switch to RPZ. This causes NSIP rules to be
-  skipped if a name server IP address isn't in the cache yet; the address
-  will be looked up and the rule will be applied on future queries.
-- Added a Python RNDC module. This allows multiple commands to sent over a
-  persistent RNDC channel, which saves time.
-- The "controls" block in named.conf can now grant read-only "rndc" access
-  to specified clients or keys. Read-only clients could, for example, check
-  "rndc status" but could not reconfigure or shut down the server.
-- "rndc" commands can now return arbitrarily large amounts of text to the
-  caller.
-- The zone serial number of a dynamically updatable zone can now be set via
-  "rndc signing -serial <number> <zonename>".  This allows inline-signing
-  zones to be set to a specific serial number.
-- The new "rndc nta" command can be used to set a Negative Trust Anchor
-  (NTA), disabling DNSSEC validation for a specific domain; this can be
-  used when responses from a domain are known to be failing validation due
-  to administrative error rather than because of a spoofing attack.
-  Negative trust anchors are strictly temporary; by default they expire
-  after one hour, but can be configured to last up to one week.
-- "rndc delzone" can now be used on zones that were not originally created
-  by "rndc addzone".
-- "rndc modzone" reconfigures a single zone, without requiring the entire
-  server to be reconfigured.
-- "rndc showzone" displays the current configuration of a zone.
-- "rndc managed-keys" can be used to check the status of RFC 5001 managed
-  trust anchors, or to force trust anchors to be refreshed.
-- "max-cache-size" can now be set to a percentage of available memory. The
-  default is 90%.
-- Update forwarding performance has been improved by allowing a single TCP
-  connection to be shared by multiple updates.
-- The EDNS Client Subnet (ECS) option is now supported for authoritative
-  servers; if a query contains an ECS option then ACLs containing "geoip"
-  or "ecs" elements can match against the the address encoded in the
-  option.  This can be used to select a view for a query, so that different
-  answers can be provided depending on the client network.
-- The EDNS EXPIRE option has been implemented on the client side, allowing
-  a slave server to set the expiration timer correctly when transferring
-  zone data from another slave server.
-- The key generation and manipulation tools (dnssec-keygen, dnssec-settime,
-  dnssec-importkey, dnssec-keyfromlabel) now take "-Psync" and "-Dsync"
-  options to set the publication and deletion times of CDS and CDNSKEY
-  parent-synchronization records.  Both named and dnssec-signzone can now
-  publish and remove these records at the scheduled times.
-- A new "minimal-any" option reduces the size of UDP responses for query
-  type ANY by returning a single arbitrarily selected RRset instead of all
-  RRsets.
-- A new "masterfile-style" zone option controls the formatting of text zone
-  files:  When set to "full", a zone file is dumped in
-  single-line-per-record format.
-- "serial-update-method" can now be set to "date". On update, the serial
-  number will be set to the current date in YYYYMMDDNN format.
-- "dnssec-signzone -N date" sets the serial number to YYYYMMDDNN.
-- "named -L <filename>" causes named to send log messages to the specified
-  file by default instead of to the system log.
-- "dig +ttlunits" prints TTL values with time-unit suffixes: w, d, h, m, s
-  for weeks, days, hours, minutes, and seconds.
-- "dig +unknownformat" prints dig output in RFC 3597 "unknown record"
-  presentation format.
-- "dig +ednsopt" allows dig to set arbitrary EDNS options on requests.
-- "dig +ednsflags" allows dig to set yet-to-be-defined EDNS flags on
-  requests.
-- "mdig" is an alternate version of dig which sends multiple pipelined TCP
-  queries to a server.  Instead of waiting for a response after sending a
-  query, it sends all queries immediately and displays responses in the
-  order received.
-- "serial-query-rate" no longer controls NOTIFY messages.  These are
-  separately controlled by "notify-rate" and "startup-notify-rate".
-- "nsupdate" now performs "check-names" processing by default on records to
-  be added.  This can be disabled with "check-names no".
-- The statistics channel now supports DEFLATE compression, reducing the
-  size of the data sent over the network when querying statistics.
-- New counters have been added to the statistics channel to track the sizes
-  of incoming queries and outgoing responses in histogram buckets, as
-  specified in RSSAC002.
-- A new NXDOMAIN redirect method (option "nxdomain-redirect") has been
-  added, allowing redirection to a specified DNS namespace instead of a
-  single redirect zone.
-- When starting up, named now ensures that no other named process is
-  already running.
-- Files created by named to store information, including "mkeys" and "nzf"
-  files, are now named after their corresponding views unless the view name
-  contains characters incompatible with use as a filename. Old style
-  filenames (based on the hash of the view name) will still work.
-
-#### BIND 9.10.0
-
-BIND 9.10.0 includes a number of changes from BIND 9.9 and earlier
-releases.  New features include:
-
- - DNS Response-rate limiting (DNS RRL), which blunts the
-   impact of reflection and amplification attacks, is always
-   compiled in and no longer requires a compile-time option
-   to enable it.
- - An experimental "Source Identity Token" (SIT) EDNS option
-   is now available.  Similar to DNS Cookies as invented by
-   Donald Eastlake 3rd, these are designed to enable clients
-   to detect off-path spoofed responses, and to enable servers
-   to detect spoofed-source queries.  Servers can be configured
-   to send smaller responses to clients that have not identified
-   themselves using a SIT option, reducing the effectiveness of
-   amplification attacks.  RRL processing has also been updated;
-   clients proven to be legitimate via SIT are not subject to
-   rate limiting.  Use "configure --enable-sit" to enable this
-   feature in BIND.
- - A new zone file format, "map", stores zone data in a
-   format that can be mapped directly into memory, allowing
-   significantly faster zone loading.
- - "delv" (domain entity lookup and validation) is a new tool
-   with dig-like semantics for looking up DNS data and performing
-   internal DNSSEC validation.  This allows easy validation in
-   environments where the resolver may not be trustworthy, and
-   assists with troubleshooting of DNSSEC problems. (NOTE:
-   In previous development releases of BIND 9.10, this utility
-   was called "delve". The spelling has been changed to avoid
-   confusion with the "delve" utility included with the Xapian
-   search engine.)
- - Improved EDNS(0) processing for better resolver performance
-   and reliability over slow or lossy connections.
- - A new "configure --with-tuning=large" option tunes certain
-   compiled-in constants and default settings to values better
-   suited to large servers with abundant memory.  This can
-   improve performance on such servers, but will consume more
-   memory and may degrade performance on smaller systems.
- - Substantial improvement in response-policy zone (RPZ)
-   performance.  Up to 32 response-policy zones can be
-   configured with minimal performance loss.
- - To improve recursive resolver performance, cache records
-   which are still being requested by clients can now be
-   automatically refreshed from the authoritative server
-   before they expire, reducing or eliminating the time
-   window in which no answer is available in the cache.
- - New "rpz-client-ip" triggers and drop policies allowing
-   response policies based on the IP address of the client.
- - ACLs can now be specified based on geographic location
-   using the MaxMind GeoIP databases.  Use "configure
-   --with-geoip" to enable.
- - Zone data can now be shared between views, allowing
-   multiple views to serve the same zones authoritatively
-   without storing multiple copies in memory.
- - New XML schema (version 3) for the statistics channel
-   includes many new statistics and uses a flattened XML tree
-   for faster parsing. The older schema is now deprecated.
- - A new stylesheet, based on the Google Charts API, displays
-   XML statistics in charts and graphs on javascript-enabled
-   browsers.
- - The statistics channel can now provide data in JSON
-   format as well as XML.
- - New stats counters track TCP and UDP queries received
-   per zone, and EDNS options received in total.
- - The internal and export versions of the BIND libraries
-   (libisc, libdns, etc) have been unified so that external
-   library clients can use the same libraries as BIND itself.
- - A new compile-time option, "configure --enable-native-pkcs11",
-   allows BIND 9 cryptography functions to use the PKCS#11 API
-   natively, so that BIND can drive a cryptographic hardware
-   service module (HSM) directly instead of using a modified
-   OpenSSL as an intermediary. (Note: This feature requires an
-   HSM to have a full implementation of the PKCS#11 API; many
-   current HSMs only have partial implementations. The new
-   "pkcs11-tokens" command can be used to check API completeness.
-   Native PKCS#11 is known to work with the Thales nShield HSM
-   and with SoftHSM version 2 from the Open DNSSEC project.)
- - The new "max-zone-ttl" option enforces maximum TTLs for
-   zones. This can simplify the process of rolling DNSSEC keys
-   by guaranteeing that cached signatures will have expired
-   within the specified amount of time.
- - "dig +subnet" sends an EDNS CLIENT-SUBNET option when
-   querying.
- - "dig +expire" sends an EDNS EXPIRE option when querying.
-   When this option is sent with an SOA query to a server
-   that supports it, it will report the expiry time of
-   a slave zone.
- - New "dnssec-coverage" tool to check DNSSEC key coverage
-   for a zone and report if a lapse in signing coverage has
-   been inadvertently scheduled.
- - Signing algorithm flexibility and other improvements
-   for the "rndc" control channel.
- - "named-checkzone" and "named-compilezone" can now read
-   journal files, allowing them to process dynamic zones.
- - Multiple DLZ databases can now be configured.  Individual
-   zones can be configured to be served from a specific DLZ
-   database.  DLZ databases now serve zones of type "master"
-   and "redirect".
- - "rndc zonestatus" reports information about a specified zone.
- - "named" now listens on IPv6 as well as IPv4 interfaces
-   by default.
- - "named" now preserves the capitalization of names
-   when responding to queries: for instance, a query for
-   "example.com" may be answered with "example.COM" if the
-   name was configured that way in the zone file.  Some
-   clients have a bug causing them to depend on the older
-   behavior, in which the case of the answer always matched
-   the case of the query, rather than the case of the name
-   configured in the DNS.  Such clients can now be specified
-   in the new "no-case-compress" ACL; this will restore the
-   older behavior of "named" for those clients only.
- - new "dnssec-importkey" command allows the use of offline
-   DNSSEC keys with automatic DNSKEY management.
- - New "named-rrchecker" tool to verify the syntactic
-   correctness of individual resource records.
- - When re-signing a zone, the new "dnssec-signzone -Q" option
-   drops signatures from keys that are still published but are
-   no longer active.
- - "named-checkconf -px" will print the contents of configuration
-   files with the shared secrets obscured, making it easier to
-   share configuration (e.g. when submitting a bug report)
-   without revealing private information.
- - "rndc scan" causes named to re-scan network interfaces for
-   changes in local addresses.
- - On operating systems with support for routing sockets,
-   network interfaces are re-scanned automatically whenever
-   they change.
- - "tsig-keygen" is now available as an alternate command
-   name to use for "ddns-confgen".
-
-#### BIND 9.9.0
-
-BIND 9.9.0 includes a number of changes from BIND 9.8 and earlier
-releases.  New features include:
-
-- Inline signing, allowing automatic DNSSEC signing of
-  master zones without modification of the zonefile, or
-  "bump in the wire" signing in slaves.
-- NXDOMAIN redirection.
-- New 'rndc flushtree' command clears all data under a given
-  name from the DNS cache.
-- New 'rndc sync' command dumps pending changes in a dynamic
-  zone to disk without a freeze/thaw cycle.
-- New 'rndc signing' command displays or clears signing status
-  records in 'auto-dnssec' zones.
-- NSEC3 parameters for 'auto-dnssec' zones can now be set prior
-  to signing, eliminating the need to initially sign with NSEC.
-- Startup time improvements on large authoritative servers.
-- Slave zones are now saved in raw format by default.
-- Several improvements to response policy zones (RPZ).
-- Improved hardware scalability by using multiple threads
-  to listen for queries and using finer-grained client locking
-- The 'also-notify' option now takes the same syntax as
-  'masters', so it can used named masterlists and TSIG keys.
-- 'dnssec-signzone -D' writes an output file containing only DNSSEC
-  data, which can be included by the primary zone file.
-- 'dnssec-signzone -R' forces removal of signatures that are
-  not expired but were created by a key which no longer exists.
-- 'dnssec-signzone -X' allows a separate expiration date to
-  be specified for DNSKEY signatures from other signatures.
-- New '-L' option to dnssec-keygen, dnssec-settime, and
-  dnssec-keyfromlabel sets the default TTL for the key.
-- dnssec-dsfromkey now supports reading from standard input,
-  to make it easier to convert DNSKEY to DS.
-- RFC 1918 reverse zones have been added to the empty-zones
-  table per RFC 6303.
-- Dynamic updates can now optionally set the zone's SOA serial
-  number to the current UNIX time.
-- DLZ modules can now retrieve the source IP address of
-  the querying client.
-- 'request-ixfr' option can now be set at the per-zone level.
-- 'dig +rrcomments' turns on comments about DNSKEY records,
-  indicating their key ID, algorithm and function
-- Simplified nsupdate syntax and added readline support
-
-#### BIND 9.8.0
-
-BIND 9.8.0 includes a number of changes from BIND 9.7 and earlier
-releases.  New features include:
-
-- Built-in trust anchor for the root zone, which can be
-  switched on via "dnssec-validation auto;"
-- Support for DNS64.
-- Support for response policy zones (RPZ).
-- Support for writable DLZ zones.
-- Improved ease of configuration of GSS/TSIG for
-  interoperability with Active Directory
-- Support for GOST signing algorithm for DNSSEC.
-- Removed RTT Banding from server selection algorithm.
-- New "static-stub" zone type.
-- Allow configuration of resolver timeouts via
-  "resolver-query-timeout" option.
-- The DLZ "dlopen" driver is now built by default.
-- Added a new include file with function typedefs
-  for the DLZ "dlopen" driver.
-- Made "--with-gssapi" default.
-- More verbose error reporting from DLZ LDAP.
-
-#### BIND 9.7.0
-
-BIND 9.7.0 includes a number of changes from BIND 9.6 and earlier
-releases.  Most are intended to simplify DNSSEC configuration.
-New features include:
-
-- Fully automatic signing of zones by "named".
-- Simplified configuration of DNSSEC Lookaside Validation (DLV).
-- Simplified configuration of Dynamic DNS, using the "ddns-confgen"
-  command line tool or the "local" update-policy option.  (As a side
-  effect, this also makes it easier to configure automatic zone
-  re-signing.)
-- New named option "attach-cache" that allows multiple views to
-  share a single cache.
-- DNS rebinding attack prevention.
-- New default values for dnssec-keygen parameters.
-- Support for RFC 5011 automated trust anchor maintenance
-- Smart signing: simplified tools for zone signing and key
-  maintenance.
-- The "statistics-channels" option is now available on Windows.
-- A new DNSSEC-aware libdns API for use by non-BIND9 applications
-- On some platforms, named and other binaries can now print out
-  a stack backtrace on assertion failure, to aid in debugging.
-- A "tools only" installation mode on Windows, which only installs
-  dig, host, nslookup and nsupdate.
-- Improved PKCS#11 support, including Keyper support and explicit
-  OpenSSL engine selection.
-
-#### BIND 9.6.0
-
-- Full NSEC3 support
-- Automatic zone re-signing
-- New update-policy methods tcp-self and 6to4-self
-- The BIND 8 resolver library, libbind, has been removed from the BIND 9
-  distribution and is now available as a separate download.
-- Change the default pid file location from /var/run to
-  /var/run/{named,lwresd} for improved chroot/setuid support.
-
-#### BIND 9.5.0
-
-- GSS-TSIG support (RFC 3645).
-- DHCID support.
-- Experimental http server and statistics support for named via xml.
-- More detailed statistics counters including those supported in BIND 8.
-- Faster ACL processing.
-- Use Doxygen to generate internal documentation.
-- Efficient LRU cache-cleaning mechanism.
-- NSID support.
-
-BIND 9.4.0
-
-- Implemented "additional section caching (or acache)", an internal cache
-  framework for additional section content to improve response performance.
-  Several configuration options were provided to control the behavior.
-- New notify type 'master-only'.  Enable notify for master zones only.
-- Accept 'notify-source' style syntax for query-source.
-- rndc now allows addresses to be set in the server clauses.
-- New option "allow-query-cache".  This lets "allow-query" be used to
-  specify the default zone access level rather than having to have every
-  zone override the global value.  "allow-query-cache" can be set at both
-  the options and view levels.  If "allow-query-cache" is not set then
-  "allow-recursion" is used if set, otherwise "allow-query" is used if set
-  unless "recursion no;" is set in which case "none;" is used, otherwise
-  the default (localhost; localnets;) is used.
-- rndc: the source address can now be specified.
-- ixfr-from-differences now takes master and slave in addition to yes and
-  no at the options and view levels.
-- Allow the journal's name to be changed via named.conf.
-- 'rndc notify zone [class [view]]' resend the NOTIFY messages for the
-  specified zone.
-- 'dig +trace' now randomly selects the next servers to try.  Report if
-  there is a bad delegation.
-- Improve check-names error messages.
-- Make public the function to read a key file, dst_key_read_public().
-- dig now returns the byte count for axfr/ixfr.
-- allow-update is now settable at the options / view level.
-- named-checkconf now checks the logging configuration.
-- host now can turn on memory debugging flags with '-m'.
-- Don't send notify messages to self.
-- Perform sanity checks on NS records which refer to 'in zone' names.
-- New zone option "notify-delay".  Specify a minimum delay between sets of
-  NOTIFY messages.
-- Extend adjusting TTL warning messages.
-- Named and named-checkzone can now both check for non-terminal wildcard
-  records.
-- "rndc freeze/thaw" now freezes/thaws all zones.
-- named-checkconf now check acls to verify that they only refer to existing
-  acls.
-- The server syntax has been extended to support a range of servers.
-- Report differences between hints and real NS rrset and associated address
-  records.
-- Preserve the case of domain names in rdata during zone transfers.
-- Restructured the data locking framework using architecture dependent
-  atomic operations (when available), improving response performance on
-  multi-processor machines significantly.  x86, x86_64, alpha, powerpc, and
-  mips are currently supported.
-- UNIX domain controls are now supported.
-- Add support for additional zone file formats for improving loading
-  performance.  The masterfile-format option in named.conf can be used to
-  specify a non-default format.  A separate command named-compilezone was
-  provided to generate zone files in the new format.  Additionally, the -I
-  and -O options for dnssec-signzone specify the input and output formats.
-- dnssec-signzone can now randomize signature end times (dnssec-signzone -j
-  jitter).
-- Add support for CH A record.
-- Add additional zone data constancy checks.  named-checkzone has extended
-  checking of NS, MX and SRV record and the hosts they reference.  named
-  has extended post zone load checks.  New zone options: check-mx and
-  integrity-check.
-- edns-udp-size can now be overridden on a per server basis.
-- dig can now specify the EDNS version when making a query.
-- Added framework for handling multiple EDNS versions.
-- Additional memory debugging support to track size and mctx arguments.
-- Detect duplicates of UDP queries we are recursing on and drop them.  New
-  stats category "duplicates".
-- "USE INTERNAL MALLOC" is now runtime selectable.
-- The lame cache is now done on a <qname,qclass,qtype> basis as some
-  servers only appear to be lame for certain query types.
-- Limit the number of recursive clients that can be waiting for a single
-  query (<qname,qtype,qclass>) to resolve.  New options clients-per-query
-  and max-clients-per-query.
-- dig: report the number of extra bytes still left in the packet after
-  processing all the records.
-- Support for IPSECKEY rdata type.
-- Raise the UDP recieve buffer size to 32k if it is less than 32k.
-- x86 and x86_64 now have seperate atomic locking implementations.
-- named-checkconf now validates update-policy entries.
-- Attempt to make the amount of work performed in a iteration self tuning.
-  The covers nodes clean from the cache per iteration, nodes written to
-  disk when rewriting a master file and nodes destroyed per iteration when
-  destroying a zone or a cache.
-- ISC string copy API.
-- Automatic empty zone creation for D.F.IP6.ARPA and friends.  Note: RFC
-  1918 zones are not yet covered by this but are likely to be in a future
-  release.
-- New options: empty-server, empty-contact, empty-zones-enable and
-  disable-empty-zone.
-- dig now has a '-q queryname' and '+showsearch' options.
-- host/nslookup now continue (default)/fail on SERVFAIL.
-- dig now warns if 'RA' is not set in the answer when 'RD' was set in the
-  query.  host/nslookup skip servers that fail to set 'RA' when 'RD' is set
-  unless a server is explicitly set.
-- Integrate contibuted DLZ code into named.
-- Integrate contibuted IDN code from JPNIC.
-- libbind: corresponds to that from BIND 8.4.7.
-
-#### BIND 9.3.0
-
-- DNSSEC is now DS based (RFC 3658).
-- DNSSEC lookaside validation.
-- check-names is now implemented.
-- rrset-order is more complete.
-- IPv4/IPv6 transition support, dual-stack-servers.
-- IXFR deltas can now be generated when loading master files,
-  ixfr-from-differences.
-- It is now possible to specify the size of a journal, max-journal-size.
-- It is now possible to define a named set of master servers to be used in
-  masters clause, masters.
-- The advertised EDNS UDP size can now be set, edns-udp-size.
-- allow-v6-synthesis has been obsoleted.
-- Zones containing MD and MF will now be rejected.
-- dig, nslookup name. now report "Not Implemented" as NOTIMP rather than
-  NOTIMPL.  This will have impact on scripts that are looking for NOTIMPL.
-- libbind: corresponds to that from BIND 8.4.5.
-
-#### BIND 9.2.0
-
-- The size of the cache can now be limited using the "max-cache-size"
-  option.
-- The server can now automatically convert RFC1886-style recursive lookup
-  requests into RFC2874-style lookups, when enabled using the new option
-  "allow-v6-synthesis".  This allows stub resolvers that support AAAA
-  records but not A6 record chains or binary labels to perform lookups in
-  domains that make use of these IPv6 DNS features.
-- Performance has been improved.
-- The man pages now use the more portable "man" macros rather than the
-  "mandoc" macros, and are installed by "make install".
-- The named.conf parser has been completely rewritten.  It now supports
-  "include" directives in more places such as inside "view" statements, and
-  it no longer has any reserved words.
-- The "rndc status" command is now implemented.
-- rndc can now be configured automatically.
-- A BIND 8 compatible stub resolver library is now included in lib/bind.
-- OpenSSL has been removed from the distribution.  This means that to use
-  DNSSEC, OpenSSL must be installed and the --with-openssl option must be
-  supplied to configure.  This does not apply to the use of TSIG, which
-  does not require OpenSSL.
-- The source distribution now builds on Windows.  See
-  win32utils/readme1.txt and win32utils/win32-build.txt for details.
-- This distribution also includes a new lightweight stub resolver library
-  and associated resolver daemon that fully support forward and reverse
-  lookups of both IPv4 and IPv6 addresses.  This library is considered
-  experimental and is not a complete replacement for the BIND 8 resolver
-  library.  Applications that use the BIND 8 `res_*` functions to perform
-  DNS lookups or dynamic updates still need to be linked against the BIND 8
-  libraries.  For DNS lookups, they can also use the new "getrrsetbyname()"
-  API.
-- BIND 9.2 is capable of acting as an authoritative server for DNSSEC
-  secured zones.  This functionality is believed to be stable and complete
-  except for lacking support for verifications involving wildcard records
-  in secure zones.
-- When acting as a caching server, BIND 9.2 can be configured to perform
-  DNSSEC secure resolution on behalf of its clients.  This part of the
-  DNSSEC implementation is still considered experimental.  For detailed
-  information about the state of the DNSSEC implementation, see the file
-  doc/misc/dnssec.

Makefile.in

@@ -1,9 +1,11 @@
-# Copyright (C) 1998-2002, 2004-2009, 2011-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 1998-2002, 2004-2009, 2011-2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+# $Id: Makefile.in,v 1.62 2011/09/06 04:06:37 marka Exp $
+
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -18,7 +20,7 @@ MANPAGES =	isc-config.sh.1
 
 HTMLPAGES =	isc-config.sh.html
 
-MANOBJS =	README HISTORY OPTIONS ${MANPAGES} ${HTMLPAGES}
+MANOBJS =	${MANPAGES} ${HTMLPAGES}
 
 @BIND9_MAKE_RULES@
 
@@ -89,19 +91,13 @@ test-force:
 	(test -f unit/unittest.sh && $(SHELL) unit/unittest.sh) || status=1; \
 	exit $$status
 
-README: README.md
-	${PANDOC} --email-obfuscation=none -s -t html README.md | \
-		${W3M} -dump -cols 75 -O ascii -T text/html > $@
-
-HISTORY: HISTORY.md
-	${PANDOC} --email-obfuscation=none -s -t html HISTORY.md | \
-		${W3M} -dump -cols 75 -O ascii -T text/html > $@
-
-OPTIONS: OPTIONS.md
-	${PANDOC} --email-obfuscation=none -s -t html OPTIONS.md | \
-		${W3M} -dump -cols 75 -O ascii -T text/html > $@
+FAQ: FAQ.xml
+	${XSLTPROC} doc/xsl/isc-docbook-text.xsl FAQ.xml | \
+	LC_ALL=C ${W3M} -T text/html -dump -cols 72 >$@.tmp
+	mv $@.tmp $@
 
 unit::
 	sh ${top_srcdir}/unit/unittest.sh
 
 clean::
+	rm -f FAQ.tmp

OPTIONS

@@ -1,25 +0,0 @@
-Setting the STD_CDEFINES environment variable before running configure can
-be used to enable certain compile-time options that are not explicitly
-defined in configure.
-
-Some of these settings are:
-
-Setting                   Description
-                          Overwrite memory with tag values when allocating
--DISC_MEM_DEFAULTFILL=1   or freeing it; this impairs performance but
-                          makes debugging of memory problems easier.
-                          Don't track memory allocations by file and line
--DISC_MEM_TRACKLINES=0    number; this improves performance but makes
-                          debugging more difficult.
--DISC_FACILITY=LOG_LOCAL0 Change the default syslog facility for named
--DNS_CLIENT_DROPPORT=0    Disable dropping queries from particular
-                          well-known ports:
--DCHECK_SIBLING=0         Don't check sibling glue in named-checkzone
--DCHECK_LOCAL=0           Don't check out-of-zone addresses in
-                          named-checkzone
--DNS_RUN_PID_DIR=0        Create default PID files in ${localstatedir}/run
-                          rather than ${localstatedir}/run/named/
-                          Increase the maximum number of configurable
--DNS_RPZ_MAX_ZONES=64     response policy zones from 32 to 64; this is the
-                          highest possible setting
-

OPTIONS.md

@@ -1,23 +0,0 @@
-<!--
- - Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-Setting the `STD_CDEFINES` environment variable before running `configure`
-can be used to enable certain compile-time options that are not explicitly
-defined in `configure`.
-
-Some of these settings are:
-
-|Setting                            |Description |
-|-----------------------------------|----------------------------------------|
-|`-DISC_MEM_DEFAULTFILL=1`|Overwrite memory with tag values when allocating or freeing it; this impairs performance but makes debugging of memory problems easier.|
-|`-DISC_MEM_TRACKLINES=0`|Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult.|
-|<nobr>`-DISC_FACILITY=LOG_LOCAL0`</nobr>|Change the default syslog facility for `named`|
-|`-DNS_CLIENT_DROPPORT=0`|Disable dropping queries from particular well-known ports:|
-|`-DCHECK_SIBLING=0`|Don't check sibling glue in `named-checkzone`|
-|`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
-|`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
-|`-DNS_RPZ_MAX_ZONES=64`|Increase the maximum number of configurable response policy zones from 32 to 64; this is the highest possible setting|

README

@@ -1,341 +1,519 @@
 BIND 9
 
-Contents
+	BIND version 9 is a major rewrite of nearly all aspects of the
+	underlying BIND architecture.  Some of the important features of
+	BIND 9 are:
 
- 1. Introduction
- 2. Reporting bugs and getting help
- 3. Contributing to BIND
- 4. BIND 9.12 features
- 5. Building BIND
- 6. Compile-time options
- 7. Automated testing
- 8. Documentation
- 9. Change log
-10. Acknowledgments
+		- DNS Security
+			DNSSEC (signed zones)
+			TSIG (signed DNS requests)
 
-Introduction
+		- IP version 6
+			Answers DNS queries on IPv6 sockets
+			IPv6 resource records (AAAA)
+			Experimental IPv6 Resolver Library
 
-BIND (Berkeley Internet Name Domain) is a complete, highly portable
-implementation of the DNS (Domain Name System) protocol.
+		- DNS Protocol Enhancements
+			IXFR, DDNS, Notify, EDNS0
+			Improved standards conformance
 
-The BIND name server, named, is able to serve as an authoritative name
-server, recursive resolver, DNS forwarder, or all three simultaneously. It
-implements views for split-horizon DNS, automatic DNSSEC zone signing and
-key management, catalog zones to facilitate provisioning of zone data
-throughout a name server constellation, response policy zones (RPZ) to
-protect clients from malicious data, response rate limiting (RRL) and
-recursive query limits to reduce distributed denial of service attacks,
-and many other advanced DNS features. BIND also includes a suite of
-administrative tools, including the dig and delv DNS lookup tools,
-nsupdate for dynamic DNS zone updates, rndc for remote name server
-administration, and more.
+		- Views
+			One server process can provide multiple "views" of
+			the DNS namespace, e.g. an "inside" view to certain
+			clients, and an "outside" view to others.
 
-BIND 9 is a complete re-write of the BIND architecture that was used in
-versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a 501
-(c)(3) public benefit corporation dedicated to providing software and
-services in support of the Internet infrastructure, developed BIND 9 and
-is responsible for its ongoing maintenance and improvement. BIND is open
-source software licenced under the terms of the Mozilla Public License,
-version 2.0.
+		- Multiprocessor Support
 
-For a summary of features introduced in past major releases of BIND, see
-the file HISTORY.
+		- Improved Portability Architecture
 
-For a detailed list of changes made throughout the history of BIND 9, see
-the file CHANGES. See below for details on the CHANGES file format.
 
-For up-to-date release notes and errata, see http://www.isc.org/software/
-bind9/releasenotes
+	BIND version 9 development has been underwritten by the following
+	organizations:
 
-Reporting bugs and getting help
+		Sun Microsystems, Inc.
+		Hewlett Packard
+		Compaq Computer Corporation
+		IBM
+		Process Software Corporation
+		Silicon Graphics, Inc.
+		Network Associates, Inc.
+		U.S. Defense Information Systems Agency
+		USENIX Association
+		Stichting NLnet - NLnet Foundation
+		Nominum, Inc.
 
-Please report assertion failure errors and suspected security issues to
-security-officer@isc.org.
+	For a summary of functional enhancements in previous
+	releases, see the HISTORY file.
 
-General bug reports can be sent to bind9-bugs@isc.org.
+	For a detailed list of user-visible changes from
+	previous releases, see the CHANGES file.
 
-Feature requests can be sent to bind-suggest@isc.org.
+	For up-to-date release notes and errata, see
+	http://www.isc.org/software/bind9/releasenotes
 
-Please note that, while tickets submitted to ISC's ticketing system are
-not initially publicly readable by default, they can be made publicly
-acessible afterward. Please do not include information in bug reports that
-you consider to be confidential. In particular, when sending the contents
-of your configuration file, it is advisable to obscure key secrets: this
-can be done automatically by using named-checkconf -px.
+BIND 9.11.1
+	
+	BIND 9.11.1 is a maintenance release and addresses the security
+	flaws disclosed in CVE-2016-6170, CVE-2016-8864, CVE-2016-9131,
+	CVE-2016-9147, CVE-2016-9778, CVE-2017-3135, CVE-2017-3136, and
+	CVE-2017-3137.
 
-Professional support and training for BIND are available from ISC at
-https://www.isc.org/support.
+BIND 9.11.0
 
-To join the BIND Users mailing list, or view the archives, visit https://
-lists.isc.org/mailman/listinfo/bind-users.
+	BIND 9.11.0 includes a number of changes from BIND 9.10 and earlier
+	releases.  New features include:
 
-If you're planning on making changes to the BIND 9 source code, you may
-also want to join the BIND Workers mailing list, at https://lists.isc.org/
-mailman/listinfo/bind-workers.
+	- Added support for Catalog Zones, a new method for provisioning
+	  servers: a list of zones to be served is stored in a DNS zone,
+	  along with their configuration parameters. Changes to the
+	  catalog zone are propagated to slaves via normal AXFR/IXFR,
+	  whereupon the zones that are listed in it are automatically
+	  added, deleted or reconfigured.
+	- Added support for "dnstap", a fast and flexible method of
+	  capturing and logging DNS traffic.
+	- Added support for "dyndb", a new API for loading zone data
+	  from an external database, developed by Red Hat for the FreeIPA
+	  project.
+	- "fetchlimit" quotas are now compiled in by default.  These
+	  are for the use of recursive resolvers that are are under
+	  high query load for domains whose authoritative servers are
+	  nonresponsive or are experiencing a denial of service attack:
+	  + "fetches-per-server" limits the number of simultaneous queries
+	    that can be sent to any single authoritative server.  The
+	    configured value is a starting point; it is automatically
+	    adjusted downward if the server is partially or completely
+	    non-responsive. The algorithm used to adjust the quota can be
+	    configured via the "fetch-quota-params" option.
+	  + "fetches-per-zone" limits the number of simultaneous queries
+	    that can be sent for names within a single domain.  (Note:
+	    Unlike "fetches-per-server", this value is not self-tuning.)
+	  + New stats counters have been added to count
+	    queries spilled due to these quotas.
+	- Added a new "dnssec-keymgr" key mainenance utility, which can
+	  generate or update keys as needed to ensure that a zone's
+	  keys match a defined DNSSEC policy.
+	- The experimental "SIT" feature in BIND 9.10 has been renamed
+	  "COOKIE" and is no longer optional. EDNS COOKIE is a mechanism
+	  enabling clients to detect off-path spoofed responses, and
+	  servers to detect spoofed-source queries.  Clients that identify
+	  themselves using COOKIE options are not subject to response rate
+	  limiting (RRL) and can receive larger UDP responses.
+	- SERVFAIL responses can now be cached for a limited time
+	  (defaulting to 1 second, with an upper limit of 30).
+	  This can reduce the frequency of retries when a query is
+	  persistently failing.
+	- Added an "nsip-wait-recurse" switch to RPZ. This causes NSIP
+	  rules to be skipped if a name server IP address isn't in the
+	  cache yet; the address will be looked up and the rule will be
+	  applied on future queries.
+	- Added a Python RNDC module. This allows multiple commands to
+	  sent over a persistent RNDC channel, which saves time.
+	- The "controls" block in named.conf can now grant read-only
+	  "rndc" access to specified clients or keys. Read-only clients
+	  could, for example, check "rndc status" but could not
+	  reconfigure or shut down the server.
+	- "rndc" commands can now return arbitrarily large amounts of
+	  text to the caller.
+	- The zone serial number of a dynamically updatable zone
+	  can now be set via "rndc signing -serial <number> <zonename>".
+	  This allows inline-signing zones to be set to a specific
+	  serial number.
+	- The new "rndc nta" command can be used to set a Negative
+	  Trust Anchor (NTA), disabling DNSSEC validation for a
+	  specific domain; this can be used when responses from a
+	  domain are known to be failing validation due to administrative
+	  error rather than because of a spoofing attack.  Negative
+	  trust anchors are strictly temporary; by default they expire
+	  after one hour, but can be configured to last up to one week.
+	- "rndc delzone" can now be used on zones that were not originally
+	  created by "rndc addzone".
+	- "rndc modzone" reconfigures a single zone, without requiring
+	  the entire server to be reconfigured.
+	- "rndc showzone" displays the current configuration of a zone.
+	- "rndc managed-keys" can be used to check the status of RFC 5001
+	  managed trust anchors, or to force trust anchors to be refreshed.
+	- "max-cache-size" can now be set to a percentage of available
+	  memory. The default is 90%.
+	- Update forwarding performance has been improved by allowing
+	  a single TCP connection to be shared by multiple updates.
+	- The EDNS Client Subnet (ECS) option is now supported for
+	  authoritative servers; if a query contains an ECS option
+	  then ACLs containing "geoip" or "ecs" elements can match
+	  against the the address encoded in the option.  This can be
+	  used to select a view for a query, so that different answers
+	  can be provided depending on the client network.
+	- The EDNS EXPIRE option has been implemented on the client
+	  side, allowing a slave server to set the expiration timer
+	  correctly when transferring zone data from another slave
+	  server.
+	- The key generation and manipulation tools (dnssec-keygen,
+	  dnssec-settime, dnssec-importkey, dnssec-keyfromlabel) now
+	  take "-Psync" and "-Dsync" options to set the publication
+	  and deletion times of CDS and CDNSKEY parent-synchronization
+	  records.  Both named and dnssec-signzone can now publish and
+	  remove these records at the scheduled times.
+	- A new "minimal-any" option reduces the size of UDP responses
+	  for query type ANY by returning a single arbitrarily selected
+	  RRset instead of all RRsets.
+	- A new "masterfile-style" zone option controls the formatting
+	  of text zone files:  When set to "full", a zone file is dumped
+	  in single-line-per-record format.
+	- "serial-update-method" can now be set to "date". On update,
+	  the serial number will be set to the current date in YYYYMMDDNN
+	  format.
+	- "dnssec-signzone -N date" sets the serial number to YYYYMMDDNN.
+	- "named -L <filename>" causes named to send log messages to
+	   the specified file by default instead of to the system log.
+	- "dig +ttlunits" prints TTL values with time-unit suffixes:
+	  w, d, h, m, s for weeks, days, hours, minutes, and seconds.
+	- "dig +unknownformat" prints dig output in RFC 3597 "unknown
+	  record" presentation format.
+	- "dig +ednsopt" allows dig to set arbitrary EDNS options on
+	  requests.
+	- "dig +ednsflags" allows dig to set yet-to-be-defined EDNS
+	  flags on requests.
+	- "mdig" is an alternate version of dig which sends multiple
+	  pipelined TCP queries to a server.  Instead of waiting for a
+	  response after sending a query, it sends all queries
+	  immediately and displays responses in the order received.
+	- "serial-query-rate" no longer controls NOTIFY messages.
+	  These are separately controlled by "notify-rate" and
+	  "startup-notify-rate".
+	- "nsupdate" now performs "check-names" processing by default
+	  on records to be added.  This can be disabled with
+	  "check-names no".
+	- The statistics channel now supports DEFLATE compression,
+	  reducing the size of the data sent over the network when
+	  querying statistics.
+	- New counters have been added to the statistics channel
+	  to track the sizes of incoming queries and outgoing responses in
+	  histogram buckets, as specified in RSSAC002.
+	- A new NXDOMAIN redirect method (option "nxdomain-redirect")
+	  has been added, allowing redirection to a specified DNS
+	  namespace instead of a single redirect zone.
+	- When starting up, named now ensures that no other named
+	  process is already running.
+	- Files created by named to store information, including "mkeys"
+	  and "nzf" files, are now named after their corresponding views
+	  unless the view name contains characters incompatible with use
+	  as a filename. Old style filenames (based on the hash of the
+	  view name) will still work.
 
-Contributing to BIND
+	This release addresses the security flaws described in
+	CVE-2014-3214, CVE-2014-3859, CVE-2014-8500, CVE-2014-8680,
+	CVE-2015-1349, CVE-2015-5477, CVE-2015-5722, CVE-2015-5986,
+	CVE-2015-8000, CVE-2015-8704, CVE-2015-8705, CVE-2016-1285,
+	CVE-2016-1286, CVE-2016-2088, CVE-2016-2775 and CVE-2016-2776.
 
-ISC maintains a public git repository for BIND; details can be found at
-http://www.isc.org/git/, and also on Github at https://github.com/
-isc-projects.
+Building
 
-Information for BIND contributors can be found in the following files: -
-General information: doc/dev/contrib.md - BIND 9 code style: doc/dev/
-style.md - BIND architecture and developer guide: doc/dev/dev.md
+	BIND 9 currently requires a UNIX system with an ANSI C compiler,
+	basic POSIX support, and a 64 bit integer type.
 
-Patches for BIND may be submitted either as Github pull requests or via
-email. When submitting a patch via email, please prepend the subject
-header with "[PATCH]" so it will be easier for us to find. If your patch
-introduces a new feature in BIND, please submit it to bind-suggest@isc.org
-; if it fixes a bug, please submit it to bind9-bugs@isc.org.
+	We've had successful builds and tests on the following systems:
 
-BIND 9.12 features
+		COMPAQ Tru64 UNIX 5.1B
+		Fedora Core 6
+		FreeBSD 4.10, 5.2.1, 6.2
+		HP-UX 11.11
+		Mac OS X 10.5
+		NetBSD 3.x, 4.0-beta, 5.0-beta
+		OpenBSD 3.3 and up
+		Solaris 8, 9, 9 (x86), 10
+		Ubuntu 7.04, 7.10
+		Windows XP/2003/2008
 
-BIND 9.12.0 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.11 and earlier releases. New features
-include:
+	NOTE:  As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of
+	Windows, including Windows NT and Windows 2000, are no longer
+	supported.
 
-  * named and related libraries have been substantially refactored for
-    improved query performance -- particularly on delegation heavy zones
-    -- and for improved readability, maintainability, and testability.
-  * Code implementing the name server query processing logic has been
-    moved into a new libns library, for easier testing and use in tools
-    other than named.
-  * Cached, validated NSEC and other records can now be used to synthesize
-    NXDOMAIN responses.
-  * The DNS Response Policy Service API (DNSRPS) is now supported.
-  * Setting 'max-journal-size default' now limits the size of journal
-    files to twice the size of the zone.
-  * dnstap-read -x prints a hex dump of the wire format of each logged DNS
-    message.
-  * dnstap output files can now be configured to roll automatically when
-    reaching a given size.
-  * Log file timestamps can now also be formatted in ISO 8601 (local) or
-    ISO 8601 (UTC) formats.
-  * Logging channels and dnstap output files can now be configured to use
-    a timestamp as the suffix when rolling to a new file.
-  * 'named-checkconf -l' lists zones found in named.conf.
-  * Added support for the EDNS Padding and Keepalive options.
-  * 'new-zones-directory' option sets the location where the configuration
-    data for zones added by rndc addzone is stored
+	We have recent reports from the user community that a supported
+	version of BIND will build and run on the following systems:
 
-Building BIND
+		AIX 4.3, 5L
+		CentOS 4, 4.5, 5
+		Darwin 9.0.0d1/ARM
+		Debian 4, 5, 6
+		Fedora Core 5, 7, 8
+		FreeBSD 6, 7, 8
+		HP-UX 11.23 PA
+		MacOS X 10.5, 10.6, 10.7
+		Red Hat Enterprise Linux 4, 5, 6
+		SCO OpenServer 5.0.6
+		Slackware 9, 10
+		SuSE 9, 10
 
-BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
-support, and a 64-bit integer type. Successful builds have been observed
-on many versions of Linux and UNIX, including RedHat, Fedora, Debian,
-Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris,
-HP-UX, AIX, SCO OpenServer, and OpenWRT.
+	To build, just
 
-BIND is also available for Windows XP, 2003, 2008, and higher. See
-win32utils/readme1st.txt for details on building for Windows systems.
+		./configure
+		make
 
-To build on a UNIX or Linux system, use:
+	Do not use a parallel "make".
 
-    $ ./configure
-    $ make
+	Several environment variables that can be set before running
+	configure will affect compilation:
 
-If you're planning on making changes to the BIND 9 source, you should run
-make depend. If you're using Emacs, you might find make tags helpful.
+	    CC
+		The C compiler to use.  configure tries to figure
+		out the right one for supported systems.
 
-Several environment variables that can be set before running configure
-will affect compilation:
+	    CFLAGS
+		C compiler flags.  Defaults to include -g and/or -O2
+		as supported by the compiler.  Please include '-g'
+		if you need to set CFLAGS.
 
-Variable       Description
-CC             The C compiler to use. configure tries to figure out the
-               right one for supported systems.
-               C compiler flags. Defaults to include -g and/or -O2 as
-CFLAGS         supported by the compiler. Please include '-g' if you need
-               to set CFLAGS.
-               System header file directories. Can be used to specify
-STD_CINCLUDES  where add-on thread or IPv6 support is, for example.
-               Defaults to empty string.
-               Any additional preprocessor symbols you want defined.
-STD_CDEFINES   Defaults to empty string. For a list of possible settings,
-               see the file OPTIONS.
-LDFLAGS        Linker flags. Defaults to empty string.
-BUILD_CC       Needed when cross-compiling: the native C compiler to use
-               when building for the target system.
-BUILD_CFLAGS   Optional, used for cross-compiling
-BUILD_CPPFLAGS
-BUILD_LDFLAGS
-BUILD_LIBS
+	    STD_CINCLUDES
+		System header file directories.  Can be used to specify
+		where add-on thread or IPv6 support is, for example.
+		Defaults to empty string.
 
-Compile-time options
+	    STD_CDEFINES
+		Any additional preprocessor symbols you want defined.
+		Defaults to empty string.
 
-To see a full list of configuration options, run configure --help.
+		Possible settings:
+		Change the default syslog facility of named/lwresd.
+		  -DISC_FACILITY=LOG_LOCAL0
+		Enable DNSSEC signature chasing support in dig.
+		  (This feature is deprecated. Use `delv` instead.)
+		  -DDIG_SIGCHASE=1 (sets -DDIG_SIGCHASE_TD=1 and
+				    -DDIG_SIGCHASE_BU=1)
+		Disable dropping queries from particular well known ports.
+		  -DNS_CLIENT_DROPPORT=0
+		Sibling glue checking in named-checkzone is enabled by default.
+		To disable the default check set.  -DCHECK_SIBLING=0
+		named-checkzone checks out-of-zone addresses by default.
+		To disable this default set.  -DCHECK_LOCAL=0
+		To create the default pid files in ${localstatedir}/run rather
+		than ${localstatedir}/run/{named,lwresd}/ set.
+		  -DNS_RUN_PID_DIR=0
+		Enable workaround for Solaris kernel bug about /dev/poll
+		  -DISC_SOCKET_USE_POLLWATCH=1
+		  The watch timeout is also configurable, e.g.,
+		  -DISC_SOCKET_POLLWATCH_TIMEOUT=20
 
-On most platforms, BIND 9 is built with multithreading support, allowing
-it to take advantage of multiple CPUs. You can configure this by
-specifying --enable-threads or --disable-threads on the configure command
-line. The default is to enable threads, except on some older operating
-systems on which threads are known to have had problems in the past.
-(Note: Prior to BIND 9.10, the default was to disable threads on Linux
-systems; this has now been reversed. On Linux systems, the threaded build
-is known to change BIND's behavior with respect to file permissions; it
-may be necessary to specify a user with the -u option when running named.)
+	    LDFLAGS
+		Linker flags. Defaults to empty string.
 
-To build shared libraries, specify --with-libtool on the configure command
-line.
+	The following need to be set when cross compiling.
 
-Certain compiled-in constants and default settings can be increased to
-values better suited to large servers with abundant memory resources (e.g,
-64-bit servers with 12G or more of memory) by specifying --with-tuning=
-large on the configure command line. This can improve performance on big
-servers, but will consume more memory and may degrade performance on
-smaller systems.
+	    BUILD_CC
+		The native C compiler.
+	    BUILD_CFLAGS (optional)
+	    BUILD_CPPFLAGS (optional)
+		Possible Settings:
+		-DNEED_OPTARG=1         (optarg is not declared in <unistd.h>)
+	    BUILD_LDFLAGS (optional)
+	    BUILD_LIBS (optional)
 
-For the server to support DNSSEC, you need to build it with crypto
-support. To use OpenSSL, you should have OpenSSL 1.0.2e or newer
-installed. If the OpenSSL library is installed in a nonstandard location,
-specify the prefix using "--with-openssl=<PREFIX>" on the configure
-command line. To use a PKCS#11 hardware service module for cryptographic
-operations, specify the path to the PKCS#11 provider library using
-"--with-pkcs11=<PREFIX>", and configure BIND with
-"--enable-native-pkcs11".
+	On most platforms, BIND 9 is built with multithreading
+	support, allowing it to take advantage of multiple CPUs.
+	You can configure this by specifying "--enable-threads" or
+	"--disable-threads" on the configure command line.  The default
+	is to enable threads, except on some older operating systems
+	on which threads are known to have had problems in the past.
+	(Note: Prior to BIND 9.10, the default was to disable threads on
+	Linux systems; this has been reversed.  On Linux systems, the
+	threaded build is known to change BIND's behavior with respect
+	to file permissions; it may be necessary to specify a user with
+	the -u option when running named.)
 
-To support the HTTP statistics channel, the server must be linked with at
-least one of the following: libxml2 http://xmlsoft.org or json-c https://
-github.com/json-c. If these are installed at a nonstandard location,
-specify the prefix using --with-libxml2=/prefix or --with-libjson=/prefix.
+	To build shared libraries, specify "--with-libtool" on the
+	configure command line.
 
-To support compression on the HTTP statistics channel, the server must be
-linked against libzlib. If this is installed in a nonstandard location,
-specify the prefix using --with-zlib=/prefix.
+	Certain compiled-in constants and default settings can be
+	increased to values better suited to large servers with abundant
+	memory resources (e.g, 64-bit servers with 12G or more of memory)
+	by specifying "--with-tuning=large" on the configure command
+	line. This can improve performance on big servers, but will
+	consume more memory and may degrade performance on smaller
+	systems.
 
-To support storing configuration data for runtime-added zones in an LMDB
-database, the server must be linked with liblmdb. If this is installed in
-a nonstandard location, specify the prefix using "with-lmdb=/prefix".
+	For the server to support DNSSEC, you need to build it
+	with crypto support.  You must have OpenSSL 1.0.1t
+	or newer installed and specify "--with-openssl" on the
+	configure command line.  If OpenSSL is installed under
+	a nonstandard prefix, you can tell configure where to
+	look for it using "--with-openssl=/prefix".
 
-To support GeoIP location-based ACLs, the server must be linked with
-libGeoIP. This is not turned on by default; BIND must be configured with
-"--with-geoip". If the library is installed in a nonstandard location, use
-specify the prefix using "--with-geoip=/prefix".
+	To support the HTTP statistics channel, the server must
+	be linked with at least one of the following: libxml2
+	(http://xmlsoft.org) or json-c (https://github.com/json-c).
+	If these are installed at a nonstandard prefix, use
+	"--with-libxml2=/prefix" or "--with-libjson=/prefix".
 
-For DNSTAP packet logging, you must have installed libfstrm https://
-github.com/farsightsec/fstrm and libprotobuf-c https://
-developers.google.com/protocol-buffers, and BIND must be configured with
-"--enable-dnstap".
+	To support compression on the HTTP statistics channel, the
+	server must be linked against libzlib (--with-zlib=/prefix).
 
-Portions of BIND that are written in Python, including dnssec-keymgr,
-dnssec-coverage, dnssec-checkds, and some of the system tests, require the
-'argparse' and 'ply' modules to be available. 'argparse' is a standard
-module as of Python 2.7 and Python 3.2. 'ply' is available from https://
-pypi.python.org/pypi/ply.
+	Python requires 'argparse' and 'ply' to be available.
+	'argparse' is a standard module as of Python 2.7 and Python 3.2.
 
-On some platforms it is necessary to explicitly request large file support
-to handle files bigger than 2GB. This can be done by using
---enable-largefile on the configure command line.
+	On some platforms it is necessary to explicitly request large
+	file support to handle files bigger than 2GB.  This can be
+	done by "--enable-largefile" on the configure command line.
 
-Support for the "fixed" rrset-order option can be enabled or disabled by
-specifying --enable-fixed-rrset or --disable-fixed-rrset on the configure
-command line. By default, fixed rrset-order is disabled to reduce memory
-footprint.
+	Support for the "fixed" rrset-order option can be enabled
+	or disabled by specifying "--enable-fixed-rrset" or
+	"--disable-fixed-rrset" on the configure command line.
+	The default is "disabled", to reduce memory footprint.
 
-If your operating system has integrated support for IPv6, it will be used
-automatically. If you have installed KAME IPv6 separately, use --with-kame
-[=PATH] to specify its location.
+	If your operating system has integrated support for IPv6, it
+	will be used automatically.  If you have installed KAME IPv6
+	separately, use "--with-kame[=PATH]" to specify its location.
 
-make install will install named and the various BIND 9 libraries. By
-default, installation is into /usr/local, but this can be changed with the
---prefix option when running configure.
+	"make install" will install "named" and the various BIND 9 libraries.
+	By default, installation is into /usr/local, but this can be changed
+	with the "--prefix" option when running "configure".
 
-You may specify the option --sysconfdir to set the directory where
-configuration files like named.conf go by default, and --localstatedir to
-set the default parent directory of run/named.pid. For backwards
-compatibility with BIND 8, --sysconfdir defaults to /etc and
---localstatedir defaults to /var if no --prefix option is given. If there
-is a --prefix option, sysconfdir defaults to $prefix/etc and localstatedir
-defaults to $prefix/var.
+	You may specify the option "--sysconfdir" to set the directory
+	where configuration files like "named.conf" go by default,
+	and "--localstatedir" to set the default parent directory
+	of "run/named.pid".   For backwards compatibility with BIND 8,
+	--sysconfdir defaults to "/etc" and --localstatedir defaults to
+	"/var" if no --prefix option is given.  If there is a --prefix
+	option, sysconfdir defaults to "$prefix/etc" and localstatedir
+	defaults to "$prefix/var".
 
-Automated testing
+	To see additional configure options, run "configure --help".
+	Note that the help message does not reflect the BIND 8
+	compatibility defaults for sysconfdir and localstatedir.
 
-A system test suite can be run with make test. The system tests require
-you to configure a set of virtual IP addresses on your system (this allows
-multiple servers to run locally and communicate with one another). These
-IP addresses can be configured by running the command bin/tests/system/
-ifconfig.sh up as root.
+	If you're planning on making changes to the BIND 9 source, you
+	should also "make depend".  If you're using Emacs, you might find
+	"make tags" helpful.
 
-Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
-and will be skipped if these are not available. Some tests require Python
-and the 'dnspython' module and will be skipped if these are not available.
-See bin/tests/system/README for further details.
+	If you need to re-run configure please run "make distclean" first.
+	This will ensure that all the option changes take.
 
-Unit tests are implemented using Automated Testing Framework (ATF). To run
-them, use configure --with-atf, then run make test or make unit.
+	Building with gcc is not supported, unless gcc is the vendor's usual
+	compiler (e.g. the various BSD systems, Linux).
+
+	Known compiler issues:
+	* gcc-3.2.1 and gcc-3.1.1 is known to cause problems with solaris-x86.
+	* gcc prior to gcc-3.2.3 ultrasparc generates incorrect code at -02.
+	* gcc-3.3.5 powerpc generates incorrect code at -02.
+	* Irix, MipsPRO 7.4.1m is known to cause problems.
+
+	A limited test suite can be run with "make test".  Many of
+	the tests require you to configure a set of virtual IP addresses
+	on your system, and some require Perl; see bin/tests/system/README
+	for details.
+
+	SunOS 4 requires "printf" to be installed to make the shared
+	libraries.  sh-utils-1.16 provides a "printf" which compiles
+	on SunOS 4.
+
+Known limitations
+
+	Linux requires kernel build 2.6.39 or later to get the
+	performance benefits from using multiple sockets.
 
 Documentation
 
-The BIND 9 Administrator Reference Manual is included with the source
-distribution, in DocBook XML, HTML and PDF format, in the doc/arm
-directory.
+	The BIND 9 Administrator Reference Manual is included with the
+	source distribution in DocBook XML and HTML format, in the
+	doc/arm directory.
 
-Some of the programs in the BIND 9 distribution have man pages in their
-directories. In particular, the command line options of named are
-documented in bin/named/named.8.
+	Some of the programs in the BIND 9 distribution have man pages
+	in their directories.  In particular, the command line
+	options of "named" are documented in /bin/named/named.8.
+	There is now also a set of man pages for the lwres library.
 
-Frequently (and not-so-frequently) asked questions and their answers can
-be found in the ISC Knowledge Base at https://kb.isc.org.
+	If you are upgrading from BIND 8, please read the migration
+	notes in doc/misc/migration.  If you are upgrading from
+	BIND 4, read doc/misc/migration-4to9.
 
-Additional information on various subjects can be found in other README
-files throughout the source tree.
+	Frequently asked questions and their answers can be found in
+	FAQ.
 
-Change log
+	Additional information on various subjects can be found
+	in the other README files.
 
-A detailed list of all changes that have been made throughout the
-development BIND 9 is included in the file CHANGES, with the most recent
-changes listed first. Change notes include tags indicating the category of
-the change that was made; these categories are:
 
-Category       Description
-[func]         New feature
-[bug]          General bug fix
-[security]     Fix for a significant security flaw
-[experimental] Used for new features when the syntax or other aspects of
-               the design are still in flux and may change
-[port]         Portability enhancement
-[maint]        Updates to built-in data such as root server addresses and
-               keys
-[tuning]       Changes to built-in configuration defaults and constants to
-               improve performance
-[performance]  Other changes to improve server performance
-[protocol]     Updates to the DNS protocol such as new RR types
-[test]         Changes to the automatic tests, not affecting server
-               functionality
-[cleanup]      Minor corrections and refactoring
-[doc]          Documentation
-[contrib]      Changes to the contributed tools and libraries in the
-               'contrib' subdirectory
-               Used in the master development branch to reserve change
-[placeholder]  numbers for use in other branches, e.g. when fixing a bug
-               that only exists in older releases
+Change Log
+
+	A detailed list of all changes to BIND 9 is included in the
+	file CHANGES, with the most recent changes listed first.
+	Change notes include tags indicating the category of the
+	change that was made; these categories are:
+
+	   [func]         New feature
+
+	   [bug]          General bug fix
+
+	   [security]     Fix for a significant security flaw
+
+	   [experimental] Used for new features when the syntax
+			  or other aspects of the design are still
+			  in flux and may change
+
+	   [port]         Portability enhancement
+
+	   [maint]        Updates to built-in data such as root
+			  server addresses and keys
+
+	   [tuning]       Changes to built-in configuration defaults
+			  and constants to improve performance
+
+	   [performance]  Other changes to improve server performance
+
+	   [protocol]     Updates to the DNS protocol such as new
+			  RR types
+
+	   [test]         Changes to the automatic tests, not
+			  affecting server functionality
+
+	   [cleanup]      Minor corrections and refactoring
+
+	   [doc]          Documentation
+
+	   [contrib]	  Changes to the contributed tools and
+			  libraries in the 'contrib' subdirectory
+
+	   [placeholder]  Used in the master development branch to
+			  reserve change numbers for use in other
+			  branches, e.g. when fixing a bug that only
+			  exists in older releases
+
+	In general, [func] and [experimental] tags will only appear
+	in new-feature releases (i.e., those with version numbers
+	ending in zero).  Some new functionality may be backported to
+	older releases on a case-by-case basis.  All other change
+	types may be applied to all currently-supported releases.
+
+
+Bug Reports and Mailing Lists
+
+	Bug reports should be sent to:
+
+		bind9-bugs@isc.org
+
+	Feature requests can be sent to:
+
+		bind-suggest@isc.org
+
+	To join or view the archives of the BIND Users mailing list,
+	visit:
+
+		https://lists.isc.org/mailman/listinfo/bind-users
+
+	If you're planning on making changes to the BIND 9 source
+	code, you may also want to join the BIND Workers mailing
+	list:
+
+		https://lists.isc.org/mailman/listinfo/bind-workers
+
+	Information on read-only Git access, coding style and developer
+	guidelines can be found at:
+
+		http://www.isc.org/git/
 
-In general, [func] and [experimental] tags will only appear in new-feature
-releases (i.e., those with version numbers ending in zero). Some new
-functionality may be backported to older releases on a case-by-case basis.
-All other change types may be applied to all currently-supported releases.
 
 Acknowledgments
 
-  * The original development of BIND 9 was underwritten by the following
-    organizations:
-
-    Sun Microsystems, Inc.
-    Hewlett Packard
-    Compaq Computer Corporation
-    IBM
-    Process Software Corporation
-    Silicon Graphics, Inc.
-    Network Associates, Inc.
-    U.S. Defense Information Systems Agency
-    USENIX Association
-    Stichting NLnet - NLnet Foundation
-    Nominum, Inc.
-
-  * This product includes software developed by the OpenSSL Project for
-    use in the OpenSSL Toolkit. http://www.OpenSSL.org/
-  * This product includes cryptographic software written by Eric Young
-    (eay@cryptsoft.com)
-  * This product includes software written by Tim Hudson
-    (tjh@cryptsoft.com)
-
+	- This product includes software developed by the OpenSSL Project
+	  for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/).
+	- This product includes cryptographic software written by Eric
+	  Young (eay@cryptsoft.com).
+	- This product includes software written by Tim Hudson
+	  (tjh@cryptsoft.com).

README.md

@@ -1,343 +0,0 @@
-<!--
- - Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-# BIND 9
-
-### Contents
-
-1. [Introduction](#intro)
-1. [Reporting bugs and getting help](#help)
-1. [Contributing to BIND](#contrib)
-1. [BIND 9.12 features](#features)
-1. [Building BIND](#build)
-1. [Compile-time options](#opts)
-1. [Automated testing](#testing)
-1. [Documentation](#doc)
-1. [Change log](#changes)
-1. [Acknowledgments](#ack)
-
-### <a name="intro"/> Introduction
-
-BIND (Berkeley Internet Name Domain) is a complete, highly portable
-implementation of the DNS (Domain Name System) protocol.
-
-The BIND name server, `named`, is able to serve as an authoritative name
-server, recursive resolver, DNS forwarder, or all three simultaneously.  It
-implements views for split-horizon DNS, automatic DNSSEC zone signing and
-key management, catalog zones to facilitate provisioning of zone data
-throughout a name server constellation, response policy zones (RPZ) to
-protect clients from malicious data, response rate limiting (RRL) and
-recursive query limits to reduce distributed denial of service attacks,
-and many other advanced DNS features.  BIND also includes a suite of
-administrative tools, including the `dig` and `delv` DNS lookup tools,
-`nsupdate` for dynamic DNS zone updates, `rndc` for remote name server
-administration, and more.
-
-BIND 9 is a complete re-write of the BIND architecture that was used in
-versions 4 and 8.  Internet Systems Consortium
-([https://www.isc.org](https://www.isc.org)), a 501(c)(3) public benefit
-corporation dedicated to providing software and services in support of the
-Internet infrastructure, developed BIND 9 and is responsible for its
-ongoing maintenance and improvement.  BIND is open source software
-licenced under the terms of the Mozilla Public License, version 2.0.
-
-For a summary of features introduced in past major releases of BIND,
-see the file [HISTORY](HISTORY.md).
-
-For a detailed list of changes made throughout the history of BIND 9, see
-the file [CHANGES](CHANGES). See [below](#changes) for details on the
-CHANGES file format.
-
-For up-to-date release notes and errata, see
-[http://www.isc.org/software/bind9/releasenotes](http://www.isc.org/software/bind9/releasenotes)
-
-### <a name="help"/> Reporting bugs and getting help
-
-Please report assertion failure errors and suspected security issues to
-[security-officer@isc.org](mailto:security-officer@isc.org).
-
-General bug reports can be sent to
-[bind9-bugs@isc.org](mailto:bind9-bugs@isc.org).
-
-Feature requests can be sent to
-[bind-suggest@isc.org](mailto:bind-suggest@isc.org).
-
-Please note that, while tickets submitted to ISC's ticketing system
-are not initially publicly readable by default, they can be made publicly
-acessible afterward.  Please do not include information in bug reports that
-you consider to be confidential. In particular, when sending the contents of
-your configuration file, it is advisable to obscure key secrets: this can
-be done automatically by using `named-checkconf -px`.
-
-Professional support and training for BIND are available from
-ISC at [https://www.isc.org/support](https://www.isc.org/support).
-
-To join the __BIND Users__ mailing list, or view the archives, visit
-[https://lists.isc.org/mailman/listinfo/bind-users](https://lists.isc.org/mailman/listinfo/bind-users).
-
-If you're planning on making changes to the BIND 9 source code, you
-may also want to join the __BIND Workers__ mailing list, at
-[https://lists.isc.org/mailman/listinfo/bind-workers](https://lists.isc.org/mailman/listinfo/bind-workers).
-
-### <a name="contrib"/> Contributing to BIND
-
-ISC maintains a public git repository for BIND; details can be found
-at [http://www.isc.org/git/](http://www.isc.org/git/), and also on Github
-at [https://github.com/isc-projects](https://github.com/isc-projects).
-
-Information for BIND contributors can be found in the following files:
-- General information: [doc/dev/contrib.md](doc/dev/contrib.md)
-- BIND 9 code style: [doc/dev/style.md](doc/dev/style.md)
-- BIND architecture and developer guide: [doc/dev/dev.md](doc/dev/dev.md)
-
-Patches for BIND may be submitted either as Github pull requests
-or via email.  When submitting a patch via email, please prepend the
-subject header with "`[PATCH]`" so it will be easier for us to find. 
-If your patch introduces a new feature in BIND, please submit it to
-[bind-suggest@isc.org](mailto:bind-suggest@isc.org); if it fixes a bug,
-please submit it to [bind9-bugs@isc.org](mailto:bind9-bugs@isc.org).
-
-### <a name="features"/> BIND 9.12 features
-
-BIND 9.12.0 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.11 and earlier releases.  New features
-include:
-
-* `named` and related libraries have been substantially refactored for
-  improved query performance -- particularly on delegation heavy zones -- 
-  and for improved readability, maintainability, and testability.
-* Code implementing the name server query processing logic has been moved
-  into a new `libns` library, for easier testing and use in tools other
-  than `named`.
-* Cached, validated NSEC and other records can now be used to synthesize
-  NXDOMAIN responses.
-* The DNS Response Policy Service API (DNSRPS) is now supported.
-* Setting `'max-journal-size default'` now limits the size of journal files
-  to twice the size of the zone.
-* `dnstap-read -x` prints a hex dump of the wire format of each logged
-  DNS message.
-* `dnstap` output files can now be configured to roll automatically when
-  reaching a given size.
-* Log file timestamps can now also be formatted in ISO 8601 (local) or ISO
-  8601 (UTC) formats.
-* Logging channels and `dnstap` output files can now be configured to use a
-  timestamp as the suffix when rolling to a new file.
-* `'named-checkconf -l'` lists zones found in `named.conf`.
-* Added support for the EDNS Padding and Keepalive options.
-* 'new-zones-directory' option sets the location where the configuration
-  data for zones added by rndc addzone is stored
-
-### <a name="build"/> Building BIND
-
-BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
-support, and a 64-bit integer type. Successful builds have been observed on
-many versions of Linux and UNIX, including RedHat, Fedora, Debian, Ubuntu,
-SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris, HP-UX, AIX,
-SCO OpenServer, and OpenWRT. 
-
-BIND is also available for Windows XP, 2003, 2008, and higher.  See
-`win32utils/readme1st.txt` for details on building for Windows systems.
-
-To build on a UNIX or Linux system, use:
-
-		$ ./configure
-		$ make
-
-If you're planning on making changes to the BIND 9 source, you should run
-`make depend`.  If you're using Emacs, you might find `make tags` helpful.
-
-Several environment variables that can be set before running `configure` will
-affect compilation:
-
-|Variable|Description |
-|--------------------|-----------------------------------------------|
-|`CC`|The C compiler to use.  `configure` tries to figure out the right one for supported systems.|
-|`CFLAGS`|C compiler flags.  Defaults to include -g and/or -O2 as supported by the compiler.  Please include '-g' if you need to set `CFLAGS`. |
-|`STD_CINCLUDES`|System header file directories.  Can be used to specify where add-on thread or IPv6 support is, for example.  Defaults to empty string.|
-|`STD_CDEFINES`|Any additional preprocessor symbols you want defined.  Defaults to empty string. For a list of possible settings, see the file [OPTIONS](OPTIONS.md).|
-|`LDFLAGS`|Linker flags. Defaults to empty string.|
-|`BUILD_CC`|Needed when cross-compiling: the native C compiler to use when building for the target system.|
-|`BUILD_CFLAGS`|Optional, used for cross-compiling|
-|`BUILD_CPPFLAGS`||
-|`BUILD_LDFLAGS`||
-|`BUILD_LIBS`||
-
-#### <a name="opts"/> Compile-time options
-
-To see a full list of configuration options, run `configure --help`.
-
-On most platforms, BIND 9 is built with multithreading support, allowing it
-to take advantage of multiple CPUs.  You can configure this by specifying
-`--enable-threads` or `--disable-threads` on the `configure` command line.
-The default is to enable threads, except on some older operating systems on
-which threads are known to have had problems in the past.  (Note: Prior to
-BIND 9.10, the default was to disable threads on Linux systems; this has
-now been reversed.  On Linux systems, the threaded build is known to change
-BIND's behavior with respect to file permissions; it may be necessary to
-specify a user with the -u option when running `named`.)
-
-To build shared libraries, specify `--with-libtool` on the `configure`
-command line.
-
-Certain compiled-in constants and default settings can be increased to
-values better suited to large servers with abundant memory resources (e.g,
-64-bit servers with 12G or more of memory) by specifying
-`--with-tuning=large` on the `configure` command line. This can improve
-performance on big servers, but will consume more memory and may degrade
-performance on smaller systems.
-
-For the server to support DNSSEC, you need to build it with crypto support.
-To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed.  If the
-OpenSSL library is installed in a nonstandard location, specify the prefix
-using "--with-openssl=&lt;PREFIX&gt;" on the configure command line. To use a
-PKCS#11 hardware service module for cryptographic operations, specify the
-path to the PKCS#11 provider library using "--with-pkcs11=&lt;PREFIX&gt;", and
-configure BIND with "--enable-native-pkcs11".
-
-To support the HTTP statistics channel, the server must be linked with at
-least one of the following: libxml2
-[http://xmlsoft.org](http://xmlsoft.org) or json-c
-[https://github.com/json-c](https://github.com/json-c).  If these are
-installed at a nonstandard location, specify the prefix using
-`--with-libxml2=/prefix` or `--with-libjson=/prefix`.
-
-To support compression on the HTTP statistics channel, the server must be
-linked against libzlib.  If this is installed in a nonstandard location,
-specify the prefix using `--with-zlib=/prefix`.
-
-To support storing configuration data for runtime-added zones in an LMDB
-database, the server must be linked with liblmdb. If this is installed in a
-nonstandard location, specify the prefix using "with-lmdb=/prefix".
-
-To support GeoIP location-based ACLs, the server must be linked with
-libGeoIP. This is not turned on by default; BIND must be configured with
-"--with-geoip". If the library is installed in a nonstandard location, use
-specify the prefix using "--with-geoip=/prefix".
-
-For DNSTAP packet logging, you must have installed libfstrm
-[https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
-and libprotobuf-c
-[https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
-and BIND must be configured with "--enable-dnstap".
-
-Portions of BIND that are written in Python, including
-`dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
-system tests, require the 'argparse' and 'ply' modules to be available.
-'argparse' is a standard module as of Python 2.7 and Python 3.2.
-'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
-
-On some platforms it is necessary to explicitly request large file support
-to handle files bigger than 2GB.  This can be done by using
-`--enable-largefile` on the `configure` command line.
-
-Support for the "fixed" rrset-order option can be enabled or disabled by
-specifying `--enable-fixed-rrset` or `--disable-fixed-rrset` on the
-configure command line.  By default, fixed rrset-order is disabled to
-reduce memory footprint.
-
-If your operating system has integrated support for IPv6, it will be used
-automatically.  If you have installed KAME IPv6 separately, use
-`--with-kame[=PATH]` to specify its location.
-
-`make install` will install `named` and the various BIND 9 libraries.  By
-default, installation is into /usr/local, but this can be changed with the
-`--prefix` option when running `configure`.
-
-You may specify the option `--sysconfdir` to set the directory where
-configuration files like `named.conf` go by default, and `--localstatedir`
-to set the default parent directory of `run/named.pid`.   For backwards
-compatibility with BIND 8, `--sysconfdir` defaults to `/etc` and
-`--localstatedir` defaults to `/var` if no `--prefix` option is given.  If
-there is a `--prefix` option, sysconfdir defaults to `$prefix/etc` and
-localstatedir defaults to `$prefix/var`.
-
-### <a name="testing"/> Automated testing
-
-A system test suite can be run with `make test`.  The system tests require
-you to configure a set of virtual IP addresses on your system (this allows
-multiple servers to run locally and communicate with one another).  These
-IP addresses can be configured by running the command
-`bin/tests/system/ifconfig.sh up` as root.
-
-Some tests require Perl and the Net::DNS and/or IO::Socket::INET6 modules,
-and will be skipped if these are not available. Some tests require Python
-and the 'dnspython' module and will be skipped if these are not available.
-See bin/tests/system/README for further details.
-
-Unit tests are implemented using Automated Testing Framework (ATF).
-To run them, use `configure --with-atf`, then run `make test` or
-`make unit`.
-
-### <a name="doc"/> Documentation
-
-The *BIND 9 Administrator Reference Manual* is included with the source
-distribution, in DocBook XML, HTML and PDF format, in the `doc/arm`
-directory.
-
-Some of the programs in the BIND 9 distribution have man pages in their
-directories.  In particular, the command line options of `named` are
-documented in `bin/named/named.8`.
-
-Frequently (and not-so-frequently) asked questions and their answers
-can be found in the ISC Knowledge Base at
-[https://kb.isc.org](https://kb.isc.org).
-
-Additional information on various subjects can be found in other
-`README` files throughout the source tree.
-
-### <a name="changes"/> Change log
-
-A detailed list of all changes that have been made throughout the
-development BIND 9 is included in the file CHANGES, with the most recent
-changes listed first.  Change notes include tags indicating the category of
-the change that was made; these categories are:
-
-|Category	|Description	        			|
-|--------------	|-----------------------------------------------|
-| [func] | New feature |
-| [bug] | General bug fix |
-| [security] | Fix for a significant security flaw |
-| [experimental] | Used for new features when the syntax or other aspects of the design are still in flux and may change |
-| [port] | Portability enhancement |
-| [maint] | Updates to built-in data such as root server addresses and keys |
-| [tuning] | Changes to built-in configuration defaults and constants to improve performance |
-| [performance] | Other changes to improve server performance |
-| [protocol] | Updates to the DNS protocol such as new RR types |
-| [test] | Changes to the automatic tests, not affecting server functionality |
-| [cleanup] | Minor corrections and refactoring |
-| [doc] | Documentation |
-| [contrib] | Changes to the contributed tools and libraries in the 'contrib' subdirectory |
-| [placeholder] | Used in the master development branch to reserve change numbers for use in other branches, e.g. when fixing a bug that only exists in older releases |
-
-In general, [func] and [experimental] tags will only appear in new-feature
-releases (i.e., those with version numbers ending in zero).  Some new
-functionality may be backported to older releases on a case-by-case basis.
-All other change types may be applied to all currently-supported releases.
-
-### <a name="ack"/> Acknowledgments
-
-* The original development of BIND 9 was underwritten by the
-  following organizations:
-
-		Sun Microsystems, Inc.
-		Hewlett Packard
-		Compaq Computer Corporation
-		IBM
-		Process Software Corporation
-		Silicon Graphics, Inc.
-		Network Associates, Inc.
-		U.S. Defense Information Systems Agency
-		USENIX Association
-		Stichting NLnet - NLnet Foundation
-		Nominum, Inc.
-
-* This product includes software developed by the OpenSSL Project for use
-  in the OpenSSL Toolkit.
-  [http://www.OpenSSL.org/](http://www.OpenSSL.org/)
-* This product includes cryptographic software written by Eric Young
-  (eay@cryptsoft.com)
-* This product includes software written by Tim Hudson (tjh@cryptsoft.com)

bin/check/Makefile.in

@@ -1,9 +1,11 @@
-# Copyright (C) 2000-2007, 2009, 2012, 2014-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2000-2007, 2009, 2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+# $Id: Makefile.in,v 1.36 2009/12/05 23:31:40 each Exp $
+
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -12,7 +14,7 @@ VERSION=@BIND9_VERSION@
 
 @BIND9_MAKE_INCLUDES@
 
-CINCLUDES =	${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
+CINCLUDES =	${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
 		${ISC_INCLUDES} @DST_OPENSSL_INC@
 
 CDEFINES = 	@CRYPTO@ -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
@@ -20,16 +22,14 @@ CWARNINGS =
 
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
-NSLIBS =	../../lib/ns/libns.@A@
 
 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
-NSDEPENDLIBS =	../../lib/ns/libns.@A@
 
 LIBS =		${ISCLIBS} @LIBS@
 NOSYMLIBS =	${ISCNOSYMLIBS} @LIBS@
@@ -61,15 +61,14 @@ named-checkzone.@O@: named-checkzone.c
 		-c ${srcdir}/named-checkzone.c
 
 named-checkconf@EXEEXT@: named-checkconf.@O@ check-tool.@O@ ${ISCDEPLIBS} \
-		${NSDEPENDLIBS} ${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${BIND9DEPLIBS}
+		${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${BIND9DEPLIBS}
 	export BASEOBJS="named-checkconf.@O@ check-tool.@O@"; \
-	export LIBS0="${NSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
+	export LIBS0="${BIND9LIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
 	${FINALBUILDCMD}
 
-named-checkzone@EXEEXT@: named-checkzone.@O@ check-tool.@O@ ${ISCDEPLIBS} \
-		${NSDEPENDLIBS} ${DNSDEPLIBS}
+named-checkzone@EXEEXT@: named-checkzone.@O@ check-tool.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	export BASEOBJS="named-checkzone.@O@ check-tool.@O@"; \
-	export LIBS0="${NSLIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
+	export LIBS0="${ISCCFGLIBS} ${DNSLIBS}"; \
 	${FINALBUILDCMD}
 
 doc man:: ${MANOBJS}

bin/check/check-tool.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2002, 2004-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2000-2002, 2004-2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -48,8 +48,6 @@
 
 #include <isccfg/log.h>
 
-#include <ns/log.h>
-
 #ifndef CHECK_SIBLING
 #define CHECK_SIBLING 1
 #endif
@@ -114,7 +112,13 @@ unsigned int zone_options2 = 0;
  */
 static isc_logcategory_t categories[] = {
 	{ "",		     0 },
+	{ "client",	     0 },
+	{ "network",	     0 },
+	{ "update",	     0 },
+	{ "queries",	     0 },
 	{ "unmatched", 	     0 },
+	{ "update-security", 0 },
+	{ "query-errors",    0 },
 	{ NULL,		     0 }
 };
 
@@ -171,7 +175,7 @@ logged(char *key, int value) {
 }
 
 static isc_boolean_t
-checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
+checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa)
 {
 #ifdef USE_GETADDRINFO
@@ -205,9 +209,8 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	/*
 	 * Turn off search.
 	 */
-	if (dns_name_countlabels(name) > 1U) {
-		strlcat(namebuf, ".", sizeof(namebuf));
-	}
+	if (dns_name_countlabels(name) > 1U)
+		strcat(namebuf, ".");
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
 
 	result = getaddrinfo(namebuf, NULL, &hints, &ai);
@@ -376,7 +379,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 }
 
 static isc_boolean_t
-checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
+checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 #ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
@@ -395,9 +398,8 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	/*
 	 * Turn off search.
 	 */
-	if (dns_name_countlabels(name) > 1U) {
-		strlcat(namebuf, ".", sizeof(namebuf));
-	}
+	if (dns_name_countlabels(name) > 1U)
+		strcat(namebuf, ".");
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
 
 	result = getaddrinfo(namebuf, NULL, &hints, &ai);
@@ -462,7 +464,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 }
 
 static isc_boolean_t
-checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
+checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 #ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
@@ -481,9 +483,8 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	/*
 	 * Turn off search.
 	 */
-	if (dns_name_countlabels(name) > 1U) {
-		strlcat(namebuf, ".", sizeof(namebuf));
-	}
+	if (dns_name_countlabels(name) > 1U)
+		strcat(namebuf, ".");
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
 
 	result = getaddrinfo(namebuf, NULL, &hints, &ai);
@@ -558,7 +559,6 @@ setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
 	dns_log_init(log);
 	dns_log_setcontext(log);
 	cfg_log_init(log);
-	ns_log_init(log);
 
 	destination.file.stream = errout;
 	destination.file.name = NULL;

bin/check/named-checkconf.8

@@ -39,7 +39,7 @@
 named-checkconf \- named configuration file syntax checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBnamed\-checkconf\fR\ 'u
-\fBnamed\-checkconf\fR [\fB\-hjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
+\fBnamed\-checkconf\fR [\fB\-hjvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
 .SH "DESCRIPTION"
 .PP
 \fBnamed\-checkconf\fR
@@ -74,11 +74,6 @@ Print the usage summary and exit\&.
 When loading a zonefile read the journal if it exists\&.
 .RE
 .PP
-\-l
-.RS 4
-List all the configured zones\&. Each line of output contains the zone name, class (e\&.g\&. IN), view, and type (e\&.g\&. master or slave)\&.
-.RE
-.PP
 \-p
 .RS 4
 Print out the

bin/check/named-checkconf.c

@@ -59,7 +59,7 @@ usage(void) ISC_PLATFORM_NORETURN_POST;
 
 static void
 usage(void) {
-	fprintf(stderr, "usage: %s [-hjlvz] [-p [-x]] [-t directory] "
+	fprintf(stderr, "usage: %s [-hjvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n", program);
 	exit(1);
 }
@@ -162,7 +162,7 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 static isc_result_t
 configure_zone(const char *vclass, const char *view,
 	       const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
-	       const cfg_obj_t *config, isc_mem_t *mctx, isc_boolean_t list)
+	       const cfg_obj_t *config, isc_mem_t *mctx)
 {
 	int i = 0;
 	isc_result_t result;
@@ -204,10 +204,6 @@ configure_zone(const char *vclass, const char *view,
 	maps[i] = NULL;
 
 	cfg_map_get(zoptions, "in-view", &inviewobj);
-	if (inviewobj != NULL && list) {
-		const char *inview = cfg_obj_asstring(inviewobj);
-		printf("%s %s %s in-view %s\n", zname, zclass, view, inview);
-	}
 	if (inviewobj != NULL)
 		return (ISC_R_SUCCESS);
 
@@ -215,12 +211,6 @@ configure_zone(const char *vclass, const char *view,
 	if (typeobj == NULL)
 		return (ISC_R_FAILURE);
 
-	if (list) {
-		const char *ztype = cfg_obj_asstring(typeobj);
-		printf("%s %s %s %s\n", zname, zclass, view, ztype);
-		return (ISC_R_SUCCESS);
-	}
-
 	/*
 	 * Skip checks when using an alternate data source.
 	 */
@@ -411,7 +401,7 @@ configure_zone(const char *vclass, const char *view,
 /*% configure a view */
 static isc_result_t
 configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
-	       const cfg_obj_t *vconfig, isc_mem_t *mctx, isc_boolean_t list)
+	       const cfg_obj_t *vconfig, isc_mem_t *mctx)
 {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *voptions;
@@ -435,7 +425,7 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
 	{
 		const cfg_obj_t *zconfig = cfg_listelt_value(element);
 		tresult = configure_zone(vclass, view, zconfig, vconfig,
-					 config, mctx, list);
+					 config, mctx);
 		if (tresult != ISC_R_SUCCESS)
 			result = tresult;
 	}
@@ -459,9 +449,7 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 
 /*% load zones from the configuration */
 static isc_result_t
-load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx,
-		      isc_boolean_t list_zones)
-{
+load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx) {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *views;
 	const cfg_obj_t *vconfig;
@@ -492,15 +480,13 @@ load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx,
 
 		dns_rdataclass_format(viewclass, buf, sizeof(buf));
 		vname = cfg_obj_asstring(cfg_tuple_get(vconfig, "name"));
-		tresult = configure_view(buf, vname, config, vconfig, mctx,
-					 list_zones);
+		tresult = configure_view(buf, vname, config, vconfig, mctx);
 		if (tresult != ISC_R_SUCCESS)
 			result = tresult;
 	}
 
 	if (views == NULL) {
-		tresult = configure_view("IN", "_default", config, NULL, mctx,
-					 list_zones);
+		tresult = configure_view("IN", "_default", config, NULL, mctx);
 		if (tresult != ISC_R_SUCCESS)
 			result = tresult;
 	}
@@ -530,7 +516,6 @@ main(int argc, char **argv) {
 	int exit_status = 0;
 	isc_entropy_t *ectx = NULL;
 	isc_boolean_t load_zones = ISC_FALSE;
-	isc_boolean_t list_zones = ISC_FALSE;
 	isc_boolean_t print = ISC_FALSE;
 	unsigned int flags = 0;
 
@@ -539,7 +524,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "dhjlm:t:pvxz"
+#define CMDLINE_FLAGS "dhjm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -572,10 +557,6 @@ main(int argc, char **argv) {
 			nomerge = ISC_FALSE;
 			break;
 
-		case 'l':
-			list_zones = ISC_TRUE;
-			break;
-
 		case 'm':
 			break;
 
@@ -626,10 +607,6 @@ main(int argc, char **argv) {
 		fprintf(stderr, "%s: -x cannot be used without -p\n", program);
 		exit(1);
 	}
-	if (print && list_zones) {
-		fprintf(stderr, "%s: -l cannot be used with -p\n", program);
-		exit(1);
-	}
 
 	if (isc_commandline_index + 1 < argc)
 		usage();
@@ -662,8 +639,8 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		exit_status = 1;
 
-	if (result == ISC_R_SUCCESS && (load_zones || list_zones)) {
-		result = load_zones_fromconfig(config, mctx, list_zones);
+	if (result == ISC_R_SUCCESS && load_zones) {
+		result = load_zones_fromconfig(config, mctx);
 		if (result != ISC_R_SUCCESS)
 			exit_status = 1;
 	}

bin/check/named-checkconf.docbook

@@ -48,7 +48,7 @@
   <refsynopsisdiv>
     <cmdsynopsis sepchar=" ">
       <command>named-checkconf</command>
-      <arg choice="opt" rep="norepeat"><option>-hjlvz</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-hjvz</option></arg>
       <arg choice="opt" rep="norepeat"><option>-p</option>
 	<arg choice="opt" rep="norepeat"><option>-x</option>
       </arg></arg>
@@ -99,17 +99,6 @@
         </listitem>
       </varlistentry>
 
-      <varlistentry>
-        <term>-l</term>
-        <listitem>
-          <para>
-            List all the configured zones. Each line of output
-            contains the zone name, class (e.g. IN), view, and type
-            (e.g. master or slave).
-          </para>
-        </listitem>
-      </varlistentry>
-
       <varlistentry>
         <term>-p</term>
         <listitem>

bin/check/named-checkconf.html

@@ -33,7 +33,7 @@
 <h2>Synopsis</h2>
     <div class="cmdsynopsis"><p>
       <code class="command">named-checkconf</code> 
-       [<code class="option">-hjlvz</code>]
+       [<code class="option">-hjvz</code>]
        [<code class="option">-p</code>
 	 [<code class="option">-x</code>
       ]]
@@ -80,14 +80,6 @@
             When loading a zonefile read the journal if it exists.
           </p>
         </dd>
-<dt><span class="term">-l</span></dt>
-<dd>
-          <p>
-            List all the configured zones. Each line of output
-            contains the zone name, class (e.g. IN), view, and type
-            (e.g. master or slave).
-          </p>
-        </dd>
 <dt><span class="term">-p</span></dt>
 <dd>
           <p>

bin/check/win32/checkconf.dsp.in

@@ -0,0 +1,107 @@
+# Microsoft Developer Studio Project File - Name="checkconf" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "@PLATFORM@ (x86) Console Application" 0x0103
+
+CFG=checkconf - @PLATFORM@ Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "checkconf.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "checkconf.mak" CFG="checkconf - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "checkconf - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "checkconf - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "checkconf - @PLATFORM@ Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 @COPTX@ @COPTI@ /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD CPP /nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/isccfg/include" @CRYPTO@ /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" /FR @COPTY@ /FD /c
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console @MACHINE@
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/checktool.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/bind9/win32/Release/libbind9.lib /nologo /subsystem:console @MACHINE@ /out:"../../../Build/Release/named-checkconf.exe"
+
+!ELSEIF  "$(CFG)" == "checkconf - @PLATFORM@ Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/isccfg/include" @CRYPTO@ /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
+# SUBTRACT CPP /X @COPTY@
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug @MACHINE@ /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/checktool.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/bind9/win32/Debug/libbind9.lib /nologo /subsystem:console /debug @MACHINE@ /out:"../../../Build/Debug/named-checkconf.exe" /pdbtype:sept
+
+!ENDIF 
+
+# Begin Target
+
+# Name "checkconf - @PLATFORM@ Release"
+# Name "checkconf - @PLATFORM@ Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# Begin Source File
+
+SOURCE="..\named-checkconf.c"
+# End Source File
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# Begin Source File
+
+SOURCE="..\check-tool.h"
+# End Source File
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# End Target
+# End Project

bin/check/win32/checkconf.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "checkconf"=".\checkconf.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/check/win32/checkconf.mak.in

@@ -0,0 +1,404 @@
+# Microsoft Developer Studio Generated NMAKE File, Based on checkconf.dsp
+!IF "$(CFG)" == ""
+CFG=checkconf - @PLATFORM@ Debug
+!MESSAGE No configuration specified. Defaulting to checkconf - @PLATFORM@ Debug.
+!ENDIF 
+
+!IF "$(CFG)" != "checkconf - @PLATFORM@ Release" && "$(CFG)" != "checkconf - @PLATFORM@ Debug"
+!MESSAGE Invalid configuration "$(CFG)" specified.
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "checkconf.mak" CFG="checkconf - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "checkconf - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "checkconf - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+!ERROR An invalid configuration is specified.
+!ENDIF 
+
+!IF "$(OS)" == "Windows_NT"
+NULL=
+!ELSE 
+NULL=nul
+!ENDIF 
+
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "checkconf - @PLATFORM@ Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
+!IF  "$(CFG)" == "checkconf - @PLATFORM@ Release"
+
+OUTDIR=.\Release
+INTDIR=.\Release
+# Begin Custom Macros
+OutDir=.\Release
+# End Custom Macros
+
+!IF "$(RECURSE)" == "0" 
+
+ALL : "..\..\..\Build\Release\named-checkconf.exe" "$(OUTDIR)\checkconf.bsc"
+
+!ELSE 
+
+ALL : "libdns - @PLATFORM@ Release" "libisccfg - @PLATFORM@ Release" "libisc - @PLATFORM@ Release" "..\..\..\Build\Release\named-checkconf.exe" "$(OUTDIR)\checkconf.bsc"
+
+!ENDIF 
+
+!IF "$(RECURSE)" == "1" 
+CLEAN :"libisc - @PLATFORM@ ReleaseCLEAN" "libisccfg - @PLATFORM@ ReleaseCLEAN" "libdns - @PLATFORM@ ReleaseCLEAN" 
+!ELSE 
+CLEAN :
+!ENDIF 
+	-@erase "$(INTDIR)\check-tool.obj"
+	-@erase "$(INTDIR)\check-tool.sbr"
+	-@erase "$(INTDIR)\named-checkconf.obj"
+	-@erase "$(INTDIR)\named-checkconf.sbr"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "$(OUTDIR)\checkconf.bsc"
+	-@erase "..\..\..\Build\Release\named-checkconf.exe"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/isccfg/include" @CRYPTO@ /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" /FR"$(INTDIR)\\" /Fp"$(INTDIR)\checkconf.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\checkconf.bsc" 
+BSC32_SBRS= \
+	"$(INTDIR)\check-tool.sbr" \
+	"$(INTDIR)\named-checkconf.sbr"
+
+"$(OUTDIR)\checkconf.bsc" : "$(OUTDIR)" $(BSC32_SBRS)
+    $(BSC32) @<<
+  $(BSC32_FLAGS) $(BSC32_SBRS)
+<<
+
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib  ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/bind9/win32/Release/libbind9.lib /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\named-checkconf.pdb" @MACHINE@ /out:"../../../Build/Release/named-checkconf.exe" 
+LINK32_OBJS= \
+	"$(INTDIR)\check-tool.obj" \
+	"$(INTDIR)\named-checkconf.obj" \
+	"..\..\..\lib\isc\win32\Release\libisc.lib" \
+	"..\..\..\lib\isccfg\win32\Release\libisccfg.lib" \
+	"..\..\..\lib\dns\win32\Release\libdns.lib"
+
+"..\..\..\Build\Release\named-checkconf.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ELSEIF  "$(CFG)" == "checkconf - @PLATFORM@ Debug"
+
+OUTDIR=.\Debug
+INTDIR=.\Debug
+# Begin Custom Macros
+OutDir=.\Debug
+# End Custom Macros
+
+!IF "$(RECURSE)" == "0" 
+
+ALL : "..\..\..\Build\Debug\named-checkconf.exe" "$(OUTDIR)\checkconf.bsc"
+
+!ELSE 
+
+ALL : "libdns - @PLATFORM@ Debug" "libisccfg - @PLATFORM@ Debug" "libisc - @PLATFORM@ Debug" "..\..\..\Build\Debug\named-checkconf.exe" "$(OUTDIR)\checkconf.bsc"
+
+!ENDIF 
+
+!IF "$(RECURSE)" == "1" 
+CLEAN :"libisc - @PLATFORM@ DebugCLEAN" "libisccfg - @PLATFORM@ DebugCLEAN" "libdns - @PLATFORM@ DebugCLEAN" 
+!ELSE 
+CLEAN :
+!ENDIF 
+	-@erase "$(INTDIR)\check-tool.obj"
+	-@erase "$(INTDIR)\check-tool.sbr"
+	-@erase "$(INTDIR)\named-checkconf.obj"
+	-@erase "$(INTDIR)\named-checkconf.sbr"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "$(INTDIR)\vc60.pdb"
+	-@erase "$(OUTDIR)\named-checkconf.pdb"
+	-@erase "$(OUTDIR)\checkconf.bsc"
+	-@erase "..\..\..\Build\Debug\named-checkconf.exe"
+	-@erase "..\..\..\Build\Debug\named-checkconf.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/isccfg/include" @CRYPTO@ /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\checkconf.bsc" 
+BSC32_SBRS= \
+	"$(INTDIR)\check-tool.sbr" \
+	"$(INTDIR)\named-checkconf.sbr"
+
+"$(OUTDIR)\checkconf.bsc" : "$(OUTDIR)" $(BSC32_SBRS)
+    $(BSC32) @<<
+  $(BSC32_FLAGS) $(BSC32_SBRS)
+<<
+
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib  ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/bind9/win32/Debug/libbind9.lib /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\named-checkconf.pdb" /debug @MACHINE@ /out:"../../../Build/Debug/named-checkconf.exe" /pdbtype:sept 
+LINK32_OBJS= \
+	"$(INTDIR)\check-tool.obj" \
+	"$(INTDIR)\named-checkconf.obj" \
+	"..\..\..\lib\isc\win32\Debug\libisc.lib" \
+	"..\..\..\lib\isccfg\win32\Debug\libisccfg.lib" \
+	"..\..\..\lib\dns\win32\Debug\libdns.lib"
+
+"..\..\..\Build\Debug\named-checkconf.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ENDIF 
+
+.c{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.c{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+
+!IF "$(NO_EXTERNAL_DEPS)" != "1"
+!IF EXISTS("checkconf.dep")
+!INCLUDE "checkconf.dep"
+!ELSE 
+!MESSAGE Warning: cannot find "checkconf.dep"
+!ENDIF 
+!ENDIF 
+
+
+!IF "$(CFG)" == "checkconf - @PLATFORM@ Release" || "$(CFG)" == "checkconf - @PLATFORM@ Debug"
+SOURCE="..\check-tool.c"
+
+"$(INTDIR)\check-tool.obj"	"$(INTDIR)\check-tool.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+SOURCE="..\named-checkconf.c"
+
+"$(INTDIR)\named-checkconf.obj"	"$(INTDIR)\named-checkconf.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!IF  "$(CFG)" == "checkconf - @PLATFORM@ Release"
+
+"libisc - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Release" 
+   cd "..\..\..\bin\check\win32"
+
+"libisc - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\check\win32"
+
+!ELSEIF  "$(CFG)" == "checkconf - @PLATFORM@ Debug"
+
+"libisc - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\check\win32"
+
+"libisc - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\check\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "checkconf - @PLATFORM@ Release"
+
+"libisccfg - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\isccfg\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisccfg.mak" CFG="libisccfg - @PLATFORM@ Release" 
+   cd "..\..\..\bin\check\win32"
+
+"libisccfg - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\isccfg\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisccfg.mak" CFG="libisccfg - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\check\win32"
+
+!ELSEIF  "$(CFG)" == "checkconf - @PLATFORM@ Debug"
+
+"libisccfg - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\isccfg\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisccfg.mak" CFG="libisccfg - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\check\win32"
+
+"libisccfg - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\isccfg\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisccfg.mak" CFG="libisccfg - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\check\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "checkconf - @PLATFORM@ Release"
+
+"libdns - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Release" 
+   cd "..\..\..\bin\check\win32"
+
+"libdns - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\check\win32"
+
+!ELSEIF  "$(CFG)" == "checkconf - @PLATFORM@ Debug"
+
+"libdns - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\check\win32"
+
+"libdns - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\check\win32"
+
+!ENDIF 
+
+
+!ENDIF 
+
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/check/win32/checkconf.vcxproj.in

@@ -63,14 +63,13 @@
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -90,7 +89,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -98,8 +96,8 @@
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
     </Link>
   </ItemDefinitionGroup>
@@ -112,4 +110,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

bin/check/win32/checktool.dsp.in

@@ -0,0 +1,113 @@
+# Microsoft Developer Studio Project File - Name="checktool" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "@PLATFORM@ (x86) Static-Link Library" 0x0104
+
+CFG=checktool - @PLATFORM@ Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "checktool.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "checktool.mak" CFG="checktool - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "checktool - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Static-Link Library")
+!MESSAGE "checktool - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Static-Link Library")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+MTL=midl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "checktool - @PLATFORM@ Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MT /W3 @COPTX@ @COPTI@ /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" @COPTY@ /FD /c
+# ADD CPP /nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" @CRYPTO@ /D "NDEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" @COPTY@ /FD /c /Fdchecktool
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /out:"Release/checktool.lib"
+
+!ELSEIF  "$(CFG)" == "checktool - @PLATFORM@ Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MTd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" @COPTY@ /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" @CRYPTO@ /D "_DEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /FR @COPTY@ /FD /GZ /c /Fdchecktool
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /debug out:"Debug/checktool.lib"
+
+!ENDIF 
+
+# Begin Target
+
+# Name "checktool - @PLATFORM@ Release"
+# Name "checktool - @PLATFORM@ Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# Begin Group "Main Dns Lib"
+
+# PROP Default_Filter "c"
+# Begin Source File
+
+SOURCE=..\check-tool.c
+# End Source File
+# End Group
+# End Target
+# End Project

bin/check/win32/checktool.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "checktool"=".\checktool.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/check/win32/checktool.vcxproj.in

@@ -65,8 +65,7 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
     </ClCompile>
     <Lib>
       <OutputFile>.\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
@@ -88,8 +87,7 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
     </ClCompile>
     <Lib>
       <OutputFile>.\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
@@ -98,4 +96,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

bin/check/win32/checkzone.dsp.in

@@ -0,0 +1,108 @@
+# Microsoft Developer Studio Project File - Name="checkzone" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "@PLATFORM@ (x86) Console Application" 0x0103
+
+CFG=checkzone - @PLATFORM@ Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "checkzone.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "checkzone.mak" CFG="checkzone - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "checkzone - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "checkzone - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "checkzone - @PLATFORM@ Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 @COPTX@ @COPTI@ /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD CPP /nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" @CRYPTO@ /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" @COPTY@ /FD /c
+# SUBTRACT CPP /Fr
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console @MACHINE@
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/checktool.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/dns/win32/Release/libdns.lib /nologo /subsystem:console @MACHINE@ /out:"../../../Build/Release/named-checkzone.exe"
+
+!ELSEIF  "$(CFG)" == "checkzone - @PLATFORM@ Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" @CRYPTO@ /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
+# SUBTRACT CPP /X @COPTY@
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug @MACHINE@ /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/checktool.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/dns/win32/Debug/libdns.lib /nologo /subsystem:console /debug @MACHINE@ /out:"../../../Build/Debug/named-checkzone.exe" /pdbtype:sept
+
+!ENDIF 
+
+# Begin Target
+
+# Name "checkzone - @PLATFORM@ Release"
+# Name "checkzone - @PLATFORM@ Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# Begin Source File
+
+SOURCE="..\named-checkzone.c"
+# End Source File
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# Begin Source File
+
+SOURCE="..\check-tool.h"
+# End Source File
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# End Target
+# End Project

bin/check/win32/checkzone.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "checkzone"=".\checkzone.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/check/win32/checkzone.mak.in

@@ -0,0 +1,404 @@
+# Microsoft Developer Studio Generated NMAKE File, Based on checkzone.dsp
+!IF "$(CFG)" == ""
+CFG=checkzone - @PLATFORM@ Debug
+!MESSAGE No configuration specified. Defaulting to checkzone - @PLATFORM@ Debug.
+!ENDIF 
+
+!IF "$(CFG)" != "checkzone - @PLATFORM@ Release" && "$(CFG)" != "checkzone - @PLATFORM@ Debug"
+!MESSAGE Invalid configuration "$(CFG)" specified.
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "checkzone.mak" CFG="checkzone - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "checkzone - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "checkzone - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+!ERROR An invalid configuration is specified.
+!ENDIF 
+
+!IF "$(OS)" == "Windows_NT"
+NULL=
+!ELSE 
+NULL=nul
+!ENDIF 
+
+!IF  "$(CFG)" == "checkzone - @PLATFORM@ Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
+!IF  "$(CFG)" == "checkzone - @PLATFORM@ Release"
+
+OUTDIR=.\Release
+INTDIR=.\Release
+
+!IF "$(RECURSE)" == "0" 
+
+ALL : "..\..\..\Build\Release\named-checkzone.exe"
+
+!ELSE 
+
+ALL : "libisc - @PLATFORM@ Release" "libdns - @PLATFORM@ Release" "..\..\..\Build\Release\named-checkzone.exe"
+
+!ENDIF 
+
+!IF "$(RECURSE)" == "1" 
+CLEAN :"libdns - @PLATFORM@ ReleaseCLEAN" "libisc - @PLATFORM@ ReleaseCLEAN" 
+!ELSE 
+CLEAN :
+!ENDIF 
+	-@erase "$(INTDIR)\check-tool.obj"
+	-@erase "$(INTDIR)\named-checkzone.obj"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "..\..\..\Build\Release\named-checkzone.exe"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP=cl.exe
+CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" @CRYPTO@ /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" /Fp"$(INTDIR)\checkzone.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+
+.c{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.c{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+RSC=rc.exe
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\checkzone.bsc" 
+BSC32_SBRS= \
+	
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/dns/win32/Release/libdns.lib /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\named-checkzone.pdb" @MACHINE@ /out:"../../../Build/Release/named-checkzone.exe" 
+LINK32_OBJS= \
+	"$(INTDIR)\check-tool.obj" \
+	"$(INTDIR)\named-checkzone.obj" \
+	"..\..\..\lib\dns\win32\Release\libdns.lib" \
+	"..\..\..\lib\isccfg\win32\Release\libisccfg.lib" \
+	"..\..\..\lib\isc\win32\Release\libisc.lib"
+
+"..\..\..\Build\Release\named-checkzone.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ELSEIF  "$(CFG)" == "checkzone - @PLATFORM@ Debug"
+
+OUTDIR=.\Debug
+INTDIR=.\Debug
+# Begin Custom Macros
+OutDir=.\Debug
+# End Custom Macros
+
+!IF "$(RECURSE)" == "0" 
+
+ALL : "..\..\..\Build\Debug\named-checkzone.exe" "$(OUTDIR)\checkzone.bsc"
+
+!ELSE 
+
+ALL : "libisc - @PLATFORM@ Debug" "libdns - @PLATFORM@ Debug" "..\..\..\Build\Debug\named-checkzone.exe" "$(OUTDIR)\checkzone.bsc"
+
+!ENDIF 
+
+!IF "$(RECURSE)" == "1" 
+CLEAN :"libdns - @PLATFORM@ DebugCLEAN" "libisc - @PLATFORM@ DebugCLEAN" 
+!ELSE 
+CLEAN :
+!ENDIF 
+	-@erase "$(INTDIR)\check-tool.obj"
+	-@erase "$(INTDIR)\check-tool.sbr"
+	-@erase "$(INTDIR)\named-checkzone.obj"
+	-@erase "$(INTDIR)\named-checkzone.sbr"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "$(INTDIR)\vc60.pdb"
+	-@erase "$(OUTDIR)\named-checkzone.pdb"
+	-@erase "$(OUTDIR)\checkzone.bsc"
+	-@erase "..\..\..\Build\Debug\named-checkzone.exe"
+	-@erase "..\..\..\Build\Debug\named-checkzone.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP=cl.exe
+CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" @CRYPTO@ /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+
+.c{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.c{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+RSC=rc.exe
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\checkzone.bsc" 
+BSC32_SBRS= \
+	"$(INTDIR)\check-tool.sbr" \
+	"$(INTDIR)\named-checkzone.sbr"
+
+"$(OUTDIR)\checkzone.bsc" : "$(OUTDIR)" $(BSC32_SBRS)
+    $(BSC32) @<<
+  $(BSC32_FLAGS) $(BSC32_SBRS)
+<<
+
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/dns/win32/Debug/libdns.lib /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\named-checkzone.pdb" /debug @MACHINE@ /out:"../../../Build/Debug/named-checkzone.exe" /pdbtype:sept 
+LINK32_OBJS= \
+	"$(INTDIR)\check-tool.obj" \
+	"$(INTDIR)\named-checkzone.obj" \
+	"..\..\..\lib\dns\win32\Debug\libdns.lib" \
+	"..\..\..\lib\isccfg\win32\Debug\libisccfg.lib" \
+	"..\..\..\lib\isc\win32\Debug\libisc.lib"
+
+"..\..\..\Build\Debug\named-checkzone.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ENDIF 
+
+
+!IF "$(NO_EXTERNAL_DEPS)" != "1"
+!IF EXISTS("checkzone.dep")
+!INCLUDE "checkzone.dep"
+!ELSE 
+!MESSAGE Warning: cannot find "checkzone.dep"
+!ENDIF 
+!ENDIF 
+
+
+!IF "$(CFG)" == "checkzone - @PLATFORM@ Release" || "$(CFG)" == "checkzone - @PLATFORM@ Debug"
+SOURCE="..\check-tool.c"
+
+!IF  "$(CFG)" == "checkzone - @PLATFORM@ Release"
+
+
+"$(INTDIR)\check-tool.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "checkzone - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\check-tool.obj"	"$(INTDIR)\check-tool.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+SOURCE="..\named-checkzone.c"
+
+!IF  "$(CFG)" == "checkzone - @PLATFORM@ Release"
+
+
+"$(INTDIR)\named-checkzone.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "checkzone - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\named-checkzone.obj"	"$(INTDIR)\named-checkzone.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+!IF  "$(CFG)" == "checkzone - @PLATFORM@ Release"
+
+"libdns - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Release" 
+   cd "..\..\..\bin\check\win32"
+
+"libdns - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\check\win32"
+
+!ELSEIF  "$(CFG)" == "checkzone - @PLATFORM@ Debug"
+
+"libdns - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\check\win32"
+
+"libdns - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\check\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "checkzone - @PLATFORM@ Release"
+
+"libisc - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Release" 
+   cd "..\..\..\bin\check\win32"
+
+"libisc - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\check\win32"
+
+!ELSEIF  "$(CFG)" == "checkzone - @PLATFORM@ Debug"
+
+"libisc - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\check\win32"
+
+"libisc - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\check\win32"
+
+!ENDIF 
+
+
+!ENDIF 
+
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/check/win32/checkzone.vcxproj.in

@@ -63,14 +63,13 @@
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
     <PostBuildEvent>
       <Command>cd ..\..\..\Build\$(Configuration)
@@ -96,7 +95,6 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -104,8 +102,8 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
     </Link>
     <PostBuildEvent>
@@ -123,4 +121,4 @@ copy /Y named-checkzone.exe named-compilezone.exe
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

bin/confgen/Makefile.in

@@ -1,9 +1,11 @@
-# Copyright (C) 2009, 2012, 2014-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009, 2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+# $Id: Makefile.in,v 1.8 2009/12/05 23:31:40 each Exp $
+
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -20,8 +22,8 @@ CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 

bin/confgen/keygen.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2012-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2012-2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -151,11 +151,6 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
 
 	DO("create entropy context", isc_entropy_create(mctx, &ectx));
 
-#ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile == NULL) {
-		isc_entropy_usehook(ectx, ISC_TRUE);
-	}
-#endif
 	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
 		randomfile = NULL;
 		open_keyboard = ISC_ENTROPY_KEYBOARDYES;

bin/confgen/rndc-confgen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -111,9 +111,7 @@ as directed\&.
 .PP
 \-A \fIalgorithm\fR
 .RS 4
-Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5, or if MD5 was disabled at compile time, hmac\-sha256\&.
-.sp
-Note: Use of hmac\-md5 is no longer recommended, and the default value will be changed to hmac\-sha256 in a future release\&.
+Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5 or if MD5 was disabled hmac\-sha256\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -219,5 +217,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/confgen/rndc-confgen.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2003-2005, 2007-2009, 2011, 2013, 2014, 2016, 2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2001, 2003-2005, 2007-2009, 2011, 2013, 2014, 2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -73,7 +73,7 @@ Usage:\n\
  %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
 [-s addr] [-t chrootdir] [-u user]\n\
   -a:		 generate just the key clause and write it to keyfile (%s)\n\
-  -A alg:	 algorithm (default hmac-md5 (deprecated and will change))\n\
+  -A alg:	 algorithm (default hmac-md5)\n\
   -b bits:	 from 1 through 512, default 256; total length of the secret\n\
   -c keyfile:	 specify an alternate key file (requires -a)\n\
   -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
@@ -115,7 +115,6 @@ main(int argc, char **argv) {
 	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
-	isc_boolean_t algset = ISC_FALSE;
 	const char *algname;
 	char *p;
 	int ch;
@@ -154,7 +153,6 @@ main(int argc, char **argv) {
 			keyonly = ISC_TRUE;
 			break;
 		case 'A':
-			algset = ISC_TRUE;
 			algname = isc_commandline_argument;
 			alg = alg_fromtext(algname);
 			if (alg == DST_ALG_UNKNOWN)
@@ -227,20 +225,6 @@ main(int argc, char **argv) {
 	if (argc > 0)
 		usage(1);
 
-	if (alg == DST_ALG_HMACMD5) {
-		if (algset) {
-			fprintf(stderr,
-				"warning: use of hmac-md5 for RNDC keys "
-				"is deprecated; hmac-sha256 is now "
-				"recommended.\n");
-		} else {
-			fprintf(stderr,
-				"warning: the default algorithm hmac-md5 "
-				"is deprecated and will be\n"
-				"changed to hmac-sha256 in a future release\n");
-		}
-	}
-
 	if (keysize < 0)
 		keysize = alg_bits(alg);
 	algname = alg_totext(alg);

bin/confgen/rndc-confgen.docbook

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
  -
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,6 @@
       <year>2014</year>
       <year>2015</year>
       <year>2016</year>
-      <year>2017</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -129,12 +128,8 @@
           <para>
             Specifies the algorithm to use for the TSIG key.  Available
             choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
-            if MD5 was disabled at compile time, hmac-sha256.
-          </para>
-          <para>
-            Note: Use of hmac-md5 is no longer recommended, and the default
-            value will be changed to hmac-sha256 in a future release.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5 or
+            if MD5 was disabled hmac-sha256.
           </para>
         </listitem>
       </varlistentry>

bin/confgen/rndc-confgen.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -113,12 +113,8 @@
           <p>
             Specifies the algorithm to use for the TSIG key.  Available
             choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
-            hmac-sha384 and hmac-sha512.  The default is hmac-md5, or
-            if MD5 was disabled at compile time, hmac-sha256.
-          </p>
-          <p>
-            Note: Use of hmac-md5 is no longer recommended, and the default
-            value will be changed to hmac-sha256 in a future release.
+            hmac-sha384 and hmac-sha512.  The default is hmac-md5 or
+            if MD5 was disabled hmac-sha256.
           </p>
         </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>

bin/confgen/win32/confgentool.dsp.in

@@ -0,0 +1,135 @@
+# Microsoft Developer Studio Project File - Name="confgentool" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "@PLATFORM@ (x86) Static-Link Library" 0x0104
+
+CFG=confgentool - @PLATFORM@ Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "confgentool.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "confgentool.mak" CFG="confgentool - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "confgentool - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Static-Link Library")
+!MESSAGE "confgentool - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Static-Link Library")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+MTL=midl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "confgentool - @PLATFORM@ Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MT /W3 @COPTX@ @COPTI@ /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" @COPTY@ /FD /c
+# ADD CPP /nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" @LIBXML2_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /D "NDEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" @COPTY@ /FD /c /Fdconfgentool
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /out:"Release/confgentool.lib"
+LIB32=lib.exe
+# ADD BASE LIB32
+# ADD LIB32 /out:"Release/confgentool.lib"
+
+!ELSEIF  "$(CFG)" == "confgentool - @PLATFORM@ Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MTd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" @COPTY@ /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" @LIBXML2_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /D "_DEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /FR @COPTY@ /FD /GZ /c /Fdconfgentool
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /debug /out:"Debug/confgentool.lib"
+LIB32=lib.exe
+# ADD BASE LIB32
+# ADD LIB32 /out:"Debug/confgentool.lib"
+
+!ENDIF 
+
+# Begin Target
+
+# Name "confgentool - @PLATFORM@ Release"
+# Name "confgentool - @PLATFORM@ Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# Begin Source File
+
+SOURCE=..\keygen.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\util.h
+# End Source File
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# Begin Group "Main Dns Lib"
+
+# PROP Default_Filter "c"
+# Begin Source File
+
+SOURCE=..\keygen.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\util.c
+# End Source File
+# Begin Source File
+
+SOURCE=.\os.c
+# End Source File
+# End Group
+# End Target
+# End Project

bin/confgen/win32/confgentool.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "confgentool"=".\confgentool.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/confgen/win32/confgentool.vcxproj.in

@@ -61,7 +61,6 @@
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -85,7 +84,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -108,4 +106,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

bin/confgen/win32/ddnsconfgen.dsp.in

@@ -0,0 +1,103 @@
+# Microsoft Developer Studio Project File - Name="ddnsconfgen" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "@PLATFORM@ (x86) Console Application" 0x0103
+
+CFG=ddnsconfgen - @PLATFORM@ Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "ddnsconfgen.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "ddnsconfgen.mak" CFG="ddnsconfgen - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "ddnsconfgen - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "ddnsconfgen - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 @COPTX@ @COPTI@ /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD CPP /nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" @LIBXML2_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/isccc/include" /I "../../../lib/isccfg/include" /D "WIN32" /D "NDEBUG" /D "__STDC__" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console @MACHINE@
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/confgentool.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/isccc/win32/Release/libisccc.lib /nologo /subsystem:console @MACHINE@ /out:"../../../Build/Release/ddns-confgen.exe"
+
+!ELSEIF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" @LIBXML2_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/isccc/include" /I "../../../lib/isccfg/include" /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
+# SUBTRACT CPP /X @COPTY@
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug @MACHINE@ /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/confgentool.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/isccc/win32/Debug/libisccc.lib /nologo /subsystem:console /debug @MACHINE@ /out:"../../../Build/Debug/ddns-confgen.exe" /pdbtype:sept
+
+!ENDIF 
+
+# Begin Target
+
+# Name "ddnsconfgen - @PLATFORM@ Release"
+# Name "ddnsconfgen - @PLATFORM@ Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# Begin Source File
+
+SOURCE="..\ddns-confgen.c"
+# End Source File
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# End Target
+# End Project

bin/confgen/win32/ddnsconfgen.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "ddnsconfgen"=".\ddnsconfgen.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/confgen/win32/ddnsconfgen.mak.in

@@ -0,0 +1,337 @@
+# Microsoft Developer Studio Generated NMAKE File, Based on ddnsconfgen.dsp
+!IF "$(CFG)" == ""
+CFG=ddnsconfgen - @PLATFORM@ Debug
+!MESSAGE No configuration specified. Defaulting to ddnsconfgen - @PLATFORM@ Debug.
+!ENDIF 
+
+!IF "$(CFG)" != "ddnsconfgen - @PLATFORM@ Release" && "$(CFG)" != "ddnsconfgen - @PLATFORM@ Debug"
+!MESSAGE Invalid configuration "$(CFG)" specified.
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "ddnsconfgen.mak" CFG="ddnsconfgen - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "ddnsconfgen - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "ddnsconfgen - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+!ERROR An invalid configuration is specified.
+!ENDIF 
+
+!IF "$(OS)" == "Windows_NT"
+NULL=
+!ELSE 
+NULL=nul
+!ENDIF 
+
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
+!IF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Release"
+
+OUTDIR=.\Release
+INTDIR=.\Release
+
+ALL : "..\..\..\Build\Release\ddns-confgen.exe"
+
+
+CLEAN :
+	-@erase "$(INTDIR)\os.obj"
+	-@erase "$(INTDIR)\ddns-confgen.obj"
+	-@erase "$(INTDIR)\keygen.obj"
+	-@erase "$(INTDIR)\util.obj"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "..\..\..\Build\Release\ddns-confgen.exe"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" @LIBXML2_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/isccc/include" /I "../../../lib/isccfg/include" /D "WIN32" /D "NDEBUG" /D "__STDC__" /D "_CONSOLE" /D "_MBCS" /Fp"$(INTDIR)\ddnsconfgen.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\ddnsconfgen.bsc" 
+BSC32_SBRS= \
+	
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/isccc/win32/Release/libisccc.lib /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\ddns-confgen.pdb" @MACHINE@ /out:"../../../Build/Release/ddns-confgen.exe" 
+LINK32_OBJS= \
+	"$(INTDIR)\os.obj" \
+	"$(INTDIR)\ddns-confgen.obj" \
+	"$(INTDIR)\keygen.obj" \
+	"$(INTDIR)\util.obj"
+
+"..\..\..\Build\Release\ddns-confgen.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ELSEIF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Debug"
+
+OUTDIR=.\Debug
+INTDIR=.\Debug
+# Begin Custom Macros
+OutDir=.\Debug
+# End Custom Macros
+
+ALL : "..\..\..\Build\Debug\ddns-confgen.exe" "$(OUTDIR)\ddnsconfgen.bsc"
+
+
+CLEAN :
+	-@erase "$(INTDIR)\os.obj"
+	-@erase "$(INTDIR)\os.sbr"
+	-@erase "$(INTDIR)\ddns-confgen.obj"
+	-@erase "$(INTDIR)\ddns-confgen.sbr"
+	-@erase "$(INTDIR)\keygen.obj"
+	-@erase "$(INTDIR)\keygen.sbr"
+	-@erase "$(INTDIR)\util.obj"
+	-@erase "$(INTDIR)\util.sbr"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "$(INTDIR)\vc60.pdb"
+	-@erase "$(OUTDIR)\ddnsconfgen.bsc"
+	-@erase "$(OUTDIR)\ddns-confgen.pdb"
+	-@erase "..\..\..\Build\Debug\ddns-confgen.exe"
+	-@erase "..\..\..\Build\Debug\ddns-confgen.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" @LIBXML2_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/isccc/include" /I "../../../lib/isccfg/include" /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\ddnsconfgen.bsc" 
+BSC32_SBRS= \
+	"$(INTDIR)\os.sbr" \
+	"$(INTDIR)\ddns-confgen.sbr" \
+	"$(INTDIR)\keygen.sbr" \
+	"$(INTDIR)\util.sbr"
+
+"$(OUTDIR)\ddnsconfgen.bsc" : "$(OUTDIR)" $(BSC32_SBRS)
+    $(BSC32) @<<
+  $(BSC32_FLAGS) $(BSC32_SBRS)
+<<
+
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/isccc/win32/Debug/libisccc.lib /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\ddns-confgen.pdb" /debug @MACHINE@ /out:"../../../Build/Debug/ddns-confgen.exe" /pdbtype:sept 
+LINK32_OBJS= \
+	"$(INTDIR)\os.obj" \
+	"$(INTDIR)\ddns-confgen.obj" \
+	"$(INTDIR)\keygen.obj" \
+	"$(INTDIR)\util.obj"
+
+"..\..\..\Build\Debug\ddns-confgen.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ENDIF 
+
+.c{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.c{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+
+!IF "$(NO_EXTERNAL_DEPS)" != "1"
+!IF EXISTS("ddnsconfgen.dep")
+!INCLUDE "ddnsconfgen.dep"
+!ELSE 
+!MESSAGE Warning: cannot find "ddnsconfgen.dep"
+!ENDIF 
+!ENDIF 
+
+
+!IF "$(CFG)" == "ddnsconfgen - @PLATFORM@ Release" || "$(CFG)" == "ddnsconfgen - @PLATFORM@ Debug"
+SOURCE=.\os.c
+
+!IF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Release"
+
+
+"$(INTDIR)\os.obj" : $(SOURCE) "$(INTDIR)"
+
+
+!ELSEIF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\os.obj"	"$(INTDIR)\os.sbr" : $(SOURCE) "$(INTDIR)"
+
+
+!ENDIF 
+
+SOURCE="..\ddns-confgen.c"
+
+!IF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Release"
+
+
+"$(INTDIR)\ddns-confgen.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\ddns-confgen.obj"	"$(INTDIR)\ddns-confgen.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+SOURCE=..\keygen.c
+
+!IF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Release"
+
+
+"$(INTDIR)\keygen.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\keygen.obj"	"$(INTDIR)\keygen.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+SOURCE=..\util.c
+
+!IF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Release"
+
+
+"$(INTDIR)\util.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "ddnsconfgen - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\util.obj"	"$(INTDIR)\util.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+
+!ENDIF 
+
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/confgen/win32/ddnsconfgen.vcxproj.in

@@ -63,7 +63,6 @@
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -96,7 +95,6 @@ copy /Y ddns-confgen.ilk tsig-keygen.ilk
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>

bin/confgen/win32/rndcconfgen.dsp.in

@@ -0,0 +1,103 @@
+# Microsoft Developer Studio Project File - Name="rndcconfgen" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "@PLATFORM@ (x86) Console Application" 0x0103
+
+CFG=rndcconfgen - @PLATFORM@ Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "rndcconfgen.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "rndcconfgen.mak" CFG="rndcconfgen - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "rndcconfgen - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "rndcconfgen - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 @COPTX@ @COPTI@ /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD CPP /nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" @LIBXML2_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/isccc/include" /I "../../../lib/isccfg/include" /D "WIN32" /D "NDEBUG" /D "__STDC__" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console @MACHINE@
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/confgentool.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/isccc/win32/Release/libisccc.lib /nologo /subsystem:console @MACHINE@ /out:"../../../Build/Release/rndc-confgen.exe"
+
+!ELSEIF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" @LIBXML2_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/isccc/include" /I "../../../lib/isccfg/include" /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
+# SUBTRACT CPP /X @COPTY@
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug @MACHINE@ /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/confgentool.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/isccc/win32/Debug/libisccc.lib /nologo /subsystem:console /debug @MACHINE@ /out:"../../../Build/Debug/rndc-confgen.exe" /pdbtype:sept
+
+!ENDIF 
+
+# Begin Target
+
+# Name "rndcconfgen - @PLATFORM@ Release"
+# Name "rndcconfgen - @PLATFORM@ Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# Begin Source File
+
+SOURCE="..\rndc-confgen.c"
+# End Source File
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# End Target
+# End Project

bin/confgen/win32/rndcconfgen.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "rndconfgen"=".\rndconfgen.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/confgen/win32/rndcconfgen.mak.in

@@ -0,0 +1,336 @@
+# Microsoft Developer Studio Generated NMAKE File, Based on confgen.dsp
+!IF "$(CFG)" == ""
+CFG=rndcconfgen - @PLATFORM@ Debug
+!MESSAGE No configuration specified. Defaulting to rndcconfgen - @PLATFORM@ Debug.
+!ENDIF 
+
+!IF "$(CFG)" != "rndcconfgen - @PLATFORM@ Release" && "$(CFG)" != "rndcconfgen - @PLATFORM@ Debug"
+!MESSAGE Invalid configuration "$(CFG)" specified.
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "rndcconfgen.mak" CFG="rndcconfgen - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "rndcconfgen - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "rndcconfgen - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+!ERROR An invalid configuration is specified.
+!ENDIF 
+
+!IF "$(OS)" == "Windows_NT"
+NULL=
+!ELSE 
+NULL=nul
+!ENDIF 
+
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
+!IF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Release"
+
+OUTDIR=.\Release
+INTDIR=.\Release
+
+ALL : "..\..\..\Build\Release\rndc-confgen.exe"
+
+
+CLEAN :
+	-@erase "$(INTDIR)\os.obj"
+	-@erase "$(INTDIR)\rndc-confgen.obj"
+	-@erase "$(INTDIR)\keygen.obj"
+	-@erase "$(INTDIR)\util.obj"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "..\..\..\Build\Release\rndc-confgen.exe"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" @LIBXML2_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/isccc/include" /I "../../../lib/isccfg/include" /D "WIN32" /D "NDEBUG" /D "__STDC__" /D "_CONSOLE" /D "_MBCS" /Fp"$(INTDIR)\confgen.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\confgen.bsc" 
+BSC32_SBRS= \
+	
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/isccc/win32/Release/libisccc.lib /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\rndc-confgen.pdb" @MACHINE@ /out:"../../../Build/Release/rndc-confgen.exe" 
+LINK32_OBJS= \
+	"$(INTDIR)\os.obj" \
+	"$(INTDIR)\rndc-confgen.obj" \
+	"$(INTDIR)\keygen.obj" \
+	"$(INTDIR)\util.obj"
+
+"..\..\..\Build\Release\rndc-confgen.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ELSEIF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Debug"
+
+OUTDIR=.\Debug
+INTDIR=.\Debug
+# Begin Custom Macros
+OutDir=.\Debug
+# End Custom Macros
+
+ALL : "..\..\..\Build\Debug\rndc-confgen.exe" "$(OUTDIR)\confgen.bsc"
+
+
+CLEAN :
+	-@erase "$(INTDIR)\os.obj"
+	-@erase "$(INTDIR)\os.sbr"
+	-@erase "$(INTDIR)\rndc-confgen.obj"
+	-@erase "$(INTDIR)\rndc-confgen.sbr"
+	-@erase "$(INTDIR)\keygen.obj"
+	-@erase "$(INTDIR)\keygen.sbr"
+	-@erase "$(INTDIR)\util.obj"
+	-@erase "$(INTDIR)\util.sbr"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "$(INTDIR)\vc60.pdb"
+	-@erase "$(OUTDIR)\confgen.bsc"
+	-@erase "$(OUTDIR)\rndc-confgen.pdb"
+	-@erase "..\..\..\Build\Debug\rndc-confgen.exe"
+	-@erase "..\..\..\Build\Debug\rndc-confgen.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" @LIBXML2_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/isccc/include" /I "../../../lib/isccfg/include" /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\confgen.bsc" 
+BSC32_SBRS= \
+	"$(INTDIR)\os.sbr" \
+	"$(INTDIR)\rndc-confgen.sbr" \
+	"$(INTDIR)\keygen.sbr" \
+	"$(INTDIR)\util.sbr"
+
+"$(OUTDIR)\confgen.bsc" : "$(OUTDIR)" $(BSC32_SBRS)
+    $(BSC32) @<<
+  $(BSC32_FLAGS) $(BSC32_SBRS)
+<<
+
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/isccc/win32/Debug/libisccc.lib /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\rndc-confgen.pdb" /debug @MACHINE@ /out:"../../../Build/Debug/rndc-confgen.exe" /pdbtype:sept 
+LINK32_OBJS= \
+	"$(INTDIR)\os.obj" \
+	"$(INTDIR)\rndc-confgen.obj" \
+	"$(INTDIR)\keygen.obj" \
+	"$(INTDIR)\util.obj"
+
+"..\..\..\Build\Debug\rndc-confgen.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ENDIF 
+
+.c{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.c{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+
+!IF "$(NO_EXTERNAL_DEPS)" != "1"
+!IF EXISTS("confgen.dep")
+!INCLUDE "confgen.dep"
+!ELSE 
+!MESSAGE Warning: cannot find "confgen.dep"
+!ENDIF 
+!ENDIF 
+
+
+!IF "$(CFG)" == "rndcconfgen - @PLATFORM@ Release" || "$(CFG)" == "rndcconfgen - @PLATFORM@ Debug"
+SOURCE=.\os.c
+
+!IF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Release"
+
+
+"$(INTDIR)\os.obj" : $(SOURCE) "$(INTDIR)"
+
+
+!ELSEIF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\os.obj"	"$(INTDIR)\os.sbr" : $(SOURCE) "$(INTDIR)"
+
+
+!ENDIF 
+
+SOURCE="..\rndc-confgen.c"
+
+!IF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Release"
+
+
+"$(INTDIR)\rndc-confgen.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\rndc-confgen.obj"	"$(INTDIR)\rndc-confgen.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+SOURCE=..\keygen.c
+
+!IF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Release"
+
+
+"$(INTDIR)\keygen.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\keygen.obj"	"$(INTDIR)\keygen.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+SOURCE=..\util.c
+
+!IF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Release"
+
+
+"$(INTDIR)\util.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "rndcconfgen - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\util.obj"	"$(INTDIR)\util.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+!ENDIF 
+
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/confgen/win32/rndcconfgen.vcxproj.in

@@ -63,7 +63,6 @@
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -90,7 +89,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -109,4 +107,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

bin/delv/Makefile.in

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -13,7 +13,7 @@ VERSION=@BIND9_VERSION@
 @BIND9_MAKE_INCLUDES@
 
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @DST_OPENSSL_INC@
+		@DST_OPENSSL_INC@ ${IRS_INCLUDES} ${ISCCFG_INCLUDES}
 
 CDEFINES =	@CRYPTO@ -DVERSION=\"${VERSION}\" \
 		-DSYSCONFDIR=\"${sysconfdir}\"
@@ -21,8 +21,8 @@ CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
+ISCLIBS =	../../lib/isc/libisc.@A@
 IRSLIBS =	../../lib/irs/libirs.@A@
 
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@

bin/delv/delv.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2014-2017 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,7 @@
 delv \- DNS lookup and validation utility
 .SH "SYNOPSIS"
 .HP \w'\fBdelv\fR\ 'u
-\fBdelv\fR [@server] [[\fB\-4\fR] | [\fB\-6\fR]] [\fB\-a\ \fR\fB\fIanchor\-file\fR\fR] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIlevel\fR\fR] [\fB\-i\fR] [\fB\-m\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [name] [type] [class] [queryopt...]
+\fBdelv\fR [@server] [\fB\-4\fR] [\fB\-6\fR] [\fB\-a\ \fR\fB\fIanchor\-file\fR\fR] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIlevel\fR\fR] [\fB\-i\fR] [\fB\-m\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [name] [type] [class] [queryopt...]
 .HP \w'\fBdelv\fR\ 'u
 \fBdelv\fR [\fB\-h\fR]
 .HP \w'\fBdelv\fR\ 'u
@@ -49,13 +49,13 @@ delv \- DNS lookup and validation utility
 .SH "DESCRIPTION"
 .PP
 \fBdelv\fR
-is a tool for sending DNS queries and validating the results, using the same internal resolver and validator logic as
+(Domain Entity Lookup & Validation) is a tool for sending DNS queries and validating the results, using the same internal resolver and validator logic as
 \fBnamed\fR\&.
 .PP
 \fBdelv\fR
 will send to a specified name server all queries needed to fetch and validate the requested data; this includes the original requested query, subsequent queries to follow CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records to establish a chain of trust for DNSSEC validation\&. It does not perform iterative resolution, but simulates the behavior of a name server configured for DNSSEC validating and forwarding\&.
 .PP
-By default, responses are validated using built\-in DNSSEC trust anchor for the root zone ("\&.")\&. Records returned by
+By default, responses are validated using built\-in DNSSEC trust anchors for the root zone ("\&.") and for the ISC DNSSEC lookaside validation zone ("dlv\&.isc\&.org")\&. Records returned by
 \fBdelv\fR
 are either fully validated or were not signed\&. If validation fails, an explanation of the failure is included in the output; the validation process can be traced in detail\&. Because
 \fBdelv\fR
@@ -135,13 +135,13 @@ will perform a lookup for an A record\&.
 Specifies a file from which to read DNSSEC trust anchors\&. The default is
 /etc/bind\&.keys, which is included with
 BIND
-9 and contains one or more trust anchors for the root zone ("\&.")\&.
+9 and contains trust anchors for the root zone ("\&.") and for the ISC DNSSEC lookaside validation zone ("dlv\&.isc\&.org")\&.
 .sp
-Keys that do not match the root zone name are ignored\&. An alternate key name can be specified using the
-\fB+root=NAME\fR
-options\&. DNSSEC Lookaside Validation can also be turned on by using the
+Keys that do not match the root or DLV trust\-anchor names are ignored; these key names can be overridden using the
 \fB+dlv=NAME\fR
-to specify the name of a zone containing DLV records\&.
+or
+\fB+root=NAME\fR
+options\&.
 .sp
 Note: When reading the trust anchor file,
 \fBdelv\fR
@@ -404,9 +404,9 @@ must be used to specify a file containing the key\&.
 .PP
 \fB+[no]dlv[=DLV]\fR
 .RS 4
-Indicates whether to perform DNSSEC lookaside validation, and if so, specifies the name of the DLV trust anchor\&. The
+Indicates whether to perform DNSSEC lookaside validation, and if so, specifies the name of the DLV trust anchor\&. The default is to perform lookaside validation using a trust anchor of "dlv\&.isc\&.org", for which there is a built\-in key\&. If specifying a different name, then
 \fB\-a\fR
-option must also be used to specify a file containing the DLV key\&.
+must be used to specify a file containing the DLV key\&.
 .RE
 .PP
 \fB+[no]tcp\fR
@@ -437,5 +437,5 @@ RFC5155\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2014-2017 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/delv/delv.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2014-2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -574,7 +574,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	dns_fixedname_t fkeyname;
 	dns_name_t *keyname;
 	isc_result_t result;
-	isc_boolean_t match_root = ISC_FALSE, match_dlv = ISC_FALSE;
+	isc_boolean_t match_root, match_dlv;
 
 	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));
@@ -582,10 +582,8 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	if (!root_validation && !dlv_validation)
 		return (ISC_R_SUCCESS);
 
-	if (anchor_name)
-		match_root = dns_name_equal(keyname, anchor_name);
-	if (dlv_name)
-		match_dlv = dns_name_equal(keyname, dlv_name);
+	match_root = dns_name_equal(keyname, anchor_name);
+	match_dlv = dns_name_equal(keyname, dlv_name);
 
 	if (!match_root && !match_dlv)
 		return (ISC_R_SUCCESS);
@@ -715,10 +713,14 @@ setup_dnsseckeys(dns_client_t *client) {
 			fatal("out of memory");
 	}
 
-	if (trust_anchor != NULL)
-		CHECK(convert_name(&afn, &anchor_name, trust_anchor));
-	if (dlv_anchor != NULL)
-		CHECK(convert_name(&dfn, &dlv_name, dlv_anchor));
+	if (dlv_anchor == NULL) {
+		dlv_anchor = isc_mem_strdup(mctx, "dlv.isc.org");
+		if (dlv_anchor == NULL)
+			fatal("out of memory");
+	}
+
+	CHECK(convert_name(&afn, &anchor_name, trust_anchor));
+	CHECK(convert_name(&dfn, &dlv_name, dlv_anchor));
 
 	CHECK(cfg_parser_create(mctx, dns_lctx, &parser));
 
@@ -786,20 +788,14 @@ addserver(dns_client_t *client) {
 
 	ISC_LIST_INIT(servers);
 
-	if (inet_pton(AF_INET, server, &in4) == 1) {
-		if (!use_ipv4) {
-			fatal("Use of IPv4 disabled by -6");
-		}
+	if (use_ipv4 && inet_pton(AF_INET, server, &in4) == 1) {
 		sa = isc_mem_get(mctx, sizeof(*sa));
 		if (sa == NULL)
 			return (ISC_R_NOMEMORY);
 		ISC_LINK_INIT(sa, link);
 		isc_sockaddr_fromin(sa, &in4, destport);
 		ISC_LIST_APPEND(servers, sa, link);
-	} else if (inet_pton(AF_INET6, server, &in6) == 1) {
-		if (!use_ipv6) {
-			fatal("Use of IPv6 disabled by -4");
-		}
+	} else if (use_ipv6 && inet_pton(AF_INET6, server, &in6) == 1) {
 		sa = isc_mem_get(mctx, sizeof(*sa));
 		if (sa == NULL)
 			return (ISC_R_NOMEMORY);
@@ -976,7 +972,8 @@ plus_option(char *option) {
 	char *cmd, *value, *ptr;
 	isc_boolean_t state = ISC_TRUE;
 
-	strlcpy(option_store, option, sizeof(option_store));
+	strncpy(option_store, option, sizeof(option_store));
+	option_store[sizeof(option_store)-1]=0;
 	ptr = option_store;
 	cmd = next_token(&ptr,"=");
 	if (cmd == NULL) {
@@ -1371,7 +1368,6 @@ dash_option(char *option, char *next, isc_boolean_t *open_type_class) {
  */
 static void
 preparse_args(int argc, char **argv) {
-	isc_boolean_t ipv4only = ISC_FALSE, ipv6only = ISC_FALSE;
 	char *option;
 
 	for (argc--, argv++; argc > 0; argc--, argv++) {
@@ -1379,23 +1375,10 @@ preparse_args(int argc, char **argv) {
 			continue;
 		option = &argv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
-			switch (option[0]) {
-			case 'm':
+			if (option[0] == 'm') {
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 					ISC_MEM_DEBUGRECORD;
-				break;
-			case '4':
-				if (ipv6only) {
-					fatal("only one of -4 and -6 allowed");
-				}
-				ipv4only = ISC_TRUE;
-				break;
-			case '6':
-				if (ipv4only) {
-					fatal("only one of -4 and -6 allowed");
-				}
-				ipv6only = ISC_TRUE;
-				break;
+				return;
 			}
 			option = &option[1];
 		}
@@ -1583,8 +1566,8 @@ main(int argc, char *argv[]) {
 	struct sigaction sa;
 #endif
 
-	progname = argv[0];
 	preparse_args(argc, argv);
+	progname = argv[0];
 
 	argc--;
 	argv++;

bin/delv/delv.docbook

@@ -1,7 +1,7 @@
 <!DOCTYPE book [
 <!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2014-2017  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2016  Internet Systems Consortium, Inc. ("ISC")
  -
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -34,7 +34,6 @@
       <year>2014</year>
       <year>2015</year>
       <year>2016</year>
-      <year>2017</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -43,10 +42,8 @@
     <cmdsynopsis sepchar=" ">
       <command>delv</command>
       <arg choice="opt" rep="norepeat">@server</arg>
-      <group choice="opt" rep="norepeat">
-	<arg choice="opt" rep="norepeat"><option>-4</option></arg>
-	<arg choice="opt" rep="norepeat"><option>-6</option></arg>
-      </group>
+      <arg choice="opt" rep="norepeat"><option>-4</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-6</option></arg>
       <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">anchor-file</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">address</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
@@ -83,7 +80,7 @@
   <refsection><info><title>DESCRIPTION</title></info>
 
     <para><command>delv</command>
-      is a tool for sending
+      (Domain Entity Lookup &amp; Validation) is a tool for sending
       DNS queries and validating the results, using the same internal
       resolver and validator logic as <command>named</command>.
     </para>
@@ -99,7 +96,8 @@
     </para>
     <para>
       By default, responses are validated using built-in DNSSEC trust
-      anchor for the root zone (".").  Records returned by
+      anchors for the root zone (".") and for the ISC DNSSEC lookaside
+      validation zone ("dlv.isc.org").  Records returned by
       <command>delv</command> are either fully validated or
       were not signed.  If validation fails, an explanation of
       the failure is included in the output; the validation process
@@ -201,15 +199,14 @@
 	    Specifies a file from which to read DNSSEC trust anchors.
 	    The default is <filename>/etc/bind.keys</filename>, which
 	    is included with <acronym>BIND</acronym> 9 and contains
-	    one or more trust anchors for the root zone (".").
+	    trust anchors for the root zone (".") and for the ISC
+	    DNSSEC lookaside validation zone ("dlv.isc.org").
 	  </para>
 	  <para>
-	    Keys that do not match the root zone name are ignored.
-            An alternate key name can be specified using the
-	    <option>+root=NAME</option> options. DNSSEC Lookaside
-            Validation can also be turned on by using the
-	    <option>+dlv=NAME</option> to specify the name of a
-            zone containing DLV records.
+	    Keys that do not match the root or DLV trust-anchor
+	    names are ignored; these key names can be overridden
+	    using the <option>+dlv=NAME</option> or
+	    <option>+root=NAME</option> options.
 	  </para>
 	  <para>
 	    Note: When reading the trust anchor file,
@@ -639,8 +636,11 @@
 	    <para>
 	      Indicates whether to perform DNSSEC lookaside validation,
 	      and if so, specifies the name of the DLV trust anchor.
-	      The <option>-a</option> option must also be used to specify
-              a file containing the DLV key.
+	      The default is to perform lookaside validation using
+	      a trust anchor of "dlv.isc.org", for which there is a
+	      built-in key.  If specifying a different name, then
+	      <option>-a</option> must be used to specify a file
+	      containing the DLV key.
 	    </para>
 	  </listitem>
 	</varlistentry>

bin/delv/delv.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2014-2017 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2016 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -34,10 +34,8 @@
     <div class="cmdsynopsis"><p>
       <code class="command">delv</code> 
        [@server]
-       [
-	[<code class="option">-4</code>]
-	 |  [<code class="option">-6</code>]
-      ]
+       [<code class="option">-4</code>]
+       [<code class="option">-6</code>]
        [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>]
        [<code class="option">-b <em class="replaceable"><code>address</code></em></code>]
        [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
@@ -75,7 +73,7 @@
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
 
     <p><span class="command"><strong>delv</strong></span>
-      is a tool for sending
+      (Domain Entity Lookup &amp; Validation) is a tool for sending
       DNS queries and validating the results, using the same internal
       resolver and validator logic as <span class="command"><strong>named</strong></span>.
     </p>
@@ -91,7 +89,8 @@
     </p>
     <p>
       By default, responses are validated using built-in DNSSEC trust
-      anchor for the root zone (".").  Records returned by
+      anchors for the root zone (".") and for the ISC DNSSEC lookaside
+      validation zone ("dlv.isc.org").  Records returned by
       <span class="command"><strong>delv</strong></span> are either fully validated or
       were not signed.  If validation fails, an explanation of
       the failure is included in the output; the validation process
@@ -188,15 +187,14 @@
 	    Specifies a file from which to read DNSSEC trust anchors.
 	    The default is <code class="filename">/etc/bind.keys</code>, which
 	    is included with <acronym class="acronym">BIND</acronym> 9 and contains
-	    one or more trust anchors for the root zone (".").
+	    trust anchors for the root zone (".") and for the ISC
+	    DNSSEC lookaside validation zone ("dlv.isc.org").
 	  </p>
 	  <p>
-	    Keys that do not match the root zone name are ignored.
-            An alternate key name can be specified using the
-	    <code class="option">+root=NAME</code> options. DNSSEC Lookaside
-            Validation can also be turned on by using the
-	    <code class="option">+dlv=NAME</code> to specify the name of a
-            zone containing DLV records.
+	    Keys that do not match the root or DLV trust-anchor
+	    names are ignored; these key names can be overridden
+	    using the <code class="option">+dlv=NAME</code> or
+	    <code class="option">+root=NAME</code> options.
 	  </p>
 	  <p>
 	    Note: When reading the trust anchor file,
@@ -538,8 +536,11 @@
 	    <p>
 	      Indicates whether to perform DNSSEC lookaside validation,
 	      and if so, specifies the name of the DLV trust anchor.
-	      The <code class="option">-a</code> option must also be used to specify
-              a file containing the DLV key.
+	      The default is to perform lookaside validation using
+	      a trust anchor of "dlv.isc.org", for which there is a
+	      built-in key.  If specifying a different name, then
+	      <code class="option">-a</code> must be used to specify a file
+	      containing the DLV key.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]tcp</code></span></dt>

bin/delv/win32/delv.dsp.in

@@ -0,0 +1,103 @@
+# Microsoft Developer Studio Project File - Name="delv" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "@PLATFORM@ (x86) Console Application" 0x0103
+
+CFG=delv - @PLATFORM@ Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "delv.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "delv.mak" CFG="delv - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "delv - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "delv - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "delv - @PLATFORM@ Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 @COPTX@ @COPTI@ /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD CPP /nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/irs/win32/include" /I "../../../lib/irs/include" @CRYPTO@ /D "NDEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console @MACHINE@
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/irs/win32/Release/libirs.lib /nologo /subsystem:console @MACHINE@ /out:"../../../Build/Release/delv.exe"
+
+!ELSEIF  "$(CFG)" == "delv - @PLATFORM@ Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/irs/win32/include" /I "../../../lib/irs/include" @CRYPTO@ /D "_DEBUG" /D "WIN32" /D "__STDC__" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
+# SUBTRACT CPP /X @COPTY@
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug @MACHINE@ /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/irs/win32/Debug/libirs.lib /nologo /subsystem:console /debug @MACHINE@ /out:"../../../Build/Debug/delv.exe" /pdbtype:sept
+
+!ENDIF 
+
+# Begin Target
+
+# Name "delv - @PLATFORM@ Release"
+# Name "delv - @PLATFORM@ Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# Begin Source File
+
+SOURCE="..\delv.c"
+# End Source File
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# End Target
+# End Project

bin/delv/win32/delv.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "delv"=".\delv.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/delv/win32/delv.mak.in

@@ -0,0 +1,299 @@
+# Microsoft Developer Studio Generated NMAKE File, Based on delv.dsp
+!IF "$(CFG)" == ""
+CFG=delv - @PLATFORM@ Debug
+!MESSAGE No configuration specified. Defaulting to delv - @PLATFORM@ Debug.
+!ENDIF 
+
+!IF "$(CFG)" != "delv - @PLATFORM@ Release" && "$(CFG)" != "delv - @PLATFORM@ Debug"
+!MESSAGE Invalid configuration "$(CFG)" specified.
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "delv.mak" CFG="delv - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "delv - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "delv - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+!ERROR An invalid configuration is specified.
+!ENDIF 
+
+!IF "$(OS)" == "Windows_NT"
+NULL=
+!ELSE 
+NULL=nul
+!ENDIF 
+
+!IF  "$(CFG)" == "delv - @PLATFORM@ Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
+!IF  "$(CFG)" == "delv - @PLATFORM@ Release"
+
+OUTDIR=.\Release
+INTDIR=.\Release
+
+ALL : "..\..\..\Build\Release\delv.exe"
+
+
+CLEAN :
+	-@erase "$(INTDIR)\delv.obj"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "..\..\..\Build\Release\delv.exe"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP=cl.exe
+CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/irs/win32/include" /I "../../../lib/irs/include" @CRYPTO@ /D "NDEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /Fp"$(INTDIR)\delv.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+
+.c{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.c{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+RSC=rc.exe
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\delv.bsc" 
+BSC32_SBRS= \
+	
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/irs/win32/Release/libirs.lib /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\delv.pdb" @MACHINE@ /out:"../../../Build/Release/delv.exe" 
+LINK32_OBJS= \
+	"$(INTDIR)\delv.obj"
+
+"..\..\..\Build\Release\delv.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ELSEIF  "$(CFG)" == "delv - @PLATFORM@ Debug"
+
+OUTDIR=.\Debug
+INTDIR=.\Debug
+# Begin Custom Macros
+OutDir=.\Debug
+# End Custom Macros
+
+ALL : "..\..\..\Build\Debug\delv.exe" "$(OUTDIR)\delv.bsc"
+
+
+CLEAN :
+	-@erase "$(INTDIR)\delv.obj"
+	-@erase "$(INTDIR)\delv.sbr"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "$(INTDIR)\vc60.pdb"
+	-@erase "$(OUTDIR)\delv.pdb"
+	-@erase "$(OUTDIR)\delv.bsc"
+	-@erase "..\..\..\Build\Debug\delv.exe"
+	-@erase "..\..\..\Build\Debug\delv.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP=cl.exe
+CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/irs/win32/include" /I "../../../lib/irs/include" @CRYPTO@ /D "_DEBUG" /D "WIN32" /D "__STDC__" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+
+.c{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.c{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+RSC=rc.exe
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\delv.bsc" 
+BSC32_SBRS= \
+	"$(INTDIR)\delv.sbr"
+
+"$(OUTDIR)\delv.bsc" : "$(OUTDIR)" $(BSC32_SBRS)
+    $(BSC32) @<<
+  $(BSC32_FLAGS) $(BSC32_SBRS)
+<<
+
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/irs/win32/Debug/libirs.lib /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\delv.pdb" /debug @MACHINE@ /out:"../../../Build/Debug/delv.exe" /pdbtype:sept 
+LINK32_OBJS= \
+	"$(INTDIR)\delv.obj"
+
+"..\..\..\Build\Debug\delv.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ENDIF 
+
+
+!IF "$(NO_EXTERNAL_DEPS)" != "1"
+!IF EXISTS("delv.dep")
+!INCLUDE "delv.dep"
+!ELSE 
+!MESSAGE Warning: cannot find "delv.dep"
+!ENDIF 
+!ENDIF 
+
+
+!IF "$(CFG)" == "delv - @PLATFORM@ Release" || "$(CFG)" == "delv - @PLATFORM@ Debug"
+SOURCE="..\delv.c"
+
+!IF  "$(CFG)" == "delv - @PLATFORM@ Release"
+
+
+"$(INTDIR)\delv.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "delv - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\delv.obj"	"$(INTDIR)\delv.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+!ENDIF 
+
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/delv/win32/delv.vcxproj.in

@@ -61,7 +61,6 @@
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
       <AdditionalIncludeDirectories>..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\win32\include;..\..\..\lib\dns\include;..\..\..\lib\irs\win32\include;..\..\..\lib\irs\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -88,7 +87,6 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <AdditionalIncludeDirectories>..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\win32\include;..\..\..\lib\dns\include;..\..\..\lib\irs\win32\include;..\..\..\lib\irs\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>

bin/dig/Makefile.in

@@ -1,4 +1,4 @@
-# Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2012-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2012-2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -14,9 +14,9 @@ VERSION=@BIND9_VERSION@
 
 READLINE_LIB = @READLINE_LIB@
 
-CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
-		${BIND9_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @DST_OPENSSL_INC@
+CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${BIND9_INCLUDES} \
+		${ISC_INCLUDES} @DST_OPENSSL_INC@ \
+		${LWRES_INCLUDES} ${ISCCFG_INCLUDES}
 
 CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@
 CWARNINGS =
@@ -24,23 +24,23 @@ CWARNINGS =
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
-IRSLIBS =	../../lib/irs/libirs.@A@
+ISCLIBS =	../../lib/isc/libisc.@A@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
+LWRESLIBS =	../../lib/lwres/liblwres.@A@
 
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 BIND9DEPLIBS =	../../lib/bind9/libbind9.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
-IRSDEPLIBS =	../../lib/irs/libirs.@A@
+LWRESDEPLIBS =	../../lib/lwres/liblwres.@A@
 
-DEPLIBS =	${DNSDEPLIBS} ${IRSDEPLIBS} ${BIND9DEPLIBS} \
-		${ISCDEPLIBS} ${ISCCFGDEPLIBS}
+DEPLIBS =	${DNSDEPLIBS} ${BIND9DEPLIBS} ${ISCDEPLIBS} \
+		${ISCCFGDEPLIBS} ${LWRESDEPLIBS}
 
-LIBS =		${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
+LIBS =		${LWRESLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
 		${ISCLIBS} @IDNLIBS@ @LIBS@
 
-NOSYMLIBS =	${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
+NOSYMLIBS =	${LWRESLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
 		${ISCNOSYMLIBS} @IDNLIBS@ @LIBS@
 
 SUBDIRS =
@@ -63,17 +63,17 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
 
 dig@EXEEXT@: dig.@O@ dighost.@O@ ${UOBJS} ${DEPLIBS}
 	export BASEOBJS="dig.@O@ dighost.@O@ ${UOBJS}"; \
-	export LIBS0="${DNSLIBS} ${IRSLIBS}"; \
+	export LIBS0="${DNSLIBS}"; \
 	${FINALBUILDCMD}
 
 host@EXEEXT@: host.@O@ dighost.@O@ ${UOBJS} ${DEPLIBS}
 	export BASEOBJS="host.@O@ dighost.@O@ ${UOBJS}"; \
-	export LIBS0="${DNSLIBS} ${IRSLIBS}"; \
+	export LIBS0="${DNSLIBS}"; \
 	${FINALBUILDCMD}
 
 nslookup@EXEEXT@: nslookup.@O@ dighost.@O@ ${UOBJS} ${DEPLIBS}
 	export BASEOBJS="nslookup.@O@ dighost.@O@ ${READLINE_LIB} ${UOBJS}"; \
-	export LIBS0="${DNSLIBS} ${IRSLIBS}"; \
+	export LIBS0="${DNSLIBS}"; \
 	${FINALBUILDCMD}
 
 doc man:: ${MANOBJS}

bin/dig/dig.1

@@ -39,7 +39,7 @@
 dig \- DNS lookup utility
 .SH "SYNOPSIS"
 .HP \w'\fBdig\fR\ 'u
-\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-m\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIname:key\fR\fR] [[\fB\-4\fR] | [\fB\-6\fR]] [name] [type] [class] [queryopt...]
+\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-m\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...]
 .HP \w'\fBdig\fR\ 'u
 \fBdig\fR [\fB\-h\fR]
 .HP \w'\fBdig\fR\ 'u
@@ -47,7 +47,7 @@ dig \- DNS lookup utility
 .SH "DESCRIPTION"
 .PP
 \fBdig\fR
-is a flexible tool for interrogating DNS name servers\&. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried\&. Most DNS administrators use
+(domain information groper) is a flexible tool for interrogating DNS name servers\&. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried\&. Most DNS administrators use
 \fBdig\fR
 to troubleshoot DNS problems because of its flexibility, ease of use and clarity of output\&. Other lookup tools tend to have less functionality than
 \fBdig\fR\&.
@@ -428,11 +428,6 @@ Specify EDNS option with code point
 and optionally payload of
 \fBvalue\fR
 as a hexadecimal string\&.
-\fBcode\fR
-can be either an EDNS option name (for example,
-NSID
-or
-ECS), or an arbitrary numeric value\&.
 \fB+noednsopt\fR
 clears the EDNS options to be sent\&.
 .RE
@@ -528,15 +523,6 @@ Print only one (starting) SOA record when performing an AXFR\&. The default is t
 Set [restore] the DNS message opcode to the specified value\&. The default value is QUERY (0)\&.
 .RE
 .PP
-\fB+padding=value\fR
-.RS 4
-Pad the size of the query packet using the EDNS Padding option to blocks of
-\fIvalue\fR
-bytes\&. For example,
-\fB+padding=32\fR
-would cause a 48\-byte query to be padded to 64 bytes\&. The default block size is 0, which disables padding\&. The maximum is 512\&. Values are ordinarily expected to be powers of two, such as 128; however, this is not mandatory\&. Responses to padded queries may also be padded, but only if the query uses TCP or DNS COOKIE\&.
-.RE
-.PP
 \fB+[no]qr\fR
 .RS 4
 Print [do not print] the query as it is sent\&. By default, the query is not printed\&.
@@ -602,7 +588,7 @@ Perform [do not perform] a search showing intermediate results\&.
 .PP
 \fB+[no]sigchase\fR
 .RS 4
-This feature is now obsolete and has been removed; use
+Chase DNSSEC signature chains\&. Requires dig be compiled with \-DDIG_SIGCHASE\&. This feature is deprecated\&. Use
 \fBdelv\fR
 instead\&.
 .RE
@@ -638,9 +624,7 @@ be used when resolving this query\&.
 .PP
 \fB+[no]tcp\fR
 .RS 4
-Use [do not use] TCP when querying name servers\&. The default behavior is to use UDP unless a type
-any
-or
+Use [do not use] TCP when querying name servers\&. The default behavior is to use UDP unless an
 ixfr=N
 query is requested, in which case the default is TCP\&. AXFR queries always use TCP\&.
 .RE
@@ -656,8 +640,7 @@ to less than 1 will result in a query timeout of 1 second being applied\&.
 .PP
 \fB+[no]topdown\fR
 .RS 4
-This feature is related to
-\fBdig +sigchase\fR, which is obsolete and has been removed\&. Use
+When chasing DNSSEC signature chains perform a top\-down validation\&. Requires dig be compiled with \-DDIG_SIGCHASE\&. This feature is deprecated\&. Use
 \fBdelv\fR
 instead\&.
 .RE
@@ -685,8 +668,18 @@ is less than or equal to zero, the number of tries is silently rounded up to 1\&
 .PP
 \fB+trusted\-key=####\fR
 .RS 4
-Formerly specified trusted keys for use with
-\fBdig +sigchase\fR\&. This feature is now obsolete and has been removed; use
+Specifies a file containing trusted keys to be used with
+\fB+sigchase\fR\&. Each DNSKEY record must be on its own line\&.
+.sp
+If not specified,
+\fBdig\fR
+will look for
+/etc/trusted\-key\&.key
+then
+trusted\-key\&.key
+in the current directory\&.
+.sp
+Requires dig be compiled with \-DDIG_SIGCHASE\&. This feature is deprecated\&. Use
 \fBdelv\fR
 instead\&.
 .RE
@@ -729,11 +722,9 @@ In this case, each
 \fIquery\fR
 argument represent an individual query in the command\-line syntax described above\&. Each consists of any of the standard options and flags, the name to be looked up, an optional query type and class and any query options that should be applied to that query\&.
 .PP
-A global set of query options, which should be applied to all queries, can also be supplied\&. These global query options must precede the first tuple of name, class, type, options, flags, and query options supplied on the command line\&. Any global query options (except
+A global set of query options, which should be applied to all queries, can also be supplied\&. These global query options must precede the first tuple of name, class, type, options, flags, and query options supplied on the command line\&. Any global query options (except the
 \fB+[no]cmd\fR
-and
-\fB+[no]short\fR
-options) can be overridden by a query\-specific set of query options\&. For example:
+option) can be overridden by a query\-specific set of query options\&. For example:
 .sp
 .if n \{\
 .RS 4

bin/dig/dig.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2000-2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -16,7 +16,6 @@
 #include <isc/app.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
-#include <isc/platform.h>
 #include <isc/print.h>
 #include <isc/string.h>
 #include <isc/task.h>
@@ -60,9 +59,15 @@ static char hexcookie[81];
 
 static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE,
 	ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE,
+	multiline = ISC_FALSE, nottl = ISC_FALSE, noclass = ISC_FALSE,
+	onesoa = ISC_FALSE, use_usec = ISC_FALSE,
+	nocrypto = ISC_FALSE, ttlunits = ISC_FALSE,
 	ipv4only = ISC_FALSE, ipv6only = ISC_FALSE;
 static isc_uint32_t splitwidth = 0xffffffff;
 
+/*% rrcomments are neither explicitly enabled nor disabled by default */
+static int rrcomments = 0;
+
 /*% opcode text */
 static const char * const opcodetext[] = {
 	"QUERY",
@@ -183,7 +188,6 @@ help(void) {
 "                 +[no]identify       (ID responders in short answers)\n"
 "                 +[no]idnout         (convert IDN response)\n"
 "                 +[no]ignore         (Don't revert to TCP for TC responses.)\n"
-"                 +[no]keepalive      (Request EDNS TCP keepalive)\n"
 "                 +[no]keepopen       (Keep the TCP socket open between queries)\n"
 "                 +[no]mapped         (Allow mapped IPv4 over IPv6)\n"
 "                 +[no]multiline      (Print records in an expanded format)\n"
@@ -192,7 +196,6 @@ help(void) {
 "                 +[no]nssearch       (Search all authoritative nameservers)\n"
 "                 +[no]onesoa         (AXFR prints only one soa record)\n"
 "                 +[no]opcode=###     (Set the opcode of the request)\n"
-"                 +padding=###        (Set padding block size [0])\n"
 "                 +[no]qr             (Print question before sending)\n"
 "                 +[no]question       (Control display of question section)\n"
 "                 +[no]rdflag         (Recursive mode (+[no]recurse))\n"
@@ -204,12 +207,21 @@ help(void) {
 "                 +[no]short          (Display nothing except short\n"
 "                                      form of answer)\n"
 "                 +[no]showsearch     (Search with intermediate results)\n"
+#ifdef DIG_SIGCHASE
+"                 +[no]sigchase       (Chase DNSSEC signatures)\n"
+#endif
 "                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
 "                 +[no]stats          (Control display of statistics)\n"
 "                 +subnet=addr        (Set edns-client-subnet option)\n"
 "                 +[no]tcp            (TCP mode (+[no]vc))\n"
 "                 +timeout=###        (Set query timeout) [5]\n"
+#if defined(DIG_SIGCHASE) && DIG_SIGCHASE_TD
+"                 +[no]topdown        (Do +sigchase in top-down mode)\n"
+#endif
 "                 +[no]trace          (Trace delegation down from root [+dnssec])\n"
+#ifdef DIG_SIGCHASE
+"                 +trusted-key=####   (Trusted Key to use with +sigchase)\n"
+#endif
 "                 +tries=###          (Set number of UDP attempts) [3]\n"
 "                 +[no]ttlid          (Control display of ttls in records)\n"
 "                 +[no]ttlunits       (Display TTLs in human-readable units)\n"
@@ -226,47 +238,28 @@ help(void) {
 /*%
  * Callback from dighost.c to print the received message.
  */
-static void
+void
 received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 	isc_uint64_t diff;
 	time_t tnow;
 	struct tm tmnow;
-#ifdef WIN32
-	wchar_t time_str[100];
-#else
 	char time_str[100];
-#endif
 	char fromtext[ISC_SOCKADDR_FORMATSIZE];
 
 	isc_sockaddr_format(from, fromtext, sizeof(fromtext));
 
 	if (query->lookup->stats && !short_form) {
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
-		if (query->lookup->use_usec)
+		if (use_usec)
 			printf(";; Query time: %ld usec\n", (long) diff);
 		else
 			printf(";; Query time: %ld msec\n", (long) diff / 1000);
 		printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
 		time(&tnow);
-#if defined(ISC_PLATFORM_USETHREADS) && !defined(WIN32)
-		(void)localtime_r(&tnow, &tmnow);
-#else
 		tmnow  = *localtime(&tnow);
-#endif
-
-#ifdef WIN32
-		/*
-		 * On Windows, time zone name ("%Z") may be a localized
-		 * wide-character string, which strftime() handles incorrectly.
-		 */
-		if (wcsftime(time_str, sizeof(time_str)/sizeof(time_str[0]),
-			     L"%a %b %d %H:%M:%S %Z %Y", &tmnow) > 0U)
-			printf(";; WHEN: %ls\n", time_str);
-#else
 		if (strftime(time_str, sizeof(time_str),
 			     "%a %b %d %H:%M:%S %Z %Y", &tmnow) > 0U)
 			printf(";; WHEN: %s\n", time_str);
-#endif
 		if (query->lookup->doing_xfr) {
 			printf(";; XFR size: %u records (messages %u, "
 			       "bytes %" ISC_PRINT_QUADFORMAT "u)\n",
@@ -286,7 +279,7 @@ received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		puts("");
 	} else if (query->lookup->identify && !short_form) {
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
-		if (query->lookup->use_usec)
+		if (use_usec)
 			printf(";; Received %" ISC_PRINT_QUADFORMAT "u bytes "
 			       "from %s(%s) in %ld us\n\n",
 			       query->lookup->doing_xfr
@@ -308,7 +301,7 @@ received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
  * Not used in dig.
  * XXX print_trying
  */
-static void
+void
 trying(char *frm, dig_lookup_t *lookup) {
 	UNUSED(frm);
 	UNUSED(lookup);
@@ -321,7 +314,7 @@ static isc_result_t
 say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	isc_result_t result;
 	isc_uint64_t diff;
-	char store[sizeof(" in 18446744073709551616 us.")];
+	char store[sizeof("12345678901234567890")];
 	unsigned int styleflags = 0;
 
 	if (query->lookup->trace || query->lookup->ns_search_only) {
@@ -332,9 +325,9 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	}
 
 	/* Turn on rrcomments if explicitly enabled */
-	if (query->lookup->rrcomments > 0)
+	if (rrcomments > 0)
 		styleflags |= DNS_STYLEFLAG_RRCOMMENT;
-	if (query->lookup->nocrypto)
+	if (nocrypto)
 		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
 	if (query->lookup->print_unknown_format)
 		styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
@@ -344,14 +337,13 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 		return (result);
 	check_result(result, "dns_rdata_totext");
 	if (query->lookup->identify) {
-
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		ADD_STRING(buf, " from server ");
 		ADD_STRING(buf, query->servname);
-		if (query->lookup->use_usec)
-			snprintf(store, sizeof(store), " in %" ISC_PLATFORM_QUADFORMAT "u us.", diff);
+		if (use_usec)
+			snprintf(store, 19, " in %ld us.", (long) diff);
 		else
-			snprintf(store, sizeof(store), " in %" ISC_PLATFORM_QUADFORMAT "u ms.", diff / 1000);
+			snprintf(store, 19, " in %ld ms.", (long) diff / 1000);
 		ADD_STRING(buf, store);
 	}
 	ADD_STRING(buf, "\n");
@@ -408,37 +400,70 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags,
 
 	return (ISC_R_SUCCESS);
 }
-
-static isc_boolean_t
-isdotlocal(dns_message_t *msg) {
+#ifdef DIG_SIGCHASE
+isc_result_t
+printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,
+	      isc_buffer_t *target)
+{
 	isc_result_t result;
-	static unsigned char local_ndata[] = { "\005local\0" };
-	static unsigned char local_offsets[] = { 0, 6 };
-	static dns_name_t local = {
-		DNS_NAME_MAGIC,
-		local_ndata, 7, 2,
-		DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
-		local_offsets, NULL,
-		{(void *)-1, (void *)-1},
-		{NULL, NULL}
-	};
+	dns_master_style_t *style = NULL;
+	unsigned int styleflags = 0;
 
-	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(msg, DNS_SECTION_QUESTION))
-	{
-		dns_name_t *name = NULL;
-		dns_message_currentname(msg, DNS_SECTION_QUESTION, &name);
-		if (dns_name_issubdomain(name, &local))
-			return (ISC_TRUE);
+	if (rdataset == NULL || owner_name == NULL || target == NULL)
+		return(ISC_FALSE);
+
+	styleflags |= DNS_STYLEFLAG_REL_OWNER;
+	if (ttlunits)
+		styleflags |= DNS_STYLEFLAG_TTL_UNITS;
+	if (nottl)
+		styleflags |= DNS_STYLEFLAG_NO_TTL;
+	if (noclass)
+		styleflags |= DNS_STYLEFLAG_NO_CLASS;
+	if (nocrypto)
+		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
+	/* Turn on rrcomments if explicitly enabled */
+	if (rrcomments > 0)
+		styleflags |= DNS_STYLEFLAG_RRCOMMENT;
+	if (multiline) {
+		styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
+		styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
+		styleflags |= DNS_STYLEFLAG_REL_DATA;
+		styleflags |= DNS_STYLEFLAG_OMIT_TTL;
+		styleflags |= DNS_STYLEFLAG_TTL;
+		styleflags |= DNS_STYLEFLAG_MULTILINE;
+		styleflags |= DNS_STYLEFLAG_COMMENT;
+		/* Turn on rrcomments if not explicitly disabled */
+		if (rrcomments >= 0)
+			styleflags |= DNS_STYLEFLAG_RRCOMMENT;
 	}
-	return (ISC_FALSE);
+
+	if (multiline || (nottl && noclass))
+		result = dns_master_stylecreate2(&style, styleflags,
+						24, 24, 24, 32, 80, 8,
+						splitwidth, mctx);
+	else if (nottl || noclass)
+		result = dns_master_stylecreate2(&style, styleflags,
+						24, 24, 32, 40, 80, 8,
+						splitwidth, mctx);
+	else
+		result = dns_master_stylecreate2(&style, styleflags,
+						24, 32, 40, 48, 80, 8,
+						splitwidth, mctx);
+	check_result(result, "dns_master_stylecreate");
+
+	result = dns_master_rdatasettotext(owner_name, rdataset, style, target);
+
+	if (style != NULL)
+		dns_master_styledestroy(&style, mctx);
+
+	return(result);
 }
+#endif
 
 /*
  * Callback from dighost.c to print the reply from a server
  */
-static isc_result_t
+isc_result_t
 printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	isc_result_t result;
 	dns_messagetextflag_t flags;
@@ -453,17 +478,17 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	if (query->lookup->print_unknown_format)
 		styleflags |= DNS_STYLEFLAG_UNKNOWNFORMAT;
 	/* Turn on rrcomments if explicitly enabled */
-	if (query->lookup->rrcomments > 0)
+	if (rrcomments > 0)
 		styleflags |= DNS_STYLEFLAG_RRCOMMENT;
-	if (query->lookup->ttlunits)
+	if (ttlunits)
 		styleflags |= DNS_STYLEFLAG_TTL_UNITS;
-	if (query->lookup->nottl)
+	if (nottl)
 		styleflags |= DNS_STYLEFLAG_NO_TTL;
-	if (query->lookup->noclass)
+	if (noclass)
 		styleflags |= DNS_STYLEFLAG_NO_CLASS;
-	if (query->lookup->nocrypto)
+	if (nocrypto)
 		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
-	if (query->lookup->multiline) {
+	if (multiline) {
 		styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
 		styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
 		styleflags |= DNS_STYLEFLAG_REL_DATA;
@@ -471,15 +496,14 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		styleflags |= DNS_STYLEFLAG_TTL;
 		styleflags |= DNS_STYLEFLAG_MULTILINE;
 		/* Turn on rrcomments unless explicitly disabled */
-		if (query->lookup->rrcomments >= 0)
+		if (rrcomments >= 0)
 			styleflags |= DNS_STYLEFLAG_RRCOMMENT;
 	}
-	if (query->lookup->multiline ||
-	    (query->lookup->nottl && query->lookup->noclass))
+	if (multiline || (nottl && noclass))
 		result = dns_master_stylecreate2(&style, styleflags,
 						 24, 24, 24, 32, 80, 8,
 						 splitwidth, mctx);
-	else if (query->lookup->nottl || query->lookup->noclass)
+	else if (nottl || noclass)
 		result = dns_master_stylecreate2(&style, styleflags,
 						 24, 24, 32, 40, 80, 8,
 						 splitwidth, mctx);
@@ -503,8 +527,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		flags |= DNS_MESSAGETEXTFLAG_NOHEADERS;
 		flags |= DNS_MESSAGETEXTFLAG_NOCOMMENTS;
 	}
-	if (query->lookup->onesoa &&
-	    query->lookup->rdtype == dns_rdatatype_axfr)
+	if (onesoa && query->lookup->rdtype == dns_rdatatype_axfr)
 		flags |= (query->msg_count == 0) ? DNS_MESSAGETEXTFLAG_ONESOA :
 						   DNS_MESSAGETEXTFLAG_OMITSOA;
 	if (!query->lookup->comments)
@@ -522,12 +545,6 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 			printf(";; Got answer:\n");
 
 		if (headers) {
-			if (isdotlocal(msg)) {
-				printf(";; WARNING: .local is reserved for "
-				       "Multicast DNS\n;; You are currently "
-				       "testing what happens when an mDNS "
-				       "query is leaked to DNS\n");
-			}
 			printf(";; ->>HEADER<<- opcode: %s, status: %s, "
 			       "id: %u\n",
 			       opcodetext[msg->opcode],
@@ -683,27 +700,33 @@ cleanup:
 static void
 printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 	int i;
+	size_t remaining;
 	static isc_boolean_t first = ISC_TRUE;
 	char append[MXNAME];
 
 	if (printcmd) {
+		lookup->cmdline[sizeof(lookup->cmdline) - 1] = 0;
 		snprintf(lookup->cmdline, sizeof(lookup->cmdline),
 			 "%s; <<>> DiG " VERSION " <<>>",
 			 first?"\n":"");
 		i = 1;
 		while (i < argc) {
 			snprintf(append, sizeof(append), " %s", argv[i++]);
-			strlcat(lookup->cmdline, append,
-				sizeof(lookup->cmdline));
+			remaining = sizeof(lookup->cmdline) -
+				    strlen(lookup->cmdline) - 1;
+			strncat(lookup->cmdline, append, remaining);
 		}
-		strlcat(lookup->cmdline, "\n", sizeof(lookup->cmdline));
+		remaining = sizeof(lookup->cmdline) -
+			    strlen(lookup->cmdline) - 1;
+		strncat(lookup->cmdline, "\n", remaining);
 		if (first && addresscount != 0) {
 			snprintf(append, sizeof(append),
 				 "; (%d server%s found)\n",
 				 addresscount,
 				 addresscount > 1 ? "s" : "");
-			strlcat(lookup->cmdline, append,
-				sizeof(lookup->cmdline));
+			remaining = sizeof(lookup->cmdline) -
+				    strlen(lookup->cmdline) - 1;
+			strncat(lookup->cmdline, append, remaining);
 		}
 		if (first) {
 			snprintf(append, sizeof(append),
@@ -711,8 +734,9 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 				 short_form ? " +short" : "",
 				 printcmd ? " +cmd" : "");
 			first = ISC_FALSE;
-			strlcat(lookup->cmdline, append,
-				sizeof(lookup->cmdline));
+			remaining = sizeof(lookup->cmdline) -
+				    strlen(lookup->cmdline) - 1;
+			strncat(lookup->cmdline, append, remaining);
 		}
 	}
 }
@@ -735,7 +759,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 	isc_boolean_t state = ISC_TRUE;
 	size_t n;
 
-	strlcpy(option_store, option, sizeof(option_store));
+	strncpy(option_store, option, sizeof(option_store));
+	option_store[sizeof(option_store)-1]=0;
 	ptr = option_store;
 	cmd = next_token(&ptr, "=");
 	if (cmd == NULL) {
@@ -848,7 +873,7 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 		case 'l': /* class */
 			/* keep +cl for backwards compatibility */
 			FULLCHECK2("cl", "class");
-			lookup->noclass = ISC_TF(!state);
+			noclass = ISC_TF(!state);
 			break;
 		case 'm': /* cmd */
 			FULLCHECK("cmd");
@@ -882,7 +907,7 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			break;
 		case 'r':
 			FULLCHECK("crypto");
-			lookup->nocrypto = ISC_TF(!state);
+			nocrypto = ISC_TF(!state);
 			break;
 		default:
 			goto invalid_option;
@@ -898,20 +923,18 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			break;
 		case 'n': /* dnssec */
 			FULLCHECK("dnssec");
- dnssec:
 			if (state && lookup->edns == -1)
 				lookup->edns = 0;
 			lookup->dnssec = state;
 			break;
-		case 'o': /* domain ... but treat "do" as synonym for dnssec */
-			if (cmd[2] == '\0')
-				goto dnssec;
+		case 'o': /* domain */
 			FULLCHECK("domain");
 			if (value == NULL)
 				goto need_value;
 			if (!state)
 				goto invalid_option;
-			strlcpy(domainopt, value, sizeof(domainopt));
+			strncpy(domainopt, value, sizeof(domainopt));
+			domainopt[sizeof(domainopt)-1] = '\0';
 			break;
 		case 's': /* dscp */
 			FULLCHECK("dscp");
@@ -1050,36 +1073,8 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 		}
 		break;
 	case 'k':
-		switch (cmd[1]) {
-		case 'e':
-			switch (cmd[2]) {
-			case 'e':
-				switch (cmd[3]) {
-				case 'p':
-					switch (cmd[4]) {
-					case 'a':
-						FULLCHECK("keepalive");
-						lookup->tcp_keepalive = state;
-						break;
-					case 'o':
-						FULLCHECK("keepopen");
-						keep_open = state;
-						break;
-					default:
-						goto invalid_option;
-					}
-					break;
-				default:
-					goto invalid_option;
-				}
-				break;
-			default:
-				goto invalid_option;
-			}
-			break;
-		default:
-			goto invalid_option;
-		}
+		FULLCHECK("keepopen");
+		keep_open = state;
 		break;
 	case 'm': /* multiline */
 		switch (cmd[1]) {
@@ -1089,7 +1084,7 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			break;
 		case 'u':
 			FULLCHECK("multiline");
-			lookup->multiline = state;
+			multiline = state;
 			break;
 		default:
 			goto invalid_option;
@@ -1131,7 +1126,7 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 					lookup->rdtype = dns_rdatatype_ns;
 					lookup->rdtypeset = ISC_TRUE;
 					short_form = ISC_TRUE;
-					lookup->rrcomments = 0;
+					rrcomments = 0;
 				}
 				break;
 			default:
@@ -1146,7 +1141,7 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 		switch (cmd[1]) {
 		case 'n':
 			FULLCHECK("onesoa");
-			lookup->onesoa = state;
+			onesoa = state;
 			break;
 		case 'p':
 			FULLCHECK("opcode");
@@ -1175,22 +1170,11 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			goto invalid_option;
 		}
 		break;
-	case 'p':
-		FULLCHECK("padding");
-		if (state && lookup->edns == -1)
-			lookup->edns = 0;
-		if (value == NULL)
-			goto need_value;
-		result = parse_uint(&num, value, 512, "padding");
-		if (result != ISC_R_SUCCESS)
-			fatal("Couldn't parse padding");
-		lookup->padding = (isc_uint16_t)num;
-		break;
 	case 'q':
 		switch (cmd[1]) {
 		case 'r': /* qr */
 			FULLCHECK("qr");
-			lookup->qr = state;
+			qr = state;
 			break;
 		case 'u': /* question */
 			FULLCHECK("question");
@@ -1232,7 +1216,7 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			break;
 		case 'r': /* rrcomments */
 			FULLCHECK("rrcomments");
-			lookup->rrcomments = state ? 1 : -1;
+			rrcomments = state ? 1 : -1;
 			break;
 		default:
 			goto invalid_option;
@@ -1261,7 +1245,7 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 					lookup->section_question = ISC_FALSE;
 					lookup->comments = ISC_FALSE;
 					lookup->stats = ISC_FALSE;
-					lookup->rrcomments = -1;
+					rrcomments = -1;
 				}
 				break;
 			case 'w': /* showsearch */
@@ -1275,10 +1259,14 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				goto invalid_option;
 			}
 			break;
+#ifdef DIG_SIGCHASE
 		case 'i': /* sigchase */
 			FULLCHECK("sigchase");
-			fprintf(stderr, ";; +sigchase option is deprecated");
+			lookup->sigchase = state;
+			if (lookup->sigchase)
+				lookup->dnssec = ISC_TRUE;
 			break;
+#endif
 		case 'p': /* split */
 			FULLCHECK("split");
 			if (value != NULL && !state)
@@ -1326,10 +1314,7 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			}
 			if (lookup->edns == -1)
 				lookup->edns = 0;
-			if (lookup->ecs_addr != NULL) {
-				isc_mem_free(mctx, lookup->ecs_addr);
-				lookup->ecs_addr = NULL;
-			}
+
 			result = parse_netprefix(&lookup->ecs_addr, value);
 			if (result != ISC_R_SUCCESS)
 				fatal("Couldn't parse client");
@@ -1360,10 +1345,12 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 			if (timeout == 0)
 				timeout = 1;
 			break;
-		case 'o':
+#if DIG_SIGCHASE_TD
+		case 'o': /* topdown */
 			FULLCHECK("topdown");
-			fprintf(stderr, ";; +topdown option is deprecated");
+			lookup->do_topdown = state;
 			break;
+#endif
 		case 'r':
 			switch (cmd[2]) {
 			case 'a': /* trace */
@@ -1374,7 +1361,7 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 					lookup->recurse = ISC_FALSE;
 					lookup->identify = ISC_TRUE;
 					lookup->comments = ISC_FALSE;
-					lookup->rrcomments = 0;
+					rrcomments = 0;
 					lookup->stats = ISC_FALSE;
 					lookup->section_additional = ISC_FALSE;
 					lookup->section_authority = ISC_TRUE;
@@ -1397,11 +1384,19 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				if (lookup->retries == 0)
 					lookup->retries = 1;
 				break;
+#ifdef DIG_SIGCHASE
 			case 'u': /* trusted-key */
 				FULLCHECK("trusted-key");
-				fprintf(stderr, ";; +trusted-key option is "
-					"deprecated");
+				if (value == NULL)
+					goto need_value;
+				if (!state)
+					goto invalid_option;
+				n = strlcpy(trustedkey, ptr,
+					    sizeof(trustedkey));
+				if (n >= sizeof(trustedkey))
+					fatal("trusted key too large");
 				break;
+#endif
 			default:
 				goto invalid_option;
 			}
@@ -1413,12 +1408,12 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 				case 0:
 				case 'i': /* ttlid */
 					FULLCHECK2("ttl", "ttlid");
-					lookup->nottl = ISC_TF(!state);
+					nottl = ISC_TF(!state);
 					break;
 				case 'u': /* ttlunits */
 					FULLCHECK("ttlunits");
-					lookup->nottl = ISC_FALSE;
-					lookup->ttlunits = ISC_TF(state);
+					nottl = ISC_FALSE;
+					ttlunits = ISC_TF(state);
 					break;
 				default:
 					goto invalid_option;
@@ -1533,7 +1528,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			/* deprecated */
 			break;
 		case 'u':
-			(*lookup)->use_usec = ISC_TRUE;
+			use_usec = ISC_TRUE;
 			break;
 		case 'v':
 			version();
@@ -1603,7 +1598,8 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		batchname = value;
 		return (value_from_next);
 	case 'k':
-		strlcpy(keyfile, value, sizeof(keyfile));
+		strncpy(keyfile, value, sizeof(keyfile));
+		keyfile[sizeof(keyfile)-1]=0;
 		return (value_from_next);
 	case 'p':
 		result = parse_uint(&num, value, MAXPORT, "port number");
@@ -1617,8 +1613,9 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				(*lookup) = clone_lookup(default_lookup,
 							 ISC_TRUE);
 			*need_clone = ISC_TRUE;
-			strlcpy((*lookup)->textname, value,
+			strncpy((*lookup)->textname, value,
 				sizeof((*lookup)->textname));
+			(*lookup)->textname[sizeof((*lookup)->textname)-1]=0;
 			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
 						     (*lookup)->ns_search_only);
 			(*lookup)->new_search = ISC_TRUE;
@@ -1670,9 +1667,6 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				if (rdtype == dns_rdatatype_axfr) {
 					(*lookup)->section_question = plusquest;
 					(*lookup)->comments = pluscomm;
-				} else if (rdtype == dns_rdatatype_any) {
-					if (!(*lookup)->tcp_mode_set)
-						(*lookup)->tcp_mode = ISC_TRUE;
 				}
 				(*lookup)->ixfr_serial = ISC_FALSE;
 			}
@@ -1702,8 +1696,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 #endif
 			digestbits = 0;
 		}
-		strlcpy(keynametext, ptr, sizeof(keynametext));
-		strlcpy(keysecret, ptr2, sizeof(keysecret));
+		strncpy(keynametext, ptr, sizeof(keynametext));
+		keynametext[sizeof(keynametext)-1]=0;
+		strncpy(keysecret, ptr2, sizeof(keysecret));
+		keysecret[sizeof(keysecret)-1]=0;
 		return (value_from_next);
 	case 'x':
 		if (*need_clone)
@@ -1711,8 +1707,9 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		*need_clone = ISC_TRUE;
 		if (get_reverse(textname, sizeof(textname), value,
 				ip6_int, ISC_FALSE) == ISC_R_SUCCESS) {
-			strlcpy((*lookup)->textname, textname,
+			strncpy((*lookup)->textname, textname,
 				sizeof((*lookup)->textname));
+			(*lookup)->textname[sizeof((*lookup)->textname)-1] = 0;
 			debug("looking up %s", (*lookup)->textname);
 			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
 						(*lookup)->ns_search_only);
@@ -1980,10 +1977,6 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 								plusquest;
 						    lookup->comments = pluscomm;
 						}
-						if (rdtype ==
-						    dns_rdatatype_any &&
-						    !lookup->tcp_mode_set)
-							lookup->tcp_mode = ISC_TRUE;
 						lookup->ixfr_serial = ISC_FALSE;
 					}
 					continue;
@@ -2006,8 +1999,9 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 					lookup = clone_lookup(default_lookup,
 								      ISC_TRUE);
 				need_clone = ISC_TRUE;
-				strlcpy(lookup->textname, rv[0],
+				strncpy(lookup->textname, rv[0],
 					sizeof(lookup->textname));
+				lookup->textname[sizeof(lookup->textname)-1]=0;
 				lookup->trace_root = ISC_TF(lookup->trace  ||
 						     lookup->ns_search_only);
 				lookup->new_search = ISC_TRUE;
@@ -2073,7 +2067,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		lookup->trace_root = ISC_TF(lookup->trace ||
 					    lookup->ns_search_only);
 		lookup->new_search = ISC_TRUE;
-		strlcpy(lookup->textname, ".", sizeof(lookup->textname));
+		strcpy(lookup->textname, ".");
 		lookup->rdtype = dns_rdatatype_ns;
 		lookup->rdtypeset = ISC_TRUE;
 		if (firstarg) {
@@ -2091,8 +2085,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
  * Here, we're possibly reading from a batch file, then shutting down
  * for real if there's nothing in the batch file to read.
  */
-static void
-query_finished(void) {
+void
+dighost_shutdown(void) {
 	char batchline[MXNAME];
 	int bargc;
 	char *bargv[16];
@@ -2138,38 +2132,23 @@ query_finished(void) {
 	}
 }
 
-void dig_setup(int argc, char **argv)
-{
+/*% Main processing routine for dig */
+int
+main(int argc, char **argv) {
 	isc_result_t result;
 
 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
 	ISC_LIST_INIT(search_list);
 
-	debug("dig_setup()");
-
-	/* setup dighost callbacks */
-	dighost_printmessage = printmessage;
-	dighost_received = received;
-	dighost_trying = trying;
-	dighost_shutdown = query_finished;
-
+	debug("main()");
 	progname = argv[0];
 	preparse_args(argc, argv);
-
 	result = isc_app_start();
 	check_result(result, "isc_app_start");
-
 	setup_libs();
 	setup_system(ipv4only, ipv6only);
-}
-
-void dig_query_setup(isc_boolean_t is_batchfile, isc_boolean_t config_only,
-		int argc, char **argv)
-{
-	debug("dig_query_setup");
-
-	parse_args(is_batchfile, config_only, argc, argv);
+	parse_args(ISC_FALSE, ISC_FALSE, argc, argv);
 	if (keyfile[0] != 0)
 		setup_file_key();
 	else if (keysecret[0] != 0)
@@ -2178,44 +2157,20 @@ void dig_query_setup(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		set_search_domain(domainopt);
 		usesearch = ISC_TRUE;
 	}
-}
-
-void dig_startup() {
-	isc_result_t result;
-
-	debug("dig_startup()");
-
 	result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
 	check_result(result, "isc_app_onrun");
 	isc_app_run();
-}
-
-void dig_query_start()
-{
-	start_lookup();
-}
-
-void
-dig_shutdown() {
 	destroy_lookup(default_lookup);
 	if (batchname != NULL) {
 		if (batchfp != stdin)
 			fclose(batchfp);
 		batchname = NULL;
 	}
+#ifdef DIG_SIGCHASE
+	clean_trustedkey();
+#endif
 	cancel_all();
 	destroy_libs();
 	isc_app_finish();
-}
-
-/*% Main processing routine for dig */
-int
-main(int argc, char **argv) {
-
-	dig_setup(argc, argv);
-	dig_query_setup(ISC_FALSE, ISC_FALSE, argc, argv);
-	dig_startup();
-	dig_shutdown();
-
 	return (exitcode);
 }

bin/dig/dig.docbook

@@ -67,10 +67,8 @@
       <arg choice="opt" rep="norepeat"><option>-v</option></arg>
       <arg choice="opt" rep="norepeat"><option>-x <replaceable class="parameter">addr</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-y <replaceable class="parameter"><optional>hmac:</optional>name:key</replaceable></option></arg>
-      <group choice="opt" rep="norepeat">
-	<arg choice="opt" rep="norepeat"><option>-4</option></arg>
-	<arg choice="opt" rep="norepeat"><option>-6</option></arg>
-      </group>
+      <arg choice="opt" rep="norepeat"><option>-4</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-6</option></arg>
       <arg choice="opt" rep="norepeat">name</arg>
       <arg choice="opt" rep="norepeat">type</arg>
       <arg choice="opt" rep="norepeat">class</arg>
@@ -91,7 +89,8 @@
 
   <refsection><info><title>DESCRIPTION</title></info>
 
-    <para><command>dig</command> is a flexible tool
+    <para><command>dig</command>
+      (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
       displays the answers that are returned from the name server(s) that
       were queried.  Most DNS administrators use <command>dig</command> to
@@ -709,10 +708,7 @@
 	    <para>
 	      Specify EDNS option with code point <option>code</option>
 	      and optionally payload of <option>value</option> as a
-	      hexadecimal string.  <option>code</option> can be
-	      either an EDNS option name (for example,
-	      <literal>NSID</literal> or <literal>ECS</literal>),
-	      or an arbitrary numeric value.  <option>+noednsopt</option>
+	      hexadecimal string.  <option>+noednsopt</option>
 	      clears the EDNS options to be sent.
 	    </para>
 	  </listitem>
@@ -881,23 +877,6 @@
 	  </listitem>
 	</varlistentry>
 
-	<varlistentry>
-	  <term><option>+padding=value</option></term>
-	  <listitem>
-	    <para>
-	      Pad the size of the query packet using the EDNS Padding option
-	      to blocks of <parameter>value</parameter> bytes. For example,
-	      <option>+padding=32</option> would cause a 48-byte query to
-	      be padded to 64 bytes.  The default block size is 0, which
-	      disables padding. The maximum is 512. Values are
-	      ordinarily expected to be powers of two, such as 128;
-	      however, this is not mandatory.  Responses to
-	      padded queries may also be padded, but only if the query
-	      uses TCP or DNS COOKIE.
-	    </para>
-	  </listitem>
-	</varlistentry>
-
 	<varlistentry>
 	  <term><option>+[no]qr</option></term>
 	  <listitem>
@@ -1009,8 +988,9 @@
 	  <term><option>+[no]sigchase</option></term>
 	  <listitem>
 	    <para>
-	      This feature is now obsolete and has been removed;
-              use <command>delv</command> instead.
+	      Chase DNSSEC signature chains. Requires dig be compiled
+	      with -DDIG_SIGCHASE. This feature is deprecated.
+	      Use <command>delv</command> instead.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1051,13 +1031,13 @@
 	      specified IP address or network prefix.
 	    </para>
 	    <para>
-	      <command>dig +subnet=0.0.0.0/0</command>, or simply
-	      <command>dig +subnet=0</command> for short, sends an EDNS
-	      CLIENT-SUBNET option with an empty address and a source
-	      prefix-length of zero, which signals a resolver that
-	      the client's address information must
-	      <emphasis>not</emphasis> be used when resolving
-	      this query.
+              <command>dig +subnet=0.0.0.0/0</command>, or simply
+              <command>dig +subnet=0</command> for short, sends an EDNS
+              CLIENT-SUBNET option with an empty address and a source
+              prefix-length of zero, which signals a resolver that
+              the client's address information must
+              <emphasis>not</emphasis> be used when resolving
+              this query.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1067,10 +1047,10 @@
 	  <listitem>
 	    <para>
 	      Use [do not use] TCP when querying name servers. The
-	      default behavior is to use UDP unless a type
-	      <literal>any</literal> or <literal>ixfr=N</literal>
-	      query is requested, in which case the default is TCP.
-	      AXFR queries always use TCP.
+	      default behavior is to use UDP unless an
+	      <literal>ixfr=N</literal> query is requested, in which
+	      case the default is TCP.  AXFR queries always use
+	      TCP.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1094,9 +1074,9 @@
 	  <term><option>+[no]topdown</option></term>
 	  <listitem>
 	    <para>
-	      This feature is related to <command>dig +sigchase</command>,
-              which is obsolete and has been removed. Use
-              <command>delv</command> instead.
+	      When chasing DNSSEC signature chains perform a top-down
+	      validation.  Requires dig be compiled with -DDIG_SIGCHASE.
+	      This feature is deprecated. Use <command>delv</command> instead.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1140,10 +1120,17 @@
 	  <term><option>+trusted-key=####</option></term>
 	  <listitem>
 	    <para>
-	      Formerly specified trusted keys for use with
-              <command>dig +sigchase</command>.  This feature is now
-              obsolete and has been removed; use
-              <command>delv</command> instead.
+	      Specifies a file containing trusted keys to be used
+	      with <option>+sigchase</option>.  Each DNSKEY record
+	      must be on its own line.
+	    </para> <para>
+	      If not specified, <command>dig</command> will look
+	      for <filename>/etc/trusted-key.key</filename> then
+	      <filename>trusted-key.key</filename> in the current
+	      directory.
+	    </para> <para>
+	      Requires dig be compiled with -DDIG_SIGCHASE.
+	      This feature is deprecated. Use <command>delv</command> instead.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1233,9 +1220,8 @@
       can also be supplied.  These global query options must precede the
       first tuple of name, class, type, options, flags, and query options
       supplied on the command line.  Any global query options (except
-      <option>+[no]cmd</option> and <option>+[no]short</option> options)
-      can be overridden by a query-specific set of query options.
-      For example:
+      the <option>+[no]cmd</option> option) can be
+      overridden by a query-specific set of query options.  For example:
       <programlisting>
 dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
 </programlisting>

bin/dig/dig.html

@@ -45,10 +45,8 @@
        [<code class="option">-v</code>]
        [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>]
        [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]name:key</code></em></code>]
-       [
-	[<code class="option">-4</code>]
-	 |  [<code class="option">-6</code>]
-      ]
+       [<code class="option">-4</code>]
+       [<code class="option">-6</code>]
        [name]
        [type]
        [class]
@@ -70,7 +68,8 @@
   <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
 
-    <p><span class="command"><strong>dig</strong></span> is a flexible tool
+    <p><span class="command"><strong>dig</strong></span>
+      (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
       displays the answers that are returned from the name server(s) that
       were queried.  Most DNS administrators use <span class="command"><strong>dig</strong></span> to
@@ -573,10 +572,7 @@
 	    <p>
 	      Specify EDNS option with code point <code class="option">code</code>
 	      and optionally payload of <code class="option">value</code> as a
-	      hexadecimal string.  <code class="option">code</code> can be
-	      either an EDNS option name (for example,
-	      <code class="literal">NSID</code> or <code class="literal">ECS</code>),
-	      or an arbitrary numeric value.  <code class="option">+noednsopt</code>
+	      hexadecimal string.  <code class="option">+noednsopt</code>
 	      clears the EDNS options to be sent.
 	    </p>
 	  </dd>
@@ -701,20 +697,6 @@
 	      value.  The default value is QUERY (0).
 	    </p>
 	  </dd>
-<dt><span class="term"><code class="option">+padding=value</code></span></dt>
-<dd>
-	    <p>
-	      Pad the size of the query packet using the EDNS Padding option
-	      to blocks of <em class="parameter"><code>value</code></em> bytes. For example,
-	      <code class="option">+padding=32</code> would cause a 48-byte query to
-	      be padded to 64 bytes.  The default block size is 0, which
-	      disables padding. The maximum is 512. Values are
-	      ordinarily expected to be powers of two, such as 128;
-	      however, this is not mandatory.  Responses to
-	      padded queries may also be padded, but only if the query
-	      uses TCP or DNS COOKIE.
-	    </p>
-	  </dd>
 <dt><span class="term"><code class="option">+[no]qr</code></span></dt>
 <dd>
 	    <p>
@@ -798,8 +780,9 @@
 <dt><span class="term"><code class="option">+[no]sigchase</code></span></dt>
 <dd>
 	    <p>
-	      This feature is now obsolete and has been removed;
-              use <span class="command"><strong>delv</strong></span> instead.
+	      Chase DNSSEC signature chains. Requires dig be compiled
+	      with -DDIG_SIGCHASE. This feature is deprecated.
+	      Use <span class="command"><strong>delv</strong></span> instead.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+split=W</code></span></dt>
@@ -831,23 +814,23 @@
 	      specified IP address or network prefix.
 	    </p>
 	    <p>
-	      <span class="command"><strong>dig +subnet=0.0.0.0/0</strong></span>, or simply
-	      <span class="command"><strong>dig +subnet=0</strong></span> for short, sends an EDNS
-	      CLIENT-SUBNET option with an empty address and a source
-	      prefix-length of zero, which signals a resolver that
-	      the client's address information must
-	      <span class="emphasis"><em>not</em></span> be used when resolving
-	      this query.
+              <span class="command"><strong>dig +subnet=0.0.0.0/0</strong></span>, or simply
+              <span class="command"><strong>dig +subnet=0</strong></span> for short, sends an EDNS
+              CLIENT-SUBNET option with an empty address and a source
+              prefix-length of zero, which signals a resolver that
+              the client's address information must
+              <span class="emphasis"><em>not</em></span> be used when resolving
+              this query.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
 <dd>
 	    <p>
 	      Use [do not use] TCP when querying name servers. The
-	      default behavior is to use UDP unless a type
-	      <code class="literal">any</code> or <code class="literal">ixfr=N</code>
-	      query is requested, in which case the default is TCP.
-	      AXFR queries always use TCP.
+	      default behavior is to use UDP unless an
+	      <code class="literal">ixfr=N</code> query is requested, in which
+	      case the default is TCP.  AXFR queries always use
+	      TCP.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+timeout=T</code></span></dt>
@@ -865,9 +848,9 @@
 <dt><span class="term"><code class="option">+[no]topdown</code></span></dt>
 <dd>
 	    <p>
-	      This feature is related to <span class="command"><strong>dig +sigchase</strong></span>,
-              which is obsolete and has been removed. Use
-              <span class="command"><strong>delv</strong></span> instead.
+	      When chasing DNSSEC signature chains perform a top-down
+	      validation.  Requires dig be compiled with -DDIG_SIGCHASE.
+	      This feature is deprecated. Use <span class="command"><strong>delv</strong></span> instead.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]trace</code></span></dt>
@@ -902,10 +885,17 @@
 <dt><span class="term"><code class="option">+trusted-key=####</code></span></dt>
 <dd>
 	    <p>
-	      Formerly specified trusted keys for use with
-              <span class="command"><strong>dig +sigchase</strong></span>.  This feature is now
-              obsolete and has been removed; use
-              <span class="command"><strong>delv</strong></span> instead.
+	      Specifies a file containing trusted keys to be used
+	      with <code class="option">+sigchase</code>.  Each DNSKEY record
+	      must be on its own line.
+	    </p> <p>
+	      If not specified, <span class="command"><strong>dig</strong></span> will look
+	      for <code class="filename">/etc/trusted-key.key</code> then
+	      <code class="filename">trusted-key.key</code> in the current
+	      directory.
+	    </p> <p>
+	      Requires dig be compiled with -DDIG_SIGCHASE.
+	      This feature is deprecated. Use <span class="command"><strong>delv</strong></span> instead.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]ttlid</code></span></dt>
@@ -980,9 +970,8 @@
       can also be supplied.  These global query options must precede the
       first tuple of name, class, type, options, flags, and query options
       supplied on the command line.  Any global query options (except
-      <code class="option">+[no]cmd</code> and <code class="option">+[no]short</code> options)
-      can be overridden by a query-specific set of query options.
-      For example:
+      the <code class="option">+[no]cmd</code> option) can be
+      overridden by a query-specific set of query options.  For example:
       </p>
 <pre class="programlisting">
 dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr

bin/dig/host.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,7 @@
 host \- DNS lookup utility
 .SH "SYNOPSIS"
 .HP \w'\fBhost\fR\ 'u
-\fBhost\fR [\fB\-aACdlnrsTUwv\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-N\ \fR\fB\fIndots\fR\fR] [\fB\-R\ \fR\fB\fInumber\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-W\ \fR\fB\fIwait\fR\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [[\fB\-4\fR] | [\fB\-6\fR]] [\fB\-v\fR] [\fB\-V\fR] {name} [server]
+\fBhost\fR [\fB\-aCdlnrsTwv\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-N\ \fR\fB\fIndots\fR\fR] [\fB\-R\ \fR\fB\fInumber\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-W\ \fR\fB\fIwait\fR\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [\fB\-v\fR] [\fB\-V\fR] {name} [server]
 .SH "DESCRIPTION"
 .PP
 \fBhost\fR
@@ -82,15 +82,6 @@ option is normally equivalent to
 list zone option\&.
 .RE
 .PP
-\-A
-.RS 4
-"Almost all"\&. The
-\fB\-A\fR
-option is equivalent to
-\fB\-a\fR
-except RRSIG, NSEC, and NSEC3 records are omitted from the output\&.
-.RE
-.PP
 \-c \fIclass\fR
 .RS 4
 Query class: This can be used to lookup HS (Hesiod) or CH (Chaosnet) class resource records\&. The default class is IN (Internet)\&.
@@ -190,14 +181,13 @@ If a query type of IXFR is chosen the starting serial number can be specified by
 \fB\-t \fR\fBIXFR=12345678\fR)\&.
 .RE
 .PP
-\-T, \-U
+\-T
 .RS 4
-TCP/UDP: By default,
+TCP: By default,
 \fBhost\fR
 uses UDP when making queries\&. The
 \fB\-T\fR
-option makes it use a TCP connection when querying the name server\&. TCP will be automatically selected for queries that require it, such as zone transfer (AXFR) requests\&. Type ANY queries default to TCP but can be forced to UDP initially using
-\fB\-U\fR\&.
+option makes it use a TCP connection when querying the name server\&. TCP will be automatically selected for queries that require it, such as zone transfer (AXFR) requests\&.
 .RE
 .PP
 \-m \fIflag\fR
@@ -274,5 +264,5 @@ runs\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dig/host.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2007, 2009-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2000-2007, 2009-2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -48,7 +48,6 @@ static isc_boolean_t short_form = ISC_TRUE, listed_server = ISC_FALSE;
 static isc_boolean_t default_lookups = ISC_TRUE;
 static int seen_error = -1;
 static isc_boolean_t list_addresses = ISC_TRUE;
-static isc_boolean_t list_almost_all = ISC_FALSE;
 static dns_rdatatype_t list_type = dns_rdatatype_a;
 static isc_boolean_t printed_server = ISC_FALSE;
 static isc_boolean_t ipv4only = ISC_FALSE, ipv6only = ISC_FALSE;
@@ -141,7 +140,6 @@ show_usage(void) {
 "Usage: host [-aCdilrTvVw] [-c class] [-N ndots] [-t type] [-W time]\n"
 "            [-R number] [-m flag] hostname [server]\n"
 "       -a is equivalent to -v -t ANY\n"
-"       -A is like -a but omits RRSIG, NSEC, NSEC3\n"
 "       -c specifies query class for non-IN data\n"
 "       -C compares SOA records on authoritative nameservers\n"
 "       -d is equivalent to -v\n"
@@ -163,12 +161,12 @@ show_usage(void) {
 	exit(1);
 }
 
-static void
-host_shutdown(void) {
-	(void) isc_app_shutdown();
+void
+dighost_shutdown(void) {
+	isc_app_shutdown();
 }
 
-static void
+void
 received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 	isc_time_t now;
 	int diff;
@@ -183,7 +181,7 @@ received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 	}
 }
 
-static void
+void
 trying(char *frm, dig_lookup_t *lookup) {
 	UNUSED(lookup);
 
@@ -225,7 +223,18 @@ say_message(dns_name_t *name, const char *msg, dns_rdata_t *rdata,
 	printf("\n");
 	isc_buffer_free(&b);
 }
-
+#ifdef DIG_SIGCHASE
+/* Just for compatibility : not use in host program */
+isc_result_t
+printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,
+	      isc_buffer_t *target)
+{
+  UNUSED(owner_name);
+  UNUSED(rdataset);
+  UNUSED(target);
+  return(ISC_FALSE);
+}
+#endif
 static isc_result_t
 printsection(dns_message_t *msg, dns_section_t sectionid,
 	     const char *section_name, isc_boolean_t headers,
@@ -279,11 +288,6 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 				rdataset->type == dns_rdatatype_ns ||
 				rdataset->type == dns_rdatatype_ptr))))
 				continue;
-			if (list_almost_all &&
-			       (rdataset->type == dns_rdatatype_rrsig ||
-				rdataset->type == dns_rdatatype_nsec ||
-				rdataset->type == dns_rdatatype_nsec3))
-				continue;
 			if (!short_form) {
 				result = dns_rdataset_totext(rdataset,
 							     print_name,
@@ -352,9 +356,8 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 }
 
 static isc_result_t
-printrdata(dns_message_t *msg, dns_rdataset_t *rdataset,
-	   const dns_name_t *owner, const char *set_name,
-	   isc_boolean_t headers)
+printrdata(dns_message_t *msg, dns_rdataset_t *rdataset, dns_name_t *owner,
+	   const char *set_name, isc_boolean_t headers)
 {
 	isc_buffer_t target;
 	isc_result_t result;
@@ -403,11 +406,11 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 	}
 }
 
-static isc_result_t
+isc_result_t
 printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	isc_boolean_t did_flag = ISC_FALSE;
 	dns_rdataset_t *opt, *tsig = NULL;
-	const dns_name_t *tsigname;
+	dns_name_t *tsigname;
 	isc_result_t result = ISC_R_SUCCESS;
 	int force_error;
 
@@ -463,8 +466,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, ISC_FALSE);
 		if (lookup != NULL) {
-			strlcpy(lookup->textname, namestr,
+			strncpy(lookup->textname, namestr,
 				sizeof(lookup->textname));
+			lookup->textname[sizeof(lookup->textname)-1] = 0;
 			lookup->rdtype = dns_rdatatype_aaaa;
 			lookup->rdtypeset = ISC_TRUE;
 			lookup->origin = NULL;
@@ -473,8 +477,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		}
 		lookup = clone_lookup(query->lookup, ISC_FALSE);
 		if (lookup != NULL) {
-			strlcpy(lookup->textname, namestr,
+			strncpy(lookup->textname, namestr,
 				sizeof(lookup->textname));
+			lookup->textname[sizeof(lookup->textname)-1] = 0;
 			lookup->rdtype = dns_rdatatype_mx;
 			lookup->rdtypeset = ISC_TRUE;
 			lookup->origin = NULL;
@@ -589,7 +594,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	return (result);
 }
 
-static const char * optstring = "46aAc:dilnm:rst:vVwCDN:R:TUW:";
+static const char * optstring = "46ac:dilnm:rst:vVwCDN:R:TW:";
 
 /*% version */
 static void
@@ -626,7 +631,6 @@ pre_parse_args(int argc, char **argv) {
 			ipv6only = ISC_TRUE;
 			break;
 		case 'a': break;
-		case 'A': break;
 		case 'c': break;
 		case 'd': break;
 		case 'i': break;
@@ -730,9 +734,6 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 				lookup->ixfr_serial = serial;
 				lookup->tcp_mode = ISC_TRUE;
 				list_type = rdtype;
-			} else if (rdtype == dns_rdatatype_any) {
-				if (!lookup->tcp_mode_set)
-					lookup->tcp_mode = ISC_TRUE;
 #ifdef WITH_IDN
 			} else if (rdtype == dns_rdatatype_a ||
 				   rdtype == dns_rdatatype_aaaa ||
@@ -761,9 +762,6 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			}
 			default_lookups = ISC_FALSE;
 			break;
-		case 'A':
-			list_almost_all = ISC_TRUE;
-			/* FALL THROUGH */
 		case 'a':
 			if (!lookup->rdtypeset ||
 			    lookup->rdtype != dns_rdatatype_axfr)
@@ -805,11 +803,6 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			break;
 		case 'T':
 			lookup->tcp_mode = ISC_TRUE;
-			lookup->tcp_mode_set = ISC_TRUE;
-			break;
-		case 'U':
-			lookup->tcp_mode = ISC_FALSE;
-			lookup->tcp_mode_set = ISC_TRUE;
 			break;
 		case 'C':
 			debug("showing all SOAs");
@@ -859,12 +852,14 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 	lookup->pending = ISC_FALSE;
 	if (get_reverse(store, sizeof(store), hostname,
 			lookup->ip6_int, ISC_TRUE) == ISC_R_SUCCESS) {
-		strlcpy(lookup->textname, store, sizeof(lookup->textname));
+		strncpy(lookup->textname, store, sizeof(lookup->textname));
+		lookup->textname[sizeof(lookup->textname)-1] = 0;
 		lookup->rdtype = dns_rdatatype_ptr;
 		lookup->rdtypeset = ISC_TRUE;
 		default_lookups = ISC_FALSE;
 	} else {
-		strlcpy(lookup->textname, hostname, sizeof(lookup->textname));
+		strncpy(lookup->textname, hostname, sizeof(lookup->textname));
+		lookup->textname[sizeof(lookup->textname)-1]=0;
 		usesearch = ISC_TRUE;
 	}
 	lookup->new_search = ISC_TRUE;
@@ -886,12 +881,6 @@ main(int argc, char **argv) {
 	idnoptions = IDN_ASCCHECK;
 #endif
 
-	/* setup dighost callbacks */
-	dighost_printmessage = printmessage;
-	dighost_received = received;
-	dighost_trying = trying;
-	dighost_shutdown = host_shutdown;
-
 	debug("main()");
 	progname = argv[0];
 	pre_parse_args(argc, argv);

bin/dig/host.docbook

@@ -1,7 +1,7 @@
 <!DOCTYPE book [
 <!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2017  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
  -
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -42,7 +42,6 @@
       <year>2014</year>
       <year>2015</year>
       <year>2016</year>
-      <year>2017</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -50,17 +49,15 @@
   <refsynopsisdiv>
     <cmdsynopsis sepchar=" ">
       <command>host</command>
-      <arg choice="opt" rep="norepeat"><option>-aACdlnrsTUwv</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-aCdlnrsTwv</option></arg>
       <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-N <replaceable class="parameter">ndots</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">number</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-W <replaceable class="parameter">wait</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-m <replaceable class="parameter">flag</replaceable></option></arg>
-      <group choice="opt" rep="norepeat">
-	<arg choice="opt" rep="norepeat"><option>-4</option></arg>
-	<arg choice="opt" rep="norepeat"><option>-6</option></arg>
-      </group>
+      <arg choice="opt" rep="norepeat"><option>-4</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-6</option></arg>
       <arg choice="opt" rep="norepeat"><option>-v</option></arg>
       <arg choice="opt" rep="norepeat"><option>-V</option></arg>
       <arg choice="req" rep="norepeat">name</arg>
@@ -130,17 +127,6 @@
 	</listitem>
       </varlistentry>
 
-      <varlistentry>
-	<term>-A</term>
-	<listitem>
-	  <para>
-	    "Almost all". The <option>-A</option> option is equivalent
-	    to <option>-a</option> except RRSIG, NSEC, and NSEC3
-	    records are omitted from the output.
-	  </para>
-	</listitem>
-      </varlistentry>
-
       <varlistentry>
 	<term>-c <replaceable class="parameter">class</replaceable></term>
 	<listitem>
@@ -293,16 +279,14 @@
 
       <varlistentry>
 	<term>-T</term>
-	<term>-U</term>
 	<listitem>
 	  <para>
-	    TCP/UDP:
+	    TCP:
 	    By default, <command>host</command> uses UDP when making
 	    queries. The <option>-T</option> option makes it use a TCP
 	    connection when querying the name server. TCP will be
 	    automatically selected for queries that require it, such
-	    as zone transfer (AXFR) requests.  Type ANY queries default
-	    to TCP but can be forced to UDP initially using <option>-U</option>.
+	    as zone transfer (AXFR) requests.
 	  </para>
 	</listitem>
       </varlistentry>

bin/dig/host.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -33,17 +33,15 @@
 <h2>Synopsis</h2>
     <div class="cmdsynopsis"><p>
       <code class="command">host</code> 
-       [<code class="option">-aACdlnrsTUwv</code>]
+       [<code class="option">-aCdlnrsTwv</code>]
        [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
        [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>]
        [<code class="option">-R <em class="replaceable"><code>number</code></em></code>]
        [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
        [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>]
        [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>]
-       [
-	[<code class="option">-4</code>]
-	 |  [<code class="option">-6</code>]
-      ]
+       [<code class="option">-4</code>]
+       [<code class="option">-6</code>]
        [<code class="option">-v</code>]
        [<code class="option">-V</code>]
        {name}
@@ -105,14 +103,6 @@
 	    list zone option.
 	  </p>
 	</dd>
-<dt><span class="term">-A</span></dt>
-<dd>
-	  <p>
-	    "Almost all". The <code class="option">-A</code> option is equivalent
-	    to <code class="option">-a</code> except RRSIG, NSEC, and NSEC3
-	    records are omitted from the output.
-	  </p>
-	</dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd>
 	  <p>
@@ -233,18 +223,15 @@
 	    (like <code class="option">-t <code class="literal">IXFR=12345678</code></code>).
 	  </p>
 	</dd>
-<dt>
-<span class="term">-T, </span><span class="term">-U</span>
-</dt>
+<dt><span class="term">-T</span></dt>
 <dd>
 	  <p>
-	    TCP/UDP:
+	    TCP:
 	    By default, <span class="command"><strong>host</strong></span> uses UDP when making
 	    queries. The <code class="option">-T</code> option makes it use a TCP
 	    connection when querying the name server. TCP will be
 	    automatically selected for queries that require it, such
-	    as zone transfer (AXFR) requests.  Type ANY queries default
-	    to TCP but can be forced to UDP initially using <code class="option">-U</code>.
+	    as zone transfer (AXFR) requests.
 	  </p>
 	</dd>
 <dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt>

bin/dig/include/dig/dig.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2009, 2011-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2000-2009, 2011-2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -64,11 +64,27 @@
  * in a tight loop of constant lookups.  It's value is arbitrary.
  */
 
+/*
+ * Defaults for the sigchase suboptions.  Consolidated here because
+ * these control the layout of dig_lookup_t (among other things).
+ */
+#ifdef DIG_SIGCHASE
+#ifndef DIG_SIGCHASE_BU
+#define DIG_SIGCHASE_BU 1
+#endif
+#ifndef DIG_SIGCHASE_TD
+#define DIG_SIGCHASE_TD 1
+#endif
+#endif
+
 ISC_LANG_BEGINDECLS
 
 typedef struct dig_lookup dig_lookup_t;
 typedef struct dig_query dig_query_t;
 typedef struct dig_server dig_server_t;
+#ifdef DIG_SIGCHASE
+typedef struct dig_message dig_message_t;
+#endif
 typedef ISC_LIST(dig_server_t) dig_serverlist_t;
 typedef struct dig_searchlist dig_searchlist_t;
 
@@ -110,29 +126,37 @@ struct dig_lookup {
 		seenbadcookie,
 		badcookie,
 		nsid,   /*% Name Server ID (RFC 5001) */
-		tcp_keepalive,
 		header_only,
 		ednsneg,
 		mapped,
 		print_unknown_format,
-		multiline,
-		nottl,
-		noclass,
-		onesoa,
-		use_usec,
-		nocrypto,
-		ttlunits,
-		idnout,
-		qr;
+		idnout;
+#ifdef DIG_SIGCHASE
+isc_boolean_t	sigchase;
+#if DIG_SIGCHASE_TD
+	isc_boolean_t do_topdown,
+		trace_root_sigchase,
+		rdtype_sigchaseset,
+		rdclass_sigchaseset;
+	/* Name we are going to validate RRset */
+	char textnamesigchase[MXNAME];
+#endif
+#endif
+
 	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;
 	dns_rdatatype_t qrdtype;
+#if DIG_SIGCHASE_TD
+	dns_rdatatype_t rdtype_sigchase;
+	dns_rdatatype_t qrdtype_sigchase;
+	dns_rdataclass_t rdclass_sigchase;
+#endif
 	dns_rdataclass_t rdclass;
 	isc_boolean_t rdtypeset;
 	isc_boolean_t rdclassset;
-	char name_space[BUFSIZE];
-	char oname_space[BUFSIZE];
+	char namespace[BUFSIZE];
+	char onamespace[BUFSIZE];
 	isc_buffer_t namebuf;
 	isc_buffer_t onamebuf;
 	isc_buffer_t renderbuf;
@@ -152,7 +176,6 @@ struct dig_lookup {
 	int nsfound;
 	isc_uint16_t udpsize;
 	isc_int16_t edns;
-	isc_int16_t padding;
 	isc_uint32_t ixfr_serial;
 	isc_buffer_t rdatabuf;
 	char rdatastore[MXNAME];
@@ -167,8 +190,6 @@ struct dig_lookup {
 	isc_dscp_t dscp;
 	unsigned int ednsflags;
 	dns_opcode_t opcode;
-	int rrcomments;
-	unsigned int eoferr;
 };
 
 /*% The dig_query structure */
@@ -221,6 +242,12 @@ struct dig_searchlist {
 	char origin[MXNAME];
 	ISC_LINK(dig_searchlist_t) link;
 };
+#ifdef DIG_SIGCHASE
+struct dig_message {
+		dns_message_t *msg;
+		ISC_LINK(dig_message_t) link;
+};
+#endif
 
 typedef ISC_LIST(dig_searchlist_t) dig_searchlistlist_t;
 typedef ISC_LIST(dig_lookup_t) dig_lookuplist_t;
@@ -235,7 +262,7 @@ extern dig_searchlistlist_t search_list;
 extern unsigned int extrabytes;
 
 extern isc_boolean_t check_ra, have_ipv4, have_ipv6, specified_source,
-	usesearch, showsearch;
+	usesearch, showsearch, qr;
 extern in_port_t port;
 extern unsigned int timeout;
 extern isc_mem_t *mctx;
@@ -247,8 +274,11 @@ extern isc_sockaddr_t bind_address;
 extern char keynametext[MXNAME];
 extern char keyfile[MXNAME];
 extern char keysecret[MXNAME];
-extern const dns_name_t *hmacname;
+extern dns_name_t *hmacname;
 extern unsigned int digestbits;
+#ifdef DIG_SIGCHASE
+extern char trustedkey[MXNAME];
+#endif
 extern dns_tsigkey_t *key;
 extern isc_boolean_t validated;
 extern isc_taskmgr_t *taskmgr;
@@ -357,73 +387,56 @@ destroy_libs(void);
 void
 set_search_domain(char *domain);
 
-char *
-next_token(char **stringp, const char *delim);
+#ifdef DIG_SIGCHASE
+void
+clean_trustedkey(void);
+#endif
 
 /*
- * Routines to be defined in dig.c, host.c, and nslookup.c. and
- * then assigned to the appropriate function pointer
+ * Routines to be defined in dig.c, host.c, and nslookup.c.
  */
-extern isc_result_t
-(*dighost_printmessage)(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers);
+#ifdef DIG_SIGCHASE
+isc_result_t
+printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,
+	      isc_buffer_t *target);
+#endif
+
+isc_result_t
+printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers);
 /*%<
  * Print the final result of the lookup.
  */
 
-extern void
-(*dighost_received)(int bytes, isc_sockaddr_t *from, dig_query_t *query);
+void
+received(int bytes, isc_sockaddr_t *from, dig_query_t *query);
 /*%<
  * Print a message about where and when the response
  * was received from, like the final comment in the
  * output of "dig".
  */
 
-extern void
-(*dighost_trying)(char *frm, dig_lookup_t *lookup);
+void
+trying(char *frm, dig_lookup_t *lookup);
 
-extern void
-(*dighost_shutdown)(void);
+void
+dighost_shutdown(void);
+
+char *
+next_token(char **stringp, const char *delim);
+
+#ifdef DIG_SIGCHASE
+/* Chasing functions */
+dns_rdataset_t *
+chase_scanname(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers);
+void
+chase_sig(dns_message_t *msg);
+#endif
 
 void save_opt(dig_lookup_t *lookup, char *code, char *value);
 
 void setup_file_key(void);
 void setup_text_key(void);
 
-/*
- * Routines exported from dig.c for use by dig for iOS
- */
-
-/*%<
- * Call once only to set up libraries, parse global
- * parameters and initial command line query parameters
- */
-void
-dig_setup(int argc, char **argv);
-
-/*%<
- * Call to supply new parameters for the next lookup
- */
-void
-dig_query_setup(isc_boolean_t, isc_boolean_t, int argc, char **argv);
-
-/*%<
- * set the main application event cycle running
- */
-void
-dig_startup(void);
-
-/*%<
- * Initiates the next lookup cycle
- */
-void
-dig_query_start(void);
-
-/*%<
- * Cleans up the application
- */
-void
-dig_shutdown(void);
-
 ISC_LANG_ENDDECLS
 
 #endif

bin/dig/nslookup.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2010, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -189,7 +189,7 @@ The class specifies the protocol group of the information\&.
 (Default = IN; abbreviation = cl)
 .RE
 .PP
-\fB\fI[no]\fR\fR\fBdebug\fR
+\fB \fR\fB\fI[no]\fR\fR\fBdebug\fR
 .RS 4
 Turn on or off the display of the full response packet and any intermediate response packets when searching\&.
 .sp
@@ -197,7 +197,7 @@ Turn on or off the display of the full response packet and any intermediate resp
 [no]deb)
 .RE
 .PP
-\fB\fI[no]\fR\fR\fBd2\fR
+\fB \fR\fB\fI[no]\fR\fR\fBd2\fR
 .RS 4
 Turn debugging mode on or off\&. This displays more about what nslookup is doing\&.
 .sp
@@ -210,7 +210,7 @@ Sets the search list to
 \fIname\fR\&.
 .RE
 .PP
-\fB\fI[no]\fR\fR\fBsearch\fR
+\fB \fR\fB\fI[no]\fR\fR\fBsearch\fR
 .RS 4
 If the lookup request contains at least one period but doesn\*(Aqt end with a trailing period, append the domain names in the domain search list to the request until an answer is received\&.
 .sp
@@ -236,7 +236,7 @@ Change the type of the information query\&.
 (Default = A; abbreviations = q, ty)
 .RE
 .PP
-\fB\fI[no]\fR\fR\fBrecurse\fR
+\fB \fR\fB\fI[no]\fR\fR\fBrecurse\fR
 .RS 4
 Tell the name server to query other servers if it does not have the information\&.
 .sp
@@ -258,14 +258,14 @@ Set the number of retries to number\&.
 Change the initial timeout interval for waiting for a reply to number seconds\&.
 .RE
 .PP
-\fB\fI[no]\fR\fR\fBvc\fR
+\fB \fR\fB\fI[no]\fR\fR\fBvc\fR
 .RS 4
 Always use a virtual circuit when sending requests to the server\&.
 .sp
 (Default = novc)
 .RE
 .PP
-\fB\fI[no]\fR\fR\fBfail\fR
+\fB \fR\fB\fI[no]\fR\fR\fBfail\fR
 .RS 4
 Try the next nameserver if a nameserver responds with SERVFAIL or a referral (nofail) or terminate query (fail) on such a response\&.
 .sp
@@ -290,5 +290,5 @@ returns with an exit status of 1 if any query failed, and 0 otherwise\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2007, 2010, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2007, 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dig/nslookup.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2000-2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -51,7 +51,7 @@
 #endif
 
 static isc_boolean_t short_form = ISC_TRUE,
-	tcpmode = ISC_FALSE, tcpmode_set = ISC_FALSE,
+	tcpmode = ISC_FALSE,
 	identify = ISC_FALSE, stats = ISC_TRUE,
 	comments = ISC_TRUE, section_question = ISC_TRUE,
 	section_answer = ISC_TRUE, section_authority = ISC_TRUE,
@@ -156,8 +156,8 @@ rcode_totext(dns_rcode_t rcode)
 	return totext.deconsttext;
 }
 
-static void
-query_finished(void) {
+void
+dighost_shutdown(void) {
 	isc_event_t *event = global_event;
 
 	flush_lookup_list();
@@ -205,6 +205,18 @@ printaddr(dns_rdata_t *rdata) {
 	       (char *)isc_buffer_base(&b));
 }
 
+#ifdef DIG_SIGCHASE
+/* Just for compatibility : not use in host program */
+isc_result_t
+printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,
+	      isc_buffer_t *target)
+{
+	UNUSED(owner_name);
+	UNUSED(rdataset);
+	UNUSED(target);
+	return(ISC_FALSE);
+}
+#endif
 static void
 printrdata(dns_rdata_t *rdata) {
 	isc_result_t result;
@@ -386,7 +398,7 @@ detailsection(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers,
 	return (ISC_R_SUCCESS);
 }
 
-static void
+void
 received(int bytes, isc_sockaddr_t *from, dig_query_t *query)
 {
 	UNUSED(bytes);
@@ -394,10 +406,11 @@ received(int bytes, isc_sockaddr_t *from, dig_query_t *query)
 	UNUSED(query);
 }
 
-static void
+void
 trying(char *frm, dig_lookup_t *lookup) {
 	UNUSED(frm);
 	UNUSED(lookup);
+
 }
 
 static void
@@ -425,7 +438,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 	}
 }
 
-static isc_result_t
+isc_result_t
 printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	char servtext[ISC_SOCKADDR_FORMATSIZE];
 
@@ -479,8 +492,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, ISC_FALSE);
 		if (lookup != NULL) {
-			strlcpy(lookup->textname, namestr,
+			strncpy(lookup->textname, namestr,
 				sizeof(lookup->textname));
+			lookup->textname[sizeof(lookup->textname)-1] = 0;
 			lookup->rdtype = dns_rdatatype_aaaa;
 			lookup->rdtypeset = ISC_TRUE;
 			lookup->origin = NULL;
@@ -636,12 +650,7 @@ version(void) {
 
 static void
 setoption(char *opt) {
-	size_t l = strlen(opt);
-
-#define CHECKOPT(A, N) \
-	((l >= N) && (l < sizeof(A)) && (strncasecmp(opt, A, l) == 0))
-
-	if (CHECKOPT("all", 3)) {
+	if (strncasecmp(opt, "all", 3) == 0) {
 		show_settings(ISC_TRUE, ISC_FALSE);
 	} else if (strncasecmp(opt, "class=", 6) == 0) {
 		if (testclass(&opt[6]))
@@ -695,43 +704,41 @@ setoption(char *opt) {
 		set_timeout(&opt[8]);
 	} else if (strncasecmp(opt, "t=", 2) == 0) {
 		set_timeout(&opt[2]);
-	} else if (CHECKOPT("recurse", 3)) {
+	} else if (strncasecmp(opt, "rec", 3) == 0) {
 		recurse = ISC_TRUE;
-	} else if (CHECKOPT("norecurse", 5)) {
+	} else if (strncasecmp(opt, "norec", 5) == 0) {
 		recurse = ISC_FALSE;
 	} else if (strncasecmp(opt, "retry=", 6) == 0) {
 		set_tries(&opt[6]);
 	} else if (strncasecmp(opt, "ret=", 4) == 0) {
 		set_tries(&opt[4]);
-	} else if (CHECKOPT("defname", 3)) {
+	} else if (strncasecmp(opt, "def", 3) == 0) {
 		usesearch = ISC_TRUE;
-	} else if (CHECKOPT("nodefname", 5)) {
+	} else if (strncasecmp(opt, "nodef", 5) == 0) {
 		usesearch = ISC_FALSE;
-	} else if (CHECKOPT("vc", 2) == 0) {
+	} else if (strncasecmp(opt, "vc", 3) == 0) {
 		tcpmode = ISC_TRUE;
-		tcpmode_set = ISC_TRUE;
-	} else if (CHECKOPT("novc", 4) == 0) {
+	} else if (strncasecmp(opt, "novc", 5) == 0) {
 		tcpmode = ISC_FALSE;
-		tcpmode_set = ISC_TRUE;
-	} else if (CHECKOPT("debug", 3) == 0) {
+	} else if (strncasecmp(opt, "deb", 3) == 0) {
 		short_form = ISC_FALSE;
 		showsearch = ISC_TRUE;
-	} else if (CHECKOPT("nodebug", 5) == 0) {
+	} else if (strncasecmp(opt, "nodeb", 5) == 0) {
 		short_form = ISC_TRUE;
 		showsearch = ISC_FALSE;
-	} else if (CHECKOPT("d2", 2) == 0) {
+	} else if (strncasecmp(opt, "d2", 2) == 0) {
 		debugging = ISC_TRUE;
-	} else if (CHECKOPT("nod2", 4) == 0) {
+	} else if (strncasecmp(opt, "nod2", 4) == 0) {
 		debugging = ISC_FALSE;
-	} else if (CHECKOPT("search", 3) == 0) {
+	} else if (strncasecmp(opt, "search", 3) == 0) {
 		usesearch = ISC_TRUE;
-	} else if (CHECKOPT("nosearch", 5) == 0) {
+	} else if (strncasecmp(opt, "nosearch", 5) == 0) {
 		usesearch = ISC_FALSE;
-	} else if (CHECKOPT("sil", 3) == 0) {
+	} else if (strncasecmp(opt, "sil", 3) == 0) {
 		/* deprecation_msg = ISC_FALSE; */
-	} else if (CHECKOPT("fail", 3) == 0) {
+	} else if (strncasecmp(opt, "fail", 3) == 0) {
 		nofail=ISC_FALSE;
-	} else if (CHECKOPT("nofail", 5) == 0) {
+	} else if (strncasecmp(opt, "nofail", 3) == 0) {
 		nofail=ISC_TRUE;
 	} else if (strncasecmp(opt, "ndots=", 6) == 0) {
 		set_ndots(&opt[6]);
@@ -789,10 +796,7 @@ addlookup(char *opt) {
 	lookup->retries = tries;
 	lookup->udpsize = 0;
 	lookup->comments = comments;
-	if (lookup->rdtype == dns_rdatatype_any && !tcpmode_set)
-		lookup->tcp_mode = ISC_TRUE;
-	else
-		lookup->tcp_mode = tcpmode;
+	lookup->tcp_mode = tcpmode;
 	lookup->stats = stats;
 	lookup->section_question = section_question;
 	lookup->section_answer = section_answer;
@@ -976,12 +980,6 @@ main(int argc, char **argv) {
 
 	check_ra = ISC_TRUE;
 
-	/* setup dighost callbacks */
-	dighost_printmessage = printmessage;
-	dighost_received = received;
-	dighost_trying = trying;
-	dighost_shutdown = query_finished;
-
 	result = isc_app_start();
 	check_result(result, "isc_app_start");
 

bin/dig/nslookup.docbook

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007, 2010, 2013-2017  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
  -
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -66,7 +66,6 @@
       <year>2014</year>
       <year>2015</year>
       <year>2016</year>
-      <year>2017</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -309,7 +308,8 @@ nslookup -query=hinfo  -timeout=10
               </varlistentry>
 
               <varlistentry>
-                <term><constant><replaceable><optional>no</optional></replaceable>debug</constant></term>
+                <term><constant>
+                    <replaceable><optional>no</optional></replaceable>debug</constant></term>
                 <listitem>
                   <para>
 		    Turn on or off the display of the full response packet and
@@ -322,7 +322,8 @@ nslookup -query=hinfo  -timeout=10
               </varlistentry>
 
               <varlistentry>
-                <term><constant><replaceable><optional>no</optional></replaceable>d2</constant></term>
+                <term><constant>
+                    <replaceable><optional>no</optional></replaceable>d2</constant></term>
                 <listitem>
                   <para>
                     Turn debugging mode on or off.  This displays more about
@@ -344,7 +345,8 @@ nslookup -query=hinfo  -timeout=10
               </varlistentry>
 
               <varlistentry>
-                <term><constant><replaceable><optional>no</optional></replaceable>search</constant></term>
+                <term><constant>
+                    <replaceable><optional>no</optional></replaceable>search</constant></term>
                 <listitem>
                   <para>
                     If the lookup request contains at least one period but
@@ -390,7 +392,8 @@ nslookup -query=hinfo  -timeout=10
               </varlistentry>
 
               <varlistentry>
-                <term><constant><replaceable><optional>no</optional></replaceable>recurse</constant></term>
+                <term><constant>
+                    <replaceable><optional>no</optional></replaceable>recurse</constant></term>
                 <listitem>
                   <para>
                     Tell the name server to query other servers if it does not
@@ -434,7 +437,8 @@ nslookup -query=hinfo  -timeout=10
               </varlistentry>
 
               <varlistentry>
-                <term><constant><replaceable><optional>no</optional></replaceable>vc</constant></term>
+                <term><constant>
+                    <replaceable><optional>no</optional></replaceable>vc</constant></term>
                 <listitem>
                   <para>
                     Always use a virtual circuit when sending requests to the
@@ -447,7 +451,8 @@ nslookup -query=hinfo  -timeout=10
               </varlistentry>
 
               <varlistentry>
-                <term><constant><replaceable><optional>no</optional></replaceable>fail</constant></term>
+                <term><constant>
+                    <replaceable><optional>no</optional></replaceable>fail</constant></term>
                 <listitem>
                   <para>
 		    Try the next nameserver if a nameserver responds with

bin/dig/nslookup.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2007, 2010, 2013-2017 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -233,7 +233,8 @@ nslookup -query=hinfo  -timeout=10
                     (Default = IN; abbreviation = cl)
                   </p>
                 </dd>
-<dt><span class="term"><code class="constant"><em class="replaceable"><code>[<span class="optional">no</span>]</code></em>debug</code></span></dt>
+<dt><span class="term"><code class="constant">
+                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>debug</code></span></dt>
 <dd>
                   <p>
 		    Turn on or off the display of the full response packet and
@@ -243,7 +244,8 @@ nslookup -query=hinfo  -timeout=10
                     (Default = nodebug; abbreviation = [<span class="optional">no</span>]deb)
                   </p>
                 </dd>
-<dt><span class="term"><code class="constant"><em class="replaceable"><code>[<span class="optional">no</span>]</code></em>d2</code></span></dt>
+<dt><span class="term"><code class="constant">
+                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>d2</code></span></dt>
 <dd>
                   <p>
                     Turn debugging mode on or off.  This displays more about
@@ -259,7 +261,8 @@ nslookup -query=hinfo  -timeout=10
                     Sets the search list to <em class="replaceable"><code>name</code></em>.
                   </p>
                 </dd>
-<dt><span class="term"><code class="constant"><em class="replaceable"><code>[<span class="optional">no</span>]</code></em>search</code></span></dt>
+<dt><span class="term"><code class="constant">
+                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>search</code></span></dt>
 <dd>
                   <p>
                     If the lookup request contains at least one period but
@@ -293,7 +296,8 @@ nslookup -query=hinfo  -timeout=10
                     (Default = A; abbreviations = q, ty)
                   </p>
                 </dd>
-<dt><span class="term"><code class="constant"><em class="replaceable"><code>[<span class="optional">no</span>]</code></em>recurse</code></span></dt>
+<dt><span class="term"><code class="constant">
+                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>recurse</code></span></dt>
 <dd>
                   <p>
                     Tell the name server to query other servers if it does not
@@ -325,7 +329,8 @@ nslookup -query=hinfo  -timeout=10
                     reply to number seconds.
                   </p>
                 </dd>
-<dt><span class="term"><code class="constant"><em class="replaceable"><code>[<span class="optional">no</span>]</code></em>vc</code></span></dt>
+<dt><span class="term"><code class="constant">
+                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>vc</code></span></dt>
 <dd>
                   <p>
                     Always use a virtual circuit when sending requests to the
@@ -335,7 +340,8 @@ nslookup -query=hinfo  -timeout=10
                     (Default = novc)
                   </p>
                 </dd>
-<dt><span class="term"><code class="constant"><em class="replaceable"><code>[<span class="optional">no</span>]</code></em>fail</code></span></dt>
+<dt><span class="term"><code class="constant">
+                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>fail</code></span></dt>
 <dd>
                   <p>
 		    Try the next nameserver if a nameserver responds with

bin/dig/win32/dig.dsp.in

@@ -0,0 +1,107 @@
+# Microsoft Developer Studio Project File - Name="dig" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "@PLATFORM@ (x86) Console Application" 0x0103
+
+CFG=dig - @PLATFORM@ Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "dig.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "dig.mak" CFG="dig - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "dig - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "dig - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "dig - @PLATFORM@ Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 @COPTX@ @COPTI@ /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD CPP /nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @IDN_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "__STDC__" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console @MACHINE@
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/dighost.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/bind9/win32/Release/libbind9.lib ../../../lib/lwres/win32/Release/liblwres.lib @IDN_LIB@ /nologo /subsystem:console @MACHINE@ /out:"../../../Build/Release/dig.exe"
+
+!ELSEIF  "$(CFG)" == "dig - @PLATFORM@ Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @IDN_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
+# SUBTRACT CPP /X /u @COPTY@
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug @MACHINE@ /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/dighost.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/lwres/win32/Debug/liblwres.lib @IDN_LIB@ /nologo /subsystem:console /debug @MACHINE@ /out:"../../../Build/Debug/dig.exe" /pdbtype:sept
+
+!ENDIF 
+
+# Begin Target
+
+# Name "dig - @PLATFORM@ Release"
+# Name "dig - @PLATFORM@ Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# Begin Source File
+
+SOURCE=..\dig.c
+# End Source File
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# Begin Source File
+
+SOURCE=..\include\dig\dig.h
+# End Source File
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# End Target
+# End Project

bin/dig/win32/dig.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "dig"=".\dig.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/dig/win32/dig.mak.in

@@ -0,0 +1,427 @@
+# Microsoft Developer Studio Generated NMAKE File, Based on dig.dsp
+!IF "$(CFG)" == ""
+CFG=dig - @PLATFORM@ Debug
+!MESSAGE No configuration specified. Defaulting to dig - @PLATFORM@ Debug.
+!ENDIF 
+
+!IF "$(CFG)" != "dig - @PLATFORM@ Release" && "$(CFG)" != "dig - @PLATFORM@ Debug"
+!MESSAGE Invalid configuration "$(CFG)" specified.
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "dig.mak" CFG="dig - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "dig - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "dig - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+!ERROR An invalid configuration is specified.
+!ENDIF 
+
+!IF "$(OS)" == "Windows_NT"
+NULL=
+!ELSE 
+NULL=nul
+!ENDIF 
+
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "dig - @PLATFORM@ Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
+!IF  "$(CFG)" == "dig - @PLATFORM@ Release"
+
+OUTDIR=.\Release
+INTDIR=.\Release
+
+!IF "$(RECURSE)" == "0" 
+
+ALL : "..\..\..\Build\Release\dig.exe"
+
+!ELSE 
+
+ALL : "liblwres - @PLATFORM@ Release" "libbind9 - @PLATFORM@ Release" "libisc - @PLATFORM@ Release" "libdns - @PLATFORM@ Release" "..\..\..\Build\Release\dig.exe"
+
+!ENDIF 
+
+!IF "$(RECURSE)" == "1" 
+CLEAN :"libdns - @PLATFORM@ ReleaseCLEAN" "libisc - @PLATFORM@ ReleaseCLEAN" "libbind9 - @PLATFORM@ ReleaseCLEAN" "liblwres - @PLATFORM@ ReleaseCLEAN" 
+!ELSE 
+CLEAN :
+!ENDIF 
+	-@erase "$(INTDIR)\dig.obj"
+	-@erase "$(INTDIR)\dighost.obj"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "..\..\..\Build\Release\dig.exe"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @IDN_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "__STDC__" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /Fp"$(INTDIR)\dig.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\dig.bsc" 
+BSC32_SBRS= \
+	
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/bind9/win32/Release/libbind9.lib ../../../lib/lwres/win32/Release/liblwres.lib @IDN_LIB@ /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\dig.pdb" @MACHINE@ /out:"../../../Build/Release/dig.exe" 
+LINK32_OBJS= \
+	"$(INTDIR)\dig.obj" \
+	"$(INTDIR)\dighost.obj" \
+	"..\..\..\lib\dns\win32\Release\libdns.lib" \
+	"..\..\..\lib\isc\win32\Release\libisc.lib" \
+	"..\..\..\lib\isccfg\win32\Release\libisccfg.lib" \
+	"..\..\..\lib\bind9\win32\Release\libbind9.lib" \
+	"..\..\..\lib\lwres\win32\Release\liblwres.lib"
+
+"..\..\..\Build\Release\dig.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ELSEIF  "$(CFG)" == "dig - @PLATFORM@ Debug"
+
+OUTDIR=.\Debug
+INTDIR=.\Debug
+# Begin Custom Macros
+OutDir=.\Debug
+# End Custom Macros
+
+!IF "$(RECURSE)" == "0" 
+
+ALL : "..\..\..\Build\Debug\dig.exe" "$(OUTDIR)\dig.bsc"
+
+!ELSE 
+
+ALL : "liblwres - @PLATFORM@ Debug" "libbind9 - @PLATFORM@ Debug" "libisc - @PLATFORM@ Debug" "libdns - @PLATFORM@ Debug" "..\..\..\Build\Debug\dig.exe" "$(OUTDIR)\dig.bsc"
+
+!ENDIF 
+
+!IF "$(RECURSE)" == "1" 
+CLEAN :"libdns - @PLATFORM@ DebugCLEAN" "libisc - @PLATFORM@ DebugCLEAN" "libbind9 - @PLATFORM@ DebugCLEAN" "liblwres - @PLATFORM@ DebugCLEAN" 
+!ELSE 
+CLEAN :
+!ENDIF 
+	-@erase "$(INTDIR)\dig.obj"
+	-@erase "$(INTDIR)\dig.sbr"
+	-@erase "$(INTDIR)\dighost.obj"
+	-@erase "$(INTDIR)\dighost.sbr"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "$(INTDIR)\vc60.pdb"
+	-@erase "$(OUTDIR)\dig.bsc"
+	-@erase "$(OUTDIR)\dig.pdb"
+	-@erase "..\..\..\Build\Debug\dig.exe"
+	-@erase "..\..\..\Build\Debug\dig.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @IDN_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\dig.bsc" 
+BSC32_SBRS= \
+	"$(INTDIR)\dig.sbr" \
+	"$(INTDIR)\dighost.sbr"
+
+"$(OUTDIR)\dig.bsc" : "$(OUTDIR)" $(BSC32_SBRS)
+    $(BSC32) @<<
+  $(BSC32_FLAGS) $(BSC32_SBRS)
+<<
+
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/lwres/win32/Debug/liblwres.lib @IDN_LIB@ /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\dig.pdb" /debug @MACHINE@ /out:"../../../Build/Debug/dig.exe" /pdbtype:sept 
+LINK32_OBJS= \
+	"$(INTDIR)\dig.obj" \
+	"$(INTDIR)\dighost.obj" \
+	"..\..\..\lib\dns\win32\Debug\libdns.lib" \
+	"..\..\..\lib\isc\win32\Debug\libisc.lib" \
+	"..\..\..\lib\isccfg\win32\Debug\libisccfg.lib" \
+	"..\..\..\lib\bind9\win32\Debug\libbind9.lib" \
+	"..\..\..\lib\lwres\win32\Debug\liblwres.lib"
+
+"..\..\..\Build\Debug\dig.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ENDIF 
+
+.c{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.c{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+
+!IF "$(NO_EXTERNAL_DEPS)" != "1"
+!IF EXISTS("dig.dep")
+!INCLUDE "dig.dep"
+!ELSE 
+!MESSAGE Warning: cannot find "dig.dep"
+!ENDIF 
+!ENDIF 
+
+
+!IF "$(CFG)" == "dig - @PLATFORM@ Release" || "$(CFG)" == "dig - @PLATFORM@ Debug"
+SOURCE=..\dig.c
+
+!IF  "$(CFG)" == "dig - @PLATFORM@ Release"
+
+
+"$(INTDIR)\dig.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "dig - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\dig.obj"	"$(INTDIR)\dig.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+SOURCE=..\dighost.c
+
+!IF  "$(CFG)" == "dig - @PLATFORM@ Release"
+
+
+"$(INTDIR)\dighost.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "dig - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\dighost.obj"	"$(INTDIR)\dighost.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+!IF  "$(CFG)" == "dig - @PLATFORM@ Release"
+
+"libdns - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"libdns - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "dig - @PLATFORM@ Debug"
+
+"libdns - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"libdns - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "dig - @PLATFORM@ Release"
+
+"libisc - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"libisc - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "dig - @PLATFORM@ Debug"
+
+"libisc - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"libisc - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "dig - @PLATFORM@ Release"
+
+"libbind9 - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"libbind9 - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "dig - @PLATFORM@ Debug"
+
+"libbind9 - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"libbind9 - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "dig - @PLATFORM@ Release"
+
+"liblwres - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"liblwres - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "dig - @PLATFORM@ Debug"
+
+"liblwres - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"liblwres - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+
+!ENDIF 
+
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/dig/win32/dig.vcxproj.in

@@ -60,15 +60,14 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
+      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\lwres\win32\include;..\..\..\lib\lwres\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\lwres\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libdns.lib;libbind9.lib;liblwres.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -87,8 +86,7 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
+      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\lwres\win32\include;..\..\..\lib\lwres\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -97,8 +95,8 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\lwres\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libdns.lib;libbind9.lib;liblwres.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
@@ -110,4 +108,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

bin/dig/win32/dighost.dsp.in

@@ -0,0 +1,113 @@
+# Microsoft Developer Studio Project File - Name="dighost" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "@PLATFORM@ (x86) Static-Link Library" 0x0104
+
+CFG=dighost - @PLATFORM@ Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "dighost.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "dighost.mak" CFG="dighost - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "dighost - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Static-Link Library")
+!MESSAGE "dighost - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Static-Link Library")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+MTL=midl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "dighost - @PLATFORM@ Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MT /W3 @COPTX@ @COPTI@ /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" @COPTY@ /FD /c
+# ADD CPP /nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @IDN_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /D "NDEBUG" @CRYPTO@ /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" @COPTY@ /FD /c /Fddighost
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /out:"Release/dighost.lib"
+
+!ELSEIF  "$(CFG)" == "dighost - @PLATFORM@ Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MTd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" @COPTY@ /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @IDN_INC@ /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" @CRYPTO@ /D "_DEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /FR @COPTY@ /FD /GZ /c /Fddighost
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /debug out:"Debug/dighost.lib"
+
+!ENDIF 
+
+# Begin Target
+
+# Name "dighost - @PLATFORM@ Release"
+# Name "dighost - @PLATFORM@ Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# Begin Group "Main Dns Lib"
+
+# PROP Default_Filter "c"
+# Begin Source File
+
+SOURCE=..\dighost.c
+# End Source File
+# End Group
+# End Target
+# End Project

bin/dig/win32/dighost.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "dighost"=".\dighost.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/dig/win32/dighost.vcxproj.in

@@ -60,8 +60,7 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\lwres\win32\include;..\..\..\lib\lwres\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -85,8 +84,7 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
+      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\lwres\win32\include;..\..\..\lib\lwres\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -103,4 +101,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

bin/dig/win32/host.dsp.in

@@ -0,0 +1,103 @@
+# Microsoft Developer Studio Project File - Name="host" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "@PLATFORM@ (x86) Console Application" 0x0103
+
+CFG=host - @PLATFORM@ Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "host.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "host.mak" CFG="host - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "host - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "host - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "host - @PLATFORM@ Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 @COPTX@ @COPTI@ /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD CPP /nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @IDN_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "__STDC__" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console @MACHINE@
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/dighost.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/bind9/win32/Release/libbind9.lib ../../../lib/lwres/win32/Release/liblwres.lib @IDN_LIB@ /nologo /subsystem:console @MACHINE@ /out:"../../../Build/Release/host.exe"
+
+!ELSEIF  "$(CFG)" == "host - @PLATFORM@ Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @IDN_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
+# SUBTRACT CPP /X /u @COPTY@
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug @MACHINE@ /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/dighost.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/lwres/win32/Debug/liblwres.lib @IDN_LIB@ /nologo /subsystem:console /debug @MACHINE@ /out:"../../../Build/Debug/host.exe" /pdbtype:sept
+
+!ENDIF 
+
+# Begin Target
+
+# Name "host - @PLATFORM@ Release"
+# Name "host - @PLATFORM@ Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# Begin Source File
+
+SOURCE=..\host.c
+# End Source File
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# End Target
+# End Project

bin/dig/win32/host.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "host"=".\host.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/dig/win32/host.mak.in

@@ -0,0 +1,427 @@
+# Microsoft Developer Studio Generated NMAKE File, Based on host.dsp
+!IF "$(CFG)" == ""
+CFG=host - @PLATFORM@ Debug
+!MESSAGE No configuration specified. Defaulting to host - @PLATFORM@ Debug.
+!ENDIF 
+
+!IF "$(CFG)" != "host - @PLATFORM@ Release" && "$(CFG)" != "host - @PLATFORM@ Debug"
+!MESSAGE Invalid configuration "$(CFG)" specified.
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "host.mak" CFG="host - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "host - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "host - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+!ERROR An invalid configuration is specified.
+!ENDIF 
+
+!IF "$(OS)" == "Windows_NT"
+NULL=
+!ELSE 
+NULL=nul
+!ENDIF 
+
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "host - @PLATFORM@ Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
+!IF  "$(CFG)" == "host - @PLATFORM@ Release"
+
+OUTDIR=.\Release
+INTDIR=.\Release
+
+!IF "$(RECURSE)" == "0" 
+
+ALL : "..\..\..\Build\Release\host.exe"
+
+!ELSE 
+
+ALL : "liblwres - @PLATFORM@ Release" "libbind9 - @PLATFORM@ Release" "libisc - @PLATFORM@ Release" "libdns - @PLATFORM@ Release" "..\..\..\Build\Release\host.exe"
+
+!ENDIF 
+
+!IF "$(RECURSE)" == "1" 
+CLEAN :"libdns - @PLATFORM@ ReleaseCLEAN" "libisc - @PLATFORM@ ReleaseCLEAN" "libbind9 - @PLATFORM@ ReleaseCLEAN" "liblwres - @PLATFORM@ ReleaseCLEAN" 
+!ELSE 
+CLEAN :
+!ENDIF 
+	-@erase "$(INTDIR)\dighost.obj"
+	-@erase "$(INTDIR)\host.obj"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "..\..\..\Build\Release\host.exe"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @IDN_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "__STDC__" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /Fp"$(INTDIR)\host.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\host.bsc" 
+BSC32_SBRS= \
+	
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/bind9/win32/Release/libbind9.lib  ../../../lib/lwres/win32/Release/liblwres.lib @IDN_LIB@ /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\host.pdb" @MACHINE@ /out:"../../../Build/Release/host.exe" 
+LINK32_OBJS= \
+	"$(INTDIR)\dighost.obj" \
+	"$(INTDIR)\host.obj" \
+	"..\..\..\lib\dns\win32\Release\libdns.lib" \
+	"..\..\..\lib\isc\win32\Release\libisc.lib" \
+	"..\..\..\lib\isccfg\win32\Release\libisccfg.lib" \
+	"..\..\..\lib\bind9\win32\Release\libbind9.lib" \
+	"..\..\..\lib\lwres\win32\Release\liblwres.lib"
+
+"..\..\..\Build\Release\host.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ELSEIF  "$(CFG)" == "host - @PLATFORM@ Debug"
+
+OUTDIR=.\Debug
+INTDIR=.\Debug
+# Begin Custom Macros
+OutDir=.\Debug
+# End Custom Macros
+
+!IF "$(RECURSE)" == "0" 
+
+ALL : "..\..\..\Build\Debug\host.exe" "$(OUTDIR)\host.bsc"
+
+!ELSE 
+
+ALL : "liblwres - @PLATFORM@ Debug" "libbind9 - @PLATFORM@ Debug" "libisc - @PLATFORM@ Debug" "libdns - @PLATFORM@ Debug" "..\..\..\Build\Debug\host.exe" "$(OUTDIR)\host.bsc"
+
+!ENDIF 
+
+!IF "$(RECURSE)" == "1" 
+CLEAN :"libdns - @PLATFORM@ DebugCLEAN" "libisc - @PLATFORM@ DebugCLEAN" "libbind9 - @PLATFORM@ DebugCLEAN" "liblwres - @PLATFORM@ DebugCLEAN" 
+!ELSE 
+CLEAN :
+!ENDIF 
+	-@erase "$(INTDIR)\dighost.obj"
+	-@erase "$(INTDIR)\dighost.sbr"
+	-@erase "$(INTDIR)\host.obj"
+	-@erase "$(INTDIR)\host.sbr"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "$(INTDIR)\vc60.pdb"
+	-@erase "$(OUTDIR)\host.bsc"
+	-@erase "$(OUTDIR)\host.pdb"
+	-@erase "..\..\..\Build\Debug\host.exe"
+	-@erase "..\..\..\Build\Debug\host.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @IDN_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\host.bsc" 
+BSC32_SBRS= \
+	"$(INTDIR)\dighost.sbr" \
+	"$(INTDIR)\host.sbr"
+
+"$(OUTDIR)\host.bsc" : "$(OUTDIR)" $(BSC32_SBRS)
+    $(BSC32) @<<
+  $(BSC32_FLAGS) $(BSC32_SBRS)
+<<
+
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/bind9/win32/Debug/libbind9.lib  ../../../lib/lwres/win32/Debug/liblwres.lib @IDN_LIB@ /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\host.pdb" /debug @MACHINE@ /out:"../../../Build/Debug/host.exe" /pdbtype:sept 
+LINK32_OBJS= \
+	"$(INTDIR)\dighost.obj" \
+	"$(INTDIR)\host.obj" \
+	"..\..\..\lib\dns\win32\Debug\libdns.lib" \
+	"..\..\..\lib\isc\win32\Debug\libisc.lib" \
+	"..\..\..\lib\isccfg\win32\Debug\libisccfg.lib" \
+	"..\..\..\lib\bind9\win32\Debug\libbind9.lib" \
+	"..\..\..\lib\lwres\win32\Debug\liblwres.lib"
+
+"..\..\..\Build\Debug\host.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ENDIF 
+
+.c{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.c{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+
+!IF "$(NO_EXTERNAL_DEPS)" != "1"
+!IF EXISTS("host.dep")
+!INCLUDE "host.dep"
+!ELSE 
+!MESSAGE Warning: cannot find "host.dep"
+!ENDIF 
+!ENDIF 
+
+
+!IF "$(CFG)" == "host - @PLATFORM@ Release" || "$(CFG)" == "host - @PLATFORM@ Debug"
+SOURCE=..\dighost.c
+
+!IF  "$(CFG)" == "host - @PLATFORM@ Release"
+
+
+"$(INTDIR)\dighost.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "host - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\dighost.obj"	"$(INTDIR)\dighost.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+SOURCE=..\host.c
+
+!IF  "$(CFG)" == "host - @PLATFORM@ Release"
+
+
+"$(INTDIR)\host.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "host - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\host.obj"	"$(INTDIR)\host.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+!IF  "$(CFG)" == "host - @PLATFORM@ Release"
+
+"libdns - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"libdns - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "host - @PLATFORM@ Debug"
+
+"libdns - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"libdns - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "host - @PLATFORM@ Release"
+
+"libisc - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"libisc - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "host - @PLATFORM@ Debug"
+
+"libisc - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"libisc - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "host - @PLATFORM@ Release"
+
+"libbind9 - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"libbind9 - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "host - @PLATFORM@ Debug"
+
+"libbind9 - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"libbind9 - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "host - @PLATFORM@ Release"
+
+"liblwres - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"liblwres - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "host - @PLATFORM@ Debug"
+
+"liblwres - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"liblwres - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+
+!ENDIF 
+
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/dig/win32/host.vcxproj.in

@@ -60,15 +60,14 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
+      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\lwres\win32\include;..\..\..\lib\lwres\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\lwres\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libdns.lib;libbind9.lib;liblwres.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -87,8 +86,7 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
+      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\lwres\win32\include;..\..\..\lib\lwres\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -97,8 +95,8 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\lwres\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libdns.lib;libbind9.lib;liblwres.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
@@ -107,4 +105,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

bin/dig/win32/nslookup.dsp.in

@@ -0,0 +1,107 @@
+# Microsoft Developer Studio Project File - Name="nslookup" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "@PLATFORM@ (x86) Console Application" 0x0103
+
+CFG=nslookup - @PLATFORM@ Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "nslookup.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "nslookup.mak" CFG="nslookup - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "nslookup - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "nslookup - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "nslookup - @PLATFORM@ Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 @COPTX@ @COPTI@ /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD CPP /nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @READLINE_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "USE_READLINE_STATIC" /D "__STDC__" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /c
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console @MACHINE@
+# ADD LINK32 @READLINE_LIB@ @IDN_LIB@ user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/bind9/win32/Release/libbind9.lib ../../../lib/lwres/win32/Release/liblwres.lib /nologo /subsystem:console @MACHINE@ /out:"../../../Build/Release/nslookup.exe"
+
+!ELSEIF  "$(CFG)" == "nslookup - @PLATFORM@ Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" @COPTY@ /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @READLINE_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "USE_READLINE_STATIC" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
+# SUBTRACT CPP /X /u @COPTY@
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug @MACHINE@ /pdbtype:sept
+# ADD LINK32 @READLINE_LIBD@ @IDN_LIB@ user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/lwres/win32/Debug/liblwres.lib /nologo /subsystem:console /debug @MACHINE@ /out:"../../../Build/Debug/nslookup.exe" /pdbtype:sept
+
+!ENDIF 
+
+# Begin Target
+
+# Name "nslookup - @PLATFORM@ Release"
+# Name "nslookup - @PLATFORM@ Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# Begin Source File
+
+SOURCE=..\dighost.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\nslookup.c
+# End Source File
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# End Target
+# End Project

bin/dig/win32/nslookup.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "nslookup"=".\nslookup.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/dig/win32/nslookup.mak.in

@@ -0,0 +1,427 @@
+# Microsoft Developer Studio Generated NMAKE File, Based on nslookup.dsp
+!IF "$(CFG)" == ""
+CFG=nslookup - @PLATFORM@ Debug
+!MESSAGE No configuration specified. Defaulting to nslookup - @PLATFORM@ Debug.
+!ENDIF 
+
+!IF "$(CFG)" != "nslookup - @PLATFORM@ Release" && "$(CFG)" != "nslookup - @PLATFORM@ Debug"
+!MESSAGE Invalid configuration "$(CFG)" specified.
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "nslookup.mak" CFG="nslookup - @PLATFORM@ Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "nslookup - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "nslookup - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE 
+!ERROR An invalid configuration is specified.
+!ENDIF 
+
+!IF "$(OS)" == "Windows_NT"
+NULL=
+!ELSE 
+NULL=nul
+!ENDIF 
+
+CPP=cl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "nslookup - @PLATFORM@ Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
+!IF  "$(CFG)" == "nslookup - @PLATFORM@ Release"
+
+OUTDIR=.\Release
+INTDIR=.\Release
+
+!IF "$(RECURSE)" == "0" 
+
+ALL : "..\..\..\Build\Release\nslookup.exe"
+
+!ELSE 
+
+ALL : "liblwres - @PLATFORM@ Release" "libbind9 - @PLATFORM@ Release" "libisc - @PLATFORM@ Release" "libdns - @PLATFORM@ Release" "..\..\..\Build\Release\nslookup.exe"
+
+!ENDIF 
+
+!IF "$(RECURSE)" == "1" 
+CLEAN :"libdns - @PLATFORM@ ReleaseCLEAN" "libisc - @PLATFORM@ ReleaseCLEAN" "libbind9 - @PLATFORM@ ReleaseCLEAN" "liblwres - @PLATFORM@ ReleaseCLEAN" 
+!ELSE 
+CLEAN :
+!ENDIF 
+	-@erase "$(INTDIR)\dighost.obj"
+	-@erase "$(INTDIR)\nslookup.obj"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "..\..\..\Build\Release\nslookup.exe"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @READLINE_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "USE_READLINE_STATIC" /D "__STDC__" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /Fp"$(INTDIR)\nslookup.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\nslookup.bsc" 
+BSC32_SBRS= \
+	
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/bind9/win32/Release/libbind9.lib  ../../../lib/lwres/win32/Release/liblwres.lib @READLINE_LIB@ @IDN_LIB@ /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\nslookup.pdb" @MACHINE@ /out:"../../../Build/Release/nslookup.exe" 
+LINK32_OBJS= \
+	"$(INTDIR)\dighost.obj" \
+	"$(INTDIR)\nslookup.obj" \
+	"..\..\..\lib\dns\win32\Release\libdns.lib" \
+	"..\..\..\lib\isc\win32\Release\libisc.lib" \
+	"..\..\..\lib\isccfg\win32\Release\libisccfg.lib" \
+	"..\..\..\lib\bind9\win32\Release\libbind9.lib" \
+	"..\..\..\lib\lwres\win32\Release\liblwres.lib"
+
+"..\..\..\Build\Release\nslookup.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ELSEIF  "$(CFG)" == "nslookup - @PLATFORM@ Debug"
+
+OUTDIR=.\Debug
+INTDIR=.\Debug
+# Begin Custom Macros
+OutDir=.\Debug
+# End Custom Macros
+
+!IF "$(RECURSE)" == "0" 
+
+ALL : "..\..\..\Build\Debug\nslookup.exe" "$(OUTDIR)\nslookup.bsc"
+
+!ELSE 
+
+ALL : "liblwres - @PLATFORM@ Debug" "libbind9 - @PLATFORM@ Debug" "libisc - @PLATFORM@ Debug" "libdns - @PLATFORM@ Debug" "..\..\..\Build\Debug\nslookup.exe" "$(OUTDIR)\nslookup.bsc"
+
+!ENDIF 
+
+!IF "$(RECURSE)" == "1" 
+CLEAN :"libdns - @PLATFORM@ DebugCLEAN" "libisc - @PLATFORM@ DebugCLEAN" "libbind9 - @PLATFORM@ DebugCLEAN" "liblwres - @PLATFORM@ DebugCLEAN" 
+!ELSE 
+CLEAN :
+!ENDIF 
+	-@erase "$(INTDIR)\dighost.obj"
+	-@erase "$(INTDIR)\dighost.sbr"
+	-@erase "$(INTDIR)\nslookup.obj"
+	-@erase "$(INTDIR)\nslookup.sbr"
+	-@erase "$(INTDIR)\vc60.idb"
+	-@erase "$(INTDIR)\vc60.pdb"
+	-@erase "$(OUTDIR)\nslookup.bsc"
+	-@erase "$(OUTDIR)\nslookup.pdb"
+	-@erase "..\..\..\Build\Debug\nslookup.exe"
+	-@erase "..\..\..\Build\Debug\nslookup.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
+
+"$(OUTDIR)" :
+    if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
+
+CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "./" /I "../include" /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ @READLINE_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" @CRYPTO@ /D "WIN32" /D "USE_READLINE_STATIC" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+BSC32=bscmake.exe
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\nslookup.bsc" 
+BSC32_SBRS= \
+	"$(INTDIR)\dighost.sbr" \
+	"$(INTDIR)\nslookup.sbr"
+
+"$(OUTDIR)\nslookup.bsc" : "$(OUTDIR)" $(BSC32_SBRS)
+    $(BSC32) @<<
+  $(BSC32_FLAGS) $(BSC32_SBRS)
+<<
+
+LINK32=link.exe
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/bind9/win32/Debug/libbind9.lib  ../../../lib/lwres/win32/Debug/liblwres.lib @READLINE_LIBD@ @IDN_LIB@ /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\nslookup.pdb" /debug @MACHINE@ /out:"../../../Build/Debug/nslookup.exe" /pdbtype:sept 
+LINK32_OBJS= \
+	"$(INTDIR)\dighost.obj" \
+	"$(INTDIR)\nslookup.obj" \
+	"..\..\..\lib\dns\win32\Debug\libdns.lib" \
+	"..\..\..\lib\isc\win32\Debug\libisc.lib" \
+	"..\..\..\lib\isccfg\win32\Debug\libisccfg.lib" \
+	"..\..\..\lib\bind9\win32\Debug\libbind9.lib" \
+	"..\..\..\lib\lwres\win32\Debug\liblwres.lib"
+
+"..\..\..\Build\Debug\nslookup.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+    $(LINK32) @<<
+  $(LINK32_FLAGS) $(LINK32_OBJS)
+<<
+    $(_VC_MANIFEST_EMBED_EXE)
+
+!ENDIF 
+
+.c{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.obj::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.c{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cpp{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+.cxx{$(INTDIR)}.sbr::
+   $(CPP) @<<
+   $(CPP_PROJ) $< 
+<<
+
+
+!IF "$(NO_EXTERNAL_DEPS)" != "1"
+!IF EXISTS("nslookup.dep")
+!INCLUDE "nslookup.dep"
+!ELSE 
+!MESSAGE Warning: cannot find "nslookup.dep"
+!ENDIF 
+!ENDIF 
+
+
+!IF "$(CFG)" == "nslookup - @PLATFORM@ Release" || "$(CFG)" == "nslookup - @PLATFORM@ Debug"
+SOURCE=..\dighost.c
+
+!IF  "$(CFG)" == "nslookup - @PLATFORM@ Release"
+
+
+"$(INTDIR)\dighost.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "nslookup - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\dighost.obj"	"$(INTDIR)\dighost.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+SOURCE=..\nslookup.c
+
+!IF  "$(CFG)" == "nslookup - @PLATFORM@ Release"
+
+
+"$(INTDIR)\nslookup.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "nslookup - @PLATFORM@ Debug"
+
+
+"$(INTDIR)\nslookup.obj"	"$(INTDIR)\nslookup.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
+!IF  "$(CFG)" == "nslookup - @PLATFORM@ Release"
+
+"libdns - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"libdns - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "nslookup - @PLATFORM@ Debug"
+
+"libdns - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"libdns - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\dns\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libdns.mak" CFG="libdns - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "nslookup - @PLATFORM@ Release"
+
+"libisc - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"libisc - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "nslookup - @PLATFORM@ Debug"
+
+"libisc - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"libisc - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\isc\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libisc.mak" CFG="libisc - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "nslookup - @PLATFORM@ Release"
+
+"libbind9 - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"libbind9 - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "nslookup - @PLATFORM@ Debug"
+
+"libbind9 - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"libbind9 - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\bind9\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\libbind9.mak" CFG="libbind9 - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+!IF  "$(CFG)" == "nslookup - @PLATFORM@ Release"
+
+"liblwres - @PLATFORM@ Release" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Release" 
+   cd "..\..\..\bin\dig\win32"
+
+"liblwres - @PLATFORM@ ReleaseCLEAN" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Release" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ELSEIF  "$(CFG)" == "nslookup - @PLATFORM@ Debug"
+
+"liblwres - @PLATFORM@ Debug" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Debug" 
+   cd "..\..\..\bin\dig\win32"
+
+"liblwres - @PLATFORM@ DebugCLEAN" : 
+   cd "..\..\..\lib\lwres\win32"
+   $(MAKE) /$(MAKEFLAGS) /F ".\liblwres.mak" CFG="liblwres - @PLATFORM@ Debug" RECURSE=1 CLEAN 
+   cd "..\..\..\bin\dig\win32"
+
+!ENDIF 
+
+
+!ENDIF 
+
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/dig/win32/nslookup.vcxproj.in

@@ -60,15 +60,14 @@
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
       <BrowseInformation>true</BrowseInformation>
-      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@READLINE_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
+      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@READLINE_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\lwres\win32\include;..\..\..\lib\lwres\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\lwres\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libdns.lib;libbind9.lib;liblwres.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -87,8 +86,7 @@
       <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
       <ObjectFileName>.\$(Configuration)\</ObjectFileName>
       <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@READLINE_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
-      <CompileAs>CompileAsC</CompileAs>
+      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@READLINE_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\lwres\win32\include;..\..\..\lib\lwres\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -97,8 +95,8 @@
       <OptimizeReferences>true</OptimizeReferences>
       <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
       <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\lwres\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
+      <AdditionalDependencies>@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libdns.lib;libbind9.lib;liblwres.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
@@ -108,4 +106,4 @@
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

bin/dnssec/.gitignore

@@ -1,4 +1,3 @@
-dnssec-cds
 dnssec-dsfromkey
 dnssec-keyfromlabel
 dnssec-keygen

bin/dnssec/Makefile.in

@@ -1,9 +1,11 @@
-# Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2012-2017  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2012-2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+# $Id: Makefile.in,v 1.42.332.1 2011/03/16 06:37:51 each Exp $
+
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -19,8 +21,8 @@ CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
 CWARNINGS =
 
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@
 
 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
@@ -32,37 +34,30 @@ LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@
 NOSYMLIBS =	${DNSLIBS} ${ISCNOSYMLIBS} @LIBS@
 
 # Alphabetically
-TARGETS =	dnssec-cds@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
-		dnssec-importkey@EXEEXT@ dnssec-keyfromlabel@EXEEXT@ \
-		dnssec-keygen@EXEEXT@ dnssec-revoke@EXEEXT@ \
-		dnssec-settime@EXEEXT@ dnssec-signzone@EXEEXT@ \
-		dnssec-verify@EXEEXT@
+TARGETS =	dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@ \
+		dnssec-keyfromlabel@EXEEXT@ dnssec-dsfromkey@EXEEXT@ \
+		dnssec-revoke@EXEEXT@ dnssec-settime@EXEEXT@ \
+		dnssec-verify@EXEEXT@ dnssec-importkey@EXEEXT@
 
 OBJS =		dnssectool.@O@
 
-SRCS =		dnssec-cds.c dnssec-dsfromkey.c dnssec-importkey.c \
-		dnssec-keyfromlabel.c dnssec-keygen.c dnssec-revoke.c \
-		dnssec-settime.c dnssec-signzone.c dnssec-verify.c \
-		dnssectool.c
+SRCS =		dnssec-dsfromkey.c dnssec-keyfromlabel.c dnssec-keygen.c \
+		dnssec-revoke.c dnssec-settime.c dnssec-signzone.c \
+		dnssec-verify.c dnssec-importkey.c dnssectool.c
 
-MANPAGES =	dnssec-cds.8 dnssec-dsfromkey.8  dnssec-importkey.8 \
-		dnssec-keyfromlabel.8 dnssec-keygen.8 dnssec-revoke.8 \
-		dnssec-settime.8 dnssec-signzone.8 dnssec-verify.8
+MANPAGES =	dnssec-dsfromkey.8 dnssec-keyfromlabel.8 dnssec-keygen.8 \
+		dnssec-revoke.8 dnssec-settime.8 dnssec-signzone.8 \
+		dnssec-verify.8 dnssec-importkey.8
 
-HTMLPAGES =	dnssec-cds.html dnssec-dsfromkey.html \
-		dnssec-importkey.html dnssec-keyfromlabel.html \
+HTMLPAGES =	dnssec-dsfromkey.html dnssec-keyfromlabel.html \
 		dnssec-keygen.html dnssec-revoke.html \
 		dnssec-settime.html dnssec-signzone.html \
-		dnssec-verify.html
+		dnssec-verify.html dnssec-importkey.html
 
 MANOBJS =	${MANPAGES} ${HTMLPAGES}
 
 @BIND9_MAKE_RULES@
 
-dnssec-cds@EXEEXT@: dnssec-cds.@O@ ${OBJS} ${DEPLIBS}
-	export BASEOBJS="dnssec-cds.@O@ ${OBJS}"; \
-	${FINALBUILDCMD}
-
 dnssec-dsfromkey@EXEEXT@: dnssec-dsfromkey.@O@ ${OBJS} ${DEPLIBS}
 	export BASEOBJS="dnssec-dsfromkey.@O@ ${OBJS}"; \
 	${FINALBUILDCMD}
@@ -122,3 +117,4 @@ uninstall::
 
 clean distclean::
 	rm -f ${TARGETS}
+

bin/dnssec/dnssec-cds.8

@@ -1,292 +0,0 @@
-.\" Copyright (C) 2017 Internet Systems Consortium, Inc. ("ISC")
-.\" 
-.\" This Source Code Form is subject to the terms of the Mozilla Public
-.\" License, v. 2.0. If a copy of the MPL was not distributed with this
-.\" file, You can obtain one at http://mozilla.org/MPL/2.0/.
-.\"
-.hy 0
-.ad l
-'\" t
-.\"     Title: dnssec-cds
-.\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2017-10-02
-.\"    Manual: BIND9
-.\"    Source: ISC
-.\"  Language: English
-.\"
-.TH "DNSSEC\-CDS" "8" "2017\-10\-02" "ISC" "BIND9"
-.\" -----------------------------------------------------------------
-.\" * Define some portability stuff
-.\" -----------------------------------------------------------------
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" http://bugs.debian.org/507673
-.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.ie \n(.g .ds Aq \(aq
-.el       .ds Aq '
-.\" -----------------------------------------------------------------
-.\" * set default formatting
-.\" -----------------------------------------------------------------
-.\" disable hyphenation
-.nh
-.\" disable justification (adjust text to left margin only)
-.ad l
-.\" -----------------------------------------------------------------
-.\" * MAIN CONTENT STARTS HERE *
-.\" -----------------------------------------------------------------
-.SH "NAME"
-dnssec-cds \- change DS records for a child zone based on CDS/CDNSKEY
-.SH "SYNOPSIS"
-.HP \w'\fBdnssec\-cds\fR\ 'u
-\fBdnssec\-cds\fR [\fB\-a\ \fR\fB\fIalg\fR\fR...] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\fR] {\fB\-d\ \fR\fB\fIdsset\-file\fR\fR} {\fB\-f\ \fR\fB\fIchild\-file\fR\fR} [\fB\-i\fR\ [\fIextension\fR]] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] {domain}
-.SH "DESCRIPTION"
-.PP
-The
-\fBdnssec\-cds\fR
-command changes DS records at a delegation point based on CDS or CDNSKEY records published in the child zone\&. If both CDS and CDNSKEY records are present in the child zone, the CDS is preferred\&.
-.PP
-Two input files are required\&. The
-\fB\-f \fR\fB\fIchild\-file\fR\fR
-option specifies a file containing the child\*(Aqs CDS and/or CDNSKEY records, plus RRSIG and DNSKEY records so that they can be authenticated\&. The
-\fB\-d \fR\fB\fIpath\fR\fR
-option specifies the location of a file containing the current DS records\&. For example, this could be a
-dsset\-
-file generated by
-\fBdnssec\-signzone\fR, or the output of
-\fBdnssec\-dsfromkey\fR, or the output of a previous run of
-\fBdnssec\-cds\fR\&.
-.PP
-For protection against replay attacks, the signatures on the child records must not be older than they were on a previous run of
-\fBdnssec\-cds\fR\&. This time is obtained from the modification time of the
-dsset\-
-file, or from the
-\fB\-s\fR
-option\&.
-.PP
-To protect against breaking the delegation,
-\fBdnssec\-cds\fR
-ensures that the DNSKEY RRset can be verified by every key algorithm in the new DS RRset, and that the same set of keys are covered by every DS digest type\&.
-.PP
-By default, replacement DS records are written to the standard output; with the
-\fB\-i\fR
-option the input file is overwritten in place\&. The replacement DS records will be the same as the existing records when no change is required\&. The output can be empty if the CDS / CDNSKEY records specify that the child zone wants to go insecure\&.
-.PP
-Warning: Be careful not to delete the DS records when
-\fBdnssec\-cds\fR
-fails!
-.PP
-Alternatively,
-\fBdnssec\-cds \-u\fR
-writes an
-\fBnsupdate\fR
-script to the standard output\&. You can use the
-\fB\-u\fR
-and
-\fB\-i\fR
-options together to maintain a
-dsset\-
-file as well as emit an
-\fBnsupdate\fR
-script\&.
-.SH "OPTIONS"
-.PP
-\-a \fIalgorithm\fR
-.RS 4
-Specify a digest algorithm to use when converting CDNSKEY records to DS records\&. This option can be repeated, so that multiple DS records are created for each CDNSKEY record\&. This option has no effect when using CDS records\&.
-.sp
-The
-\fIalgorithm\fR
-must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST, or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
-.RE
-.PP
-\-c \fIclass\fR
-.RS 4
-Specifies the DNS class of the zones\&.
-.RE
-.PP
-\-D
-.RS 4
-Generate DS records from CDNSKEY records if both CDS and CDNSKEY records are present in the child zone\&. By default CDS records are preferred\&.
-.RE
-.PP
-\-d \fIpath\fR
-.RS 4
-Location of the parent DS records\&. The
-\fIpath\fR
-can be the name of a file containing the DS records, or if it is a directory,
-\fBdnssec\-cds\fR
-looks for a
-dsset\-
-file for the
-\fIdomain\fR
-inside the directory\&.
-.sp
-To protect against replay attacks, child records are rejected if they were signed earlier than the modification time of the
-dsset\-
-file\&. This can be adjusted with the
-\fB\-s\fR
-option\&.
-.RE
-.PP
-\-f \fIchild\-file\fR
-.RS 4
-File containing the child\*(Aqs CDS and/or CDNSKEY records, plus its DNSKEY records and the covering RRSIG records so that they can be authenticated\&.
-.sp
-The EXAMPLES below describe how to generate this file\&.
-.RE
-.PP
-\-i [\fIextension\fR]
-.RS 4
-Update the
-dsset\-
-file in place, instead of writing DS records to the standard output\&.
-.sp
-There must be no space between the
-\fB\-i\fR
-and the
-\fIextension\fR\&. If you provide no
-\fIextension\fR
-then the old
-dsset\-
-is discarded\&. If an
-\fIextension\fR
-is present, a backup of the old
-dsset\-
-file is kept with the
-\fIextension\fR
-appended to its filename\&.
-.sp
-To protect against replay attacks, the modification time of the
-dsset\-
-file is set to match the signature inception time of the child records, provided that is later than the file\*(Aqs current modification time\&.
-.RE
-.PP
-\-s \fIstart\-time\fR
-.RS 4
-Specify the date and time after which RRSIG records become acceptable\&. This can be either an absolute or relative time\&. An absolute start time is indicated by a number in YYYYMMDDHHMMSS notation; 20170827133700 denotes 13:37:00 UTC on August 27th, 2017\&. A time relative to the
-dsset\-
-file is indicated with \-N, which is N seconds before the file modification time\&. A time relative to the current time is indicated with now+N\&.
-.sp
-If no
-\fIstart\-time\fR
-is specified, the modification time of the
-dsset\-
-file is used\&.
-.RE
-.PP
-\-T \fIttl\fR
-.RS 4
-Specifies a TTL to be used for new DS records\&. If not specified, the default is the TTL of the old DS records\&. If they had no explicit TTL then the new DS records also have no explicit TTL\&.
-.RE
-.PP
-\-u
-.RS 4
-Write an
-\fBnsupdate\fR
-script to the standard output, instead of printing the new DS reords\&. The output will be empty if no change is needed\&.
-.sp
-Note: The TTL of new records needs to be specified, either in the original
-dsset\-
-file, or with the
-\fB\-T\fR
-option, or using the
-\fBnsupdate\fR\fBttl\fR
-command\&.
-.RE
-.PP
-\-V
-.RS 4
-Print version information\&.
-.RE
-.PP
-\-v \fIlevel\fR
-.RS 4
-Sets the debugging level\&. Level 1 is intended to be usefully verbose for general users; higher levels are intended for developers\&.
-.RE
-.PP
-\fIdomain\fR
-.RS 4
-The name of the delegation point / child zone apex\&.
-.RE
-.SH "EXIT STATUS"
-.PP
-The
-\fBdnssec\-cds\fR
-command exits 0 on success, or non\-zero if an error occurred\&.
-.PP
-In the success case, the DS records might or might not need to be changed\&.
-.SH "EXAMPLES"
-.PP
-Before running
-\fBdnssec\-signzone\fR, you can ensure that the delegations are up\-to\-date by running
-\fBdnssec\-cds\fR
-on every
-dsset\-
-file\&.
-.PP
-To fetch the child records required by
-\fBdnssec\-cds\fR
-you can invoke
-\fBdig\fR
-as in the script below\&. It\*(Aqs okay if the
-\fBdig\fR
-fails since
-\fBdnssec\-cds\fR
-performs all the necessary checking\&.
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-for f in dsset\-*
-do
-	d=${f#dsset\-}
-	dig +dnssec +noall +answer $d DNSKEY $d CDNSKEY $d CDS |
-	dnssec\-cds \-i \-f /dev/stdin \-d $f $d
-done
-.fi
-.if n \{\
-.RE
-.\}
-.PP
-When the parent zone is automatically signed by
-\fBnamed\fR, you can use
-\fBdnssec\-cds\fR
-with
-\fBnsupdate\fR
-to maintain a delegation as follows\&. The
-dsset\-
-file allows the script to avoid having to fetch and validate the parent DS records, and it keeps the replay attack protection time\&.
-.sp
-.if n \{\
-.RS 4
-.\}
-.nf
-dig +dnssec +noall +answer $d DNSKEY $d CDNSKEY $d CDS |
-dnssec\-cds \-u \-i \-f /dev/stdin \-d $f $d |
-nsupdate \-l
-.fi
-.if n \{\
-.RE
-.\}
-.SH "SEE ALSO"
-.PP
-\fBdig\fR(1),
-\fBdnssec-settime\fR(8),
-\fBdnssec-signzone\fR(8),
-\fBnsupdate\fR(1),
-BIND 9 Administrator Reference Manual,
-RFC 7344\&.
-.SH "AUTHORS"
-.PP
-\fBInternet Systems Consortium, Inc\&.\fR
-.PP
-\fBTony Finch\fR <\&dot@dotat\&.at\&>, <\&fanf2@cam\&.ac\&.uk\&>
-.br
-.RS 4
-.RE
-.SH "COPYRIGHT"
-.br
-Copyright \(co 2017 Internet Systems Consortium, Inc. ("ISC")
-.br

bin/dnssec/dnssec-cds.docbook

@@ -1,373 +0,0 @@
-<!--
- - Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
- -
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-
-<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-cds">
-  <info>
-    <date>2017-10-02</date>
-  </info>
-  <refentryinfo>
-    <corpname>ISC</corpname>
-    <corpauthor>Internet Systems Consortium, Inc.</corpauthor>
-    <author>
-      <personname>Tony Finch</personname>
-      <email>dot@dotat.at</email>
-      <email>fanf2@cam.ac.uk</email>
-      <affiliation>Cambridge University Information Services</affiliation>
-      <personblurb></personblurb>
-    </author>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle><application>dnssec-cds</application></refentrytitle>
-   <manvolnum>8</manvolnum>
-    <refmiscinfo>BIND9</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname><application>dnssec-cds</application></refname>
-    <refpurpose>change DS records for a child zone based on CDS/CDNSKEY</refpurpose>
-  </refnamediv>
-
-  <docinfo>
-    <copyright>
-      <year>2017</year>
-      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
-    </copyright>
-  </docinfo>
-
-  <refsynopsisdiv>
-    <cmdsynopsis sepchar=" ">
-      <command>dnssec-cds</command>
-      <arg choice="opt" rep="repeat"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-D</option></arg>
-      <arg choice="req" rep="norepeat"><option>-d <replaceable class="parameter">dsset-file</replaceable></option></arg>
-      <arg choice="req" rep="norepeat"><option>-f <replaceable class="parameter">child-file</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-i</option><arg choice="opt" rep="norepeat"><replaceable class="parameter">extension</replaceable></arg></arg>
-      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">start-time</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">ttl</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-u</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-V</option></arg>
-      <arg choice="req" rep="norepeat">domain</arg>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsection><info><title>DESCRIPTION</title></info>
-
-    <para>
-      The <command>dnssec-cds</command> command changes DS records at
-      a delegation point based on CDS or CDNSKEY records published in
-      the child zone. If both CDS and CDNSKEY records are present in
-      the child zone, the CDS is preferred.
-    </para>
-    <para>
-      Two input files are required.  The
-      <option>-f <replaceable class="parameter">child-file</replaceable></option>
-      option specifies a file containing the child's CDS and/or CDNSKEY
-      records, plus RRSIG and DNSKEY records so that they can be
-      authenticated.  The
-      <option>-d <replaceable class="parameter">path</replaceable></option>
-      option specifies the location of a file containing the current DS
-      records. For example, this could be a <filename>dsset-</filename>
-      file generated by <command>dnssec-signzone</command>, or the output of
-      <command>dnssec-dsfromkey</command>, or the output of a previous
-      run of <command>dnssec-cds</command>.
-    </para>
-    <para>
-      For protection against replay attacks, the signatures on the
-      child records must not be older than they were on a previous run
-      of <command>dnssec-cds</command>. This time is obtained from the
-      modification time of the <filename>dsset-</filename> file, or
-      from the <option>-s</option> option.
-    </para>
-    <para>
-      To protect against breaking the delegation,
-      <command>dnssec-cds</command> ensures that the DNSKEY RRset can be
-      verified by every key algorithm in the new DS RRset, and that the
-      same set of keys are covered by every DS digest type.
-    </para>
-    <para>
-      By default, replacement DS records are written to the standard
-      output; with the <option>-i</option> option the input file is
-      overwritten in place. The replacement DS records will be the
-      same as the existing records when no change is required. The
-      output can be empty if the CDS / CDNSKEY records specify that
-      the child zone wants to go insecure.
-    </para>
-    <para>
-      Warning: Be careful not to delete the DS records
-      when <command>dnssec-cds</command> fails!
-    </para>
-    <para>
-      Alternatively, <command>dnssec-cds -u</command> writes
-      an <command>nsupdate</command> script to the standard output.
-      You can use the <option>-u</option> and <option>-i</option>
-      options together to maintain a <filename>dsset-</filename> file
-      as well as emit an <command>nsupdate</command> script.
-    </para>
-
-  </refsection>
-
-  <refsection><info><title>OPTIONS</title></info>
-
-    <variablelist>
-
-      <varlistentry>
-	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
-        <listitem>
-          <para>
-	    Specify a digest algorithm to use when converting CDNSKEY
-	    records to DS records. This option can be repeated, so
-	    that multiple DS records are created for each CDNSKEY
-	    record. This option has no effect when using CDS records.
-          </para>
-          <para>
-	    The <replaceable>algorithm</replaceable> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
-	    values are case insensitive. If no algorithm is specified,
-	    the default is SHA-256.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-c <replaceable class="parameter">class</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the DNS class of the zones.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-D</term>
-        <listitem>
-          <para>
-	    Generate DS records from CDNSKEY records if both CDS and
-	    CDNSKEY records are present in the child zone. By default
-	    CDS records are preferred.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-d <replaceable class="parameter">path</replaceable></term>
-        <listitem>
-          <para>
-            Location of the parent DS records.
-	    The <replaceable>path</replaceable> can be the name of a file
-	    containing the DS records, or if it is a
-	    directory, <command>dnssec-cds</command> looks for
-	    a <filename>dsset-</filename> file for
-	    the <replaceable>domain</replaceable> inside the directory.
-          </para>
-          <para>
-            To protect against replay attacks, child records are
-            rejected if they were signed earlier than the modification
-            time of the <filename>dsset-</filename> file. This can be
-            adjusted with the <option>-s</option> option.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-f <replaceable class="parameter">child-file</replaceable></term>
-        <listitem>
-          <para>
-	    File containing the child's CDS and/or CDNSKEY records,
-	    plus its DNSKEY records and the covering RRSIG records so
-	    that they can be authenticated.
-          </para>
-	  <para>
-	    The EXAMPLES below describe how to generate this file.
-	  </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-i<arg choice="opt" rep="norepeat"><replaceable class="parameter">extension</replaceable></arg></term>
-        <listitem>
-          <para>
-            Update the <filename>dsset-</filename> file in place,
-            instead of writing DS records to the standard output.
-          </para>
-	  <para>
-	    There must be no space between the <option>-i</option> and
-	    the <replaceable>extension</replaceable>. If you provide
-	    no <replaceable>extension</replaceable> then the
-	    old <filename>dsset-</filename> is discarded. If
-	    an <replaceable>extension</replaceable> is present, a
-	    backup of the old <filename>dsset-</filename> file is kept
-	    with the <replaceable>extension</replaceable> appended to
-	    its filename.
-	  </para>
-          <para>
-            To protect against replay attacks, the modification time
-            of the <filename>dsset-</filename> file is set to match
-            the signature inception time of the child records,
-            provided that is later than the file's current
-            modification time.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-s <replaceable class="parameter">start-time</replaceable></term>
-        <listitem>
-          <para>
-            Specify the date and time after which RRSIG records become
-            acceptable. This can be either an absolute or relative
-            time. An absolute start time is indicated by a number in
-            YYYYMMDDHHMMSS notation; 20170827133700 denotes 13:37:00
-            UTC on August 27th, 2017. A time relative to
-            the <filename>dsset-</filename> file is indicated with -N,
-            which is N seconds before the file modification time. A
-            time relative to the current time is indicated with now+N.
-	  </para>
-	  <para>
-            If no <replaceable>start-time</replaceable> is specified, the
-            modification time of the <filename>dsset-</filename> file
-            is used.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-T <replaceable class="parameter">ttl</replaceable></term>
-        <listitem>
-          <para>
-            Specifies a TTL to be used for new DS records. If not
-            specified, the default is the TTL of the old DS records.
-            If they had no explicit TTL then the new DS records also
-            have no explicit TTL.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-u</term>
-        <listitem>
-          <para>
-	    Write an <command>nsupdate</command> script to the
-	    standard output, instead of printing the new DS reords.
-	    The output will be empty if no change is needed.
-          </para>
-	  <para>
-	    Note: The TTL of new records needs to be specified, either
-	    in the original <filename>dsset-</filename> file, or with
-	    the <option>-T</option> option, or using
-	    the <command>nsupdate</command> <command>ttl</command>
-	    command.
-	  </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-	<term>-V</term>
-        <listitem>
-	  <para>
-	    Print version information.
-	  </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-v <replaceable class="parameter">level</replaceable></term>
-        <listitem>
-          <para>
-            Sets the debugging level. Level 1 is intended to be
-            usefully verbose for general users; higher levels are
-            intended for developers.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><replaceable>domain</replaceable></term>
-        <listitem>
-          <para>
-            The name of the delegation point / child zone apex.
-          </para>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-  </refsection>
-
-  <refsection><info><title>EXIT STATUS</title></info>
-
-    <para>
-      The <command>dnssec-cds</command> command exits 0 on success, or
-      non-zero if an error occurred.
-    </para>
-    <para>
-      In the success case, the DS records might or might not need
-      to be changed.
-    </para>
-
-  </refsection>
-
-  <refsection><info><title>EXAMPLES</title></info>
-
-    <para>
-      Before running <command>dnssec-signzone</command>, you can ensure
-      that the delegations are up-to-date by running
-      <command>dnssec-cds</command> on every <filename>dsset-</filename> file.
-    </para>
-    <para>
-      To fetch the child records required by <command>dnssec-cds</command>
-      you can invoke <command>dig</command> as in the script below.  It's
-      okay if the <command>dig</command> fails since
-      <command>dnssec-cds</command> performs all the necessary checking.
-    </para>
-<programlisting>for f in dsset-*
-do
-	d=${f#dsset-}
-	dig +dnssec +noall +answer $d DNSKEY $d CDNSKEY $d CDS |
-	dnssec-cds -i -f /dev/stdin -d $f $d
-done
-</programlisting>
-
-    <para>
-      When the parent zone is automatically signed by
-      <command>named</command>, you can use <command>dnssec-cds</command>
-      with <command>nsupdate</command> to maintain a delegation as follows.
-      The <filename>dsset-</filename> file allows the script to avoid
-      having to fetch and validate the parent DS records, and it keeps the
-      replay attack protection time.
-    </para>
-<programlisting>
-dig +dnssec +noall +answer $d DNSKEY $d CDNSKEY $d CDS |
-dnssec-cds -u -i -f /dev/stdin -d $f $d |
-nsupdate -l
-</programlisting>
-  </refsection>
-
-  <refsection><info><title>SEE ALSO</title></info>
-
-    <para>
-      <citerefentry>
-        <refentrytitle>dig</refentrytitle><manvolnum>1</manvolnum>
-      </citerefentry>,
-      <citerefentry>
-        <refentrytitle>dnssec-settime</refentrytitle><manvolnum>8</manvolnum>
-      </citerefentry>,
-      <citerefentry>
-        <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
-      </citerefentry>,
-      <citerefentry>
-        <refentrytitle>nsupdate</refentrytitle><manvolnum>1</manvolnum>
-      </citerefentry>,
-      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 7344</citetitle>.
-    </para>
-
-  </refsection>
-
-</refentry>

bin/dnssec/dnssec-cds.html

@@ -1,332 +0,0 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
-<!--
- - Copyright (C) 2017 Internet Systems Consortium, Inc. ("ISC")
- - 
- - This Source Code Form is subject to the terms of the Mozilla Public
- - License, v. 2.0. If a copy of the MPL was not distributed with this
- - file, You can obtain one at http://mozilla.org/MPL/2.0/.
--->
-<html lang="en">
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
-<title>dnssec-cds</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
-</head>
-<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
-<a name="man.dnssec-cds"></a><div class="titlepage"></div>
-  
-  
-
-  
-
-  <div class="refnamediv">
-<h2>Name</h2>
-<p>
-    <span class="application">dnssec-cds</span>
-     &#8212; change DS records for a child zone based on CDS/CDNSKEY
-  </p>
-</div>
-
-  
-
-  <div class="refsynopsisdiv">
-<h2>Synopsis</h2>
-    <div class="cmdsynopsis"><p>
-      <code class="command">dnssec-cds</code> 
-       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>...]
-       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
-       [<code class="option">-D</code>]
-       {<code class="option">-d <em class="replaceable"><code>dsset-file</code></em></code>}
-       {<code class="option">-f <em class="replaceable"><code>child-file</code></em></code>}
-       [<code class="option">-i</code> [<em class="replaceable"><code>extension</code></em>]]
-       [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>]
-       [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>]
-       [<code class="option">-u</code>]
-       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-V</code>]
-       {domain}
-    </p></div>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.7"></a><h2>DESCRIPTION</h2>
-
-    <p>
-      The <span class="command"><strong>dnssec-cds</strong></span> command changes DS records at
-      a delegation point based on CDS or CDNSKEY records published in
-      the child zone. If both CDS and CDNSKEY records are present in
-      the child zone, the CDS is preferred.
-    </p>
-    <p>
-      Two input files are required.  The
-      <code class="option">-f <em class="replaceable"><code>child-file</code></em></code>
-      option specifies a file containing the child's CDS and/or CDNSKEY
-      records, plus RRSIG and DNSKEY records so that they can be
-      authenticated.  The
-      <code class="option">-d <em class="replaceable"><code>path</code></em></code>
-      option specifies the location of a file containing the current DS
-      records. For example, this could be a <code class="filename">dsset-</code>
-      file generated by <span class="command"><strong>dnssec-signzone</strong></span>, or the output of
-      <span class="command"><strong>dnssec-dsfromkey</strong></span>, or the output of a previous
-      run of <span class="command"><strong>dnssec-cds</strong></span>.
-    </p>
-    <p>
-      For protection against replay attacks, the signatures on the
-      child records must not be older than they were on a previous run
-      of <span class="command"><strong>dnssec-cds</strong></span>. This time is obtained from the
-      modification time of the <code class="filename">dsset-</code> file, or
-      from the <code class="option">-s</code> option.
-    </p>
-    <p>
-      To protect against breaking the delegation,
-      <span class="command"><strong>dnssec-cds</strong></span> ensures that the DNSKEY RRset can be
-      verified by every key algorithm in the new DS RRset, and that the
-      same set of keys are covered by every DS digest type.
-    </p>
-    <p>
-      By default, replacement DS records are written to the standard
-      output; with the <code class="option">-i</code> option the input file is
-      overwritten in place. The replacement DS records will be the
-      same as the existing records when no change is required. The
-      output can be empty if the CDS / CDNSKEY records specify that
-      the child zone wants to go insecure.
-    </p>
-    <p>
-      Warning: Be careful not to delete the DS records
-      when <span class="command"><strong>dnssec-cds</strong></span> fails!
-    </p>
-    <p>
-      Alternatively, <span class="command"><strong>dnssec-cds -u</strong></span> writes
-      an <span class="command"><strong>nsupdate</strong></span> script to the standard output.
-      You can use the <code class="option">-u</code> and <code class="option">-i</code>
-      options together to maintain a <code class="filename">dsset-</code> file
-      as well as emit an <span class="command"><strong>nsupdate</strong></span> script.
-    </p>
-
-  </div>
-
-  <div class="refsection">
-<a name="id-1.8"></a><h2>OPTIONS</h2>
-
-    <div class="variablelist"><dl class="variablelist">
-<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
-<dd>
-          <p>
-	    Specify a digest algorithm to use when converting CDNSKEY
-	    records to DS records. This option can be repeated, so
-	    that multiple DS records are created for each CDNSKEY
-	    record. This option has no effect when using CDS records.
-          </p>
-          <p>
-	    The <em class="replaceable"><code>algorithm</code></em> must be one of SHA-1
-	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
-	    values are case insensitive. If no algorithm is specified,
-	    the default is SHA-256.
-          </p>
-        </dd>
-<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd>
-          <p>
-            Specifies the DNS class of the zones.
-          </p>
-        </dd>
-<dt><span class="term">-D</span></dt>
-<dd>
-          <p>
-	    Generate DS records from CDNSKEY records if both CDS and
-	    CDNSKEY records are present in the child zone. By default
-	    CDS records are preferred.
-          </p>
-        </dd>
-<dt><span class="term">-d <em class="replaceable"><code>path</code></em></span></dt>
-<dd>
-          <p>
-            Location of the parent DS records.
-	    The <em class="replaceable"><code>path</code></em> can be the name of a file
-	    containing the DS records, or if it is a
-	    directory, <span class="command"><strong>dnssec-cds</strong></span> looks for
-	    a <code class="filename">dsset-</code> file for
-	    the <em class="replaceable"><code>domain</code></em> inside the directory.
-          </p>
-          <p>
-            To protect against replay attacks, child records are
-            rejected if they were signed earlier than the modification
-            time of the <code class="filename">dsset-</code> file. This can be
-            adjusted with the <code class="option">-s</code> option.
-          </p>
-        </dd>
-<dt><span class="term">-f <em class="replaceable"><code>child-file</code></em></span></dt>
-<dd>
-          <p>
-	    File containing the child's CDS and/or CDNSKEY records,
-	    plus its DNSKEY records and the covering RRSIG records so
-	    that they can be authenticated.
-          </p>
-	  <p>
-	    The EXAMPLES below describe how to generate this file.
-	  </p>
-        </dd>
-<dt><span class="term">-i[<em class="replaceable"><code>extension</code></em>]</span></dt>
-<dd>
-          <p>
-            Update the <code class="filename">dsset-</code> file in place,
-            instead of writing DS records to the standard output.
-          </p>
-	  <p>
-	    There must be no space between the <code class="option">-i</code> and
-	    the <em class="replaceable"><code>extension</code></em>. If you provide
-	    no <em class="replaceable"><code>extension</code></em> then the
-	    old <code class="filename">dsset-</code> is discarded. If
-	    an <em class="replaceable"><code>extension</code></em> is present, a
-	    backup of the old <code class="filename">dsset-</code> file is kept
-	    with the <em class="replaceable"><code>extension</code></em> appended to
-	    its filename.
-	  </p>
-          <p>
-            To protect against replay attacks, the modification time
-            of the <code class="filename">dsset-</code> file is set to match
-            the signature inception time of the child records,
-            provided that is later than the file's current
-            modification time.
-          </p>
-        </dd>
-<dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
-<dd>
-          <p>
-            Specify the date and time after which RRSIG records become
-            acceptable. This can be either an absolute or relative
-            time. An absolute start time is indicated by a number in
-            YYYYMMDDHHMMSS notation; 20170827133700 denotes 13:37:00
-            UTC on August 27th, 2017. A time relative to
-            the <code class="filename">dsset-</code> file is indicated with -N,
-            which is N seconds before the file modification time. A
-            time relative to the current time is indicated with now+N.
-	  </p>
-	  <p>
-            If no <em class="replaceable"><code>start-time</code></em> is specified, the
-            modification time of the <code class="filename">dsset-</code> file
-            is used.
-          </p>
-        </dd>
-<dt><span class="term">-T <em class="replaceable"><code>ttl</code></em></span></dt>
-<dd>
-          <p>
-            Specifies a TTL to be used for new DS records. If not
-            specified, the default is the TTL of the old DS records.
-            If they had no explicit TTL then the new DS records also
-            have no explicit TTL.
-          </p>
-        </dd>
-<dt><span class="term">-u</span></dt>
-<dd>
-          <p>
-	    Write an <span class="command"><strong>nsupdate</strong></span> script to the
-	    standard output, instead of printing the new DS reords.
-	    The output will be empty if no change is needed.
-          </p>
-	  <p>
-	    Note: The TTL of new records needs to be specified, either
-	    in the original <code class="filename">dsset-</code> file, or with
-	    the <code class="option">-T</code> option, or using
-	    the <span class="command"><strong>nsupdate</strong></span> <span class="command"><strong>ttl</strong></span>
-	    command.
-	  </p>
-        </dd>
-<dt><span class="term">-V</span></dt>
-<dd>
-	  <p>
-	    Print version information.
-	  </p>
-        </dd>
-<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd>
-          <p>
-            Sets the debugging level. Level 1 is intended to be
-            usefully verbose for general users; higher levels are
-            intended for developers.
-          </p>
-        </dd>
-<dt><span class="term"><em class="replaceable"><code>domain</code></em></span></dt>
-<dd>
-          <p>
-            The name of the delegation point / child zone apex.
-          </p>
-        </dd>
-</dl></div>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.9"></a><h2>EXIT STATUS</h2>
-
-    <p>
-      The <span class="command"><strong>dnssec-cds</strong></span> command exits 0 on success, or
-      non-zero if an error occurred.
-    </p>
-    <p>
-      In the success case, the DS records might or might not need
-      to be changed.
-    </p>
-
-  </div>
-
-  <div class="refsection">
-<a name="id-1.10"></a><h2>EXAMPLES</h2>
-
-    <p>
-      Before running <span class="command"><strong>dnssec-signzone</strong></span>, you can ensure
-      that the delegations are up-to-date by running
-      <span class="command"><strong>dnssec-cds</strong></span> on every <code class="filename">dsset-</code> file.
-    </p>
-    <p>
-      To fetch the child records required by <span class="command"><strong>dnssec-cds</strong></span>
-      you can invoke <span class="command"><strong>dig</strong></span> as in the script below.  It's
-      okay if the <span class="command"><strong>dig</strong></span> fails since
-      <span class="command"><strong>dnssec-cds</strong></span> performs all the necessary checking.
-    </p>
-<pre class="programlisting">for f in dsset-*
-do
-	d=${f#dsset-}
-	dig +dnssec +noall +answer $d DNSKEY $d CDNSKEY $d CDS |
-	dnssec-cds -i -f /dev/stdin -d $f $d
-done
-</pre>
-
-    <p>
-      When the parent zone is automatically signed by
-      <span class="command"><strong>named</strong></span>, you can use <span class="command"><strong>dnssec-cds</strong></span>
-      with <span class="command"><strong>nsupdate</strong></span> to maintain a delegation as follows.
-      The <code class="filename">dsset-</code> file allows the script to avoid
-      having to fetch and validate the parent DS records, and it keeps the
-      replay attack protection time.
-    </p>
-<pre class="programlisting">
-dig +dnssec +noall +answer $d DNSKEY $d CDNSKEY $d CDS |
-dnssec-cds -u -i -f /dev/stdin -d $f $d |
-nsupdate -l
-</pre>
-  </div>
-
-  <div class="refsection">
-<a name="id-1.11"></a><h2>SEE ALSO</h2>
-
-    <p>
-      <span class="citerefentry">
-        <span class="refentrytitle">dig</span>(1)
-      </span>,
-      <span class="citerefentry">
-        <span class="refentrytitle">dnssec-settime</span>(8)
-      </span>,
-      <span class="citerefentry">
-        <span class="refentrytitle">dnssec-signzone</span>(8)
-      </span>,
-      <span class="citerefentry">
-        <span class="refentrytitle">nsupdate</span>(1)
-      </span>,
-      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 7344</em>.
-    </p>
-
-  </div>
-
-</div></body>
-</html>

bin/dnssec/dnssec-dsfromkey.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008-2012, 2014-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -183,7 +183,7 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	result = dst_key_fromnamedfile(filename, NULL, DST_TYPE_PUBLIC,
 				       mctx, &key);
 	if (result != ISC_R_SUCCESS)
-		fatal("can't load %s.key: %s",
+		fatal("invalid keyfile name %s: %s",
 		      filename, isc_result_totext(result));
 
 	if (verbose > 2) {
@@ -346,7 +346,7 @@ usage(void) {
 
 int
 main(int argc, char **argv) {
-	char		*classname = NULL;
+	char		*algname = NULL, *classname = NULL;
 	char		*filename = NULL, *dir = NULL, *namestr;
 	char		*lookaside = NULL;
 	char		*endp;
@@ -393,7 +393,7 @@ main(int argc, char **argv) {
 			showall = ISC_TRUE;
 			break;
 		case 'a':
-			dtype = strtodsdigest(isc_commandline_argument);
+			algname = isc_commandline_argument;
 			both = ISC_FALSE;
 			break;
 		case 'C':
@@ -430,7 +430,7 @@ main(int argc, char **argv) {
 			break;
 		case 'T':
 			emitttl = ISC_TRUE;
-			ttl = strtottl(isc_commandline_argument);
+			ttl = atol(isc_commandline_argument);
 			break;
 		case 'v':
 			verbose = strtol(isc_commandline_argument, &endp, 0);
@@ -460,6 +460,24 @@ main(int argc, char **argv) {
 		}
 	}
 
+	if (algname != NULL) {
+		if (strcasecmp(algname, "SHA1") == 0 ||
+		    strcasecmp(algname, "SHA-1") == 0)
+			dtype = DNS_DSDIGEST_SHA1;
+		else if (strcasecmp(algname, "SHA256") == 0 ||
+			 strcasecmp(algname, "SHA-256") == 0)
+			dtype = DNS_DSDIGEST_SHA256;
+#if defined(HAVE_OPENSSL_GOST) || defined(HAVE_PKCS11_GOST)
+		else if (strcasecmp(algname, "GOST") == 0)
+			dtype = DNS_DSDIGEST_GOST;
+#endif
+		else if (strcasecmp(algname, "SHA384") == 0 ||
+			 strcasecmp(algname, "SHA-384") == 0)
+			dtype = DNS_DSDIGEST_SHA384;
+		else
+			fatal("unknown algorithm %s", algname);
+	}
+
 	rdclass = strtoclass(classname);
 
 	if (usekeyset && filename != NULL)
@@ -476,14 +494,14 @@ main(int argc, char **argv) {
 
 	if (ectx == NULL)
 		setup_entropy(mctx, NULL, &ectx);
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("could not initialize hash");
 	result = dst_lib_init(mctx, ectx,
 			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("could not initialize hash");
 	isc_entropy_stopcallbacksources(ectx);
 
 	setup_logging(mctx, &log);
@@ -545,8 +563,8 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
-	isc_hash_destroy();
 	dst_lib_destroy();
+	isc_hash_destroy();
 	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)

bin/dnssec/dnssec-importkey.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2013-2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -405,14 +405,14 @@ main(int argc, char **argv) {
 
 	if (ectx == NULL)
 		setup_entropy(mctx, NULL, &ectx);
+	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS)
+		fatal("could not initialize hash");
 	result = dst_lib_init(mctx, ectx,
 			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("could not initialize hash");
 	isc_entropy_stopcallbacksources(ectx);
 
 	setup_logging(mctx, &log);
@@ -456,8 +456,8 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
-	isc_hash_destroy();
 	dst_lib_destroy();
+	isc_hash_destroy();
 	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)

bin/dnssec/dnssec-keyfromlabel.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -55,7 +55,7 @@ of the key is specified on the command line\&. This must match the name of the z
 .RS 4
 Selects the cryptographic algorithm\&. The value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256 or ECDSAP384SHA384\&. These values are case insensitive\&.
 .sp
 If no algorithm is specified, then RSASHA1 will be used by default, unless the
 \fB\-3\fR
@@ -63,20 +63,14 @@ option is specified, in which case NSEC3RSASHA1 will be used instead\&. (If
 \fB\-3\fR
 is used and an algorithm is specified, that algorithm will be checked for compatibility with NSEC3\&.)
 .sp
-These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
-\fB\-3\fR
-option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
+Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement algorithm, and DSA is recommended\&.
 .sp
-As of BIND 9\&.12\&.0, this option is mandatory except when using the
-\fB\-S\fR
-option (which copies the algorithm from the predecessory key)\&. Previously, the default for newly generated keys was RSASHA1\&.
+Note 2: DH automatically sets the \-k flag\&.
 .RE
 .PP
 \-3
 .RS 4
-Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used with an algorithm that has both NSEC and NSEC3 versions, then the NSEC3 version will be used; for example,
-\fBdnssec\-keygen \-3a RSASHA1\fR
-specifies the NSEC3RSASHA1 algorithm\&.
+Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used and no algorithm is explicitly set on the command line, NSEC3RSASHA1 will be used by default\&.
 .RE
 .PP
 \-E \fIengine\fR
@@ -307,5 +301,5 @@ The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13)\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-keyfromlabel.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2012, 2014-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -46,6 +46,14 @@
 const char *program = "dnssec-keyfromlabel";
 int verbose;
 
+#define DEFAULT_ALGORITHM "RSASHA1"
+#define DEFAULT_NSEC3_ALGORITHM "NSEC3RSASHA1"
+
+static const char *algs = "RSA | RSAMD5 | DH | DSA | RSASHA1 |"
+			  " NSEC3DSA | NSEC3RSASHA1 |"
+			  " RSASHA256 | RSASHA512 | ECCGOST |"
+			  " ECDSAP256SHA256 | ECDSAP384SHA384";
+
 ISC_PLATFORM_NORETURN_PRE static void
 usage(void) ISC_PLATFORM_NORETURN_POST;
 
@@ -59,11 +67,9 @@ usage(void) {
 	fprintf(stderr, "    -l label: label of the key pair\n");
 	fprintf(stderr, "    name: owner of the key\n");
 	fprintf(stderr, "Other options:\n");
-	fprintf(stderr, "    -a algorithm: \n"
-			"        RSA | RSAMD5 | DH | DSA | RSASHA1 |\n"
-			"        NSEC3DSA | NSEC3RSASHA1 |\n"
-			"        RSASHA256 | RSASHA512 | ECCGOST |\n"
-			"        ECDSAP256SHA256 | ECDSAP384SHA384\n");
+	fprintf(stderr, "    -a algorithm: %s\n", algs);
+	fprintf(stderr, "       (default: RSASHA1, or "
+			       "NSEC3RSASHA1 if using -3)\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
 	fprintf(stderr, "    -E <engine>:\n");
@@ -149,7 +155,7 @@ main(int argc, char **argv) {
 	char		*label = NULL;
 	dns_ttl_t	ttl = 0;
 	isc_stdtime_t	publish = 0, activate = 0, revoke = 0;
-	isc_stdtime_t	inactive = 0, deltime = 0;
+	isc_stdtime_t	inactive = 0, delete = 0;
 	isc_stdtime_t	now;
 	int		prepub = -1;
 	isc_boolean_t	setpub = ISC_FALSE, setact = ISC_FALSE;
@@ -311,8 +317,8 @@ main(int argc, char **argv) {
 			if (setdel || unsetdel)
 				fatal("-D specified more than once");
 
-			deltime = strtotime(isc_commandline_argument,
-					    now, now, &setdel);
+			delete = strtotime(isc_commandline_argument,
+					   now, now, &setdel);
 			unsetdel = !setdel;
 			break;
 		case 'S':
@@ -387,7 +393,16 @@ main(int argc, char **argv) {
 		}
 
 		if (algname == NULL) {
-			fatal("no algorithm specified");
+			if (use_nsec3)
+				algname = strdup(DEFAULT_NSEC3_ALGORITHM);
+			else
+				algname = strdup(DEFAULT_ALGORITHM);
+			if (algname == NULL)
+				fatal("strdup failed");
+			freeit = algname;
+			if (verbose > 0)
+				fprintf(stderr, "no algorithm specified; "
+					"defaulting to %s\n", algname);
 		}
 
 		if (strcasecmp(algname, "RSA") == 0) {
@@ -418,28 +433,13 @@ main(int argc, char **argv) {
 				options |= DST_TYPE_KEY;
 		}
 
-		if (use_nsec3) {
-			switch (alg) {
-			case DST_ALG_DSA:
-				alg = DST_ALG_NSEC3DSA;
-				break;
-			case DST_ALG_RSASHA1:
-				alg = DST_ALG_NSEC3RSASHA1;
-				break;
-			case DST_ALG_NSEC3DSA:
-			case DST_ALG_NSEC3RSASHA1:
-			case DST_ALG_RSASHA256:
-			case DST_ALG_RSASHA512:
-			case DST_ALG_ECCGOST:
-			case DST_ALG_ECDSA256:
-			case DST_ALG_ECDSA384:
-			case DST_ALG_ED25519:
-			case DST_ALG_ED448:
-				break;
-			default:
-				fatal("%s is incompatible with NSEC3; "
-				      "do not use the -3 option", algname);
-			}
+		if (use_nsec3 &&
+		    alg != DST_ALG_NSEC3DSA && alg != DST_ALG_NSEC3RSASHA1 &&
+		    alg != DST_ALG_RSASHA256 && alg != DST_ALG_RSASHA512 &&
+		    alg != DST_ALG_ECCGOST &&
+		    alg != DST_ALG_ECDSA256 && alg != DST_ALG_ECDSA384) {
+			fatal("%s is incompatible with NSEC3; "
+			      "do not use the -3 option", algname);
 		}
 
 		if (type != NULL && (options & DST_TYPE_KEY) != 0) {
@@ -662,7 +662,7 @@ main(int argc, char **argv) {
 			dst_key_settime(key, DST_TIME_INACTIVE, inactive);
 
 		if (setdel)
-			dst_key_settime(key, DST_TIME_DELETE, deltime);
+			dst_key_settime(key, DST_TIME_DELETE, delete);
 	if (setsyncadd)
 		dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
 	if (setsyncdel)

bin/dnssec/dnssec-keyfromlabel.docbook

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2008-2012, 2014-2017  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
  -
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -38,7 +38,6 @@
       <year>2014</year>
       <year>2015</year>
       <year>2016</year>
-      <year>2017</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -103,7 +102,8 @@
 	    Selects the cryptographic algorithm.  The value of
 	    <option>algorithm</option> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
-	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
+	    ECDSAP256SHA256 or ECDSAP384SHA384.
+	    These values are case insensitive.
 	  </para>
 	  <para>
 	    If no algorithm is specified, then RSASHA1 will be used by
@@ -113,17 +113,11 @@
 	    that algorithm will be checked for compatibility with NSEC3.)
 	  </para>
 	  <para>
-	    These values are case insensitive. In some cases, abbreviations
-	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
-	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
-	    along with the <option>-3</option> option, then NSEC3RSASHA1
-	    or NSEC3DSA will be used instead.
+	    Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
+	    algorithm, and DSA is recommended.
 	  </para>
 	  <para>
-	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <option>-S</option> option (which copies the algorithm from
-	    the predecessory key). Previously, the default for newly
-	    generated keys was RSASHA1.
+	    Note 2: DH automatically sets the -k flag.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -133,10 +127,9 @@
 	<listitem>
 	  <para>
 	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used with an algorithm that has both
-	    NSEC and NSEC3 versions, then the NSEC3 version will be
-	    used; for example, <command>dnssec-keygen -3a RSASHA1</command>
-	    specifies the NSEC3RSASHA1 algorithm.
+	    If this option is used and no algorithm is explicitly
+	    set on the command line, NSEC3RSASHA1 will be used by
+	    default.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -460,30 +453,30 @@
       </varlistentry>
 
       <varlistentry>
-	<term>-i <replaceable class="parameter">interval</replaceable></term>
-	<listitem>
-	  <para>
-	    Sets the prepublication interval for a key.  If set, then
-	    the publication and activation dates must be separated by at least
-	    this much time.  If the activation date is specified but the
-	    publication date isn't, then the publication date will default
-	    to this much time before the activation date; conversely, if
-	    the publication date is specified but activation date isn't,
-	    then activation will be set to this much time after publication.
-	  </para>
-	  <para>
-	    If the key is being created as an explicit successor to another
-	    key, then the default prepublication interval is 30 days;
-	    otherwise it is zero.
-	  </para>
-	  <para>
-	    As with date offsets, if the argument is followed by one of
-	    the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
-	    interval is measured in years, months, weeks, days, hours,
-	    or minutes, respectively.  Without a suffix, the interval is
-	    measured in seconds.
-	  </para>
-	</listitem>
+        <term>-i <replaceable class="parameter">interval</replaceable></term>
+        <listitem>
+          <para>
+            Sets the prepublication interval for a key.  If set, then
+            the publication and activation dates must be separated by at least
+            this much time.  If the activation date is specified but the
+            publication date isn't, then the publication date will default
+            to this much time before the activation date; conversely, if
+            the publication date is specified but activation date isn't,
+            then activation will be set to this much time after publication.
+          </para>
+          <para>
+            If the key is being created as an explicit successor to another
+            key, then the default prepublication interval is 30 days;
+            otherwise it is zero.
+          </para>
+          <para>
+            As with date offsets, if the argument is followed by one of
+            the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
+            interval is measured in years, months, weeks, days, hours,
+            or minutes, respectively.  Without a suffix, the interval is
+            measured in seconds.
+          </para>
+        </listitem>
       </varlistentry>
 
     </variablelist>

bin/dnssec/dnssec-keyfromlabel.html

@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
  - 
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -91,7 +91,8 @@
 	    Selects the cryptographic algorithm.  The value of
 	    <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
-	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
+	    ECDSAP256SHA256 or ECDSAP384SHA384.
+	    These values are case insensitive.
 	  </p>
 	  <p>
 	    If no algorithm is specified, then RSASHA1 will be used by
@@ -101,27 +102,20 @@
 	    that algorithm will be checked for compatibility with NSEC3.)
 	  </p>
 	  <p>
-	    These values are case insensitive. In some cases, abbreviations
-	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
-	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
-	    along with the <code class="option">-3</code> option, then NSEC3RSASHA1
-	    or NSEC3DSA will be used instead.
+	    Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
+	    algorithm, and DSA is recommended.
 	  </p>
 	  <p>
-	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <code class="option">-S</code> option (which copies the algorithm from
-	    the predecessory key). Previously, the default for newly
-	    generated keys was RSASHA1.
+	    Note 2: DH automatically sets the -k flag.
 	  </p>
 	</dd>
 <dt><span class="term">-3</span></dt>
 <dd>
 	  <p>
 	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used with an algorithm that has both
-	    NSEC and NSEC3 versions, then the NSEC3 version will be
-	    used; for example, <span class="command"><strong>dnssec-keygen -3a RSASHA1</strong></span>
-	    specifies the NSEC3RSASHA1 algorithm.
+	    If this option is used and no algorithm is explicitly
+	    set on the command line, NSEC3RSASHA1 will be used by
+	    default.
 	  </p>
 	</dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
@@ -373,28 +367,28 @@
 	</dd>
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
-	  <p>
-	    Sets the prepublication interval for a key.  If set, then
-	    the publication and activation dates must be separated by at least
-	    this much time.  If the activation date is specified but the
-	    publication date isn't, then the publication date will default
-	    to this much time before the activation date; conversely, if
-	    the publication date is specified but activation date isn't,
-	    then activation will be set to this much time after publication.
-	  </p>
-	  <p>
-	    If the key is being created as an explicit successor to another
-	    key, then the default prepublication interval is 30 days;
-	    otherwise it is zero.
-	  </p>
-	  <p>
-	    As with date offsets, if the argument is followed by one of
-	    the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
-	    interval is measured in years, months, weeks, days, hours,
-	    or minutes, respectively.  Without a suffix, the interval is
-	    measured in seconds.
-	  </p>
-	</dd>
+          <p>
+            Sets the prepublication interval for a key.  If set, then
+            the publication and activation dates must be separated by at least
+            this much time.  If the activation date is specified but the
+            publication date isn't, then the publication date will default
+            to this much time before the activation date; conversely, if
+            the publication date is specified but activation date isn't,
+            then activation will be set to this much time after publication.
+          </p>
+          <p>
+            If the key is being created as an explicit successor to another
+            key, then the default prepublication interval is 30 days;
+            otherwise it is zero.
+          </p>
+          <p>
+            As with date offsets, if the argument is followed by one of
+            the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
+            interval is measured in years, months, weeks, days, hours,
+            or minutes, respectively.  Without a suffix, the interval is
+            measured in seconds.
+          </p>
+        </dd>
 </dl></div>
   </div>
 

bin/dnssec/dnssec-keygen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2005, 2007-2012, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2005, 2007-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -48,45 +48,34 @@ generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034\&. I
 The
 \fBname\fR
 of the key is specified on the command line\&. For DNSSEC keys, this must match the name of the zone for which the key is being generated\&.
-.PP
-The
-\fBdnssec\-keymgr\fR
-command acts as a wrapper around
-\fBdnssec\-keygen\fR, generating and updating keys as needed to enforce defined security policies such as key rollover scheduling\&. Using
-\fBdnssec\-keymgr\fR
-may be preferable to direct use of
-\fBdnssec\-keygen\fR\&.
 .SH "OPTIONS"
 .PP
 \-a \fIalgorithm\fR
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY and SIG(0) keys, the value must be DH (Diffie Hellman); specifying this value will automatically set the
-\fB\-T KEY\fR
-option as well\&.
+must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256 or ECDSAP384SHA384\&. For TSIG/TKEY, the value must be DH (Diffie Hellman), HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. These values are case insensitive\&.
 .sp
-TSIG keys can also by generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
-\fB\-T KEY\fR\&. Note, however, that
-\fBtsig\-keygen\fR
-produces TSIG keys in a more useful format\&. These algorithms have been deprecated in
-\fBdnssec\-keygen\fR, and will be removed in a future release\&.
-.sp
-These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
+If no algorithm is specified, then RSASHA1 will be used by default, unless the
 \fB\-3\fR
-option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
+option is specified, in which case NSEC3RSASHA1 will be used instead\&. (If
+\fB\-3\fR
+is used and an algorithm is specified, that algorithm will be checked for compatibility with NSEC3\&.)
 .sp
-As of BIND 9\&.12\&.0, this option is mandatory except when using the
-\fB\-S\fR
-option, which copies the algorithm from the predecessor key\&. Previously, the default for newly generated keys was RSASHA1\&.
+Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement algorithm, and DSA is recommended\&. For TSIG, HMAC\-MD5 is mandatory\&.
+.sp
+Note 2: DH, HMAC\-MD5, and HMAC\-SHA1 through HMAC\-SHA512 automatically set the \-T KEY option\&.
 .RE
 .PP
 \-b \fIkeysize\fR
 .RS 4
-Specifies the number of bits in the key\&. The choice of key size depends on the algorithm used\&. RSA keys must be between 1024 and 2048 bits\&. Diffie Hellman keys must be between 128 and 4096 bits\&. DSA keys must be between 512 and 1024 bits and an exact multiple of 64\&. HMAC keys must be between 1 and 512 bits\&. Elliptic curve algorithms don\*(Aqt need this parameter\&.
+Specifies the number of bits in the key\&. The choice of key size depends on the algorithm used\&. RSA keys must be between 512 and 2048 bits\&. Diffie Hellman keys must be between 128 and 4096 bits\&. DSA keys must be between 512 and 1024 bits and an exact multiple of 64\&. HMAC keys must be between 1 and 512 bits\&. Elliptic curve algorithms don\*(Aqt need this parameter\&.
 .sp
-If the key size is not specified, some algorithms have pre\-defined defaults\&. For example, RSA keys for use as DNSSEC zone signing keys have a default size of 1024 bits; RSA keys for use as key signing keys (KSKs, generated with
-\fB\-f KSK\fR) default to 2048 bits\&.
+The key size does not need to be specified if using a default algorithm\&. The default key size is 1024 bits for zone signing keys (ZSKs) and 2048 bits for key signing keys (KSKs, generated with
+\fB\-f KSK\fR)\&. However, if an algorithm is explicitly specified with the
+\fB\-a\fR, then there is no default key size, and the
+\fB\-b\fR
+must be used\&.
 .RE
 .PP
 \-n \fInametype\fR
@@ -98,9 +87,7 @@ must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a
 .PP
 \-3
 .RS 4
-Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used with an algorithm that has both NSEC and NSEC3 versions, then the NSEC3 version will be used; for example,
-\fBdnssec\-keygen \-3a RSASHA1\fR
-specifies the NSEC3RSASHA1 algorithm\&.
+Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used and no algorithm is explicitly set on the command line, NSEC3RSASHA1 will be used by default\&. Note that RSASHA256, RSASHA512, ECCGOST, ECDSAP256SHA256 and ECDSAP384SHA384 algorithms are NSEC3\-capable\&.
 .RE
 .PP
 \-C
@@ -180,17 +167,13 @@ indicating the progress of the key generation\&. A \*(Aq\&.\*(Aq indicates that
 .PP
 \-r \fIrandomdev\fR
 .RS 4
-Specifies a source of randomness\&. Normally, when generating DNSSEC keys, this option has no effect; the random number generation function provided by the cryptographic library will be used\&.
-.sp
-If that behavior is disabled at compile time, however, the specified file will be used as entropy source for key generation\&.
+Specifies the source of randomness\&. If the operating system does not provide a
+/dev/random
+or equivalent device, the default source of randomness is keyboard input\&.
 randomdev
-is the name of a character device or file containing random data to be used\&. The special value
+specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
 keyboard
 indicates that keyboard input should be used\&.
-.sp
-The default is
-/dev/random
-if the operating system provides it or an equivalent device; if not, the default source of randomness is keyboard input\&.
 .RE
 .PP
 \-S \fIkey\fR
@@ -208,9 +191,7 @@ Specifies the strength value of the key\&. The strength is a number between 0 an
 Specifies the resource record type to use for the key\&.
 \fBrrtype\fR
 must be either DNSKEY or KEY\&. The default is DNSKEY when using a DNSSEC algorithm, but it can be overridden to KEY for use with SIG(0)\&.
-Specifying any TSIG algorithm (HMAC\-* or DH) with
-\fB\-a\fR
-forces this option to KEY\&.
+Using any TSIG algorithm (HMAC\-* or DH) forces this option to KEY\&.
 .RE
 .PP
 \-t \fItype\fR
@@ -369,5 +350,5 @@ RFC 4034\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2005, 2007-2012, 2014-2017 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2005, 2007-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-keygen.c

@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 1999-2017  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1999-2016  Internet Systems Consortium, Inc. ("ISC")
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -61,6 +61,9 @@
 const char *program = "dnssec-keygen";
 int verbose;
 
+#define DEFAULT_ALGORITHM "RSASHA1"
+#define DEFAULT_NSEC3_ALGORITHM "NSEC3RSASHA1"
+
 ISC_PLATFORM_NORETURN_PRE static void
 usage(void) ISC_PLATFORM_NORETURN_POST;
 
@@ -79,16 +82,17 @@ usage(void) {
 				" | NSEC3DSA |\n");
 	fprintf(stderr, "        RSASHA256 | RSASHA512 | ECCGOST |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
-	fprintf(stderr, "        ED25519 | ED448 | DH |\n");
-	fprintf(stderr, "        HMAC-MD5 | HMAC-SHA1 | HMAC-SHA224 | "
+	fprintf(stderr, "        DH | HMAC-MD5 | HMAC-SHA1 | HMAC-SHA224 | "
 				"HMAC-SHA256 | \n");
 	fprintf(stderr, "        HMAC-SHA384 | HMAC-SHA512\n");
+	fprintf(stderr, "       (default: RSASHA1, or "
+			       "NSEC3RSASHA1 if using -3)\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	fprintf(stderr, "        RSAMD5:\t[1024..%d]\n", MAX_RSA);
-	fprintf(stderr, "        RSASHA1:\t[1024..%d]\n", MAX_RSA);
-	fprintf(stderr, "        NSEC3RSASHA1:\t[1024..%d]\n", MAX_RSA);
-	fprintf(stderr, "        RSASHA256:\t[1024..%d]\n", MAX_RSA);
+	fprintf(stderr, "        RSAMD5:\t[512..%d]\n", MAX_RSA);
+	fprintf(stderr, "        RSASHA1:\t[512..%d]\n", MAX_RSA);
+	fprintf(stderr, "        NSEC3RSASHA1:\t[512..%d]\n", MAX_RSA);
+	fprintf(stderr, "        RSASHA256:\t[512..%d]\n", MAX_RSA);
 	fprintf(stderr, "        RSASHA512:\t[1024..%d]\n", MAX_RSA);
 	fprintf(stderr, "        DH:\t\t[128..4096]\n");
 	fprintf(stderr, "        DSA:\t\t[512..1024] and divisible by 64\n");
@@ -97,16 +101,15 @@ usage(void) {
 	fprintf(stderr, "        ECCGOST:\tignored\n");
 	fprintf(stderr, "        ECDSAP256SHA256:\tignored\n");
 	fprintf(stderr, "        ECDSAP384SHA384:\tignored\n");
-	fprintf(stderr, "        ED25519:\tignored\n");
-	fprintf(stderr, "        ED448:\tignored\n");
 	fprintf(stderr, "        HMAC-MD5:\t[1..512]\n");
 	fprintf(stderr, "        HMAC-SHA1:\t[1..160]\n");
 	fprintf(stderr, "        HMAC-SHA224:\t[1..224]\n");
 	fprintf(stderr, "        HMAC-SHA256:\t[1..256]\n");
 	fprintf(stderr, "        HMAC-SHA384:\t[1..384]\n");
 	fprintf(stderr, "        HMAC-SHA512:\t[1..512]\n");
-	fprintf(stderr, "        (key size defaults are set according to\n"
-			"        algorithm and usage (ZSK or KSK)\n");
+	fprintf(stderr, "        (if using the default algorithm, key size\n"
+			"        defaults to 2048 for KSK, or 1024 for all "
+			"others)\n");
 	fprintf(stderr, "    -n <nametype>: ZONE | HOST | ENTITY | "
 					    "USER | OTHER\n");
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE)\n");
@@ -234,9 +237,9 @@ main(int argc, char **argv) {
 	int		options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	int		dbits = 0;
 	dns_ttl_t	ttl = 0;
-	isc_boolean_t	use_nsec3 = ISC_FALSE;
+	isc_boolean_t	use_default = ISC_FALSE, use_nsec3 = ISC_FALSE;
 	isc_stdtime_t	publish = 0, activate = 0, revokekey = 0;
-	isc_stdtime_t	inactive = 0, deltime = 0;
+	isc_stdtime_t	inactive = 0, delete = 0;
 	isc_stdtime_t	now;
 	int		prepub = -1;
 	isc_boolean_t	setpub = ISC_FALSE, setact = ISC_FALSE;
@@ -464,8 +467,8 @@ main(int argc, char **argv) {
 			if (setdel || unsetdel)
 				fatal("-D specified more than once");
 
-			deltime = strtotime(isc_commandline_argument,
-					    now, now, &setdel);
+			delete = strtotime(isc_commandline_argument,
+					   now, now, &setdel);
 			unsetdel = !setdel;
 			break;
 		case 'S':
@@ -531,7 +534,17 @@ main(int argc, char **argv) {
 			      isc_result_totext(ret));
 
 		if (algname == NULL) {
-			fatal("no algorithm specified");
+			use_default = ISC_TRUE;
+			if (use_nsec3)
+				algname = strdup(DEFAULT_NSEC3_ALGORITHM);
+			else
+				algname = strdup(DEFAULT_ALGORITHM);
+			if (algname == NULL)
+				fatal("strdup failed");
+			freeit = algname;
+			if (verbose > 0)
+				fprintf(stderr, "no algorithm specified; "
+						"defaulting to %s\n", algname);
 		}
 
 		if (strcasecmp(algname, "RSA") == 0) {
@@ -582,41 +595,16 @@ main(int argc, char **argv) {
 		INSIST((alg != DNS_KEYALG_RSAMD5) && (alg != DST_ALG_HMACMD5));
 #endif
 
-
-		if (alg == DST_ALG_HMACMD5 || alg == DST_ALG_HMACSHA1 ||
-		    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
-		    alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512)
-		{
-			fprintf(stderr,
-				"Use of dnssec-keygen for HMAC keys is "
-				"deprecated: use tsig-keygen\n");
-		}
-
 		if (!dst_algorithm_supported(alg))
 			fatal("unsupported algorithm: %d", alg);
 
-		if (use_nsec3) {
-			switch (alg) {
-			case DST_ALG_DSA:
-				alg = DST_ALG_NSEC3DSA;
-				break;
-			case DST_ALG_RSASHA1:
-				alg = DST_ALG_NSEC3RSASHA1;
-				break;
-			case DST_ALG_NSEC3DSA:
-			case DST_ALG_NSEC3RSASHA1:
-			case DST_ALG_RSASHA256:
-			case DST_ALG_RSASHA512:
-			case DST_ALG_ECCGOST:
-			case DST_ALG_ECDSA256:
-			case DST_ALG_ECDSA384:
-			case DST_ALG_ED25519:
-			case DST_ALG_ED448:
-				break;
-			default:
-				fatal("%s is incompatible with NSEC3; "
-				      "do not use the -3 option", algname);
-			}
+		if (use_nsec3 &&
+		    alg != DST_ALG_NSEC3DSA && alg != DST_ALG_NSEC3RSASHA1 &&
+		    alg != DST_ALG_RSASHA256 && alg!= DST_ALG_RSASHA512 &&
+		    alg != DST_ALG_ECCGOST &&
+		    alg != DST_ALG_ECDSA256 && alg != DST_ALG_ECDSA384) {
+			fatal("%s is incompatible with NSEC3; "
+			      "do not use the -3 option", algname);
 		}
 
 		if (type != NULL && (options & DST_TYPE_KEY) != 0) {
@@ -637,31 +625,19 @@ main(int argc, char **argv) {
 		}
 
 		if (size < 0) {
-			switch (alg) {
-			case DST_ALG_RSASHA1:
-			case DST_ALG_NSEC3RSASHA1:
-			case DST_ALG_RSASHA256:
-			case DST_ALG_RSASHA512:
-				if ((kskflag & DNS_KEYFLAG_KSK) != 0) {
+			if (use_default) {
+				if ((kskflag & DNS_KEYFLAG_KSK) != 0)
 					size = 2048;
-				} else {
+				else
 					size = 1024;
-				}
-				if (verbose > 0) {
+				if (verbose > 0)
 					fprintf(stderr, "key size not "
 							"specified; defaulting"
 							" to %d\n", size);
-				}
-				break;
-			case DST_ALG_ECCGOST:
-			case DST_ALG_ECDSA256:
-			case DST_ALG_ECDSA384:
-			case DST_ALG_ED25519:
-			case DST_ALG_ED448:
-				break;
-			default:
+			} else if (alg != DST_ALG_ECCGOST &&
+				   alg != DST_ALG_ECDSA256 &&
+				   alg != DST_ALG_ECDSA384)
 				fatal("key size not specified (-b option)");
-			}
 		}
 
 		if (!oldstyle && prepub > 0) {
@@ -772,7 +748,7 @@ main(int argc, char **argv) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
 	case DNS_KEYALG_RSASHA256:
-		if (size != 0 && (size < 1024 || size > MAX_RSA))
+		if (size != 0 && (size < 512 || size > MAX_RSA))
 			fatal("RSA key size %d out of range", size);
 		break;
 	case DNS_KEYALG_RSASHA512:
@@ -797,12 +773,6 @@ main(int argc, char **argv) {
 	case DST_ALG_ECDSA384:
 		size = 384;
 		break;
-	case DST_ALG_ED25519:
-		size = 256;
-		break;
-	case DST_ALG_ED448:
-		size = 456;
-		break;
 	case DST_ALG_HMACMD5:
 		options |= DST_TYPE_KEY;
 		if (size < 1 || size > 512)
@@ -936,8 +906,6 @@ main(int argc, char **argv) {
 	case DST_ALG_ECCGOST:
 	case DST_ALG_ECDSA256:
 	case DST_ALG_ECDSA384:
-	case DST_ALG_ED25519:
-	case DST_ALG_ED448:
 		show_progress = ISC_TRUE;
 		/* fall through */
 
@@ -1039,13 +1007,13 @@ main(int argc, char **argv) {
 						inactive);
 
 			if (setdel) {
-				if (setinact && deltime < inactive)
+				if (setinact && delete < inactive)
 					fprintf(stderr, "%s: warning: Key is "
 						"scheduled to be deleted "
 						"before it is scheduled to be "
 						"made inactive.\n",
 						program);
-				dst_key_settime(key, DST_TIME_DELETE, deltime);
+				dst_key_settime(key, DST_TIME_DELETE, delete);
 			}
 
 			if (setsyncadd)

bin/dnssec/dnssec-keygen.docbook

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2000-2005, 2007-2012, 2014-2017  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2005, 2007-2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
  -
  - This Source Code Form is subject to the terms of the Mozilla Public
  - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -45,7 +45,6 @@
       <year>2014</year>
       <year>2015</year>
       <year>2016</year>
-      <year>2017</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -53,7 +52,7 @@
   <refsynopsisdiv>
     <cmdsynopsis sepchar=" ">
       <command>dnssec-keygen</command>
-      <arg rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
       <arg choice="opt" rep="norepeat"><option>-3</option></arg>
@@ -101,13 +100,6 @@
       line.  For DNSSEC keys, this must match the name of the zone for
       which the key is being generated.
     </para>
-    <para>
-      The <command>dnssec-keymgr</command> command acts as a wrapper
-      around <command>dnssec-keygen</command>, generating and updating keys
-      as needed to enforce defined security policies such as key rollover
-      scheduling. Using <command>dnssec-keymgr</command> may be preferable
-      to direct use of <command>dnssec-keygen</command>.
-    </para>
   </refsection>
 
   <refsection><info><title>OPTIONS</title></info>
@@ -121,33 +113,27 @@
 	    Selects the cryptographic algorithm.  For DNSSEC keys, the value
 	    of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
-	    ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
-	    TKEY and SIG(0) keys, the value must be DH (Diffie Hellman);
-	    specifying this value will automatically set the
-	    <option>-T KEY</option> option as well.
+	    ECDSAP256SHA256 or ECDSAP384SHA384.
+	    For TSIG/TKEY, the value must
+	    be DH (Diffie Hellman), HMAC-MD5, HMAC-SHA1, HMAC-SHA224,
+	    HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512.  These values are
+	    case insensitive.
 	  </para>
 	  <para>
-	    TSIG keys can also by generated by setting the value to
-	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
-	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
-	    values will automatically set <option>-T KEY</option>. Note,
-	    however, that <command>tsig-keygen</command> produces TSIG keys
-	    in a more useful format. These algorithms have been deprecated
-	    in <command>dnssec-keygen</command>, and will be removed in a
-	    future release.
+	    If no algorithm is specified, then RSASHA1 will be used by
+	    default, unless the <option>-3</option> option is specified,
+	    in which case NSEC3RSASHA1 will be used instead.  (If
+	    <option>-3</option> is used and an algorithm is specified,
+	    that algorithm will be checked for compatibility with NSEC3.)
 	  </para>
 	  <para>
-	    These values are case insensitive. In some cases, abbreviations
-	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
-	    ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
-	    along with the <option>-3</option> option, then NSEC3RSASHA1
-	    or NSEC3DSA will be used instead.
+	    Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
+	    algorithm, and DSA is recommended.  For TSIG, HMAC-MD5 is
+	    mandatory.
 	  </para>
 	  <para>
-	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <option>-S</option> option, which copies the algorithm from
-	    the predecessor key.  Previously, the default for newly
-	    generated keys was RSASHA1.
+	    Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
+	    automatically set the -T KEY option.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -158,18 +144,20 @@
 	  <para>
 	    Specifies the number of bits in the key.  The choice of key
 	    size depends on the algorithm used.  RSA keys must be
-	    between 1024 and 2048 bits.  Diffie Hellman keys must be between
+	    between 512 and 2048 bits.  Diffie Hellman keys must be between
 	    128 and 4096 bits.  DSA keys must be between 512 and 1024
 	    bits and an exact multiple of 64.  HMAC keys must be
 	    between 1 and 512 bits. Elliptic curve algorithms don't need
 	    this parameter.
 	  </para>
 	  <para>
-	    If the key size is not specified, some algorithms have
-	    pre-defined defaults.  For example, RSA keys for use as
-	    DNSSEC zone signing keys have a default size of 1024 bits;
-	    RSA keys for use as key signing keys (KSKs, generated with
-	    <option>-f KSK</option>) default to 2048 bits.
+	    The key size does not need to be specified if using a default
+	    algorithm.  The default key size is 1024 bits for zone signing
+	    keys (ZSKs) and 2048 bits for key signing keys (KSKs,
+	    generated with <option>-f KSK</option>).  However, if an
+	    algorithm is explicitly specified with the <option>-a</option>,
+	    then there is no default key size, and the <option>-b</option>
+	    must be used.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -180,10 +168,11 @@
 	  <para>
 	    Specifies the owner type of the key.  The value of
 	    <option>nametype</option> must either be ZONE (for a DNSSEC
-	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
-	    with a host (KEY)), USER (for a key associated with a
-	    user(KEY)) or OTHER (DNSKEY).  These values are case
-	    insensitive.  Defaults to ZONE for DNSKEY generation.
+	    zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
+	    a host (KEY)),
+	    USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
+	    These values are case insensitive.  Defaults to ZONE for DNSKEY
+	    generation.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -193,10 +182,11 @@
 	<listitem>
 	  <para>
 	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
-	    If this option is used with an algorithm that has both
-	    NSEC and NSEC3 versions, then the NSEC3 version will be
-	    used; for example, <command>dnssec-keygen -3a RSASHA1</command>
-	    specifies the NSEC3RSASHA1 algorithm.
+	    If this option is used and no algorithm is explicitly
+	    set on the command line, NSEC3RSASHA1 will be used by
+	    default. Note that RSASHA256, RSASHA512, ECCGOST,
+	    ECDSAP256SHA256 and ECDSAP384SHA384 algorithms
+	    are NSEC3-capable.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -354,23 +344,15 @@
 	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
 	<listitem>
 	  <para>
-	    Specifies a source of randomness.  Normally, when generating
-	    DNSSEC keys, this option has no effect; the random number
-	    generation function provided by the cryptographic library will
-	    be used.
-	  </para>
-	  <para>
-	    If that behavior is disabled at compile time, however,
-	    the specified file will be used as entropy source
-	    for key generation.  <filename>randomdev</filename> is
+	    Specifies the source of randomness.  If the operating
+	    system does not provide a <filename>/dev/random</filename>
+	    or equivalent device, the default source of randomness
+	    is keyboard input.  <filename>randomdev</filename>
+	    specifies
 	    the name of a character device or file containing random
-	    data to be used.  The special value <filename>keyboard</filename>
-	    indicates that keyboard input should be used.
-	  </para>
-	  <para>
-	    The default is <filename>/dev/random</filename> if the
-	    operating system provides it or an equivalent device;
-	    if not, the default source of randomness is keyboard input.
+	    data to be used instead of the default.  The special value
+	    <filename>keyboard</filename> indicates that keyboard
+	    input should be used.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -411,8 +393,8 @@
 	    overridden to KEY for use with SIG(0).
 	  <para>
 	  </para>
-	    Specifying any TSIG algorithm (HMAC-* or DH) with
-	    <option>-a</option> forces this option to KEY.
+	    Using any TSIG algorithm (HMAC-* or DH) forces this option
+	    to KEY.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -546,30 +528,30 @@
       </varlistentry>
 
       <varlistentry>
-	<term>-i <replaceable class="parameter">interval</replaceable></term>
-	<listitem>
-	  <para>
-	    Sets the prepublication interval for a key.  If set, then
-	    the publication and activation dates must be separated by at least
-	    this much time.  If the activation date is specified but the
-	    publication date isn't, then the publication date will default
-	    to this much time before the activation date; conversely, if
-	    the publication date is specified but activation date isn't,
-	    then activation will be set to this much time after publication.
-	  </para>
-	  <para>
-	    If the key is being created as an explicit successor to another
-	    key, then the default prepublication interval is 30 days;
-	    otherwise it is zero.
-	  </para>
-	  <para>
-	    As with date offsets, if the argument is followed by one of
-	    the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
-	    interval is measured in years, months, weeks, days, hours,
-	    or minutes, respectively.  Without a suffix, the interval is
-	    measured in seconds.
-	  </para>
-	</listitem>
+        <term>-i <replaceable class="parameter">interval</replaceable></term>
+        <listitem>
+          <para>
+            Sets the prepublication interval for a key.  If set, then
+            the publication and activation dates must be separated by at least
+            this much time.  If the activation date is specified but the
+            publication date isn't, then the publication date will default
+            to this much time before the activation date; conversely, if
+            the publication date is specified but activation date isn't,
+            then activation will be set to this much time after publication.
+          </para>
+          <para>
+            If the key is being created as an explicit successor to another
+            key, then the default prepublication interval is 30 days;
+            otherwise it is zero.
+          </para>
+          <para>
+            As with date offsets, if the argument is followed by one of
+            the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
+            interval is measured in years, months, weeks, days, hours,
+            or minutes, respectively.  Without a suffix, the interval is
+            measured in seconds.
+          </para>
+        </listitem>
       </varlistentry>
 
     </variablelist>