pullup to 9.0:

661.   [bug]           Certain UDP IXFR requests caused an assertion failure
                        (mpctx->allocated == 0). [RT #355, #394, #623]

CHANGES

@@ -1,4 +1,38 @@
 
+ 661.   [bug]           Certain UDP IXFR requests caused an assertion failure
+                        (mpctx->allocated == 0). [RT #355, #394, #623]
+
+ 589.	[bug]		The server could deadlock if a zone was updated
+			while being transferred out.
+
+ 581.	[bug]		Log severity was not being correctly processed.
+			[RT #485]
+
+ 574.	[bug]		TSIG signed queries sent by the resolver would fail to
+			have their responses validated and would leak memory.
+
+ 573.	[bug]		The journal files of IXFRed slave zones were
+			inadvertantly discarded on server reload, causing
+			"journal out of sync with zone" errors on subsequent
+			reloads. [RT #482]
+
+ 572.	[bug]		Quoted strings were not accepted as key names in
+			address match lists.
+
+ 555.	[bug]		Slave server attempting zone transfer could crash
+			with an assertion failure on certain malformed
+			responses from the master. [RT #457]
+
+ 554.	[bug]		In some cases, not all of the dnssec tools were
+			properly installed.
+
+ 553.	[bug]		Incoming zone transfers deferred due to quota 
+			were not started when quota was increased but 
+			only when a transfer in progress finished. [RT #456]
+
+ 552.	[bug]		We were not correctly detecting the end of all c-style
+			comments.  [RT #455]
+
 	--- 9.0.1 released ---
 
  547.	[bug]		dnssafe doesn't correctly handle RSA keys longer

README

@@ -128,6 +128,7 @@ Building
 	of the following systems:
 
 		Slackware Linux 7.0 with 2.4.0-test6 kernel and glibc 2.1.3
+		Slackware Linux 7.0.1 with glibc 2.1.3
 		OpenBSD 2.6, 2.8, -current
 
 	To build, just

bin/dnssec/Makefile.in

@@ -13,7 +13,7 @@
 # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 # SOFTWARE.
 
-# $Id: Makefile.in,v 1.7 2000/06/22 21:49:01 tale Exp $
+# $Id: Makefile.in,v 1.7.2.1 2000/11/13 22:11:47 gson Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -70,5 +70,5 @@ installdirs:
 		mkdir ${DESTDIR}${sbindir}; \
 	fi
 
-install:: ${TARGSTS} installdirs
-	${LIBTOOL} ${INSTALL_PROGRAM} ${TARGETS} ${DESTDIR}${sbindir}
+install:: ${TARGETS} installdirs
+	for t in ${TARGETS}; do ${LIBTOOL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done

bin/named/logconf.c

@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: logconf.c,v 1.22 2000/06/23 17:59:08 tale Exp $ */
+/* $Id: logconf.c,v 1.22.2.1 2000/11/29 20:18:57 gson Exp $ */
 
 #include <config.h>
 
@@ -95,6 +95,7 @@ channel_fromconf(dns_c_logchan_t *cchan, isc_logconfig_t *lctx) {
 	unsigned int type;
 	unsigned int flags = 0;
 	int level;
+	dns_c_logseverity_t severity;
 	
 	type = ISC_LOG_TONULL;
 	switch (cchan->ctype) {
@@ -173,7 +174,34 @@ channel_fromconf(dns_c_logchan_t *cchan, isc_logconfig_t *lctx) {
 	}
 	
 	level = ISC_LOG_INFO;
-	(void)dns_c_logchan_getdebuglevel(cchan, &level);
+	if (dns_c_logchan_getseverity(cchan, &severity) == ISC_R_SUCCESS) {
+		switch (severity) {
+		case dns_c_log_critical:
+			level = ISC_LOG_CRITICAL;
+			break;
+		case dns_c_log_error:
+			level = ISC_LOG_ERROR;
+			break;
+		case dns_c_log_warn:
+			level = ISC_LOG_WARNING;
+			break;
+		case dns_c_log_notice:
+			level = ISC_LOG_NOTICE;
+			break;
+		case dns_c_log_info:
+			level = ISC_LOG_INFO;
+			break;
+		case dns_c_log_debug:
+			(void)dns_c_logchan_getdebuglevel(cchan, &level);
+			break;
+		case dns_c_log_dynamic:
+			level = ISC_LOG_DYNAMIC;
+			break;
+		default:
+			level = ISC_LOG_INFO;
+			break;
+		}
+	}
 	
 	result = isc_log_createchannel(lctx, cchan->name,
 				       type, level, &dest, flags);

bin/named/xfrout.c

@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: xfrout.c,v 1.68.2.3 2000/08/22 19:59:44 gson Exp $ */
+/* $Id: xfrout.c,v 1.68.2.5 2001/01/08 20:11:40 gson Exp $ */
 
 #include <config.h>
 
@@ -213,6 +213,11 @@ db_rr_iterator_next(db_rr_iterator_t *it) {
 	return (it->result);
 }
 
+static void
+db_rr_iterator_pause(db_rr_iterator_t *it) {
+	dns_dbiterator_pause(it->dbit);
+}
+
 static void
 db_rr_iterator_destroy(db_rr_iterator_t *it) {
 	if (dns_rdataset_isassociated(&it->rdataset))
@@ -303,9 +308,15 @@ struct rrstream_methods {
 					   dns_name_t **,
 					   isc_uint32_t *,
 					   dns_rdata_t **);
+	void	 		(*pause)(rrstream_t *);
 	void 			(*destroy)(rrstream_t **);
 };
 
+static void
+rrstream_noop_pause(rrstream_t *rs) {
+	UNUSED(rs);
+}
+
 /**************************************************************************/
 /*
  * An 'ixfr_rrstream_t' is an 'rrstream_t' that returns
@@ -396,13 +407,14 @@ ixfr_rrstream_destroy(rrstream_t **rsp) {
 static rrstream_methods_t ixfr_rrstream_methods = {
 	ixfr_rrstream_first,
 	ixfr_rrstream_next,
-	ixfr_rrstream_current,		
+	ixfr_rrstream_current,
+	rrstream_noop_pause,
 	ixfr_rrstream_destroy
 };
 
 /**************************************************************************/
 /*
- * An 'ixfr_rrstream_t' is an 'rrstream_t' that returns
+ * An 'axfr_rrstream_t' is an 'rrstream_t' that returns
  * an AXFR-like RR stream from a database.
  *
  * The SOAs at the beginning and end of the transfer are
@@ -412,7 +424,7 @@ static rrstream_methods_t ixfr_rrstream_methods = {
 typedef struct axfr_rrstream {
 	rrstream_t		common;
 	int 			state;
-	db_rr_iterator_t		it;
+	db_rr_iterator_t	it;
 	isc_boolean_t		it_valid;
 } axfr_rrstream_t;
 
@@ -503,6 +515,12 @@ axfr_rrstream_current(rrstream_t *rs, dns_name_t **name, isc_uint32_t *ttl,
 	db_rr_iterator_current(&s->it, name, ttl, rdata);
 }
 
+static void
+axfr_rrstream_pause(rrstream_t *rs) {
+	axfr_rrstream_t *s = (axfr_rrstream_t *) rs;
+	db_rr_iterator_pause(&s->it);
+}
+
 static void
 axfr_rrstream_destroy(rrstream_t **rsp) {
 	axfr_rrstream_t *s = (axfr_rrstream_t *) *rsp;
@@ -514,7 +532,8 @@ axfr_rrstream_destroy(rrstream_t **rsp) {
 static rrstream_methods_t axfr_rrstream_methods = {
 	axfr_rrstream_first,
 	axfr_rrstream_next,
-	axfr_rrstream_current,		
+	axfr_rrstream_current,
+	axfr_rrstream_pause,
 	axfr_rrstream_destroy
 };
 
@@ -597,7 +616,8 @@ soa_rrstream_destroy(rrstream_t **rsp) {
 static rrstream_methods_t soa_rrstream_methods = {
 	soa_rrstream_first,
 	soa_rrstream_next,
-	soa_rrstream_current,		
+	soa_rrstream_current,
+	rrstream_noop_pause,
 	soa_rrstream_destroy
 };
 
@@ -685,6 +705,11 @@ compound_rrstream_next(rrstream_t *rs) {
 	rrstream_t *curstream = s->components[s->state];	
 	s->result = curstream->methods->next(curstream);
 	while (s->result == ISC_R_NOMORE) {
+		/*
+		 * Make sure locks held by the current stream
+		 * are released before we switch streams.
+		 */
+		curstream->methods->pause(curstream);
 		if (s->state == 2)
 			return (ISC_R_NOMORE);
 		s->state++;
@@ -706,6 +731,16 @@ compound_rrstream_current(rrstream_t *rs, dns_name_t **name, isc_uint32_t *ttl,
 	curstream->methods->current(curstream, name, ttl, rdata);
 }
 
+static void
+compound_rrstream_pause(rrstream_t *rs)
+{
+	compound_rrstream_t *s = (compound_rrstream_t *) rs;
+	rrstream_t *curstream;
+	INSIST(0 <= s->state && s->state < 3);
+	curstream = s->components[s->state];
+	curstream->methods->pause(curstream);
+}
+
 static void
 compound_rrstream_destroy(rrstream_t **rsp) {
 	compound_rrstream_t *s = (compound_rrstream_t *) *rsp;
@@ -718,7 +753,8 @@ compound_rrstream_destroy(rrstream_t **rsp) {
 static rrstream_methods_t compound_rrstream_methods = {
 	compound_rrstream_first,
 	compound_rrstream_next,
-	compound_rrstream_current,		
+	compound_rrstream_current,
+	compound_rrstream_pause,
 	compound_rrstream_destroy
 };
 
@@ -1197,7 +1233,8 @@ failure:
  */
 static void
 sendstream(xfrout_ctx_t *xfr) {
-	dns_message_t *msg = NULL;
+	dns_message_t *tcpmsg = NULL;
+	dns_message_t *msg = NULL; /* Client message if UDP, tcpmsg if TCP */
 	isc_result_t result;
 	isc_region_t used;
 	isc_region_t region;
@@ -1208,67 +1245,78 @@ sendstream(xfrout_ctx_t *xfr) {
 	isc_buffer_clear(&xfr->txlenbuf);
 	isc_buffer_clear(&xfr->txbuf);
 
-	/*
-	 * Build a response dns_message_t, temporarily storing the raw, 
-	 * uncompressed owner names and RR data contiguously in xfr->buf.
-	 * We know that if the uncompressed data fits in xfr->buf,
-	 * the compressed data will surely fit in a TCP message.
-	 */
+	if ((xfr->client->attributes & NS_CLIENTATTR_TCP) == 0) {
+		/*
+		 * In the UDP case, we put the response data directly into
+		 * the client message.
+		 */
+		msg = xfr->client->message;
+		CHECK(dns_message_reply(msg, ISC_TRUE));
+	} else {
+		/*
+		 * TCP. Build a response dns_message_t, temporarily storing
+		 * the raw, uncompressed owner names and RR data contiguously
+		 * in xfr->buf.  We know that if the uncompressed data fits
+		 * in xfr->buf, the compressed data will surely fit in a TCP
+		 * message.
+		 */
 
-	msg = NULL;
-	CHECK(dns_message_create(xfr->mctx, DNS_MESSAGE_INTENTRENDER, &msg));
+		CHECK(dns_message_create(xfr->mctx,
+					 DNS_MESSAGE_INTENTRENDER, &tcpmsg));
+		msg = tcpmsg;
 
-	msg->id = xfr->id;
-	msg->rcode = dns_rcode_noerror;
-	msg->flags = DNS_MESSAGEFLAG_QR | DNS_MESSAGEFLAG_AA;
-	if ((xfr->client->attributes & NS_CLIENTATTR_RA) != 0)
-		msg->flags |= DNS_MESSAGEFLAG_RA;
-	dns_message_settsigkey(msg, xfr->tsigkey);
-	CHECK(dns_message_setquerytsig(msg, xfr->lasttsig));
-	if (xfr->lasttsig != NULL)
-		isc_buffer_free(&xfr->lasttsig);
-
-	/*
-	 * Include a question section in the first message only. 
-	 * BIND 8.2.1 will not recognize an IXFR if it does not have a
-	 * question section.
-	 */
-	if (xfr->nmsg == 0) {
-		dns_name_t *qname = NULL;
-		isc_region_t r;
+		msg->id = xfr->id;
+		msg->rcode = dns_rcode_noerror;
+		msg->flags = DNS_MESSAGEFLAG_QR | DNS_MESSAGEFLAG_AA;
+		if ((xfr->client->attributes & NS_CLIENTATTR_RA) != 0)
+			msg->flags |= DNS_MESSAGEFLAG_RA;
+		dns_message_settsigkey(msg, xfr->tsigkey);
+		CHECK(dns_message_setquerytsig(msg, xfr->lasttsig));
+		if (xfr->lasttsig != NULL)
+			isc_buffer_free(&xfr->lasttsig);
 
 		/*
-		 * Reserve space for the 12-byte message header
-		 * and 4 bytes of question.
+		 * Include a question section in the first message only.
+		 * BIND 8.2.1 will not recognize an IXFR if it does not
+		 * have a question section.
 		 */
-		isc_buffer_add(&xfr->buf, 12 + 4);
+		if (xfr->nmsg == 0) {
+			dns_name_t *qname = NULL;
+			isc_region_t r;
 		
-		qrdataset = NULL;
-		result = dns_message_gettemprdataset(msg, &qrdataset);
-		if (result != ISC_R_SUCCESS)
-			goto failure;
-		dns_rdataset_init(qrdataset);
-		dns_rdataset_makequestion(qrdataset,
-					  xfr->client->message->rdclass,
-					  xfr->qtype);
+			/*
+			 * Reserve space for the 12-byte message header
+			 * and 4 bytes of question.
+			 */
+			isc_buffer_add(&xfr->buf, 12 + 4);
 
-		result = dns_message_gettempname(msg, &qname);
-		if (result != ISC_R_SUCCESS)
-			goto failure;
-		dns_name_init(qname, NULL);
-		isc_buffer_availableregion(&xfr->buf, &r);
-		INSIST(r.length >= xfr->qname->length);
-		r.length = xfr->qname->length;
-		isc_buffer_putmem(&xfr->buf, xfr->qname->ndata,
-				  xfr->qname->length);
-		dns_name_fromregion(qname, &r);
-		ISC_LIST_INIT(qname->list);
-		ISC_LIST_APPEND(qname->list, qrdataset, link);
+			qrdataset = NULL;
+			result = dns_message_gettemprdataset(msg, &qrdataset);
+			if (result != ISC_R_SUCCESS)
+				goto failure;
+			dns_rdataset_init(qrdataset);
+			dns_rdataset_makequestion(qrdataset,
+					xfr->client->message->rdclass,
+					xfr->qtype);
 
-		dns_message_addname(msg, qname, DNS_SECTION_QUESTION);
+			result = dns_message_gettempname(msg, &qname);
+			if (result != ISC_R_SUCCESS)
+				goto failure;
+			dns_name_init(qname, NULL);
+			isc_buffer_availableregion(&xfr->buf, &r);
+			INSIST(r.length >= xfr->qname->length);
+			r.length = xfr->qname->length;
+			isc_buffer_putmem(&xfr->buf, xfr->qname->ndata,
+					  xfr->qname->length);
+			dns_name_fromregion(qname, &r);
+			ISC_LIST_INIT(qname->list);
+			ISC_LIST_APPEND(qname->list, qrdataset, link);
+
+			dns_message_addname(msg, qname, DNS_SECTION_QUESTION);
+		}
+		else
+			msg->tcp_continuation = 1;
 	}
-	else
-		msg->tcp_continuation = 1;
 	
 	/*
 	 * Try to fit in as many RRs as possible, unless "one-answer"
@@ -1384,13 +1432,9 @@ sendstream(xfrout_ctx_t *xfr) {
 				      xfr));
 		xfr->sends++;
 	} else {
-		xfrout_log(xfr, ISC_LOG_DEBUG(8),
-			   "sending IXFR UDP response");
-		/* XXX kludge */
-		dns_message_destroy(&xfr->client->message);
-		xfr->client->message = msg;
-		msg = NULL;
+		xfrout_log(xfr, ISC_LOG_DEBUG(8), "sending IXFR UDP response");
 		ns_client_send(xfr->client);
+		xfr->stream->methods->pause(xfr->stream);
 		xfrout_ctx_destroy(&xfr);
 		return;
 	}
@@ -1404,9 +1448,15 @@ sendstream(xfrout_ctx_t *xfr) {
 	/*
 	 * XXXRTH  need to cleanup qname and qrdataset...
 	 */
-	if (msg != NULL) {
-		dns_message_destroy(&msg);
-	}
+	if (tcpmsg != NULL)
+		dns_message_destroy(&tcpmsg);
+
+	/*
+	 * Make sure to release any locks held by database
+	 * iterators before returning from the event handler.
+	 */
+	xfr->stream->methods->pause(xfr->stream);
+	
 	if (result == ISC_R_SUCCESS)
 		return;
 

bin/tests/system/nsupdate/tests.sh

@@ -15,7 +15,7 @@
 # ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 # SOFTWARE.
 
-# $Id: tests.sh,v 1.4 2000/07/09 16:27:30 tale Exp $
+# $Id: tests.sh,v 1.4.2.1 2000/11/20 20:57:11 gson Exp $
 
 #
 # Perform tests
@@ -60,5 +60,44 @@ echo "I:comparing post-update copies to known good data"
 $PERL ../digcomp.pl knowngood.ns1.after dig.out.ns1 || status=1
 $PERL ../digcomp.pl knowngood.ns1.after dig.out.ns2 || status=1
 
+echo "I:begin RT #482 regression test"
+
+echo "I:update master"
+$NSUPDATE <<END > /dev/null || status=1
+server 10.53.0.1 5300
+update add updated2.example.nil. 600 A 10.10.10.2
+update add updated2.example.nil. 600 TXT Bar
+update delete c.example.nil.
+send
+END
+
+sleep 5
+
+echo "I:SIGHUP slave"
+kill -HUP `cat ns2/named.pid`
+
+sleep 5
+
+echo "I:update master again"
+$NSUPDATE <<END > /dev/null || status=1
+server 10.53.0.1 5300
+update add updated3.example.nil. 600 A 10.10.10.3
+update add updated3.example.nil. 600 TXT Zap
+update delete d.example.nil.
+send
+END
+
+sleep 5
+
+echo "I:SIGHUP slave again"
+kill -HUP `cat ns2/named.pid`
+
+sleep 5
+
+if grep "out of sync" ns2/named.run
+then
+	status=1
+fi
+
 echo "I:exit status: $status"
 exit $status

lib/dns/config/confparser.y

@@ -16,7 +16,7 @@
  * SOFTWARE.
  */
 
-/* $Id: confparser.y,v 1.99.2.5 2000/09/13 23:13:25 explorer Exp $ */
+/* $Id: confparser.y,v 1.99.2.6 2000/11/22 20:18:03 bwelling Exp $ */
 
 #include <config.h>
 
@@ -2942,7 +2942,7 @@ address_match_element: address_match_simple
 		}
 		$$ = $2;
 	}
-	| L_SEC_KEY L_STRING
+	| L_SEC_KEY any_string
 	{
 		dns_c_ipmatchelement_t *ime = NULL;
 

lib/dns/name.c

@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: name.c,v 1.93.2.1 2000/10/16 23:32:34 bwelling Exp $ */
+/* $Id: name.c,v 1.93.2.2 2000/12/11 21:02:04 gson Exp $ */
 
 #include <config.h>
 
@@ -2592,11 +2592,12 @@ dns_name_split(dns_name_t *name,
 	       dns_name_t *prefix, dns_name_t *suffix)
 
 {
-	dns_offsets_t name_odata, split_odata;
-	unsigned char *offsets, *splitoffsets;
+	dns_offsets_t name_odata, prefix_odata, suffix_odata;
+	unsigned char *offsets, *prefix_offsets = NULL, *suffix_offsets;
 	isc_result_t result = ISC_R_SUCCESS;
 	unsigned int splitlabel, bitbytes, mod, len;
 	unsigned char *p, *src, *dst;
+	isc_boolean_t maybe_compact_prefix = ISC_FALSE;
 
 	REQUIRE(VALID_NAME(name));
 	REQUIRE((nbits == 0 &&
@@ -2665,11 +2666,14 @@ dns_name_split(dns_name_t *name,
 			}
 
 			/*
-			 * Set the new bit count.
+			 * Set the new bit count.  Also, when a bitstring
+			 * label being split is maximal length, compaction
+			 * might be necessary on the prefix.
 			 */
-			if (*p == 0)
+			if (*p == 0) {
+				maybe_compact_prefix = ISC_TRUE;
 				*p = 256 - nbits;
-			else
+			} else
 				*p = *p - nbits;
 
 			/*
@@ -2743,8 +2747,8 @@ dns_name_split(dns_name_t *name,
 			 */
 			INSIST(len = prefix->length);
 
-			INIT_OFFSETS(prefix, splitoffsets, split_odata);
-			set_offsets(prefix, splitoffsets, prefix);
+			INIT_OFFSETS(prefix, prefix_offsets, prefix_odata);
+			set_offsets(prefix, prefix_offsets, prefix);
 
 			INSIST(prefix->labels == splitlabel + 1 &&
 			       prefix->length == len);
@@ -2768,7 +2772,9 @@ dns_name_split(dns_name_t *name,
 			 * the new name.
 			 */
 			src = &name->ndata[offsets[splitlabel] + 1];
-			len = (*src++ - 1) / 8 - (bitbytes - 1);
+			len = ((*src == 0 ? 256 : *src) - 1) / 8;
+			len -= (bitbytes - 1);
+			src++;
 
 			suffix->length = name->length -
 				offsets[splitlabel] - len;
@@ -2844,8 +2850,8 @@ dns_name_split(dns_name_t *name,
 			 */
 			INSIST(len = suffix->length);
 
-			INIT_OFFSETS(suffix, splitoffsets, split_odata);
-			set_offsets(suffix, splitoffsets, suffix);
+			INIT_OFFSETS(suffix, suffix_offsets, suffix_odata);
+			set_offsets(suffix, suffix_offsets, suffix);
 
 			INSIST(suffix->labels == suffixlabels &&
 			       suffix->length == len);
@@ -2856,6 +2862,16 @@ dns_name_split(dns_name_t *name,
 
 	}
 
+	/*
+	 * Compacting the prefix can't be done until after the suffix is
+	 * set, because it would screw up the offsets table of 'name'
+	 * when 'name' == 'prefix'.
+	 */
+	if (maybe_compact_prefix && splitlabel > 0 &&
+	    prefix->ndata[prefix_offsets[splitlabel - 1]] ==
+	    DNS_LABELTYPE_BITSTRING)
+		compact(prefix, prefix_offsets);
+
 	return (result);
 }
 

lib/dns/rbt.c

@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: rbt.c,v 1.83.2.1 2000/07/10 23:54:33 gson Exp $ */
+/* $Id: rbt.c,v 1.83.2.2 2000/12/11 21:17:09 gson Exp $ */
 
 /* Principal Authors: DCL */
 
@@ -560,40 +560,70 @@ dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep) {
 				 * end of the truncated name, and then
 				 * updating PADBYTES to reflect the truncation.
 				 *
-				 * When bitstring labels are involved, things
-				 * are just a tad more complicated (aren't
-				 * they always?) because the splitting
-				 * has shifted the bits that this name needs,
-				 * as well as adjusted the bit count.
-				 * So there are convolutions to deal with it.
-				 * There are compromises here between
-				 * abstraction and efficiency.
-				 */
+  				 * When bitstring labels are involved, things
+  				 * are just a tad more complicated (aren't
+  				 * they always?) because the splitting
+				 * has shifted the bits that this name needs
+				 * from the end of the label they were in
+				 * to either the beginning of the label or
+				 * even to the previous (lesser significance)
+				 * label if the split was done in a maximally
+				 * sized bitstring label.  The bit count has
+				 * been adjusted too, so there are convolutions
+				 * to deal with all the bit movement.  Yay,
+				 * I *love* bit labels.  Grumble grumble.
+  				 */
+  				if (common_bits > 0) {
+					unsigned char *p;
+					unsigned int skip_width;
+					unsigned int start_label =
+  					    FAST_COUNTLABELS(&current_name)
+						- common_labels;
 
-				if (common_bits > 0) {
-					dns_label_t label;
+					/*
+					 * If it is not the first label which
+					 * was split, also copy the label
+					 * before it -- which will essentially
+					 * be a NO-OP unless the preceding
+					 * label is a bitstring and the split
+					 * label was 256 bits.  Testing for
+					 * that case is probably roughly
+					 * as expensive as just unconditionally
+					 * copying the preceding label.
+					 */
+					if (start_label > 0)
+						start_label--;
 
-					dns_name_getlabel(prefix,
-					      FAST_COUNTLABELS(&current_name) -
-							  common_labels,
-							  &label);
+					skip_width =
+						prefix->offsets[start_label];
 
-					INSIST(dns_label_type(&label) ==
-					       dns_labeltype_bitstring);
+					memcpy(NAME(current) + skip_width,
+					       prefix->ndata + skip_width,
+					       prefix->length - skip_width);
 
-					memcpy(NAME(current) +
-					       (label.base - prefix->ndata),
-					       label.base,
-					       label.length);
+					/*
+					 * Now add_bits is set to the total
+					 * number of bits in the split label of
+					 * the name being added, and used later
+					 * to determine if the job was
+					 * completed by pushing the
+					 * not-in-common bits down one level.
+					 */
+					start_label =
+						FAST_COUNTLABELS(add_name)
+						- common_labels;
 
-					dns_name_getlabel(add_name,
-						   FAST_COUNTLABELS(add_name) -
-							  common_labels,
-							  &label);
-					INSIST(dns_label_type(&label) ==
-					       dns_labeltype_bitstring);
+					p = add_name->ndata +
+						add_name->offsets[start_label];
+					INSIST(*p == DNS_LABELTYPE_BITSTRING);
 
-					add_bits = dns_label_countbits(&label);
+					add_bits = *(p + 1);
+
+					/*
+					 * A bitstring that was split would not
+					 * result in a part of maximal length.
+					 */
+					INSIST(add_bits != 0);
 				} else
 					add_bits = 0;
 

lib/dns/xfrin.c

@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: xfrin.c,v 1.79.2.6 2000/09/01 01:06:06 bwelling Exp $ */
+/* $Id: xfrin.c,v 1.79.2.7 2000/12/05 18:59:47 bwelling Exp $ */
 
 #include <config.h>
 
@@ -406,6 +406,11 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, isc_uint32_t ttl,
  redo:
 	switch (xfr->state) {
 	case XFRST_SOAQUERY:
+		if (rdata->type != dns_rdatatype_soa) {
+			xfrin_log(xfr, ISC_LOG_ERROR,
+				  "non-SOA response to SOA query");
+			FAIL(DNS_R_FORMERR);
+		}
 		xfr->end_serial = dns_soa_getserial(rdata);
 		if (!DNS_SERIAL_GT(xfr->end_serial,
 				   xfr->ixfr.request_serial)) {

lib/dns/zone.c

@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.152.2.14 2000/10/17 18:48:05 gson Exp $ */
+/* $Id: zone.c,v 1.152.2.16 2000/12/04 18:57:11 bwelling Exp $ */
 
 #include <config.h>
 
@@ -602,6 +602,28 @@ dns_zone_getjournal(dns_zone_t *zone) {
 	return (zone->journal);
 }
 
+/*
+ * Return true iff the zone is "dynamic", in the sense that the zone's
+ * master file (if any) is written by the server, rather than being
+ * updated manually and read by the server.
+ *
+ * This is true for slave zones, stub zones, and zones that allow
+ * dynamic updates either by having an update policy ("ssutable")
+ * or an "allow-update" ACL with a value other than exactly "{ none; }".
+ */
+static isc_boolean_t
+zone_isdynamic(dns_zone_t *zone) {
+	return (ISC_TF(zone->type == dns_zone_slave ||
+	       zone->type == dns_zone_stub ||
+	       zone->ssutable != NULL ||
+	       (zone->update_acl != NULL &&
+	       ! (zone->update_acl->length == 0 && 
+		  zone->update_acl->elements[0].negative == ISC_TRUE &&
+		  zone->update_acl->elements[0].type ==
+		  	dns_aclelementtype_any))));
+}
+
+
 isc_result_t
 dns_zone_load(dns_zone_t *zone) {
 	const char me[] = "dns_zone_load";
@@ -629,6 +651,16 @@ dns_zone_load(dns_zone_t *zone) {
 		goto cleanup;
 	}
 
+	if (zone->db != NULL && zone_isdynamic(zone)) {
+		/*
+		 * This is a slave, stub, or dynamically updated
+		 * zone being reloaded.  Do nothing - the database
+		 * we already have is guaranteed to be up-to-date.
+		 */
+		result = ISC_R_SUCCESS;
+		goto cleanup;
+	}
+		
 	zone_log(zone, me, ISC_LOG_DEBUG(1), "start");
 
 	/*
@@ -3671,13 +3703,22 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) {
 			 */
 			(void)isc_time_now(&zone->loadtime);
 		}
-		if (zone->journal != NULL) {
+
+		if (dump && zone->journal != NULL) {
+			/*
+			 * The in-memory database just changed, and because 'dump'
+			 * is set, it didn't change by being loaded from disk.
+			 * Also, we have not journalled diffs for this change.
+			 * Therefore, the on-disk journal is missing the deltas
+			 * for this change and must be considered invalid.
+			 */
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_ZONE, ISC_LOG_DEBUG(3),
 				      "removing journal file");
 			(void)remove(zone->journal);
 		}
 	}
+	
 	dns_db_closeversion(db, &ver, ISC_FALSE);
 
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
@@ -4196,6 +4237,15 @@ dns_zonemgr_forcemaint(dns_zonemgr_t *zmgr) {
 	{
 		dns_zone_maintenance(p);
 	}
+
+	/*
+	 * Recent configuration changes may have increased the
+	 * amount of available transfers quota.  Make sure any
+	 * transfers currently blocked on quota get started if
+	 * possible.
+	 */
+	zmgr_resume_xfrs(zmgr);
+
 	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_read);
 	return (ISC_R_SUCCESS);
 }

lib/isc/lex.c

@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: lex.c,v 1.31.2.2 2000/07/11 04:55:09 gson Exp $ */
+/* $Id: lex.c,v 1.31.2.3 2000/11/13 17:42:25 gson Exp $ */
 
 #include <config.h>
 
@@ -620,7 +620,7 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 				no_comments = ISC_FALSE;
 				state = saved_state;
 				goto no_read;
-			} else
+			} else if (c != '*')
 				state = lexstate_ccomment;
 			break;
 		case lexstate_eatline:

lib/isc/unix/socket.c

@@ -15,7 +15,7 @@
  * SOFTWARE.
  */
 
-/* $Id: socket.c,v 1.142.2.6 2000/09/08 22:17:27 gson Exp $ */
+/* $Id: socket.c,v 1.142.2.7 2000/11/13 22:06:54 gson Exp $ */
 
 #include <config.h>
 
@@ -1179,7 +1179,8 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 
 #if defined(SO_TIMESTAMP)
 		if (setsockopt(sock->fd, SOL_SOCKET, SO_TIMESTAMP,
-			       (void *)&on, sizeof on) < 0) {
+			       (void *)&on, sizeof on) < 0
+		    && errno != ENOPROTOOPT) {
 			UNEXPECTED_ERROR(__FILE__, __LINE__,
 					 "setsockopt(%d, SO_TIMESTAMP) failed",
 					 sock->fd);

version

@@ -1,10 +1,10 @@
-# $Id: version,v 1.15.2.16 2000/11/09 00:40:21 gson Exp $
+# $Id: version,v 1.15.2.17 2000/11/13 17:41:14 gson Exp $
 #
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
 #
 MAJORVER=9
 MINORVER=0
-PATCHVER=1
-RELEASETYPE=
-RELEASEVER=
+PATCHVER=2
+RELEASETYPE=a
+RELEASEVER=1