9.10.2-P3

(cherry picked from commit 2a008da497)

.gitignore

@@ -4,9 +4,9 @@ config.h
 config.cache
 config.status
 libtool
-isc-config.sh
-configure.lineno
-autom4te.cache
+/isc-config.sh
+/configure.lineno
+autom4te.cache/
 *.o
 *.lo
 *.so

COPYRIGHT

@@ -1,4 +1,4 @@
-Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 1996-2003  Internet Software Consortium.
 
 Permission to use, copy, modify, and/or distribute this software for any

FAQ

@@ -1,6 +1,7 @@
 Frequently Asked Questions about BIND 9
 
-Copyright © 2004-2010, 2013 Internet Systems Consortium, Inc. ("ISC")
+Copyright © 2004-2010, 2013, 2014 Internet Systems Consortium, Inc.
+("ISC")
 
 Copyright © 2000-2003 Internet Software Consortium.
 
@@ -28,8 +29,8 @@ A: Short Answer: No.
    What addresses to listen on? For a laptop on the move a lot you may
    only want to listen on the loop back interfaces.
 
-   Who do you offer recursive service to? Is there are firewall to
-   consider? If so is it stateless or stateful. Are you directly on the
+   To whom do you offer recursive service? Is there a firewall to
+   consider? If so, is it stateless or stateful? Are you directly on the
    Internet? Are you on a private network? Are you on a NAT'd network? The
    answers to all these questions change how you configure even a caching
    name server.
@@ -104,8 +105,8 @@ A: You are most likely running named as a non-root user, and that user
    fixing this are to create a /var/run/named directory owned by the named
    user and set pid-file to "/var/run/named/named.pid", or set pid-file to
    "named.pid", which will put the file in the directory specified by the
-   directory option (which, in this case, must be writable by the named
-   user).
+   directory option (which, in this case, must be writable by the user
+   named is running as).
 
 Q: I can query the nameserver from the nameserver but not from other
    machines. Why?
@@ -264,7 +265,7 @@ Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading
    master file primaries/wireless.ietf56.ietf.org: no owner".
 
 A: This error is produced when a line in the master file contains leading
-   white space (tab/space) but the is no current record owner name to
+   white space (tab/space) but there is no current record owner name to
    inherit the name from. Usually this is the result of putting white
    space before a comment, forgetting the "@" for the SOA record, or
    indenting the master file.

FAQ.xml

@@ -1,7 +1,7 @@
 <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
        "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []>
 <!--
- - Copyright (C) 2004-2010, 2013  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2010, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -31,6 +31,7 @@
       <year>2009</year>
       <year>2010</year>
       <year>2013</year>
+      <year>2014</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -83,8 +84,8 @@
 	  you may only want to listen on the loop back interfaces.
 	</para>
 	<para>
-	  Who do you offer recursive service to?  Is there are firewall
-	  to consider?  If so is it stateless or stateful.  Are you
+	  To whom do you offer recursive service?  Is there a firewall
+	  to consider?  If so, is it stateless or stateful?  Are you
 	  directly on the Internet?  Are you on a private network? Are
 	  you on a NAT'd network? The answers
 	  to all these questions change how you configure even a
@@ -246,7 +247,7 @@ view "chaos" chaos {
 	  "/var/run/named/named.pid", or set pid-file to "named.pid",
 	  which will put the file in the directory specified by the
 	  directory option (which, in this case, must be writable by
-	  the named user).
+	  the user named is running as).
 	</para>
       </answer>
     </qandaentry>
@@ -480,7 +481,7 @@ Master 10.0.1.1:
       <answer>
 	<para>
 	  This error is produced when a line in the master file
-	  contains leading white space (tab/space) but the is no
+	  contains leading white space (tab/space) but there is no
 	  current record owner name to inherit the name from.  Usually
 	  this is the result of putting white space before a comment,
 	  forgetting the "@" for the SOA record, or indenting the master

Makefile.in

@@ -21,7 +21,7 @@ top_srcdir =	@top_srcdir@
 
 @BIND9_VERSION@
 
-SUBDIRS =	make unit lib bin doc @LIBEXPORT@
+SUBDIRS =	make unit lib bin doc
 TARGETS =
 PREREQS =	bind.keys.h
 

README

@@ -51,6 +51,39 @@ BIND 9
 	For up-to-date release notes and errata, see
 	http://www.isc.org/software/bind9/releasenotes
 
+BIND 9.10.2-P3
+
+	BIND 9.10.2-P3 is a security release addressing the flaw
+	described in CVE-2015-5477.
+
+BIND 9.10.2-P2
+
+	BIND 9.10.2-P2 is a security release addressing the flaw
+	described in CVE-2015-4620.
+
+BIND 9.10.2-P1
+
+        BIND 9.10.2-P1 is a patch release addressing several
+        bugs recently found in the response-policy zones (RPZ)
+        implementation in BIND 9.10.  These mostly affect servers
+        that have multiple frequently-updated response-policy
+        zones.
+
+BIND 9.10.2
+
+	BIND 9.10.2 is a maintenance release and addresses bugs
+	found in BIND 9.10.1 and earlier, as well as the security
+	flaws described in CVE-2014-8500, CVE-2014-8680 and
+	CVE-2015-1349.
+
+BIND 9.10.1
+
+	BIND 9.10.1 is a maintenance release and addresses bugs
+	found in BIND 9.10.0 and earlier.
+
+	This release addresses the security flaws described in
+	CVE-2014-3214 and CVE-2014-3859.
+
 BIND 9.10.0
 
 	BIND 9.10.0 includes a number of changes from BIND 9.9 and earlier
@@ -74,12 +107,15 @@ BIND 9.10.0
 	 - A new zone file format, "map", stores zone data in a
 	   format that can be mapped directly into memory, allowing
 	   significantly faster zone loading.
-	 - "delve" (domain entity lookup and validation engine) is a
-	   new tool with dig-like semantics for looking up DNS data
-	   and performing internal DNSSEC validation.  This allows
-	   easy validation in environments where the resolver may
-	   not be trustworthy, and assists with troubleshooting of
-	   DNSSEC problems.
+	 - "delv" (domain entity lookup and validation) is a new tool
+	   with dig-like semantics for looking up DNS data and performing
+	   internal DNSSEC validation.  This allows easy validation in
+	   environments where the resolver may not be trustworthy, and
+	   assists with troubleshooting of DNSSEC problems. (NOTE:
+	   In previous development releases of BIND 9.10, this utility
+	   was called "delve". The spelling has been changed to avoid
+	   confusion with the "delve" utility included with the Xapian
+	   search engine.)
 	 - Improved EDNS(0) processing for better resolver performance
 	   and reliability over slow or lossy connections.
 	 - A new "configure --with-tuning=large" option tunes certain
@@ -111,7 +147,7 @@ BIND 9.10.0
 	   browsers.
 	 - The statistics channel can now provide data in JSON
 	   format as well as XML.
-	 - New stats counters track TCP and UDP queries recieved
+	 - New stats counters track TCP and UDP queries received
 	   per zone, and EDNS options received in total.
 	 - The internal and export versions of the BIND libraries
 	   (libisc, libdns, etc) have been unified so that external
@@ -494,23 +530,29 @@ Change Log
 
 Bug Reports and Mailing Lists
 
-	Bugs reports should be sent to
+	Bug reports should be sent to:
 
 		bind9-bugs@isc.org
 
-	To join the BIND Users mailing list, send mail to
+	Feature requests can be sent to:
 
-		bind-users-request@isc.org
+		bind-suggest@isc.org
 
-	archives of which can be found via
+	To join or view the archives of the BIND Users mailing list,
+	visit:
 
-		http://www.isc.org/ops/lists/
+		https://lists.isc.org/mailman/listinfo/bind-users
 
 	If you're planning on making changes to the BIND 9 source
-	code, you might want to join the BIND Workers mailing list.
-	Send mail to
+	code, you may also want to join the BIND Workers mailing
+	list:
 
-		bind-workers-request@isc.org
+		https://lists.isc.org/mailman/listinfo/bind-workers
+
+	Information on read-only Git access, coding style and developer
+	guidelines can be found at:
+
+		http://www.isc.org/git/
 
 
 Acknowledgments

acconfig.h

@@ -73,6 +73,9 @@
 /** define if arc4random() exists */
 #undef HAVE_ARC4RANDOM
 
+/** define if arc4random_addrandom() exists */
+#undef HAVE_ARC4RANDOM_ADDRANDOM
+
 /**
  * define if pthread_setconcurrency() should be called to tell the
  * OS how many threads we might want to run.

aclocal.m4

@@ -9,7 +9,9 @@ m4_divert_text(HELP_CANON, [[
   and --localstatedir are /etc and /var, respectively.]])
 m4_divert_text(HELP_END, [[
 Professional support for BIND is provided by Internet Systems Consortium,
-Inc., doing business as DNSco.  Information about paid support options is
-available at http://www.dns-co.com/solutions/.  Free support is provided by
-our user community via a mailing list.  Information on public email lists
-is available at https://www.isc.org/community/mailing-list/.]])
+Inc.  Information about paid support and training options is available at
+https://www.isc.org/support.
+
+Help can also often be found on the BIND Users mailing list
+(https://lists.isc.org/mailman/listinfo/bind-users) or in the #bind
+channel of the Freenode IRC service.]])

bin/Makefile.in

@@ -19,7 +19,7 @@ srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 
-SUBDIRS =	named rndc dig delve dnssec tools tests nsupdate \
+SUBDIRS =	named rndc dig delv dnssec tools tests nsupdate \
 		check confgen @PYTHON_TOOLS@ @PKCS11_TOOLS@
 TARGETS =
 

bin/check/Makefile.in

@@ -70,7 +70,7 @@ named-checkzone.@O@: named-checkzone.c
 		-c ${srcdir}/named-checkzone.c
 
 named-checkconf@EXEEXT@: named-checkconf.@O@ check-tool.@O@ ${ISCDEPLIBS} \
-		${ISCCFGDEPLIBS} ${BIND9DEPLIBS}
+		${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${BIND9DEPLIBS}
 	export BASEOBJS="named-checkconf.@O@ check-tool.@O@"; \
 	export LIBS0="${BIND9LIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
 	${FINALBUILDCMD}

bin/check/named-checkconf.c

@@ -503,7 +503,33 @@ main(int argc, char **argv) {
 
 	isc_commandline_errprint = ISC_FALSE;
 
-	while ((c = isc_commandline_parse(argc, argv, "dhjt:pvxz")) != EOF) {
+	/*
+	 * Process memory debugging argument first.
+	 */
+#define CMDLINE_FLAGS "dhjm:t:pvxz"
+	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
+		switch (c) {
+		case 'm':
+			if (strcasecmp(isc_commandline_argument, "record") == 0)
+				isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
+			if (strcasecmp(isc_commandline_argument, "trace") == 0)
+				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
+			if (strcasecmp(isc_commandline_argument, "usage") == 0)
+				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
+			if (strcasecmp(isc_commandline_argument, "size") == 0)
+				isc_mem_debugging |= ISC_MEM_DEBUGSIZE;
+			if (strcasecmp(isc_commandline_argument, "mctx") == 0)
+				isc_mem_debugging |= ISC_MEM_DEBUGCTX;
+			break;
+		default:
+			break;
+		}
+	}
+	isc_commandline_reset = ISC_TRUE;
+
+	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
+
+	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
 		switch (c) {
 		case 'd':
 			debug++;
@@ -513,6 +539,9 @@ main(int argc, char **argv) {
 			nomerge = ISC_FALSE;
 			break;
 
+		case 'm':
+			break;
+
 		case 't':
 			result = isc_dir_chroot(isc_commandline_argument);
 			if (result != ISC_R_SUCCESS) {
@@ -572,8 +601,6 @@ main(int argc, char **argv) {
 	InitSockets();
 #endif
 
-	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
-
 	RUNTIME_CHECK(setup_logging(mctx, stdout, &logc) == ISC_R_SUCCESS);
 
 	RUNTIME_CHECK(isc_entropy_create(mctx, &ectx) == ISC_R_SUCCESS);

bin/check/named-checkconf.html

@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-h</code>] [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-p</code>] [<code class="option">-x</code>] [<code class="option">-z</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543402"></a><h2>DESCRIPTION</h2>
+<a name="id2543411"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
       checks the syntax, but not the semantics, of a
       <span><strong class="command">named</strong></span> configuration file.  The file is parsed
@@ -52,7 +52,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543451"></a><h2>OPTIONS</h2>
+<a name="id2543460"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-h</span></dt>
 <dd><p>
@@ -101,21 +101,21 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543595"></a><h2>RETURN VALUES</h2>
+<a name="id2543604"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
       returns an exit status of 1 if
       errors were detected and 0 otherwise.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543607"></a><h2>SEE ALSO</h2>
+<a name="id2543616"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543637"></a><h2>AUTHOR</h2>
+<a name="id2543645"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/check/named-checkzone.8

@@ -266,7 +266,7 @@ so that include directives in the configuration file are processed as if run by
 .PP
 \-T \fImode\fR
 .RS 4
-Check if Sender Policy Framework records (TXT and SPF) both exist or both don't exist. A warning is issued if they don't match. Possible modes are
+Check if Sender Policy Framework (SPF) records exist and issues a warning if an SPF\-formatted TXT record is not also present. Possible modes are
 \fB"warn"\fR
 (default),
 \fB"ignore"\fR.

bin/check/named-checkzone.docbook

@@ -440,10 +440,10 @@
 	<term>-T <replaceable class="parameter">mode</replaceable></term>
 	<listitem>
 	  <para>
-	    Check if Sender Policy Framework records (TXT and SPF)
-	    both exist or both don't exist.  A warning is issued
-	    if they don't match.  Possible modes are
-	    <command>"warn"</command> (default), <command>"ignore"</command>.
+	    Check if Sender Policy Framework (SPF) records exist
+	    and issues a warning if an SPF-formatted TXT record is
+	    not also present.  Possible modes are <command>"warn"</command>
+	    (default), <command>"ignore"</command>.
 	  </para>
 	</listitem>
       </varlistentry>

bin/check/named-checkzone.html

@@ -33,7 +33,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-compilezone</code>  [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-J <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-l <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543776"></a><h2>DESCRIPTION</h2>
+<a name="id2543784"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
       checks the syntax and integrity of a zone file.  It performs the
       same checks as <span><strong class="command">named</strong></span> does when loading a
@@ -53,7 +53,7 @@
      </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543811"></a><h2>OPTIONS</h2>
+<a name="id2543819"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-d</span></dt>
 <dd><p>
@@ -249,10 +249,10 @@
           </p></dd>
 <dt><span class="term">-T <em class="replaceable"><code>mode</code></em></span></dt>
 <dd><p>
-	    Check if Sender Policy Framework records (TXT and SPF)
-	    both exist or both don't exist.  A warning is issued
-	    if they don't match.  Possible modes are
-	    <span><strong class="command">"warn"</strong></span> (default), <span><strong class="command">"ignore"</strong></span>.
+	    Check if Sender Policy Framework (SPF) records exist
+	    and issues a warning if an SPF-formatted TXT record is
+	    not also present.  Possible modes are <span><strong class="command">"warn"</strong></span>
+	    (default), <span><strong class="command">"ignore"</strong></span>.
 	  </p></dd>
 <dt><span class="term">-w <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
@@ -287,14 +287,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544633"></a><h2>RETURN VALUES</h2>
+<a name="id2544710"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
       returns an exit status of 1 if
       errors were detected and 0 otherwise.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544713"></a><h2>SEE ALSO</h2>
+<a name="id2544722"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
       <em class="citetitle">RFC 1035</em>,
@@ -302,7 +302,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544746"></a><h2>AUTHOR</h2>
+<a name="id2544755"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/confgen/.gitignore

@@ -1,2 +1,3 @@
 ddns-confgen
 rndc-confgen
+tsig-keygen

bin/confgen/ddns-confgen.8

@@ -40,7 +40,7 @@ ddns\-confgen \- ddns key generation tool
 \fBtsig\-keygen\fR
 and
 \fBddns\-confgen\fR
-are invokation methods for a utility that generates keys for use in TSIG signing. The resulting keys can be used, for example, to secure dynamic DNS updates to a zone or for the
+are invocation methods for a utility that generates keys for use in TSIG signing. The resulting keys can be used, for example, to secure dynamic DNS updates to a zone or for the
 \fBrndc\fR
 command channel.
 .PP

bin/confgen/ddns-confgen.docbook

@@ -67,7 +67,7 @@
     <title>DESCRIPTION</title>
     <para>
       <command>tsig-keygen</command> and <command>ddns-confgen</command>
-      are invokation methods for a utility that generates keys for use
+      are invocation methods for a utility that generates keys for use
       in TSIG signing.  The resulting keys can be used, for example,
       to secure dynamic DNS updates to a zone or for the
       <command>rndc</command> command channel.

bin/confgen/ddns-confgen.html

@@ -32,10 +32,10 @@
 <div class="cmdsynopsis"><p><code class="command">ddns-confgen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-q</code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [ -s <em class="replaceable"><code>name</code></em>  |   -z <em class="replaceable"><code>zone</code></em> ]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543426"></a><h2>DESCRIPTION</h2>
+<a name="id2543434"></a><h2>DESCRIPTION</h2>
 <p>
       <span><strong class="command">tsig-keygen</strong></span> and <span><strong class="command">ddns-confgen</strong></span>
-      are invokation methods for a utility that generates keys for use
+      are invocation methods for a utility that generates keys for use
       in TSIG signing.  The resulting keys can be used, for example,
       to secure dynamic DNS updates to a zone or for the
       <span><strong class="command">rndc</strong></span> command channel.
@@ -68,7 +68,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543499"></a><h2>OPTIONS</h2>
+<a name="id2543508"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd><p>
@@ -140,7 +140,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543697"></a><h2>SEE ALSO</h2>
+<a name="id2543705"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">nsupdate</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -148,7 +148,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543735"></a><h2>AUTHOR</h2>
+<a name="id2543744"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/confgen/rndc-confgen.html

@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc-confgen</code>  [<code class="option">-a</code>] [<code class="option">-A <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543447"></a><h2>DESCRIPTION</h2>
+<a name="id2543456"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc-confgen</strong></span>
       generates configuration files
       for <span><strong class="command">rndc</strong></span>.  It can be used as a
@@ -48,7 +48,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543492"></a><h2>OPTIONS</h2>
+<a name="id2543500"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd>
@@ -162,7 +162,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543822"></a><h2>EXAMPLES</h2>
+<a name="id2543831"></a><h2>EXAMPLES</h2>
 <p>
       To allow <span><strong class="command">rndc</strong></span> to be used with
       no manual configuration, run
@@ -179,7 +179,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543864"></a><h2>SEE ALSO</h2>
+<a name="id2543873"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -187,7 +187,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543902"></a><h2>AUTHOR</h2>
+<a name="id2543911"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/delv/.gitignore

@@ -0,0 +1 @@
+/delv

bin/delv/Makefile.in

@@ -44,36 +44,33 @@ NOSYMLIBS =	${DNSLIBS} ${IRSLIBS} ${ISCCFGLIBS} ${ISCNOSYMLIBS} @LIBS@
 
 SUBDIRS =
 
-TARGETS =	delve@EXEEXT@
+TARGETS =	delv@EXEEXT@
 
-OBJS =		delve.@O@
+OBJS =		delv.@O@
 
-SRCS =		delve.c
+SRCS =		delv.c
 
-MANPAGES =	delve.1
+MANPAGES =	delv.1
 
-HTMLPAGES =	delve.html
+HTMLPAGES =	delv.html
 
 MANOBJS =	${MANPAGES} ${HTMLPAGES}
 
 @BIND9_MAKE_RULES@
 
-delve@EXEEXT@: delve.@O@ ${DEPLIBS}
-	export BASEOBJS="delve.@O@"; \
+delv@EXEEXT@: delv.@O@ ${DEPLIBS}
+	export BASEOBJS="delv.@O@"; \
 	export LIBS0="${DNSLIBS}"; \
 	${FINALBUILDCMD}
 
-#	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
-#	delve.@O@ ${LIBS}
-
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
 
-install:: delve@EXEEXT@ installdirs
+install:: delv@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
-		delve@EXEEXT@ ${DESTDIR}${bindir}
-	${INSTALL_DATA} ${srcdir}/delve.1 ${DESTDIR}${mandir}/man1
+		delv@EXEEXT@ ${DESTDIR}${bindir}
+	${INSTALL_DATA} ${srcdir}/delv.1 ${DESTDIR}${mandir}/man1
 
 doc man:: ${MANOBJS}
 

bin/delv/delv.1

@@ -16,63 +16,63 @@
 .\"
 .hy 0
 .ad l
-.\"     Title: delve
+.\"     Title: delv
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
-.\"      Date: February 21, 2014
+.\"      Date: April 23, 2014
 .\"    Manual: BIND9
 .\"    Source: BIND9
 .\"
-.TH "DELVE" "1" "February 21, 2014" "BIND9" "BIND9"
+.TH "DELV" "1" "April 23, 2014" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
 .ad l
 .SH "NAME"
-delve \- DNS lookup and validation utility
+delv \- DNS lookup and validation utility
 .SH "SYNOPSIS"
-.HP 6
-\fBdelve\fR [@server] [\fB\-4\fR] [\fB\-6\fR] [\fB\-a\ \fR\fB\fIanchor\-file\fR\fR] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIlevel\fR\fR] [\fB\-i\fR] [\fB\-m\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [name] [type] [class] [queryopt...]
-.HP 6
-\fBdelve\fR [\fB\-h\fR]
-.HP 6
-\fBdelve\fR [\fB\-v\fR]
-.HP 6
-\fBdelve\fR [queryopt...] [query...]
+.HP 5
+\fBdelv\fR [@server] [\fB\-4\fR] [\fB\-6\fR] [\fB\-a\ \fR\fB\fIanchor\-file\fR\fR] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIlevel\fR\fR] [\fB\-i\fR] [\fB\-m\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [name] [type] [class] [queryopt...]
+.HP 5
+\fBdelv\fR [\fB\-h\fR]
+.HP 5
+\fBdelv\fR [\fB\-v\fR]
+.HP 5
+\fBdelv\fR [queryopt...] [query...]
 .SH "DESCRIPTION"
 .PP
-\fBdelve\fR
-(Domain Entity Lookup & Validation Engine) is a tool for sending DNS queries and validating the results, using the the same internal resolver and validator logic as
+\fBdelv\fR
+(Domain Entity Lookup & Validation) is a tool for sending DNS queries and validating the results, using the the same internal resolver and validator logic as
 \fBnamed\fR.
 .PP
-\fBdelve\fR
+\fBdelv\fR
 will send to a specified name server all queries needed to fetch and validate the requested data; this includes the original requested query, subsequent queries to follow CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records to establish a chain of trust for DNSSEC validation. It does not perform iterative resolution, but simulates the behavior of a name server configured for DNSSEC validating and forwarding.
 .PP
 By default, responses are validated using built\-in DNSSEC trust anchors for the root zone (".") and for the ISC DNSSEC lookaside validation zone ("dlv.isc.org"). Records returned by
-\fBdelve\fR
+\fBdelv\fR
 are either fully validated or were not signed. If validation fails, an explanation of the failure is included in the output; the validation process can be traced in detail. Because
-\fBdelve\fR
+\fBdelv\fR
 does not rely on an external server to carry out validation, it can be used to check the validity of DNS responses in environments where local name servers may not be trustworthy.
 .PP
 Unless it is told to query a specific name server,
-\fBdelve\fR
+\fBdelv\fR
 will try each of the servers listed in
 \fI/etc/resolv.conf\fR. If no usable server addresses are found,
-\fBdelve\fR
+\fBdelv\fR
 will send queries to the localhost addresses (127.0.0.1 for IPv4, ::1 for IPv6).
 .PP
 When no command line arguments or options are given,
-\fBdelve\fR
+\fBdelv\fR
 will perform an NS query for "." (the root zone).
 .SH "SIMPLE USAGE"
 .PP
 A typical invocation of
-\fBdelve\fR
+\fBdelv\fR
 looks like:
 .sp
 .RS 4
 .nf
- delve @server name type 
+ delv @server name type 
 .fi
 .RE
 .sp
@@ -83,7 +83,7 @@ where:
 is the name or IP address of the name server to query. This can be an IPv4 address in dotted\-decimal notation or an IPv6 address in colon\-delimited notation. When the supplied
 \fIserver\fR
 argument is a hostname,
-\fBdelve\fR
+\fBdelv\fR
 resolves that name before querying that name server (note, however, that this initial lookup is
 \fInot\fR
 validated by DNSSEC).
@@ -91,14 +91,14 @@ validated by DNSSEC).
 If no
 \fIserver\fR
 argument is provided,
-\fBdelve\fR
+\fBdelv\fR
 consults
 \fI/etc/resolv.conf\fR; if an address is found there, it queries the name server at that address. If either of the
 \fB\-4\fR
 or
 \fB\-6\fR
 options are in use, then only addresses for the corresponding transport will be tried. If no usable addresses are found,
-\fBdelve\fR
+\fBdelv\fR
 will send queries to the localhost addresses (127.0.0.1 for IPv4, ::1 for IPv6).
 .RE
 .PP
@@ -114,7 +114,7 @@ indicates what type of query is required \(em ANY, A, MX, etc.
 can be any valid query type. If no
 \fItype\fR
 argument is supplied,
-\fBdelve\fR
+\fBdelv\fR
 will perform a lookup for an A record.
 .RE
 .SH "OPTIONS"
@@ -133,7 +133,7 @@ or
 options.
 .sp
 Note: When reading the trust anchor file,
-\fBdelve\fR
+\fBdelv\fR
 treats
 \fBmanaged\-keys\fR
 statements and
@@ -141,14 +141,14 @@ statements and
 statements identically. That is, for a managed key, it is the
 \fIinitial\fR
 key that is trusted; RFC 5011 key management is not supported.
-\fBdelve\fR
+\fBdelv\fR
 will not consult the managed\-keys database maintained by
 \fBnamed\fR. This means that if either of the keys in
 \fI/etc/bind.keys\fR
 is revoked and rolled over, it will be necessary to update
 \fI/etc/bind.keys\fR
 to use DNSSEC validation in
-\fBdelve\fR.
+\fBdelv\fR.
 .RE
 .PP
 \-b \fIaddress\fR
@@ -160,7 +160,7 @@ Sets the source IP address of the query to
 \-c \fIclass\fR
 .RS 4
 Sets the query class for the requested data. Currently, only class "IN" is supported in
-\fBdelve\fR
+\fBdelv\fR
 and any other value is ignored.
 .RE
 .PP
@@ -168,7 +168,7 @@ and any other value is ignored.
 .RS 4
 Set the systemwide debug level to
 \fBlevel\fR. The allowed range is from 0 to 99. The default is 0 (no debugging). Debugging traces from
-\fBdelve\fR
+\fBdelv\fR
 become more verbose as the debug level increases. See the
 \fB+mtrace\fR,
 \fB+rtrace\fR, and
@@ -179,14 +179,14 @@ options below for additional debugging details.
 \-h
 .RS 4
 Display the
-\fBdelve\fR
+\fBdelv\fR
 help usage output and exit.
 .RE
 .PP
 \-i
 .RS 4
 Insecure mode. This disables internal DNSSEC validation. (Note, however, this does not set the CD bit on upstream queries. If the server being queried is performing DNSSEC validation, then it will not return invalid data; this can cause
-\fBdelve\fR
+\fBdelv\fR
 to time out. When it is necessary to examine invalid data to debug a DNSSEC problem, use
 \fBdig +cd\fR.)
 .RE
@@ -222,7 +222,7 @@ option is supplied to indicate a reverse lookup, in which case it is "PTR".
 \-v
 .RS 4
 Print the
-\fBdelve\fR
+\fBdelv\fR
 version and exit.
 .RE
 .PP
@@ -237,7 +237,7 @@ is used, there is no need to provide the
 or
 \fItype\fR
 arguments.
-\fBdelve\fR
+\fBdelv\fR
 automatically performs a lookup for a name like
 11.12.13.10.in\-addr.arpa
 and sets the query type to PTR. IPv6 addresses are looked up using nibble format under the IP6.ARPA domain.
@@ -246,19 +246,19 @@ and sets the query type to PTR. IPv6 addresses are looked up using nibble format
 \-4
 .RS 4
 Forces
-\fBdelve\fR
+\fBdelv\fR
 to only use IPv4.
 .RE
 .PP
 \-6
 .RS 4
 Forces
-\fBdelve\fR
+\fBdelv\fR
 to only use IPv6.
 .RE
 .SH "QUERY OPTIONS"
 .PP
-\fBdelve\fR
+\fBdelv\fR
 provides a number of query options which affect the way results are displayed, and in some cases the way lookups are performed.
 .PP
 Each query option is identified by a keyword preceded by a plus sign (+). Some keywords set or reset an option. These may be preceded by the string
@@ -269,8 +269,8 @@ to negate the meaning of that keyword. Other keywords assign values to options l
 \fB+[no]cdflag\fR
 .RS 4
 Controls whether to set the CD (checking disabled) bit in queries sent by
-\fBdelve\fR. This may be useful when troubleshooting DNSSEC problems from behind a validating resolver. A validating resolver will block invalid responses, making it difficult to retrieve them for analysis. Setting the CD flag on queries will cause the resolver to return invalid responses, which
-\fBdelve\fR
+\fBdelv\fR. This may be useful when troubleshooting DNSSEC problems from behind a validating resolver. A validating resolver will block invalid responses, making it difficult to retrieve them for analysis. Setting the CD flag on queries will cause the resolver to return invalid responses, which
+\fBdelv\fR
 can then validate internally and report the errors in detail.
 .RE
 .PP
@@ -287,7 +287,7 @@ Controls whether to display the TTL when printing a record. The default is to di
 \fB+[no]rtrace\fR
 .RS 4
 Toggle resolver fetch logging. This reports the name and type of each query sent by
-\fBdelve\fR
+\fBdelv\fR
 in the process of carrying out the resolution and validation process: this includes including the original query and all subsequent queries to follow CNAMEs and to establish a chain of trust for DNSSEC validation.
 .sp
 This is equivalent to setting the debug level to 1 in the "resolver" logging category. Setting the systemwide debug level to 1 using the
@@ -298,7 +298,7 @@ option will product the same output (but will affect other logging categories as
 \fB+[no]mtrace\fR
 .RS 4
 Toggle message logging. This produces a detailed dump of the responses received by
-\fBdelve\fR
+\fBdelv\fR
 in the process of carrying out the resolution and validation process.
 .sp
 This is equivalent to setting the debug level to 10 for the the "packets" module of the "resolver" logging category. Setting the systemwide debug level to 10 using the
@@ -365,14 +365,14 @@ as a group.
 \fB+[no]multiline\fR
 .RS 4
 Print long records (such as RRSIG, DNSKEY, and SOA records) in a verbose multi\-line format with human\-readable comments. The default is to print each record on a single line, to facilitate machine parsing of the
-\fBdelve\fR
+\fBdelv\fR
 output.
 .RE
 .PP
 \fB+[no]dnssec\fR
 .RS 4
 Indicates whether to display RRSIG records in the
-\fBdelve\fR
+\fBdelv\fR
 output. The default is to do so. Note that (unlike in
 \fBdig\fR) this does
 \fInot\fR

bin/delv/delv.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -88,7 +88,7 @@
 
 #define MAXNAME (DNS_NAME_MAXTEXT+1)
 
-/* Variables used internally by delve. */
+/* Variables used internally by delv. */
 char *progname;
 static isc_mem_t *mctx = NULL;
 static isc_log_t *lctx = NULL;
@@ -155,7 +155,7 @@ parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 static void
 usage(void) {
 	fputs(
-"Usage:  delve [@server] {q-opt} {d-opt} [domain] [q-type] [q-class]\n"
+"Usage:  delv [@server] {q-opt} {d-opt} [domain] [q-type] [q-class]\n"
 "Where:  domain	  is in the Domain Name System\n"
 "        q-class  is one of (in,hs,ch,...) [default: in]\n"
 "        q-type   is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n"
@@ -230,22 +230,22 @@ warn(const char *format, ...) {
 }
 
 static isc_logcategory_t categories[] = {
-	{ "delve",	     0 },
+	{ "delv",	     0 },
 	{ NULL,		     0 }
 };
 #define LOGCATEGORY_DEFAULT		(&categories[0])
 #define LOGMODULE_DEFAULT		(&modules[0])
 
 static isc_logmodule_t modules[] = {
-	{ "delve",	 		0 },
+	{ "delv",	 		0 },
 	{ NULL, 			0 }
 };
 
 static void
-delve_log(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
+delv_log(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 
 static void
-delve_log(int level, const char *fmt, ...) {
+delv_log(int level, const char *fmt, ...) {
 	va_list ap;
 	char msgbuf[2048];
 
@@ -416,7 +416,7 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 	if (!dns_rdataset_isassociated(rdataset)) {
 		char namebuf[DNS_NAME_FORMATSIZE];
 		dns_name_format(owner, namebuf, sizeof(namebuf));
-		delve_log(ISC_LOG_DEBUG(4),
+		delv_log(ISC_LOG_DEBUG(4),
 			  "WARN: empty rdataset %s", namebuf);
 		return (ISC_R_SUCCESS);
 	}
@@ -444,8 +444,6 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 			     result == ISC_R_SUCCESS;
 			     result = dns_rdataset_next(rdataset))
 			{
-				isc_region_t r;
-
 				if ((rdataset->attributes &
 				     DNS_RDATASETATTR_NEGATIVE) != 0)
 					continue;
@@ -459,14 +457,12 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 				if (result != ISC_R_SUCCESS)
 					break;
 
-				isc_buffer_availableregion(&target, &r);
-				if (r.length < 1) {
+				if (isc_buffer_availablelength(&target) < 1) {
 					result = ISC_R_NOSPACE;
 					break;
 				}
 
-				r.base[0] = '\n';
-				isc_buffer_add(&target, 1);
+				isc_buffer_putstr(&target, "\n");
 
 				dns_rdata_reset(&rdata);
 			}
@@ -556,7 +552,7 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 
 	result = dns_name_fromtext(n, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
-		delve_log(ISC_LOG_ERROR, "failed to convert QNAME %s: %s",
+		delv_log(ISC_LOG_ERROR, "failed to convert QNAME %s: %s",
 			  text, isc_result_totext(result));
 		return (result);
 	}
@@ -595,10 +591,10 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 		return (ISC_R_SUCCESS);
 
 	if (match_root)
-		delve_log(ISC_LOG_DEBUG(3), "adding trust anchor %s",
+		delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s",
 			  trust_anchor);
 	if (match_dlv)
-		delve_log(ISC_LOG_DEBUG(3), "adding DLV trust anchor %s",
+		delv_log(ISC_LOG_DEBUG(3), "adding DLV trust anchor %s",
 			  dlv_anchor);
 
 	flags = cfg_obj_asuint32(cfg_tuple_get(key, "flags"));
@@ -711,10 +707,17 @@ setup_dnsseckeys(dns_client_t *client) {
 #endif
 	}
 
-	if (trust_anchor == NULL)
+	if (trust_anchor == NULL) {
 		trust_anchor = isc_mem_strdup(mctx, ".");
-	if (dlv_anchor == NULL)
+		if (trust_anchor == NULL)
+			fatal("out of memory");
+	}
+
+	if (dlv_anchor == NULL) {
 		dlv_anchor = isc_mem_strdup(mctx, "dlv.isc.org");
+		if (dlv_anchor == NULL)
+			fatal("out of memory");
+	}
 
 	CHECK(convert_name(&afn, &anchor_name, trust_anchor));
 	CHECK(convert_name(&dfn, &dlv_name, dlv_anchor));
@@ -762,7 +765,7 @@ setup_dnsseckeys(dns_client_t *client) {
 
  cleanup:
 	if (result != ISC_R_SUCCESS)
-		delve_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
+		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			  isc_result_totext(result));
 	return (result);
 }
@@ -811,7 +814,7 @@ addserver(dns_client_t *client) {
 		hints.ai_protocol = IPPROTO_UDP;
 		gai_error = getaddrinfo(server, port, &hints, &res);
 		if (gai_error != 0) {
-			delve_log(ISC_LOG_ERROR,
+			delv_log(ISC_LOG_ERROR,
 				  "getaddrinfo failed: %s",
 				  gai_strerror(gai_error));
 			return (ISC_R_FAILURE);
@@ -848,7 +851,7 @@ addserver(dns_client_t *client) {
 	}
 
 	if (result != ISC_R_SUCCESS)
-		delve_log(ISC_LOG_ERROR, "addserver: %s",
+		delv_log(ISC_LOG_ERROR, "addserver: %s",
 			  isc_result_totext(result));
 
 	return (result);
@@ -868,7 +871,7 @@ findserver(dns_client_t *client) {
 
 	result = irs_resconf_load(mctx, "/etc/resolv.conf", &resconf);
 	if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
-		delve_log(ISC_LOG_ERROR, "irs_resconf_load: %s",
+		delv_log(ISC_LOG_ERROR, "irs_resconf_load: %s",
 			  isc_result_totext(result));
 		goto cleanup;
 	}
@@ -925,7 +928,7 @@ findserver(dns_client_t *client) {
 	result = dns_client_setservers(client, dns_rdataclass_in, NULL,
 				       nameservers);
 	if (result != ISC_R_SUCCESS)
-		delve_log(ISC_LOG_ERROR, "dns_client_setservers: %s",
+		delv_log(ISC_LOG_ERROR, "dns_client_setservers: %s",
 			  isc_result_totext(result));
 
 cleanup:
@@ -1026,8 +1029,11 @@ plus_option(char *option) {
 			if (state && no_sigs)
 				break;
 			dlv_validation = state;
-			if (value != NULL)
+			if (value != NULL) {
 				dlv_anchor = isc_mem_strdup(mctx, value);
+				if (dlv_anchor == NULL)
+					fatal("out of memory");
+			}
 			break;
 		case 'n': /* dnssec */
 			FULLCHECK("dnssec");
@@ -1059,8 +1065,11 @@ plus_option(char *option) {
 			if (state && no_sigs)
 				break;
 			root_validation = state;
-			if (value != NULL)
+			if (value != NULL) {
 				trust_anchor = isc_mem_strdup(mctx, value);
+				if (trust_anchor == NULL)
+					fatal("out of memory");
+			}
 			break;
 		case 'r': /* rrcomments */
 			FULLCHECK("rrcomments");
@@ -1207,7 +1216,7 @@ dash_option(char *option, char *next, isc_boolean_t *open_type_class) {
 			/* handled in preparse_args() */
 			break;
 		case 'v':
-			fputs("delve " VERSION "\n", stderr);
+			fputs("delv " VERSION "\n", stderr);
 			exit(0);
 			/* NOTREACHED */
 		default:
@@ -1231,6 +1240,8 @@ dash_option(char *option, char *next, isc_boolean_t *open_type_class) {
 	switch (opt) {
 	case 'a':
 		anchorfile = isc_mem_strdup(mctx, value);
+		if (anchorfile == NULL)
+			fatal("out of memory");
 		return (value_from_next);
 	case 'b':
 		hash = strchr(value, '#');
@@ -1289,11 +1300,13 @@ dash_option(char *option, char *next, isc_boolean_t *open_type_class) {
 		port = value;
 		return (value_from_next);
 	case 'q':
-		if (qname != NULL) {
+		if (curqname != NULL) {
 			warn("extra query name");
-			isc_mem_free(mctx, qname);
+			isc_mem_free(mctx, curqname);
 		}
-		curqname = value;
+		curqname = isc_mem_strdup(mctx, value);
+		if (curqname == NULL)
+			fatal("out of memory");
 		return (value_from_next);
 	case 't':
 		*open_type_class = ISC_FALSE;
@@ -1316,9 +1329,13 @@ dash_option(char *option, char *next, isc_boolean_t *open_type_class) {
 		result = get_reverse(textname, sizeof(textname), value,
 				     ISC_FALSE);
 		if (result == ISC_R_SUCCESS) {
-			if (curqname != NULL)
+			if (curqname != NULL) {
+				isc_mem_free(mctx, curqname);
 				warn("extra query name");
+			}
 			curqname = isc_mem_strdup(mctx, textname);
+			if (curqname == NULL)
+				fatal("out of memory");
 			if (typeset)
 				warn("extra query type");
 			qtype = dns_rdatatype_ptr;
@@ -1363,7 +1380,7 @@ preparse_args(int argc, char **argv) {
 /*
  * Argument parsing is based on dig, but simplified: only one
  * QNAME/QCLASS/QTYPE tuple can be specified, and options have
- * been removed that aren't applicable to delve. The interface
+ * been removed that aren't applicable to delv. The interface
  * should be familiar to dig users, however.
  */
 static void
@@ -1426,8 +1443,11 @@ parse_args(int argc, char **argv) {
 				}
 			}
 
-			if (curqname == NULL)
-				curqname = argv[0];
+			if (curqname == NULL) {
+				curqname = isc_mem_strdup(mctx, argv[0]);
+				if (curqname == NULL)
+					fatal("out of memory");
+			}
 		}
 	}
 
@@ -1440,10 +1460,13 @@ parse_args(int argc, char **argv) {
 
 	if (curqname == NULL) {
 		qname = isc_mem_strdup(mctx, ".");
+		if (qname == NULL)
+			fatal("out of memory");
+
 		if (!typeset)
 			qtype = dns_rdatatype_ns;
 	} else
-		qname = isc_mem_strdup(mctx, curqname);
+		qname = curqname;
 }
 
 static isc_result_t
@@ -1576,7 +1599,7 @@ main(int argc, char *argv[]) {
 	result = dns_client_createx2(mctx, actx, taskmgr, socketmgr, timermgr,
 				     clopt, &client, srcaddr4, srcaddr6);
 	if (result != ISC_R_SUCCESS) {
-		delve_log(ISC_LOG_ERROR, "dns_client_create: %s",
+		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
 			  isc_result_totext(result));
 		goto cleanup;
 	}
@@ -1606,7 +1629,7 @@ main(int argc, char *argv[]) {
 	result = dns_client_resolve(client, query_name, dns_rdataclass_in,
 				    qtype, resopt, &namelist);
 	if (result != ISC_R_SUCCESS)
-		delve_log(ISC_LOG_ERROR, "resolution failed: %s",
+		delv_log(ISC_LOG_ERROR, "resolution failed: %s",
 			  isc_result_totext(result));
 
 	for (response_name = ISC_LIST_HEAD(namelist);
@@ -1617,7 +1640,7 @@ main(int argc, char *argv[]) {
 		     rdataset = ISC_LIST_NEXT(rdataset, link)) {
 			result = printdata(rdataset, response_name, style);
 			if (result != ISC_R_SUCCESS)
-				delve_log(ISC_LOG_ERROR, "print data failed");
+				delv_log(ISC_LOG_ERROR, "print data failed");
 		}
 	}
 

bin/delv/delv.docbook

@@ -17,20 +17,20 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<refentry id="man.delve">
+<refentry id="man.delv">
 
   <refentryinfo>
-    <date>February 21, 2014</date>
+    <date>April 23, 2014</date>
   </refentryinfo>
 
   <refmeta>
-    <refentrytitle>delve</refentrytitle>
+    <refentrytitle>delv</refentrytitle>
     <manvolnum>1</manvolnum>
     <refmiscinfo>BIND9</refmiscinfo>
   </refmeta>
 
   <refnamediv>
-    <refname>delve</refname>
+    <refname>delv</refname>
     <refpurpose>DNS lookup and validation utility</refpurpose>
   </refnamediv>
 
@@ -43,7 +43,7 @@
 
   <refsynopsisdiv>
     <cmdsynopsis>
-      <command>delve</command>
+      <command>delv</command>
       <arg choice="opt">@server</arg>
       <arg><option>-4</option></arg>
       <arg><option>-6</option></arg>
@@ -64,17 +64,17 @@
     </cmdsynopsis>
 
     <cmdsynopsis>
-      <command>delve</command>
+      <command>delv</command>
       <arg><option>-h</option></arg>
     </cmdsynopsis>
 
     <cmdsynopsis>
-      <command>delve</command>
+      <command>delv</command>
       <arg><option>-v</option></arg>
     </cmdsynopsis>
 
     <cmdsynopsis>
-      <command>delve</command>
+      <command>delv</command>
       <arg choice="opt" rep="repeat">queryopt</arg>
       <arg choice="opt" rep="repeat">query</arg>
     </cmdsynopsis>
@@ -82,13 +82,13 @@
 
   <refsect1>
     <title>DESCRIPTION</title>
-    <para><command>delve</command>
-      (Domain Entity Lookup &amp; Validation Engine) is a tool for sending
+    <para><command>delv</command>
+      (Domain Entity Lookup &amp; Validation) is a tool for sending
       DNS queries and validating the results, using the the same internal
       resolver and validator logic as <command>named</command>.
     </para>
     <para>
-      <command>delve</command> will send to a specified name server all
+      <command>delv</command> will send to a specified name server all
       queries needed to fetch and validate the requested data; this
       includes the original requested query, subsequent queries to follow
       CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records
@@ -101,25 +101,25 @@
       By default, responses are validated using built-in DNSSEC trust
       anchors for the root zone (".") and for the ISC DNSSEC lookaside
       validation zone ("dlv.isc.org").  Records returned by
-      <command>delve</command> are either fully validated or
+      <command>delv</command> are either fully validated or
       were not signed.  If validation fails, an explanation of
       the failure is included in the output; the validation process
-      can be traced in detail.  Because <command>delve</command> does
+      can be traced in detail.  Because <command>delv</command> does
       not rely on an external server to carry out validation, it can
       be used to check the validity of DNS responses in environments
       where local name servers may not be trustworthy.
     </para>
     <para>
       Unless it is told to query a specific name server,
-      <command>delve</command> will try each of the servers listed in
+      <command>delv</command> will try each of the servers listed in
       <filename>/etc/resolv.conf</filename>. If no usable server
-      addresses are found, <command>delve</command> will send
+      addresses are found, <command>delv</command> will send
       queries to the localhost addresses (127.0.0.1 for IPv4, ::1
       for IPv6).
     </para>
     <para>
       When no command line arguments or options are given,
-      <command>delve</command> will perform an NS query for "."
+      <command>delv</command> will perform an NS query for "."
       (the root zone).
     </para>
   </refsect1>
@@ -128,8 +128,8 @@
     <title>SIMPLE USAGE</title>
 
     <para>
-      A typical invocation of <command>delve</command> looks like:
-      <programlisting> delve @server name type </programlisting>
+      A typical invocation of <command>delv</command> looks like:
+      <programlisting> delv @server name type </programlisting>
       where:
 
       <variablelist>
@@ -141,21 +141,21 @@
 	      can be an IPv4 address in dotted-decimal notation or an IPv6
 	      address in colon-delimited notation.  When the supplied
 	      <parameter>server</parameter> argument is a hostname,
-	      <command>delve</command> resolves that name before
+	      <command>delv</command> resolves that name before
 	      querying that name server (note, however, that this
 	      initial lookup is <emphasis>not</emphasis> validated
 	      by DNSSEC).
 	    </para>
 	    <para>
 	      If no <parameter>server</parameter> argument is
-	      provided, <command>delve</command> consults
+	      provided, <command>delv</command> consults
 	      <filename>/etc/resolv.conf</filename>; if an
 	      address is found there, it queries the name server at
 	      that address. If either of the <option>-4</option> or
 	      <option>-6</option> options are in use, then
 	      only addresses for the corresponding transport
 	      will be tried.  If no usable addresses are found,
-	      <command>delve</command> will send queries to
+	      <command>delv</command> will send queries to
 	      the localhost addresses (127.0.0.1 for IPv4,
 	      ::1 for IPv6).
 	    </para>
@@ -180,7 +180,7 @@
 	      <parameter>type</parameter> can be any valid query
 	      type.  If no
 	      <parameter>type</parameter> argument is supplied,
-	      <command>delve</command> will perform a lookup for an
+	      <command>delv</command> will perform a lookup for an
 	      A record.
 	    </para>
 	  </listitem>
@@ -213,17 +213,17 @@
 	  </para>
 	  <para>
 	    Note: When reading the trust anchor file,
-	    <command>delve</command> treats <option>managed-keys</option>
+	    <command>delv</command> treats <option>managed-keys</option>
 	    statements and <option>trusted-keys</option> statements
 	    identically.  That is, for a managed key, it is the
 	    <emphasis>initial</emphasis> key that is trusted; RFC 5011
-	    key management is not supported. <command>delve</command>
+	    key management is not supported. <command>delv</command>
 	    will not consult the managed-keys database maintained by
 	    <command>named</command>. This means that if either of the
 	    keys in <filename>/etc/bind.keys</filename> is revoked
 	    and rolled over, it will be necessary to update
 	    <filename>/etc/bind.keys</filename> to use DNSSEC
-	    validation in <command>delve</command>.
+	    validation in <command>delv</command>.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -246,7 +246,7 @@
 	<listitem>
 	  <para>
 	    Sets the query class for the requested data. Currently,
-	    only class "IN" is supported in <command>delve</command>
+	    only class "IN" is supported in <command>delv</command>
 	    and any other value is ignored.
 	  </para>
 	</listitem>
@@ -259,7 +259,7 @@
 	    Set the systemwide debug level to <option>level</option>.
 	    The allowed range is from 0 to 99.
 	    The default is 0 (no debugging).
-	    Debugging traces from <command>delve</command> become
+	    Debugging traces from <command>delv</command> become
 	    more verbose as the debug level increases.
 	    See the <option>+mtrace</option>, <option>+rtrace</option>,
 	    and <option>+vtrace</option> options below for additional
@@ -272,7 +272,7 @@
 	<term>-h</term>
 	<listitem>
 	  <para>
-	    Display the <command>delve</command> help usage output and exit.
+	    Display the <command>delv</command> help usage output and exit.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -285,7 +285,7 @@
 	    (Note, however, this does not set the CD bit on upstream
 	    queries. If the server being queried is performing DNSSEC
 	    validation, then it will not return invalid data; this
-	    can cause <command>delve</command> to time out. When it
+	    can cause <command>delv</command> to time out. When it
 	    is necessary to examine invalid data to debug a DNSSEC
 	    problem, use <command>dig +cd</command>.)
 	  </para>
@@ -350,7 +350,7 @@
 	<term>-v</term>
 	<listitem>
 	  <para>
-	    Print the <command>delve</command> version and exit.
+	    Print the <command>delv</command> version and exit.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -364,7 +364,7 @@
 	    dotted-decimal notation, or a colon-delimited IPv6 address.
 	    When <option>-x</option> is used, there is no need to provide
 	    the <parameter>name</parameter> or <parameter>type</parameter>
-	    arguments.  <command>delve</command> automatically performs a
+	    arguments.  <command>delv</command> automatically performs a
 	    lookup for a name like <literal>11.12.13.10.in-addr.arpa</literal>
 	    and sets the query type to PTR.  IPv6 addresses are looked up
 	    using nibble format under the IP6.ARPA domain.
@@ -376,7 +376,7 @@
 	<term>-4</term>
 	<listitem>
 	  <para>
-	    Forces <command>delve</command> to only use IPv4.
+	    Forces <command>delv</command> to only use IPv4.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -385,7 +385,7 @@
 	<term>-6</term>
 	<listitem>
 	  <para>
-	    Forces <command>delve</command> to only use IPv6.
+	    Forces <command>delv</command> to only use IPv6.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -396,7 +396,7 @@
   <refsect1>
     <title>QUERY OPTIONS</title>
 
-    <para><command>delve</command>
+    <para><command>delv</command>
       provides a number of query options which affect the way results are
       displayed, and in some cases the way lookups are performed.
     </para>
@@ -416,12 +416,12 @@
 	  <listitem>
 	    <para>
 	      Controls whether to set the CD (checking disabled) bit in
-	      queries sent by <command>delve</command>. This may be useful
+	      queries sent by <command>delv</command>. This may be useful
 	      when troubleshooting DNSSEC problems from behind a validating
 	      resolver. A validating resolver will block invalid responses,
 	      making it difficult to retrieve them for analysis. Setting
 	      the CD flag on queries will cause the resolver to return
-	      invalid responses, which <command>delve</command> can then
+	      invalid responses, which <command>delv</command> can then
 	      validate internally and report the errors in detail.
 	    </para>
 	  </listitem>
@@ -452,7 +452,7 @@
 	  <listitem>
 	    <para>
 	      Toggle resolver fetch logging. This reports the
-	      name and type of each query sent by <command>delve</command>
+	      name and type of each query sent by <command>delv</command>
 	      in the process of carrying out the resolution and validation
 	      process: this includes including the original query and
 	      all subsequent queries to follow CNAMEs and to establish a
@@ -473,7 +473,7 @@
 	  <listitem>
 	    <para>
 	      Toggle message logging. This produces a detailed dump of
-	      the responses received by <command>delve</command> in the
+	      the responses received by <command>delv</command> in the
 	      process of carrying out the resolution and validation process.
 	    </para>
 	    <para>
@@ -595,7 +595,7 @@
 	      Print long records (such as RRSIG, DNSKEY, and SOA records)
 	      in a verbose multi-line format with human-readable comments.
 	      The default is to print each record on a single line, to
-	      facilitate machine parsing of the <command>delve</command>
+	      facilitate machine parsing of the <command>delv</command>
 	      output.
 	    </para>
 	  </listitem>
@@ -606,7 +606,7 @@
 	  <listitem>
 	    <para>
 	      Indicates whether to display RRSIG records in the
-	      <command>delve</command> output.  The default is to
+	      <command>delv</command> output.  The default is to
 	      do so.  Note that (unlike in <command>dig</command>)
 	      this does <emphasis>not</emphasis> control whether to
 	      request DNSSEC records or whether to validate them.

bin/delv/delv.html

@@ -18,31 +18,31 @@
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
-<title>delve</title>
+<title>delv</title>
 <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="man.delve"></a><div class="titlepage"></div>
+<a name="man.delv"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
-<p>delve &#8212; DNS lookup and validation utility</p>
+<p>delv &#8212; DNS lookup and validation utility</p>
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">delve</code>  [@server] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>level</code></em></code>] [<code class="option">-i</code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [name] [type] [class] [queryopt...]</p></div>
-<div class="cmdsynopsis"><p><code class="command">delve</code>  [<code class="option">-h</code>]</p></div>
-<div class="cmdsynopsis"><p><code class="command">delve</code>  [<code class="option">-v</code>]</p></div>
-<div class="cmdsynopsis"><p><code class="command">delve</code>  [queryopt...] [query...]</p></div>
+<div class="cmdsynopsis"><p><code class="command">delv</code>  [@server] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-a <em class="replaceable"><code>anchor-file</code></em></code>] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>level</code></em></code>] [<code class="option">-i</code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [name] [type] [class] [queryopt...]</p></div>
+<div class="cmdsynopsis"><p><code class="command">delv</code>  [<code class="option">-h</code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">delv</code>  [<code class="option">-v</code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">delv</code>  [queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543489"></a><h2>DESCRIPTION</h2>
-<p><span><strong class="command">delve</strong></span>
-      (Domain Entity Lookup &amp; Validation Engine) is a tool for sending
+<a name="id2543497"></a><h2>DESCRIPTION</h2>
+<p><span><strong class="command">delv</strong></span>
+      (Domain Entity Lookup &amp; Validation) is a tool for sending
       DNS queries and validating the results, using the the same internal
       resolver and validator logic as <span><strong class="command">named</strong></span>.
     </p>
 <p>
-      <span><strong class="command">delve</strong></span> will send to a specified name server all
+      <span><strong class="command">delv</strong></span> will send to a specified name server all
       queries needed to fetch and validate the requested data; this
       includes the original requested query, subsequent queries to follow
       CNAME or DNAME chains, and queries for DNSKEY, DS and DLV records
@@ -55,34 +55,34 @@
       By default, responses are validated using built-in DNSSEC trust
       anchors for the root zone (".") and for the ISC DNSSEC lookaside
       validation zone ("dlv.isc.org").  Records returned by
-      <span><strong class="command">delve</strong></span> are either fully validated or
+      <span><strong class="command">delv</strong></span> are either fully validated or
       were not signed.  If validation fails, an explanation of
       the failure is included in the output; the validation process
-      can be traced in detail.  Because <span><strong class="command">delve</strong></span> does
+      can be traced in detail.  Because <span><strong class="command">delv</strong></span> does
       not rely on an external server to carry out validation, it can
       be used to check the validity of DNS responses in environments
       where local name servers may not be trustworthy.
     </p>
 <p>
       Unless it is told to query a specific name server,
-      <span><strong class="command">delve</strong></span> will try each of the servers listed in
+      <span><strong class="command">delv</strong></span> will try each of the servers listed in
       <code class="filename">/etc/resolv.conf</code>. If no usable server
-      addresses are found, <span><strong class="command">delve</strong></span> will send
+      addresses are found, <span><strong class="command">delv</strong></span> will send
       queries to the localhost addresses (127.0.0.1 for IPv4, ::1
       for IPv6).
     </p>
 <p>
       When no command line arguments or options are given,
-      <span><strong class="command">delve</strong></span> will perform an NS query for "."
+      <span><strong class="command">delv</strong></span> will perform an NS query for "."
       (the root zone).
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543542"></a><h2>SIMPLE USAGE</h2>
+<a name="id2543550"></a><h2>SIMPLE USAGE</h2>
 <p>
-      A typical invocation of <span><strong class="command">delve</strong></span> looks like:
+      A typical invocation of <span><strong class="command">delv</strong></span> looks like:
       </p>
-<pre class="programlisting"> delve @server name type </pre>
+<pre class="programlisting"> delv @server name type </pre>
 <p>
       where:
 
@@ -95,21 +95,21 @@
 	      can be an IPv4 address in dotted-decimal notation or an IPv6
 	      address in colon-delimited notation.  When the supplied
 	      <em class="parameter"><code>server</code></em> argument is a hostname,
-	      <span><strong class="command">delve</strong></span> resolves that name before
+	      <span><strong class="command">delv</strong></span> resolves that name before
 	      querying that name server (note, however, that this
 	      initial lookup is <span class="emphasis"><em>not</em></span> validated
 	      by DNSSEC).
 	    </p>
 <p>
 	      If no <em class="parameter"><code>server</code></em> argument is
-	      provided, <span><strong class="command">delve</strong></span> consults
+	      provided, <span><strong class="command">delv</strong></span> consults
 	      <code class="filename">/etc/resolv.conf</code>; if an
 	      address is found there, it queries the name server at
 	      that address. If either of the <code class="option">-4</code> or
 	      <code class="option">-6</code> options are in use, then
 	      only addresses for the corresponding transport
 	      will be tried.  If no usable addresses are found,
-	      <span><strong class="command">delve</strong></span> will send queries to
+	      <span><strong class="command">delv</strong></span> will send queries to
 	      the localhost addresses (127.0.0.1 for IPv4,
 	      ::1 for IPv6).
 	    </p>
@@ -125,7 +125,7 @@
 	      <em class="parameter"><code>type</code></em> can be any valid query
 	      type.  If no
 	      <em class="parameter"><code>type</code></em> argument is supplied,
-	      <span><strong class="command">delve</strong></span> will perform a lookup for an
+	      <span><strong class="command">delv</strong></span> will perform a lookup for an
 	      A record.
 	    </p></dd>
 </dl></div>
@@ -133,7 +133,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543651"></a><h2>OPTIONS</h2>
+<a name="id2543659"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>anchor-file</code></em></span></dt>
 <dd>
@@ -152,17 +152,17 @@
 	  </p>
 <p>
 	    Note: When reading the trust anchor file,
-	    <span><strong class="command">delve</strong></span> treats <code class="option">managed-keys</code>
+	    <span><strong class="command">delv</strong></span> treats <code class="option">managed-keys</code>
 	    statements and <code class="option">trusted-keys</code> statements
 	    identically.  That is, for a managed key, it is the
 	    <span class="emphasis"><em>initial</em></span> key that is trusted; RFC 5011
-	    key management is not supported. <span><strong class="command">delve</strong></span>
+	    key management is not supported. <span><strong class="command">delv</strong></span>
 	    will not consult the managed-keys database maintained by
 	    <span><strong class="command">named</strong></span>. This means that if either of the
 	    keys in <code class="filename">/etc/bind.keys</code> is revoked
 	    and rolled over, it will be necessary to update
 	    <code class="filename">/etc/bind.keys</code> to use DNSSEC
-	    validation in <span><strong class="command">delve</strong></span>.
+	    validation in <span><strong class="command">delv</strong></span>.
 	  </p>
 </dd>
 <dt><span class="term">-b  <em class="replaceable"><code>address</code></em></span></dt>
@@ -176,7 +176,7 @@
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd><p>
 	    Sets the query class for the requested data. Currently,
-	    only class "IN" is supported in <span><strong class="command">delve</strong></span>
+	    only class "IN" is supported in <span><strong class="command">delv</strong></span>
 	    and any other value is ignored.
 	  </p></dd>
 <dt><span class="term">-d <em class="replaceable"><code>level</code></em></span></dt>
@@ -184,7 +184,7 @@
 	    Set the systemwide debug level to <code class="option">level</code>.
 	    The allowed range is from 0 to 99.
 	    The default is 0 (no debugging).
-	    Debugging traces from <span><strong class="command">delve</strong></span> become
+	    Debugging traces from <span><strong class="command">delv</strong></span> become
 	    more verbose as the debug level increases.
 	    See the <code class="option">+mtrace</code>, <code class="option">+rtrace</code>,
 	    and <code class="option">+vtrace</code> options below for additional
@@ -192,7 +192,7 @@
 	  </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
-	    Display the <span><strong class="command">delve</strong></span> help usage output and exit.
+	    Display the <span><strong class="command">delv</strong></span> help usage output and exit.
 	  </p></dd>
 <dt><span class="term">-i</span></dt>
 <dd><p>
@@ -200,7 +200,7 @@
 	    (Note, however, this does not set the CD bit on upstream
 	    queries. If the server being queried is performing DNSSEC
 	    validation, then it will not return invalid data; this
-	    can cause <span><strong class="command">delve</strong></span> to time out. When it
+	    can cause <span><strong class="command">delv</strong></span> to time out. When it
 	    is necessary to examine invalid data to debug a DNSSEC
 	    problem, use <span><strong class="command">dig +cd</strong></span>.)
 	  </p></dd>
@@ -242,7 +242,7 @@
 </dd>
 <dt><span class="term">-v</span></dt>
 <dd><p>
-	    Print the <span><strong class="command">delve</strong></span> version and exit.
+	    Print the <span><strong class="command">delv</strong></span> version and exit.
 	  </p></dd>
 <dt><span class="term">-x <em class="replaceable"><code>addr</code></em></span></dt>
 <dd><p>
@@ -251,24 +251,24 @@
 	    dotted-decimal notation, or a colon-delimited IPv6 address.
 	    When <code class="option">-x</code> is used, there is no need to provide
 	    the <em class="parameter"><code>name</code></em> or <em class="parameter"><code>type</code></em>
-	    arguments.  <span><strong class="command">delve</strong></span> automatically performs a
+	    arguments.  <span><strong class="command">delv</strong></span> automatically performs a
 	    lookup for a name like <code class="literal">11.12.13.10.in-addr.arpa</code>
 	    and sets the query type to PTR.  IPv6 addresses are looked up
 	    using nibble format under the IP6.ARPA domain.
 	  </p></dd>
 <dt><span class="term">-4</span></dt>
 <dd><p>
-	    Forces <span><strong class="command">delve</strong></span> to only use IPv4.
+	    Forces <span><strong class="command">delv</strong></span> to only use IPv4.
 	  </p></dd>
 <dt><span class="term">-6</span></dt>
 <dd><p>
-	    Forces <span><strong class="command">delve</strong></span> to only use IPv6.
+	    Forces <span><strong class="command">delv</strong></span> to only use IPv6.
 	  </p></dd>
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544151"></a><h2>QUERY OPTIONS</h2>
-<p><span><strong class="command">delve</strong></span>
+<a name="id2544160"></a><h2>QUERY OPTIONS</h2>
+<p><span><strong class="command">delv</strong></span>
       provides a number of query options which affect the way results are
       displayed, and in some cases the way lookups are performed.
     </p>
@@ -286,12 +286,12 @@
 <dt><span class="term"><code class="option">+[no]cdflag</code></span></dt>
 <dd><p>
 	      Controls whether to set the CD (checking disabled) bit in
-	      queries sent by <span><strong class="command">delve</strong></span>. This may be useful
+	      queries sent by <span><strong class="command">delv</strong></span>. This may be useful
 	      when troubleshooting DNSSEC problems from behind a validating
 	      resolver. A validating resolver will block invalid responses,
 	      making it difficult to retrieve them for analysis. Setting
 	      the CD flag on queries will cause the resolver to return
-	      invalid responses, which <span><strong class="command">delve</strong></span> can then
+	      invalid responses, which <span><strong class="command">delv</strong></span> can then
 	      validate internally and report the errors in detail.
 	    </p></dd>
 <dt><span class="term"><code class="option">+[no]class</code></span></dt>
@@ -308,7 +308,7 @@
 <dd>
 <p>
 	      Toggle resolver fetch logging. This reports the
-	      name and type of each query sent by <span><strong class="command">delve</strong></span>
+	      name and type of each query sent by <span><strong class="command">delv</strong></span>
 	      in the process of carrying out the resolution and validation
 	      process: this includes including the original query and
 	      all subsequent queries to follow CNAMEs and to establish a
@@ -326,7 +326,7 @@
 <dd>
 <p>
 	      Toggle message logging. This produces a detailed dump of
-	      the responses received by <span><strong class="command">delve</strong></span> in the
+	      the responses received by <span><strong class="command">delv</strong></span> in the
 	      process of carrying out the resolution and validation process.
 	    </p>
 <p>
@@ -406,13 +406,13 @@
 	      Print long records (such as RRSIG, DNSKEY, and SOA records)
 	      in a verbose multi-line format with human-readable comments.
 	      The default is to print each record on a single line, to
-	      facilitate machine parsing of the <span><strong class="command">delve</strong></span>
+	      facilitate machine parsing of the <span><strong class="command">delv</strong></span>
 	      output.
 	    </p></dd>
 <dt><span class="term"><code class="option">+[no]dnssec</code></span></dt>
 <dd><p>
 	      Indicates whether to display RRSIG records in the
-	      <span><strong class="command">delve</strong></span> output.  The default is to
+	      <span><strong class="command">delv</strong></span> output.  The default is to
 	      do so.  Note that (unlike in <span><strong class="command">dig</strong></span>)
 	      this does <span class="emphasis"><em>not</em></span> control whether to
 	      request DNSSEC records or whether to validate them.
@@ -447,12 +447,12 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544637"></a><h2>FILES</h2>
+<a name="id2544646"></a><h2>FILES</h2>
 <p><code class="filename">/etc/bind.keys</code></p>
 <p><code class="filename">/etc/resolv.conf</code></p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544652"></a><h2>SEE ALSO</h2>
+<a name="id2544661"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <em class="citetitle">RFC4034</em>,

bin/delv/win32/delv.dsp.in

@@ -1,24 +1,24 @@
-# Microsoft Developer Studio Project File - Name="delve" - Package Owner=<4>
+# Microsoft Developer Studio Project File - Name="delv" - Package Owner=<4>
 # Microsoft Developer Studio Generated Build File, Format Version 6.00
 # ** DO NOT EDIT **
 
 # TARGTYPE "@PLATFORM@ (x86) Console Application" 0x0103
 
-CFG=delve - @PLATFORM@ Debug
+CFG=delv - @PLATFORM@ Debug
 !MESSAGE This is not a valid makefile. To build this project using NMAKE,
 !MESSAGE use the Export Makefile command and run
 !MESSAGE 
-!MESSAGE NMAKE /f "delve.mak".
+!MESSAGE NMAKE /f "delv.mak".
 !MESSAGE 
 !MESSAGE You can specify a configuration when running NMAKE
 !MESSAGE by defining the macro CFG on the command line. For example:
 !MESSAGE 
-!MESSAGE NMAKE /f "delve.mak" CFG="delve - @PLATFORM@ Debug"
+!MESSAGE NMAKE /f "delv.mak" CFG="delv - @PLATFORM@ Debug"
 !MESSAGE 
 !MESSAGE Possible choices for configuration are:
 !MESSAGE 
-!MESSAGE "delve - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
-!MESSAGE "delve - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "delv - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "delv - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
 !MESSAGE 
 
 # Begin Project
@@ -28,7 +28,7 @@ CFG=delve - @PLATFORM@ Debug
 CPP=cl.exe
 RSC=rc.exe
 
-!IF  "$(CFG)" == "delve - @PLATFORM@ Release"
+!IF  "$(CFG)" == "delv - @PLATFORM@ Release"
 
 # PROP BASE Use_MFC 0
 # PROP BASE Use_Debug_Libraries 0
@@ -50,9 +50,9 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console @MACHINE@
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/irs/win32/Release/libirs.lib /nologo /subsystem:console @MACHINE@ /out:"../../../Build/Release/delve.exe"
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/irs/win32/Release/libirs.lib /nologo /subsystem:console @MACHINE@ /out:"../../../Build/Release/delv.exe"
 
-!ELSEIF  "$(CFG)" == "delve - @PLATFORM@ Debug"
+!ELSEIF  "$(CFG)" == "delv - @PLATFORM@ Debug"
 
 # PROP BASE Use_MFC 0
 # PROP BASE Use_Debug_Libraries 1
@@ -75,20 +75,20 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug @MACHINE@ /pdbtype:sept
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/irs/win32/Debug/libirs.lib /nologo /subsystem:console /debug @MACHINE@ /out:"../../../Build/Debug/delve.exe" /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/irs/win32/Debug/libirs.lib /nologo /subsystem:console /debug @MACHINE@ /out:"../../../Build/Debug/delv.exe" /pdbtype:sept
 
 !ENDIF 
 
 # Begin Target
 
-# Name "delve - @PLATFORM@ Release"
-# Name "delve - @PLATFORM@ Debug"
+# Name "delv - @PLATFORM@ Release"
+# Name "delv - @PLATFORM@ Debug"
 # Begin Group "Source Files"
 
 # PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
 # Begin Source File
 
-SOURCE="..\delve.c"
+SOURCE="..\delv.c"
 # End Source File
 # End Group
 # Begin Group "Header Files"

bin/delv/win32/delv.dsw

@@ -3,7 +3,7 @@ Microsoft Developer Studio Workspace File, Format Version 6.00
 
 ###############################################################################
 
-Project: "delve"=".\delve.dsp" - Package Owner=<4>
+Project: "delv"=".\delv.dsp" - Package Owner=<4>
 
 Package=<5>
 {{{

bin/delv/win32/delv.mak.in

@@ -1,20 +1,20 @@
-# Microsoft Developer Studio Generated NMAKE File, Based on delve.dsp
+# Microsoft Developer Studio Generated NMAKE File, Based on delv.dsp
 !IF "$(CFG)" == ""
-CFG=delve - @PLATFORM@ Debug
-!MESSAGE No configuration specified. Defaulting to delve - @PLATFORM@ Debug.
+CFG=delv - @PLATFORM@ Debug
+!MESSAGE No configuration specified. Defaulting to delv - @PLATFORM@ Debug.
 !ENDIF 
 
-!IF "$(CFG)" != "delve - @PLATFORM@ Release" && "$(CFG)" != "delve - @PLATFORM@ Debug"
+!IF "$(CFG)" != "delv - @PLATFORM@ Release" && "$(CFG)" != "delv - @PLATFORM@ Debug"
 !MESSAGE Invalid configuration "$(CFG)" specified.
 !MESSAGE You can specify a configuration when running NMAKE
 !MESSAGE by defining the macro CFG on the command line. For example:
 !MESSAGE 
-!MESSAGE NMAKE /f "delve.mak" CFG="delve - @PLATFORM@ Debug"
+!MESSAGE NMAKE /f "delv.mak" CFG="delv - @PLATFORM@ Debug"
 !MESSAGE 
 !MESSAGE Possible choices for configuration are:
 !MESSAGE 
-!MESSAGE "delve - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
-!MESSAGE "delve - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "delv - @PLATFORM@ Release" (based on "@PLATFORM@ (x86) Console Application")
+!MESSAGE "delv - @PLATFORM@ Debug" (based on "@PLATFORM@ (x86) Console Application")
 !MESSAGE 
 !ERROR An invalid configuration is specified.
 !ENDIF 
@@ -25,7 +25,7 @@ NULL=
 NULL=nul
 !ENDIF 
 
-!IF  "$(CFG)" == "delve - @PLATFORM@ Release"
+!IF  "$(CFG)" == "delv - @PLATFORM@ Release"
 _VC_MANIFEST_INC=0
 _VC_MANIFEST_BASENAME=__VC80
 !ELSE
@@ -100,25 +100,25 @@ _VC_MANIFEST_CLEAN=
 
 !endif
 
-!IF  "$(CFG)" == "delve - @PLATFORM@ Release"
+!IF  "$(CFG)" == "delv - @PLATFORM@ Release"
 
 OUTDIR=.\Release
 INTDIR=.\Release
 
-ALL : "..\..\..\Build\Release\delve.exe"
+ALL : "..\..\..\Build\Release\delv.exe"
 
 
 CLEAN :
-	-@erase "$(INTDIR)\delve.obj"
+	-@erase "$(INTDIR)\delv.obj"
 	-@erase "$(INTDIR)\vc60.idb"
-	-@erase "..\..\..\Build\Release\delve.exe"
+	-@erase "..\..\..\Build\Release\delv.exe"
 	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
 
 CPP=cl.exe
-CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/irs/win32/include" /I "../../../lib/irs/include" /D "NDEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /Fp"$(INTDIR)\delve.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "../../../" @LIBXML2_INC@ @OPENSSL_INC@ /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/win32/include" /I "../../../lib/dns/include" /I "../../../lib/irs/win32/include" /I "../../../lib/irs/include" /D "NDEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /Fp"$(INTDIR)\delv.pch" @COPTY@ /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
 
 .c{$(INTDIR)}.obj::
    $(CPP) @<<
@@ -152,21 +152,21 @@ CPP_PROJ=/nologo /MD /W3 @COPTX@ @COPTI@ /O2 /I "../../../" @LIBXML2_INC@ @OPENS
 
 RSC=rc.exe
 BSC32=bscmake.exe
-BSC32_FLAGS=/nologo /o"$(OUTDIR)\delve.bsc" 
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\delv.bsc" 
 BSC32_SBRS= \
 	
 LINK32=link.exe
-LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/irs/win32/Release/libirs.lib /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\delve.pdb" @MACHINE@ /out:"../../../Build/Release/delve.exe" 
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/irs/win32/Release/libirs.lib /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\delv.pdb" @MACHINE@ /out:"../../../Build/Release/delv.exe" 
 LINK32_OBJS= \
-	"$(INTDIR)\delve.obj"
+	"$(INTDIR)\delv.obj"
 
-"..\..\..\Build\Release\delve.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+"..\..\..\Build\Release\delv.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
     $(_VC_MANIFEST_EMBED_EXE)
 
-!ELSEIF  "$(CFG)" == "delve - @PLATFORM@ Debug"
+!ELSEIF  "$(CFG)" == "delv - @PLATFORM@ Debug"
 
 OUTDIR=.\Debug
 INTDIR=.\Debug
@@ -174,18 +174,18 @@ INTDIR=.\Debug
 OutDir=.\Debug
 # End Custom Macros
 
-ALL : "..\..\..\Build\Debug\delve.exe" "$(OUTDIR)\delve.bsc"
+ALL : "..\..\..\Build\Debug\delv.exe" "$(OUTDIR)\delv.bsc"
 
 
 CLEAN :
-	-@erase "$(INTDIR)\delve.obj"
-	-@erase "$(INTDIR)\delve.sbr"
+	-@erase "$(INTDIR)\delv.obj"
+	-@erase "$(INTDIR)\delv.sbr"
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "$(INTDIR)\vc60.pdb"
-	-@erase "$(OUTDIR)\delve.pdb"
-	-@erase "$(OUTDIR)\delve.bsc"
-	-@erase "..\..\..\Build\Debug\delve.exe"
-	-@erase "..\..\..\Build\Debug\delve.ilk"
+	-@erase "$(OUTDIR)\delv.pdb"
+	-@erase "$(OUTDIR)\delv.bsc"
+	-@erase "..\..\..\Build\Debug\delv.exe"
+	-@erase "..\..\..\Build\Debug\delv.ilk"
 	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
@@ -226,21 +226,21 @@ CPP_PROJ=/nologo /MDd /W3 /Gm @COPTX@ @COPTI@ /ZI /Od /I "../../../" @LIBXML2_IN
 
 RSC=rc.exe
 BSC32=bscmake.exe
-BSC32_FLAGS=/nologo /o"$(OUTDIR)\delve.bsc" 
+BSC32_FLAGS=/nologo /o"$(OUTDIR)\delv.bsc" 
 BSC32_SBRS= \
-	"$(INTDIR)\delve.sbr"
+	"$(INTDIR)\delv.sbr"
 
-"$(OUTDIR)\delve.bsc" : "$(OUTDIR)" $(BSC32_SBRS)
+"$(OUTDIR)\delv.bsc" : "$(OUTDIR)" $(BSC32_SBRS)
     $(BSC32) @<<
   $(BSC32_FLAGS) $(BSC32_SBRS)
 <<
 
 LINK32=link.exe
-LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/irs/win32/Debug/libirs.lib /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\delve.pdb" /debug @MACHINE@ /out:"../../../Build/Debug/delve.exe" /pdbtype:sept 
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/irs/win32/Debug/libirs.lib /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\delv.pdb" /debug @MACHINE@ /out:"../../../Build/Debug/delv.exe" /pdbtype:sept 
 LINK32_OBJS= \
-	"$(INTDIR)\delve.obj"
+	"$(INTDIR)\delv.obj"
 
-"..\..\..\Build\Debug\delve.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
+"..\..\..\Build\Debug\delv.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
@@ -250,28 +250,28 @@ LINK32_OBJS= \
 
 
 !IF "$(NO_EXTERNAL_DEPS)" != "1"
-!IF EXISTS("delve.dep")
-!INCLUDE "delve.dep"
+!IF EXISTS("delv.dep")
+!INCLUDE "delv.dep"
 !ELSE 
-!MESSAGE Warning: cannot find "delve.dep"
+!MESSAGE Warning: cannot find "delv.dep"
 !ENDIF 
 !ENDIF 
 
 
-!IF "$(CFG)" == "delve - @PLATFORM@ Release" || "$(CFG)" == "delve - @PLATFORM@ Debug"
-SOURCE="..\delve.c"
+!IF "$(CFG)" == "delv - @PLATFORM@ Release" || "$(CFG)" == "delv - @PLATFORM@ Debug"
+SOURCE="..\delv.c"
 
-!IF  "$(CFG)" == "delve - @PLATFORM@ Release"
+!IF  "$(CFG)" == "delv - @PLATFORM@ Release"
 
 
-"$(INTDIR)\delve.obj" : $(SOURCE) "$(INTDIR)"
+"$(INTDIR)\delv.obj" : $(SOURCE) "$(INTDIR)"
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 
-!ELSEIF  "$(CFG)" == "delve - @PLATFORM@ Debug"
+!ELSEIF  "$(CFG)" == "delv - @PLATFORM@ Debug"
 
 
-"$(INTDIR)\delve.obj"	"$(INTDIR)\delve.sbr" : $(SOURCE) "$(INTDIR)"
+"$(INTDIR)\delv.obj"	"$(INTDIR)\delv.sbr" : $(SOURCE) "$(INTDIR)"
 	$(CPP) $(CPP_PROJ) $(SOURCE)
 
 

bin/delv/win32/delv.vcxproj.filters.in

@@ -15,8 +15,8 @@
     </Filter>
   </ItemGroup>
   <ItemGroup>
-    <ClCompile Include="..\delve.c">
+    <ClCompile Include="..\delv.c">
       <Filter>Source Files</Filter>
     </ClCompile>
   </ItemGroup>
-</Project>
+</Project>

bin/delv/win32/delv.vcxproj.in

@@ -13,7 +13,7 @@
   <PropertyGroup Label="Globals">
     <ProjectGuid>{BE172EFE-C1DC-4812-BFB9-8C5F8ADB7E9F}</ProjectGuid>
     <Keyword>Win32Proj</Keyword>
-    <RootNamespace>delve</RootNamespace>
+    <RootNamespace>delv</RootNamespace>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
@@ -100,9 +100,9 @@
     </Link>
   </ItemDefinitionGroup>
   <ItemGroup>
-    <ClCompile Include="..\delve.c" />
+    <ClCompile Include="..\delv.c" />
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
-</Project>
+</Project>

bin/dig/.gitignore

@@ -1,4 +1,7 @@
-dig
-host
-nslookup
+/dig
+/host
+/nslookup
 .libs
+dig-symtbl.c
+host-symtbl.c
+nslookup-symtbl.c

bin/dig/Makefile.in

@@ -28,7 +28,7 @@ READLINE_LIB = @READLINE_LIB@
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${BIND9_INCLUDES} \
 		${ISC_INCLUDES} ${LWRES_INCLUDES} ${ISCCFG_INCLUDES}
 
-CDEFINES =	-DVERSION=\"${VERSION}\"
+CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@
 CWARNINGS =
 
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@

bin/dig/dig.1

@@ -247,21 +247,90 @@ no
 to negate the meaning of that keyword. Other keywords assign values to options like the timeout interval. They have the form
 \fB+keyword=value\fR. The query options are:
 .PP
-\fB+[no]tcp\fR
+\fB+[no]aaflag\fR
 .RS 4
-Use [do not use] TCP when querying name servers. The default behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used.
+A synonym for
+\fI+[no]aaonly\fR.
 .RE
 .PP
-\fB+[no]vc\fR
+\fB+[no]aaonly\fR
 .RS 4
-Use [do not use] TCP when querying name servers. This alternate syntax to
-\fI+[no]tcp\fR
-is provided for backwards compatibility. The "vc" stands for "virtual circuit".
+Sets the "aa" flag in the query.
 .RE
 .PP
-\fB+[no]ignore\fR
+\fB+[no]additional\fR
 .RS 4
-Ignore truncation in UDP responses instead of retrying with TCP. By default, TCP retries are performed.
+Display [do not display] the additional section of a reply. The default is to display it.
+.RE
+.PP
+\fB+[no]adflag\fR
+.RS 4
+Set [do not set] the AD (authentic data) bit in the query. This requests the server to return whether all of the answer and authority sections have all been validated as secure according to the security policy of the server. AD=1 indicates that all records have been validated as secure and the answer is not from a OPT\-OUT range. AD=0 indicate that some part of the answer was insecure or not validated. This bit is set by default.
+.RE
+.PP
+\fB+[no]all\fR
+.RS 4
+Set or clear all display flags.
+.RE
+.PP
+\fB+[no]answer\fR
+.RS 4
+Display [do not display] the answer section of a reply. The default is to display it.
+.RE
+.PP
+\fB+[no]authority\fR
+.RS 4
+Display [do not display] the authority section of a reply. The default is to display it.
+.RE
+.PP
+\fB+[no]besteffort\fR
+.RS 4
+Attempt to display the contents of messages which are malformed. The default is to not display malformed answers.
+.RE
+.PP
+\fB+bufsize=B\fR
+.RS 4
+Set the UDP message buffer size advertised using EDNS0 to
+\fIB\fR
+bytes. The maximum and minimum sizes of this buffer are 65535 and 0 respectively. Values outside this range are rounded up or down appropriately. Values other than zero will cause a EDNS query to be sent.
+.RE
+.PP
+\fB+[no]cdflag\fR
+.RS 4
+Set [do not set] the CD (checking disabled) bit in the query. This requests the server to not perform DNSSEC validation of responses.
+.RE
+.PP
+\fB+[no]cl\fR
+.RS 4
+Display [do not display] the CLASS when printing the record.
+.RE
+.PP
+\fB+[no]cmd\fR
+.RS 4
+Toggles the printing of the initial comment in the output identifying the version of
+\fBdig\fR
+and the query options that have been applied. This comment is printed by default.
+.RE
+.PP
+\fB+[no]comments\fR
+.RS 4
+Toggle the display of comment lines in the output. The default is to print comments.
+.RE
+.PP
+\fB+[no]crypto\fR
+.RS 4
+Toggle the display of cryptographic fields in DNSSEC records. The contents of these field are unnecessary to debug most DNSSEC validation failures and removing them makes it easier to see the common failures. The default is to display the fields. When omitted they are replaced by the string "[omitted]" or in the DNSKEY case the key id is displayed as the replacement, e.g. "[ key id = value ]".
+.RE
+.PP
+\fB+[no]defname\fR
+.RS 4
+Deprecated, treated as a synonym for
+\fI+[no]search\fR
+.RE
+.PP
+\fB+[no]dnssec\fR
+.RS 4
+Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO) in the OPT record in the additional section of the query.
 .RE
 .PP
 \fB+domain=somename\fR
@@ -275,53 +344,91 @@ directive in
 option were given.
 .RE
 .PP
-\fB+[no]search\fR
+\fB+[no]edns[=#]\fR
 .RS 4
-Use [do not use] the search list defined by the searchlist or domain directive in
-\fIresolv.conf\fR
-(if any). The search list is not used by default.
+Specify the EDNS version to query with. Valid values are 0 to 255. Setting the EDNS version will cause a EDNS query to be sent.
+\fB+noedns\fR
+clears the remembered EDNS version. EDNS is set to 0 by default.
 .RE
 .PP
-\fB+[no]showsearch\fR
+\fB+[no]expire\fR
 .RS 4
-Perform [do not perform] a search showing intermediate results.
+Send an EDNS Expire option.
 .RE
 .PP
-\fB+[no]defname\fR
+\fB+[no]fail\fR
 .RS 4
-Deprecated, treated as a synonym for
-\fI+[no]search\fR
+Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behavior.
 .RE
 .PP
-\fB+[no]aaonly\fR
+\fB+[no]identify\fR
 .RS 4
-Sets the "aa" flag in the query.
+Show [or do not show] the IP address and port number that supplied the answer when the
+\fI+short\fR
+option is enabled. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer.
 .RE
 .PP
-\fB+[no]aaflag\fR
+\fB+[no]ignore\fR
 .RS 4
-A synonym for
-\fI+[no]aaonly\fR.
+Ignore truncation in UDP responses instead of retrying with TCP. By default, TCP retries are performed.
 .RE
 .PP
-\fB+[no]adflag\fR
+\fB+[no]keepopen\fR
 .RS 4
-Set [do not set] the AD (authentic data) bit in the query. This requests the server to return whether all of the answer and authority sections have all been validated as secure according to the security policy of the server. AD=1 indicates that all records have been validated as secure and the answer is not from a OPT\-OUT range. AD=0 indicate that some part of the answer was insecure or not validated. This bit is set by default.
+Keep the TCP socket open between queries and reuse it rather than creating a new TCP socket for each lookup. The default is
+\fB+nokeepopen\fR.
 .RE
 .PP
-\fB+[no]cdflag\fR
+\fB+[no]multiline\fR
 .RS 4
-Set [do not set] the CD (checking disabled) bit in the query. This requests the server to not perform DNSSEC validation of responses.
+Print records like the SOA records in a verbose multi\-line format with human\-readable comments. The default is to print each record on a single line, to facilitate machine parsing of the
+\fBdig\fR
+output.
 .RE
 .PP
-\fB+[no]cl\fR
+\fB+ndots=D\fR
 .RS 4
-Display [do not display] the CLASS when printing the record.
+Set the number of dots that have to appear in
+\fIname\fR
+to
+\fID\fR
+for it to be considered absolute. The default value is that defined using the ndots statement in
+\fI/etc/resolv.conf\fR, or 1 if no ndots statement is present. Names with fewer dots are interpreted as relative names and will be searched for in the domains listed in the
+\fBsearch\fR
+or
+\fBdomain\fR
+directive in
+\fI/etc/resolv.conf\fR
+if
+\fB+search\fR
+is set.
 .RE
 .PP
-\fB+[no]ttlid\fR
+\fB+[no]nsid\fR
 .RS 4
-Display [do not display] the TTL when printing the record.
+Include an EDNS name server ID request when sending a query.
+.RE
+.PP
+\fB+[no]nssearch\fR
+.RS 4
+When this option is set,
+\fBdig\fR
+attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone.
+.RE
+.PP
+\fB+[no]onesoa\fR
+.RS 4
+Print only one (starting) SOA record when performing an AXFR. The default is to print both the starting and ending SOA records.
+.RE
+.PP
+\fB+[no]qr\fR
+.RS 4
+Print [do not print] the query as it is sent. By default, the query is not printed.
+.RE
+.PP
+\fB+[no]question\fR
+.RS 4
+Print [do not print] the question section of a query when an answer is returned. The default is to print the question section as a comment.
 .RE
 .PP
 \fB+[no]recurse\fR
@@ -335,45 +442,12 @@ or
 query options are used.
 .RE
 .PP
-\fB+[no]nssearch\fR
+\fB+retry=T\fR
 .RS 4
-When this option is set,
-\fBdig\fR
-attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone.
-.RE
-.PP
-\fB+[no]trace\fR
-.RS 4
-Toggle tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled,
-\fBdig\fR
-makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup.
-.sp
-\fB+dnssec\fR
-is also set when +trace is set to better emulate the default queries from a nameserver.
-.RE
-.PP
-\fB+[no]cmd\fR
-.RS 4
-Toggles the printing of the initial comment in the output identifying the version of
-\fBdig\fR
-and the query options that have been applied. This comment is printed by default.
-.RE
-.PP
-\fB+[no]short\fR
-.RS 4
-Provide a terse answer. The default is to print the answer in a verbose form.
-.RE
-.PP
-\fB+[no]identify\fR
-.RS 4
-Show [or do not show] the IP address and port number that supplied the answer when the
-\fI+short\fR
-option is enabled. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer.
-.RE
-.PP
-\fB+[no]comments\fR
-.RS 4
-Toggle the display of comment lines in the output. The default is to print comments.
+Sets the number of times to retry UDP queries to server to
+\fIT\fR
+instead of the default, 2. Unlike
+\fI+tries\fR, this does not include the initial query.
 .RE
 .PP
 \fB+[no]rrcomments\fR
@@ -381,9 +455,38 @@ Toggle the display of comment lines in the output. The default is to print comme
 Toggle the display of per\-record comments in the output (for example, human\-readable key information about DNSKEY records). The default is not to print record comments unless multiline mode is active.
 .RE
 .PP
-\fB+[no]crypto\fR
+\fB+[no]search\fR
 .RS 4
-Toggle the display of cryptographic fields in DNSSEC records. The contents of these field are unnecessary to debug most DNSSEC validation failures and removing them makes it easier to see the common failures. The default is to display the fields. When omitted they are replaced by the string "[omitted]" or in the DNSKEY case the key id is displayed as the replacement, e.g. "[ key id = value ]".
+Use [do not use] the search list defined by the searchlist or domain directive in
+\fIresolv.conf\fR
+(if any). The search list is not used by default.
+.sp
+\'ndots' from
+\fIresolv.conf\fR
+(default 1) which may be overridden by
+\fI+ndots\fR
+determines if the name will be treated as relative or not and hence whether a search is eventually performed or not.
+.RE
+.PP
+\fB+[no]short\fR
+.RS 4
+Provide a terse answer. The default is to print the answer in a verbose form.
+.RE
+.PP
+\fB+[no]showsearch\fR
+.RS 4
+Perform [do not perform] a search showing intermediate results.
+.RE
+.PP
+\fB+[no]sigchase\fR
+.RS 4
+Chase DNSSEC signature chains. Requires dig be compiled with \-DDIG_SIGCHASE.
+.RE
+.PP
+\fB+[no]sit\fR\fB[=####]\fR
+.RS 4
+Send a Source Identity Token EDNS option, with optional value. Replaying a SIT from a previous response will allow the server to identify a previous client. The default is
+\fB+nosit\fR. Currently using experimental value 65001 for the option code.
 .RE
 .PP
 \fB+split=W\fR
@@ -404,34 +507,16 @@ causes fields not to be split at all. The default is 56 characters, or 44 charac
 This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behavior is to print the query statistics.
 .RE
 .PP
-\fB+[no]qr\fR
+\fB+[no]subnet=addr/prefix\fR
 .RS 4
-Print [do not print] the query as it is sent. By default, the query is not printed.
+Send an EDNS Client Subnet option with the specified IP address or network prefix.
 .RE
 .PP
-\fB+[no]question\fR
+\fB+[no]tcp\fR
 .RS 4
-Print [do not print] the question section of a query when an answer is returned. The default is to print the question section as a comment.
-.RE
-.PP
-\fB+[no]answer\fR
-.RS 4
-Display [do not display] the answer section of a reply. The default is to display it.
-.RE
-.PP
-\fB+[no]authority\fR
-.RS 4
-Display [do not display] the authority section of a reply. The default is to display it.
-.RE
-.PP
-\fB+[no]additional\fR
-.RS 4
-Display [do not display] the additional section of a reply. The default is to display it.
-.RE
-.PP
-\fB+[no]all\fR
-.RS 4
-Set or clear all display flags.
+Use [do not use] TCP when querying name servers. The default behavior is to use UDP unless an
+ixfr=N
+query is requested, in which case the default is TCP. AXFR queries always use TCP.
 .RE
 .PP
 \fB+time=T\fR
@@ -443,6 +528,21 @@ seconds. The default timeout is 5 seconds. An attempt to set
 to less than 1 will result in a query timeout of 1 second being applied.
 .RE
 .PP
+\fB+[no]topdown\fR
+.RS 4
+When chasing DNSSEC signature chains perform a top\-down validation. Requires dig be compiled with \-DDIG_SIGCHASE.
+.RE
+.PP
+\fB+[no]trace\fR
+.RS 4
+Toggle tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled,
+\fBdig\fR
+makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup.
+.sp
+\fB+dnssec\fR
+is also set when +trace is set to better emulate the default queries from a nameserver.
+.RE
+.PP
 \fB+tries=T\fR
 .RS 4
 Sets the number of times to try UDP queries to server to
@@ -452,75 +552,6 @@ instead of the default, 3. If
 is less than or equal to zero, the number of tries is silently rounded up to 1.
 .RE
 .PP
-\fB+retry=T\fR
-.RS 4
-Sets the number of times to retry UDP queries to server to
-\fIT\fR
-instead of the default, 2. Unlike
-\fI+tries\fR, this does not include the initial query.
-.RE
-.PP
-\fB+ndots=D\fR
-.RS 4
-Set the number of dots that have to appear in
-\fIname\fR
-to
-\fID\fR
-for it to be considered absolute. The default value is that defined using the ndots statement in
-\fI/etc/resolv.conf\fR, or 1 if no ndots statement is present. Names with fewer dots are interpreted as relative names and will be searched for in the domains listed in the
-\fBsearch\fR
-or
-\fBdomain\fR
-directive in
-\fI/etc/resolv.conf\fR.
-.RE
-.PP
-\fB+bufsize=B\fR
-.RS 4
-Set the UDP message buffer size advertised using EDNS0 to
-\fIB\fR
-bytes. The maximum and minimum sizes of this buffer are 65535 and 0 respectively. Values outside this range are rounded up or down appropriately. Values other than zero will cause a EDNS query to be sent.
-.RE
-.PP
-\fB+edns=#\fR
-.RS 4
-Specify the EDNS version to query with. Valid values are 0 to 255. Setting the EDNS version will cause a EDNS query to be sent.
-\fB+noedns\fR
-clears the remembered EDNS version. EDNS is set to 0 by default.
-.RE
-.PP
-\fB+[no]multiline\fR
-.RS 4
-Print records like the SOA records in a verbose multi\-line format with human\-readable comments. The default is to print each record on a single line, to facilitate machine parsing of the
-\fBdig\fR
-output.
-.RE
-.PP
-\fB+[no]onesoa\fR
-.RS 4
-Print only one (starting) SOA record when performing an AXFR. The default is to print both the starting and ending SOA records.
-.RE
-.PP
-\fB+[no]fail\fR
-.RS 4
-Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behavior.
-.RE
-.PP
-\fB+[no]besteffort\fR
-.RS 4
-Attempt to display the contents of messages which are malformed. The default is to not display malformed answers.
-.RE
-.PP
-\fB+[no]dnssec\fR
-.RS 4
-Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO) in the OPT record in the additional section of the query.
-.RE
-.PP
-\fB+[no]sigchase\fR
-.RS 4
-Chase DNSSEC signature chains. Requires dig be compiled with \-DDIG_SIGCHASE.
-.RE
-.PP
 \fB+trusted\-key=####\fR
 .RS 4
 Specifies a file containing trusted keys to be used with
@@ -537,36 +568,16 @@ in the current directory.
 Requires dig be compiled with \-DDIG_SIGCHASE.
 .RE
 .PP
-\fB+[no]topdown\fR
+\fB+[no]ttlid\fR
 .RS 4
-When chasing DNSSEC signature chains perform a top\-down validation. Requires dig be compiled with \-DDIG_SIGCHASE.
+Display [do not display] the TTL when printing the record.
 .RE
 .PP
-\fB+[no]nsid\fR
+\fB+[no]vc\fR
 .RS 4
-Include an EDNS name server ID request when sending a query.
-.RE
-.PP
-\fB+[no]keepopen\fR
-.RS 4
-Keep the TCP socket open between queries and reuse it rather than creating a new TCP socket for each lookup. The default is
-\fB+nokeepopen\fR.
-.RE
-.PP
-\fB+[no]sit\fR\fB[=####]\fR
-.RS 4
-Send a Source Identity Token EDNS option, with optional value. Replaying a SIT from a previous response will allow the server to identify a previous client. The default is
-\fB+nosit\fR. Currently using experimental value 65001 for the option code.
-.RE
-.PP
-\fB+[no]subnet=addr/prefix\fR
-.RS 4
-Send an EDNS Client Subnet option with the speciifed IP address or network prefix.
-.RE
-.PP
-\fB+[no]expire\fR
-.RS 4
-Send an EDNS Expire option. Currently using experimental value 65002 for the option code.
+Use [do not use] TCP when querying name servers. This alternate syntax to
+\fI+[no]tcp\fR
+is provided for backwards compatibility. The "vc" stands for "virtual circuit".
 .RE
 .SH "MULTIPLE QUERIES"
 .PP

bin/dig/dig.c

@@ -255,7 +255,6 @@ help(void) {
 void
 received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 	isc_uint64_t diff;
-	isc_time_t now;
 	time_t tnow;
 	struct tm tmnow;
 	char time_str[100];
@@ -263,10 +262,8 @@ received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 
 	isc_sockaddr_format(from, fromtext, sizeof(fromtext));
 
-	TIME_NOW(&now);
-
 	if (query->lookup->stats && !short_form) {
-		diff = isc_time_microdiff(&now, &query->time_sent);
+		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		if (use_usec)
 			printf(";; Query time: %ld usec\n", (long) diff);
 		else
@@ -295,7 +292,7 @@ received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		}
 		puts("");
 	} else if (query->lookup->identify && !short_form) {
-		diff = isc_time_microdiff(&now, &query->time_sent);
+		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		if (use_usec)
 			printf(";; Received %" ISC_PRINT_QUADFORMAT "u bytes "
 			       "from %s(%s) in %ld us\n\n",
@@ -331,7 +328,6 @@ static isc_result_t
 say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	isc_result_t result;
 	isc_uint64_t diff;
-	isc_time_t now;
 	char store[sizeof("12345678901234567890")];
 	unsigned int styleflags = 0;
 
@@ -349,8 +345,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 		return (result);
 	check_result(result, "dns_rdata_totext");
 	if (query->lookup->identify) {
-		TIME_NOW(&now);
-		diff = isc_time_microdiff(&now, &query->time_sent);
+		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		ADD_STRING(buf, " from server ");
 		ADD_STRING(buf, query->servname);
 		if (use_usec)
@@ -758,7 +753,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 	char *cmd, *value, *ptr;
 	isc_uint32_t num;
 	isc_boolean_t state = ISC_TRUE;
-#ifdef DIG_SIGCHASE
+#if defined(DIG_SIGCHASE) || defined(ISC_PLATFORM_USESIT)
 	size_t n;
 #endif
 
@@ -1122,8 +1117,10 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 					lookup->edns = 0;
 				lookup->sit = state;
 				if (value != NULL) {
-					strncpy(sitvalue, value,
-						sizeof(sitvalue));
+					n = strlcpy(sitvalue, value,
+						    sizeof(sitvalue));
+					if (n >= sizeof(sitvalue))
+						fatal("SIT data too large");
 					lookup->sitvalue = sitvalue;
 				} else
 					lookup->sitvalue = NULL;
@@ -1193,8 +1190,10 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 		switch (cmd[1]) {
 		case 'c': /* tcp */
 			FULLCHECK("tcp");
-			if (!is_batchfile)
+			if (!is_batchfile) {
 				lookup->tcp_mode = state;
+				lookup->tcp_mode_set = ISC_TRUE;
+			}
 			break;
 		case 'i': /* timeout */
 			FULLCHECK("timeout");
@@ -1274,8 +1273,10 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 		break;
 	case 'v':
 		FULLCHECK("vc");
-		if (!is_batchfile)
+		if (!is_batchfile) {
 			lookup->tcp_mode = state;
+			lookup->tcp_mode_set = ISC_TRUE;
+		}
 		break;
 	default:
 	invalid_option:
@@ -1493,10 +1494,12 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				(*lookup)->ixfr_serial = serial;
 				(*lookup)->section_question = plusquest;
 				(*lookup)->comments = pluscomm;
-				(*lookup)->tcp_mode = ISC_TRUE;
+				if (!(*lookup)->tcp_mode_set)
+					(*lookup)->tcp_mode = ISC_TRUE;
 			} else {
 				(*lookup)->rdtype = rdtype;
-				(*lookup)->rdtypeset = ISC_TRUE;
+				if (!config_only)
+					(*lookup)->rdtypeset = ISC_TRUE;
 				if (rdtype == dns_rdatatype_axfr) {
 					(*lookup)->section_question = plusquest;
 					(*lookup)->comments = pluscomm;
@@ -1538,6 +1541,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				ip6_int, ISC_FALSE) == ISC_R_SUCCESS) {
 			strncpy((*lookup)->textname, textname,
 				sizeof((*lookup)->textname));
+			(*lookup)->textname[sizeof((*lookup)->textname)-1] = 0;
 			debug("looking up %s", (*lookup)->textname);
 			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
 						(*lookup)->ns_search_only);
@@ -1601,7 +1605,8 @@ preparse_args(int argc, char **argv) {
 
 static void
 parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
-	   int argc, char **argv) {
+	   int argc, char **argv)
+{
 	isc_result_t result;
 	isc_textregion_t tr;
 	isc_boolean_t firstarg = ISC_TRUE;
@@ -1695,7 +1700,24 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		if (strncmp(rv[0], "%", 1) == 0)
 			break;
 		if (rv[0][0] == '@') {
-			addresscount = getaddresses(lookup, &rv[0][1], NULL);
+
+			if (is_batchfile && !config_only) {
+				addresscount = getaddresses(lookup, &rv[0][1],
+							     &result);
+				if (result != ISC_R_SUCCESS) {
+					fprintf(stderr, "couldn't get address "
+						"for '%s': %s: skipping "
+						"lookup\n", &rv[0][1],
+						isc_result_totext(result));
+					if (ISC_LINK_LINKED(lookup, link))
+						ISC_LIST_DEQUEUE(lookup_list,
+								 lookup, link);
+					destroy_lookup(lookup);
+					return;
+				}
+			} else
+				addresscount = getaddresses(lookup, &rv[0][1],
+							    NULL);
 		} else if (rv[0][0] == '+') {
 			plus_option(&rv[0][1], is_batchfile,
 				    lookup);
@@ -1759,7 +1781,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 						lookup->section_question =
 							plusquest;
 						lookup->comments = pluscomm;
-						lookup->tcp_mode = ISC_TRUE;
+						if (!lookup->tcp_mode_set)
+							lookup->tcp_mode = ISC_TRUE;
 					} else {
 						lookup->rdtype = rdtype;
 						lookup->rdtypeset = ISC_TRUE;

bin/dig/dig.html

@@ -34,7 +34,7 @@
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543536"></a><h2>DESCRIPTION</h2>
+<a name="id2543544"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
       (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
@@ -81,7 +81,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543614"></a><h2>SIMPLE USAGE</h2>
+<a name="id2543623"></a><h2>SIMPLE USAGE</h2>
 <p>
       A typical invocation of <span><strong class="command">dig</strong></span> looks like:
       </p>
@@ -94,47 +94,47 @@
 <dt><span class="term"><code class="constant">server</code></span></dt>
 <dd>
 <p>
-              is the name or IP address of the name server to query.  This
-              can be an IPv4 address in dotted-decimal notation or an IPv6
-              address in colon-delimited notation.  When the supplied
-              <em class="parameter"><code>server</code></em> argument is a hostname,
-              <span><strong class="command">dig</strong></span> resolves that name before querying
-              that name server.
-            </p>
+	      is the name or IP address of the name server to query.  This
+	      can be an IPv4 address in dotted-decimal notation or an IPv6
+	      address in colon-delimited notation.  When the supplied
+	      <em class="parameter"><code>server</code></em> argument is a hostname,
+	      <span><strong class="command">dig</strong></span> resolves that name before querying
+	      that name server.
+	    </p>
 <p>
-              If no <em class="parameter"><code>server</code></em> argument is
-              provided, <span><strong class="command">dig</strong></span> consults
-              <code class="filename">/etc/resolv.conf</code>; if an
-              address is found there, it queries the name server at
-              that address. If either of the <code class="option">-4</code> or
-              <code class="option">-6</code> options are in use, then
-              only addresses for the corresponding transport
-              will be tried.  If no usable addresses are found,
-              <span><strong class="command">dig</strong></span> will send the query to the
-              local host.  The reply from the name server that
-              responds is displayed.
-            </p>
+	      If no <em class="parameter"><code>server</code></em> argument is
+	      provided, <span><strong class="command">dig</strong></span> consults
+	      <code class="filename">/etc/resolv.conf</code>; if an
+	      address is found there, it queries the name server at
+	      that address. If either of the <code class="option">-4</code> or
+	      <code class="option">-6</code> options are in use, then
+	      only addresses for the corresponding transport
+	      will be tried.  If no usable addresses are found,
+	      <span><strong class="command">dig</strong></span> will send the query to the
+	      local host.  The reply from the name server that
+	      responds is displayed.
+	    </p>
 </dd>
 <dt><span class="term"><code class="constant">name</code></span></dt>
 <dd><p>
-              is the name of the resource record that is to be looked up.
-            </p></dd>
+	      is the name of the resource record that is to be looked up.
+	    </p></dd>
 <dt><span class="term"><code class="constant">type</code></span></dt>
 <dd><p>
-              indicates what type of query is required &#8212;
-              ANY, A, MX, SIG, etc.
-              <em class="parameter"><code>type</code></em> can be any valid query
-              type.  If no
-              <em class="parameter"><code>type</code></em> argument is supplied,
-              <span><strong class="command">dig</strong></span> will perform a lookup for an
-              A record.
-            </p></dd>
+	      indicates what type of query is required &#8212;
+	      ANY, A, MX, SIG, etc.
+	      <em class="parameter"><code>type</code></em> can be any valid query
+	      type.  If no
+	      <em class="parameter"><code>type</code></em> argument is supplied,
+	      <span><strong class="command">dig</strong></span> will perform a lookup for an
+	      A record.
+	    </p></dd>
 </dl></div>
 <p>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543718"></a><h2>OPTIONS</h2>
+<a name="id2543726"></a><h2>OPTIONS</h2>
 <p>
       The <code class="option">-b</code> option sets the source IP address of the query
       to <em class="parameter"><code>address</code></em>.  This must be a valid
@@ -242,7 +242,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544009"></a><h2>QUERY OPTIONS</h2>
+<a name="id2544018"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">dig</strong></span>
       provides a number of query options which affect
       the way in which lookups are made and the results displayed.  Some of
@@ -262,62 +262,19 @@
 
       </p>
 <div class="variablelist"><dl>
-<dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
-<dd><p>
-              Use [do not use] TCP when querying name servers.  The default
-              behavior is to use UDP unless an AXFR or IXFR query is
-              requested, in
-              which case a TCP connection is used.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]vc</code></span></dt>
-<dd><p>
-              Use [do not use] TCP when querying name servers.  This alternate
-              syntax to <em class="parameter"><code>+[no]tcp</code></em> is
-              provided for backwards
-              compatibility.  The "vc" stands for "virtual circuit".
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]ignore</code></span></dt>
-<dd><p>
-              Ignore truncation in UDP responses instead of retrying with TCP.
-               By
-              default, TCP retries are performed.
-            </p></dd>
-<dt><span class="term"><code class="option">+domain=somename</code></span></dt>
-<dd><p>
-              Set the search list to contain the single domain
-              <em class="parameter"><code>somename</code></em>, as if specified in
-              a
-              <span><strong class="command">domain</strong></span> directive in
-              <code class="filename">/etc/resolv.conf</code>, and enable
-              search list
-              processing as if the <em class="parameter"><code>+search</code></em>
-              option were given.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]search</code></span></dt>
-<dd><p>
-              Use [do not use] the search list defined by the searchlist or
-              domain
-              directive in <code class="filename">resolv.conf</code> (if
-              any).
-              The search list is not used by default.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]showsearch</code></span></dt>
-<dd><p>
-              Perform [do not perform] a search showing intermediate
-	      results.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]defname</code></span></dt>
-<dd><p>
-              Deprecated, treated as a synonym for <em class="parameter"><code>+[no]search</code></em>
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]aaonly</code></span></dt>
-<dd><p>
-              Sets the "aa" flag in the query.
-            </p></dd>
 <dt><span class="term"><code class="option">+[no]aaflag</code></span></dt>
 <dd><p>
-              A synonym for <em class="parameter"><code>+[no]aaonly</code></em>.
-            </p></dd>
+	      A synonym for <em class="parameter"><code>+[no]aaonly</code></em>.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]aaonly</code></span></dt>
+<dd><p>
+	      Sets the "aa" flag in the query.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]additional</code></span></dt>
+<dd><p>
+	      Display [do not display] the additional section of a
+	      reply.  The default is to display it.
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]adflag</code></span></dt>
 <dd><p>
 	      Set [do not set] the AD (authentic data) bit in the
@@ -330,21 +287,179 @@
 	      of the answer was insecure or not validated.  This
 	      bit is set by default.
 	    </p></dd>
+<dt><span class="term"><code class="option">+[no]all</code></span></dt>
+<dd><p>
+	      Set or clear all display flags.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]answer</code></span></dt>
+<dd><p>
+	      Display [do not display] the answer section of a
+	      reply.  The default is to display it.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]authority</code></span></dt>
+<dd><p>
+	      Display [do not display] the authority section of a
+	      reply.  The default is to display it.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]besteffort</code></span></dt>
+<dd><p>
+	      Attempt to display the contents of messages which are
+	      malformed.  The default is to not display malformed
+	      answers.
+	    </p></dd>
+<dt><span class="term"><code class="option">+bufsize=B</code></span></dt>
+<dd><p>
+	      Set the UDP message buffer size advertised using EDNS0
+	      to <em class="parameter"><code>B</code></em> bytes.  The maximum and
+	      minimum sizes of this buffer are 65535 and 0 respectively.
+	      Values outside this range are rounded up or down
+	      appropriately.  Values other than zero will cause a
+	      EDNS query to be sent.
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]cdflag</code></span></dt>
 <dd><p>
-              Set [do not set] the CD (checking disabled) bit in the query.
-              This
-              requests the server to not perform DNSSEC validation of
-              responses.
-            </p></dd>
+	      Set [do not set] the CD (checking disabled) bit in
+	      the query.  This requests the server to not perform
+	      DNSSEC validation of responses.
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]cl</code></span></dt>
 <dd><p>
-              Display [do not display] the CLASS when printing the record.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]ttlid</code></span></dt>
+	      Display [do not display] the CLASS when printing the
+	      record.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]cmd</code></span></dt>
 <dd><p>
-              Display [do not display] the TTL when printing the record.
-            </p></dd>
+	      Toggles the printing of the initial comment in the
+	      output identifying the version of <span><strong class="command">dig</strong></span>
+	      and the query options that have been applied.  This
+	      comment is printed by default.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]comments</code></span></dt>
+<dd><p>
+	      Toggle the display of comment lines in the output.
+	      The default is to print comments.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]crypto</code></span></dt>
+<dd><p>
+	      Toggle the display of cryptographic fields in DNSSEC
+	      records.  The contents of these field are unnecessary
+	      to debug most DNSSEC validation failures and removing
+	      them makes it easier to see the common failures.  The
+	      default is to display the fields.  When omitted they
+	      are replaced by the string "[omitted]" or in the
+	      DNSKEY case the key id is displayed as the replacement,
+	      e.g. "[ key id = value ]".
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]defname</code></span></dt>
+<dd><p>
+	      Deprecated, treated as a synonym for
+	      <em class="parameter"><code>+[no]search</code></em>
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]dnssec</code></span></dt>
+<dd><p>
+	      Requests DNSSEC records be sent by setting the DNSSEC
+	      OK bit (DO) in the OPT record in the additional section
+	      of the query.
+	    </p></dd>
+<dt><span class="term"><code class="option">+domain=somename</code></span></dt>
+<dd><p>
+	      Set the search list to contain the single domain
+	      <em class="parameter"><code>somename</code></em>, as if specified in
+	      a <span><strong class="command">domain</strong></span> directive in
+	      <code class="filename">/etc/resolv.conf</code>, and enable
+	      search list processing as if the
+	      <em class="parameter"><code>+search</code></em> option were given.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]edns[=#]</code></span></dt>
+<dd><p>
+	       Specify the EDNS version to query with.  Valid values
+	       are 0 to 255.  Setting the EDNS version will cause
+	       a EDNS query to be sent.  <code class="option">+noedns</code>
+	       clears the remembered EDNS version.  EDNS is set to
+	       0 by default.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]expire</code></span></dt>
+<dd><p>
+	      Send an EDNS Expire option.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]fail</code></span></dt>
+<dd><p>
+	      Do not try the next server if you receive a SERVFAIL.
+	      The default is to not try the next server which is
+	      the reverse of normal stub resolver behavior.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]identify</code></span></dt>
+<dd><p>
+	      Show [or do not show] the IP address and port number
+	      that supplied the answer when the
+	      <em class="parameter"><code>+short</code></em> option is enabled.  If
+	      short form answers are requested, the default is not
+	      to show the source address and port number of the
+	      server that provided the answer.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]ignore</code></span></dt>
+<dd><p>
+	      Ignore truncation in UDP responses instead of retrying
+	      with TCP.  By default, TCP retries are performed.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]keepopen</code></span></dt>
+<dd><p>
+	      Keep the TCP socket open between queries and reuse
+	      it rather than creating a new TCP socket for each
+	      lookup.  The default is <code class="option">+nokeepopen</code>.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]multiline</code></span></dt>
+<dd><p>
+	      Print records like the SOA records in a verbose
+	      multi-line format with human-readable comments.  The
+	      default is to print each record on a single line, to
+	      facilitate machine parsing of the <span><strong class="command">dig</strong></span>
+	      output.
+	    </p></dd>
+<dt><span class="term"><code class="option">+ndots=D</code></span></dt>
+<dd><p>
+	      Set the number of dots that have to appear in
+	      <em class="parameter"><code>name</code></em> to <em class="parameter"><code>D</code></em>
+	      for it to be considered absolute.  The default value
+	      is that defined using the ndots statement in
+	      <code class="filename">/etc/resolv.conf</code>, or 1 if no
+	      ndots statement is present.  Names with fewer dots
+	      are interpreted as relative names and will be searched
+	      for in the domains listed in the <code class="option">search</code>
+	      or <code class="option">domain</code> directive in
+	      <code class="filename">/etc/resolv.conf</code> if
+	      <code class="option">+search</code> is set.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]nsid</code></span></dt>
+<dd><p>
+	      Include an EDNS name server ID request when sending
+	      a query.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]nssearch</code></span></dt>
+<dd><p>
+	      When this option is set, <span><strong class="command">dig</strong></span>
+	      attempts to find the authoritative name servers for
+	      the zone containing the name being looked up and
+	      display the SOA record that each name server has for
+	      the zone.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]onesoa</code></span></dt>
+<dd><p>
+	      Print only one (starting) SOA record when performing
+	      an AXFR. The default is to print both the starting
+	      and ending SOA records.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]qr</code></span></dt>
+<dd><p>
+	      Print [do not print] the query as it is sent.  By
+	      default, the query is not printed.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]question</code></span></dt>
+<dd><p>
+	      Print [do not print] the question section of a query
+	      when an answer is returned.  The default is to print
+	      the question section as a comment.
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]recurse</code></span></dt>
 <dd><p>
 	      Toggle the setting of the RD (recursion desired) bit
@@ -354,16 +469,105 @@
 	      the <em class="parameter"><code>+nssearch</code></em> or
 	      <em class="parameter"><code>+trace</code></em> query options are used.
 	    </p></dd>
-<dt><span class="term"><code class="option">+[no]nssearch</code></span></dt>
+<dt><span class="term"><code class="option">+retry=T</code></span></dt>
 <dd><p>
-              When this option is set, <span><strong class="command">dig</strong></span>
-              attempts to find the
-              authoritative name servers for the zone containing the name
-              being
-              looked up and display the SOA record that each name server has
-              for the
-              zone.
-            </p></dd>
+	      Sets the number of times to retry UDP queries to
+	      server to <em class="parameter"><code>T</code></em> instead of the
+	      default, 2.  Unlike <em class="parameter"><code>+tries</code></em>,
+	      this does not include the initial query.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]rrcomments</code></span></dt>
+<dd><p>
+	      Toggle the display of per-record comments in the
+	      output (for example, human-readable key information
+	      about DNSKEY records).  The default is not to print
+	      record comments unless multiline mode is active.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]search</code></span></dt>
+<dd>
+<p>
+	      Use [do not use] the search list defined by the
+	      searchlist or domain directive in
+	      <code class="filename">resolv.conf</code> (if any).  The search
+	      list is not used by default.
+	    </p>
+<p>
+	      'ndots' from <code class="filename">resolv.conf</code> (default 1)
+	       which may be overridden by <em class="parameter"><code>+ndots</code></em>
+	      determines if the name will be treated as relative
+	      or not and hence whether a search is eventually
+	      performed or not.
+	    </p>
+</dd>
+<dt><span class="term"><code class="option">+[no]short</code></span></dt>
+<dd><p>
+	      Provide a terse answer.  The default is to print the
+	      answer in a verbose form.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]showsearch</code></span></dt>
+<dd><p>
+	      Perform [do not perform] a search showing intermediate
+	      results.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]sigchase</code></span></dt>
+<dd><p>
+	      Chase DNSSEC signature chains.  Requires dig be
+	      compiled with -DDIG_SIGCHASE.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]sit[<span class="optional">=####</span>]</code></span></dt>
+<dd><p>
+	      Send a Source Identity Token EDNS option, with optional
+	      value.  Replaying a SIT from a previous response will
+	      allow the server to identify a previous client.  The
+	      default is <code class="option">+nosit</code>.  Currently using
+	      experimental value 65001 for the option code.
+	    </p></dd>
+<dt><span class="term"><code class="option">+split=W</code></span></dt>
+<dd><p>
+	      Split long hex- or base64-formatted fields in resource
+	      records into chunks of <em class="parameter"><code>W</code></em>
+	      characters (where <em class="parameter"><code>W</code></em> is rounded
+	      up to the nearest multiple of 4).
+	      <em class="parameter"><code>+nosplit</code></em> or
+	      <em class="parameter"><code>+split=0</code></em> causes fields not to
+	      be split at all.  The default is 56 characters, or
+	      44 characters when multiline mode is active.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]stats</code></span></dt>
+<dd><p>
+	      This query option toggles the printing of statistics:
+	      when the query was made, the size of the reply and
+	      so on.  The default behavior is to print the query
+	      statistics.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]subnet=addr/prefix</code></span></dt>
+<dd><p>
+	      Send an EDNS Client Subnet option with the specified
+	      IP address or network prefix.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
+<dd><p>
+	      Use [do not use] TCP when querying name servers. The
+	      default behavior is to use UDP unless an
+	      <code class="literal">ixfr=N</code> query is requested, in which
+	      case the default is TCP.  AXFR queries always use
+	      TCP.
+	    </p></dd>
+<dt><span class="term"><code class="option">+time=T</code></span></dt>
+<dd><p>
+
+	      Sets the timeout for a query to
+	      <em class="parameter"><code>T</code></em> seconds.  The default
+	      timeout is 5 seconds.
+	      An attempt to set <em class="parameter"><code>T</code></em> to less
+	      than 1 will result
+	      in a query timeout of 1 second being applied.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]topdown</code></span></dt>
+<dd><p>
+	      When chasing DNSSEC signature chains perform a top-down
+	      validation.  Requires dig be compiled with -DDIG_SIGCHASE.
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]trace</code></span></dt>
 <dd>
 <p>
@@ -376,258 +580,55 @@
 	      from each server that was used to resolve the lookup.
 	    </p>
 <p>
-	      <span><strong class="command">+dnssec</strong></span> is also set when +trace is
-	      set to better emulate the default queries from a nameserver.
+	      <span><strong class="command">+dnssec</strong></span> is also set when +trace
+	      is set to better emulate the default queries from a
+	      nameserver.
 	    </p>
 </dd>
-<dt><span class="term"><code class="option">+[no]cmd</code></span></dt>
-<dd><p>
-              Toggles the printing of the initial comment in the output
-              identifying
-              the version of <span><strong class="command">dig</strong></span> and the query
-              options that have
-              been applied.  This comment is printed by default.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]short</code></span></dt>
-<dd><p>
-              Provide a terse answer.  The default is to print the answer in a
-              verbose form.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]identify</code></span></dt>
-<dd><p>
-              Show [or do not show] the IP address and port number that
-              supplied the
-              answer when the <em class="parameter"><code>+short</code></em> option
-              is enabled.  If
-              short form answers are requested, the default is not to show the
-              source address and port number of the server that provided the
-              answer.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]comments</code></span></dt>
-<dd><p>
-              Toggle the display of comment lines in the output.  The default
-              is to print comments.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]rrcomments</code></span></dt>
-<dd><p>
-              Toggle the display of per-record comments in the output (for
-              example, human-readable key information about DNSKEY records).
-              The default is not to print record comments unless multiline
-              mode is active.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]crypto</code></span></dt>
-<dd><p>
-	      Toggle the display of cryptographic fields in DNSSEC records.
-	      The contents of these field are unnecessary to debug most DNSSEC
-	      validation failures and removing them makes it easier to see
-	      the common failures.  The default is to display the fields.
-	      When omitted they are replaced by the string "[omitted]" or
-	      in the DNSKEY case the key id is displayed as the replacement,
-	      e.g. "[ key id = value ]".
-            </p></dd>
-<dt><span class="term"><code class="option">+split=W</code></span></dt>
-<dd><p>
-              Split long hex- or base64-formatted fields in resource
-              records into chunks of <em class="parameter"><code>W</code></em> characters
-              (where <em class="parameter"><code>W</code></em> is rounded up to the nearest
-              multiple of 4).
-              <em class="parameter"><code>+nosplit</code></em> or
-              <em class="parameter"><code>+split=0</code></em> causes fields not to be
-              split at all.  The default is 56 characters, or 44 characters
-              when multiline mode is active.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]stats</code></span></dt>
-<dd><p>
-              This query option toggles the printing of statistics: when the
-              query
-              was made, the size of the reply and so on.  The default
-              behavior is
-              to print the query statistics.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]qr</code></span></dt>
-<dd><p>
-              Print [do not print] the query as it is sent.
-              By default, the query is not printed.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]question</code></span></dt>
-<dd><p>
-              Print [do not print] the question section of a query when an
-              answer is
-              returned.  The default is to print the question section as a
-              comment.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]answer</code></span></dt>
-<dd><p>
-              Display [do not display] the answer section of a reply.  The
-              default
-              is to display it.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]authority</code></span></dt>
-<dd><p>
-              Display [do not display] the authority section of a reply.  The
-              default is to display it.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]additional</code></span></dt>
-<dd><p>
-              Display [do not display] the additional section of a reply.
-              The default is to display it.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]all</code></span></dt>
-<dd><p>
-              Set or clear all display flags.
-            </p></dd>
-<dt><span class="term"><code class="option">+time=T</code></span></dt>
-<dd><p>
-
-              Sets the timeout for a query to
-              <em class="parameter"><code>T</code></em> seconds.  The default
-	      timeout is 5 seconds.
-              An attempt to set <em class="parameter"><code>T</code></em> to less
-              than 1 will result
-              in a query timeout of 1 second being applied.
-            </p></dd>
 <dt><span class="term"><code class="option">+tries=T</code></span></dt>
 <dd><p>
-              Sets the number of times to try UDP queries to server to
-              <em class="parameter"><code>T</code></em> instead of the default, 3.
-              If
-              <em class="parameter"><code>T</code></em> is less than or equal to
-              zero, the number of
-              tries is silently rounded up to 1.
-            </p></dd>
-<dt><span class="term"><code class="option">+retry=T</code></span></dt>
-<dd><p>
-              Sets the number of times to retry UDP queries to server to
-              <em class="parameter"><code>T</code></em> instead of the default, 2.
-              Unlike
-              <em class="parameter"><code>+tries</code></em>, this does not include
-              the initial
-              query.
-            </p></dd>
-<dt><span class="term"><code class="option">+ndots=D</code></span></dt>
-<dd><p>
-              Set the number of dots that have to appear in
-              <em class="parameter"><code>name</code></em> to <em class="parameter"><code>D</code></em> for it to be
-              considered absolute.  The default value is that defined using
-              the
-              ndots statement in <code class="filename">/etc/resolv.conf</code>, or 1 if no
-              ndots statement is present.  Names with fewer dots are
-              interpreted as
-              relative names and will be searched for in the domains listed in
-              the
-              <code class="option">search</code> or <code class="option">domain</code> directive in
-              <code class="filename">/etc/resolv.conf</code>.
-            </p></dd>
-<dt><span class="term"><code class="option">+bufsize=B</code></span></dt>
-<dd><p>
-              Set the UDP message buffer size advertised using EDNS0 to
-              <em class="parameter"><code>B</code></em> bytes.  The maximum and minimum sizes
-	      of this buffer are 65535 and 0 respectively.  Values outside
-	      this range are rounded up or down appropriately.  
-	      Values other than zero will cause a EDNS query to be sent.
-            </p></dd>
-<dt><span class="term"><code class="option">+edns=#</code></span></dt>
-<dd><p>
-	       Specify the EDNS version to query with.  Valid values
-	       are 0 to 255.  Setting the EDNS version will cause
-	       a EDNS query to be sent.  <code class="option">+noedns</code>
-	       clears the remembered EDNS version.  EDNS is set to
-	       0 by default.
+	      Sets the number of times to try UDP queries to server
+	      to <em class="parameter"><code>T</code></em> instead of the default,
+	      3.  If <em class="parameter"><code>T</code></em> is less than or equal
+	      to zero, the number of tries is silently rounded up
+	      to 1.
 	    </p></dd>
-<dt><span class="term"><code class="option">+[no]multiline</code></span></dt>
-<dd><p>
-              Print records like the SOA records in a verbose multi-line
-              format with human-readable comments.  The default is to print
-              each record on a single line, to facilitate machine parsing
-              of the <span><strong class="command">dig</strong></span> output.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]onesoa</code></span></dt>
-<dd><p>
-	      Print only one (starting) SOA record when performing
-	      an AXFR. The default is to print both the starting and
-	      ending SOA records.
-	    </p></dd>
-<dt><span class="term"><code class="option">+[no]fail</code></span></dt>
-<dd><p>
-              Do not try the next server if you receive a SERVFAIL.  The
-              default is
-              to not try the next server which is the reverse of normal stub
-              resolver
-              behavior.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]besteffort</code></span></dt>
-<dd><p>
-              Attempt to display the contents of messages which are malformed.
-              The default is to not display malformed answers.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]dnssec</code></span></dt>
-<dd><p>
-              Requests DNSSEC records be sent by setting the DNSSEC OK bit
-              (DO)
-              in the OPT record in the additional section of the query.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]sigchase</code></span></dt>
-<dd><p>
-              Chase DNSSEC signature chains.  Requires dig be compiled with
-              -DDIG_SIGCHASE.
-            </p></dd>
 <dt><span class="term"><code class="option">+trusted-key=####</code></span></dt>
 <dd>
 <p>
-              Specifies a file containing trusted keys to be used with
-	      <code class="option">+sigchase</code>.  Each DNSKEY record must be
-	      on its own line.
-            </p>
-<p>
-	      If not specified, <span><strong class="command">dig</strong></span> will look for
-	      <code class="filename">/etc/trusted-key.key</code> then
-	      <code class="filename">trusted-key.key</code> in the current directory.
+	      Specifies a file containing trusted keys to be used
+	      with <code class="option">+sigchase</code>.  Each DNSKEY record
+	      must be on its own line.
 	    </p>
 <p>
-              Requires dig be compiled with -DDIG_SIGCHASE.
+	      If not specified, <span><strong class="command">dig</strong></span> will look
+	      for <code class="filename">/etc/trusted-key.key</code> then
+	      <code class="filename">trusted-key.key</code> in the current
+	      directory.
+	    </p>
+<p>
+	      Requires dig be compiled with -DDIG_SIGCHASE.
 	    </p>
 </dd>
-<dt><span class="term"><code class="option">+[no]topdown</code></span></dt>
+<dt><span class="term"><code class="option">+[no]ttlid</code></span></dt>
 <dd><p>
-              When chasing DNSSEC signature chains perform a top-down
-              validation.
-              Requires dig be compiled with -DDIG_SIGCHASE.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]nsid</code></span></dt>
+	      Display [do not display] the TTL when printing the
+	      record.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]vc</code></span></dt>
 <dd><p>
-              Include an EDNS name server ID request when sending a query.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]keepopen</code></span></dt>
-<dd><p>
-              Keep the TCP socket open between queries and reuse it rather
-	      than creating a new TCP socket for each lookup.  The default
-	      is <code class="option">+nokeepopen</code>.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]sit[<span class="optional">=####</span>]</code></span></dt>
-<dd><p>
-	      Send a Source Identity Token EDNS option, with optional value.
-	      Replaying a SIT from a previous response will allow the
-	      server to identify a previous client.  The default is
-	      <code class="option">+nosit</code>.  Currently using experimental value
-	      65001 for the option code.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]subnet=addr/prefix</code></span></dt>
-<dd><p>
-	      Send an EDNS Client Subnet option with the speciifed
-              IP address or network prefix.
-            </p></dd>
-<dt><span class="term"><code class="option">+[no]expire</code></span></dt>
-<dd><p>
-	      Send an EDNS Expire option.  Currently using experimental
-	      value 65002 for the option code.
-            </p></dd>
+	      Use [do not use] TCP when querying name servers.  This
+	      alternate syntax to <em class="parameter"><code>+[no]tcp</code></em>
+	      is provided for backwards compatibility.  The "vc"
+	      stands for "virtual circuit".
+	    </p></dd>
 </dl></div>
 <p>
 
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545418"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2545243"></a><h2>MULTIPLE QUERIES</h2>
 <p>
       The BIND 9 implementation of <span><strong class="command">dig </strong></span>
       supports
@@ -673,7 +674,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545548"></a><h2>IDN SUPPORT</h2>
+<a name="id2545305"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names.
@@ -687,14 +688,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545571"></a><h2>FILES</h2>
+<a name="id2545328"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 <p><code class="filename">${HOME}/.digrc</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545588"></a><h2>SEE ALSO</h2>
+<a name="id2545345"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -702,7 +703,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545625"></a><h2>BUGS</h2>
+<a name="id2545382"></a><h2>BUGS</h2>
 <p>
       There are probably too many query options.
     </p>

bin/dig/dighost.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -58,6 +58,7 @@
 #include <dns/log.h>
 #include <dns/message.h>
 #include <dns/name.h>
+#include <dns/rcode.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
@@ -100,6 +101,10 @@
 
 #include <dig/dig.h>
 
+#ifdef PKCS11CRYPTO
+#include <pk11/result.h>
+#endif
+
 #if ! defined(NS_INADDRSZ)
 #define NS_INADDRSZ	 4
 #endif
@@ -370,6 +375,11 @@ connect_timeout(isc_task_t *task, isc_event_t *event);
 static void
 launch_next_query(dig_query_t *query, isc_boolean_t include_question);
 
+static void
+check_next_lookup(dig_lookup_t *lookup);
+
+static isc_boolean_t
+next_origin(dig_lookup_t *oldlookup);
 
 static void *
 mem_alloc(void *arg, size_t size) {
@@ -613,7 +623,8 @@ addr2af(int lwresaddrtype)
 static void
 copy_server_list(lwres_conf_t *confdata, dig_serverlist_t *dest) {
 	dig_server_t *newsrv;
-	char tmp[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")];
+	char tmp[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") +
+		 sizeof("%4000000000")];
 	int af;
 	int i;
 
@@ -628,6 +639,12 @@ copy_server_list(lwres_conf_t *confdata, dig_serverlist_t *dest) {
 
 		lwres_net_ntop(af, confdata->nameservers[i].address,
 				   tmp, sizeof(tmp));
+		if (af == AF_INET6 && confdata->nameservers[i].zone != 0) {
+			char buf[sizeof("%4000000000")];
+			snprintf(buf, sizeof(buf), "%%%u",
+				 confdata->nameservers[i].zone);
+			strlcat(tmp, buf, sizeof(tmp));
+		}
 		newsrv = make_server(tmp, tmp);
 		ISC_LINK_INIT(newsrv, link);
 		ISC_LIST_ENQUEUE(*dest, newsrv, link);
@@ -797,6 +814,7 @@ make_empty_lookup(void) {
 	looknew->retries = tries;
 	looknew->nsfound = 0;
 	looknew->tcp_mode = ISC_FALSE;
+	looknew->tcp_mode_set = ISC_FALSE;
 	looknew->ip6_int = ISC_FALSE;
 	looknew->comments = ISC_TRUE;
 	looknew->stats = ISC_TRUE;
@@ -883,6 +901,7 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->cdflag = lookold->cdflag;
 	looknew->ns_search_only = lookold->ns_search_only;
 	looknew->tcp_mode = lookold->tcp_mode;
+	looknew->tcp_mode_set = lookold->tcp_mode_set;
 	looknew->comments = lookold->comments;
 	looknew->stats = lookold->stats;
 	looknew->section_question = lookold->section_question;
@@ -1136,10 +1155,9 @@ parse_hmac(const char *hmac) {
  */
 static isc_result_t
 read_confkey(void) {
-	isc_log_t *lctx = NULL;
 	cfg_parser_t *pctx = NULL;
 	cfg_obj_t *file = NULL;
-	const cfg_obj_t *key = NULL;
+	const cfg_obj_t *keyobj = NULL;
 	const cfg_obj_t *secretobj = NULL;
 	const cfg_obj_t *algorithmobj = NULL;
 	const char *keyname;
@@ -1150,7 +1168,7 @@ read_confkey(void) {
 	if (! isc_file_exists(keyfile))
 		return (ISC_R_FILENOTFOUND);
 
-	result = cfg_parser_create(mctx, lctx, &pctx);
+	result = cfg_parser_create(mctx, NULL, &pctx);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
@@ -1159,16 +1177,16 @@ read_confkey(void) {
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	result = cfg_map_get(file, "key", &key);
+	result = cfg_map_get(file, "key", &keyobj);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	(void) cfg_map_get(key, "secret", &secretobj);
-	(void) cfg_map_get(key, "algorithm", &algorithmobj);
+	(void) cfg_map_get(keyobj, "secret", &secretobj);
+	(void) cfg_map_get(keyobj, "algorithm", &algorithmobj);
 	if (secretobj == NULL || algorithmobj == NULL)
 		fatal("key must have algorithm and secret");
 
-	keyname = cfg_obj_asstring(cfg_map_getname(key));
+	keyname = cfg_obj_asstring(cfg_map_getname(keyobj));
 	secretstr = cfg_obj_asstring(secretobj);
 	algorithm = cfg_obj_asstring(algorithmobj);
 
@@ -1401,6 +1419,11 @@ setup_libs(void) {
 
 	debug("setup_libs()");
 
+#ifdef PKCS11CRYPTO
+	pk11_result_register();
+#endif
+	dns_result_register();
+
 	result = isc_net_probeipv4();
 	if (result == ISC_R_SUCCESS)
 		have_ipv4 = ISC_TRUE;
@@ -1459,8 +1482,6 @@ setup_libs(void) {
 
 	result = isc_mutex_init(&lookup_lock);
 	check_result(result, "isc_mutex_init");
-
-	dns_result_register();
 }
 
 /*%
@@ -1470,7 +1491,7 @@ setup_libs(void) {
  */
 static void
 add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
-	isc_boolean_t dnssec, dns_ednsopt_t *ednsopts, size_t count)
+	isc_boolean_t dnssec, dns_ednsopt_t *opts, size_t count)
 {
 	dns_rdataset_t *rdataset = NULL;
 	isc_result_t result;
@@ -1480,7 +1501,7 @@ add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
 	if (dnssec)
 		flags |= DNS_MESSAGEEXTFLAG_DO;
 	result = dns_message_buildopt(msg, &rdataset, edns, udpsize, flags,
-				      ednsopts, count);
+				      opts, count);
 	check_result(result, "dns_message_buildopt");
 	result = dns_message_setopt(msg, rdataset);
 	check_result(result, "dns_message_setopt");
@@ -1501,7 +1522,6 @@ add_question(dns_message_t *message, dns_name_t *name,
 	rdataset = NULL;
 	result = dns_message_gettemprdataset(message, &rdataset);
 	check_result(result, "dns_message_gettemprdataset()");
-	dns_rdataset_init(rdataset);
 	dns_rdataset_makequestion(rdataset, rdclass, rdtype);
 	ISC_LIST_APPEND(name->list, rdataset, link);
 }
@@ -1752,8 +1772,10 @@ start_lookup(void) {
 		}
 	novalidation:
 #endif
-		setup_lookup(current_lookup);
-		do_lookup(current_lookup);
+		if (setup_lookup(current_lookup))
+			do_lookup(current_lookup);
+		else if (next_origin(current_lookup))
+			check_next_lookup(current_lookup);
 	} else {
 		check_if_done();
 	}
@@ -1954,8 +1976,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
  * Return ISC_TRUE iff there was another searchlist entry.
  */
 static isc_boolean_t
-next_origin(dig_query_t *query) {
-	dig_lookup_t *lookup;
+next_origin(dig_lookup_t *oldlookup) {
+	dig_lookup_t *newlookup;
 	dig_searchlist_t *search;
 	dns_fixedname_t fixed;
 	dns_name_t *name;
@@ -1964,7 +1986,7 @@ next_origin(dig_query_t *query) {
 	INSIST(!free_now);
 
 	debug("next_origin()");
-	debug("following up %s", query->lookup->textname);
+	debug("following up %s", oldlookup->textname);
 
 	if (!usesearch)
 		/*
@@ -1978,30 +2000,30 @@ next_origin(dig_query_t *query) {
 	 */
 	dns_fixedname_init(&fixed);
 	name = dns_fixedname_name(&fixed);
-	result = dns_name_fromstring2(name, query->lookup->textname, NULL,
+	result = dns_name_fromstring2(name, oldlookup->textname, NULL,
 				      0, NULL);
 	if (result == ISC_R_SUCCESS &&
 	    (dns_name_isabsolute(name) ||
 	     (int)dns_name_countlabels(name) > ndots))
 		return (ISC_FALSE);
 
-	if (query->lookup->origin == NULL && !query->lookup->need_search)
+	if (oldlookup->origin == NULL && !oldlookup->need_search)
 		/*
 		 * Then we just did rootorg; there's nothing left.
 		 */
 		return (ISC_FALSE);
-	if (query->lookup->origin == NULL && query->lookup->need_search) {
-		lookup = requeue_lookup(query->lookup, ISC_TRUE);
-		lookup->origin = ISC_LIST_HEAD(search_list);
-		lookup->need_search = ISC_FALSE;
+	if (oldlookup->origin == NULL && oldlookup->need_search) {
+		newlookup = requeue_lookup(oldlookup, ISC_TRUE);
+		newlookup->origin = ISC_LIST_HEAD(search_list);
+		newlookup->need_search = ISC_FALSE;
 	} else {
-		search = ISC_LIST_NEXT(query->lookup->origin, link);
-		if (search == NULL && query->lookup->done_as_is)
+		search = ISC_LIST_NEXT(oldlookup->origin, link);
+		if (search == NULL && oldlookup->done_as_is)
 			return (ISC_FALSE);
-		lookup = requeue_lookup(query->lookup, ISC_TRUE);
-		lookup->origin = search;
+		newlookup = requeue_lookup(oldlookup, ISC_TRUE);
+		newlookup->origin = search;
 	}
-	cancel_lookup(query->lookup);
+	cancel_lookup(oldlookup);
 	return (ISC_TRUE);
 }
 
@@ -2059,7 +2081,6 @@ insert_soa(dig_lookup_t *lookup) {
 	ISC_LIST_INIT(rdatalist->rdata);
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 
-	dns_rdataset_init(rdataset);
 	dns_rdatalist_tordataset(rdatalist, rdataset);
 
 	result = dns_message_gettempname(lookup->sendmsg, &soaname);
@@ -2073,10 +2094,10 @@ insert_soa(dig_lookup_t *lookup) {
 
 #ifdef ISC_PLATFORM_USESIT
 static void
-compute_cookie(unsigned char *cookie, size_t len) {
+compute_cookie(unsigned char *clientcookie, size_t len) {
 	/* XXXMPA need to fix, should be per server. */
 	INSIST(len >= 8U);
-	memmove(cookie, cookie_secret, 8);
+	memmove(clientcookie, cookie_secret, 8);
 }
 #endif
 
@@ -2086,7 +2107,7 @@ compute_cookie(unsigned char *cookie, size_t len) {
  * well as the query structures and buffer space for the replies.  If the
  * server list is empty, clone it from the system default list.
  */
-void
+isc_boolean_t
 setup_lookup(dig_lookup_t *lookup) {
 	isc_result_t result;
 	isc_uint32_t id;
@@ -2216,20 +2237,35 @@ setup_lookup(dig_lookup_t *lookup) {
 		if (lookup->trace && lookup->trace_root) {
 			dns_name_clone(dns_rootname, lookup->name);
 		} else {
+			dns_fixedname_t fixed;
+			dns_name_t *name;
+
+			dns_fixedname_init(&fixed);
+			name = dns_fixedname_name(&fixed);
 			len = strlen(lookup->textname);
 			isc_buffer_init(&b, lookup->textname, len);
 			isc_buffer_add(&b, len);
-			result = dns_name_fromtext(lookup->name, &b,
-						   lookup->oname, 0,
-						   &lookup->namebuf);
-		}
-		if (result != ISC_R_SUCCESS) {
-			dns_message_puttempname(lookup->sendmsg,
-						&lookup->name);
-			dns_message_puttempname(lookup->sendmsg,
-						&lookup->oname);
-			fatal("'%s' is not in legal name syntax (%s)",
-			      lookup->textname, isc_result_totext(result));
+			result = dns_name_fromtext(name, &b, NULL, 0, NULL);
+			if (result == ISC_R_SUCCESS &&
+			    !dns_name_isabsolute(name))
+				result = dns_name_concatenate(name,
+							      lookup->oname,
+							      lookup->name,
+							      &lookup->namebuf);
+			else if (result == ISC_R_SUCCESS)
+				result = dns_name_copy(name, lookup->name,
+						       &lookup->namebuf);
+			if (result != ISC_R_SUCCESS) {
+				dns_message_puttempname(lookup->sendmsg,
+							&lookup->name);
+				dns_message_puttempname(lookup->sendmsg,
+							&lookup->oname);
+				if (result == DNS_R_NAMETOOLONG)
+					return (ISC_FALSE);
+				fatal("'%s' is not in legal name syntax (%s)",
+				      lookup->textname,
+				      isc_result_totext(result));
+			}
 		}
 		dns_message_puttempname(lookup->sendmsg, &lookup->oname);
 	} else
@@ -2258,7 +2294,6 @@ setup_lookup(dig_lookup_t *lookup) {
 		if (result != ISC_R_SUCCESS) {
 			dns_message_puttempname(lookup->sendmsg,
 						&lookup->name);
-			isc_buffer_init(&b, store, MXNAME);
 			fatal("'%s' is not a legal name "
 			      "(%s)", lookup->textname,
 			      isc_result_totext(result));
@@ -2376,7 +2411,6 @@ setup_lookup(dig_lookup_t *lookup) {
 			struct sockaddr_in *sin;
 			struct sockaddr_in6 *sin6;
 			size_t addrl;
-			isc_buffer_t b;
 
 			sa = &lookup->ecs_addr->type.sa;
 			prefixlen = lookup->ecs_addr->length;
@@ -2416,8 +2450,6 @@ setup_lookup(dig_lookup_t *lookup) {
 			INSIST(i < DNS_EDNSOPTIONS);
 			opts[i].code = DNS_OPT_SIT;
 			if (lookup->sitvalue != NULL) {
-				isc_buffer_t b;
-
 				isc_buffer_init(&b, sitbuf, sizeof(sitbuf));
 				result = isc_hex_decodestring(lookup->sitvalue,
 							      &b);
@@ -2515,6 +2547,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		printmessage(ISC_LIST_HEAD(lookup->q), lookup->sendmsg,
 			     ISC_TRUE);
 	}
+	return (ISC_TRUE);
 }
 
 /*%
@@ -3103,7 +3136,8 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		query->waiting_connect = ISC_FALSE;
 		isc_event_free(&event);
 		l = query->lookup;
-		if (l->current_query != NULL)
+		if ((l->current_query != NULL) &&
+		    (ISC_LINK_LINKED(l->current_query, link)))
 			next = ISC_LIST_NEXT(l->current_query, link);
 		else
 			next = NULL;
@@ -3379,6 +3413,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	INSIST(recvcount >= 0);
 
 	query = event->ev_arg;
+	TIME_NOW(&query->time_recv);
 	debug("lookup=%p, query=%p", query->lookup, query);
 
 	l = query->lookup;
@@ -3713,7 +3748,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	if (!l->doing_xfr || l->xfr_q == query) {
 		if (msg->rcode == dns_rcode_nxdomain &&
 		    (l->origin != NULL || l->need_search)) {
-			if (!next_origin(query) || showsearch) {
+			if (!next_origin(query->lookup) || showsearch) {
 				printmessage(query, msg, ISC_TRUE);
 				received(b->used, &sevent->address, query);
 			}
@@ -3723,7 +3758,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 #endif
 				printmessage(query, msg, ISC_TRUE);
 		} else if (l->trace) {
-			int n = 0;
+			int nl = 0;
 			int count = msg->counts[DNS_SECTION_ANSWER];
 
 			debug("in TRACE code");
@@ -3734,13 +3769,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			if (l->trace_root || (l->ns_search_only && count > 0)) {
 				if (!l->trace_root)
 					l->rdtype = dns_rdatatype_soa;
-				n = followup_lookup(msg, query,
-						    DNS_SECTION_ANSWER);
+				nl = followup_lookup(msg, query,
+						     DNS_SECTION_ANSWER);
 				l->trace_root = ISC_FALSE;
 			} else if (count == 0)
-				n = followup_lookup(msg, query,
-						    DNS_SECTION_AUTHORITY);
-			if (n == 0)
+				nl = followup_lookup(msg, query,
+						     DNS_SECTION_AUTHORITY);
+			if (nl == 0)
 				docancel = ISC_TRUE;
 		} else {
 			debug("in NSSEARCH code");
@@ -3749,12 +3784,12 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				/*
 				 * This is the initial NS query.
 				 */
-				int n;
+				int nl;
 
 				l->rdtype = dns_rdatatype_soa;
-				n = followup_lookup(msg, query,
-						    DNS_SECTION_ANSWER);
-				if (n == 0)
+				nl = followup_lookup(msg, query,
+						     DNS_SECTION_ANSWER);
+				if (nl == 0)
 					docancel = ISC_TRUE;
 				l->trace_root = ISC_FALSE;
 				usesearch = ISC_FALSE;
@@ -3884,12 +3919,12 @@ recv_done(isc_task_t *task, isc_event_t *event) {
  * routines, since they may be using a non-DNS system for these lookups.
  */
 isc_result_t
-get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
+get_address(char *host, in_port_t myport, isc_sockaddr_t *sockaddr) {
 	int count;
 	isc_result_t result;
 
 	isc_app_block();
-	result = bind9_getaddresses(host, port, sockaddr, 1, &count);
+	result = bind9_getaddresses(host, myport, sockaddr, 1, &count);
 	isc_app_unblock();
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -4356,6 +4391,9 @@ chase_scanname_section(dns_message_t *msg, dns_name_t *name,
 	dns_rdataset_t *rdataset;
 	dns_name_t *msg_name = NULL;
 
+	if (msg->counts[section] == 0)
+		return (NULL);
+
 	do {
 		dns_message_currentname(msg, section, &msg_name);
 		if (dns_name_compare(msg_name, name) == 0) {
@@ -4562,8 +4600,8 @@ get_trusted_key(isc_mem_t *mctx)
 	dns_rdatacallbacks_init_stdio(&callbacks);
 	callbacks.add = insert_trustedkey;
 	return (dns_master_loadfile(filename, dns_rootname, dns_rootname,
-				    current_lookup->rdclass, 0, &callbacks,
-				    mctx));
+				    current_lookup->rdclass, DNS_MASTER_NOTTL,
+				    &callbacks, mctx));
 }
 
 
@@ -4763,36 +4801,36 @@ child_of_zone(dns_name_t * name, dns_name_t * zone_name,
 }
 
 isc_result_t
-grandfather_pb_test(dns_name_t *zone_name, dns_rdataset_t  *sigrdataset)
-{
-	isc_result_t result;
-	dns_rdata_t sigrdata = DNS_RDATA_INIT;
+grandfather_pb_test(dns_name_t *zone_name, dns_rdataset_t  *sigrdataset) {
 	dns_rdata_sig_t siginfo;
+	dns_rdataset_t mysigrdataset;
+	isc_result_t result;
 
-	result = dns_rdataset_first(sigrdataset);
+	dns_rdataset_init(&mysigrdataset);
+	dns_rdataset_clone(sigrdataset, &mysigrdataset);
+
+	result = dns_rdataset_first(&mysigrdataset);
 	check_result(result, "empty RRSIG dataset");
-	dns_rdata_init(&sigrdata);
 
 	do {
-		dns_rdataset_current(sigrdataset, &sigrdata);
+		dns_rdata_t sigrdata = DNS_RDATA_INIT;
+
+		dns_rdataset_current(&mysigrdataset, &sigrdata);
 
 		result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
 		check_result(result, "sigrdata tostruct siginfo");
 
 		if (dns_name_compare(&siginfo.signer, zone_name) == 0) {
-			dns_rdata_freestruct(&siginfo);
-			dns_rdata_reset(&sigrdata);
-			return (ISC_R_SUCCESS);
+			result = ISC_R_SUCCESS;
+			goto cleanup;
 		}
+	} while (dns_rdataset_next(&mysigrdataset) == ISC_R_SUCCESS);
 
-		dns_rdata_freestruct(&siginfo);
-		dns_rdata_reset(&sigrdata);
+	result = ISC_R_FAILURE;
+cleanup:
+	dns_rdataset_disassociate(&mysigrdataset);
 
-	} while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);
-
-	dns_rdata_reset(&sigrdata);
-
-	return (ISC_R_FAILURE);
+	return (result);
 }
 
 
@@ -4872,26 +4910,30 @@ contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
 		     dns_rdataset_t *sigrdataset,
 		     isc_mem_t *mctx)
 {
-	isc_result_t result;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_rdataset_t myrdataset;
 	dst_key_t *dnsseckey = NULL;
 	int i;
+	isc_result_t result;
 
 	if (name == NULL || rdataset == NULL)
 		return (ISC_R_FAILURE);
 
-	result = dns_rdataset_first(rdataset);
+	dns_rdataset_init(&myrdataset);
+	dns_rdataset_clone(rdataset, &myrdataset);
+
+	result = dns_rdataset_first(&myrdataset);
 	check_result(result, "empty rdataset");
 
 	do {
-		dns_rdataset_current(rdataset, &rdata);
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+
+		dns_rdataset_current(&myrdataset, &rdata);
 		INSIST(rdata.type == dns_rdatatype_dnskey);
 
 		result = dns_dnssec_keyfromrdata(name, &rdata,
 						 mctx, &dnsseckey);
 		check_result(result, "dns_dnssec_keyfromrdata");
 
-
 		for (i = 0; i < tk_list.nb_tk; i++) {
 			if (dst_key_compare(tk_list.key[i], dnsseckey)
 			    == ISC_TRUE) {
@@ -4900,22 +4942,21 @@ contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
 				printf(";; Ok, find a Trusted Key in the "
 				       "DNSKEY RRset: %d\n",
 				       dst_key_id(dnsseckey));
-				if (sigchase_verify_sig_key(name, rdataset,
-							    dnsseckey,
-							    sigrdataset,
-							    mctx)
-				    == ISC_R_SUCCESS) {
-					dst_key_free(&dnsseckey);
-					dnsseckey = NULL;
-					return (ISC_R_SUCCESS);
-				}
+				result = sigchase_verify_sig_key(name, rdataset,
+								 dnsseckey,
+								 sigrdataset,
+								 mctx);
+				if (result == ISC_R_SUCCESS)
+					goto cleanup;
 			}
 		}
+		dst_key_free(&dnsseckey);
+	} while (dns_rdataset_next(&myrdataset) == ISC_R_SUCCESS);
 
-		dns_rdata_reset(&rdata);
-		if (dnsseckey != NULL)
-			dst_key_free(&dnsseckey);
-	} while (dns_rdataset_next(rdataset) == ISC_R_SUCCESS);
+cleanup:
+	if (dnsseckey != NULL)
+		dst_key_free(&dnsseckey);
+	dns_rdataset_disassociate(&myrdataset);
 
 	return (ISC_R_NOTFOUND);
 }
@@ -4926,16 +4967,20 @@ sigchase_verify_sig(dns_name_t *name, dns_rdataset_t *rdataset,
 		    dns_rdataset_t *sigrdataset,
 		    isc_mem_t *mctx)
 {
-	isc_result_t result;
-	dns_rdata_t keyrdata = DNS_RDATA_INIT;
+	dns_rdataset_t mykeyrdataset;
 	dst_key_t *dnsseckey = NULL;
+	isc_result_t result;
 
-	result = dns_rdataset_first(keyrdataset);
+	dns_rdataset_init(&mykeyrdataset);
+	dns_rdataset_clone(keyrdataset, &mykeyrdataset);
+
+	result = dns_rdataset_first(&mykeyrdataset);
 	check_result(result, "empty DNSKEY dataset");
-	dns_rdata_init(&keyrdata);
 
 	do {
-		dns_rdataset_current(keyrdataset, &keyrdata);
+		dns_rdata_t keyrdata = DNS_RDATA_INIT;
+
+		dns_rdataset_current(&mykeyrdataset, &keyrdata);
 		INSIST(keyrdata.type == dns_rdatatype_dnskey);
 
 		result = dns_dnssec_keyfromrdata(name, &keyrdata,
@@ -4944,18 +4989,19 @@ sigchase_verify_sig(dns_name_t *name, dns_rdataset_t *rdataset,
 
 		result = sigchase_verify_sig_key(name, rdataset, dnsseckey,
 						 sigrdataset, mctx);
-		if (result == ISC_R_SUCCESS) {
-			dns_rdata_reset(&keyrdata);
-			dst_key_free(&dnsseckey);
-			return (ISC_R_SUCCESS);
-		}
+		if (result == ISC_R_SUCCESS)
+			goto cleanup;
 		dst_key_free(&dnsseckey);
-		dns_rdata_reset(&keyrdata);
-	} while (dns_rdataset_next(chase_keyrdataset) == ISC_R_SUCCESS);
+	} while (dns_rdataset_next(&mykeyrdataset) == ISC_R_SUCCESS);
 
-	dns_rdata_reset(&keyrdata);
+	result = ISC_R_NOTFOUND;
 
-	return (ISC_R_NOTFOUND);
+ cleanup:
+	if (dnsseckey != NULL)
+		dst_key_free(&dnsseckey);
+	dns_rdataset_disassociate(&mykeyrdataset);
+
+	return (result);
 }
 
 isc_result_t
@@ -4963,16 +5009,23 @@ sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
 			dst_key_t *dnsseckey, dns_rdataset_t *sigrdataset,
 			isc_mem_t *mctx)
 {
-	isc_result_t result;
-	dns_rdata_t sigrdata = DNS_RDATA_INIT;
 	dns_rdata_sig_t siginfo;
+	dns_rdataset_t myrdataset;
+	dns_rdataset_t mysigrdataset;
+	isc_result_t result;
 
-	result = dns_rdataset_first(sigrdataset);
+	dns_rdataset_init(&myrdataset);
+	dns_rdataset_clone(rdataset, &myrdataset);
+	dns_rdataset_init(&mysigrdataset);
+	dns_rdataset_clone(sigrdataset, &mysigrdataset);
+
+	result = dns_rdataset_first(&mysigrdataset);
 	check_result(result, "empty RRSIG dataset");
-	dns_rdata_init(&sigrdata);
 
 	do {
-		dns_rdataset_current(sigrdataset, &sigrdata);
+		dns_rdata_t sigrdata = DNS_RDATA_INIT;
+
+		dns_rdataset_current(&mysigrdataset, &sigrdata);
 
 		result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
 		check_result(result, "sigrdata tostruct siginfo");
@@ -4983,10 +5036,10 @@ sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
 		 */
 		if (siginfo.keyid == dst_key_id(dnsseckey)) {
 
-			result = dns_rdataset_first(rdataset);
+			result = dns_rdataset_first(&myrdataset);
 			check_result(result, "empty DS dataset");
 
-			result = dns_dnssec_verify(name, rdataset, dnsseckey,
+			result = dns_dnssec_verify(name, &myrdataset, dnsseckey,
 						   ISC_FALSE, mctx, &sigrdata);
 
 			printf(";; VERIFYING ");
@@ -4996,19 +5049,18 @@ sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
 			printf(" with DNSKEY:%d: %s\n", dst_key_id(dnsseckey),
 			       isc_result_totext(result));
 
-			if (result == ISC_R_SUCCESS) {
-				dns_rdata_reset(&sigrdata);
-				return (result);
-			}
+			if (result == ISC_R_SUCCESS)
+				goto cleanup;
 		}
-		dns_rdata_freestruct(&siginfo);
-		dns_rdata_reset(&sigrdata);
+	} while (dns_rdataset_next(&mysigrdataset) == ISC_R_SUCCESS);
 
-	} while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);
+	result = ISC_R_NOTFOUND;
 
-	dns_rdata_reset(&sigrdata);
+ cleanup:
+	dns_rdataset_disassociate(&myrdataset);
+	dns_rdataset_disassociate(&mysigrdataset);
 
-	return (ISC_R_NOTFOUND);
+	return (result);
 }
 
 
@@ -5016,27 +5068,35 @@ isc_result_t
 sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 		   dns_rdataset_t *dsrdataset, isc_mem_t *mctx)
 {
-	isc_result_t result;
-	dns_rdata_t keyrdata = DNS_RDATA_INIT;
-	dns_rdata_t newdsrdata = DNS_RDATA_INIT;
-	dns_rdata_t dsrdata = DNS_RDATA_INIT;
 	dns_rdata_ds_t dsinfo;
+	dns_rdataset_t mydsrdataset;
+	dns_rdataset_t mykeyrdataset;
 	dst_key_t *dnsseckey = NULL;
+	isc_result_t result;
 	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
 
-	result = dns_rdataset_first(dsrdataset);
+	dns_rdataset_init(&mydsrdataset);
+	dns_rdataset_clone(dsrdataset, &mydsrdataset);
+	dns_rdataset_init(&mykeyrdataset);
+	dns_rdataset_clone(keyrdataset, &mykeyrdataset);
+
+	result = dns_rdataset_first(&mydsrdataset);
 	check_result(result, "empty DSset dataset");
 	do {
-		dns_rdataset_current(dsrdataset, &dsrdata);
+		dns_rdata_t dsrdata = DNS_RDATA_INIT;
+
+		dns_rdataset_current(&mydsrdataset, &dsrdata);
 
 		result = dns_rdata_tostruct(&dsrdata, &dsinfo, NULL);
 		check_result(result, "dns_rdata_tostruct for DS");
 
-		result = dns_rdataset_first(keyrdataset);
+		result = dns_rdataset_first(&mykeyrdataset);
 		check_result(result, "empty KEY dataset");
 
 		do {
-			dns_rdataset_current(keyrdataset, &keyrdata);
+			dns_rdata_t keyrdata = DNS_RDATA_INIT;
+
+			dns_rdataset_current(&mykeyrdataset, &keyrdata);
 			INSIST(keyrdata.type == dns_rdatatype_dnskey);
 
 			result = dns_dnssec_keyfromrdata(name, &keyrdata,
@@ -5048,6 +5108,7 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 			 * id of DNSKEY referenced by the DS
 			 */
 			if (dsinfo.key_tag == dst_key_id(dnsseckey)) {
+				dns_rdata_t newdsrdata = DNS_RDATA_INIT;
 
 				result = dns_ds_buildrdata(name, &keyrdata,
 							   dsinfo.digest_type,
@@ -5055,14 +5116,9 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 				dns_rdata_freestruct(&dsinfo);
 
 				if (result != ISC_R_SUCCESS) {
-					dns_rdata_reset(&keyrdata);
-					dns_rdata_reset(&newdsrdata);
-					dns_rdata_reset(&dsrdata);
-					dst_key_free(&dnsseckey);
-					dns_rdata_freestruct(&dsinfo);
 					printf("Oops: impossible to build"
 					       " new DS rdata\n");
-					return (result);
+					goto cleanup;
 				}
 
 
@@ -5079,34 +5135,26 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 							 dnsseckey,
 							 chase_sigkeyrdataset,
 							 mctx);
-					if (result ==  ISC_R_SUCCESS) {
-						dns_rdata_reset(&keyrdata);
-						dns_rdata_reset(&newdsrdata);
-						dns_rdata_reset(&dsrdata);
-						dst_key_free(&dnsseckey);
-
-						return (result);
-					}
+					if (result ==  ISC_R_SUCCESS)
+						goto cleanup;
 				} else {
 					printf(";; This DS is NOT the DS for"
 					       " the chasing KEY: FAILED\n");
 				}
-
-				dns_rdata_reset(&newdsrdata);
 			}
 			dst_key_free(&dnsseckey);
-			dns_rdata_reset(&keyrdata);
-			dnsseckey = NULL;
-		} while (dns_rdataset_next(chase_keyrdataset) == ISC_R_SUCCESS);
-		dns_rdata_reset(&dsrdata);
+		} while (dns_rdataset_next(&mykeyrdataset) == ISC_R_SUCCESS);
+	} while (dns_rdataset_next(&mydsrdataset) == ISC_R_SUCCESS);
 
-	} while (dns_rdataset_next(chase_dsrdataset) == ISC_R_SUCCESS);
+	result = ISC_R_NOTFOUND;
 
-	dns_rdata_reset(&keyrdata);
-	dns_rdata_reset(&newdsrdata);
-	dns_rdata_reset(&dsrdata);
+ cleanup:
+	if (dnsseckey != NULL)
+		dst_key_free(&dnsseckey);
+	dns_rdataset_disassociate(&mydsrdataset);
+	dns_rdataset_disassociate(&mykeyrdataset);
 
-	return (ISC_R_NOTFOUND);
+	return (result);
 }
 
 /*
@@ -5154,6 +5202,20 @@ sigchase_td(dns_message_t *msg)
 	isc_boolean_t have_answer = ISC_FALSE;
 	isc_boolean_t true = ISC_TRUE;
 
+	if (msg->rcode != dns_rcode_noerror &&
+	    msg->rcode != dns_rcode_nxdomain) {
+		char buf[20];
+		isc_buffer_t b;
+
+		isc_buffer_init(&b, buf, sizeof(buf));
+		result = dns_rcode_totext(msg->rcode, &b);
+		check_result(result, "dns_rcode_totext failed");
+		printf("error response code %.*s\n",
+		       (int)isc_buffer_usedlength(&b), buf);
+		error_message = msg;
+		return;
+	}
+
 	if ((result = dns_message_firstname(msg, DNS_SECTION_ANSWER))
 	    == ISC_R_SUCCESS) {
 		dns_message_currentname(msg, DNS_SECTION_ANSWER, &name);
@@ -5166,10 +5228,13 @@ sigchase_td(dns_message_t *msg)
 		if (!current_lookup->trace_root_sigchase) {
 			result = dns_message_firstname(msg,
 						       DNS_SECTION_AUTHORITY);
-			if (result == ISC_R_SUCCESS)
-				dns_message_currentname(msg,
-							DNS_SECTION_AUTHORITY,
-							&name);
+			if (result != ISC_R_SUCCESS) {
+				printf("no answer or authority section\n");
+				error_message = msg;
+				return;
+			}
+			dns_message_currentname(msg, DNS_SECTION_AUTHORITY,
+						&name);
 			chase_nsrdataset
 				= chase_scanname_section(msg, name,
 							 dns_rdatatype_ns,
@@ -5179,7 +5244,7 @@ sigchase_td(dns_message_t *msg)
 			if (chase_nsrdataset != NULL) {
 				have_delegation_ns = ISC_TRUE;
 				printf("no response but there is a delegation"
-				       " in authority section:");
+				       " in authority section: ");
 				dns_name_print(name, stdout);
 				printf("\n");
 			} else {
@@ -5306,7 +5371,7 @@ sigchase_td(dns_message_t *msg)
 			dns_name_t tmp_name;
 
 			printf("\n;; We are in a Grand Father Problem:"
-			       " See 2.2.1 in RFC 3568\n");
+			       " See 2.2.1 in RFC 3658\n");
 			chase_rdataset = NULL;
 			chase_sigrdataset = NULL;
 			have_response = ISC_FALSE;
@@ -5589,7 +5654,7 @@ getneededrr(dns_message_t *msg)
 					   dns_rdatatype_dnskey,
 					   &chase_sigkeylookedup);
 		if (result == ISC_R_FAILURE) {
-			printf("\n;; RRSIG for DNSKEY  is missing  to continue"
+			printf("\n;; RRSIG for DNSKEY is missing  to continue"
 			       " validation : FAILED\n\n");
 			free_name(&chase_signame, mctx);
 			if (dns_name_dynamic(&chase_name))
@@ -5609,9 +5674,8 @@ getneededrr(dns_message_t *msg)
 
 	if (chase_dsrdataset == NULL) {
 		result = advanced_rrsearch(&chase_dsrdataset, &chase_signame,
-					   dns_rdatatype_ds,
-					   dns_rdatatype_any,
-		&chase_dslookedup);
+					   dns_rdatatype_ds, dns_rdatatype_any,
+					   &chase_dslookedup);
 		if (result == ISC_R_FAILURE) {
 			printf("\n;; WARNING There is no DS for the zone: ");
 			dns_name_print(&chase_signame, stdout);
@@ -5899,7 +5963,6 @@ prove_nx_domain(dns_message_t *msg,
 		     result = dns_rdataset_next(nsecset)) {
 			dns_rdataset_current(nsecset, &nsec);
 
-
 			signsecset
 				= chase_scanname_section(msg, nsecname,
 						 dns_rdatatype_rrsig,

bin/dig/host.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -165,7 +165,7 @@ show_usage(void) {
 "       -4 use IPv4 query transport only\n"
 "       -6 use IPv6 query transport only\n"
 "       -m set memory debugging flag (trace|record|usage)\n"
-"       -v print version number and exit\n", stderr);
+"       -V print version number and exit\n", stderr);
 	exit(1);
 }
 
@@ -255,7 +255,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 	isc_result_t result, loopresult;
 	isc_region_t r;
 	dns_name_t empty_name;
-	char t[4096];
+	char tbuf[4096];
 	isc_boolean_t first;
 	isc_boolean_t no_rdata;
 
@@ -279,7 +279,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		name = NULL;
 		dns_message_currentname(msg, sectionid, &name);
 
-		isc_buffer_init(&target, t, sizeof(t));
+		isc_buffer_init(&target, tbuf, sizeof(tbuf));
 		first = ISC_TRUE;
 		print_name = name;
 
@@ -370,13 +370,13 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset, dns_name_t *owner,
 	isc_buffer_t target;
 	isc_result_t result;
 	isc_region_t r;
-	char t[4096];
+	char tbuf[4096];
 
 	UNUSED(msg);
 	if (headers)
 		printf(";; %s SECTION:\n", set_name);
 
-	isc_buffer_init(&target, t, sizeof(t));
+	isc_buffer_init(&target, tbuf, sizeof(tbuf));
 
 	result = dns_rdataset_totext(rdataset, owner, ISC_FALSE, ISC_FALSE,
 				     &target);
@@ -765,6 +765,9 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			if (!lookup->rdtypeset ||
 			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = dns_rdatatype_any;
+#ifdef WITH_IDN
+			idnoptions = 0;
+#endif
 			list_type = dns_rdatatype_any;
 			list_addresses = ISC_FALSE;
 			lookup->rdtypeset = ISC_TRUE;

bin/dig/host.html

@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">host</code>  [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-v</code>] [<code class="option">-V</code>] {name} [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543446"></a><h2>DESCRIPTION</h2>
+<a name="id2543454"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">host</strong></span>
       is a simple utility for performing DNS lookups.
       It is normally used to convert names to IP addresses and vice versa.
@@ -188,7 +188,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543822"></a><h2>IDN SUPPORT</h2>
+<a name="id2543831"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">host</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names. 
@@ -202,12 +202,12 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543845"></a><h2>FILES</h2>
+<a name="id2543853"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543857"></a><h2>SEE ALSO</h2>
+<a name="id2543865"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
     </p>

bin/dig/include/dig/dig.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,8 +15,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dig.h,v 1.114 2011/12/07 17:23:28 each Exp $ */
-
 #ifndef DIG_H
 #define DIG_H
 
@@ -117,6 +115,7 @@ struct dig_lookup {
 		trace, /*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
 		tcp_mode,
+		tcp_mode_set,
 		ip6_int,
 		comments,
 		stats,
@@ -227,6 +226,7 @@ struct dig_query {
 	ISC_LINK(dig_query_t) clink;
 	isc_sockaddr_t sockaddr;
 	isc_time_t time_sent;
+	isc_time_t time_recv;
 	isc_uint64_t byte_count;
 	isc_buffer_t sendbuf;
 };
@@ -265,7 +265,6 @@ extern isc_boolean_t check_ra, have_ipv4, have_ipv6, specified_source,
 extern in_port_t port;
 extern unsigned int timeout;
 extern isc_mem_t *mctx;
-extern dns_messageid_t id;
 extern int sendcount;
 extern int ndots;
 extern int lookup_counter;
@@ -317,7 +316,7 @@ debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 void
 check_result(isc_result_t result, const char *msg);
 
-void
+isc_boolean_t
 setup_lookup(dig_lookup_t *lookup);
 
 void

bin/dig/nslookup.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -425,13 +425,12 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	puts("");
 
 	if (!short_form) {
-		isc_boolean_t headers = ISC_TRUE;
 		puts("------------");
 		/*		detailheader(query, msg);*/
-		detailsection(query, msg, headers, DNS_SECTION_QUESTION);
-		detailsection(query, msg, headers, DNS_SECTION_ANSWER);
-		detailsection(query, msg, headers, DNS_SECTION_AUTHORITY);
-		detailsection(query, msg, headers, DNS_SECTION_ADDITIONAL);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_QUESTION);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_ANSWER);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_AUTHORITY);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_ADDITIONAL);
 		puts("------------");
 	}
 

bin/dig/nslookup.html

@@ -21,7 +21,7 @@
 <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2476275"></a><div class="titlepage"></div>
+<a name="id2476283"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>nslookup &#8212; query Internet name servers interactively</p>
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">nslookup</code>  [<code class="option">-option</code>] [name | -] [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543433"></a><h2>DESCRIPTION</h2>
+<a name="id2543442"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">Nslookup</strong></span>
       is a program to query Internet domain name servers.  <span><strong class="command">Nslookup</strong></span>
       has two modes: interactive and non-interactive.  Interactive mode allows
@@ -43,7 +43,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543449"></a><h2>ARGUMENTS</h2>
+<a name="id2543458"></a><h2>ARGUMENTS</h2>
 <p>
       Interactive mode is entered in the following cases:
       </p>
@@ -83,7 +83,7 @@ nslookup -query=hinfo  -timeout=10
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543504"></a><h2>INTERACTIVE COMMANDS</h2>
+<a name="id2543512"></a><h2>INTERACTIVE COMMANDS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">host</code> [<span class="optional">server</span>]</span></dt>
 <dd>
@@ -299,19 +299,19 @@ nslookup -query=hinfo  -timeout=10
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2546317"></a><h2>FILES</h2>
+<a name="id2546326"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2546329"></a><h2>SEE ALSO</h2>
+<a name="id2546338"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2546363"></a><h2>Author</h2>
+<a name="id2546372"></a><h2>Author</h2>
 <p>
       Andrew Cherenson
     </p>

bin/dnssec/dnssec-dsfromkey.8

@@ -35,6 +35,8 @@ dnssec\-dsfromkey \- DNSSEC DS RR generation tool
 \fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] {keyfile}
 .HP 17
 \fBdnssec\-dsfromkey\fR {\-s} [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-A\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {dnsname}
+.HP 17
+\fBdnssec\-dsfromkey\fR [\fB\-h\fR] [\fB\-V\fR]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-dsfromkey\fR
@@ -113,6 +115,16 @@ Specifies the DNS class (default is IN). Useful only in keyset or zone file mode
 .RS 4
 Sets the debugging level.
 .RE
+.PP
+\-h
+.RS 4
+Prints usage information.
+.RE
+.PP
+\-V
+.RS 4
+Prints version information.
+.RE
 .SH "EXAMPLE"
 .PP
 To build the SHA\-256 DS RR from the

bin/dnssec/dnssec-dsfromkey.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,8 +14,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-dsfromkey.c,v 1.24.114.1 2012/02/07 00:44:12 each Exp $ */
-
 /*! \file */
 
 #include <config.h>
@@ -67,6 +65,7 @@ static dns_fixedname_t	fixed;
 static dns_name_t	*name = NULL;
 static isc_mem_t	*mctx = NULL;
 static isc_uint32_t	ttl;
+static isc_boolean_t	emitttl = ISC_FALSE;
 
 static isc_result_t
 initname(char *setname) {
@@ -301,7 +300,7 @@ emit(unsigned int dtype, isc_boolean_t showall, char *lookaside,
 	isc_buffer_usedregion(&nameb, &r);
 	printf("%.*s ", (int)r.length, r.base);
 
-	if (ttl != 0U)
+	if (emitttl)
 		printf("%u ", ttl);
 
 	isc_buffer_usedregion(&classb, &r);
@@ -330,6 +329,7 @@ usage(void) {
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "Options:\n");
 	fprintf(stderr, "    -v <verbose level>\n");
+	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "    -K <directory>: directory in which to find "
 			"key file or keyset file\n");
 	fprintf(stderr, "    -a algorithm: digest algorithm "
@@ -382,7 +382,7 @@ main(int argc, char **argv) {
 	isc_commandline_errprint = ISC_FALSE;
 
 	while ((ch = isc_commandline_parse(argc, argv,
-					   "12Aa:c:d:Ff:K:l:sT:v:h")) != -1) {
+					   "12Aa:c:d:Ff:K:l:sT:v:hV")) != -1) {
 		switch (ch) {
 		case '1':
 			dtype = DNS_DSDIGEST_SHA1;
@@ -423,6 +423,7 @@ main(int argc, char **argv) {
 			usekeyset = ISC_TRUE;
 			break;
 		case 'T':
+			emitttl = ISC_TRUE;
 			ttl = atol(isc_commandline_argument);
 			break;
 		case 'v':
@@ -439,8 +440,13 @@ main(int argc, char **argv) {
 					program, isc_commandline_option);
 			/* FALLTHROUGH */
 		case 'h':
+			/* Does not return. */
 			usage();
 
+		case 'V':
+			/* Does not return. */
+			version(program);
+
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n",
 				program, isc_commandline_option);
@@ -492,7 +498,7 @@ main(int argc, char **argv) {
 		      isc_result_totext(result));
 	isc_entropy_stopcallbacksources(ectx);
 
-	setup_logging(verbose, mctx, &log);
+	setup_logging(mctx, &log);
 
 	dns_rdataset_init(&rdataset);
 

bin/dnssec/dnssec-dsfromkey.docbook

@@ -72,6 +72,11 @@
       <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
       <arg choice="req">dnsname</arg>
    </cmdsynopsis>
+    <cmdsynopsis>
+      <command>dnssec-dsfromkey</command>
+      <arg><option>-h</option></arg>
+      <arg><option>-V</option></arg>
+   </cmdsynopsis>
   </refsynopsisdiv>
 
   <refsect1>
@@ -210,6 +215,24 @@
           </para>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term>-h</term>
+        <listitem>
+          <para>
+            Prints usage information.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>-V</term>
+        <listitem>
+          <para>
+            Prints version information.
+          </para>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>
 

bin/dnssec/dnssec-dsfromkey.html

@@ -30,16 +30,17 @@
 <h2>Synopsis</h2>
 <div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
 <div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543491"></a><h2>DESCRIPTION</h2>
+<a name="id2543514"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-dsfromkey</strong></span>
       outputs the Delegation Signer (DS) resource record (RR), as defined in
       RFC 3658 and RFC 4509, for the given key(s).
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543502"></a><h2>OPTIONS</h2>
+<a name="id2543526"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-1</span></dt>
 <dd><p>
@@ -113,10 +114,18 @@
 <dd><p>
             Sets the debugging level.
           </p></dd>
+<dt><span class="term">-h</span></dt>
+<dd><p>
+            Prints usage information.
+          </p></dd>
+<dt><span class="term">-V</span></dt>
+<dd><p>
+            Prints version information.
+          </p></dd>
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543729"></a><h2>EXAMPLE</h2>
+<a name="id2543780"></a><h2>EXAMPLE</h2>
 <p>
       To build the SHA-256 DS RR from the
       <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
@@ -131,7 +140,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543758"></a><h2>FILES</h2>
+<a name="id2543810"></a><h2>FILES</h2>
 <p>
       The keyfile can be designed by the key identification
       <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
@@ -145,13 +154,13 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543794"></a><h2>CAVEAT</h2>
+<a name="id2543845"></a><h2>CAVEAT</h2>
 <p>
       A keyfile error can give a "file not found" even if the file exists.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543803"></a><h2>SEE ALSO</h2>
+<a name="id2543854"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -161,7 +170,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543843"></a><h2>AUTHOR</h2>
+<a name="id2543894"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/dnssec/dnssec-importkey.8

@@ -32,9 +32,9 @@
 dnssec\-importkey \- Import DNSKEY records from external systems so they can be managed.
 .SH "SYNOPSIS"
 .HP 17
-\fBdnssec\-importkey\fR [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {\fBkeyfile\fR}
+\fBdnssec\-importkey\fR [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] {\fBkeyfile\fR}
 .HP 17
-\fBdnssec\-importkey\fR {\fB\-f\ \fR\fB\fIfilename\fR\fR} [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fBdnsname\fR]
+\fBdnssec\-importkey\fR {\fB\-f\ \fR\fB\fIfilename\fR\fR} [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fBdnsname\fR]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-importkey\fR
@@ -80,6 +80,11 @@ Emit usage message and exit.
 .RS 4
 Sets the debugging level.
 .RE
+.PP
+\-V
+.RS 4
+Prints version information.
+.RE
 .SH "TIMING OPTIONS"
 .PP
 Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'.

bin/dnssec/dnssec-importkey.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2013-2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -273,6 +273,7 @@ usage(void) {
 				"the key files\n");
 	fprintf(stderr, "    -L ttl:             set default key TTL\n");
 	fprintf(stderr, "    -v <verbose level>\n");
+	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "    -h: print usage and exit\n");
 	fprintf(stderr, "Timing options:\n");
 	fprintf(stderr, "    -P date/[+-]offset/none: set/unset key "
@@ -313,7 +314,7 @@ main(int argc, char **argv) {
 
 	isc_commandline_errprint = ISC_FALSE;
 
-#define CMDLINE_FLAGS "D:f:hK:L:P:v:"
+#define CMDLINE_FLAGS "D:f:hK:L:P:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case 'D':
@@ -353,8 +354,13 @@ main(int argc, char **argv) {
 					program, isc_commandline_option);
 			/* FALLTHROUGH */
 		case 'h':
+			/* Does not return. */
 			usage();
 
+		case 'V':
+			/* Does not return. */
+			version(program);
+
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n",
 				program, isc_commandline_option);
@@ -381,7 +387,7 @@ main(int argc, char **argv) {
 		      isc_result_totext(result));
 	isc_entropy_stopcallbacksources(ectx);
 
-	setup_logging(verbose, mctx, &log);
+	setup_logging(mctx, &log);
 
 	dns_rdataset_init(&rdataset);
 

bin/dnssec/dnssec-importkey.docbook

@@ -50,6 +50,7 @@
       <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg><option>-h</option></arg>
       <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg><option>-V</option></arg>
       <arg choice="req"><option>keyfile</option></arg>
     </cmdsynopsis>
     <cmdsynopsis>
@@ -61,6 +62,7 @@
       <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg><option>-h</option></arg>
       <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg><option>-V</option></arg>
       <arg><option>dnsname</option></arg>
     </cmdsynopsis>
   </refsynopsisdiv>
@@ -147,6 +149,15 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-V</term>
+        <listitem>
+	  <para>
+	    Prints version information.
+	  </para>
+        </listitem>
+      </varlistentry>
+
     </variablelist>
   </refsect1>
 

bin/dnssec/dnssec-importkey.html

@@ -29,11 +29,11 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {<code class="option">keyfile</code>}</p></div>
-<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>} [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">dnsname</code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] {<code class="option">keyfile</code>}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>} [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">dnsname</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543458"></a><h2>DESCRIPTION</h2>
+<a name="id2543475"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-importkey</strong></span>
       reads a public DNSKEY record and generates a pair of
       .key/.private files.  The DNSKEY record may be read from an
@@ -53,7 +53,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543483"></a><h2>OPTIONS</h2>
+<a name="id2543500"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-f <em class="replaceable"><code>filename</code></em></span></dt>
 <dd>
@@ -89,10 +89,14 @@
 <dd><p>
             Sets the debugging level.
           </p></dd>
+<dt><span class="term">-V</span></dt>
+<dd><p>
+	    Prints version information.
+	  </p></dd>
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543601"></a><h2>TIMING OPTIONS</h2>
+<a name="id2543632"></a><h2>TIMING OPTIONS</h2>
 <p>
       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -120,7 +124,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543648"></a><h2>FILES</h2>
+<a name="id2543678"></a><h2>FILES</h2>
 <p>
       A keyfile can be designed by the key identification
       <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
@@ -129,7 +133,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543669"></a><h2>SEE ALSO</h2>
+<a name="id2543700"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -137,7 +141,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543702"></a><h2>AUTHOR</h2>
+<a name="id2543733"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/dnssec/dnssec-keyfromlabel.8

@@ -32,7 +32,7 @@
 dnssec\-keyfromlabel \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP 20
-\fBdnssec\-keyfromlabel\fR {\-l\ \fIlabel\fR} [\fB\-3\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-k\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-y\fR] {name}
+\fBdnssec\-keyfromlabel\fR {\-l\ \fIlabel\fR} [\fB\-3\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-k\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-y\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keyfromlabel\fR
@@ -168,6 +168,11 @@ must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF.
 Sets the debugging level.
 .RE
 .PP
+\-V
+.RS 4
+Prints version information.
+.RE
+.PP
 \-y
 .RS 4
 Allows DNSSEC key files to be generated even if the key ID would collide with that of an existing key, in the event of either key being revoked. (This is only safe to use if you are sure you won't be using RFC 5011 trust anchor maintenance with either of the keys involved.)

bin/dnssec/dnssec-keyfromlabel.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,8 +14,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-keyfromlabel.c,v 1.38 2011/11/30 00:48:51 marka Exp $ */
-
 /*! \file */
 
 #include <config.h>
@@ -103,6 +101,7 @@ usage(void) {
 		"(default: AUTHCONF)\n");
 	fprintf(stderr, "    -y: permit keys that might collide\n");
 	fprintf(stderr, "    -v verbose level\n");
+	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "Date options:\n");
 	fprintf(stderr, "    -P date/[+-]offset: set key publication date\n");
 	fprintf(stderr, "    -A date/[+-]offset: set key activation date\n");
@@ -187,7 +186,7 @@ main(int argc, char **argv) {
 
 	isc_stdtime_get(&now);
 
-#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:y"
+#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 	    switch (ch) {
 		case '3':
@@ -310,8 +309,13 @@ main(int argc, char **argv) {
 					program, isc_commandline_option);
 			/* FALLTHROUGH */
 		case 'h':
+			/* Does not return. */
 			usage();
 
+		case 'V':
+			/* Does not return. */
+			version(program);
+
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n",
 				program, isc_commandline_option);
@@ -327,7 +331,7 @@ main(int argc, char **argv) {
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(ret));
 
-	setup_logging(verbose, mctx, &log);
+	setup_logging(mctx, &log);
 
 	if (predecessor == NULL) {
 		if (label == NULL)

bin/dnssec/dnssec-keyfromlabel.docbook

@@ -69,6 +69,7 @@
       <arg><option>-S <replaceable class="parameter">key</replaceable></option></arg>
       <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>
       <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg><option>-V</option></arg>
       <arg><option>-y</option></arg>
       <arg choice="req">name</arg>
     </cmdsynopsis>
@@ -334,6 +335,15 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-V</term>
+        <listitem>
+	  <para>
+	    Prints version information.
+	  </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-y</term>
         <listitem>

bin/dnssec/dnssec-keyfromlabel.html

@@ -28,10 +28,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code>  {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-y</code>] {name}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code>  {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543526"></a><h2>DESCRIPTION</h2>
+<a name="id2543539"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-keyfromlabel</strong></span>
       generates a key pair of files that referencing a key object stored
       in a cryptographic hardware service module (HSM).  The private key
@@ -47,7 +47,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543547"></a><h2>OPTIONS</h2>
+<a name="id2543560"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
@@ -209,6 +209,10 @@
 <dd><p>
             Sets the debugging level.
           </p></dd>
+<dt><span class="term">-V</span></dt>
+<dd><p>
+	    Prints version information.
+	  </p></dd>
 <dt><span class="term">-y</span></dt>
 <dd><p>
             Allows DNSSEC key files to be generated even if the key ID
@@ -220,7 +224,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544061"></a><h2>TIMING OPTIONS</h2>
+<a name="id2544020"></a><h2>TIMING OPTIONS</h2>
 <p>
       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -292,7 +296,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544251"></a><h2>GENERATED KEY FILES</h2>
+<a name="id2544278"></a><h2>GENERATED KEY FILES</h2>
 <p>
       When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes
       successfully,
@@ -331,7 +335,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544324"></a><h2>SEE ALSO</h2>
+<a name="id2544350"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -340,7 +344,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544361"></a><h2>AUTHOR</h2>
+<a name="id2544388"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/dnssec/dnssec-keygen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005, 2007-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -33,7 +33,7 @@
 dnssec\-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP 14
-\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-k\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-k\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-z\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -138,11 +138,11 @@ Deprecated in favor of \-T KEY.
 .PP
 \-L \fIttl\fR
 .RS 4
-Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. Setting the default TTL to
+Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL. Setting the default TTL to
 0
 or
 none
-removes it.
+is the same as leaving it unset.
 .RE
 .PP
 \-p \fIprotocol\fR
@@ -199,6 +199,11 @@ must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF.
 .RS 4
 Sets the debugging level.
 .RE
+.PP
+\-V
+.RS 4
+Prints version information.
+.RE
 .SH "TIMING OPTIONS"
 .PP
 Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'.
@@ -304,7 +309,7 @@ RFC 4034.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007\-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007\-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br

bin/dnssec/dnssec-keygen.c

@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -29,8 +29,6 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-keygen.c,v 1.120 2011/11/30 00:48:51 marka Exp $ */
-
 /*! \file */
 
 #include <config.h>
@@ -150,6 +148,7 @@ usage(void) {
 	fprintf(stderr, "    -m <memory debugging mode>:\n");
 	fprintf(stderr, "       usage | trace | record | size | mctx\n");
 	fprintf(stderr, "    -v <level>: set verbosity level (0 - 10)\n");
+	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "Timing options:\n");
 	fprintf(stderr, "    -P date/[+-]offset/none: set key publication date "
 						"(default: now)\n");
@@ -268,7 +267,8 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:kL:m:n:P:p:qR:r:S:s:T:t:v:"
+#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:kL:m:n:P:p:qR:r:S:s:T:t:" \
+		      "v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case 'm':
@@ -462,8 +462,13 @@ main(int argc, char **argv) {
 					program, isc_commandline_option);
 			/* FALLTHROUGH */
 		case 'h':
+			/* Does not return. */
 			usage();
 
+		case 'V':
+			/* Does not return. */
+			version(program);
+
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n",
 				program, isc_commandline_option);
@@ -482,7 +487,7 @@ main(int argc, char **argv) {
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(ret));
 
-	setup_logging(verbose, mctx, &log);
+	setup_logging(mctx, &log);
 
 	if (predecessor == NULL) {
 		if (prepub == -1)
@@ -547,6 +552,9 @@ main(int argc, char **argv) {
 				options |= DST_TYPE_KEY;
 		}
 
+		if (!dst_algorithm_supported(alg))
+			fatal("unsupported algorithm: %d", alg);
+
 		if (use_nsec3 &&
 		    alg != DST_ALG_NSEC3DSA && alg != DST_ALG_NSEC3RSASHA1 &&
 		    alg != DST_ALG_RSASHA256 && alg!= DST_ALG_RSASHA512 &&
@@ -714,8 +722,13 @@ main(int argc, char **argv) {
 			fatal("invalid DSS key size: %d", size);
 		break;
 	case DST_ALG_ECCGOST:
+		size = 256;
+		break;
 	case DST_ALG_ECDSA256:
+		size = 256;
+		break;
 	case DST_ALG_ECDSA384:
+		size = 384;
 		break;
 	case DST_ALG_HMACMD5:
 		options |= DST_TYPE_KEY;

bin/dnssec/dnssec-keygen.docbook

@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005, 2007-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -45,6 +45,7 @@
       <year>2011</year>
       <year>2012</year>
       <year>2014</year>
+      <year>2015</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -86,6 +87,7 @@
       <arg><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
       <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>
       <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg><option>-V</option></arg>
       <arg><option>-z</option></arg>
       <arg choice="req">name</arg>
     </cmdsynopsis>
@@ -305,8 +307,10 @@
             into a DNSKEY RR.  If the key is imported into a zone,
             this is the TTL that will be used for it, unless there was
             already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <literal>0</literal> or <literal>none</literal> removes it.
+            would take precedence.  If this value is not set and there
+            is no existing DNSKEY RRset, the TTL will default to the
+            SOA TTL. Setting the default TTL to <literal>0</literal>
+            or <literal>none</literal> is the same as leaving it unset.
           </para>
         </listitem>
       </varlistentry>
@@ -422,6 +426,15 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-V</term>
+        <listitem>
+	  <para>
+	    Prints version information.
+	  </para>
+        </listitem>
+      </varlistentry>
+
     </variablelist>
   </refsect1>
 

bin/dnssec/dnssec-keygen.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005, 2007-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -29,10 +29,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {name}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-z</code>] {name}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543592"></a><h2>DESCRIPTION</h2>
+<a name="id2543608"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-keygen</strong></span>
       generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
       and RFC 4034.  It can also generate keys for use with
@@ -46,7 +46,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543610"></a><h2>OPTIONS</h2>
+<a name="id2543626"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
@@ -182,8 +182,10 @@
             into a DNSKEY RR.  If the key is imported into a zone,
             this is the TTL that will be used for it, unless there was
             already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <code class="literal">0</code> or <code class="literal">none</code> removes it.
+            would take precedence.  If this value is not set and there
+            is no existing DNSKEY RRset, the TTL will default to the
+            SOA TTL. Setting the default TTL to <code class="literal">0</code>
+            or <code class="literal">none</code> is the same as leaving it unset.
           </p></dd>
 <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
 <dd><p>
@@ -260,10 +262,14 @@
 <dd><p>
             Sets the debugging level.
           </p></dd>
+<dt><span class="term">-V</span></dt>
+<dd><p>
+	    Prints version information.
+	  </p></dd>
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544193"></a><h2>TIMING OPTIONS</h2>
+<a name="id2544292"></a><h2>TIMING OPTIONS</h2>
 <p>
       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -337,7 +343,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544382"></a><h2>GENERATED KEYS</h2>
+<a name="id2544413"></a><h2>GENERATED KEYS</h2>
 <p>
       When <span><strong class="command">dnssec-keygen</strong></span> completes
       successfully,
@@ -383,7 +389,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544533"></a><h2>EXAMPLE</h2>
+<a name="id2544496"></a><h2>EXAMPLE</h2>
 <p>
       To generate a 768-bit DSA key for the domain
       <strong class="userinput"><code>example.com</code></strong>, the following command would be
@@ -404,7 +410,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544645"></a><h2>SEE ALSO</h2>
+<a name="id2544608"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 2539</em>,
@@ -413,7 +419,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544676"></a><h2>AUTHOR</h2>
+<a name="id2544638"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/dnssec/dnssec-revoke.8

@@ -32,7 +32,7 @@
 dnssec\-revoke \- Set the REVOKED bit on a DNSSEC key
 .SH "SYNOPSIS"
 .HP 14
-\fBdnssec\-revoke\fR [\fB\-hr\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\fR] [\fB\-R\fR] {keyfile}
+\fBdnssec\-revoke\fR [\fB\-hr\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\fR] [\fB\-R\fR] {keyfile}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-revoke\fR
@@ -59,6 +59,11 @@ After writing the new keyset files remove the original keyset files.
 Sets the debugging level.
 .RE
 .PP
+\-V
+.RS 4
+Prints version information.
+.RE
+.PP
 \-E \fIengine\fR
 .RS 4
 Specifies the cryptographic hardware to use, when applicable.

bin/dnssec/dnssec-revoke.c

@@ -14,8 +14,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-revoke.c,v 1.24 2011/10/20 23:46:51 tbox Exp $ */
-
 /*! \file */
 
 #include <config.h>
@@ -72,6 +70,7 @@ usage(void) {
 	fprintf(stderr, "    -r:	   remove old keyfiles after "
 					   "creating revoked version\n");
 	fprintf(stderr, "    -v level:	   set level of verbosity\n");
+	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "Output:\n");
 	fprintf(stderr, "     K<name>+<alg>+<new id>.key, "
 			     "K<name>+<alg>+<new id>.private\n");
@@ -114,7 +113,7 @@ main(int argc, char **argv) {
 
 	isc_commandline_errprint = ISC_FALSE;
 
-	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:")) != -1) {
+	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) {
 		switch (ch) {
 		    case 'E':
 			engine = isc_commandline_argument;
@@ -150,8 +149,13 @@ main(int argc, char **argv) {
 					program, isc_commandline_option);
 			/* Falls into */
 		    case 'h':
+			/* Does not return. */
 			usage();
 
+		    case 'V':
+			/* Does not return. */
+			version(program);
+
 		    default:
 			fprintf(stderr, "%s: unhandled option -%c\n",
 				program, isc_commandline_option);
@@ -259,12 +263,10 @@ main(int argc, char **argv) {
 			dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf);
 			if (strcmp(oldname, newname) == 0)
 				goto cleanup;
-			if (access(oldname, F_OK) == 0)
-				unlink(oldname);
+			(void)unlink(oldname);
 			isc_buffer_clear(&buf);
 			dst_key_buildfilename(key, DST_TYPE_PUBLIC, dir, &buf);
-			if (access(oldname, F_OK) == 0)
-				unlink(oldname);
+			(void)unlink(oldname);
 		}
 	} else {
 		dst_key_format(key, keystr, sizeof(keystr));

bin/dnssec/dnssec-revoke.docbook

@@ -47,6 +47,7 @@
       <command>dnssec-revoke</command>
       <arg><option>-hr</option></arg>
       <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg><option>-V</option></arg>
       <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
       <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
       <arg><option>-f</option></arg>
@@ -105,6 +106,15 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-V</term>
+        <listitem>
+	  <para>
+	    Prints version information.
+	  </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-E <replaceable class="parameter">engine</replaceable></term>
         <listitem>

bin/dnssec/dnssec-revoke.html

@@ -28,10 +28,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-revoke</code>  [<code class="option">-hr</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f</code>] [<code class="option">-R</code>] {keyfile}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-revoke</code>  [<code class="option">-hr</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f</code>] [<code class="option">-R</code>] {keyfile}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543384"></a><h2>DESCRIPTION</h2>
+<a name="id2543397"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-revoke</strong></span>
       reads a DNSSEC key file, sets the REVOKED bit on the key as defined
       in RFC 5011, and creates a new pair of key files containing the
@@ -39,7 +39,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543396"></a><h2>OPTIONS</h2>
+<a name="id2543409"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-h</span></dt>
 <dd><p>
@@ -58,6 +58,10 @@
 <dd><p>
             Sets the debugging level.
           </p></dd>
+<dt><span class="term">-V</span></dt>
+<dd><p>
+	    Prints version information.
+	  </p></dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
 <dd>
 <p>
@@ -86,14 +90,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543517"></a><h2>SEE ALSO</h2>
+<a name="id2543544"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 5011</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543542"></a><h2>AUTHOR</h2>
+<a name="id2543569"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/dnssec/dnssec-settime.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009-2011, 2014 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -32,7 +32,7 @@
 dnssec\-settime \- Set the key timing metadata for a DNSSEC key
 .SH "SYNOPSIS"
 .HP 15
-\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile}
+\fBdnssec\-settime\fR [\fB\-f\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-h\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] {keyfile}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-settime\fR
@@ -69,11 +69,11 @@ Sets the directory in which the key files are to reside.
 .PP
 \-L \fIttl\fR
 .RS 4
-Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. Setting the default TTL to
+Sets the default TTL to use for this key when it is converted into a DNSKEY RR. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL. Setting the default TTL to
 0
 or
 none
-removes it.
+removes it from the key.
 .RE
 .PP
 \-h
@@ -81,6 +81,11 @@ removes it.
 Emit usage message and exit.
 .RE
 .PP
+\-V
+.RS 4
+Prints version information.
+.RE
+.PP
 \-v \fIlevel\fR
 .RS 4
 Sets the debugging level.
@@ -173,5 +178,5 @@ RFC 5011.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2009\-2011, 2014 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009\-2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
 .br

bin/dnssec/dnssec-settime.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,8 +14,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-settime.c,v 1.32 2011/06/02 20:24:45 each Exp $ */
-
 /*! \file */
 
 #include <config.h>
@@ -75,6 +73,7 @@ usage(void) {
 	fprintf(stderr, "    -K directory:       set key file location\n");
 	fprintf(stderr, "    -L ttl:             set default key TTL\n");
 	fprintf(stderr, "    -v level:           set level of verbosity\n");
+	fprintf(stderr, "    -V:                 print version information\n");
 	fprintf(stderr, "    -h:                 help\n");
 	fprintf(stderr, "Timing options:\n");
 	fprintf(stderr, "    -P date/[+-]offset/none: set/unset key "
@@ -170,7 +169,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("Out of memory");
 
-	setup_logging(verbose, mctx, &log);
+	setup_logging(mctx, &log);
 
 #ifdef PKCS11CRYPTO
 	pk11_result_register();
@@ -181,7 +180,7 @@ main(int argc, char **argv) {
 
 	isc_stdtime_get(&now);
 
-#define CMDLINE_FLAGS "A:D:E:fhI:i:K:L:P:p:R:S:uv:"
+#define CMDLINE_FLAGS "A:D:E:fhI:i:K:L:P:p:R:S:uv:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case 'E':
@@ -311,8 +310,13 @@ main(int argc, char **argv) {
 					program, isc_commandline_option);
 			/* Falls into */
 		case 'h':
+			/* Does not return. */
 			usage();
 
+		case 'V':
+			/* Does not return. */
+			version(program);
+
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n",
 				program, isc_commandline_option);
@@ -339,7 +343,6 @@ main(int argc, char **argv) {
 	isc_entropy_stopcallbacksources(ectx);
 
 	if (predecessor != NULL) {
-		char keystr[DST_KEY_FORMATSIZE];
 		int major, minor;
 
 		if (prepub == -1)

bin/dnssec/dnssec-settime.docbook

@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
                [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2009-2011, 2014  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
  -
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -39,6 +39,7 @@
       <year>2010</year>
       <year>2011</year>
       <year>2014</year>
+      <year>2015</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -55,6 +56,7 @@
       <arg><option>-I <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
       <arg><option>-h</option></arg>
+      <arg><option>-V</option></arg>
       <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
       <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
       <arg choice="req">keyfile</arg>
@@ -125,8 +127,10 @@
             into a DNSKEY RR.  If the key is imported into a zone,
             this is the TTL that will be used for it, unless there was
             already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <literal>0</literal> or <literal>none</literal> removes it.
+            would take precedence.  If this value is not set and there
+            is no existing DNSKEY RRset, the TTL will default to the
+            SOA TTL. Setting the default TTL to <literal>0</literal>
+            or <literal>none</literal> removes it from the key.
           </para>
         </listitem>
       </varlistentry>
@@ -140,6 +144,15 @@
         </listitem>
       </varlistentry>
   
+      <varlistentry>
+	<term>-V</term>
+        <listitem>
+	  <para>
+	    Prints version information.
+	  </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-v <replaceable class="parameter">level</replaceable></term>
         <listitem>

bin/dnssec/dnssec-settime.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2009-2011, 2014 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
  - 
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -28,10 +28,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code>  [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code>  [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543434"></a><h2>DESCRIPTION</h2>
+<a name="id2543450"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-settime</strong></span>
       reads a DNSSEC private key file and sets the key timing metadata
       as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
@@ -57,7 +57,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543482"></a><h2>OPTIONS</h2>
+<a name="id2543498"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-f</span></dt>
 <dd><p>
@@ -80,13 +80,19 @@
             into a DNSKEY RR.  If the key is imported into a zone,
             this is the TTL that will be used for it, unless there was
             already a DNSKEY RRset in place, in which case the existing TTL
-            would take precedence.  Setting the default TTL to
-            <code class="literal">0</code> or <code class="literal">none</code> removes it.
+            would take precedence.  If this value is not set and there
+            is no existing DNSKEY RRset, the TTL will default to the
+            SOA TTL. Setting the default TTL to <code class="literal">0</code>
+            or <code class="literal">none</code> removes it from the key.
           </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
 	    Emit usage message and exit.
 	  </p></dd>
+<dt><span class="term">-V</span></dt>
+<dd><p>
+	    Prints version information.
+	  </p></dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
 <dd><p>
             Sets the debugging level.
@@ -108,7 +114,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543669"></a><h2>TIMING OPTIONS</h2>
+<a name="id2543700"></a><h2>TIMING OPTIONS</h2>
 <p>
       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -187,7 +193,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543808"></a><h2>PRINTING OPTIONS</h2>
+<a name="id2543838"></a><h2>PRINTING OPTIONS</h2>
 <p>
       <span><strong class="command">dnssec-settime</strong></span> can also be used to print the
       timing metadata associated with a key.
@@ -213,7 +219,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543885"></a><h2>SEE ALSO</h2>
+<a name="id2543916"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -221,7 +227,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2542144"></a><h2>AUTHOR</h2>
+<a name="id2543949"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/dnssec/dnssec-signzone.8

@@ -33,7 +33,7 @@
 dnssec\-signzone \- DNSSEC zone signing tool
 .SH "SYNOPSIS"
 .HP 16
-\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fIdomain\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-p\fR] [\fB\-R\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
+\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fIdomain\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-p\fR] [\fB\-R\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-signzone\fR
@@ -174,6 +174,11 @@ Prints a short summary of the options and arguments to
 \fBdnssec\-signzone\fR.
 .RE
 .PP
+\-V
+.RS 4
+Prints version information.
+.RE
+.PP
 \-i \fIinterval\fR
 .RS 4
 When a previously\-signed zone is passed as input, records may be resigned. The

bin/dnssec/dnssec-signzone.c

@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -29,8 +29,6 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.285.32.1 2012/02/07 00:44:12 each Exp $ */
-
 /*! \file */
 
 #include <config.h>
@@ -138,7 +136,7 @@ static isc_mem_t *mctx = NULL;
 static isc_entropy_t *ectx = NULL;
 static dns_ttl_t zone_soa_min_ttl;
 static dns_ttl_t soa_ttl;
-static FILE *fp = NULL;
+static FILE *outfp = NULL;
 static char *tempfile = NULL;
 static const dns_master_style_t *masterstyle;
 static dns_masterformat_t inputformat = dns_masterformat_text;
@@ -158,7 +156,7 @@ static dns_name_t *gorigin;		/* The database origin */
 static int nsec3flags = 0;
 static dns_iterations_t nsec3iter = 10U;
 static unsigned char saltbuf[255];
-static unsigned char *salt = saltbuf;
+static unsigned char *gsalt = saltbuf;
 static size_t salt_length = 0;
 static isc_task_t *master = NULL;
 static unsigned int ntasks = 0;
@@ -210,7 +208,7 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 
 	if (!output_dnssec_only) {
 		result = dns_master_dumpnodetostream(mctx, gdb, gversion, node,
-						     name, masterstyle, fp);
+						     name, masterstyle, outfp);
 		check_result(result, "dns_master_dumpnodetostream");
 		return;
 	}
@@ -252,7 +250,7 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 		check_result(result, "dns_master_rdatasettotext");
 
 		isc_buffer_usedregion(buffer, &r);
-		result = isc_stdio_write(r.base, 1, r.length, fp, NULL);
+		result = isc_stdio_write(r.base, 1, r.length, outfp, NULL);
 		check_result(result, "isc_stdio_write");
 		isc_buffer_clear(buffer);
 
@@ -293,8 +291,6 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
 				 mctx, &b, &trdata);
 	isc_entropy_stopcallbacksources(ectx);
 	if (result != ISC_R_SUCCESS) {
-		char keystr[DST_KEY_FORMATSIZE];
-		dst_key_format(key, keystr, sizeof(keystr));
 		fatal("dnskey '%s' failed to sign data: %s",
 		      keystr, isc_result_totext(result));
 	}
@@ -506,6 +502,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	result = dns_db_findrdataset(gdb, node, gversion, dns_rdatatype_rrsig,
 				     set->type, 0, &sigset, NULL);
 	if (result == ISC_R_NOTFOUND) {
+		vbprintf(2, "no existing signatures for %s/%s\n",
+			 namestr, typestr);
 		result = ISC_R_SUCCESS;
 		nosigs = ISC_TRUE;
 	}
@@ -742,7 +740,7 @@ hashlist_add(hashlist_t *l, const unsigned char *hash, size_t len)
 static void
 hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
 		      unsigned int hashalg, unsigned int iterations,
-		      const unsigned char *salt, size_t salt_length,
+		      const unsigned char *salt, size_t salt_len,
 		      isc_boolean_t speculative)
 {
 	char nametext[DNS_NAME_FORMATSIZE];
@@ -751,7 +749,7 @@ hashlist_add_dns_name(hashlist_t *l, /*const*/ dns_name_t *name,
 	size_t i;
 
 	len = isc_iterated_hash(hash, hashalg, iterations,
-				salt, (int)salt_length,
+				salt, (int)salt_len,
 				name->ndata, name->length);
 	if (verbose) {
 		dns_name_format(name, nametext, sizeof nametext);
@@ -833,7 +831,7 @@ hashlist_exists(const hashlist_t *l,
 static void
 addnowildcardhash(hashlist_t *l, /*const*/ dns_name_t *name,
 		  unsigned int hashalg, unsigned int iterations,
-		  const unsigned char *salt, size_t salt_length)
+		  const unsigned char *salt, size_t salt_len)
 {
 	dns_fixedname_t fixed;
 	dns_name_t *wild;
@@ -860,7 +858,7 @@ addnowildcardhash(hashlist_t *l, /*const*/ dns_name_t *name,
 		fprintf(stderr, "adding no-wildcardhash for %s\n", namestr);
 	}
 
-	hashlist_add_dns_name(l, wild, hashalg, iterations, salt, salt_length,
+	hashlist_add_dns_name(l, wild, hashalg, iterations, salt, salt_len,
 			      ISC_TRUE);
 }
 
@@ -1661,10 +1659,14 @@ remove_records(dns_dbnode_t *node, dns_rdatatype_t which,
 }
 
 /*
- * Remove signatures covering the given type (0 == all signatures).
+ * Remove signatures covering the given type.  If type == 0,
+ * then remove all signatures, unless this is a delegation, in
+ * which case remove all signatures except for DS or nsec_datatype
  */
 static void
-remove_sigs(dns_dbnode_t *node, dns_rdatatype_t which) {
+remove_sigs(dns_dbnode_t *node, isc_boolean_t delegation,
+	    dns_rdatatype_t which)
+{
 	isc_result_t result;
 	dns_rdatatype_t type, covers;
 	dns_rdatasetiter_t *rdsiter = NULL;
@@ -1681,14 +1683,21 @@ remove_sigs(dns_dbnode_t *node, dns_rdatatype_t which) {
 		covers = rdataset.covers;
 		dns_rdataset_disassociate(&rdataset);
 
-		if (type == dns_rdatatype_rrsig &&
-		    (covers == which || which == 0))
-		{
-			result = dns_db_deleterdataset(gdb, node, gversion,
-						       type, covers);
-			check_result(result, "dns_db_deleterdataset()");
+		if (type != dns_rdatatype_rrsig)
 			continue;
-		}
+
+		if (which == 0 && delegation &&
+		    (dns_rdatatype_atparent(covers) ||
+		     (nsec_datatype == dns_rdatatype_nsec &&
+		      covers == nsec_datatype)))
+			continue;
+
+		if (which != 0 && covers != which)
+			continue;
+
+		result = dns_db_deleterdataset(gdb, node, gversion,
+					       type, covers);
+		check_result(result, "dns_db_deleterdataset()");
 	}
 	dns_rdatasetiter_destroy(&rdsiter);
 }
@@ -1775,7 +1784,7 @@ nsecify(void) {
 		if (is_delegation(gdb, gversion, gorigin, name, node, &nsttl)) {
 			zonecut = dns_fixedname_name(&fzonecut);
 			dns_name_copy(name, zonecut, NULL);
-			remove_sigs(node, 0);
+			remove_sigs(node, ISC_TRUE, 0);
 			if (generateds)
 				add_ds(name, node, nsttl);
 		}
@@ -1797,7 +1806,7 @@ nsecify(void) {
 			    (zonecut != NULL &&
 			     dns_name_issubdomain(nextname, zonecut)))
 			{
-				remove_sigs(nextnode, 0);
+				remove_sigs(nextnode, ISC_FALSE, 0);
 				remove_records(nextnode, dns_rdatatype_nsec,
 					       ISC_FALSE);
 				dns_db_detachnode(gdb, &nextnode);
@@ -1824,7 +1833,7 @@ nsecify(void) {
 }
 
 static void
-addnsec3param(const unsigned char *salt, size_t salt_length,
+addnsec3param(const unsigned char *salt, size_t salt_len,
 	      dns_iterations_t iterations)
 {
 	dns_dbnode_t *node = NULL;
@@ -1845,7 +1854,7 @@ addnsec3param(const unsigned char *salt, size_t salt_length,
 	nsec3param.flags = 0;
 	nsec3param.hash = unknownalg ? DNS_NSEC3_UNKNOWNALG : dns_hash_sha1;
 	nsec3param.iterations = iterations;
-	nsec3param.salt_length = (unsigned char)salt_length;
+	nsec3param.salt_length = (unsigned char)salt_len;
 	DE_CONST(salt, nsec3param.salt);
 
 	isc_buffer_init(&b, nsec3parambuf, sizeof(nsec3parambuf));
@@ -1884,7 +1893,7 @@ addnsec3param(const unsigned char *salt, size_t salt_length,
 
 static void
 addnsec3(dns_name_t *name, dns_dbnode_t *node,
-	 const unsigned char *salt, size_t salt_length,
+	 const unsigned char *salt, size_t salt_len,
 	 unsigned int iterations, hashlist_t *hashlist,
 	 dns_ttl_t ttl)
 {
@@ -1898,7 +1907,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node,
 	isc_result_t result;
 	dns_dbnode_t *nsec3node = NULL;
 	char namebuf[DNS_NAME_FORMATSIZE];
-	size_t hash_length;
+	size_t hash_len;
 
 	dns_name_format(name, namebuf, sizeof(namebuf));
 
@@ -1906,16 +1915,16 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node,
 	dns_rdataset_init(&rdataset);
 
 	dns_name_downcase(name, name, NULL);
-	result = dns_nsec3_hashname(&hashname, hash, &hash_length,
+	result = dns_nsec3_hashname(&hashname, hash, &hash_len,
 				    name, gorigin, dns_hash_sha1, iterations,
-				    salt, salt_length);
+				    salt, salt_len);
 	check_result(result, "addnsec3: dns_nsec3_hashname()");
 	nexthash = hashlist_findnext(hashlist, hash);
 	result = dns_nsec3_buildrdata(gdb, gversion, node,
 				      unknownalg ?
 					  DNS_NSEC3_UNKNOWNALG : dns_hash_sha1,
 				      nsec3flags, iterations,
-				      salt, salt_length,
+				      salt, salt_len,
 				      nexthash, ISC_SHA1_DIGESTLENGTH,
 				      nsec3buffer, &rdata);
 	check_result(result, "addnsec3: dns_nsec3_buildrdata()");
@@ -1951,7 +1960,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node,
 static void
 nsec3clean(dns_name_t *name, dns_dbnode_t *node,
 	   unsigned int hashalg, unsigned int iterations,
-	   const unsigned char *salt, size_t salt_length, hashlist_t *hashlist)
+	   const unsigned char *salt, size_t salt_len, hashlist_t *hashlist)
 {
 	dns_label_t label;
 	dns_rdata_nsec3_t nsec3;
@@ -2011,8 +2020,8 @@ nsec3clean(dns_name_t *name, dns_dbnode_t *node,
 		check_result(result, "dns_rdata_tostruct");
 		if (exists && nsec3.hash == hashalg &&
 		    nsec3.iterations == iterations &&
-		    nsec3.salt_length == salt_length &&
-		    !memcmp(nsec3.salt, salt, salt_length))
+		    nsec3.salt_length == salt_len &&
+		    !memcmp(nsec3.salt, salt, salt_len))
 			continue;
 		rdatalist.rdclass = rdata.rdclass;
 		rdatalist.type = rdata.type;
@@ -2172,7 +2181,7 @@ cleanup_zone(void) {
  */
 static void
 nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
-	 const unsigned char *salt, size_t salt_length, hashlist_t *hashlist)
+	 const unsigned char *salt, size_t salt_len, hashlist_t *hashlist)
 {
 	dns_dbiterator_t *dbiter = NULL;
 	dns_dbnode_t *node = NULL, *nextnode = NULL;
@@ -2237,7 +2246,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			if (!dns_name_issubdomain(nextname, gorigin) ||
 			    (zonecut != NULL &&
 			     dns_name_issubdomain(nextname, zonecut))) {
-				remove_sigs(nextnode, 0);
+				remove_sigs(nextnode, ISC_FALSE, 0);
 				dns_db_detachnode(gdb, &nextnode);
 				result = dns_dbiterator_next(dbiter);
 				continue;
@@ -2247,7 +2256,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			{
 				zonecut = dns_fixedname_name(&fzonecut);
 				dns_name_copy(nextname, zonecut, NULL);
-				remove_sigs(nextnode, 0);
+				remove_sigs(nextnode, ISC_TRUE, 0);
 				if (generateds)
 					add_ds(nextname, nextnode, nsttl);
 				if (OPTOUT(nsec3flags) &&
@@ -2268,7 +2277,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			      isc_result_totext(result));
 		dns_name_downcase(name, name, NULL);
 		hashlist_add_dns_name(hashlist, name, hashalg, iterations,
-				      salt, salt_length, ISC_FALSE);
+				      salt, salt_len, ISC_FALSE);
 		dns_db_detachnode(gdb, &node);
 		/*
 		 * Add hashs for empty nodes.  Use closest encloser logic.
@@ -2279,16 +2288,16 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 		dns_name_downcase(nextname, nextname, NULL);
 		dns_name_fullcompare(name, nextname, &order, &nlabels);
 		addnowildcardhash(hashlist, name, hashalg, iterations,
-				  salt, salt_length);
+				  salt, salt_len);
 		count = dns_name_countlabels(nextname);
 		while (count > nlabels + 1) {
 			count--;
 			dns_name_split(nextname, count, NULL, nextname);
 			hashlist_add_dns_name(hashlist, nextname, hashalg,
-					      iterations, salt, salt_length,
+					      iterations, salt, salt_len,
 					      ISC_FALSE);
 			addnowildcardhash(hashlist, nextname, hashalg,
-					  iterations, salt, salt_length);
+					  iterations, salt, salt_len);
 		}
 	}
 	dns_dbiterator_destroy(&dbiter);
@@ -2311,7 +2320,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 	zonecut = NULL;
 	done = ISC_FALSE;
 
-	addnsec3param(salt, salt_length, iterations);
+	addnsec3param(salt, salt_len, iterations);
 
 	/*
 	 * Clean out NSEC3 records which don't match this chain.
@@ -2324,7 +2333,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 	     result = dns_dbiterator_next(dbiter)) {
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		nsec3clean(name, node, hashalg, iterations, salt, salt_length,
+		nsec3clean(name, node, hashalg, iterations, salt, salt_len,
 			   hashlist);
 		dns_db_detachnode(gdb, &node);
 	}
@@ -2398,7 +2407,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 		 * We need to pause here to release the lock on the database.
 		 */
 		dns_dbiterator_pause(dbiter);
-		addnsec3(name, node, salt, salt_length, iterations,
+		addnsec3(name, node, salt, salt_len, iterations,
 			 hashlist, zone_soa_min_ttl);
 		dns_db_detachnode(gdb, &node);
 		/*
@@ -2409,7 +2418,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 		while (count > nlabels + 1) {
 			count--;
 			dns_name_split(nextname, count, NULL, nextname);
-			addnsec3(nextname, NULL, salt, salt_length,
+			addnsec3(nextname, NULL, salt, salt_len,
 				 iterations, hashlist, zone_soa_min_ttl);
 		}
 	}
@@ -2671,7 +2680,7 @@ warnifallksk(dns_db_t *db) {
 }
 
 static void
-set_nsec3params(isc_boolean_t update_chain, isc_boolean_t set_salt,
+set_nsec3params(isc_boolean_t update, isc_boolean_t set_salt,
 		isc_boolean_t set_optout, isc_boolean_t set_iter)
 {
 	isc_result_t result;
@@ -2699,7 +2708,7 @@ set_nsec3params(isc_boolean_t update_chain, isc_boolean_t set_salt,
 
 	nsec_datatype = dns_rdatatype_nsec3;
 
-	if (!update_chain && set_salt) {
+	if (!update && set_salt) {
 		if (salt_length != orig_saltlen ||
 		    memcmp(saltbuf, orig_salt, salt_length) != 0)
 			fatal("An NSEC3 chain exists with a different salt. "
@@ -2707,10 +2716,10 @@ set_nsec3params(isc_boolean_t update_chain, isc_boolean_t set_salt,
 	} else if (!set_salt) {
 		salt_length = orig_saltlen;
 		memmove(saltbuf, orig_salt, orig_saltlen);
-		salt = saltbuf;
+		gsalt = saltbuf;
 	}
 
-	if (!update_chain && set_iter) {
+	if (!update && set_iter) {
 		if (nsec3iter != orig_iter)
 			fatal("An NSEC3 chain exists with different "
 			      "iterations. Use -u to update it.");
@@ -2744,7 +2753,7 @@ set_nsec3params(isc_boolean_t update_chain, isc_boolean_t set_salt,
 	result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
 	check_result(result, "dns_rdata_tostruct");
 
-	if (!update_chain && set_optout) {
+	if (!update && set_optout) {
 		if (nsec3flags != nsec3.flags)
 			fatal("An NSEC3 chain exists with%s OPTOUT. "
 			      "Use -u -%s to %s it.",
@@ -2967,6 +2976,7 @@ usage(void) {
 	fprintf(stderr, "\t-j jitter:\n");
 	fprintf(stderr, "\t\trandomize signature end time up to jitter seconds\n");
 	fprintf(stderr, "\t-v debuglevel (0)\n");
+	fprintf(stderr, "\t-V:\tprint version information\n");
 	fprintf(stderr, "\t-o origin:\n");
 	fprintf(stderr, "\t\tzone origin (name of zonefile)\n");
 	fprintf(stderr, "\t-f outfile:\n");
@@ -3025,6 +3035,7 @@ usage(void) {
 	fprintf(stderr, "Signing Keys: ");
 	fprintf(stderr, "(default: all zone keys that have private keys)\n");
 	fprintf(stderr, "\tkeyfile (Kname+alg+tag)\n");
+
 	exit(0);
 }
 
@@ -3107,7 +3118,7 @@ main(int argc, char *argv[]) {
 
 	/* Unused letters: Bb G J q Yy (and F is reserved). */
 #define CMDLINE_FLAGS \
-	"3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:L:l:m:M:n:N:o:O:PpQRr:s:ST:tuUv:X:xzZ:"
+	"3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:L:l:m:M:n:N:o:O:PpQRr:s:ST:tuUv:VX:xzZ:"
 
 	/*
 	 * Process memory debugging argument first.
@@ -3227,10 +3238,6 @@ main(int argc, char *argv[]) {
 				fatal("iterations too big");
 			break;
 
-		case 'h':
-			usage();
-			break;
-
 		case 'I':
 			inputformatstr = isc_commandline_argument;
 			break;
@@ -3388,17 +3395,24 @@ main(int argc, char *argv[]) {
 			if (isc_commandline_option != '?')
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
+			/* FALLTHROUGH */
+		case 'h':
+			/* Does not return. */
 			usage();
+
+		case 'V':
+			/* Does not return. */
+			version(program);
+
+		case 'Z':	/* Undocumented test options */
+			if (!strcmp(isc_commandline_argument, "nonsecify"))
+				nonsecify = ISC_TRUE;
 			break;
 
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n",
 				program, isc_commandline_option);
 			exit(1);
-		case 'Z':	/* Undocumented test options */
-			if (!strcmp(isc_commandline_argument, "nonsecify"))
-				nonsecify = ISC_TRUE;
-			break;
 		}
 	}
 
@@ -3449,7 +3463,7 @@ main(int argc, char *argv[]) {
 	if (directory == NULL)
 		directory = ".";
 
-	setup_logging(verbose, mctx, &log);
+	setup_logging(mctx, &log);
 
 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
@@ -3665,7 +3679,7 @@ main(int argc, char *argv[]) {
 
 	if (!nonsecify) {
 		if (IS_NSEC3)
-			nsec3ify(dns_hash_sha1, nsec3iter, salt, salt_length,
+			nsec3ify(dns_hash_sha1, nsec3iter, gsalt, salt_length,
 				 &hashlist);
 		else
 			nsecify();
@@ -3681,7 +3695,7 @@ main(int argc, char *argv[]) {
 	}
 
 	if (output_stdout) {
-		fp = stdout;
+		outfp = stdout;
 		if (outputformatstr == NULL)
 			masterstyle = &dns_master_style_full;
 	} else {
@@ -3694,9 +3708,9 @@ main(int argc, char *argv[]) {
 		check_result(result, "isc_file_mktemplate");
 
 		if (outputformat == dns_masterformat_text)
-			result = isc_file_openunique(tempfile, &fp);
+			result = isc_file_openunique(tempfile, &outfp);
 		else
-			result = isc_file_bopenunique(tempfile, &fp);
+			result = isc_file_bopenunique(tempfile, &outfp);
 		if (result != ISC_R_SUCCESS)
 			fatal("failed to open temporary output file: %s",
 			      isc_result_totext(result));
@@ -3704,8 +3718,8 @@ main(int argc, char *argv[]) {
 		setfatalcallback(&removetempfile);
 	}
 
-	print_time(fp);
-	print_version(fp);
+	print_time(outfp);
+	print_version(outfp);
 
 	result = isc_taskmgr_create(mctx, ntasks, 0, &taskmgr);
 	if (result != ISC_R_SUCCESS)
@@ -3775,7 +3789,7 @@ main(int argc, char *argv[]) {
 		}
 		result = dns_master_dumptostream3(mctx, gdb, gversion,
 						  masterstyle, outputformat,
-						  &header, fp);
+						  &header, outfp);
 		check_result(result, "dns_master_dumptostream3");
 	}
 
@@ -3784,7 +3798,7 @@ main(int argc, char *argv[]) {
 		DESTROYLOCK(&statslock);
 
 	if (!output_stdout) {
-		result = isc_stdio_close(fp);
+		result = isc_stdio_close(outfp);
 		check_result(result, "isc_stdio_close");
 		removefile = ISC_FALSE;
 

bin/dnssec/dnssec-signzone.docbook

@@ -90,6 +90,7 @@
       <arg><option>-t</option></arg>
       <arg><option>-u</option></arg>
       <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg><option>-V</option></arg>
       <arg><option>-X <replaceable class="parameter">extended end-time</replaceable></option></arg>
       <arg><option>-x</option></arg>
       <arg><option>-z</option></arg>
@@ -337,6 +338,15 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-V</term>
+        <listitem>
+	  <para>
+	    Prints version information.
+	  </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-i <replaceable class="parameter">interval</replaceable></term>
         <listitem>

bin/dnssec/dnssec-signzone.html

@@ -29,10 +29,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-M <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-M <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543643"></a><h2>DESCRIPTION</h2>
+<a name="id2543656"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-signzone</strong></span>
       signs a zone.  It generates
       NSEC and RRSIG records and produces a signed version of the
@@ -43,7 +43,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543658"></a><h2>OPTIONS</h2>
+<a name="id2543671"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd><p>
@@ -189,6 +189,10 @@
             Prints a short summary of the options and arguments to
             <span><strong class="command">dnssec-signzone</strong></span>.
           </p></dd>
+<dt><span class="term">-V</span></dt>
+<dd><p>
+	    Prints version information.
+	  </p></dd>
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
 <p>
@@ -487,7 +491,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545351"></a><h2>EXAMPLE</h2>
+<a name="id2545241"></a><h2>EXAMPLE</h2>
 <p>
       The following command signs the <strong class="userinput"><code>example.com</code></strong>
       zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>
@@ -517,14 +521,14 @@ db.example.com.signed
 %</pre>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545475"></a><h2>SEE ALSO</h2>
+<a name="id2545365"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 4033</em>, <em class="citetitle">RFC 4641</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545502"></a><h2>AUTHOR</h2>
+<a name="id2545393"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/dnssec/dnssec-verify.8

@@ -32,7 +32,7 @@
 dnssec\-verify \- DNSSEC zone verification tool
 .SH "SYNOPSIS"
 .HP 14
-\fBdnssec\-verify\fR [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-x\fR] [\fB\-z\fR] {zonefile}
+\fBdnssec\-verify\fR [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-x\fR] [\fB\-z\fR] {zonefile}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-verify\fR
@@ -69,6 +69,11 @@ The zone origin. If not specified, the name of the zone file is assumed to be th
 Sets the debugging level.
 .RE
 .PP
+\-V
+.RS 4
+Prints version information.
+.RE
+.PP
 \-x
 .RS 4
 Only verify that the DNSKEY RRset is signed with key\-signing keys. Without this flag, it is assumed that the DNSKEY RRset will be signed by all active keys. When this flag is set, it will not be an error if the DNSKEY RRset is not signed by zone\-signing keys. This corresponds to the

bin/dnssec/dnssec-verify.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,8 +14,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-verify.c,v 1.1.2.1 2011/03/16 06:37:51 each Exp $ */
-
 /*! \file */
 
 #include <config.h>
@@ -135,6 +133,7 @@ usage(void) {
 
 	fprintf(stderr, "Options: (default value in parenthesis) \n");
 	fprintf(stderr, "\t-v debuglevel (0)\n");
+	fprintf(stderr, "\t-V:\tprint version information\n");
 	fprintf(stderr, "\t-o origin:\n");
 	fprintf(stderr, "\t\tzone origin (name of zonefile)\n");
 	fprintf(stderr, "\t-I format:\n");
@@ -173,7 +172,7 @@ main(int argc, char *argv[]) {
 	int ch;
 
 #define CMDLINE_FLAGS \
-	"m:o:I:c:E:v:xz"
+	"hm:o:I:c:E:v:Vxz"
 
 	/*
 	 * Process memory debugging argument first.
@@ -220,10 +219,6 @@ main(int argc, char *argv[]) {
 			engine = isc_commandline_argument;
 			break;
 
-		case 'h':
-			usage();
-			break;
-
 		case 'I':
 			inputformatstr = isc_commandline_argument;
 			break;
@@ -254,8 +249,15 @@ main(int argc, char *argv[]) {
 			if (isc_commandline_option != '?')
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
+			/* FALLTHROUGH */
+
+		case 'h':
+			/* Does not return. */
 			usage();
-			break;
+
+		case 'V':
+			/* Does not return. */
+			version(program);
 
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n",
@@ -280,7 +282,7 @@ main(int argc, char *argv[]) {
 
 	rdclass = strtoclass(classname);
 
-	setup_logging(verbose, mctx, &log);
+	setup_logging(mctx, &log);
 
 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;

bin/dnssec/dnssec-verify.docbook

@@ -49,6 +49,7 @@
       <arg><option>-I <replaceable class="parameter">input-format</replaceable></option></arg>
       <arg><option>-o <replaceable class="parameter">origin</replaceable></option></arg>
       <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
+      <arg><option>-V</option></arg>
       <arg><option>-x</option></arg>
       <arg><option>-z</option></arg>
       <arg choice="req">zonefile</arg>
@@ -129,6 +130,15 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+	<term>-V</term>
+        <listitem>
+	  <para>
+	    Prints version information.
+	  </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-x</term>
         <listitem>

bin/dnssec/dnssec-verify.html

@@ -28,10 +28,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-verify</code>  [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-verify</code>  [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543393"></a><h2>DESCRIPTION</h2>
+<a name="id2543405"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-verify</strong></span>
       verifies that a zone is fully signed for each algorithm found
       in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
@@ -39,7 +39,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543404"></a><h2>OPTIONS</h2>
+<a name="id2543417"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd><p>
@@ -79,6 +79,10 @@
 <dd><p>
             Sets the debugging level.
           </p></dd>
+<dt><span class="term">-V</span></dt>
+<dd><p>
+	    Prints version information.
+	  </p></dd>
 <dt><span class="term">-x</span></dt>
 <dd><p>
             Only verify that the DNSKEY RRset is signed with key-signing
@@ -115,7 +119,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543634"></a><h2>SEE ALSO</h2>
+<a name="id2543660"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -123,7 +127,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543659"></a><h2>AUTHOR</h2>
+<a name="id2543686"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/dnssec/dnssectool.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,8 +15,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssectool.c,v 1.63 2011/10/21 03:55:33 marka Exp $ */
-
 /*! \file */
 
 /*%
@@ -121,6 +119,12 @@ vbprintf(int level, const char *fmt, ...) {
 	va_end(ap);
 }
 
+void
+version(const char *name) {
+	fprintf(stderr, "%s %s\n", name, VERSION);
+	exit(0);
+}
+
 void
 type_format(const dns_rdatatype_t type, char *cp, unsigned int size) {
 	isc_buffer_t b;
@@ -145,7 +149,7 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size) {
 }
 
 void
-setup_logging(int verbose, isc_mem_t *mctx, isc_log_t **logp) {
+setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
 	isc_result_t result;
 	isc_logdestination_t destination;
 	isc_logconfig_t *logconfig = NULL;

bin/dnssec/dnssectool.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -45,6 +45,9 @@ check_result(isc_result_t result, const char *message);
 void
 vbprintf(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 
+void
+version(const char *program);
+
 void
 type_format(const dns_rdatatype_t type, char *cp, unsigned int size);
 #define TYPE_FORMATSIZE 20
@@ -54,7 +57,7 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
 #define SIG_FORMATSIZE (DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + sizeof("65535"))
 
 void
-setup_logging(int verbose, isc_mem_t *mctx, isc_log_t **logp);
+setup_logging(isc_mem_t *mctx, isc_log_t **logp);
 
 void
 cleanup_logging(isc_log_t **logp);

bin/named/.gitignore

@@ -1,4 +1,4 @@
 .libs
-named
+/named
+/lwresd
 named-symtbl.c
-lwresd

bin/named/client.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -546,6 +546,17 @@ exit_check(ns_client_t *client) {
 		INSIST(client->recursionquota == NULL);
 		INSIST(!ISC_QLINK_LINKED(client, ilink));
 
+		if (manager != NULL) {
+			LOCK(&manager->listlock);
+			ISC_LIST_UNLINK(manager->clients, client, link);
+			LOCK(&manager->lock);
+			if (manager->exiting &&
+			    ISC_LIST_EMPTY(manager->clients))
+				destroy_manager = ISC_TRUE;
+			UNLOCK(&manager->lock);
+			UNLOCK(&manager->listlock);
+		}
+
 		ns_query_free(client);
 		isc_mem_put(client->mctx, client->recvbuf, RECV_BUFFER_SIZE);
 		isc_event_free((isc_event_t **)&client->sendevent);
@@ -565,16 +576,6 @@ exit_check(ns_client_t *client) {
 		}
 
 		dns_message_destroy(&client->message);
-		if (manager != NULL) {
-			LOCK(&manager->listlock);
-			ISC_LIST_UNLINK(manager->clients, client, link);
-			LOCK(&manager->lock);
-			if (manager->exiting &&
-			    ISC_LIST_EMPTY(manager->clients))
-				destroy_manager = ISC_TRUE;
-			UNLOCK(&manager->lock);
-			UNLOCK(&manager->listlock);
-		}
 
 		/*
 		 * Detaching the task must be done after unlinking from
@@ -595,6 +596,13 @@ exit_check(ns_client_t *client) {
 			isc_mem_stats(client->mctx, stderr);
 			INSIST(0);
 		}
+
+		/*
+		 * Destroy the fetchlock mutex that was created in
+		 * ns_query_init().
+		 */
+		DESTROYLOCK(&client->query.fetchlock);
+
 		isc_mem_putanddetach(&client->mctx, client, sizeof(*client));
 	}
 
@@ -1412,7 +1420,6 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 	    (ns_g_server->server_id != NULL ||
 	     ns_g_server->server_usehostname)) {
 		if (ns_g_server->server_usehostname) {
-			isc_result_t result;
 			result = ns_os_gethostname(nsid, sizeof(nsid));
 			if (result != ISC_R_SUCCESS) {
 				goto no_nsid;
@@ -3198,6 +3205,9 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
 	int len = 1024;
 	isc_result_t result;
 
+	if (!isc_log_wouldlog(ns_g_lctx, ISC_LOG_DEBUG(1)))
+		return;
+
 	/*
 	 * Note that these are multiline debug messages.  We want a newline
 	 * to appear in the log after each message.

bin/named/config.c

@@ -15,8 +15,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: config.c,v 1.123 2012/01/06 23:46:41 tbox Exp $ */
-
 /*! \file */
 
 #include <config.h>
@@ -170,6 +168,8 @@ options {\n\
 	dnssec-accept-expired no;\n\
 	clients-per-query 10;\n\
 	max-clients-per-query 100;\n\
+	max-recursion-depth 7;\n\
+	max-recursion-queries 75;\n\
 	zero-no-soa-ttl-cache no;\n\
 	nsec3-test-zone no;\n\
 	allow-new-zones no;\n\
@@ -577,6 +577,17 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	REQUIRE(keysp != NULL && *keysp == NULL);
 	REQUIRE(countp != NULL);
 
+	/*
+	 * Get system defaults.
+	 */
+	result = ns_config_getport(config, &port);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
+	result = ns_config_getdscp(config, &dscp);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
  newlist:
 	addrlist = cfg_tuple_get(list, "addresses");
 	portobj = cfg_tuple_get(list, "port");
@@ -591,10 +602,6 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			goto cleanup;
 		}
 		port = (in_port_t) val;
-	} else {
-		result = ns_config_getport(config, &port);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
 	}
 
 	if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
@@ -605,10 +612,6 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			return (ISC_R_RANGE);
 		}
 		dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
-	} else {
-		result = ns_config_getdscp(config, &dscp);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
 	}
 
 	result = ISC_R_NOMEMORY;

bin/named/control.c

@@ -206,7 +206,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
 		   command_compare(command, NS_COMMAND_LOADKEYS)) {
 		result = ns_server_rekey(ns_g_server, command, text);
 	} else if (command_compare(command, NS_COMMAND_ADDZONE)) {
-		result = ns_server_add_zone(ns_g_server, command);
+		result = ns_server_add_zone(ns_g_server, command, text);
 	} else if (command_compare(command, NS_COMMAND_DELZONE)) {
 		result = ns_server_del_zone(ns_g_server, command, text);
 	} else if (command_compare(command, NS_COMMAND_SIGNING)) {

bin/named/geoip.c

@@ -87,6 +87,7 @@ ns_geoip_init(void) {
 #ifndef HAVE_GEOIP
 	return;
 #else
+	GeoIP_cleanup();
 	if (ns_g_geoip == NULL)
 		ns_g_geoip = &geoip_table;
 #endif

bin/named/include/.gitignore

@@ -1 +1,2 @@
+!config.h
 !named

bin/named/include/named/globals.h

@@ -166,6 +166,10 @@ EXTERN isc_boolean_t		ns_g_nosoa		INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_noaa		INIT(ISC_FALSE);
 EXTERN unsigned int		ns_g_delay		INIT(0);
 EXTERN isc_boolean_t		ns_g_nonearest		INIT(ISC_FALSE);
+EXTERN isc_boolean_t		ns_g_notcp		INIT(ISC_FALSE);
+EXTERN isc_boolean_t		ns_g_disable6		INIT(ISC_FALSE);
+EXTERN isc_boolean_t		ns_g_disable4		INIT(ISC_FALSE);
+
 
 #ifdef HAVE_GEOIP
 EXTERN dns_geoip_databases_t	*ns_g_geoip		INIT(NULL);

bin/named/include/named/interfacemgr.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2011, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -97,7 +97,7 @@ isc_result_t
 ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 		       isc_socketmgr_t *socketmgr,
 		       dns_dispatchmgr_t *dispatchmgr,
-		       ns_interfacemgr_t **mgrp);
+		       isc_task_t *task, ns_interfacemgr_t **mgrp);
 /*%
  * Create a new interface manager.
  *

bin/named/include/named/query.h

@@ -15,8 +15,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.h,v 1.45 2011/01/13 04:59:24 tbox Exp $ */
-
 #ifndef NAMED_QUERY_H
 #define NAMED_QUERY_H 1
 

bin/named/include/named/seccomp.h

@@ -0,0 +1,237 @@
+/*
+ * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef NAMED_SECCOMP_H
+#define NAMED_SECCOMP_H 1
+
+/*! \file */
+
+#ifdef HAVE_LIBSECCOMP
+#include <sys/types.h>
+#include <sys/resource.h>
+#include <unistd.h>
+#include <seccomp.h>
+#include <isc/platform.h>
+
+/*%
+ * For each architecture, the scmp_syscalls and
+ * scmp_syscall_names arrays MUST be kept in sync.
+ */
+#ifdef __x86_64__
+int scmp_syscalls[] = {
+	SCMP_SYS(access),
+	SCMP_SYS(open),
+	SCMP_SYS(clock_gettime),
+	SCMP_SYS(time),
+	SCMP_SYS(read),
+	SCMP_SYS(write),
+	SCMP_SYS(close),
+	SCMP_SYS(brk),
+	SCMP_SYS(poll),
+	SCMP_SYS(select),
+	SCMP_SYS(madvise),
+	SCMP_SYS(mmap),
+	SCMP_SYS(munmap),
+	SCMP_SYS(exit_group),
+	SCMP_SYS(rt_sigprocmask),
+	SCMP_SYS(rt_sigaction),
+	SCMP_SYS(fsync),
+	SCMP_SYS(rt_sigreturn),
+	SCMP_SYS(setsid),
+	SCMP_SYS(chdir),
+	SCMP_SYS(futex),
+	SCMP_SYS(stat),
+	SCMP_SYS(rt_sigsuspend),
+	SCMP_SYS(fstat),
+	SCMP_SYS(epoll_ctl),
+	SCMP_SYS(gettimeofday),
+	SCMP_SYS(unlink),
+	SCMP_SYS(socket),
+	SCMP_SYS(sendto),
+#ifndef ISC_PLATFORM_USETHREADS
+	SCMP_SYS(bind),
+	SCMP_SYS(accept),
+	SCMP_SYS(connect),
+	SCMP_SYS(listen),
+	SCMP_SYS(fcntl),
+	SCMP_SYS(sendmsg),
+	SCMP_SYS(recvmsg),
+	SCMP_SYS(uname),
+	SCMP_SYS(setrlimit),
+	SCMP_SYS(getrlimit),
+	SCMP_SYS(setsockopt),
+	SCMP_SYS(getsockopt),
+	SCMP_SYS(getsockname),
+	SCMP_SYS(lstat),
+	SCMP_SYS(lseek),
+	SCMP_SYS(getgid),
+	SCMP_SYS(getegid),
+	SCMP_SYS(getuid),
+	SCMP_SYS(geteuid),
+	SCMP_SYS(setresgid),
+	SCMP_SYS(setresuid),
+	SCMP_SYS(setgid),
+	SCMP_SYS(setuid),
+	SCMP_SYS(prctl),
+	SCMP_SYS(epoll_wait),
+	SCMP_SYS(openat),
+	SCMP_SYS(getdents),
+	SCMP_SYS(rename),
+	SCMP_SYS(utimes),
+	SCMP_SYS(dup),
+#endif
+};
+const char *scmp_syscall_names[] = {
+	"access",
+	"open",
+	"clock_gettime",
+	"time",
+	"read",
+	"write",
+	"close",
+	"brk",
+	"poll",
+	"select",
+	"madvise",
+	"mmap",
+	"munmap",
+	"exit_group",
+	"rt_sigprocmask",
+	"rt_sigaction",
+	"fsync",
+	"rt_sigreturn",
+	"setsid",
+	"chdir",
+	"futex",
+	"stat",
+	"rt_sigsuspend",
+	"fstat",
+	"epoll_ctl",
+	"gettimeofday",
+	"unlink",
+	"socket",
+	"sendto",
+#ifndef ISC_PLATFORM_USETHREADS
+	"bind",
+	"accept",
+	"connect",
+	"listen",
+	"fcntl",
+	"sendmsg",
+	"recvmsg",
+	"uname",
+	"setrlimit",
+	"getrlimit",
+	"setsockopt",
+	"getsockopt",
+	"getsockname",
+	"lstat",
+	"lseek",
+	"getgid",
+	"getegid",
+	"getuid",
+	"geteuid",
+	"setresgid",
+	"setresuid",
+	"setgid",
+	"setuid",
+	"prctl",
+	"epoll_wait",
+	"openat",
+	"getdents",
+	"rename",
+	"utimes",
+	"dup",
+#endif
+};
+#endif /* __x86_64__ */
+#ifdef __i386__
+int scmp_syscalls[] = {
+	SCMP_SYS(access),
+	SCMP_SYS(open),
+	SCMP_SYS(clock_gettime),
+	SCMP_SYS(time),
+	SCMP_SYS(read),
+	SCMP_SYS(write),
+	SCMP_SYS(close),
+	SCMP_SYS(brk),
+	SCMP_SYS(poll),
+	SCMP_SYS(_newselect),
+	SCMP_SYS(select),
+	SCMP_SYS(madvise),
+	SCMP_SYS(mmap2),
+	SCMP_SYS(mmap),
+	SCMP_SYS(munmap),
+	SCMP_SYS(exit_group),
+	SCMP_SYS(rt_sigprocmask),
+	SCMP_SYS(sigprocmask),
+	SCMP_SYS(rt_sigaction),
+	SCMP_SYS(socketcall),
+	SCMP_SYS(fsync),
+	SCMP_SYS(sigreturn),
+	SCMP_SYS(setsid),
+	SCMP_SYS(chdir),
+	SCMP_SYS(futex),
+	SCMP_SYS(stat64),
+	SCMP_SYS(rt_sigsuspend),
+	SCMP_SYS(fstat64),
+	SCMP_SYS(epoll_ctl),
+	SCMP_SYS(gettimeofday),
+	SCMP_SYS(unlink),
+#ifndef ISC_PLATFORM_USETHREADS
+	SCMP_SYS(fcntl64),
+#endif
+};
+const char *scmp_syscall_names[] = {
+	"access",
+	"open",
+	"clock_gettime",
+	"time",
+	"read",
+	"write",
+	"close",
+	"brk",
+	"poll",
+	"_newselect",
+	"select",
+	"madvise",
+	"mmap2",
+	"mmap",
+	"munmap",
+	"exit_group",
+	"rt_sigprocmask",
+	"sigprocmask",
+	"rt_sigaction",
+	"socketcall",
+	"fsync",
+	"sigreturn",
+	"setsid",
+	"chdir",
+	"futex",
+	"stat64",
+	"rt_sigsuspend",
+	"fstat64",
+	"epoll_ctl",
+	"gettimeofday",
+	"unlink",
+#ifndef ISC_PLATFORM_USETHREADS
+	"fcntl64",
+#endif
+};
+#endif /* __i386__ */
+#endif /* HAVE_LIBSECCOMP */
+
+#endif /* NAMED_SECCOMP_H */

bin/named/include/named/server.h

@@ -37,7 +37,6 @@
 #define NS_EVENTCLASS		ISC_EVENTCLASS(0x4E43)
 #define NS_EVENT_RELOAD		(NS_EVENTCLASS + 0)
 #define NS_EVENT_CLIENTCONTROL	(NS_EVENTCLASS + 1)
-#define NS_EVENT_IFSCAN		(NS_EVENTCLASS + 2)
 
 /*%
  * Name server state.  Better here than in lots of separate global variables.
@@ -225,6 +224,7 @@ void
 ns_server_scan_interfaces(ns_server_t *server);
 /*%<
  * Trigger a interface scan.
+ * Must only be called when running under server->task.
  */
 
 void
@@ -372,7 +372,7 @@ ns_server_validation(ns_server_t *server, char *args, isc_buffer_t *text);
  * Add a zone to a running process
  */
 isc_result_t
-ns_server_add_zone(ns_server_t *server, char *args);
+ns_server_add_zone(ns_server_t *server, char *args, isc_buffer_t *text);
 
 /*%
  * Deletes a zone from a running process

bin/named/interfacemgr.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -140,7 +140,7 @@ route_event(isc_task_t *task, isc_event_t *event) {
 	switch (rtm->MSGTYPE) {
 	case RTM_NEWADDR:
 	case RTM_DELADDR:
-		if (ns_g_server->interface_auto)
+		if (mgr->route != NULL && ns_g_server->interface_auto)
 			ns_server_scan_interfaces(ns_g_server);
 		break;
 	default:
@@ -172,11 +172,15 @@ isc_result_t
 ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 		       isc_socketmgr_t *socketmgr,
 		       dns_dispatchmgr_t *dispatchmgr,
-		       ns_interfacemgr_t **mgrp)
+		       isc_task_t *task, ns_interfacemgr_t **mgrp)
 {
 	isc_result_t result;
 	ns_interfacemgr_t *mgr;
 
+#ifndef USE_ROUTE_SOCKET
+	UNUSED(task);
+#endif
+
 	REQUIRE(mctx != NULL);
 	REQUIRE(mgrp != NULL);
 	REQUIRE(*mgrp == NULL);
@@ -232,11 +236,8 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	}
 
 	mgr->task = NULL;
-	if (mgr->route != NULL) {
-		result = isc_task_create(taskmgr, 0, &mgr->task);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup_route;
-	}
+	if (mgr->route != NULL)
+		isc_task_attach(task, &mgr->task);
 	mgr->references = (mgr->route != NULL) ? 2 : 1;
 #else
 	mgr->references = 1;
@@ -260,9 +261,6 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	return (ISC_R_SUCCESS);
 
 #ifdef USE_ROUTE_SOCKET
- cleanup_route:
-	if (mgr->route != NULL)
-		isc_socket_detach(&mgr->route);
  cleanup_aclenv:
 	dns_aclenv_destroy(&mgr->aclenv);
 #endif
@@ -569,7 +567,7 @@ ns_interface_setup(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_interface;
 
-	if (accept_tcp == ISC_TRUE) {
+	if (!ns_g_notcp && accept_tcp == ISC_TRUE) {
 		result = ns_interface_accepttcp(ifp);
 		if (result != ISC_R_SUCCESS) {
 			/*
@@ -816,7 +814,7 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 	if (isc_net_probeipv6() == ISC_R_SUCCESS)
 		scan_ipv6 = ISC_TRUE;
 #ifdef WANT_IPV6
-	else
+	else if (!ns_g_disable6)
 		isc_log_write(IFMGR_COMMON_LOGARGS,
 			      verbose ? ISC_LOG_INFO : ISC_LOG_DEBUG(1),
 			      "no IPv6 interfaces found");
@@ -824,7 +822,7 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 
 	if (isc_net_probeipv4() == ISC_R_SUCCESS)
 		scan_ipv4 = ISC_TRUE;
-	else
+	else if (!ns_g_disable4)
 		isc_log_write(IFMGR_COMMON_LOGARGS,
 			      verbose ? ISC_LOG_INFO : ISC_LOG_DEBUG(1),
 			      "no IPv4 interfaces found");
@@ -1041,7 +1039,7 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 				if (le->dscp != -1 && ifp->dscp == -1)
 					ifp->dscp = le->dscp;
 				else if (le->dscp != ifp->dscp) {
-					isc_sockaddr_format(&listen_addr,
+					isc_sockaddr_format(&listen_sockaddr,
 							    sabuf,
 							    sizeof(sabuf));
 					isc_log_write(IFMGR_COMMON_LOGARGS,

bin/named/lwresd.html

@@ -22,7 +22,7 @@
 <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2476274"></a><div class="titlepage"></div>
+<a name="id2476282"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><span class="application">lwresd</span> &#8212; lightweight resolver daemon</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">lwresd</code>  [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-4</code>] [<code class="option">-6</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543470"></a><h2>DESCRIPTION</h2>
+<a name="id2543479"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">lwresd</strong></span>
       is the daemon providing name lookup
       services to clients that use the BIND 9 lightweight resolver
@@ -67,7 +67,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543517"></a><h2>OPTIONS</h2>
+<a name="id2543526"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -197,7 +197,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543934"></a><h2>FILES</h2>
+<a name="id2543943"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/resolv.conf</code></span></dt>
 <dd><p>
@@ -210,14 +210,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543974"></a><h2>SEE ALSO</h2>
+<a name="id2543982"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
       <span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544008"></a><h2>AUTHOR</h2>
+<a name="id2544017"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/named/main.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -54,6 +54,10 @@
 
 #include <dlz/dlz_dlopen_driver.h>
 
+#ifdef HAVE_GPERFTOOLS_PROFILER
+#include <gperftools/profiler.h>
+#endif
+
 
 /*
  * Defining NS_MAIN provides storage declarations (rather than extern)
@@ -70,12 +74,14 @@
 #include <named/server.h>
 #include <named/lwresd.h>
 #include <named/main.h>
+#include <named/seccomp.h>
 #ifdef HAVE_LIBSCF
 #include <named/ns_smf_globals.h>
 #endif
 
 #ifdef OPENSSL
 #include <openssl/opensslv.h>
+#include <openssl/crypto.h>
 #endif
 #ifdef HAVE_LIBXML2
 #include <libxml/xmlversion.h>
@@ -100,6 +106,9 @@
 #endif
 
 extern int isc_dscp_check_value;
+extern unsigned int dns_zone_mkey_hour;
+extern unsigned int dns_zone_mkey_day;
+extern unsigned int dns_zone_mkey_month;
 
 static isc_boolean_t	want_stats = ISC_FALSE;
 static char		program_name[ISC_DIR_NAMEMAX] = "named";
@@ -415,8 +424,6 @@ parse_command_line(int argc, char *argv[]) {
 	int ch;
 	int port;
 	const char *p;
-	isc_boolean_t disable6 = ISC_FALSE;
-	isc_boolean_t disable4 = ISC_FALSE;
 
 	save_command_line(argc, argv);
 
@@ -426,20 +433,20 @@ parse_command_line(int argc, char *argv[]) {
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case '4':
-			if (disable4)
+			if (ns_g_disable4)
 				ns_main_earlyfatal("cannot specify -4 and -6");
 			if (isc_net_probeipv4() != ISC_R_SUCCESS)
 				ns_main_earlyfatal("IPv4 not supported by OS");
 			isc_net_disableipv6();
-			disable6 = ISC_TRUE;
+			ns_g_disable6 = ISC_TRUE;
 			break;
 		case '6':
-			if (disable6)
+			if (ns_g_disable6)
 				ns_main_earlyfatal("cannot specify -4 and -6");
 			if (isc_net_probeipv6() != ISC_R_SUCCESS)
 				ns_main_earlyfatal("IPv6 not supported by OS");
 			isc_net_disableipv4();
-			disable4 = ISC_TRUE;
+			ns_g_disable4 = ISC_TRUE;
 			break;
 		case 'c':
 			ns_g_conffile = isc_commandline_argument;
@@ -555,6 +562,39 @@ parse_command_line(int argc, char *argv[]) {
 			else if (!strncmp(isc_commandline_argument, "dscp=", 5))
 				isc_dscp_check_value =
 					   atoi(isc_commandline_argument + 5);
+			else if (!strncmp(isc_commandline_argument,
+					  "mkeytimers=", 11))
+			{
+				p = strtok(isc_commandline_argument + 11, "/");
+				if (p == NULL)
+					ns_main_earlyfatal("bad mkeytimer");
+				dns_zone_mkey_hour = atoi(p);
+				if (dns_zone_mkey_hour == 0)
+					ns_main_earlyfatal("bad mkeytimer");
+
+				p = strtok(NULL, "/");
+				if (p == NULL) {
+					dns_zone_mkey_day =
+						(24 * dns_zone_mkey_hour);
+					dns_zone_mkey_month =
+						(30 * dns_zone_mkey_day);
+					break;
+				}
+				dns_zone_mkey_day = atoi(p);
+				if (dns_zone_mkey_day < dns_zone_mkey_hour)
+					ns_main_earlyfatal("bad mkeytimer");
+
+				p = strtok(NULL, "/");
+				if (p == NULL) {
+					dns_zone_mkey_month =
+						(30 * dns_zone_mkey_day);
+					break;
+				}
+				dns_zone_mkey_month = atoi(p);
+				if (dns_zone_mkey_month < dns_zone_mkey_day)
+					ns_main_earlyfatal("bad mkeytimer");
+			} else if (!strcmp(isc_commandline_argument, "notcp"))
+				ns_g_notcp = ISC_TRUE;
 			else
 				fprintf(stderr, "unknown -T flag '%s\n",
 					isc_commandline_argument);
@@ -597,12 +637,20 @@ parse_command_line(int argc, char *argv[]) {
 			printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif
 #ifdef OPENSSL
-			printf("using OpenSSL version: %s\n",
+			printf("compiled with OpenSSL version: %s\n",
 			       OPENSSL_VERSION_TEXT);
+#ifndef WIN32
+			printf("linked to OpenSSL version: %s\n",
+			       SSLeay_version(SSLEAY_VERSION));
+#endif
 #endif
 #ifdef HAVE_LIBXML2
-			printf("using libxml2 version: %s\n",
+			printf("compiled with libxml2 version: %s\n",
 			       LIBXML_DOTTED_VERSION);
+#ifndef WIN32
+			printf("linked to libxml2 version: %s\n",
+			       xmlParserVersion);
+#endif
 #endif
 			exit(0);
 		case 'F':
@@ -770,6 +818,60 @@ dump_symboltable(void) {
 	}
 }
 
+#ifdef HAVE_LIBSECCOMP
+static void
+setup_seccomp() {
+	scmp_filter_ctx ctx;
+	unsigned int i;
+	int ret;
+
+	/* Make sure the lists are in sync */
+	INSIST((sizeof(scmp_syscalls) / sizeof(int)) ==
+	       (sizeof(scmp_syscall_names) / sizeof(const char *)));
+
+	ctx = seccomp_init(SCMP_ACT_KILL);
+	if (ctx == NULL) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_MAIN, ISC_LOG_WARNING,
+			      "libseccomp activation failed");
+		return;
+	}
+
+	for (i = 0 ; i < sizeof(scmp_syscalls)/sizeof(*(scmp_syscalls)); i++) {
+		ret = seccomp_rule_add(ctx, SCMP_ACT_ALLOW,
+				       scmp_syscalls[i], 0);
+		if (ret < 0)
+			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+				      NS_LOGMODULE_MAIN, ISC_LOG_WARNING,
+				      "libseccomp rule failed: %s",
+				      scmp_syscall_names[i]);
+
+		else
+			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+				      NS_LOGMODULE_MAIN, ISC_LOG_DEBUG(9),
+				      "added libseccomp rule: %s",
+				      scmp_syscall_names[i]);
+	}
+
+	ret = seccomp_load(ctx);
+	if (ret < 0) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_MAIN, ISC_LOG_WARNING,
+			      "libseccomp unable to load filter");
+	} else {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+			      "libseccomp sandboxing active");
+	}
+
+	/*
+	 * Release filter in ctx. Filters already loaded are not
+	 * affected.
+	 */
+	seccomp_release(ctx);
+}
+#endif /* HAVE_LIBSECCOMP */
+
 static void
 setup(void) {
 	isc_result_t result;
@@ -983,6 +1085,10 @@ setup(void) {
 #endif
 
 	ns_server_create(ns_g_mctx, &ns_g_server);
+
+#ifdef HAVE_LIBSECCOMP
+	setup_seccomp();
+#endif /* HAVE_LIBSECCOMP */
 }
 
 static void
@@ -1109,6 +1215,10 @@ main(int argc, char *argv[]) {
 	char *instance = NULL;
 #endif
 
+#ifdef HAVE_GPERFTOOLS_PROFILER
+	(void) ProfilerStart(NULL);
+#endif
+
 	/*
 	 * Record version in core image.
 	 * strings named.core | grep "named version:"
@@ -1228,5 +1338,9 @@ main(int argc, char *argv[]) {
 
 	ns_os_shutdown();
 
+#ifdef HAVE_GPERFTOOLS_PROFILER
+	ProfilerStop();
+#endif
+
 	return (0);
 }

bin/named/named.conf.html

@@ -21,7 +21,7 @@
 <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2476274"></a><div class="titlepage"></div>
+<a name="id2476282"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><code class="filename">named.conf</code> &#8212; configuration file for named</p>
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543362"></a><h2>DESCRIPTION</h2>
+<a name="id2543370"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">named.conf</code> is the configuration file
       for
       <span><strong class="command">named</strong></span>.  Statements are enclosed
@@ -50,14 +50,14 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543389"></a><h2>ACL</h2>
+<a name="id2543398"></a><h2>ACL</h2>
 <div class="literallayout"><p><br>
 acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 <br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543405"></a><h2>KEY</h2>
+<a name="id2543414"></a><h2>KEY</h2>
 <div class="literallayout"><p><br>
 key <em class="replaceable"><code>domain_name</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -66,7 +66,7 @@ key
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543425"></a><h2>MASTERS</h2>
+<a name="id2543433"></a><h2>MASTERS</h2>
 <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
 	( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
@@ -75,7 +75,7 @@ masters
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543470"></a><h2>SERVER</h2>
+<a name="id2543479"></a><h2>SERVER</h2>
 <div class="literallayout"><p><br>
 server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/prefixlen</span>]</code></em> | <em class="replaceable"><code>ipv6_address[<span class="optional">/prefixlen</span>]</code></em> ) {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -97,7 +97,7 @@ server
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543539"></a><h2>TRUSTED-KEYS</h2>
+<a name="id2543547"></a><h2>TRUSTED-KEYS</h2>
 <div class="literallayout"><p><br>
 trusted-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br>
@@ -105,7 +105,7 @@ trusted-keys
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543564"></a><h2>MANAGED-KEYS</h2>
+<a name="id2543573"></a><h2>MANAGED-KEYS</h2>
 <div class="literallayout"><p><br>
 managed-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <code class="constant">initial-key</code> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br>
@@ -113,7 +113,7 @@ managed-keys
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543593"></a><h2>CONTROLS</h2>
+<a name="id2543602"></a><h2>CONTROLS</h2>
 <div class="literallayout"><p><br>
 controls {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br>
@@ -125,7 +125,7 @@ controls
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543628"></a><h2>LOGGING</h2>
+<a name="id2543637"></a><h2>LOGGING</h2>
 <div class="literallayout"><p><br>
 logging {<br>
 	channel <em class="replaceable"><code>string</code></em> {<br>
@@ -143,7 +143,7 @@ logging
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543667"></a><h2>LWRES</h2>
+<a name="id2543675"></a><h2>LWRES</h2>
 <div class="literallayout"><p><br>
 lwres {<br>
 	listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
@@ -156,7 +156,7 @@ lwres
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543708"></a><h2>OPTIONS</h2>
+<a name="id2543717"></a><h2>OPTIONS</h2>
 <div class="literallayout"><p><br>
 options {<br>
 	avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br>
@@ -362,7 +362,7 @@ options
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544594"></a><h2>VIEW</h2>
+<a name="id2544602"></a><h2>VIEW</h2>
 <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -527,7 +527,7 @@ view
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545316"></a><h2>ZONE</h2>
+<a name="id2545324"></a><h2>ZONE</h2>
 <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	type ( master | slave | stub | hint | redirect |<br>
@@ -624,12 +624,12 @@ zone
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545705"></a><h2>FILES</h2>
+<a name="id2545714"></a><h2>FILES</h2>
 <p><code class="filename">/etc/named.conf</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545717"></a><h2>SEE ALSO</h2>
+<a name="id2545725"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,

bin/named/named.html

@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-D <em class="replaceable"><code>string</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-U <em class="replaceable"><code>#listeners</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543507"></a><h2>DESCRIPTION</h2>
+<a name="id2543515"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named</strong></span>
       is a Domain Name System (DNS) server,
       part of the BIND 9 distribution from ISC.  For more
@@ -47,7 +47,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543531"></a><h2>OPTIONS</h2>
+<a name="id2543540"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -258,7 +258,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544183"></a><h2>SIGNALS</h2>
+<a name="id2544123"></a><h2>SIGNALS</h2>
 <p>
       In routine operation, signals should not be used to control
       the nameserver; <span><strong class="command">rndc</strong></span> should be used
@@ -279,7 +279,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544299"></a><h2>CONFIGURATION</h2>
+<a name="id2544240"></a><h2>CONFIGURATION</h2>
 <p>
       The <span><strong class="command">named</strong></span> configuration file is too complex
       to describe in detail here.  A complete description is provided
@@ -296,7 +296,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544336"></a><h2>FILES</h2>
+<a name="id2544276"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
 <dd><p>
@@ -309,7 +309,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544375"></a><h2>SEE ALSO</h2>
+<a name="id2544384"></a><h2>SEE ALSO</h2>
 <p><em class="citetitle">RFC 1033</em>,
       <em class="citetitle">RFC 1034</em>,
       <em class="citetitle">RFC 1035</em>,
@@ -322,7 +322,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544445"></a><h2>AUTHOR</h2>
+<a name="id2544454"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/named/server.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,8 +15,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id$ */
-
 /*! \file */
 
 #include <config.h>
@@ -151,6 +149,14 @@
 	       if (result != ISC_R_SUCCESS) goto cleanup;	 \
 	} while (0)
 
+#define TCHECK(op) \
+	do { tresult = (op);					 \
+		if (tresult != ISC_R_SUCCESS) {			 \
+			isc_buffer_clear(text);			 \
+			goto cleanup;	 			 \
+		}						 \
+	} while (0)
+
 #define CHECKM(op, msg) \
 	do { result = (op);					  \
 	       if (result != ISC_R_SUCCESS) {			  \
@@ -411,6 +417,9 @@ newzone_cfgctx_destroy(void **cfgp);
 static isc_result_t
 putstr(isc_buffer_t *b, const char *str);
 
+static isc_result_t
+putnull(isc_buffer_t *b);
+
 isc_result_t
 add_comment(FILE *fp, const char *viewname);
 
@@ -1882,6 +1891,12 @@ configure_rpz(dns_view_t *view, const cfg_obj_t *rpz_obj,
 	if (*old_rpz_okp) {
 		dns_rpz_detach_rpzs(&view->rpzs);
 		dns_rpz_attach_rpzs(pview->rpzs, &view->rpzs);
+	} else if (old != NULL && pview != NULL) {
+		pview->rpzs->rpz_ver += 1;
+		view->rpzs->rpz_ver = pview->rpzs->rpz_ver;
+		cfg_obj_log(rpz_obj, ns_g_lctx, ISC_LOG_DEBUG(1),
+			    "updated RPZ policy: version %d",
+			    view->rpzs->rpz_ver);
 	}
 	if (pview != NULL)
 		dns_view_detach(&pview);
@@ -2249,16 +2264,19 @@ create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, ISC_TRUE);
 	dns_zone_setnotifytype(zone, dns_notifytype_no);
 	dns_zone_setdialup(zone, dns_dialuptype_no);
-	if (view->queryacl)
+	if (view->queryacl != NULL)
 		dns_zone_setqueryacl(zone, view->queryacl);
 	else
 		dns_zone_clearqueryacl(zone);
-	if (view->queryonacl)
+	if (view->queryonacl != NULL)
 		dns_zone_setqueryonacl(zone, view->queryonacl);
 	else
 		dns_zone_clearqueryonacl(zone);
 	dns_zone_clearupdateacl(zone);
-	dns_zone_clearxfracl(zone);
+	if (view->transferacl != NULL)
+		dns_zone_setxfracl(zone, view->transferacl);
+	else
+		dns_zone_clearxfracl(zone);
 
 	CHECK(setquerystats(zone, view->mctx, statlevel));
 	if (db != NULL) {
@@ -2284,6 +2302,9 @@ create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
 		dns_db_closeversion(db, &version, ISC_FALSE);
 	if (db != NULL)
 		dns_db_detach(&db);
+
+	INSIST(version == NULL);
+
 	return (result);
 }
 
@@ -2537,13 +2558,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		const cfg_obj_t *dlzopts;
-		obj = NULL;
+		dlz = cfg_listelt_value(element);
 
 		obj = NULL;
-		dlz = cfg_listelt_value(element);
-		dlzopts = cfg_tuple_get(dlz, "options");
-		(void)cfg_map_get(dlzopts, "database", &obj);
+		(void)cfg_map_get(dlz, "database", &obj);
 		if (obj != NULL) {
 			dns_dlzdb_t *dlzdb = NULL;
 			const cfg_obj_t *name, *search = NULL;
@@ -2560,7 +2578,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 				goto cleanup;
 			}
 
-			name = cfg_tuple_get(dlz, "name");
+			name = cfg_map_getname(dlz);
 			result = dns_dlzcreate(mctx, cfg_obj_asstring(name),
 					       dlzargv[0], dlzargc, dlzargv,
 					       &dlzdb);
@@ -2575,7 +2593,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			 * method now.  If not searchable, we'll take
 			 * care of it when we process the zone statement.
 			 */
-			(void)cfg_map_get(dlzopts, "search", &search);
+			(void)cfg_map_get(dlz, "search", &search);
 			if (search == NULL || cfg_obj_asboolean(search)) {
 				dlzdb->search = ISC_TRUE;
 				result = dns_dlzconfigure(view, dlzdb,
@@ -2652,7 +2670,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	result = ns_config_get(maps, "dns64", &obj);
 	if (result == ISC_R_SUCCESS && strcmp(view->name, "_bind") &&
 	    strcmp(view->name, "_meta")) {
-		const cfg_listelt_t *element;
 		isc_netaddr_t na, suffix, *sp;
 		unsigned int prefixlen;
 		const char *server, *contact;
@@ -3161,7 +3178,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	 */
 	{
 		const cfg_obj_t *peers = NULL;
-		const cfg_listelt_t *element;
 		dns_peerlist_t *newpeers = NULL;
 
 		(void)ns_config_get(cfgmaps, "server", &peers);
@@ -3186,7 +3202,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	 */
 	{
 		const cfg_obj_t *rrsetorder = NULL;
-		const cfg_listelt_t *element;
 
 		(void)ns_config_get(maps, "rrset-order", &rrsetorder);
 		CHECK(dns_order_create(mctx, &order));
@@ -3432,6 +3447,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 					cfg_obj_asuint32(obj),
 					max_clients_per_query);
 
+	obj = NULL;
+	result = ns_config_get(maps, "max-recursion-depth", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	dns_resolver_setmaxdepth(view->resolver, cfg_obj_asuint32(obj));
+
+	obj = NULL;
+	result = ns_config_get(maps, "max-recursion-queries", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	dns_resolver_setmaxqueries(view->resolver, cfg_obj_asuint32(obj));
+
 #ifdef ALLOW_FILTER_AAAA
 	obj = NULL;
 	result = ns_config_get(maps, "filter-aaaa-on-v4", &obj);
@@ -3479,10 +3504,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->prefetch_trigger = 10;
 		eligible = cfg_tuple_get(obj, "eligible");
 		if (cfg_obj_isvoid(eligible)) {
-			int i;
-			for (i = 1; maps[i] != NULL; i++) {
+			int m;
+			for (m = 1; maps[m] != NULL; m++) {
 				obj = NULL;
-				result = ns_config_get(&maps[i],
+				result = ns_config_get(&maps[m],
 						       "prefetch", &obj);
 				INSIST(result == ISC_R_SUCCESS);
 				eligible = cfg_tuple_get(obj, "eligible");
@@ -3527,18 +3552,13 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		     element != NULL;
 		     element = cfg_list_next(element))
 		{
-			const char *str;
-			isc_buffer_t b;
 			dns_name_t *dlv;
 
 			obj = cfg_listelt_value(element);
-			str = cfg_obj_asstring(cfg_tuple_get(obj,
-							     "trust-anchor"));
-			isc_buffer_constinit(&b, str, strlen(str));
-			isc_buffer_add(&b, strlen(str));
+			obj = cfg_tuple_get(obj, "trust-anchor");
 			dlv = dns_fixedname_name(&view->dlv_fixed);
-			CHECK(dns_name_fromtext(dlv, &b, dns_rootname,
-						DNS_NAME_DOWNCASE, NULL));
+			CHECK(dns_name_fromstring(dlv, cfg_obj_asstring(obj),
+						  DNS_NAME_DOWNCASE, NULL));
 			view->dlv = dns_fixedname_name(&view->dlv_fixed);
 		}
 	} else
@@ -3572,28 +3592,22 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	obj = NULL;
 	result = ns_config_get(maps, "root-delegation-only", &obj);
 	if (result == ISC_R_SUCCESS) {
-		dns_view_setrootdelonly(view, ISC_TRUE);
-		if (!cfg_obj_isvoid(obj)) {
-			dns_fixedname_t fixed;
-			dns_name_t *name;
-			isc_buffer_t b;
-			const char *str;
-			const cfg_obj_t *exclude;
+		dns_fixedname_t fixed;
+		dns_name_t *name;
+		const cfg_obj_t *exclude;
 
-			dns_fixedname_init(&fixed);
-			name = dns_fixedname_name(&fixed);
-			for (element = cfg_list_first(obj);
-			     element != NULL;
-			     element = cfg_list_next(element)) {
-				exclude = cfg_listelt_value(element);
-				str = cfg_obj_asstring(exclude);
-				isc_buffer_constinit(&b, str, strlen(str));
-				isc_buffer_add(&b, strlen(str));
-				CHECK(dns_name_fromtext(name, &b, dns_rootname,
-							0, NULL));
-				CHECK(dns_view_excludedelegationonly(view,
-								     name));
-			}
+		dns_view_setrootdelonly(view, ISC_TRUE);
+
+		dns_fixedname_init(&fixed);
+		name = dns_fixedname_name(&fixed);
+		for (element = cfg_list_first(obj);
+		     element != NULL;
+		     element = cfg_list_next(element)) {
+			exclude = cfg_listelt_value(element);
+			CHECK(dns_name_fromstring(name,
+						  cfg_obj_asstring(exclude),
+						  0, NULL));
+			CHECK(dns_view_excludedelegationonly(view, name));
 		}
 	} else
 		dns_view_setrootdelonly(view, ISC_FALSE);
@@ -3622,7 +3636,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		dns_fixedname_t fixed;
 		dns_name_t *name;
 		isc_buffer_t buffer;
-		const char *str;
 		char server[DNS_NAME_FORMATSIZE + 1];
 		char contact[DNS_NAME_FORMATSIZE + 1];
 		const char *empty_dbtype[4] =
@@ -3636,11 +3649,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		obj = NULL;
 		result = ns_config_get(maps, "empty-server", &obj);
 		if (result == ISC_R_SUCCESS) {
-			str = cfg_obj_asstring(obj);
-			isc_buffer_constinit(&buffer, str, strlen(str));
-			isc_buffer_add(&buffer, strlen(str));
-			CHECK(dns_name_fromtext(name, &buffer, dns_rootname, 0,
-						NULL));
+			CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj),
+						  0, NULL));
 			isc_buffer_init(&buffer, server, sizeof(server) - 1);
 			CHECK(dns_name_totext(name, ISC_FALSE, &buffer));
 			server[isc_buffer_usedlength(&buffer)] = 0;
@@ -3651,11 +3661,8 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		obj = NULL;
 		result = ns_config_get(maps, "empty-contact", &obj);
 		if (result == ISC_R_SUCCESS) {
-			str = cfg_obj_asstring(obj);
-			isc_buffer_constinit(&buffer, str, strlen(str));
-			isc_buffer_add(&buffer, strlen(str));
-			CHECK(dns_name_fromtext(name, &buffer, dns_rootname, 0,
-						NULL));
+			CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj),
+						 0, NULL));
 			isc_buffer_init(&buffer, contact, sizeof(contact) - 1);
 			CHECK(dns_name_totext(name, ISC_FALSE, &buffer));
 			contact[isc_buffer_usedlength(&buffer)] = 0;
@@ -3687,16 +3694,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		     empty != NULL;
 		     empty = empty_zones[++empty_zone])
 		{
-			dns_forwarders_t *forwarders = NULL;
-			dns_view_t *pview = NULL;
+			dns_forwarders_t *dnsforwarders = NULL;
 
-			isc_buffer_constinit(&buffer, empty, strlen(empty));
-			isc_buffer_add(&buffer, strlen(empty));
 			/*
 			 * Look for zone on drop list.
 			 */
-			CHECK(dns_name_fromtext(name, &buffer, dns_rootname, 0,
-						NULL));
+			CHECK(dns_name_fromstring(name, empty, 0, NULL));
 			if (disablelist != NULL &&
 			    on_disable_list(disablelist, name))
 				continue;
@@ -3715,9 +3718,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			 * empty zone for it.
 			 */
 			result = dns_fwdtable_find(view->fwdtable, name,
-						   &forwarders);
+						   &dnsforwarders);
 			if (result == ISC_R_SUCCESS &&
-			    forwarders->fwdpolicy == dns_fwdpolicy_only)
+			    dnsforwarders->fwdpolicy == dns_fwdpolicy_only)
 				continue;
 
 			/*
@@ -3925,17 +3928,18 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
 	/*
 	 * DSCP value for forwarded requests.
 	 */
-	dscpobj = cfg_tuple_get(forwarders, "dscp");
-	if (!cfg_obj_isuint32(dscpobj))
-		dscp = ns_g_dscp;
-	else {
-		if (cfg_obj_asuint32(dscpobj) > 63) {
-			cfg_obj_log(dscpobj, ns_g_lctx, ISC_LOG_ERROR,
-				    "dscp value '%u' is out of range",
-				    cfg_obj_asuint32(dscpobj));
-			return (ISC_R_RANGE);
+	dscp = ns_g_dscp;
+	if (forwarders != NULL) {
+		dscpobj = cfg_tuple_get(forwarders, "dscp");
+		if (cfg_obj_isuint32(dscpobj)) {
+			if (cfg_obj_asuint32(dscpobj) > 63) {
+				cfg_obj_log(dscpobj, ns_g_lctx, ISC_LOG_ERROR,
+					    "dscp value '%u' is out of range",
+					    cfg_obj_asuint32(dscpobj));
+				return (ISC_R_RANGE);
+			}
+			dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
 		}
-		dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
 	}
 
 	faddresses = NULL;
@@ -4251,16 +4255,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 		if (dns_name_equal(origin, dns_rootname)) {
 			const char *hintsfile = cfg_obj_asstring(fileobj);
 
-			result = configure_hints(view, hintsfile);
-			if (result != ISC_R_SUCCESS) {
-				isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-					      NS_LOGMODULE_SERVER,
-					      ISC_LOG_ERROR,
-					      "could not configure root hints "
-					      "from '%s': %s", hintsfile,
-					      isc_result_totext(result));
-				goto cleanup;
-			}
+			CHECK(configure_hints(view, hintsfile));
+
 			/*
 			 * Hint zones may also refer to delegation only points.
 			 */
@@ -4817,11 +4813,6 @@ interface_timer_tick(isc_task_t *task, isc_event_t *event) {
 	INSIST(task == server->task);
 	UNUSED(task);
 
-	if (event->ev_type == NS_EVENT_IFSCAN)
-		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-			      NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
-			      "automatic interface rescan");
-
 	isc_event_free(&event);
 
 	/*
@@ -4998,6 +4989,9 @@ removed(dns_zone_t *zone, void *uap) {
 	case dns_zone_stub:
 		type = "stub";
 		break;
+	case dns_zone_staticstub:
+		type = "static-stub";
+		break;
 	case dns_zone_redirect:
 		type = "redirect";
 		break;
@@ -5093,8 +5087,8 @@ generate_session_key(const char *filename, const char *keynamestr,
 		(int) isc_buffer_usedlength(&key_txtbuffer),
 		(char*) isc_buffer_base(&key_txtbuffer));
 
-	RUNTIME_CHECK(isc_stdio_flush(fp) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_stdio_close(fp) == ISC_R_SUCCESS);
+	CHECK(isc_stdio_flush(fp));
+	CHECK(isc_stdio_close(fp));
 
 	dst_key_free(&key);
 
@@ -5107,6 +5101,11 @@ generate_session_key(const char *filename, const char *keynamestr,
 		      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "failed to generate session key "
 		      "for dynamic DNS: %s", isc_result_totext(result));
+	if (fp != NULL) {
+		if (isc_file_exists(filename))
+			(void)isc_file_remove(filename);
+		(void)isc_stdio_close(fp);
+	}
 	if (tsigkey != NULL)
 		dns_tsigkey_detach(&tsigkey);
 	if (key != NULL)
@@ -5573,10 +5572,11 @@ load_configuration(const char *filename, ns_server_t *server,
 			isc_portset_addrange(v4portset, udpport_low,
 					     udpport_high);
 		}
-		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "using default UDP/IPv4 port range: [%d, %d]",
-			      udpport_low, udpport_high);
+		if (!ns_g_disable4)
+			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "using default UDP/IPv4 port range: "
+				      "[%d, %d]", udpport_low, udpport_high);
 	}
 	(void)ns_config_get(maps, "avoid-v4-udp-ports", &avoidv4ports);
 	if (avoidv4ports != NULL)
@@ -5595,10 +5595,11 @@ load_configuration(const char *filename, ns_server_t *server,
 			isc_portset_addrange(v6portset, udpport_low,
 					     udpport_high);
 		}
-		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "using default UDP/IPv6 port range: [%d, %d]",
-			      udpport_low, udpport_high);
+		if (!ns_g_disable6)
+			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "using default UDP/IPv6 port range: "
+				      "[%d, %d]", udpport_low, udpport_high);
 	}
 	(void)ns_config_get(maps, "avoid-v6-udp-ports", &avoidv6ports);
 	if (avoidv6ports != NULL)
@@ -6110,7 +6111,6 @@ load_configuration(const char *filename, ns_server_t *server,
 				(void)cfg_map_get(logobj, "category",
 						  &categories);
 			if (categories != NULL) {
-				const cfg_listelt_t *element;
 				for (element = cfg_list_first(categories);
 				     element != NULL;
 				     element = cfg_list_next(element))
@@ -6478,7 +6478,7 @@ run_server(isc_task_t *task, isc_event_t *event) {
 
 	CHECKFATAL(ns_interfacemgr_create(ns_g_mctx, ns_g_taskmgr,
 					  ns_g_socketmgr, ns_g_dispatchmgr,
-					  &server->interfacemgr),
+					  server->task, &server->interfacemgr),
 		   "creating interface manager");
 
 	CHECKFATAL(isc_timer_create(ns_g_timermgr, isc_timertype_inactive,
@@ -7025,13 +7025,16 @@ ns_server_reloadwanted(ns_server_t *server) {
 
 void
 ns_server_scan_interfaces(ns_server_t *server) {
-	isc_event_t *event;
+	isc_result_t result;
 
-	event = isc_event_allocate(ns_g_mctx, server, NS_EVENT_IFSCAN,
-				   interface_timer_tick, server,
-				   sizeof(isc_event_t));
-	if (event != NULL)
-		isc_task_send(server->task, &event);
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+		      NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
+		      "automatic interface rescan");
+
+	result = isc_task_beginexclusive(server->task);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	scan_interfaces(server, ISC_TRUE);
+	isc_task_endexclusive(server->task);
 }
 
 static char *
@@ -7118,6 +7121,10 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt,
 			snprintf(problem, sizeof(problem),
 				 "no matching zone '%s' in any view",
 				 zonetxt);
+		else if (result == ISC_R_MULTIPLE)
+			snprintf(problem, sizeof(problem),
+				 "zone '%s' was found in multiple views",
+				 zonetxt);
 	} else {
 		result = dns_viewlist_find(&server->viewlist, viewtxt,
 					   rdclass, &view);
@@ -7144,9 +7151,8 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt,
 		isc_result_t tresult;
 
 		tresult = putstr(text, problem);
-		if (tresult == ISC_R_SUCCESS &&
-		    isc_buffer_availablelength(text) > 0U)
-			isc_buffer_putuint8(text, 0);
+		if (tresult == ISC_R_SUCCESS)
+			(void) putnull(text);
 	}
 
  cleanup:
@@ -7909,35 +7915,22 @@ ns_server_validation(ns_server_t *server, char *args, isc_buffer_t *text) {
 			continue;
 		result = dns_view_flushcache(view);
 		if (result != ISC_R_SUCCESS)
-			goto out;
+			goto cleanup;
 
 		if (set) {
 			view->enablevalidation = enable;
 			changed = ISC_TRUE;
 		} else {
-			unsigned int n;
-			if (!first) {
-				n = snprintf((char *)isc_buffer_used(text),
-					     isc_buffer_availablelength(text),
-					     "\n");
-				if (n >= isc_buffer_availablelength(text)) {
-					result = ISC_R_NOSPACE;
-					goto out;
-				}
-				isc_buffer_add(text, n);
-			}
+			if (!first)
+				CHECK(putstr(text, "\n"));
+			CHECK(putstr(text, "DNSSEC validation is "));
+			CHECK(putstr(text, view->enablevalidation
+				       ? "enabled" : "disabled"));
+			CHECK(putstr(text, " (view "));
+			CHECK(putstr(text, view->name));
+			CHECK(putstr(text, ")"));
+			CHECK(putnull(text));
 			first = ISC_FALSE;
-			n = snprintf((char *)isc_buffer_used(text),
-				     isc_buffer_availablelength(text),
-				     "DNSSEC validation is %s (view %s)",
-				     view->enablevalidation ?
-				       "enabled" : "disabled",
-				     view->name);
-			if (n >= isc_buffer_availablelength(text)) {
-				result = ISC_R_NOSPACE;
-				goto out;
-			}
-			isc_buffer_add(text, n);
 		}
 	}
 
@@ -7947,7 +7940,7 @@ ns_server_validation(ns_server_t *server, char *args, isc_buffer_t *text) {
 		result = ISC_R_SUCCESS;
 	else
 		result = ISC_R_FAILURE;
- out:
+ cleanup:
 	isc_task_endexclusive(server->task);
 	return (result);
 }
@@ -8361,7 +8354,6 @@ list_keynames(dns_view_t *view, dns_tsig_keyring_t *ring, isc_buffer_t *text,
 	dns_name_t *origin;
 	dns_rbtnode_t *node;
 	dns_tsigkey_t *tkey;
-	unsigned int n;
 	const char *viewname;
 
 	if (view != NULL)
@@ -8395,21 +8387,26 @@ list_keynames(dns_view_t *view, dns_tsig_keyring_t *ring, isc_buffer_t *text,
 			if (tkey->generated) {
 				dns_name_format(tkey->creator, creatorstr,
 						sizeof(creatorstr));
-				n = snprintf((char *)isc_buffer_used(text),
-					     isc_buffer_availablelength(text),
-					     "view \"%s\"; type \"dynamic\"; key \"%s\"; creator \"%s\";\n",
-					     viewname, namestr, creatorstr);
+				if (*foundkeys != 0)
+					CHECK(putstr(text, "\n"));
+				CHECK(putstr(text, "view \""));
+				CHECK(putstr(text, viewname));
+				CHECK(putstr(text,
+					     "\"; type \"dynamic\"; key \""));
+				CHECK(putstr(text, namestr));
+				CHECK(putstr(text, "\"; creator \""));
+				CHECK(putstr(text, creatorstr));
+				CHECK(putstr(text, "\";"));
 			} else {
-				n = snprintf((char *)isc_buffer_used(text),
-					     isc_buffer_availablelength(text),
-					     "view \"%s\"; type \"static\"; key \"%s\";\n",
-					     viewname, namestr);
+				if (*foundkeys != 0)
+					CHECK(putstr(text, "\n"));
+				CHECK(putstr(text, "view \""));
+				CHECK(putstr(text, viewname));
+				CHECK(putstr(text,
+					     "\"; type \"static\"; key \""));
+				CHECK(putstr(text, namestr));
+				CHECK(putstr(text, "\";"));
 			}
-			if (n >= isc_buffer_availablelength(text)) {
-				dns_rbtnodechain_invalidate(&chain);
-				return (ISC_R_NOSPACE);
-			}
-			isc_buffer_add(text, n);
 		}
 		result = dns_rbtnodechain_next(&chain, &foundname, origin);
 		if (result == ISC_R_NOMORE)
@@ -8421,12 +8418,14 @@ list_keynames(dns_view_t *view, dns_tsig_keyring_t *ring, isc_buffer_t *text,
 	}
 
 	return (ISC_R_SUCCESS);
+
+cleanup:
+	return (result);
 }
 
 isc_result_t
 ns_server_tsiglist(ns_server_t *server, isc_buffer_t *text) {
 	isc_result_t result;
-	unsigned int n;
 	dns_view_t *view;
 	unsigned int foundkeys = 0;
 
@@ -8454,16 +8453,16 @@ ns_server_tsiglist(ns_server_t *server, isc_buffer_t *text) {
 	}
 	isc_task_endexclusive(server->task);
 
-	if (foundkeys == 0) {
-		n = snprintf((char *)isc_buffer_used(text),
-			     isc_buffer_availablelength(text),
-			     "no tsig keys found.\n");
-		if (n >= isc_buffer_availablelength(text))
-			return (ISC_R_NOSPACE);
-		isc_buffer_add(text, n);
-	}
+	if (foundkeys == 0)
+		CHECK(putstr(text, "no tsig keys found."));
+
+	if (isc_buffer_usedlength(text) > 0)
+		CHECK(putnull(text));
 
 	return (ISC_R_SUCCESS);
+
+ cleanup:
+	return (result);
 }
 
 /*
@@ -8778,8 +8777,8 @@ add_comment(FILE *fp, const char *viewname) {
  * Act on an "addzone" command from the command channel.
  */
 isc_result_t
-ns_server_add_zone(ns_server_t *server, char *args) {
-	isc_result_t	     result;
+ns_server_add_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
+	isc_result_t	     result, tresult;
 	isc_buffer_t	     argbuf;
 	size_t		     arglen;
 	cfg_parser_t	    *parser = NULL;
@@ -8794,7 +8793,7 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 	const char	    *argp;
 	const char	    *viewname = NULL;
 	dns_rdataclass_t     rdclass;
-	dns_view_t	    *view = 0;
+	dns_view_t	    *view = NULL;
 	isc_buffer_t	     buf;
 	dns_fixedname_t	     fname;
 	dns_name_t	    *dnsname;
@@ -8875,7 +8874,14 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 	}
 
 	/* Open save file for write configuration */
-	CHECK(isc_stdio_open(view->new_zone_file, "a", &fp));
+	result = isc_stdio_open(view->new_zone_file, "a", &fp);
+	if (result != ISC_R_SUCCESS) {
+		TCHECK(putstr(text, "unable to open '"));
+		TCHECK(putstr(text, view->new_zone_file));
+		TCHECK(putstr(text, "': "));
+		TCHECK(putstr(text, isc_result_totext(result)));
+		goto cleanup;
+	}
 	CHECK(isc_stdio_tell(fp, &offset));
 	if (offset == 0)
 		CHECK(add_comment(fp, view->name));
@@ -8889,8 +8895,11 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 				ISC_FALSE, ISC_FALSE);
 	dns_view_freeze(view);
 	isc_task_endexclusive(server->task);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
+		TCHECK(putstr(text, "configure_zone failed: "));
+		TCHECK(putstr(text, isc_result_totext(result)));
 		goto cleanup;
+	}
 
 	/* Is it there yet? */
 	CHECK(dns_zt_find(view->zonetable, dnsname, 0, NULL, &zone));
@@ -8903,6 +8912,9 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 	if (result != ISC_R_SUCCESS) {
 		dns_db_t *dbp = NULL;
 
+		TCHECK(putstr(text, "dns_zone_loadnew failed: "));
+		TCHECK(putstr(text, isc_result_totext(result)));
+
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "addzone failed; reverting.");
@@ -8924,7 +8936,7 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 	/* Emit the zone name, quoted and escaped */
 	isc_buffer_init(&buf, namebuf, sizeof(namebuf));
 	CHECK(dns_name_totext(dnsname, ISC_TRUE, &buf));
-	isc_buffer_putuint8(&buf, 0);
+	putnull(&buf);
 	CHECK(isc_stdio_write("zone \"", 6, 1, fp, NULL));
 	CHECK(isc_stdio_write(namebuf, strlen(namebuf), 1, fp, NULL));
 	CHECK(isc_stdio_write("\" ", 2, 1, fp, NULL));
@@ -8963,6 +8975,8 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 	result = ISC_R_SUCCESS;
 
  cleanup:
+	if (isc_buffer_usedlength(text) > 0)
+		putnull(text);
 	if (fp != NULL)
 		isc_stdio_close(fp);
 	if (parser != NULL) {
@@ -8987,10 +9001,10 @@ inuse(const char* file, isc_boolean_t first, isc_buffer_t *text) {
 	    strlen(file) + (first ? sizeof(INUSEMSG) : sizeof("\n")))
 	{
 		if (first)
-			isc_buffer_putstr(text, INUSEMSG);
+			(void) putstr(text, INUSEMSG);
 		else
-			isc_buffer_putstr(text, "\n");
-		isc_buffer_putstr(text, file);
+			(void) putstr(text, "\n");
+		(void) putstr(text, file);
 		return (ISC_FALSE);
 	}
 	return (first);
@@ -9149,6 +9163,16 @@ ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 				result = isc_stdio_read(buf, 1, 1024, ifp, &n);
 			}
 
+			/*
+			 * Close files before overwriting the nzfile
+			 * with the temporary file as it's necessary on
+			 * some platforms (win32).
+			 */
+			(void) isc_stdio_close(ifp);
+			ifp = NULL;
+			(void) isc_stdio_close(ofp);
+			ofp = NULL;
+
 			/* Move temporary into place */
 			CHECK(isc_file_rename(tmpname, view->new_zone_file));
 		} else {
@@ -9170,6 +9194,8 @@ ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 	dns_zone_getraw(zone, &raw);
 	mayberaw = (raw != NULL) ? raw : zone;
 	if (cleanup) {
+		isc_result_t tresult;
+
 		file = dns_zone_getfile(mayberaw);
 		if (isc_file_exists(file))
 			isc_file_remove(file);
@@ -9187,10 +9213,10 @@ ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 			if (isc_file_exists(file))
 				isc_file_remove(file);
 		}
-		isc_buffer_putstr(text, "zone ");
-		isc_buffer_putstr(text, zonename);
-		isc_buffer_putstr(text, " and associated files deleted");
-		isc_buffer_putuint8(text, 0);
+		TCHECK(putstr(text, "zone "));
+		TCHECK(putstr(text, zonename));
+		TCHECK(putstr(text, " and associated files deleted"));
+		TCHECK(putnull(text));
 	} else if (dns_zone_gettype(mayberaw) == dns_zone_slave ||
 		   dns_zone_gettype(mayberaw) == dns_zone_stub)
 	{
@@ -9209,8 +9235,7 @@ ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 			file = dns_zone_getjournal(zone);
 			(void)inuse(file, first, text);
 		}
-		if (isc_buffer_availablelength(text) > 0)
-			isc_buffer_putuint8(text, 0);
+		putnull(text);
 	}
 
 	CHECK(dns_zt_unmount(view->zonetable, zone));
@@ -9225,16 +9250,18 @@ ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 	result = ISC_R_SUCCESS;
 
  cleanup:
+	if (isc_buffer_usedlength(text) > 0)
+		putnull(text);
 	if (exclusive)
 		isc_task_endexclusive(server->task);
 	if (ifp != NULL)
 		isc_stdio_close(ifp);
-	if (ofp != NULL) {
+	if (ofp != NULL)
 		isc_stdio_close(ofp);
+	if (tmpname != NULL) {
 		isc_file_remove(tmpname);
-	}
-	if (tmpname != NULL)
 		isc_mem_free(server->mctx, tmpname);
+	}
 	if (raw != NULL)
 		dns_zone_detach(&raw);
 	if (zone != NULL)
@@ -9288,7 +9315,7 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	for (i = 0; i < n; i++)
 		isc_random_get(&rnd.rnd32[i]);
 
-	memcpy(salt, rnd.rnd, saltlen);
+	memmove(salt, rnd.rnd, saltlen);
 
 	r.base = rnd.rnd;
 	r.length = (unsigned int) saltlen;
@@ -9318,7 +9345,7 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 	isc_boolean_t first = ISC_TRUE;
 	isc_boolean_t list = ISC_FALSE, clear = ISC_FALSE;
 	isc_boolean_t chain = ISC_FALSE;
-	char keystr[DNS_SECALG_FORMATSIZE + 7];
+	char keystr[DNS_SECALG_FORMATSIZE + 7]; /* <5-digit keyid>/<alg> */
 	unsigned short hash = 0, flags = 0, iter = 0, saltlen = 0;
 	unsigned char salt[255];
 	const char *ptr;
@@ -9344,7 +9371,7 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 		ptr = next_token(&args, " \t");
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
-		memmove(keystr, ptr, sizeof(keystr));
+		strlcpy(keystr, ptr, sizeof(keystr));
 	} else if (strcasecmp(ptr, "-nsec3param") == 0) {
 		const char *hashstr, *flagstr, *iterstr;
 		char nbuf[512];
@@ -9403,15 +9430,15 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 
 	if (clear) {
 		CHECK(dns_zone_keydone(zone, keystr));
-		isc_buffer_putstr(text, "request queued");
-		isc_buffer_putuint8(text, 0);
+		putstr(text, "request queued");
+		putnull(text);
 	} else if (chain) {
 		CHECK(dns_zone_setnsec3param(zone, (isc_uint8_t)hash,
 					     (isc_uint8_t)flags, iter,
 					     (isc_uint8_t)saltlen, salt,
 					     ISC_TRUE));
-		isc_buffer_putstr(text, "request queued");
-		isc_buffer_putuint8(text, 0);
+		putstr(text, "request queued");
+		putnull(text);
 	} else if (list) {
 		privatetype = dns_zone_getprivatetype(zone);
 		origin = dns_zone_getorigin(zone);
@@ -9423,8 +9450,8 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 					     dns_rdatatype_none, 0,
 					     &privset, NULL);
 		if (result == ISC_R_NOTFOUND) {
-			isc_buffer_putstr(text, "No signing records found");
-			isc_buffer_putuint8(text, 0);
+			putstr(text, "No signing records found");
+			putnull(text);
 			result = ISC_R_SUCCESS;
 			goto cleanup;
 		}
@@ -9443,7 +9470,7 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 			CHECK(dns_private_totext(&priv, &buf));
 
 			if (!first)
-				isc_buffer_putstr(text, "\n");
+				putstr(text, "\n");
 			first = ISC_FALSE;
 
 			n = snprintf((char *)isc_buffer_used(text),
@@ -9454,8 +9481,8 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 
 			isc_buffer_add(text, (unsigned int)n);
 		}
-		if (!first && isc_buffer_availablelength(text) > 0)
-			isc_buffer_putuint8(text, 0);
+		if (!first)
+			putnull(text);
 
 		if (result == ISC_R_NOMORE)
 			result = ISC_R_SUCCESS;
@@ -9490,6 +9517,15 @@ putstr(isc_buffer_t *b, const char *str) {
 	return (ISC_R_SUCCESS);
 }
 
+static isc_result_t
+putnull(isc_buffer_t *b) {
+	if (isc_buffer_availablelength(b) == 0)
+		return (ISC_R_NOSPACE);
+
+	isc_buffer_putuint8(b, 0);
+	return (ISC_R_SUCCESS);
+}
+
 isc_result_t
 ns_server_zonestatus(ns_server_t *server, char *args, isc_buffer_t *text) {
 	isc_result_t result = ISC_R_SUCCESS;
@@ -9722,11 +9758,10 @@ ns_server_zonestatus(ns_server_t *server, char *args, isc_buffer_t *text) {
 
  cleanup:
 	/* Indicate truncated output if possible. */
-	if (result == ISC_R_NOSPACE && isc_buffer_availablelength(text) > 4U)
-		isc_buffer_putstr(text, "\n...");
-	if ((result == ISC_R_SUCCESS || result == ISC_R_NOSPACE) &&
-	    isc_buffer_availablelength(text) > 0)
-		isc_buffer_putuint8(text, 0);
+	if (result == ISC_R_NOSPACE)
+		(void) putstr(text, "\n...");
+	if ((result == ISC_R_SUCCESS || result == ISC_R_NOSPACE))
+		putnull(text);
 
 	if (db != NULL)
 		dns_db_detach(&db);

bin/named/statschannel.c

@@ -79,6 +79,12 @@ stats_dumparg {
 
 static isc_once_t once = ISC_ONCE_INIT;
 
+#if defined(HAVE_LIBXML2) || defined(HAVE_JSON)
+#define EXTENDED_STATS
+#else
+#undef EXTENDED_STATS
+#endif
+
 /*%
  * Statistics descriptions.  These could be statistically initialized at
  * compile time, but we configure them run time in the init_desc() function
@@ -90,7 +96,7 @@ static const char *adbstats_desc[dns_adbstats_max];
 static const char *zonestats_desc[dns_zonestatscounter_max];
 static const char *sockstats_desc[isc_sockstatscounter_max];
 static const char *dnssecstats_desc[dns_dnssecstats_max];
-#ifdef HAVE_LIBXML2
+#if defined(EXTENDED_STATS)
 static const char *nsstats_xmldesc[dns_nsstatscounter_max];
 static const char *resstats_xmldesc[dns_resstatscounter_max];
 static const char *adbstats_xmldesc[dns_adbstats_max];
@@ -104,7 +110,7 @@ static const char *dnssecstats_xmldesc[dns_dnssecstats_max];
 #define zonestats_xmldesc NULL
 #define sockstats_xmldesc NULL
 #define dnssecstats_xmldesc NULL
-#endif	/* HAVE_LIBXML2 */
+#endif	/* EXTENDED_STATS */
 
 #define TRY0(a) do { xmlrc = (a); if (xmlrc < 0) goto error; } while(0)
 
@@ -125,13 +131,13 @@ set_desc(int counter, int maxcounter, const char *fdesc, const char **fdescs,
 	 const char *xdesc, const char **xdescs)
 {
 	REQUIRE(counter < maxcounter);
-	REQUIRE(fdescs[counter] == NULL);
-#ifdef HAVE_LIBXML2
-	REQUIRE(xdescs[counter] == NULL);
+	REQUIRE(fdescs != NULL && fdescs[counter] == NULL);
+#if defined(EXTENDED_STATS)
+	REQUIRE(xdescs != NULL && xdescs[counter] == NULL);
 #endif
 
 	fdescs[counter] = fdesc;
-#ifdef HAVE_LIBXML2
+#if defined(EXTENDED_STATS)
 	xdescs[counter] = xdesc;
 #else
 	UNUSED(xdesc);
@@ -146,7 +152,7 @@ init_desc(void) {
 	/* Initialize name server statistics */
 	for (i = 0; i < dns_nsstatscounter_max; i++)
 		nsstats_desc[i] = NULL;
-#ifdef HAVE_LIBXML2
+#if defined(EXTENDED_STATS)
 	for (i = 0; i < dns_nsstatscounter_max; i++)
 		nsstats_xmldesc[i] = NULL;
 #endif
@@ -241,7 +247,7 @@ init_desc(void) {
 	/* Initialize resolver statistics */
 	for (i = 0; i < dns_resstatscounter_max; i++)
 		resstats_desc[i] = NULL;
-#ifdef  HAVE_LIBXML2
+#if defined(EXTENDED_STATS)
 	for (i = 0; i < dns_resstatscounter_max; i++)
 		resstats_xmldesc[i] = NULL;
 #endif
@@ -326,7 +332,7 @@ init_desc(void) {
 	/* Initialize adb statistics */
 	for (i = 0; i < dns_adbstats_max; i++)
 		adbstats_desc[i] = NULL;
-#ifdef  HAVE_LIBXML2
+#if defined(EXTENDED_STATS)
 	for (i = 0; i < dns_adbstats_max; i++)
 		adbstats_xmldesc[i] = NULL;
 #endif
@@ -348,7 +354,7 @@ init_desc(void) {
 	/* Initialize zone statistics */
 	for (i = 0; i < dns_zonestatscounter_max; i++)
 		zonestats_desc[i] = NULL;
-#ifdef  HAVE_LIBXML2
+#if defined(EXTENDED_STATS)
 	for (i = 0; i < dns_zonestatscounter_max; i++)
 		zonestats_xmldesc[i] = NULL;
 #endif
@@ -381,7 +387,7 @@ init_desc(void) {
 	/* Initialize socket statistics */
 	for (i = 0; i < isc_sockstatscounter_max; i++)
 		sockstats_desc[i] = NULL;
-#ifdef  HAVE_LIBXML2
+#if defined(EXTENDED_STATS)
 	for (i = 0; i < isc_sockstatscounter_max; i++)
 		sockstats_xmldesc[i] = NULL;
 #endif
@@ -500,7 +506,7 @@ init_desc(void) {
 	/* Initialize DNSSEC statistics */
 	for (i = 0; i < dns_dnssecstats_max; i++)
 		dnssecstats_desc[i] = NULL;
-#ifdef  HAVE_LIBXML2
+#if defined(EXTENDED_STATS)
 	for (i = 0; i < dns_dnssecstats_max; i++)
 		dnssecstats_xmldesc[i] = NULL;
 #endif
@@ -537,7 +543,7 @@ init_desc(void) {
 		INSIST(sockstats_desc[i] != NULL);
 	for (i = 0; i < dns_dnssecstats_max; i++)
 		INSIST(dnssecstats_desc[i] != NULL);
-#ifdef  HAVE_LIBXML2
+#if defined(EXTENDED_STATS)
 	for (i = 0; i < dns_nsstatscounter_max; i++)
 		INSIST(nsstats_xmldesc[i] != NULL);
 	for (i = 0; i < dns_resstatscounter_max; i++)
@@ -581,7 +587,7 @@ dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 	json_object *job, *cat, *counter;
 #endif
 
-#if !defined(HAVE_LIBXML2) && !defined(HAVE_JSON)
+#if !defined(EXTENDED_STATS)
 	UNUSED(category);
 #endif
 
@@ -2353,11 +2359,11 @@ ns_statschannels_configure(ns_server_t *server, const cfg_obj_t *config,
 	 * address-in-use error.
 	 */
 	if (statschannellist != NULL) {
-#ifndef HAVE_LIBXML2
+#ifndef EXTENDED_STATS
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "statistics-channels specified but not effective "
-			      "due to missing XML library");
+			      "due to missing XML and/or JSON library");
 #endif
 
 		for (element = cfg_list_first(statschannellist);

bin/named/unix/dlz_dlopen_driver.c

@@ -245,11 +245,13 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 
 	cd->dl_path = isc_mem_strdup(cd->mctx, argv[1]);
 	if (cd->dl_path == NULL) {
+		result = ISC_R_NOMEMORY;
 		goto failed;
 	}
 
 	cd->dlzname = isc_mem_strdup(cd->mctx, dlzname);
 	if (cd->dlzname == NULL) {
+		result = ISC_R_NOMEMORY;
 		goto failed;
 	}
 
@@ -279,6 +281,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 		dlopen_log(ISC_LOG_ERROR,
 			   "dlz_dlopen failed to open library '%s' - %s",
 			   cd->dl_path, dlerror());
+		result = ISC_R_FAILURE;
 		goto failed;
 	}
 
@@ -298,6 +301,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	    cd->dlz_findzonedb == NULL)
 	{
 		/* We're missing a required symbol */
+		result = ISC_R_FAILURE;
 		goto failed;
 	}
 
@@ -379,7 +383,6 @@ failed:
 	return (result);
 }
 
-
 /*
  * Called when bind is shutting down
  */

bin/named/update.c

@@ -2917,10 +2917,18 @@ update_action(isc_task_t *task, isc_event_t *event) {
 					dns_diff_clear(&ctx.del_diff);
 					dns_diff_clear(&ctx.add_diff);
 				} else {
-					CHECK(do_diff(&ctx.del_diff, db, ver,
-						      &diff));
-					CHECK(do_diff(&ctx.add_diff, db, ver,
-						      &diff));
+					result = do_diff(&ctx.del_diff, db, ver,
+							 &diff);
+					if (result == ISC_R_SUCCESS) {
+						result = do_diff(&ctx.add_diff,
+								 db, ver,
+								 &diff);
+					}
+					if (result != ISC_R_SUCCESS) {
+						dns_diff_clear(&ctx.del_diff);
+						dns_diff_clear(&ctx.add_diff);
+						goto failure;
+					}
 					CHECK(update_one_rr(db, ver, &diff,
 							    DNS_DIFFOP_ADD,
 							    name, ttl, &rdata));
@@ -3069,10 +3077,9 @@ update_action(isc_task_t *task, isc_event_t *event) {
 #define ALLOW_SECURE_TO_INSECURE(zone) \
 	((dns_zone_getoptions(zone) & DNS_ZONEOPT_SECURETOINSECURE) != 0)
 
+		CHECK(rrset_exists(db, oldver, zonename, dns_rdatatype_dnskey,
+				   0, &had_dnskey));
 		if (!ALLOW_SECURE_TO_INSECURE(zone)) {
-			CHECK(rrset_exists(db, oldver, zonename,
-					   dns_rdatatype_dnskey, 0,
-					   &had_dnskey));
 			if (had_dnskey && !has_dnskey) {
 				update_log(client, zone, LOGLEVEL_PROTOCOL,
 					   "update rejected: all DNSKEY "
@@ -3262,6 +3269,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	uev->ev_type = DNS_EVENT_UPDATEDONE;
 	uev->ev_action = updatedone_action;
 	isc_task_send(client->task, &event);
+
+	INSIST(ver == NULL);
 	INSIST(event == NULL);
 }