This commit was manufactured by cvs2git to create tag 'v9_5_0b1'.

update copyright notice
newcopyrights
2008-06-24 23:46:28 +00:00 · 2008-06-24 23:46:27 +00:00 · 2008-06-24 23:30:18 +00:00 · 2008-06-24 23:30:17 +00:00 · 2008-06-24 23:26:49 +00:00 · 2008-06-24 21:43:44 +00:00
320 changed files with 42859 additions and 58967 deletions
@@ -1,343 +1,3 @@
-2382.	[doc]		Add descriptions of DHCID, IPSECKEY, SPF and SSHFP
-			to ARM.
-
-2381.	[port]		dlz/mysql: support multiple install layouts for
-			mysql.  <prefix>/include/{,mysql/}mysql.h and
-			<prefix>/lib/{,mysql/}. [RT #18152]
-
-2380.	[bug]		dns_view_find() was not returning NXDOMAIN/NXRRSET
-			proofs which, in turn, caused validation failures
-			for insecure zones immediately below a secure zone
-			the server was authoritative for. [RT #18112] 
-
-2379.	[contrib]	queryperf/gen-data-queryperf.py: removed redundant
-			TLDs and supported RRs with TTLs [RT #17972]
-
-2378.	[bug]		gssapi_functions{} had a redundant member in BIND 9.5.
-			[RT #18169]
-
-2377.	[bug]		Address race condition in dnssec-signzone. [RT #18142]
-
-2376.	[bug]		Change #2144 was not complete.
-
-2375.	[placeholder]
-
-2374.	[bug]		"blackhole" ACLs could cause named to segfault due
-			to some uninitialized memory. [RT #18095]
-
-2373.	[bug]		Default values of zone ACLs were re-parsed each time a
-			new zone was configured, causing an overconsumption
-			of memory. [RT #18092]
-
-2372.	[bug]		Fixed incorrect TAG_HMACSHA256_BITS value [RT #18047]
-
-2371.	[doc]		Add +nsid option to dig man page. [RT #18039]
-
-2370.	[bug]		"rndc freeze" could trigger an assertion in named
-			when called on a nonexistent zone. [RT #18050]
-
-2369.	[bug]		libbind: Array bounds overrun on read in bitncmp().
-			[RT #18054]
-
-2368.	[port]		Linux: use libcap for capability management if
-			possible. [RT# 18026]
-
-2367.	[bug]		Improve counting of dns_resstatscounter_retry
-			[RT #18030]
-
-2366.	[bug]		Adb shutdown race. [RT #18021]
-
-2365.	[bug]		Fix a bug that caused dns_acl_isany() to return
-			spurious results. [RT #18000]
-
-2364.	[bug]		named could trigger a assertion when serving a
-			malformed signed zone. [RT #17828]
-
-2363.	[port]		sunos: pre-set "lt_cv_sys_max_cmd_len=4096;".
-			[RT #17513]
-
-2362.   [cleanup]	Make "rrset-order fixed" a compile-time option.
-			settable by "./configure --enable-fixed-rrset".
-			Disabled by default. [RT #17977]
-
-2361.	[bug]		"recursion" statistics counter could be counted
-			multiple times for a single query.  [RT #17990]
-
-2360.	[bug]		Fix a condition where we release a database version
-			(which may acquire a lock) while holding the lock.
-
-2359.	[bug]		Fix NSID bug. [RT #17942]
-
-2358.	[doc]		Update host's default query description. [RT #17934]
-
-2357.	[port]		Don't use OpenSSL's engine support in versions before
-			OpenSSL 0.9.7f. [RT #17922]
-
-2356.	[bug]		Built in mutex profiler was not scalable enough.
-			[RT #17436]
-
-2355.	[func]		Extend the number statistics counters available.
-			[RT #17590]
-
-2354.	[bug]		Failed to initialize some rdatasetheader_t elements.
-			[RT #17927]
-
-2353.	[func]		Add support for Name Server ID (RFC 5001).
-			'dig +nsid' requests NSID from server.
-			'request-nsid yes;' causes recursive server to send
-			NSID requests to upstream servers.  Server responds
-			to NSID requests with the string configured by
-			'server-id' option.  [RT #17091]
-
-2352.	[bug]		Various GSS_API fixups. [RT #17729]
-
-2351.	[bug]		convertxsl.pl generated very long lines. [RT #17906]
-
-2350.	[port]		win32: IPv6 support. [RT #17797]
-
-2349.	[func]		Provide incremental re-signing support for secure
-			dynamic zones. [RT #1091]
-
-2348.	[func]		Use the EVP interface to OpenSSL. Add PKCS#11 support.
-			Documentation is in the new README.pkcs11 file.
-			[RT #16844]
-
-2347.	[bug]		Delete now traverses the RB tree in the canonical
-			order. [RT #17451]
-
-2346.	[func]		Memory statistics now cover all active memory contexts
-			in increased detail. [RT #17580]
-
-2345.	[bug]		named-checkconf failed to detect when forwarders
-			were set at both the options/view level and in
-			a root zone. [RT #17671]
-
-2344.	[bug]		Improve "logging{ file ...; };" documentation.
-			[RT #17888]
-
-2343.	[bug]		(Seemingly) duplicate IPv6 entries could be
-			created in ADB. [RT #17837]
-
-2342.	[func]		Use getifaddrs() if available under Linux. [RT #17224]
-
-2341.	[bug]		libbind: add missing -I../include for off source
-			tree builds. [RT #17606]
-
-2340.	[port]		openbsd: interface configuration. [RT #17700]
-
-2339.	[port]		tru64: support for libbind. [RT #17589]
-
-2338.	[bug]		check_ds() could be called with a non DS rdataset.
-			[RT #17598]
-
-2337.	[bug]		BUILD_LDFLAGS was not being correctly set.  [RT #17614]
-
-2336.	[func]		If "named -6" is specified then listen on all IPv6
-			interfaces if there are not listen-on-v6 clauses in
-			named.conf.  [RT #17581]
-
-2335.	[port]		sunos:  libbind and *printf() support for long long. 
-			[RT #17513]
-
-2334.	[bug]		Bad REQUIRES in fromstruct_in_naptr(),  off by one
-			bug in fromstruct_txt(). [RT #17609]
-			
-2333.	[bug]		Fix off by one error in isc_time_nowplusinterval().
-			[RT #17608]
-
-2332.	[contrib]	query-loc-0.4.0. [RT #17602]
-
-2331.	[bug]		Failure to regenerate any signatures was not being
-			reported nor being past back to the UPDATE client.
-			[RT #17570]
-
-2330.	[bug]		Remove potential race condition when handling
-			over memory events. [RT #17572]
-
-			WARNING: API CHANGE: over memory callback
-			function now needs to call isc_mem_waterack().
-			See <isc/mem.h> for details.
-
-2329.	[bug]		Clearer help text for dig's '-x' and '-i' options.
-
-2328.	[maint]		Add AAAA addresses for A.ROOT-SERVERS.NET,
-			F.ROOT-SERVERS.NET, H.ROOT-SERVERS.NET,
-			J.ROOT-SERVERS.NET, K.ROOT-SERVERS.NET and
-			M.ROOT-SERVERS.NET.
-
-2327.	[bug]		It was possible to dereference a NULL pointer in
-			rbtdb.c.  Implement dead node processing in zones as
-			we do for caches. [RT #17312]
-
-2326.	[bug]		It was possible to trigger a INSIST in the acache
-			processing.
-
-2325.	[port]		Linux: use capset() function if available. [RT #17557]
-
-2324.	[bug]		Fix IPv6 matching against "any;". [RT #17533]
-
-2323.	[port]		tru64: namespace clash. [RT #17547]
-
-2322.	[port]		MacOS: work around the limitation of setrlimit()
-			for RLIMIT_NOFILE. [RT #17526]
-
-2321.	[placeholder]
-
-2320.	[func]		Make statistics counters thread-safe for platforms
-			that support certain atomic operations. [RT #17466]
-
-2319.	[bug]		Silence Coverity warnings in 
-			lib/dns/rdata/in_1/apl_42.c. [RT #17469]
-
-2318.	[port]		sunos fixes for libbind.  [RT #17514]
-
-2317.	[bug]		"make distclean" removed bind9.xsl.h. [RT #17518]
-
-2316.	[port]		Missing #include <isc/print.h> in lib/dns/gssapictx.c.
-			[RT #17513]
-
-2315.   [bug]           Used incorrect address family for mapped IPv4
-                        addresses in acl.c. [RT #17519]
-
-2314.	[bug]		Uninitialized memory use on error path in
-			bin/named/lwdnoop.c.  [RT #17476]
-
-2313.	[cleanup]	Silence Coverity warnings. Handle private stacks.
-			[RT #17447] [RT #17478]
-
-2312.	[cleanup]	Silence Coverity warning in lib/isc/unix/socket.c.
-			[RT #17458]
-
-2311.   [bug]           IPv6 addresses could match IPv4 ACL entries and
-                        vice versa. [RT #17462]
-
-2310.	[bug]		dig, host, nslookup: flush stdout before emitting
-			debug/fatal messages.  [RT #17501]
-
-2309.   [cleanup]       Fix Coverity warnings in lib/dns/acl.c and iptable.c.
-                        [RT #17455]
-
-2308.	[cleanup]	Silence Coverity warning in bin/named/controlconf.c.
-			[RT #17495]
-
-2307.	[bug]		Remove infinite loop from lib/dns/sdb.c. [RT #17496]
-
-2306.	[bug]		Remove potential race from lib/dns/resolver.c.
-			[RT #17470]
-
-2305.	[security]	inet_network() buffer overflow. CVE-2008-0122.
-
-2304.	[bug]		Check returns from all dns_rdata_tostruct() calls.
-			[RT #17460]
-
-2303.	[bug]		Remove unnecessary code from bin/named/lwdgnba.c.
-			[RT #17471]
-
-2302.	[bug]		Fix memset() calls in lib/tests/t_api.c. [RT #17472]
-
-2301.	[bug]		Remove resource leak and fix error messages in
-			bin/tests/system/lwresd/lwtest.c. [RT #17474]
-
-2300.	[bug]		Fixed failure to close open file in 
-			bin/tests/names/t_names.c. [RT #17473]
-
-2299.	[bug]		Remove unnecessary NULL check in
-			bin/nsupdate/nsupdate.c. [RT #17475]
-
-2298.	[bug]		isc_mutex_lock() failure not caught in
-			bin/tests/timers/t_timers.c. [RT #17468]
-
-2297.	[bug]		isc_entropy_createfilesource() failure not caught in
-			bin/tests/dst/t_dst.c. [RT #17467]
-
-2296.	[port]		Allow docbook stylesheet location to be specified to
-			configure. [RT #17457]
-
-2295.	[bug]		Silence static overrun error in bin/named/lwaddr.c.
-			[RT #17459]
-
-2294.	[func]		Allow the experimental statistics channels to have
-			multiple connections and ACL.
-			Note: the stats-server and stats-server-v6 options
-			available in the previous beta releases are replaced
-			with the generic statistics-channels statement.
-
-2293.	[func]		Add ACL regression test. [RT #17375]
-
-2292.	[bug]		Log if the working directory is not writable.
-			[RT #17312]
-
-2291.   [bug]           PR_SET_DUMPABLE may be set too late.  Also report
-			failure to set PR_SET_DUMPABLE. [RT #17312]
-
-2290.	[bug]		Let AD in the query signal that the client wants AD
-			set in the response. [RT #17301]
-
-2289.	[func]		named-checkzone now reports the out-of-zone CNAME
-			found. [RT #17309]
-
-2288.	[port]		win32: mark service as running when we have finished
-			loading.  [RT #17441]
-
-2287.	[bug]		Use 'volatile' if the compiler supports it. [RT #17413]
-
-2286.	[func]		Allow a TCP connection to be used as a weak
-			authentication method for reverse zones.
-			New update-policy methods tcp-self and 6to4-self.
-			[RT #17378]
-
-2285.	[func]		Test framework for client memory context management.
-			[RT #17377]
-
-2284.	[bug]		Memory leak in UPDATE prerequisite processing.
-			[RT #17377]
-
-2283.	[bug]		TSIG keys were not attaching to the memory
-			context.  TSIG keys should use the rings
-			memory context rather than the clients memory
-			context. [RT #17377]
-
-2282.	[bug]		Acl code fixups. [RT #17346] [RT #17374]
-
-2281.	[bug]		Attempts to use undefined acls were not being logged.
-			[RT #17307]
-
-2280.	[func]		Allow the experimental http server to be reached
-			over IPv6 as well as IPv4. [RT #17332]
-
-2279.   [bug]           Use setsockopt(SO_NOSIGPIPE), when available,
-			to protect applications from receiving spurious
-			SIGPIPE signals when using the resolver.
-
-2278.	[bug]		win32: handle the case where Windows returns no
-			search list or DNS suffix. [RT #17354]
-
-2277.	[bug]		Empty zone names were not correctly being caught at
-			in the post parse checks. [RT #17357]
-
-2276.	[bug]		Install <dst/gssapi.h>.  [RT# 17359]
-
-2275.	[func]		Add support to dig to perform IXFR queries over UDP.
-			[RT #17235]
-
-2274.	[func]		Log zone transfer statistics. [RT #17336]
-
-2273.	[bug]		Adjust log level to WARNING when saving inconsistent
-			stub/slave master and journal files. [RT# 17279]
-
-2272.	[bug]		Handle illegal dnssec-lookaside trust-anchor names.
-			[RT #17262]
-
-2271.	[bug]		Fix a memory leak in http server code [RT #17100]
-
-2270.	[bug]		dns_db_closeversion() version->writer could be reset
-			before it is tested. [RT #17290]
-
-2269.	[contrib]	dbus memory leaks and missing va_end calls. [RT #17232]
-
-2268.	[bug]		0.IN-ADDR.ARPA was missing from the empty zones
-			list.
-
 	--- 9.5.0b1 released ---

 2267.   [bug]           Radix tree node_num value could be set incorrectly,
@@ -376,7 +36,7 @@
 2256.	[bug]		win32: Correctly register the installation location of
 			bindevt.dll. [RT #17159]

-2255.	[maint]		L.ROOT-SERVERS.NET is now 199.7.83.42.
+2255.	[bug]		L.ROOT-SERVERS.NET is now 199.7.83.42.

 2254.	[bug]		timer.c:dispatch() failed to lock timer->lock
 			when reading timer->idle allowing it to see
@@ -419,7 +79,7 @@
 			library could require a source of random data.
 			[RT #17127]

-2241.	[func]		nsupdate: add a interactive 'help' command. [RT #17099]
+2241.	[func]		nsupdate: add a interative 'help' command. [RT #17099]

 2240.	[bug]		Cleanup nsupdates GSS-TSIG support.  Convert
 			a number of INSIST()s into plain fatal() errors
@@ -427,10 +87,10 @@
 			The 'key' command wasn't disabling GSS-TSIG.
 			[RT #17099]

-2239.	[func]		Ship a pre built bin/named/bind9.xsl.h. [RT #17114]
+2239.	[func]		Ship a prebuilt bin/named/bind9.xsl.h. [RT #17114]

 2238.	[bug]		It was possible to trigger a REQUIRE when a
-			validation was canceled. [RT #17106]
+			validation was cancelled. [RT #17106]

 2237.	[bug]		libbind: res_init() was not thread aware. [RT #17123]

@@ -442,8 +102,8 @@
 2234.   [port]          Correct some compiler warnings on SCO OSr5 [RT #17134]
  
 2233.   [func]          Add support for O(1) ACL processing, based on
-                        radix tree code originally written by Kevin
-                        Brintnall. [RT #16288]
+                        radix tree code originally written by kevin
+                        brintnall. [RT #16288]

 2232.	[bug]		dns_adb_findaddrinfo() could fail and return
 			ISC_R_SUCCESS. [RT #17137]
@@ -482,7 +142,7 @@
 2220.	[bug]		win32: Address a race condition in final shutdown of
 			the Windows socket code. [RT #17028]
 			
-2219.	[bug]		Apply zone consistency checks to additions, not
+2219.	[bug]		Apply zone consistancy checks to additions, not
 			removals, when updating. [RT #17049]

 2218.	[bug]		Remove unnecessary REQUIRE from dns_validator_create().
@@ -600,7 +260,7 @@

 2187.	[bug]		query_addds(), query_addwildcardproof() and
 			query_addnxrrsetnsec() should take a version
-			argument. [RT #16368]
+			arguement. [RT #16368]

 2186.	[port]		cygwin: libbind: check for struct sockaddr_storage
 			independently of IPv6. [RT #16482]
@@ -633,7 +293,7 @@
 			debug level 10+. [RT #16798]

 2176.	[contrib]	dbus update to handle race condition during
-			initialization (Bugzilla 235809). [RT #16842]
+			initialisation (Bugzilla 235809). [RT #16842]

 2175.	[bug]		win32: windows broadcast condition variable support
 			was broken. [RT #16592]
@@ -697,7 +357,7 @@

 2159.	[bug]		Array bounds overrun in acache processing. [RT #16710]

-2158.	[bug]		ns_client_isself() failed to initialize key
+2158.	[bug]		ns_client_isself() failed to initialise key
 			leading to a REQUIRE failure. [RT #16688]

 2157.	[func]		dns_db_transfernode() created. [RT #16685]
@@ -768,7 +428,7 @@
 2136.	[bug]		nslookup/host looped if there was no search list
 			and the host didn't exist. [RT #16657]

-2135.	[bug]		Uninitialized rdataset in sdlz.c. [RT# 16656]
+2135.	[bug]		Uninitialised rdataset in sdlz.c. [RT# 16656]

 2134.	[func]		Additional statistics support. [RT #16666]

@@ -790,7 +450,7 @@

 2127.	[port]		Improved OpenSSL 0.9.8 support. [RT #16563]

-2126.	[security]	Serialize validation of type ANY responses. [RT #16555]
+2126.	[security]	Serialise validation of type ANY responses. [RT #16555]

 2125.	[bug]		dns_zone_getzeronosoattl() REQUIRE failure if DLZ
 			was defined. [RT #16574]
@@ -800,7 +460,7 @@

 	--- 9.5.0a1 released ---

-2123.	[func]		Use Doxygen to generate internal documentation.
+2123.	[func]		Use Doxygen to generate internal documention.
 			[RT #11398]

 2122.	[func]		Experimental http server and statistics support
@@ -861,7 +521,7 @@
 2103.	[port]		Add /usr/sfw to list of locations for OpenSSL
 			under Solaris.

-2102.	[port]		Silence Solaris 10 warnings.
+2102.	[port]		Silence solaris 10 warnings.

 2101.	[bug]		OpenSSL version checks were not quite right.
 			[RT #16476]
@@ -869,7 +529,7 @@
 2100.	[port]		win32: copy libeay32.dll to Build\Debug.
 			Copy Debug\named-checkzone to Debug\named-compilezone.

-2099.	[port]		win32: more manifest issues.
+2099.	[port]		win32: more manifiest issues.

 2098.	[bug]		Race in rbtdb.c:no_references(), which occasionally
 			triggered an INSIST failure about the node lock
@@ -931,7 +591,7 @@
 2078.	[bug]		dnssec-checkzone output style "default" was badly
 			named.  It is now called "relative". [RT #16326]

-2077.	[bug]		'dnssec-signzone -O raw' wasn't outputting the
+2077.	[bug]		'dnssec-signzone -O raw' wasn't outputing the
 			complete signed zone. [RT #16326]

 2076.	[bug]		Several files were missing #include <config.h>
@@ -1014,7 +674,7 @@
 			[RT #16287]

 2049.	[bug]		Restore SOA before AXFR when falling back from
-			a attempted IXFR when transferring in a zone.
+			a attempted IXFR when transfering in a zone.
 			Allow a initial SOA query before attempting
 			a AXFR to be requested. [RT #16156]

@@ -1023,7 +683,7 @@
 			the OS always returned the same local port.
 			[RT #16182]

-2047.	[bug]		Failed to initialize the interface flags to zero.
+2047.	[bug]		Failed to initialise the interface flags to zero.
 			[RT #16245]

 2046.	[bug]		rbtdb.c:rdataset_setadditional() could cause duplicate
@@ -1067,7 +727,7 @@

 2034.	[bug]		gcc: set -fno-strict-aliasing. [RT #16124]

-2033.	[bug]		We weren't creating multiple client memory contexts
+2033.	[bug]		We wern't creating multiple client memory contexts
 			on demand as expected. [RT #16095]

 2032.	[bug]		Remove a INSIST in query_addadditional2(). [RT #16074]
@@ -1081,7 +741,7 @@
 2029.	[bug]		host printed out the server multiple times when
 			specified on the command line. [RT #15992]

-2028.	[port]		linux: socket.c compatibility for old systems.
+2028.	[port]		linux: socket.c compatability for old systems.
 			[RT #16015]

 2027.	[port]		libbind: Solaris x86 support. [RT #16020]
@@ -1091,7 +751,7 @@

 2025.	[func]		Update "zone serial unchanged" message. [RT #16026]

-2024.	[bug]		named emitted spurious "zone serial unchanged"
+2024.	[bug]		named emited spurious "zone serial unchanged"
 			messages on reload. [RT #16027]

 2023.	[bug]		"make install" should create ${localstatedir}/run and
@@ -1117,7 +777,7 @@
 			to the original qname. [RT #15945]

 2015.	[cleanup]	use-additional-cache is now acache-enable for
-			consistency.  Default acache-enable off in BIND 9.4
+			consistancy.  Default acache-enable off in BIND 9.4
 			as it requires memory usage to be configured.
 			It may be enabled by default in BIND 9.5 once we
 			have more experience with it.
@@ -1137,9 +797,9 @@

 2010.	[placeholder]	rt15958

-2009.	[bug]		libbind: Coverity fixes. [RT #15808]
+2009.	[bug]		libbind: coverity fixes. [RT #15808]

-2008.	[func]		It is now possible to enable/disable DNSSEC
+2008.	[func]		It is now posssible to enable/disable DNSSEC
 			validation from rndc.  This is useful for the
 			mobile hosts where the current connection point
 			breaks DNSSEC (firewall/proxy).  [RT #15592]
@@ -1151,7 +811,7 @@
 			be changed to yes in 9.5.0.  [RT #15674]

 2006.	[security]	Allow-query-cache and allow-recursion now default
-			to the built in acls "localnets" and "localhost".
+			to the builtin acls "localnets" and "localhost".

 			This is being done to make caching servers less
 			attractive as reflective amplifying targets for
@@ -1199,7 +859,7 @@

 1994.	[port]		OpenSSL 0.9.8 support. [RT #15694]

-1993.	[bug]		Log messages, via syslog, were missing the space
+1993.	[bug]		Log messsage, via syslog, were missing the space
 			after the timestamp if "print-time yes" was specified.
 			[RT #15844]

@@ -1207,11 +867,11 @@
 			view.  [RT #15825]

 1991.	[cleanup]	The configuration data, once read, should be treated
-			as read only.  Expand the use of const to enforce this
+			as readonly.  Expand the use of const to enforce this
 			at compile time. [RT #15813]

 1990.	[bug]		libbind:  isc's override of broken gettimeofday()
-			implementations was not always effective.
+			implementions was not always effective.
 			[RT #15709]

 1989.	[bug]		win32: don't check the service password when
@@ -1233,7 +893,7 @@
 			server for the zone.  Also any zones that contain
 			DLV records should be removed when upgrading a slave
 			zone.  You do not however have to upgrade all
-			servers for a zone with DLV records simultaneously.
+			servers for a zone with DLV records simultaniously.

 1984.	[func]		dig, nslookup and host now advertise a 4096 byte
 			EDNS UDP buffer size by default. [RT #15855]
@@ -1270,7 +930,7 @@
 1973.	[func]		TSIG HMACSHA1, HMACSHA224, HMACSHA256, HMACSHA384 and
 			HMACSHA512 support. [RT #13606]

-1972.	[contrib]	DBUS dynamic forwarders integration from
+1972.	[contrib]	DBUS dynamic forwarders integation from
 			Jason Vas Dias <jvdias@redhat.com>.

 1971.	[port]		linux: make detection of missing IF_NAMESIZE more
@@ -1320,7 +980,7 @@
 			by native compiler.  See README for additional
 			cross compile support information. [RT #15148]

-1955.	[bug]		Pre-allocate the cache cleaning iterator. [RT #14998]
+1955.	[bug]		Pre-allocate the cache cleaning interator. [RT #14998]

 1954.	[func]		Named now falls back to advertising EDNS with a
 			512 byte receive buffer if the initial EDNS queries
@@ -1356,7 +1016,7 @@
 1946.	[bug]		resume_dslookup() could trigger a REQUIRE failure
 			when using forwarders. [RT #15549]

-1945.	[cleanup]	dnssec-keygen: RSA (RSAMD5) is no longer recommended.
+1945.	[cleanup]	dnssec-keygen: RSA (RSAMD5) is nolonger recommended.
 			To generate a RSAMD5 key you must explicitly request
 			RSAMD5. [RT #13780]
 			
@@ -1440,15 +1100,15 @@
 1917.	[doc]		funcsynopsisinfo wasn't being treated as verbatim
 			when generating man pages. [RT #15385]

-1916.	[func]		Integrate contributed IDN code from JPNIC. [RT #15383]
+1916.	[func]		Integrate contibuted IDN code from JPNIC. [RT #15383]

 1915.	[bug]		dig +ndots was broken. [RT #15215]

 1914.	[protocol]	DS is required to accept mnemonic algorithms
 			(RFC 4034).  Still emit numeric algorithms for
-			compatibility with RFC 3658. [RT #15354]
+			compatability with RFC 3658. [RT #15354]

-1913.	[func]		Integrate contributed DLZ code into named. [RT #11382]
+1913.	[func]		Integrate contibuted DLZ code into named. [RT #11382]

 1912.	[port]		aix: atomic locking for powerpc. [RT #15020]

@@ -1520,7 +1180,7 @@
 1891.	[port]		freebsd: pthread_mutex_init can fail if it runs out
 			of memory. [RT #14995]

-1890.	[func]		Raise the UDP receive buffer size to 32k if it is
+1890.	[func]		Raise the UDP recieve buffer size to 32k if it is
 			less than 32k. [RT #14953]

 1889.	[port]		sunos: non blocking i/o support. [RT #14951]
@@ -1560,7 +1220,7 @@
 			[RT #2471]

 1877.	[bug]		Fix unreasonably low quantum on call to
-			dns_rbt_destroy2().  Remove unnecessary unhash_node()
+			dns_rbt_destroy2().  Remove unnecessay unhash_node()
 			call. [RT #14919]

 1876.	[func]		Additional memory debugging support to track size
@@ -1644,7 +1304,7 @@
 1850.	[bug]		Memory leak in lwres_getipnodebyaddr(). [RT #14591]

 1849.	[doc]		All forms of the man pages (docbook, man, html) should
-			have consistent copyright dates.
+			have consistant copyright dates.

 1848.	[bug]		Improve SMF integration. [RT #13238]

@@ -1655,13 +1315,13 @@
 1846.	[contrib]	query-loc-0.3.0 from Stephane Bortzmeyer
 			<bortzmeyer@nic.fr>.

-1845.	[bug]		Improve error reporting to distinguish between
+1845.	[bug]		Improve error reporting to distingish between
 			accept()/fcntl() and socket()/fcntl() errors.
 			[RT #13745]

 1844.	[bug]		inet_pton() accepted more that 4 hexadecimal digits
 			for each 16 bit piece of the IPv6 address.  The text
-			representation of a IPv6 address has been tightened
+			representation of a IPv6 address has been tighted
 			to disallow this (draft-ietf-ipv6-addr-arch-v4-02.txt).
 			[RT #5662]

@@ -1895,7 +1555,7 @@
 1765.	[bug]		configure --with-openssl=auto failed. [RT #12937]

 1764.	[bug]		dns_zone_replacedb failed to emit a error message
-			if there was no SOA record in the replacement db.
+			if there was no SOA record in the replacment db.
 			[RT #13016]

 1763.	[func]		Perform sanity checks on NS records which refer to
@@ -1923,7 +1583,7 @@
 1755.	[func]		allow-update is now settable at the options / view
 			level. [RT #6636]

-1754.	[bug]		We weren't always attempting to query the parent
+1754.	[bug]		We wern't always attempting to query the parent
 			server for the DS records at the zone cut.
 			[RT #12774]

@@ -1944,7 +1604,7 @@

 1748.	[func]		dig now returns the byte count for axfr/ixfr.
 			
-1747.	[bug]		BIND 8 compatibility: named/named-checkconf failed
+1747.	[bug]		BIND 8 compatability: named/named-checkconf failed
 			to parse "host-statistics-max" in named.conf.

 1746.	[func]		Make public the function to read a key file,
@@ -2027,7 +1687,7 @@
 			[RT #12519]

 1721.	[bug]		Error message from the journal processing were not
-			always identifying the relevant journal. [RT #12519]
+			always identifing the relevent journal. [RT #12519]

 1720.	[bug]		'dig +chase' did not terminate on a RFC 2308 Type 1
 			negative response. [RT #12506]
@@ -2084,7 +1744,7 @@
 1703.	[bug]		named would loop sending NOTIFY messages when it
 			failed to receive a response. [RT #12322]

-1702.	[bug]		also-notify should not be applied to built in zones.
+1702.	[bug]		also-notify should not be applied to builtin zones.
 			[RT #12323]

 1701.	[doc]		A minimal named.conf man page.
@@ -2251,7 +1911,7 @@
 			masters with keys are specified.

 1644.	[bug]		Update the journal modification time after a
-			successful refresh query. [RT #11436]
+			sucessfull refresh query. [RT #11436]

 1643.	[bug]		dns_db_closeversion() could leak memory / node
 			references. [RT #11163]
@@ -2272,7 +1932,7 @@
 1637.	[bug]		Node reference leak on error in addnoqname().

 1636.	[bug]		The dump done callback could get ISC_R_SUCCESS even if
-			a error had occurred.  The database version no longer
+			a error had occured.  The database version no longer
 			matched the version of the database that was dumped.

 1635.	[bug]		Memory leak on error in query_addds().
@@ -2471,7 +2131,7 @@
 1568.	[bug]		nsupdate now reports that the update failed in
 			interactive mode. [RT# 10236]

-1567.	[maint]		B.ROOT-SERVERS.NET is now 192.228.79.201.
+1567.	[bug]		B.ROOT-SERVERS.NET is now 192.228.79.201.

 1566.	[port]		Support for the cmsg framework on Solaris and HP/UX.
 			This also solved the problem that match-destinations
@@ -2640,7 +2300,7 @@
 			type, class and responding nameserver.

 1511.	[bug]		delegation-only was generating false positives
-			on negative answers from sub-zones.
+			on negative answers from subzones.

 1510.	[func]		New view option "root-delegation-only".  Apply
 			delegation-only check to all TLDs and root.
@@ -2974,7 +2634,7 @@
 1398.	[doc]		ARM: notify-also should have been also-notify.
 			[RT #4345]

-1397.	[maint]		J.ROOT-SERVERS.NET is now 192.58.128.30.
+1397.	[bug]		J.ROOT-SERVERS.NET is now 192.58.128.30.

 1396.	[func]		dnssec-signzone: adjust the default signing time by
 			1 hour to allow for clock skew.
@@ -4321,7 +3981,7 @@

 954.	[bug]		When requesting AXFRs or IXFRs using dig, host, or
 			nslookup, the RD bit should not be set as zone
-			transfers are inherently non-recursive. [RT #1575]
+			transfers are inherently nonrecursive. [RT #1575]

 953.	[func]		The /var/run/named.key file from change #843
 			has been replaced by /etc/rndc.key.  Both
@@ -4636,7 +4296,7 @@
 860.	[func]		Drop cross class glue in zone transfers.

 859.	[bug]		Cache cleaning now won't swamp the CPU if there
-			is a persistent over limit condition.
+			is a persistent overlimit condition.

 858.	[func]		isc_mem_setwater() no longer requires that when the
 			callback function is non-NULL then its hi_water
@@ -4812,7 +4472,7 @@
 811.	[bug]		Parentheses were not quoted in zone dumps. [RT #1194]

 810.	[bug]		The signer name in SIG records was not properly
-			down-cased when signing/verifying records. [RT #1186]
+			downcased when signing/verifying records. [RT #1186]

 809.	[bug]		Configuring a non-local address as a transfer-source
 			could cause an assertion failure during load.
@@ -4824,9 +4484,9 @@
 			ignored like it should be.

 806.	[bug]		DNS_R_SEENINCLUDE was failing to propagate back up
-			the calling stack to the zone maintenance level,
-			causing zones to not reload when an included file was
-			touched but the top-level zone file was not.
+			the calling stack to the zone maintence level, causing
+			zones to not reload when an included file was touched
+			but the top-level zone file was not.

 805.	[bug]		When using "forward only", missing root hints should
 			not cause queries to fail. [RT #1143]
@@ -4866,7 +4526,7 @@
 			in rndc.conf.

 793.	[cleanup]	The DNSSEC tools could create filenames that were
-			illegal or contained shell meta-characters.  They
+			illegal or contained shell metacharacters.  They
 			now use a different text encoding of names that
 			doesn't have these problems. [RT #1101]

@@ -4890,7 +4550,7 @@
 			names when mapping them into file names.

 786.	[bug]		When DNSSEC signing/verifying data, owner names were
-			not properly down-cased.
+			not properly downcased.

 785.	[bug]		A race condition in the resolver could cause
 			an assertion failure. [RT #673, #872, #1048]
@@ -4909,7 +4569,7 @@

 780.	[bug]		Error handling code dealing with out of memory or
 			other rare errors could lead to assertion failures
-			by calling functions on uninitialized names. [RT #1065]
+			by calling functions on unitialized names. [RT #1065]

 779.	[func]		Added the "minimal-responses" option.

@@ -5052,7 +4712,7 @@
 735.	[doc]		Add BIND 4 migration notes.

 734.	[bug]		An attempt to re-lock the zone lock could occur if
-			the server was shutdown during a zone transfer.
+			the server was shutdown during a zone tranfer.
 			[RT #830]

 733.	[bug]		Reference counts of dns_acl_t objects need to be
@@ -5192,7 +4852,7 @@
 688.	[func]		"make tags" now works on systems with the
 			"Exuberant Ctags" etags.

- 687.	[bug]		Only say we have IPv6, with sufficient functionality,
+ 687.	[bug]		Only say we have IPv6, with sufficent functionality,
 			if it has actually been tested. [RT #586]

 686.	[bug]		dig and nslookup can now be properly aborted during
@@ -5510,7 +5170,7 @@
 	--- 9.1.0b1 released ---

 591.	[bug]		Work around non-reentrancy in openssl by disabling
-			pre-computation in keys.
+			precomputation in keys.

 590.	[doc]		There are now man pages for the lwres library in
 			doc/man/lwres.
@@ -5559,7 +5219,7 @@
 			source address for notify messages.

 577.	[func]		Log illegal RDATA combinations. e.g. multiple
-			singleton types, cname and other data.
+			singlton types, cname and other data.

 576.	[doc]		isc_log_create() description did not match reality.

@@ -5570,7 +5230,7 @@
 			have their responses validated and would leak memory.

 573.	[bug]		The journal files of IXFRed slave zones were
-			inadvertently discarded on server reload, causing
+			inadvertantly discarded on server reload, causing
 			"journal out of sync with zone" errors on subsequent
 			reloads. [RT #482]

@@ -5739,7 +5399,7 @@
 			others).

 519.	[bug]		dns_name_split() would improperly split some bitstring
-			labels, zeroing a few of the least significant bits in
+			labels, zeroing a few of the least signficant bits in
 			the prefix part.  When such an improperly created
 			prefix was returned to the RBT database, the bogus
 			label was dutifully stored, corrupting the tree.
@@ -5767,7 +5427,7 @@
 513.	[func]		New functionality added to rdnc and server to allow
 			individual zones to be refreshed or reloaded.

- 512.	[bug]		The zone transfer code could throw an exception with
+ 512.	[bug]		The zone transfer code could throw an execption with
 			an invalid IXFR stream.

 511.	[bug]		The message code could throw an assertion on an
@@ -5958,7 +5618,7 @@
 452.	[bug]		Warn if the unimplemented option "statistics-file"
 			is specified in named.conf. [RT #301]

- 451.	[func]		Update forwarding implemented.
+ 451.	[func]		Update forwarding implememted.

 450.	[func]		New function ns_client_sendraw().

@@ -6059,7 +5719,7 @@
 			e.g. due to corrupt zones with multiple SOA records.
 			[RT #279]

- 423.	[bug]		When responding to a recursive query, errors that occur
+ 423.	[bug]		When responding to a recusive query, errors that occur
 			after following a CNAME should cause the query to fail.
 			[RT #274]

@@ -6104,7 +5764,7 @@

 409.	[bug]		If named was shut down early in the startup
 			process, ns_omapi_shutdown() would attempt to lock
-			an uninitialized mutex. [RT #262]
+			an unintialized mutex. [RT #262]

 408.	[bug]		stub zones could leak memory and reference counts if
 			all the masters were unreachable.
@@ -6171,7 +5831,7 @@
 			making the functions dns_zone_adddbarg()
 			and dns_zone_cleardbargs() unnecessary.

- 389.	[bug]		Attempting to send a request over IPv6 using
+ 389.	[bug]		Attempting to send a reqeust over IPv6 using
 			dns_request_create() on a system without IPv6
 			support caused an assertion failure [RT #235].

@@ -6228,7 +5888,7 @@
 			of a very large RRset could cause an assertion failure
 			during logging.

- 370.	[bug]		The error messages for roll-forward failures were
+ 370.	[bug]		The error messages for rollforward failures were
 			overly terse.

 369.	[func]		Support new named.conf options, view and zone
@@ -6371,7 +6031,7 @@

 328.	[func]		Added isc_base64_decodestring().

- 327.	[bug]		rndc.conf parser wasn't correctly recognizing an IP
+ 327.	[bug]		rndc.conf parser wasn't correctly recognising an IP
 			address where a host specification was required.

 326.	[func]		'keys' in an 'inet' control statement is now
@@ -6401,7 +6061,7 @@
 			where they previously didn't.

 321.	[bug]		When synthesizing a CNAME RR for a DNAME
-			response, query_addcname() failed to initialize
+			response, query_addcname() failed to intitialize
 			the type and class of the CNAME dns_rdata_t,
 			causing random failures.

@@ -6677,7 +6337,7 @@

 	--- 9.0.0b4 released ---

- 253.	[func]		resolv.conf parser now recognizes ';' and '#' as
+ 253.	[func]		resolv.conf parser now recognises ';' and '#' as
 			comments (anywhere in line, not just as the beginning).

 252.	[bug]		resolv.conf parser mishandled masks on sortlists.
@@ -6747,7 +6407,7 @@
 			requiring a quoted string.

 233.	[cleanup]	Convert all config structure integer values to unsigned
-			integer (isc_uint32_t) to match grammar.
+			integer (isc_uint32_t) to match grammer.

 232.	[bug]		Allow slave zones to not have a file.

@@ -6784,7 +6444,7 @@
 			from confparser.c, because of yacc's code, are
 			unfortunately to be expected.)

- 223.	[func]		Several functions were re-prototyped to qualify one
+ 223.	[func]		Several functions were reprototyped to qualify one
 			or more of their arguments with "const".  Similarly,
 			several functions that return pointers now have
 			those pointers qualified with const.
@@ -6949,7 +6609,7 @@
 183.	[func]		ISC_LOG_PRINTTAG option for log channels.  Useful
 			for logging the program name or other identifier.

- 182.	[cleanup]	New command-line parameters for dnssec tools
+ 182.	[cleanup]	New commandline parameters for dnssec tools

 181.	[func]		Added dst_key_buildfilename and dst_key_parsefilename

@@ -6994,7 +6654,7 @@
 			--with-mit-pthreads option is no longer needed
 			and has been removed.

- 170.	[cleanup]	Remove inter server consistency checks from zone,
+ 170.	[cleanup]	Remove inter server consistancy checks from zone,
 			these should return as a separate module in 9.1.
 			dns_zone_checkservers(), dns_zone_checkparents(),
 			dns_zone_checkchildren(), dns_zone_checkglue().
@@ -7087,7 +6747,7 @@
 			than continuing to itemize every header which changed,
 			this changelog entry just notes that if a header file
 			did not need another header file that it was including
-			in order to provide its advertised functionality, the
+			in order to provide its advertized functionality, the
 			inclusion of the other header file was removed.  See
 			util/check-includes for how this was tested.

@@ -7479,7 +7139,7 @@

  31.	[bug]		Use ${LIBTOOL} to compile bin/named/main.@O@.

-  30.	[func]		config file grammar change to support optional
+  30.	[func]		config file grammer change to support optional
 			class type for a view.

  29.	[func]		support new config file view options:
@@ -7543,7 +7203,7 @@
  13.	[bug]		lib/dns/master.c and lib/dns/xfrin.c didn't ignore
 			out-of-zone data.

-  12.	[bug]		Fixed possible uninitialized variable error.
+  12.	[bug]		Fixed possible unitialized variable error.

  11.	[bug]		axfr_rrstream_first() didn't check the result code of
 			db_rr_iterator_first(), possibly causing an assertion
@@ -1,4 +1,4 @@
-Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 1996-2003  Internet Software Consortium.

 Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.

-$Id: COPYRIGHT,v 1.14 2008/01/02 23:47:01 tbox Exp $
+$Id: COPYRIGHT,v 1.13 2007/06/18 05:59:26 marka Exp $

 Portions Copyright (C) 1996-2001  Nominum, Inc.

@@ -1,6 +1,6 @@
 Frequently Asked Questions about BIND 9

-Copyright © 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+Copyright © 2004-2007 Internet Systems Consortium, Inc. ("ISC")

 Copyright © 2000-2003 Internet Software Consortium.

@@ -396,8 +396,8 @@ A: Someone is trying to update your DNS data using the RFC2136 Dynamic
   Update protocol. Windows 2000 machines have a habit of sending dynamic
   update requests to DNS servers without being specifically configured to
   do so. If the update requests are coming from a Windows 2000 machine,
-   see <http://support.microsoft.com/support/kb/articles/q246/8/04.asp>
-   for information about how to turn them off.
+   see http://support.microsoft.com/support/kb/articles/q246/8/04.asp for
+   information about how to turn them off.

 Q: When I do a "dig . ns", many of the A records for the root servers are
   missing. Why?
@@ -468,7 +468,7 @@ A: If the IN-ADDR.ARPA name covered refers to a internal address space you
   are using then you have failed to follow RFC 1918 usage rules and are
   leaking queries to the Internet. You should establish your own zones
   for these addresses to prevent you querying the Internet's name servers
-   for these addresses. Please see <http://as112.net/> for details of the
+   for these addresses. Please see http://as112.net/ for details of the
   problems you are causing and the counter measures that have had to be
   deployed.

@@ -569,20 +569,7 @@ Q: Why do I get the following errors:

 A: This is the result of a Linux kernel bug.

-   See: <http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=
-   2>
-
-Q: Why does named lock up when it attempts to connect over IPSEC tunnels?
-
-A: This is due to a kernel bug where the fact that a socket is marked
-   non-blocking is ignored. It is reported that setting xfrm_larval_drop
-   to 1 helps but this may have negative side effects. See: <https://
-   bugzilla.redhat.com/show_bug.cgi?id=427629> and <http://lkml.org/lkml/
-   2007/12/4/260>.
-
-   xfrm_larval_drop can be set to 1 by the following procedure:
-
-   echo "1" > proc/sys/net/core/xfrm_larval_drop
+   See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2

 Q: Why do I see 5 (or more) copies of named on Linux?

@@ -607,12 +594,7 @@ Q: I get the error message "named: capset failed: Operation not permitted"
   when starting named.

 A: The capability module, part of "Linux Security Modules/LSM", has not
-   been loaded into the kernel. See insmod(8), modprobe(8).
-
-   The relevant modules can be loaded by running:
-
-   modprobe commoncap
-   modprobe capability
+   been loaded into the kernel. See insmod(8).

 Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core -

@@ -626,7 +608,7 @@ Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core -
 A: Red Hat Security Enhanced Linux (SELinux) policy security protections :

   Red Hat have adopted the National Security Agency's SELinux security
-   policy (see <http://www.nsa.gov/selinux>) and recommendations for BIND
+   policy ( see http://www.nsa.gov/selinux ) and recommendations for BIND
   security , which are more secure than running named in a chroot and
   make use of the bind-chroot environment unnecessary .

@@ -717,18 +699,6 @@ A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
   See these man-pages for more information : selinux(8), named_selinux
   (8), chcon(1), setsebool(8)

-Q: Listening on individual IPv6 interfaces does not work.
-
-A: This is usually due to "/proc/net/if_inet6" not being available in the
-   chroot file system. Mount another instance of "proc" in the chroot file
-   system.
-
-   This can be be made permanent by adding a second instance to /etc/
-   fstab.
-
-   proc /proc           proc defaults 0 0
-   proc /var/named/proc proc defaults 0 0
-
 4.3. Windows

 Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail.
@@ -766,7 +736,7 @@ A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to
   /etc/rc.conf
   rand_irqs="3 14 15"

-   See also <http://people.freebsd.org/~dougb/randomness.html>.
+   See also http://people.freebsd.org/~dougb/randomness.html

 4.5. Solaris

@@ -774,7 +744,7 @@ Q: How do I integrate BIND 9 and Solaris SMF

 A: Sun has a blog entry describing how to do this.

-   <http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris>
+   http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris

 4.6. Apple Mac OS X

@@ -1,7 +1,7 @@
 <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
       "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []>
 <!--
- - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: FAQ.xml,v 1.39 2008/05/31 01:44:13 marka Exp $ -->
+<!-- $Id: FAQ.xml,v 1.30 2007/11/02 00:25:41 marka Exp $ -->

 <article class="faq">
  <title>Frequently Asked Questions about BIND 9</title>
@@ -27,7 +27,6 @@
      <year>2005</year>
      <year>2006</year>
      <year>2007</year>
-      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -706,7 +705,8 @@ zone "list.dsbl.org" {
 	  requests are coming from a Windows 2000 machine, see
 	  <ulink
 	   url="http://support.microsoft.com/support/kb/articles/q246/8/04.asp">
-  &lt;http://support.microsoft.com/support/kb/articles/q246/8/04.asp&gt;</ulink>
+	    http://support.microsoft.com/support/kb/articles/q246/8/04.asp
+	  </ulink>
 	  for information about how to turn them off.
 	</para>
      </answer>
@@ -856,7 +856,7 @@ serial-query-rate 5; // default 20</programlisting>
 	  usage rules and are leaking queries to the Internet.  You
 	  should establish your own zones for these addresses to prevent
 	  you querying the Internet's name servers for these addresses.
-	  Please see <ulink url="http://as112.net/">&lt;http://as112.net/&gt;</ulink>
+	  Please see <ulink url="http://as112.net/">http://as112.net/</ulink>
 	  for details of the problems you are causing and the counter
 	  measures that have had to be deployed.
 	</para>
@@ -1009,31 +1009,7 @@ client: UDP client handler shutting down due to fatal receive error: unexpected
 	</para>
 	<para>
 	  See:
-	  <ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&amp;m=113081708031466&amp;w=2">&lt;http://marc.theaimsgroup.com/?l=linux-netdev&amp;m=113081708031466&amp;w=2&gt;</ulink>
-	</para>
-      </answer>
-    </qandaentry>
-
-    <qandaentry>
-      <question>
-	<para>
-	  Why does named lock up when it attempts to connect over IPSEC tunnels?
-	</para>
-      </question>
-      <answer>
-	<para>
-	  This is due to a kernel bug where the fact that a socket is marked
-	  non-blocking is ignored.  It is reported that setting
-	  xfrm_larval_drop to 1 helps but this may have negative side effects.
-	  See:
-<ulink url="https://bugzilla.redhat.com/show_bug.cgi?id=427629">&lt;https://bugzilla.redhat.com/show_bug.cgi?id=427629&gt;</ulink>
-	  and
-<ulink url="http://lkml.org/lkml/2007/12/4/260">&lt;http://lkml.org/lkml/2007/12/4/260&gt;</ulink>.
-	</para>
-	<para>
-	xfrm_larval_drop can be set to 1 by the following procedure:
-<programlisting>
-echo "1" &gt; proc/sys/net/core/xfrm_larval_drop</programlisting>
+	  <ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&amp;m=113081708031466&amp;w=2">http://marc.theaimsgroup.com/?l=linux-netdev&amp;m=113081708031466&amp;w=2</ulink>
 	</para>
      </answer>
    </qandaentry>
@@ -1088,13 +1064,7 @@ echo "1" &gt; proc/sys/net/core/xfrm_larval_drop</programlisting>
      <answer>
 	<para>
 	  The capability module, part of "Linux Security Modules/LSM",
-	  has not been loaded into the kernel.  See insmod(8), modprobe(8).
-	</para>
-	<para>
-	  The relevant modules can be loaded by running:
-<programlisting>
-modprobe commoncap
-modprobe capability</programlisting>
+	  has not been loaded into the kernel.  See insmod(8).
 	</para>
      </answer>
    </qandaentry>
@@ -1124,9 +1094,8 @@ modprobe capability</programlisting>

 	<para>
 	   Red Hat have adopted the National Security Agency's
-	   SELinux security policy (see <ulink
-   url="http://www.nsa.gov/selinux">&lt;http://www.nsa.gov/selinux&gt;</ulink>)
-	   and recommendations for BIND security , which are more
+	   SELinux security policy ( see http://www.nsa.gov/selinux
+	   ) and recommendations for BIND security , which are more
 	   secure than running named in a chroot and make use of
 	   the bind-chroot environment unnecessary .
 	</para>
@@ -1264,30 +1233,6 @@ named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,d
 	</para>
      </answer>
    </qandaentry>
-
-    <qandaentry>
-      <question>
-	<para>
-	  Listening on individual IPv6 interfaces does not work.
-	</para>
-      </question>
-      <answer>
-	<para>
-	  This is usually due to "/proc/net/if_inet6" not being available
-	  in the chroot file system.  Mount another instance of "proc"
-	  in the chroot file system.
-	</para>
-	<para>
-	  This can be be made permanent by adding a second instance to
-	  /etc/fstab.
-	  <informalexample>
-	    <programlisting>
-proc /proc           proc defaults 0 0
-proc /var/named/proc proc defaults 0 0</programlisting>
-	  </informalexample>
-	</para>
-      </answer>
-    </qandaentry>
    
    </qandadiv> <!-- Linux -->
    
@@ -1365,7 +1310,8 @@ rand_irqs="3 14 15"</programlisting>
 	<para>
 	  See also
 	  <ulink url="http://people.freebsd.org/~dougb/randomness.html">
-	  &lt;http://people.freebsd.org/~dougb/randomness.html&gt;</ulink>.
+	    http://people.freebsd.org/~dougb/randomness.html
+	  </ulink>
 	</para>
      </answer>
    </qandaentry>
@@ -1387,7 +1333,7 @@ rand_irqs="3 14 15"</programlisting>
 	<para>
 	  <ulink
 	  url="http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris">
-	 &lt;http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris&gt;
+	     http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris
 	  </ulink>
 	</para>
      </answer>
@@ -54,16 +54,12 @@ BIND 9.5.0

 	Experimental http server and statistics support for named via xml.

-	More detailed statistics counters including those supported in BIND 8.
-
 	Faster ACL processing.

-	Use Doxygen to generate internal documentation.
+	Use Doxygen to generate internal documention.

        Efficient LRU cache-cleaning mechanism.

-        NSID support.
-
 BIND 9.4.0

 	BIND 9.4.0 has a number of new features over 9.3,
@@ -433,6 +429,8 @@ Building
 				    -DDIG_SIGCHASE_BU=1)
 		Disable dropping queries from particular well known ports.
 		  -DNS_CLIENT_DROPPORT=0
+		Disable support for "rrset-order fixed".
+		  -DDNS_RDATASET_FIXED=0

 	    LDFLAGS
 		Linker flags. Defaults to empty string.
@@ -468,11 +466,6 @@ Building
 	on the configure command line.  The default is operating
 	system dependent.

-        Support for the "fixed" rrset-order option can be enabled
-        or disabled by specifying "--enable-fixed-rrset" or
-        "--disable-fixed-rrset" on the configure command line.
-        The default is "disabled", to reduce memory footprint.
-
 	If your operating system has integrated support for IPv6, it
 	will be used automatically.  If you have installed KAME IPv6
 	separately, use "--with-kame[=PATH]" to specify its location.
@@ -515,9 +508,6 @@ Building
 	on your system, and some require Perl; see bin/tests/system/README
 	for details.

-	SunOS 4 requires "printf" to be installed to make the shared
-	libraries.  sh-utils-1.16 provides a "printf" which compiles
-	on SunOS 4.

 Documentation

@@ -1,61 +0,0 @@
-
-			BIND-9 PKCS#11 support
-
-Prerequisite
-
-The PKCS#11 support needs a PKCS#11 OpenSSL engine based on the Solaris one,
-released the 2007-11-21 for OpenSSL 0.9.8g, with a bug fix (call to free)
-and some improvements, including user friendly PIN management.
-
-Compilation
-
-"configure --with-pkcs11 ..."
-
-PKCS#11 Libraries
-
-Tested with Solaris one with a SCA board and with openCryptoki with the
-software token.
-
-OpenSSL Engines
-
-With PKCS#11 support the PKCS#11 engine is statically loaded but at its
-initialization it dynamically loads the PKCS#11 objects.
-Even the pre commands are therefore unused they are defined with:
- SO_PATH:
-   define: PKCS11_SO_PATH
-   default: /usr/local/lib/engines/engine_pkcs11.so
- MODULE_PATH:
-   define: PKCS11_MODULE_PATH
-   default: /usr/lib/libpkcs11.so
-Without PKCS#11 support, a specific OpenSSL engine can be still used
-by defining ENGINE_ID at compile time.
-
-PKCS#11 tools
-
-The contrib/pkcs11-keygen directory contains a set of experimental tools
-to handle keys stored in a Hardware Security Module at the benefit of BIND.
-
-The patch for OpenSSL 0.9.8g is in this directory. Read its README.pkcs11
-for the way to use it (these are the original notes so with the original
-path, etc. Define OPENCRYPTOKI to use it with openCryptoki.)
-
-PIN management
-
-With the just fixed PKCS#11 OpenSSL engine, the PIN should be entered
-each time it is required. With the improved engine, the PIN should be
-entered the first time it is required or can be configured in the
-OpenSSL configuration file (aka. openssl.cnf) by adding in it:
- - at the beginning:
-	openssl_conf = openssl_def
- - at any place these sections:
-	[ openssl_def ]
-	engines = engine_section
-	[ engine_section ]
-	pkcs11 = pkcs11_section
-	[ pkcs11_section ]
-	PIN = put__your__pin__value__here
-
-Note
-
-Some names here are registered trademarks, at least Solaris is a trademark
-of Sun Microsystems Inc...
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: check-tool.c,v 1.34 2008/01/18 23:46:57 tbox Exp $ */
+/* $Id: check-tool.c,v 1.31 2007/09/13 04:45:18 each Exp $ */

 /*! \file */

@@ -60,7 +60,7 @@
 		result = (r); \
 		if (result != ISC_R_SUCCESS) \
 			goto cleanup; \
-	} while (0)
+	} while (0)   

 #define ERR_IS_CNAME 1
 #define ERR_NO_ADDRESSES 2
@@ -78,7 +78,7 @@ isc_boolean_t nomerge = ISC_TRUE;
 isc_boolean_t docheckmx = ISC_TRUE;
 isc_boolean_t dochecksrv = ISC_TRUE;
 isc_boolean_t docheckns = ISC_TRUE;
-unsigned int zone_options = DNS_ZONEOPT_CHECKNS |
+unsigned int zone_options = DNS_ZONEOPT_CHECKNS | 
 			    DNS_ZONEOPT_CHECKMX |
 			    DNS_ZONEOPT_MANYERRORS |
 			    DNS_ZONEOPT_CHECKNAMES |
@@ -109,7 +109,7 @@ freekey(char *key, unsigned int type, isc_symvalue_t value, void *userarg) {
 	UNUSED(type);
 	UNUSED(value);
 	isc_mem_free(userarg, key);
-}
+} 

 static void
 add(char *key, int value) {
@@ -205,9 +205,8 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
 		    !logged(namebuf, ERR_IS_CNAME)) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "%s/NS '%s' (out of zone) "
-				     "is a CNAME '%s' (illegal)",
-				     ownerbuf, namebuf,
-				     cur->ai_canonname);
+				     "is a CNAME (illegal)",
+				     ownerbuf, namebuf);
 			/* XXX950 make fatal for 9.5.0 */
 			/* answer = ISC_FALSE; */
 			add(namebuf, ERR_IS_CNAME);
@@ -377,7 +376,7 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 	if (dns_name_countlabels(name) > 1U)
 		strcat(namebuf, ".");
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
-
+	
 	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	switch (result) {
@@ -398,10 +397,8 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 				if (!logged(namebuf, ERR_IS_MXCNAME)) {
 					dns_zone_log(zone, level,
 						     "%s/MX '%s' (out of zone)"
-						     " is a CNAME '%s' "
-						     "(illegal)",
-						     ownerbuf, namebuf,
-						     cur->ai_canonname);
+						     " is a CNAME (illegal)",
+						     ownerbuf, namebuf);
 					add(namebuf, ERR_IS_MXCNAME);
 				}
 				if (level == ISC_LOG_ERROR)
@@ -462,7 +459,7 @@ checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 	if (dns_name_countlabels(name) > 1U)
 		strcat(namebuf, ".");
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
-
+	
 	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	switch (result) {
@@ -483,9 +480,8 @@ checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 				if (!logged(namebuf, ERR_IS_SRVCNAME)) {
 					dns_zone_log(zone, level, "%s/SRV '%s'"
 						     " (out of zone) is a "
-						     "CNAME '%s' (illegal)",
-						     ownerbuf, namebuf,
-						     cur->ai_canonname);
+						     "CNAME (illegal)",
+						     ownerbuf, namebuf);
 					add(namebuf, ERR_IS_SRVCNAME);
 				}
 				if (level == ISC_LOG_ERROR)
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dig.1,v 1.48 2008/05/15 01:12:20 tbox Exp $
+.\" $Id: dig.1,v 1.45 2007/05/16 06:12:00 marka Exp $
 .\"
 .hy 0
 .ad l
@@ -489,11 +489,6 @@ Requires dig be compiled with \-DDIG_SIGCHASE.
 .RS 4
 When chasing DNSSEC signature chains perform a top\-down validation. Requires dig be compiled with \-DDIG_SIGCHASE.
 .RE
-.PP
-\fB+[no]nsid\fR
-.RS 4
-Include an EDNS name server ID request when sending a query.
-.RE
 .SH "MULTIPLE QUERIES"
 .PP
 The BIND 9 implementation of
@@ -556,7 +551,7 @@ RFC1035.
 .PP
 There are probably too many query options.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dig.c,v 1.221 2008/04/03 02:01:08 marka Exp $ */
+/* $Id: dig.c,v 1.217 2007/06/18 23:47:17 tbox Exp $ */

 /*! \file */

@@ -50,7 +50,7 @@

 #define ADD_STRING(b, s) { 				\
 	if (strlen(s) >= isc_buffer_availablelength(b)) \
-		return (ISC_R_NOSPACE); 		\
+ 		return (ISC_R_NOSPACE); 		\
 	else 						\
 		isc_buffer_putstr(b, s); 		\
 }
@@ -144,8 +144,8 @@ help(void) {
 "        q-type   is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n"
 "                 (Use ixfr=version for type ixfr)\n"
 "        q-opt    is one of:\n"
-"                 -x dot-notation     (shortcut for reverse lookups)\n"
-"                 -i                  (use IP6.INT for IPv6 reverse lookups)\n"
+"                 -x dot-notation     (shortcut for in-addr lookups)\n"
+"                 -i                  (IP6.INT reverse IPv6 lookups)\n"
 "                 -f filename         (batch mode)\n"
 "                 -b address[#port]   (bind to source address/port)\n"
 "                 -p port             (specify port number)\n"
@@ -194,7 +194,6 @@ help(void) {
 "                 +[no]identify       (ID responders in short answers)\n"
 "                 +[no]trace          (Trace delegation down from root)\n"
 "                 +[no]dnssec         (Request DNSSEC records)\n"
-"                 +[no]nsid           (Request Name Server ID)\n"
 #ifdef DIG_SIGCHASE
 "                 +[no]sigchase       (Chase DNSSEC signatures)\n"
 "                 +trusted-key=####   (Trusted Key when chasing DNSSEC sigs)\n"
@@ -384,7 +383,7 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,
 	else if (nottl || noclass)
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 32, 40, 80, 8, mctx);
-	else
+	else 
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 32, 40, 48, 80, 8, mctx);
 	check_result(result, "dns_master_stylecreate");
@@ -393,7 +392,7 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,

 	if (style != NULL)
 		dns_master_styledestroy(&style, mctx);
-
+  
 	return(result);
 }
 #endif
@@ -430,7 +429,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	else if (nottl || noclass)
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 32, 40, 80, 8, mctx);
-	else
+	else 
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 32, 40, 48, 80, 8, mctx);
 	check_result(result, "dns_master_stylecreate");
@@ -639,7 +638,7 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 			strncat(lookup->cmdline, append, remaining);
 		}
 		if (first) {
-			snprintf(append, sizeof(append),
+			snprintf(append, sizeof(append), 
 				 ";; global options: %s %s\n",
 			       short_form ? "short_form" : "",
 			       printcmd ? "printcmd" : "");
@@ -717,7 +716,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			FULLCHECK2("aaonly", "aaflag");
 			lookup->aaonly = state;
 			break;
-		case 'd':
+		case 'd': 
 			switch (cmd[2]) {
 			case 'd': /* additional */
 				FULLCHECK("additional");
@@ -802,13 +801,13 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			FULLCHECK("defname");
 			usesearch = state;
 			break;
-		case 'n': /* dnssec */
+		case 'n': /* dnssec */	
 			FULLCHECK("dnssec");
 			if (state && lookup->edns == -1)
 				lookup->edns = 0;
 			lookup->dnssec = state;
 			break;
-		case 'o': /* domain */
+		case 'o': /* domain */	
 			FULLCHECK("domain");
 			if (value == NULL)
 				goto need_value;
@@ -861,40 +860,28 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 				goto invalid_option;
 			ndots = parse_uint(value, "ndots", MAXNDOTS);
 			break;
-		case 's':
-			switch (cmd[2]) {
-			case 'i': /* nsid */
-				FULLCHECK("nsid");
-				if (state && lookup->edns == -1)
-					lookup->edns = 0;
-				lookup->nsid = state;
-				break;
-			case 's': /* nssearch */
-				FULLCHECK("nssearch");
-				lookup->ns_search_only = state;
-				if (state) {
-					lookup->trace_root = ISC_TRUE;
-					lookup->recurse = ISC_TRUE;
-					lookup->identify = ISC_TRUE;
-					lookup->stats = ISC_FALSE;
-					lookup->comments = ISC_FALSE;
-					lookup->section_additional = ISC_FALSE;
-					lookup->section_authority = ISC_FALSE;
-					lookup->section_question = ISC_FALSE;
-					lookup->rdtype = dns_rdatatype_ns;
-					lookup->rdtypeset = ISC_TRUE;
-					short_form = ISC_TRUE;
-				}
-				break;
-			default:
-				goto invalid_option;
+		case 's': /* nssearch */
+			FULLCHECK("nssearch");
+			lookup->ns_search_only = state;
+			if (state) {
+				lookup->trace_root = ISC_TRUE;
+				lookup->recurse = ISC_TRUE;
+				lookup->identify = ISC_TRUE;
+				lookup->stats = ISC_FALSE;
+				lookup->comments = ISC_FALSE;
+				lookup->section_additional = ISC_FALSE;
+				lookup->section_authority = ISC_FALSE;
+				lookup->section_question = ISC_FALSE;
+				lookup->rdtype = dns_rdatatype_ns;
+				lookup->rdtypeset = ISC_TRUE;
+				short_form = ISC_TRUE;
 			}
 			break;
 		default:
 			goto invalid_option;
 		}
 		break;
-	case 'q':
+	case 'q': 
 		switch (cmd[1]) {
 		case 'r': /* qr */
 			FULLCHECK("qr");
@@ -970,11 +957,11 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			break;
 #ifdef DIG_SIGCHASE
 		case 'i': /* sigchase */
-			FULLCHECK("sigchase");
+		        FULLCHECK("sigchase");
 			lookup->sigchase = state;
 			if (lookup->sigchase)
 				lookup->dnssec = ISC_TRUE;
-			break;
+			break;	
 #endif
 		case 't': /* stats */
 			FULLCHECK("stats");
@@ -1002,7 +989,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 				timeout = 1;
 			break;
 #if DIG_SIGCHASE_TD
-		case 'o': /* topdown */
+		case 'o': /* topdown */	
 			FULLCHECK("topdown");
 			lookup->do_topdown = state;
 			break;
@@ -1037,7 +1024,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 #ifdef DIG_SIGCHASE
 			case 'u': /* trusted-key */
 				FULLCHECK("trusted-key");
-				if (value == NULL)
+			  	if (value == NULL) 
 					goto need_value;
 				if (!state)
 					goto invalid_option;
@@ -1171,7 +1158,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		hash = strchr(value, '#');
 		if (hash != NULL) {
 			srcport = (in_port_t)
-				parse_uint(hash + 1,
+			  	parse_uint(hash + 1,
 					   "port number", MAXPORT);
 			*hash = '\0';
 		} else
@@ -1224,7 +1211,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				(*lookup) = clone_lookup(default_lookup,
 							 ISC_TRUE);
 			*need_clone = ISC_TRUE;
-			strncpy((*lookup)->textname, value,
+			strncpy((*lookup)->textname, value, 
 				sizeof((*lookup)->textname));
 			(*lookup)->textname[sizeof((*lookup)->textname)-1]=0;
 			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
@@ -1263,10 +1250,9 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				(*lookup)->rdtypeset = ISC_TRUE;
 				(*lookup)->ixfr_serial =
 					parse_uint(&value[5], "serial number",
-						MAXSERIAL);
+					  	MAXSERIAL);
 				(*lookup)->section_question = plusquest;
 				(*lookup)->comments = pluscomm;
-				(*lookup)->tcp_mode = ISC_TRUE;
 			} else {
 				(*lookup)->rdtype = rdtype;
 				(*lookup)->rdtypeset = ISC_TRUE;
@@ -1290,7 +1276,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (ptr2 == NULL)
 			usage();
 		ptr3 = next_token(&value,":"); /* secret or NULL */
-		if (ptr3 != NULL) {
+		if (ptr3 != NULL) {	
 			if (strcasecmp(ptr, "hmac-md5") == 0) {
 				hmacname = DNS_TSIG_HMACMD5_NAME;
 				digestbits = 0;
@@ -1439,7 +1425,7 @@ getaddresses(dig_lookup_t *lookup, const char *host) {
 	char tmp[ISC_NETADDR_FORMATSIZE];

 	result = bind9_getaddresses(host, 0, sockaddrs,
-				    DIG_MAX_ADDRESSES, &count);
+				    DIG_MAX_ADDRESSES, &count);   
 	if (result != ISC_R_SUCCESS)
 	fatal("couldn't get address for '%s': %s",
 	      host, isc_result_totext(result));
@@ -1501,7 +1487,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		if (homedir != NULL) {
 			unsigned int n;
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
-				     homedir);
+			             homedir);
 			if (n < sizeof(rcfile))
 				batchfp = fopen(rcfile, "r");
 		}
@@ -1581,7 +1567,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 					tr.base = rv[0];
 					tr.length = strlen(rv[0]);
 					result = dns_rdatatype_fromtext(&rdtype,
-						(isc_textregion_t *)&tr);
+					     	(isc_textregion_t *)&tr);
 					if (result == ISC_R_SUCCESS &&
 					    rdtype == dns_rdatatype_ixfr) {
 						result = DNS_R_UNKNOWN;
@@ -1602,12 +1588,11 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 						lookup->rdtypeset = ISC_TRUE;
 						lookup->ixfr_serial =
 							parse_uint(&rv[0][5],
-								"serial number",
-								MAXSERIAL);
+							  	"serial number",
+							  	MAXSERIAL);
 						lookup->section_question =
 							plusquest;
 						lookup->comments = pluscomm;
-						lookup->tcp_mode = ISC_TRUE;
 					} else {
 						lookup->rdtype = rdtype;
 						lookup->rdtypeset = ISC_TRUE;
@@ -1639,7 +1624,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 					lookup = clone_lookup(default_lookup,
 								      ISC_TRUE);
 				need_clone = ISC_TRUE;
-				strncpy(lookup->textname, rv[0],
+				strncpy(lookup->textname, rv[0], 
 					sizeof(lookup->textname));
 				lookup->textname[sizeof(lookup->textname)-1]=0;
 				lookup->trace_root = ISC_TF(lookup->trace  ||
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: dig.docbook,v 1.40 2008/05/14 23:47:03 tbox Exp $ -->
+<!-- $Id: dig.docbook,v 1.38 2007/06/18 23:47:17 tbox Exp $ -->
 <refentry id="man.dig">

  <refentryinfo>
@@ -42,7 +42,6 @@
      <year>2005</year>
      <year>2006</year>
      <year>2007</year>
-      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -830,14 +829,6 @@
          </listitem>
        </varlistentry>

-        <varlistentry>
-          <term><option>+[no]nsid</option></term>
-          <listitem>
-            <para>
-              Include an EDNS name server ID request when sending a query.
-            </para>
-          </listitem>
-        </varlistentry>


      </variablelist>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dig.html,v 1.43 2008/05/15 01:12:20 tbox Exp $ -->
+<!-- $Id: dig.html,v 1.41 2007/05/16 06:12:01 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -34,7 +34,7 @@
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543511"></a><h2>DESCRIPTION</h2>
+<a name="id2543508"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
      (domain information groper) is a flexible tool
      for interrogating DNS name servers.  It performs DNS lookups and
@@ -80,7 +80,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543580"></a><h2>SIMPLE USAGE</h2>
+<a name="id2543577"></a><h2>SIMPLE USAGE</h2>
 <p>
      A typical invocation of <span><strong class="command">dig</strong></span> looks like:
      </p>
@@ -126,7 +126,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543671"></a><h2>OPTIONS</h2>
+<a name="id2543668"></a><h2>OPTIONS</h2>
 <p>
      The <code class="option">-b</code> option sets the source IP address of the query
      to <em class="parameter"><code>address</code></em>.  This must be a valid
@@ -226,7 +226,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543942"></a><h2>QUERY OPTIONS</h2>
+<a name="id2543939"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">dig</strong></span>
      provides a number of query options which affect
      the way in which lookups are made and the results displayed.  Some of
@@ -539,17 +539,13 @@
              validation.
              Requires dig be compiled with -DDIG_SIGCHASE.
            </p></dd>
-<dt><span class="term"><code class="option">+[no]nsid</code></span></dt>
-<dd><p>
-              Include an EDNS name server ID request when sending a query.
-            </p></dd>
 </dl></div>
 <p>

    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545145"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2545128"></a><h2>MULTIPLE QUERIES</h2>
 <p>
      The BIND 9 implementation of <span><strong class="command">dig </strong></span>
      supports
@@ -595,7 +591,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545275"></a><h2>IDN SUPPORT</h2>
+<a name="id2545258"></a><h2>IDN SUPPORT</h2>
 <p>
      If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
      domain name) support, it can accept and display non-ASCII domain names.
@@ -609,14 +605,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545298"></a><h2>FILES</h2>
+<a name="id2545281"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
    </p>
 <p><code class="filename">${HOME}/.digrc</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545315"></a><h2>SEE ALSO</h2>
+<a name="id2545298"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -624,7 +620,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545352"></a><h2>BUGS</h2>
+<a name="id2545335"></a><h2>BUGS</h2>
 <p>
      There are probably too many query options.
    </p>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dighost.c,v 1.309 2008/04/03 02:01:08 marka Exp $ */
+/* $Id: dighost.c,v 1.303 2007/06/18 23:47:17 tbox Exp $ */

 /*! \file
 *  \note
@@ -277,7 +277,7 @@ dns_name_t chase_name; /* the query name */
 /*
 * the current name is the parent name when we follow delegation
 */
-dns_name_t chase_current_name;
+dns_name_t chase_current_name; 
 /*
 * the child name is used for delegation (NS DS responses in AUTHORITY section)
 */
@@ -493,7 +493,6 @@ void
 fatal(const char *format, ...) {
 	va_list args;

-	fflush(stdout);
 	fprintf(stderr, "%s: ", progname);
 	va_start(args, format);
 	vfprintf(stderr, format, args);
@@ -511,7 +510,6 @@ debug(const char *format, ...) {
 	va_list args;

 	if (debugging) {
-		fflush(stdout);
 		va_start(args, format);
 		vfprintf(stderr, format, args);
 		va_end(args);
@@ -618,13 +616,13 @@ set_nameserver(char *opt) {
 		return;

 	result = bind9_getaddresses(opt, 0, sockaddrs,
-				    DIG_MAX_ADDRESSES, &count);
+				    DIG_MAX_ADDRESSES, &count); 
 	if (result != ISC_R_SUCCESS)
 		fatal("couldn't get address for '%s': %s",
 		      opt, isc_result_totext(result));

 	flush_server_list();
-
+	
 	for (i = 0; i < count; i++) {
 		isc_netaddr_fromsockaddr(&netaddr, &sockaddrs[i]);
 		isc_netaddr_format(&netaddr, tmp, sizeof(tmp));
@@ -724,7 +722,6 @@ make_empty_lookup(void) {
 	looknew->servfail_stops = ISC_TRUE;
 	looknew->besteffort = ISC_TRUE;
 	looknew->dnssec = ISC_FALSE;
-	looknew->nsid = ISC_FALSE;
 #ifdef DIG_SIGCHASE
 	looknew->sigchase = ISC_FALSE;
 #if DIG_SIGCHASE_TD
@@ -804,7 +801,6 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->servfail_stops = lookold->servfail_stops;
 	looknew->besteffort = lookold->besteffort;
 	looknew->dnssec = lookold->dnssec;
-	looknew->nsid = lookold->nsid;
 #ifdef DIG_SIGCHASE
 	looknew->sigchase = lookold->sigchase;
 #if DIG_SIGCHASE_TD
@@ -895,7 +891,7 @@ setup_text_key(void) {
 	result = isc_base64_decodestring(keysecret, &secretbuf);
 	if (result != ISC_R_SUCCESS)
 		goto failure;
-
+	
 	secretsize = isc_buffer_usedlength(&secretbuf);

 	result = dns_name_fromtext(&keyname, namebuf,
@@ -1029,7 +1025,7 @@ setup_system(void) {
 			domain  = NULL;
 		}
 	}
-
+			
 	if (ndots == -1) {
 		ndots = lwconf->ndots;
 		debug("ndots is %d.", ndots);
@@ -1092,7 +1088,7 @@ clear_searchlist(void) {
 void
 set_search_domain(char *domain) {
 	dig_searchlist_t *search;
-
+	
 	clear_searchlist();
 	search = make_searchlist_entry(domain);
 	ISC_LIST_APPEND(search_list, search, link);
@@ -1157,11 +1153,11 @@ setup_libs(void) {

 /*%
 * Add EDNS0 option record to a message.  Currently, the only supported
- * options are UDP buffer size, the DO bit, and NSID request.
+ * options are UDP buffer size and the DO bit.
 */
 static void
 add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
-	isc_boolean_t dnssec, isc_boolean_t nsid)
+	isc_boolean_t dnssec)
 {
 	dns_rdataset_t *rdataset = NULL;
 	dns_rdatalist_t *rdatalist = NULL;
@@ -1184,19 +1180,8 @@ add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
 	rdatalist->ttl = edns << 16;
 	if (dnssec)
 		rdatalist->ttl |= DNS_MESSAGEEXTFLAG_DO;
-	if (nsid) {
-		unsigned char data[4];
-		isc_buffer_t buf;
-
-		isc_buffer_init(&buf, data, sizeof(data));
-		isc_buffer_putuint16(&buf, DNS_OPT_NSID);
-		isc_buffer_putuint16(&buf, 0);
-		rdata->data = data;
-		rdata->length = sizeof(data);
-	} else {
-		rdata->data = NULL;
-		rdata->length = 0;
-	}
+	rdata->data = NULL;
+	rdata->length = 0;
 	ISC_LIST_INIT(rdatalist->rdata);
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	dns_rdatalist_tordataset(rdatalist, rdataset);
@@ -1424,7 +1409,7 @@ start_lookup(void) {
 			current_lookup->qrdtype_sigchase
 				= current_lookup->qrdtype;
 			current_lookup->qrdtype = dns_rdatatype_ns;
-
+		   
 			current_lookup->rdclass_sigchase
 				= current_lookup->rdclass;
 			current_lookup->rdclass_sigchaseset
@@ -1505,7 +1490,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 	INSIST(!free_now);

 	debug("following up %s", query->lookup->textname);
-
+	
 	for (result = dns_message_firstname(msg, section);
 	     result == ISC_R_SUCCESS;
 	     result = dns_message_nextname(msg, section)) {
@@ -1560,8 +1545,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 			dns_rdataset_current(rdataset, &rdata);

 			query->lookup->nsfound++;
-			result = dns_rdata_tostruct(&rdata, &ns, NULL);
-			check_result(result, "dns_rdata_tostruct");
+			(void)dns_rdata_tostruct(&rdata, &ns, NULL);
 			dns_name_format(&ns.name, namestr, sizeof(namestr));
 			dns_rdata_freestruct(&ns);

@@ -1966,15 +1950,12 @@ setup_lookup(dig_lookup_t *lookup) {

 	if ((lookup->rdtype == dns_rdatatype_axfr) ||
 	    (lookup->rdtype == dns_rdatatype_ixfr)) {
+		lookup->doing_xfr = ISC_TRUE;
 		/*
-		 * Force TCP mode if we're doing an axfr.
+		 * Force TCP mode if we're doing an xfr.
+		 * XXX UDP ixfr's would be useful
 		 */
-		if (lookup->rdtype == dns_rdatatype_axfr) {
-			lookup->doing_xfr = ISC_TRUE;
-			lookup->tcp_mode = ISC_TRUE;
-		} else if (lookup->tcp_mode) {
-			lookup->doing_xfr = ISC_TRUE;
-		}
+		lookup->tcp_mode = ISC_TRUE;
 	}

 	add_question(lookup->sendmsg, lookup->name, lookup->rdclass,
@@ -2011,7 +1992,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		if (lookup->edns < 0)
 			lookup->edns = 0;
 		add_opt(lookup->sendmsg, lookup->udpsize,
-			lookup->edns, lookup->dnssec, lookup->nsid);
+			lookup->edns, lookup->dnssec);
 	}

 	result = dns_message_rendersection(lookup->sendmsg,
@@ -2108,7 +2089,7 @@ send_done(isc_task_t *_task, isc_event_t *event) {

 	for  (b = ISC_LIST_HEAD(sevent->bufferlist);
 	      b != NULL;
-	      b = ISC_LIST_HEAD(sevent->bufferlist))
+	      b = ISC_LIST_HEAD(sevent->bufferlist)) 
 		ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);

 	query = event->ev_arg;
@@ -2188,7 +2169,7 @@ bringup_timer(dig_query_t *query, unsigned int default_timeout) {
 				  &l->interval, global_task, connect_timeout,
 				  l, &l->timer);
 	check_result(result, "isc_timer_create");
-}
+}	

 static void
 connect_done(isc_task_t *task, isc_event_t *event);
@@ -2210,7 +2191,7 @@ send_tcp_connect(dig_query_t *query) {
 	query->waiting_connect = ISC_TRUE;
 	query->lookup->current_query = query;
 	get_address(query->servname, port, &query->sockaddr);
-
+	
 	if (specified_source &&
 	    (isc_sockaddr_pf(&query->sockaddr) !=
 	     isc_sockaddr_pf(&bind_address))) {
@@ -2680,8 +2661,7 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 					goto next_rdata;
 				/* Now we have an SOA.  Work with it. */
 				debug("got an SOA");
-				result = dns_rdata_tostruct(&rdata, &soa, NULL);
-				check_result(result, "dns_rdata_tostruct");
+				(void)dns_rdata_tostruct(&rdata, &soa, NULL);
 				serial = soa.serial;
 				dns_rdata_freestruct(&soa);
 				if (!query->first_soa_rcvd) {
@@ -2844,13 +2824,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		char buf2[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_t any;

-		if (isc_sockaddr_pf(&query->sockaddr) == AF_INET)
+		if (isc_sockaddr_pf(&query->sockaddr) == AF_INET) 
 			isc_sockaddr_any(&any);
 		else
 			isc_sockaddr_any6(&any);

 		/*
-		* We don't expect a match when the packet is
+		* We don't expect a match when the packet is 
 		* sent to 0.0.0.0, :: or to a multicast addresses.
 		* XXXMPA broadcast needs to be handled here as well.
 		*/
@@ -2868,7 +2848,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 	}

-	result = dns_message_peekheader(b, &id, &msgflags);
+ 	result = dns_message_peekheader(b, &id, &msgflags);
 	if (result != ISC_R_SUCCESS || l->sendmsg->id != id) {
 		match = ISC_FALSE;
 		if (l->tcp_mode) {
@@ -2973,7 +2953,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		return;
 	}
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 &&
-	    !l->ignore && !l->tcp_mode) {
+            !l->ignore && !l->tcp_mode) {
 		printf(";; Truncated, retrying in TCP mode.\n");
 		n = requeue_lookup(l, ISC_TRUE);
 		n->tcp_mode = ISC_TRUE;
@@ -2985,7 +2965,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		check_next_lookup(l);
 		UNLOCK_LOOKUP;
 		return;
-	}
+	}			
 	if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
 	    (check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
 	{
@@ -3111,7 +3091,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {

 			if (l->trace_root) {
 				/*
-				 * This is the initial NS query.
+				 * This is the initial NS query. 
 				 */
 				int n;

@@ -3126,7 +3106,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				if (!do_sigchase)
 #endif
 				printmessage(query, msg, ISC_TRUE);
-		}
+		} 
 #ifdef DIG_SIGCHASE
 		if (do_sigchase) {
 			chase_msg = isc_mem_allocate(mctx,
@@ -3145,13 +3125,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {

 			isc_buffer_usedregion(b, &r);
 			result = isc_buffer_allocate(mctx, &buf, r.length);
-
+	   
 			check_result(result, "isc_buffer_allocate");
 			result =  isc_buffer_copyregion(buf, &r);
 			check_result(result, "isc_buffer_copyregion");
-
+	   
 			result =  dns_message_parse(msg_temp, buf, 0);
-
+ 
 			isc_buffer_free(&buf);
 			chase_msg->msg = msg_temp;

@@ -3167,9 +3147,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 #endif
 	}
-
+       
 #ifdef DIG_SIGCHASE
-	if (l->sigchase && ISC_LIST_EMPTY(lookup_list)) {
+	if (l->sigchase && ISC_LIST_EMPTY(lookup_list)) {   
 		sigchase(msg_temp);
 	}
 #endif
@@ -3326,7 +3306,7 @@ cancel_all(void) {
 */
 void
 destroy_libs(void) {
-#ifdef DIG_SIGCHASE
+#ifdef DIG_SIGCHASE 
 	void * ptr;
 	dig_message_t *chase_msg;
 #endif
@@ -3366,8 +3346,8 @@ destroy_libs(void) {
 	clear_searchlist();

 #ifdef WITH_IDN
-	result = dns_name_settotextfilter(NULL);
-	check_result(result, "dns_name_settotextfilter");
+        result = dns_name_settotextfilter(NULL);
+        check_result(result, "dns_name_settotextfilter");
 #endif
 	dns_name_destroy();

@@ -3439,7 +3419,7 @@ destroy_libs(void) {
 #endif

 	debug("Destroy memory");
-
+	
 #endif
 	if (memdebugging != 0)
 		isc_mem_stats(mctx, stderr);
@@ -3536,7 +3516,7 @@ append_textname(char *name, const char *origin, size_t namesize) {
 	(void)strcpy(name + namelen, origin);
 	return idn_success;
 }
-
+ 
 static void
 idn_check_result(idn_result_t r, const char *msg) {
 	if (r != idn_success) {
@@ -3572,14 +3552,14 @@ void
 dump_database_section(dns_message_t *msg, int section)
 {
 	dns_name_t *msg_name=NULL;
-
+ 
 	dns_rdataset_t *rdataset;

 	do {
 		dns_message_currentname(msg, section, &msg_name);
-
+    
 		for (rdataset = ISC_LIST_HEAD(msg_name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link)) {
+		     rdataset = ISC_LIST_NEXT(rdataset, link)) {	
 			dns_name_print(msg_name, stdout);
 			printf("\n");
 			print_rdataset(msg_name, rdataset, mctx);
@@ -3596,15 +3576,15 @@ dump_database(void) {
 	for (msg = ISC_LIST_HEAD(chase_message_list);  msg != NULL;
 	     msg = ISC_LIST_NEXT(msg, link)) {
 		if (dns_message_firstname(msg->msg, DNS_SECTION_ANSWER)
-		    == ISC_R_SUCCESS)
+		    == ISC_R_SUCCESS) 
 			dump_database_section(msg->msg, DNS_SECTION_ANSWER);
-
+       
 		if (dns_message_firstname(msg->msg, DNS_SECTION_AUTHORITY)
-		    == ISC_R_SUCCESS)
+		    == ISC_R_SUCCESS) 
 			dump_database_section(msg->msg, DNS_SECTION_AUTHORITY);
-
+	
 		if (dns_message_firstname(msg->msg, DNS_SECTION_ADDITIONAL)
-		    == ISC_R_SUCCESS)
+		    == ISC_R_SUCCESS) 
 			dump_database_section(msg->msg, DNS_SECTION_ADDITIONAL);
 	}
 }
@@ -3634,7 +3614,7 @@ search_type(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers) {
 			if ((siginfo.covered == covers) ||
 			    (covers == dns_rdatatype_any)) {
 				dns_rdata_reset(&sigrdata);
-				dns_rdata_freestruct(&siginfo);
+				dns_rdata_freestruct(&siginfo);	
 				return (rdataset);
 			}
 			dns_rdata_reset(&sigrdata);
@@ -3672,7 +3652,7 @@ chase_scanname(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers)
 {
 	dns_rdataset_t *rdataset = NULL;
 	dig_message_t * msg;
-
+ 
 	for (msg = ISC_LIST_HEAD(chase_message_list2);  msg != NULL;
 	     msg = ISC_LIST_NEXT(msg, link)) {
 		if (dns_message_firstname(msg->msg, DNS_SECTION_ANSWER)
@@ -3765,7 +3745,7 @@ insert_trustedkey(dst_key_t * key)
 		return;

 	tk_list.key[tk_list.nb_tk++] = key;
-	return;
+	return;   
 }

 void
@@ -3788,7 +3768,7 @@ char alphnum[] =
 	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";

 isc_result_t
-removetmpkey(isc_mem_t *mctx, const char *file)
+removetmpkey(isc_mem_t *mctx, const char *file) 
 {
 	char *tempnamekey = NULL;
 	int tempnamekeylen;
@@ -3801,7 +3781,7 @@ removetmpkey(isc_mem_t *mctx, const char *file)
 		return (ISC_R_NOMEMORY);

 	memset(tempnamekey, 0, tempnamekeylen);
-
+ 
 	strcat(tempnamekey, file);
 	strcat(tempnamekey,".key");
 	isc_file_remove(tempnamekey);
@@ -3841,24 +3821,24 @@ opentmpkey(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {
 			isc_mem_free(mctx, tempname);
 			return (ISC_R_FAILURE);
 		}
-
+	    
 		x = cp--;
 		while (cp >= tempname && *cp == 'X') {
 			isc_random_get(&which);
 			*cp = alphnum[which % (sizeof(alphnum) - 1)];
 			x = cp--;
 		}
-
+ 
 		tempnamekeylen = tempnamelen+5;
 		tempnamekey = isc_mem_allocate(mctx, tempnamekeylen);
 		if (tempnamekey == NULL)
 			return (ISC_R_NOMEMORY);
-
+	
 		memset(tempnamekey, 0, tempnamekeylen);
 		strncpy(tempnamekey, tempname, tempnamelen);
 		strcat(tempnamekey ,".key");

-
+	   
 		if (isc_file_exists(tempnamekey)) {
 			isc_mem_free(mctx, tempnamekey);
 			isc_mem_free(mctx, tempname);
@@ -3879,7 +3859,7 @@ opentmpkey(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {

 cleanup:
 	isc_mem_free(mctx, tempname);
-
+	
 	return (result);
 }

@@ -3893,7 +3873,7 @@ get_trusted_key(isc_mem_t *mctx)
 	char buf[1500];
 	FILE *fp, *fptemp;
 	dst_key_t *key = NULL;
-
+ 
 	result = isc_file_exists(trustedkey);
 	if (result !=  ISC_TRUE) {
 		result = isc_file_exists("/etc/trusted-key.key");
@@ -3971,11 +3951,11 @@ nameFromString(const char *str, dns_name_t *p_ret) {

 	result = dns_name_dup(dns_fixedname_name(&fixedname), mctx, p_ret);
 	check_result(result, "nameFromString");
-}
+} 


 #if DIG_SIGCHASE_TD
-isc_result_t
+isc_result_t 
 prepare_lookup(dns_name_t *name)
 {
 	isc_result_t result;
@@ -3993,7 +3973,7 @@ prepare_lookup(dns_name_t *name)
 	lookup->rdtype = lookup->rdtype_sigchase;
 	lookup->rdtypeset = ISC_TRUE;
 	lookup->qrdtype = lookup->qrdtype_sigchase;
-
+   
 	s = ISC_LIST_HEAD(lookup->my_server_list);
 	while (s != NULL) {
 		debug("freeing server %p belonging to %p",
@@ -4026,11 +4006,12 @@ prepare_lookup(dns_name_t *name)

 		dns_rdataset_current(chase_nsrdataset, &rdata);

-		result = dns_rdata_tostruct(&rdata, &ns, NULL);
-		check_result(result, "dns_rdata_tostruct");
-
+		(void)dns_rdata_tostruct(&rdata, &ns, NULL);
+      
+     
+      
 #ifdef __FOLLOW_GLUE__
-
+      
 		result = advanced_rrsearch(&rdataset, &ns.name,
 					   dns_rdatatype_aaaa,
 					   dns_rdatatype_any, &true);
@@ -4054,12 +4035,12 @@ prepare_lookup(dns_name_t *name)


 				srv = make_server(namestr, namestr);
-
+	     
 				ISC_LIST_APPEND(lookup->my_server_list,
 						srv, link);
 			}
 		}
-
+      
 		rdataset = NULL;
 		result = advanced_rrsearch(&rdataset, &ns.name, dns_rdatatype_a,
 					   dns_rdatatype_any, &true);
@@ -4081,28 +4062,28 @@ prepare_lookup(dns_name_t *name)
 				isc_buffer_free(&b);
 				dns_rdata_reset(&a);
 				printf("ns name: %s\n", namestr);
-
+      

 				srv = make_server(namestr, namestr);
-
+	     
 				ISC_LIST_APPEND(lookup->my_server_list,
 						srv, link);
 			}
 		}
 #else
-
+       
 		dns_name_format(&ns.name, namestr, sizeof(namestr));
 		printf("ns name: ");
 		dns_name_print(&ns.name, stdout);
 		printf("\n");
 		srv = make_server(namestr, namestr);
-
+	     
 		ISC_LIST_APPEND(lookup->my_server_list, srv, link);

-#endif
+#endif 
 		dns_rdata_freestruct(&ns);
 		dns_rdata_reset(&rdata);
-
+      
 	}

 	ISC_LIST_APPEND(lookup_list, lookup, link);
@@ -4156,10 +4137,10 @@ grandfather_pb_test(dns_name_t *zone_name, dns_rdataset_t  *sigrdataset)

 	do {
 		dns_rdataset_current(sigrdataset, &sigrdata);
-
+    
 		result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
 		check_result(result, "sigrdata tostruct siginfo");
-
+ 
 		if (dns_name_compare(&siginfo.signer, zone_name) == 0) {
 			dns_rdata_freestruct(&siginfo);
 			dns_rdata_reset(&sigrdata);
@@ -4167,7 +4148,7 @@ grandfather_pb_test(dns_name_t *zone_name, dns_rdataset_t  *sigrdataset)
 		}

 		dns_rdata_freestruct(&siginfo);
-
+ 
 	} while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);

 	dns_rdata_reset(&sigrdata);
@@ -4197,7 +4178,7 @@ initialization(dns_name_t *name)

 	return (ISC_R_SUCCESS);
 }
-#endif
+#endif 

 void
 print_rdataset(dns_name_t *name, dns_rdataset_t *rdataset, isc_mem_t *mctx)
@@ -4221,10 +4202,10 @@ print_rdataset(dns_name_t *name, dns_rdataset_t *rdataset, isc_mem_t *mctx)
 }


-void
+void 
 dup_name(dns_name_t *source, dns_name_t *target, isc_mem_t *mctx) {
-	isc_result_t result;
-
+	isc_result_t result; 
+ 
 	if (dns_name_dynamic(target))
 		free_name(target, mctx);
 	result = dns_name_dup(source, mctx, target);
@@ -4243,7 +4224,7 @@ free_name(dns_name_t *name, isc_mem_t *mctx) {
 * return ISC_R_SUCCESS if the DNSKEY RRset contains a trusted_key
 * 			and the RRset is valid
 * return ISC_R_NOTFOUND if not contains trusted key
-			or if the RRset isn't valid
+ 			or if the RRset isn't valid
 * return ISC_R_FAILURE if problem
 *
 */
@@ -4268,17 +4249,17 @@ contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
 	do {
 		dns_rdataset_current(rdataset, &rdata);
 		INSIST(rdata.type == dns_rdatatype_dnskey);
-
+  	  
 		result = dns_dnssec_keyfromrdata(name, &rdata,
 						 mctx, &dnsseckey);
 		check_result(result, "dns_dnssec_keyfromrdata");

-
+    
 		for (i = 0; i < tk_list.nb_tk; i++) {
 			if (dst_key_compare(tk_list.key[i], dnsseckey)
 			    == ISC_TRUE) {
 				dns_rdata_reset(&rdata);
-
+	
 				printf(";; Ok, find a Trusted Key in the "
 				       "DNSKEY RRset: %d\n",
 				       dst_key_id(dnsseckey));
@@ -4293,7 +4274,7 @@ contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
 				}
 			}
 		}
-
+ 
 		dns_rdata_reset(&rdata);
 		if (dnsseckey != NULL)
 			dst_key_free(&dnsseckey);
@@ -4323,7 +4304,7 @@ sigchase_verify_sig(dns_name_t *name, dns_rdataset_t *rdataset,
 	do {
 		dns_rdataset_current(keyrdataset, &keyrdata);
 		INSIST(keyrdata.type == dns_rdatatype_dnskey);
-
+  	  
 		result = dns_dnssec_keyfromrdata(name, &keyrdata,
 						 mctx, &dnsseckey);
 		check_result(result, "dns_dnssec_keyfromrdata");
@@ -4355,22 +4336,22 @@ sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
 	result = dns_rdataset_first(sigrdataset);
 	check_result(result, "empty RRSIG dataset");
 	dns_rdata_init(&sigrdata);
-
+    
 	do {
 		dns_rdataset_current(sigrdataset, &sigrdata);

 		result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
 		check_result(result, "sigrdata tostruct siginfo");
-
+ 
 		/*
 		 * Test if the id of the DNSKEY is
 		 * the id of the DNSKEY signer's
 		 */
 		if (siginfo.keyid == dst_key_id(dnsseckey)) {
-
+    
 			result = dns_rdataset_first(rdataset);
 			check_result(result, "empty DS dataset");
-
+    
 			result = dns_dnssec_verify(name, rdataset, dnsseckey,
 						   ISC_FALSE, mctx, &sigrdata);

@@ -4387,7 +4368,7 @@ sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
 			}
 		}
 		dns_rdata_freestruct(&siginfo);
-
+ 
 	} while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);

 	dns_rdata_reset(&sigrdata);
@@ -4413,18 +4394,18 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 	dns_rdata_init(&dsrdata);
 	do {
 		dns_rdataset_current(dsrdataset, &dsrdata);
-
+    
 		result = dns_rdata_tostruct(&dsrdata, &dsinfo, NULL);
 		check_result(result, "dns_rdata_tostruct  for DS");
-
+    
 		result = dns_rdataset_first(keyrdataset);
 		check_result(result, "empty KEY dataset");
-		dns_rdata_init(&keyrdata);
+		dns_rdata_init(&keyrdata);	  

 		do {
 			dns_rdataset_current(keyrdataset, &keyrdata);
 			INSIST(keyrdata.type == dns_rdatatype_dnskey);
-
+  	  
 			result = dns_dnssec_keyfromrdata(name, &keyrdata,
 							 mctx, &dnsseckey);
 			check_result(result, "dns_dnssec_keyfromrdata");
@@ -4439,20 +4420,20 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 				result = dns_ds_buildrdata(name, &keyrdata,
 							   dsinfo.digest_type,
 							   dsbuf, &newdsrdata);
-				dns_rdata_freestruct(&dsinfo);
+				dns_rdata_freestruct(&dsinfo);  

 				if (result != ISC_R_SUCCESS) {
 					dns_rdata_reset(&keyrdata);
 					dns_rdata_reset(&newdsrdata);
 					dns_rdata_reset(&dsrdata);
 					dst_key_free(&dnsseckey);
-					dns_rdata_freestruct(&dsinfo);
+					dns_rdata_freestruct(&dsinfo);  
 					printf("Oops: impossible to build"
 					       " new DS rdata\n");
 					return (result);
 				}
-
-
+	
+	
 				if (dns_rdata_compare(&dsrdata,
 						      &newdsrdata) == 0) {
 					printf(";; OK a DS valids a DNSKEY"
@@ -4460,7 +4441,7 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 					printf(";; Now verify that this"
 					       " DNSKEY validates the "
 					       "DNSKEY RRset\n");
-
+	       
 					result = sigchase_verify_sig_key(name,
 							 keyrdataset,
 							 dnsseckey,
@@ -4471,7 +4452,7 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 						dns_rdata_reset(&newdsrdata);
 						dns_rdata_reset(&dsrdata);
 						dst_key_free(&dnsseckey);
-
+		 
 						return (result);
 					}
 				} else {
@@ -4485,12 +4466,12 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 			dnsseckey = NULL;
 		} while (dns_rdataset_next(chase_keyrdataset) == ISC_R_SUCCESS);
 		dns_rdata_reset(&keyrdata);
-
+ 
 	} while (dns_rdataset_next(chase_dsrdataset) == ISC_R_SUCCESS);
 #if 0
 	dns_rdata_reset(&dsrdata); WARNING
 #endif
-
+ 
 	return (ISC_R_NOTFOUND);
 }

@@ -4503,13 +4484,13 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 * ISC_R_SUCCESS: if we found the rrset
 * ISC_R_NOTFOUND: we do not found the rrset in cache
 * and we do a query on the net
- * ISC_R_FAILURE: rrset not found
+ * ISC_R_FAILURE: rrset not found 
 */
 isc_result_t
 advanced_rrsearch(dns_rdataset_t **rdataset, dns_name_t *name,
 		  dns_rdatatype_t type, dns_rdatatype_t covers,
 		  isc_boolean_t *lookedup)
-{
+{ 
 	isc_boolean_t  tmplookedup;

 	INSIST(rdataset != NULL);
@@ -4584,7 +4565,7 @@ sigchase_td(dns_message_t *msg)
 		}
 	}

-
+   
 	if (have_answer) {
 		chase_rdataset
 			= chase_scanname_section(msg, &chase_name,
@@ -4644,7 +4625,7 @@ sigchase_td(dns_message_t *msg)
 						    chase_dsrdataset,
 						    mctx);
 		}
-
+      
 		if (result != ISC_R_SUCCESS) {
 			printf("\n;; chain of trust can't be validated:"
 			       " FAILED\n\n");
@@ -4696,7 +4677,7 @@ sigchase_td(dns_message_t *msg)
 			chase_sigrdataset = NULL;
 			have_response = ISC_FALSE;
 			have_delegation_ns = ISC_FALSE;
-
+	  
 			dns_name_init(&tmp_name, NULL);
 			result = child_of_zone(&chase_name, &chase_current_name,
 					       &tmp_name);
@@ -4775,10 +4756,10 @@ sigchase_td(dns_message_t *msg)
 		}
 		chase_keyrdataset = NULL;
 		chase_sigkeyrdataset = NULL;
-
-
+    
+ 
 		prepare_lookup(&chase_authority_name);
-
+	
 		have_response = ISC_FALSE;
 		have_delegation_ns = ISC_FALSE;
 		delegation_follow = ISC_TRUE;
@@ -4872,7 +4853,7 @@ sigchase_td(dns_message_t *msg)
 	}
 }

-#endif
+#endif 


 #if DIG_SIGCHASE_BU
@@ -4889,7 +4870,7 @@ getneededrr(dns_message_t *msg)
 	if ((result = dns_message_firstname(msg, DNS_SECTION_ANSWER))
 	    != ISC_R_SUCCESS) {
 		printf(";; NO ANSWERS: %s\n", isc_result_totext(result));
-
+    
 		if (chase_name.ndata == NULL)
 			return (ISC_R_ADDRNOTAVAIL);
 	} else {
@@ -4932,7 +4913,7 @@ getneededrr(dns_message_t *msg)
 	}
 	INSIST(chase_sigrdataset != NULL);

-
+ 
 	/* first find the DNSKEY name */
 	result = dns_rdataset_first(chase_sigrdataset);
 	check_result(result, "empty RRSIG dataset");
@@ -4943,7 +4924,7 @@ getneededrr(dns_message_t *msg)
 	dup_name(&siginfo.signer, &chase_signame, mctx);
 	dns_rdata_freestruct(&siginfo);
 	dns_rdata_reset(&sigrdata);
-
+ 
 	/* Do we have a key?  */
 	if (chase_keyrdataset == NULL) {
 		result = advanced_rrsearch(&chase_keyrdataset,
@@ -5012,7 +4993,7 @@ getneededrr(dns_message_t *msg)
 			print_rdataset(&chase_signame, chase_dsrdataset, mctx);
 		}
 	}
-
+ 
 	if (chase_dsrdataset != NULL) {
 		/*
 		 * if there is no RRSIG of DS,
@@ -5071,7 +5052,7 @@ sigchase_bu(dns_message_t *msg)
 		dns_name_init(&query_name, NULL);
 		dns_name_init(&rdata_name, NULL);
 		nameFromString(current_lookup->textname, &query_name);
-
+   
 		result = prove_nx(msg, &query_name, current_lookup->rdclass,
 				  current_lookup->rdtype, &rdata_name,
 				  &rdataset, &sigrdataset);
@@ -5093,7 +5074,7 @@ sigchase_bu(dns_message_t *msg)
 		}
 		printf(";; An NSEC prove the non-existence of a answers,"
 		       " Now we want validate this NSEC\n");
-
+	
 		dup_name(&rdata_name, &chase_name, mctx);
 		free_name(&rdata_name, mctx);
 		chase_rdataset =  rdataset;
@@ -5174,7 +5155,7 @@ sigchase_bu(dns_message_t *msg)
 	chase_sigdsrdataset = NULL;
 	chase_siglookedup = chase_keylookedup = ISC_FALSE;
 	chase_dslookedup = chase_sigdslookedup = ISC_FALSE;
-
+ 
 	printf(";; Now, we want to validate the DS :  recursive call\n");
 	sigchase(msg);
 	return;
@@ -5267,7 +5248,7 @@ prove_nx_domain(dns_message_t *msg,
 		       " validate the non-existence : FAILED\n");
 		return (ISC_R_FAILURE);
 	}
-
+ 
 	do {
 		nsecname = NULL;
 		dns_message_currentname(msg, DNS_SECTION_AUTHORITY, &nsecname);
@@ -5345,7 +5326,7 @@ prove_nx_type(dns_message_t *msg, dns_name_t *name, dns_rdataset_t *nsecset,

 	ret = dns_rdataset_first(nsecset);
 	check_result(ret,"dns_rdataset_first");
-
+	
 	dns_rdataset_current(nsecset, &nsec);

 	ret = dns_nsec_typepresent(&nsec, type);
@@ -5413,6 +5394,6 @@ prove_nx(dns_message_t *msg, dns_name_t *name, dns_rdataclass_t class,
 				      rdataset, sigrdataset);
 		return (ret);
 	}
-	/* Never get here */
+	/* Never get here */ 
 }
 #endif
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: host.1,v 1.29 2008/04/05 01:09:34 tbox Exp $
+.\" $Id: host.1,v 1.28 2007/05/09 03:33:50 marka Exp $
 .\"
 .hy 0
 .ad l
@@ -154,7 +154,7 @@ option is used to select the query type.
 \fItype\fR
 can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified,
 \fBhost\fR
-automatically selects an appropriate query type. By default it looks for A, AAAA, and MX records, but if the
+automatically selects an appropriate query type. By default it looks for A records, but if the
 \fB\-C\fR
 option was given, queries will be made for SOA records, and if
 \fIname\fR
@@ -213,7 +213,7 @@ runs.
 \fBdig\fR(1),
 \fBnamed\fR(8).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2002 Internet Software Consortium.
 .br
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: host.c,v 1.116 2007/12/03 00:21:48 marka Exp $ */
+/* $Id: host.c,v 1.115 2007/08/15 04:40:30 marka Exp $ */

 /*! \file */

@@ -689,7 +689,6 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 				lookup->tcp_mode = ISC_TRUE;
 			} else if (rdtype == dns_rdatatype_ixfr) {
 				lookup->ixfr_serial = serial;
-				lookup->tcp_mode = ISC_TRUE;
 				list_type = rdtype;
 #ifdef WITH_IDN
 			} else if (rdtype == dns_rdatatype_a ||
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: host.docbook,v 1.18 2008/04/04 23:47:01 tbox Exp $ -->
+<!-- $Id: host.docbook,v 1.16 2007/06/18 23:47:17 tbox Exp $ -->
 <refentry id="man.host">

  <refentryinfo>
@@ -41,7 +41,6 @@
      <year>2004</year>
      <year>2005</year>
      <year>2007</year>
-      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -200,7 +199,7 @@
      NS, SOA, SIG, KEY, AXFR, etc.  When no query type is specified,
      <command>host</command> automatically selects an appropriate
      query
-      type.  By default it looks for A, AAAA, and MX records, but if the
+      type.  By default it looks for A records, but if the
      <option>-C</option> option was given, queries will be made for SOA
      records, and if <parameter>name</parameter> is a
      dotted-decimal IPv4
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: host.html,v 1.28 2008/04/05 01:09:34 tbox Exp $ -->
+<!-- $Id: host.html,v 1.27 2007/05/09 03:33:50 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">host</code>  [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] {name} [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543431"></a><h2>DESCRIPTION</h2>
+<a name="id2543428"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">host</strong></span>
      is a simple utility for performing DNS lookups.
      It is normally used to convert names to IP addresses and vice versa.
@@ -148,7 +148,7 @@
      NS, SOA, SIG, KEY, AXFR, etc.  When no query type is specified,
      <span><strong class="command">host</strong></span> automatically selects an appropriate
      query
-      type.  By default it looks for A, AAAA, and MX records, but if the
+      type.  By default it looks for A records, but if the
      <code class="option">-C</code> option was given, queries will be made for SOA
      records, and if <em class="parameter"><code>name</code></em> is a
      dotted-decimal IPv4
@@ -184,7 +184,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543797"></a><h2>IDN SUPPORT</h2>
+<a name="id2543725"></a><h2>IDN SUPPORT</h2>
 <p>
      If <span><strong class="command">host</strong></span> has been built with IDN (internationalized
      domain name) support, it can accept and display non-ASCII domain names. 
@@ -198,12 +198,12 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543819"></a><h2>FILES</h2>
+<a name="id2543748"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543831"></a><h2>SEE ALSO</h2>
+<a name="id2543828"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
    </p>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dig.h,v 1.107 2008/04/03 06:09:04 tbox Exp $ */
+/* $Id: dig.h,v 1.105 2007/06/18 23:47:17 tbox Exp $ */

 #ifndef DIG_H
 #define DIG_H
@@ -102,7 +102,7 @@ typedef struct dig_searchlist dig_searchlist_t;
 /*% The dig_lookup structure */
 struct dig_lookup {
 	isc_boolean_t
-		pending, /*%< Pending a successful answer */
+	        pending, /*%< Pending a successful answer */
 		waiting_connect,
 		doing_xfr,
 		ns_search_only, /*%< dig +nssearch, host -C */
@@ -129,28 +129,27 @@ struct dig_lookup {
 		need_search,
 		done_as_is,
 		besteffort,
-		dnssec,
-		nsid;   /*% Name Server ID (RFC 5001) */
+		dnssec;
 #ifdef DIG_SIGCHASE
 isc_boolean_t	sigchase;
 #if DIG_SIGCHASE_TD
-	isc_boolean_t do_topdown,
-		trace_root_sigchase,
-		rdtype_sigchaseset,
-		rdclass_sigchaseset;
+ 	isc_boolean_t do_topdown,
+	        trace_root_sigchase,
+	        rdtype_sigchaseset,
+	        rdclass_sigchaseset;
 	/* Name we are going to validate RRset */
-	char textnamesigchase[MXNAME];
+  	char textnamesigchase[MXNAME];
 #endif
 #endif
-
+	
 	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;
 	dns_rdatatype_t qrdtype;
 #if DIG_SIGCHASE_TD
-	dns_rdatatype_t rdtype_sigchase;
-	dns_rdatatype_t qrdtype_sigchase;
-	dns_rdataclass_t rdclass_sigchase;
+        dns_rdatatype_t rdtype_sigchase;
+        dns_rdatatype_t qrdtype_sigchase;
+        dns_rdataclass_t rdclass_sigchase;
 #endif
 	dns_rdataclass_t rdclass;
 	isc_boolean_t rdtypeset;
@@ -232,7 +231,7 @@ struct dig_searchlist {
 };
 #ifdef DIG_SIGCHASE
 struct dig_message {
-		dns_message_t *msg;
+	        dns_message_t *msg;
 		ISC_LINK(dig_message_t) link;
 };
 #endif
@@ -250,7 +249,7 @@ extern dig_searchlistlist_t search_list;
 extern unsigned int extrabytes;

 extern isc_boolean_t check_ra, have_ipv4, have_ipv6, specified_source,
-	usesearch, showsearch, qr;
+        usesearch, showsearch, qr;
 extern in_port_t port;
 extern unsigned int timeout;
 extern isc_mem_t *mctx;
@@ -3,6 +3,5 @@ dnssec-keygen
 dnssec-makekeyset
 dnssec-signkey
 dnssec-signzone
-dnssec-keyfromlabel
 *.lo
 .libs
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: Makefile.in,v 1.34 2008/04/01 23:47:10 tbox Exp $
+# $Id: Makefile.in,v 1.32 2007/06/19 23:46:59 tbox Exp $

 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -39,27 +39,20 @@ DEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
 LIBS =		${DNSLIBS} ${ISCLIBS} @LIBS@

 # Alphabetically
-TARGETS =	dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@ \
-		dnssec-keyfromlabel@EXEEXT@
+TARGETS =	dnssec-keygen@EXEEXT@ dnssec-signzone@EXEEXT@

 OBJS =		dnssectool.@O@

-SRCS =		dnssec-keyfromlabel.c dnssec-keygen.c dnssec-signzone.c \
-		dnssectool.c
+SRCS =		dnssec-keygen.c dnssec-signzone.c dnssectool.c

-MANPAGES =	dnssec-keyfromlabel.8 dnssec-keygen.8 dnssec-signzone.8
+MANPAGES =	dnssec-keygen.8 dnssec-signzone.8

-HTMLPAGES =	dnssec-keyfromlabel.html dnssec-keygen.html \
-		dnssec-signzone.html
+HTMLPAGES =	dnssec-keygen.html dnssec-signzone.html

 MANOBJS =	${MANPAGES} ${HTMLPAGES}

@BIND9_MAKE_RULES@

-dnssec-keyfromlabel@EXEEXT@: dnssec-keyfromlabel.@O@ ${OBJS} ${DEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
-	dnssec-keyfromlabel.@O@ ${OBJS} ${LIBS}
-
 dnssec-keygen@EXEEXT@: dnssec-keygen.@O@ ${OBJS} ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 	dnssec-keygen.@O@ ${OBJS} ${LIBS}
@@ -1,149 +0,0 @@
-.\" Copyright (C) 2008 Internet Systems Consortium, Inc. ("ISC")
-.\" 
-.\" Permission to use, copy, modify, and distribute this software for any
-.\" purpose with or without fee is hereby granted, provided that the above
-.\" copyright notice and this permission notice appear in all copies.
-.\" 
-.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
-.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
-.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
-.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-.\" PERFORMANCE OF THIS SOFTWARE.
-.\"
-.\" $Id: dnssec-keyfromlabel.8,v 1.3 2008/04/01 01:11:50 tbox Exp $
-.\"
-.hy 0
-.ad l
-.\"     Title: dnssec\-keyfromlabel
-.\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
-.\"      Date: february 8, 2008
-.\"    Manual: BIND9
-.\"    Source: BIND9
-.\"
-.TH "DNSSEC\-KEYFROMLABEL" "8" "february 8, 2008" "BIND9" "BIND9"
-.\" disable hyphenation
-.nh
-.\" disable justification (adjust text to left margin only)
-.ad l
-.SH "NAME"
-dnssec\-keyfromlabel \- DNSSEC key generation tool
-.SH "SYNOPSIS"
-.HP 20
-\fBdnssec\-keyfromlabel\fR {\-a\ \fIalgorithm\fR} {\-l\ \fIlabel\fR} [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-k\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
-.SH "DESCRIPTION"
-.PP
-\fBdnssec\-keyfromlabel\fR
-gets keys with the given label from a crypto hardware and builds key files for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034.
-.SH "OPTIONS"
-.PP
-\-a \fIalgorithm\fR
-.RS 4
-Selects the cryptographic algorithm. The value of
-\fBalgorithm\fR
-must be one of RSAMD5 (RSA) or RSASHA1, DSA or DH (Diffie Hellman). These values are case insensitive.
-.sp
-Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement algorithm, and DSA is recommended.
-.sp
-Note 2: DH automatically sets the \-k flag.
-.RE
-.PP
-\-l \fIlabel\fR
-.RS 4
-Specifies the label of keys in the crypto hardware (PKCS#11 device).
-.RE
-.PP
-\-n \fInametype\fR
-.RS 4
-Specifies the owner type of the key. The value of
-\fBnametype\fR
-must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY). These values are case insensitive.
-.RE
-.PP
-\-c \fIclass\fR
-.RS 4
-Indicates that the DNS record containing the key should have the specified class. If not specified, class IN is used.
-.RE
-.PP
-\-f \fIflag\fR
-.RS 4
-Set the specified flag in the flag field of the KEY/DNSKEY record. The only recognized flag is KSK (Key Signing Key) DNSKEY.
-.RE
-.PP
-\-h
-.RS 4
-Prints a short summary of the options and arguments to
-\fBdnssec\-keygen\fR.
-.RE
-.PP
-\-k
-.RS 4
-Generate KEY records rather than DNSKEY records.
-.RE
-.PP
-\-p \fIprotocol\fR
-.RS 4
-Sets the protocol value for the generated key. The protocol is a number between 0 and 255. The default is 3 (DNSSEC). Other possible values for this argument are listed in RFC 2535 and its successors.
-.RE
-.PP
-\-t \fItype\fR
-.RS 4
-Indicates the use of the key.
-\fBtype\fR
-must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data.
-.RE
-.PP
-\-v \fIlevel\fR
-.RS 4
-Sets the debugging level.
-.RE
-.SH "GENERATED KEY FILES"
-.PP
-When
-\fBdnssec\-keyfromlabel\fR
-completes successfully, it prints a string of the form
-\fIKnnnn.+aaa+iiiii\fR
-to the standard output. This is an identification string for the key files it has generated.
-.TP 4
-\(bu
-\fInnnn\fR
-is the key name.
-.TP 4
-\(bu
-\fIaaa\fR
-is the numeric representation of the algorithm.
-.TP 4
-\(bu
-\fIiiiii\fR
-is the key identifier (or footprint).
-.PP
-\fBdnssec\-keyfromlabel\fR
-creates two files, with names based on the printed string.
-\fIKnnnn.+aaa+iiiii.key\fR
-contains the public key, and
-\fIKnnnn.+aaa+iiiii.private\fR
-contains the private key.
-.PP
-The
-\fI.key\fR
-file contains a DNS KEY record that can be inserted into a zone file (directly or with a $INCLUDE statement).
-.PP
-The
-\fI.private\fR
-file contains algorithm specific fields. For obvious security reasons, this file does not have general read permission.
-.SH "SEE ALSO"
-.PP
-\fBdnssec\-keygen\fR(8),
-\fBdnssec\-signzone\fR(8),
-BIND 9 Administrator Reference Manual,
-RFC 2535,
-RFC 2845,
-RFC 2539.
-.SH "AUTHOR"
-.PP
-Internet Systems Consortium
-.SH "COPYRIGHT"
-Copyright \(co 2008 Internet Systems Consortium, Inc. ("ISC")
-.br
@@ -1,326 +0,0 @@
-/*
- * Copyright (C) 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- * PERFORMANCE OF THIS SOFTWARE.
- */
-
-/* $Id: dnssec-keyfromlabel.c,v 1.3 2008/03/31 23:47:11 tbox Exp $ */
-
-/*! \file */
-
-#include <config.h>
-
-#include <stdlib.h>
-
-#include <isc/buffer.h>
-#include <isc/commandline.h>
-#include <isc/entropy.h>
-#include <isc/mem.h>
-#include <isc/region.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/fixedname.h>
-#include <dns/keyvalues.h>
-#include <dns/log.h>
-#include <dns/name.h>
-#include <dns/rdataclass.h>
-#include <dns/result.h>
-#include <dns/secalg.h>
-
-#include <dst/dst.h>
-
-#include "dnssectool.h"
-
-#define MAX_RSA 4096 /* should be long enough... */
-
-const char *program = "dnssec-keyfromlabel";
-int verbose;
-
-static const char *algs = "RSA | RSAMD5 | DH | DSA | RSASHA1";
-
-static void
-usage(void) {
-	fprintf(stderr, "Usage:\n");
-	fprintf(stderr, "    %s -a alg -l label [options] name\n\n",
-		program);
-	fprintf(stderr, "Version: %s\n", VERSION);
-	fprintf(stderr, "Required options:\n");
-	fprintf(stderr, "    -a algorithm: %s\n", algs);
-	fprintf(stderr, "    -l label: label of the key\n");
-	fprintf(stderr, "    name: owner of the key\n");
-	fprintf(stderr, "Other options:\n");
-	fprintf(stderr, "    -n nametype: ZONE | HOST | ENTITY | USER | OTHER\n");
-	fprintf(stderr, "        (DNSKEY generation defaults to ZONE\n");
-	fprintf(stderr, "    -c <class> (default: IN)\n");
-	fprintf(stderr, "    -f keyflag: KSK\n");
-	fprintf(stderr, "    -t <type>: "
-		"AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF "
-		"(default: AUTHCONF)\n");
-	fprintf(stderr, "    -p <protocol>: "
-	       "default: 3 [dnssec]\n");
-	fprintf(stderr, "    -v <verbose level>\n");
-	fprintf(stderr, "    -k : generate a TYPE=KEY key\n");
-	fprintf(stderr, "Output:\n");
-	fprintf(stderr, "     K<name>+<alg>+<id>.key, "
-		"K<name>+<alg>+<id>.private\n");
-
-	exit (-1);
-}
-
-int
-main(int argc, char **argv) {
-	char		*algname = NULL, *nametype = NULL, *type = NULL;
-	char		*classname = NULL;
-	char		*endp;
-	dst_key_t	*key = NULL, *oldkey;
-	dns_fixedname_t	fname;
-	dns_name_t	*name;
-	isc_uint16_t	flags = 0, ksk = 0;
-	dns_secalg_t	alg;
-	isc_boolean_t	null_key = ISC_FALSE;
-	isc_mem_t	*mctx = NULL;
-	int		ch;
-	int		protocol = -1, signatory = 0;
-	isc_result_t	ret;
-	isc_textregion_t r;
-	char		filename[255];
-	isc_buffer_t	buf;
-	isc_log_t	*log = NULL;
-	isc_entropy_t	*ectx = NULL;
-	dns_rdataclass_t rdclass;
-	int		options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
-	char		*label = NULL;
-
-	if (argc == 1)
-		usage();
-
-	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
-
-	dns_result_register();
-
-	isc_commandline_errprint = ISC_FALSE;
-
-	while ((ch = isc_commandline_parse(argc, argv,
-					 "a:c:f:kl:n:p:t:v:h")) != -1)
-	{
-	    switch (ch) {
-		case 'a':
-			algname = isc_commandline_argument;
-			break;
-		case 'c':
-			classname = isc_commandline_argument;
-			break;
-		case 'f':
-			if (strcasecmp(isc_commandline_argument, "KSK") == 0)
-				ksk = DNS_KEYFLAG_KSK;
-			else
-				fatal("unknown flag '%s'",
-				      isc_commandline_argument);
-			break;
-		case 'k':
-			options |= DST_TYPE_KEY;
-			break;
-		case 'l':
-			label = isc_commandline_argument;
-			break;
-		case 'n':
-			nametype = isc_commandline_argument;
-			break;
-		case 'p':
-			protocol = strtol(isc_commandline_argument, &endp, 10);
-			if (*endp != '\0' || protocol < 0 || protocol > 255)
-				fatal("-p must be followed by a number "
-				      "[0..255]");
-			break;
-		case 't':
-			type = isc_commandline_argument;
-			break;
-		case 'v':
-			verbose = strtol(isc_commandline_argument, &endp, 0);
-			if (*endp != '\0')
-				fatal("-v must be followed by a number");
-			break;
-
-		case '?':
-			if (isc_commandline_option != '?')
-				fprintf(stderr, "%s: invalid argument -%c\n",
-					program, isc_commandline_option);
-		case 'h':
-			usage();
-
-		default:
-			fprintf(stderr, "%s: unhandled option -%c\n",
-				program, isc_commandline_option);
-			exit(1);
-		}
-	}
-
-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	ret = dst_lib_init(mctx, ectx,
-			   ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
-	if (ret != ISC_R_SUCCESS)
-		fatal("could not initialize dst");
-
-	setup_logging(verbose, mctx, &log);
-
-	if (label == NULL)
-		fatal("the key label was not specified");
-	if (argc < isc_commandline_index + 1)
-		fatal("the key name was not specified");
-	if (argc > isc_commandline_index + 1)
-		fatal("extraneous arguments");
-
-	if (algname == NULL)
-		fatal("no algorithm was specified");
-	if (strcasecmp(algname, "RSA") == 0) {
-		fprintf(stderr, "The use of RSA (RSAMD5) is not recommended.\n"
-				"If you still wish to use RSA (RSAMD5) please "
-				"specify \"-a RSAMD5\"\n");
-		return (1);
-	} else {
-		r.base = algname;
-		r.length = strlen(algname);
-		ret = dns_secalg_fromtext(&alg, &r);
-		if (ret != ISC_R_SUCCESS)
-			fatal("unknown algorithm %s", algname);
-		if (alg == DST_ALG_DH)
-			options |= DST_TYPE_KEY;
-	}
-
-	if (type != NULL && (options & DST_TYPE_KEY) != 0) {
-		if (strcasecmp(type, "NOAUTH") == 0)
-			flags |= DNS_KEYTYPE_NOAUTH;
-		else if (strcasecmp(type, "NOCONF") == 0)
-			flags |= DNS_KEYTYPE_NOCONF;
-		else if (strcasecmp(type, "NOAUTHCONF") == 0) {
-			flags |= (DNS_KEYTYPE_NOAUTH | DNS_KEYTYPE_NOCONF);
-		}
-		else if (strcasecmp(type, "AUTHCONF") == 0)
-			/* nothing */;
-		else
-			fatal("invalid type %s", type);
-	}
-
-	if (nametype == NULL) {
-		if ((options & DST_TYPE_KEY) != 0) /* KEY */
-			fatal("no nametype specified");
-		flags |= DNS_KEYOWNER_ZONE;	/* DNSKEY */
-	} else if (strcasecmp(nametype, "zone") == 0)
-		flags |= DNS_KEYOWNER_ZONE;
-	else if ((options & DST_TYPE_KEY) != 0)	{ /* KEY */
-		if (strcasecmp(nametype, "host") == 0 ||
-			 strcasecmp(nametype, "entity") == 0)
-			flags |= DNS_KEYOWNER_ENTITY;
-		else if (strcasecmp(nametype, "user") == 0)
-			flags |= DNS_KEYOWNER_USER;
-		else
-			fatal("invalid KEY nametype %s", nametype);
-	} else if (strcasecmp(nametype, "other") != 0) /* DNSKEY */
-		fatal("invalid DNSKEY nametype %s", nametype);
-
-	rdclass = strtoclass(classname);
-
-	if ((options & DST_TYPE_KEY) != 0)  /* KEY */
-		flags |= signatory;
-	else if ((flags & DNS_KEYOWNER_ZONE) != 0) /* DNSKEY */
-		flags |= ksk;
-
-	if (protocol == -1)
-		protocol = DNS_KEYPROTO_DNSSEC;
-	else if ((options & DST_TYPE_KEY) == 0 &&
-		 protocol != DNS_KEYPROTO_DNSSEC)
-		fatal("invalid DNSKEY protocol: %d", protocol);
-
-	if ((flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY) {
-		if ((flags & DNS_KEYFLAG_SIGNATORYMASK) != 0)
-			fatal("specified null key with signing authority");
-	}
-
-	if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
-	    alg == DNS_KEYALG_DH)
-		fatal("a key with algorithm '%s' cannot be a zone key",
-		      algname);
-
-	dns_fixedname_init(&fname);
-	name = dns_fixedname_name(&fname);
-	isc_buffer_init(&buf, argv[isc_commandline_index],
-			strlen(argv[isc_commandline_index]));
-	isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-	ret = dns_name_fromtext(name, &buf, dns_rootname, ISC_FALSE, NULL);
-	if (ret != ISC_R_SUCCESS)
-		fatal("invalid key name %s: %s", argv[isc_commandline_index],
-		      isc_result_totext(ret));
-
-	if ((flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY)
-		null_key = ISC_TRUE;
-
-	isc_buffer_init(&buf, filename, sizeof(filename) - 1);
-
-	/* associate the key */
-	ret = dst_key_fromlabel(name, alg, flags, protocol,
-				rdclass, "", label, NULL, mctx, &key);
-	isc_entropy_stopcallbacksources(ectx);
-
-	if (ret != ISC_R_SUCCESS) {
-		char namestr[DNS_NAME_FORMATSIZE];
-		char algstr[ALG_FORMATSIZE];
-		dns_name_format(name, namestr, sizeof(namestr));
-		alg_format(alg, algstr, sizeof(algstr));
-		fatal("failed to generate key %s/%s: %s\n",
-		      namestr, algstr, isc_result_totext(ret));
-		exit(-1);
-	}
-
-	/*
-	 * Try to read a key with the same name, alg and id from disk.
-	 * If there is one we must continue generating a new one
-	 * unless we were asked to generate a null key, in which
-	 * case we return failure.
-	 */
-	ret = dst_key_fromfile(name, dst_key_id(key), alg,
-			       DST_TYPE_PRIVATE, NULL, mctx, &oldkey);
-	/* do not overwrite an existing key  */
-	if (ret == ISC_R_SUCCESS) {
-		isc_buffer_clear(&buf);
-		ret = dst_key_buildfilename(key, 0, NULL, &buf);
-		fprintf(stderr, "%s: %s already exists\n",
-			program, filename);
-		dst_key_free(&key);
-		exit (1);
-	}
-
-	ret = dst_key_tofile(key, options, NULL);
-	if (ret != ISC_R_SUCCESS) {
-		char keystr[KEY_FORMATSIZE];
-		key_format(key, keystr, sizeof(keystr));
-		fatal("failed to write key %s: %s\n", keystr,
-		      isc_result_totext(ret));
-	}
-
-	isc_buffer_clear(&buf);
-	ret = dst_key_buildfilename(key, 0, NULL, &buf);
-	printf("%s\n", filename);
-	dst_key_free(&key);
-
-	cleanup_logging(&log);
-	cleanup_entropy(&ectx);
-	dst_lib_destroy();
-	dns_name_destroy();
-	if (verbose > 10)
-		isc_mem_stats(mctx, stdout);
-	isc_mem_destroy(&mctx);
-
-	return (0);
-}
@@ -1,265 +0,0 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
-               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
-	       [<!ENTITY mdash "&#8212;">]>
-<!--
- - Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
- -
- - Permission to use, copy, modify, and/or distribute this software for any
- - purpose with or without fee is hereby granted, provided that the above
- - copyright notice and this permission notice appear in all copies.
- -
- - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- - AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- - PERFORMANCE OF THIS SOFTWARE.
-->
-
-<!-- $Id: dnssec-keyfromlabel.docbook,v 1.3 2008/03/31 23:47:11 tbox Exp $ -->
-<refentry id="man.dnssec-keyfromlabel">
-  <refentryinfo>
-    <date>february 8, 2008</date>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle><application>dnssec-keyfromlabel</application></refentrytitle>
-    <manvolnum>8</manvolnum>
-    <refmiscinfo>BIND9</refmiscinfo>
-  </refmeta>
-
-  <refnamediv>
-    <refname><application>dnssec-keyfromlabel</application></refname>
-    <refpurpose>DNSSEC key generation tool</refpurpose>
-  </refnamediv>
-
-  <docinfo>
-    <copyright>
-      <year>2008</year>
-      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
-    </copyright>
-  </docinfo>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>dnssec-keyfromlabel</command>
-      <arg choice="req">-a <replaceable class="parameter">algorithm</replaceable></arg>
-      <arg choice="req">-l <replaceable class="parameter">label</replaceable></arg>
-      <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
-      <arg><option>-f <replaceable class="parameter">flag</replaceable></option></arg>
-      <arg><option>-k</option></arg>
-      <arg><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
-      <arg><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
-      <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>
-      <arg><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="req">name</arg>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-  <refsect1>
-    <title>DESCRIPTION</title>
-    <para><command>dnssec-keyfromlabel</command>
-      gets keys with the given label from a crypto hardware and builds
-      key files for DNSSEC (Secure DNS), as defined in RFC 2535
-      and RFC 4034.  
-    </para>
-  </refsect1>
-
-  <refsect1>
-    <title>OPTIONS</title>
-
-    <variablelist>
-      <varlistentry>
-        <term>-a <replaceable class="parameter">algorithm</replaceable></term>
-        <listitem>
-	  <para>
-	    Selects the cryptographic algorithm.  The value of
-	    <option>algorithm</option> must be one of RSAMD5 (RSA)
-	    or RSASHA1, DSA or DH (Diffie Hellman).  These values
-	    are case insensitive.
-	  </para>
-          <para>
-            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
-            algorithm, and DSA is recommended.
-          </para>
-          <para>
-            Note 2: DH automatically sets the -k flag.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-l <replaceable class="parameter">label</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the label of keys in the crypto hardware
-            (PKCS#11 device).
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-n <replaceable class="parameter">nametype</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the owner type of the key.  The value of
-            <option>nametype</option> must either be ZONE (for a DNSSEC
-            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-            a host (KEY)),
-            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-            These values are
-            case insensitive.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-c <replaceable class="parameter">class</replaceable></term>
-        <listitem>
-          <para>
-            Indicates that the DNS record containing the key should have
-            the specified class.  If not specified, class IN is used.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-f <replaceable class="parameter">flag</replaceable></term>
-        <listitem>
-          <para>
-            Set the specified flag in the flag field of the KEY/DNSKEY record.
-            The only recognized flag is KSK (Key Signing Key) DNSKEY.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-h</term>
-        <listitem>
-          <para>
-            Prints a short summary of the options and arguments to
-            <command>dnssec-keygen</command>.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-k</term>
-        <listitem>
-          <para>
-            Generate KEY records rather than DNSKEY records.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-p <replaceable class="parameter">protocol</replaceable></term>
-        <listitem>
-          <para>
-            Sets the protocol value for the generated key.  The protocol
-            is a number between 0 and 255.  The default is 3 (DNSSEC).
-            Other possible values for this argument are listed in
-            RFC 2535 and its successors.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-t <replaceable class="parameter">type</replaceable></term>
-        <listitem>
-          <para>
-            Indicates the use of the key.  <option>type</option> must be
-            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-            is AUTHCONF.  AUTH refers to the ability to authenticate
-            data, and CONF the ability to encrypt data.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-v <replaceable class="parameter">level</replaceable></term>
-        <listitem>
-          <para>
-            Sets the debugging level.
-          </para>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-  </refsect1>
-
-  <refsect1>
-    <title>GENERATED KEY FILES</title>
-    <para>
-      When <command>dnssec-keyfromlabel</command> completes
-      successfully,
-      it prints a string of the form <filename>Knnnn.+aaa+iiiii</filename>
-      to the standard output.  This is an identification string for
-      the key files it has generated.
-    </para>
-    <itemizedlist>
-      <listitem>
-        <para><filename>nnnn</filename> is the key name.
-        </para>
-      </listitem>
-      <listitem>
-        <para><filename>aaa</filename> is the numeric representation
-          of the
-          algorithm.
-        </para>
-      </listitem>
-      <listitem>
-        <para><filename>iiiii</filename> is the key identifier (or
-          footprint).
-        </para>
-      </listitem>
-    </itemizedlist>
-    <para><command>dnssec-keyfromlabel</command> 
-      creates two files, with names based
-      on the printed string.  <filename>Knnnn.+aaa+iiiii.key</filename>
-      contains the public key, and
-      <filename>Knnnn.+aaa+iiiii.private</filename> contains the
-      private
-      key.
-    </para>
-    <para>
-      The <filename>.key</filename> file contains a DNS KEY record
-      that
-      can be inserted into a zone file (directly or with a $INCLUDE
-      statement).
-    </para>
-    <para>
-      The <filename>.private</filename> file contains algorithm
-      specific
-      fields.  For obvious security reasons, this file does not have
-      general read permission.
-    </para>
-  </refsect1>
-
-  <refsect1>
-    <title>SEE ALSO</title>
-    <para><citerefentry>
-        <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
-      </citerefentry>,
-      <citerefentry>
-        <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
-      </citerefentry>,
-      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 2535</citetitle>,
-      <citetitle>RFC 2845</citetitle>,
-      <citetitle>RFC 2539</citetitle>.
-    </para>
-  </refsect1>
-
-  <refsect1>
-    <title>AUTHOR</title>
-    <para><corpauthor>Internet Systems Consortium</corpauthor>
-    </para>
-  </refsect1>
-
-</refentry><!--
- - Local variables:
- - mode: sgml
- - End:
-->
@@ -1,171 +0,0 @@
-<!--
- - Copyright (C) 2008 Internet Systems Consortium, Inc. ("ISC")
- - 
- - Permission to use, copy, modify, and distribute this software for any
- - purpose with or without fee is hereby granted, provided that the above
- - copyright notice and this permission notice appear in all copies.
- - 
- - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- - PERFORMANCE OF THIS SOFTWARE.
-->
-<!-- $Id: dnssec-keyfromlabel.html,v 1.3 2008/04/01 01:11:50 tbox Exp $ -->
-<html>
-<head>
-<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
-<title>dnssec-keyfromlabel</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
-</head>
-<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
-<div class="refnamediv">
-<h2>Name</h2>
-<p><span class="application">dnssec-keyfromlabel</span> &#8212; DNSSEC key generation tool</p>
-</div>
-<div class="refsynopsisdiv">
-<h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code>  {-a <em class="replaceable"><code>algorithm</code></em>} {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-k</code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
-</div>
-<div class="refsect1" lang="en">
-<a name="id2543413"></a><h2>DESCRIPTION</h2>
-<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
-      gets keys with the given label from a crypto hardware and builds
-      key files for DNSSEC (Secure DNS), as defined in RFC 2535
-      and RFC 4034.  
-    </p>
-</div>
-<div class="refsect1" lang="en">
-<a name="id2543425"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl>
-<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
-<dd>
-<p>
-	    Selects the cryptographic algorithm.  The value of
-	    <code class="option">algorithm</code> must be one of RSAMD5 (RSA)
-	    or RSASHA1, DSA or DH (Diffie Hellman).  These values
-	    are case insensitive.
-	  </p>
-<p>
-            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
-            algorithm, and DSA is recommended.
-          </p>
-<p>
-            Note 2: DH automatically sets the -k flag.
-          </p>
-</dd>
-<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
-<dd><p>
-            Specifies the label of keys in the crypto hardware
-            (PKCS#11 device).
-          </p></dd>
-<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
-<dd><p>
-            Specifies the owner type of the key.  The value of
-            <code class="option">nametype</code> must either be ZONE (for a DNSSEC
-            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
-            a host (KEY)),
-            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
-            These values are
-            case insensitive.
-          </p></dd>
-<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd><p>
-            Indicates that the DNS record containing the key should have
-            the specified class.  If not specified, class IN is used.
-          </p></dd>
-<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
-<dd><p>
-            Set the specified flag in the flag field of the KEY/DNSKEY record.
-            The only recognized flag is KSK (Key Signing Key) DNSKEY.
-          </p></dd>
-<dt><span class="term">-h</span></dt>
-<dd><p>
-            Prints a short summary of the options and arguments to
-            <span><strong class="command">dnssec-keygen</strong></span>.
-          </p></dd>
-<dt><span class="term">-k</span></dt>
-<dd><p>
-            Generate KEY records rather than DNSKEY records.
-          </p></dd>
-<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
-<dd><p>
-            Sets the protocol value for the generated key.  The protocol
-            is a number between 0 and 255.  The default is 3 (DNSSEC).
-            Other possible values for this argument are listed in
-            RFC 2535 and its successors.
-          </p></dd>
-<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
-<dd><p>
-            Indicates the use of the key.  <code class="option">type</code> must be
-            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
-            is AUTHCONF.  AUTH refers to the ability to authenticate
-            data, and CONF the ability to encrypt data.
-          </p></dd>
-<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd><p>
-            Sets the debugging level.
-          </p></dd>
-</dl></div>
-</div>
-<div class="refsect1" lang="en">
-<a name="id2543619"></a><h2>GENERATED KEY FILES</h2>
-<p>
-      When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes
-      successfully,
-      it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
-      to the standard output.  This is an identification string for
-      the key files it has generated.
-    </p>
-<div class="itemizedlist"><ul type="disc">
-<li><p><code class="filename">nnnn</code> is the key name.
-        </p></li>
-<li><p><code class="filename">aaa</code> is the numeric representation
-          of the
-          algorithm.
-        </p></li>
-<li><p><code class="filename">iiiii</code> is the key identifier (or
-          footprint).
-        </p></li>
-</ul></div>
-<p><span><strong class="command">dnssec-keyfromlabel</strong></span> 
-      creates two files, with names based
-      on the printed string.  <code class="filename">Knnnn.+aaa+iiiii.key</code>
-      contains the public key, and
-      <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
-      private
-      key.
-    </p>
-<p>
-      The <code class="filename">.key</code> file contains a DNS KEY record
-      that
-      can be inserted into a zone file (directly or with a $INCLUDE
-      statement).
-    </p>
-<p>
-      The <code class="filename">.private</code> file contains algorithm
-      specific
-      fields.  For obvious security reasons, this file does not have
-      general read permission.
-    </p>
-</div>
-<div class="refsect1" lang="en">
-<a name="id2543691"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
-      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 2535</em>,
-      <em class="citetitle">RFC 2845</em>,
-      <em class="citetitle">RFC 2539</em>.
-    </p>
-</div>
-<div class="refsect1" lang="en">
-<a name="id2543731"></a><h2>AUTHOR</h2>
-<p><span class="corpauthor">Internet Systems Consortium</span>
-    </p>
-</div>
-</div></body>
-</html>
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Portions Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -29,7 +29,7 @@
 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssec-signzone.c,v 1.206 2008/06/02 23:47:04 tbox Exp $ */
+/* $Id: dnssec-signzone.c,v 1.204 2007/08/28 07:20:42 tbox Exp $ */

 /*! \file */

@@ -141,6 +141,7 @@ static dns_name_t *gorigin;		/* The database origin */
 static isc_task_t *master = NULL;
 static unsigned int ntasks = 0;
 static isc_boolean_t shuttingdown = ISC_FALSE, finished = ISC_FALSE;
+static unsigned int assigned = 0, completed = 0;
 static isc_boolean_t nokeys = ISC_FALSE;
 static isc_boolean_t removefile = ISC_FALSE;
 static isc_boolean_t generateds = ISC_FALSE;
@@ -981,7 +982,7 @@ active_node(dns_dbnode_t *node) {
 			fatal("rdataset iteration failed: %s",
 			      isc_result_totext(result));
 	} else {
-		/*
+		/* 
 		 * Delete RRSIGs for types that no longer exist.
 		 */
 		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter2);
@@ -1206,7 +1207,7 @@ signapex(void) {
 	dns_fixedname_t fixed;
 	dns_name_t *name;
 	isc_result_t result;
-
+	
 	dns_fixedname_init(&fixed);
 	name = dns_fixedname_name(&fixed);
 	result = dns_dbiterator_current(gdbiter, &node, name);
@@ -1236,19 +1237,16 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	dns_rdataset_t nsec;
 	isc_boolean_t found;
 	isc_result_t result;
-	static unsigned int ended = 0;		/* Protected by namelock. */

 	if (shuttingdown)
 		return;

-	LOCK(&namelock);
 	if (finished) {
-		ended++;
-		if (ended == ntasks) {
+		if (assigned == completed) {
 			isc_task_detach(&task);
 			isc_app_shutdown();
 		}
-		goto unlock;
+		return;
 	}

 	fname = isc_mem_get(mctx, sizeof(dns_fixedname_t));
@@ -1258,6 +1256,7 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	name = dns_fixedname_name(fname);
 	node = NULL;
 	found = ISC_FALSE;
+	LOCK(&namelock);
 	while (!found) {
 		result = dns_dbiterator_current(gdbiter, &node, name);
 		if (result != ISC_R_SUCCESS)
@@ -1284,14 +1283,14 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 			fatal("failure iterating database: %s",
 			      isc_result_totext(result));
 	}
+	UNLOCK(&namelock);
 	if (!found) {
-		ended++;
-		if (ended == ntasks) {
+		if (assigned == completed) {
 			isc_task_detach(&task);
 			isc_app_shutdown();
 		}
 		isc_mem_put(mctx, fname, sizeof(dns_fixedname_t));
-		goto unlock;
+		return;
 	}
 	sevent = (sevent_t *)
 		 isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,
@@ -1302,8 +1301,7 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	sevent->node = node;
 	sevent->fname = fname;
 	isc_task_send(worker, ISC_EVENT_PTR(&sevent));
- unlock:
-	UNLOCK(&namelock);
+	assigned++;
 }

 /*%
@@ -1326,6 +1324,7 @@ writenode(isc_task_t *task, isc_event_t *event) {
 	isc_task_t *worker;
 	sevent_t *sevent = (sevent_t *)event;

+	completed++;
 	worker = (isc_task_t *)event->ev_sender;
 	dumpnode(dns_fixedname_name(sevent->fname), sevent->node);
 	cleannode(gdb, gversion, sevent->node);
@@ -1619,7 +1618,7 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
 	unsigned char keybuf[DST_KEY_MAXSIZE];
 	unsigned int filenamelen;
-	const dns_master_style_t *style =
+	const dns_master_style_t *style = 
 		(type == dns_rdatatype_dnskey) ? masterstyle : dsstyle;

 	isc_buffer_init(&namebuf, namestr, sizeof(namestr));
@@ -1832,13 +1831,13 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish) {
 	printf("Signatures successfully verified:   %10d\n", nverified);
 	printf("Signatures unsuccessfully verified: %10d\n", nverifyfailed);
 	runtime_ms = runtime_us / 1000;
-	printf("Runtime in seconds:                %7u.%03u\n",
-	       (unsigned int) (runtime_ms / 1000),
+	printf("Runtime in seconds:                %7u.%03u\n", 
+	       (unsigned int) (runtime_ms / 1000), 
 	       (unsigned int) (runtime_ms % 1000));
 	if (runtime_us > 0) {
 		sig_ms = ((isc_uint64_t)nsigned * 1000000000) / runtime_us;
 		printf("Signatures per second:             %7u.%03u\n",
-		       (unsigned int) sig_ms / 1000,
+		       (unsigned int) sig_ms / 1000, 
 		       (unsigned int) sig_ms % 1000);
 	}
 }
@@ -1938,7 +1937,7 @@ main(int argc, char *argv[]) {
 				fatal("jitter must be numeric and positive");
 			break;

-		case 'l':
+		case 'l': 
 			dns_fixedname_init(&dlv_fixed);
 			len = strlen(isc_commandline_argument);
 			isc_buffer_init(&b, isc_commandline_argument, len);
@@ -2104,7 +2103,7 @@ main(int argc, char *argv[]) {
 	result = dns_master_stylecreate(&dsstyle,  DNS_STYLEFLAG_NO_TTL,
 					0, 24, 0, 0, 0, 8, mctx);
 	check_result(result, "dns_master_stylecreate");
-
+					

 	gdb = NULL;
 	TIME_NOW(&timer_start);
@@ -2126,8 +2125,8 @@ main(int argc, char *argv[]) {
 						       DST_TYPE_PRIVATE,
 						       mctx, &newkey);
 			if (result != ISC_R_SUCCESS)
-				fatal("cannot load dnskey %s: %s", argv[i],
-				      isc_result_totext(result));
+				fatal("cannot load dnskey %s: %s", argv[i], 
+				      isc_result_totext(result)); 

 			key = ISC_LIST_HEAD(keylist);
 			while (key != NULL) {
@@ -2135,7 +2134,7 @@ main(int argc, char *argv[]) {
 				if (dst_key_id(dkey) == dst_key_id(newkey) &&
 				    dst_key_alg(dkey) == dst_key_alg(newkey) &&
 				    dns_name_equal(dst_key_name(dkey),
-						   dst_key_name(newkey)))
+					    	   dst_key_name(newkey)))
 				{
 					if (!dst_key_isprivate(dkey))
 						fatal("cannot sign zone with "
@@ -2164,7 +2163,7 @@ main(int argc, char *argv[]) {
 					       mctx, &newkey);
 		if (result != ISC_R_SUCCESS)
 			fatal("cannot load dnskey %s: %s", dskeyfile[i],
-			      isc_result_totext(result));
+			      isc_result_totext(result)); 

 		key = ISC_LIST_HEAD(keylist);
 		while (key != NULL) {
@@ -2172,7 +2171,7 @@ main(int argc, char *argv[]) {
 			if (dst_key_id(dkey) == dst_key_id(newkey) &&
 			    dst_key_alg(dkey) == dst_key_alg(newkey) &&
 			    dns_name_equal(dst_key_name(dkey),
-					   dst_key_name(newkey)))
+				    	   dst_key_name(newkey)))
 			{
 				/* Override key flags. */
 				key->issigningkey = ISC_TRUE;
@@ -4,3 +4,4 @@ Makefile
 *.lo
 named
 lwresd
+bind9.xsl.h
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: Makefile.in,v 1.100 2008/03/31 05:00:29 marka Exp $
+# $Id: Makefile.in,v 1.96 2007/06/19 06:49:18 marka Exp $

 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -75,7 +75,7 @@ TARGETS =	named@EXEEXT@ lwresd@EXEEXT@
 OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \
 		controlconf.@O@ interfacemgr.@O@ \
 		listenlist.@O@ log.@O@ logconf.@O@ main.@O@ notify.@O@ \
-		query.@O@ server.@O@ sortlist.@O@ statschannel.@O@ \
+		query.@O@ server.@O@ sortlist.@O@ \
 		tkeyconf.@O@ tsigconf.@O@ update.@O@ xfrout.@O@ \
 		zoneconf.@O@ \
 		lwaddr.@O@ lwresd.@O@ lwdclient.@O@ lwderror.@O@ lwdgabn.@O@ \
@@ -84,10 +84,12 @@ OBJS =		builtin.@O@ client.@O@ config.@O@ control.@O@ \

 UOBJS =		unix/os.@O@

+GENERATED =	bind9.xsl.h
+
 SRCS =		builtin.c client.c config.c control.c \
 		controlconf.c interfacemgr.c \
 		listenlist.c log.c logconf.c main.c notify.c \
-		query.c server.c sortlist.c statschannel.c \
+		query.c server.c sortlist.c \
 		tkeyconf.c tsigconf.c update.c xfrout.c \
 		zoneconf.c \
 		lwaddr.c lwresd.c lwdclient.c lwderror.c lwdgabn.c \
@@ -128,13 +130,13 @@ docclean manclean maintainer-clean::
 	rm -f ${MANOBJS}

 clean distclean maintainer-clean::
-	rm -f ${TARGETS} ${OBJS}
+	rm -f ${TARGETS} ${OBJS} ${GENERATED}

 bind9.xsl.h: bind9.xsl convertxsl.pl
 	${PERL} ${srcdir}/convertxsl.pl < ${srcdir}/bind9.xsl > bind9.xsl.h

 depend: bind9.xsl.h
-statschannel.@O@: bind9.xsl.h
+server.@O@: bind9.xsl.h

 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sbindir}
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
- - Copyright (C) 2006-2008  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: bind9.xsl,v 1.17 2008/04/09 22:48:17 jinmei Exp $ -->
+<!-- $Id: bind9.xsl,v 1.13 2007/06/18 23:47:18 tbox Exp $ -->

 <xsl:stylesheet version="1.0"
   xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
@@ -55,11 +55,6 @@ tr.lrow {
 	color: #ffffff;
 }

-td, th {
-	padding-right: 5px;
-	padding-left: 5px;
-}
-
 .header {
 	background-color: teal;
 	color: #ffffff;
@@ -104,293 +99,21 @@ td, th {
 	<br/>

 	<table>
-	  <tr class="rowh"><th colspan="2">Incoming Requests</th></tr>
-	  <xsl:for-each select="server/requests/opcode">
+	  <tr class="rowh"><th colspan="2">Server statistics</th></tr>
+	  <xsl:for-each select="server/counters/*">
 	    <tr class="lrow">
-	      <td><xsl:value-of select="name"/></td>
-	      <td><xsl:value-of select="counter"/></td>
+	      <td><xsl:value-of select="name()"/></td>
+	      <td><xsl:value-of select="."/></td>
 	    </tr>
 	  </xsl:for-each>
 	</table>

-	<br/>
-
-	<table>
-	  <tr class="rowh"><th colspan="2">Incoming Queries</th></tr>
-	  <xsl:for-each select="server/queries-in/rdtype">
-	    <tr class="lrow">
-	      <td><xsl:value-of select="name"/></td>
-	      <td><xsl:value-of select="counter"/></td>
-	    </tr>
-	  </xsl:for-each>
-	</table>
-
-	<br/>
-
-	<xsl:for-each select="views/view">
-	  <table>
-	    <tr class="rowh">
-	      <th colspan="2">Outgoing Queries from View <xsl:value-of select="name"/></th>
-	    </tr>
-	    <xsl:for-each select="rdtype">
-	      <tr class="lrow">
-		<td><xsl:value-of select="name"/></td>
-		<td><xsl:value-of select="counter"/></td>
-	      </tr>
-	    </xsl:for-each>
-	  </table>
-	  <br/>
-	</xsl:for-each>
-
-	<br/>
-
-	<table>
-	  <tr class="rowh"><th colspan="10">Server Statistics</th></tr>
-          <tr class="rowh">
-	    <!-- The ordering of the following items must be consistent
-	    with dns_nsstatscounter_xxx -->
-	    <th>Requestv4</th>
-	    <th>Requestv6</th>
-	    <th>ReqEdns0</th>
-	    <th>ReqBadEDNSVer</th>
-	    <th>ReqTSIG</th>
-	    <th>ReqSIG0</th>
-	    <th>ReqBadSIG</th>
-	    <th>ReqTCP</th>
-	    <th>AuthQryRej</th>
-	    <th>RecQryRej</th>
-	  </tr>
-	  <tr class="lrow">
-	    <td><xsl:value-of select="server/nsstats/Requestv4"/></td>
-	    <td><xsl:value-of select="server/nsstats/Requestv6"/></td>
-	    <td><xsl:value-of select="server/nsstats/ReqEdns0"/></td>
-	    <td><xsl:value-of select="server/nsstats/ReqBadEDNSVer"/></td>
-	    <td><xsl:value-of select="server/nsstats/ReqTSIG"/></td>
-	    <td><xsl:value-of select="server/nsstats/ReqSIG0"/></td>
-	    <td><xsl:value-of select="server/nsstats/ReqBadSIG"/></td>
-	    <td><xsl:value-of select="server/nsstats/ReqTCP"/></td>
-	    <td><xsl:value-of select="server/nsstats/AuthQryRej"/></td>
-	    <td><xsl:value-of select="server/nsstats/RecQryRej"/></td>
-	  </tr>
-          <tr class="rowh">
-	    <th>XfrRej</th>
-	    <th>UpdateRej</th>
-	    <th>Response</th>
-	    <th>RespTruncated</th>
-	    <th>RespEDNS0</th>
-	    <th>RespTSIG</th>
-	    <th>RespSIG0</th>
-	    <th>QrySuccess</th>
-	    <th>QryAuthAns</th>
-	    <th>QryNoauthAns</th>
-	  </tr>
-	  <tr class="lrow">
-	    <td><xsl:value-of select="server/nsstats/XfrRej"/></td>
-	    <td><xsl:value-of select="server/nsstats/UpdateRej"/></td>
-	    <td><xsl:value-of select="server/nsstats/Response"/></td>
-	    <td><xsl:value-of select="server/nsstats/TruncatedResp"/></td>
-	    <td><xsl:value-of select="server/nsstats/RespEDNS0"/></td>
-	    <td><xsl:value-of select="server/nsstats/RespTSIG"/></td>
-	    <td><xsl:value-of select="server/nsstats/RespSIG0"/></td>
-	    <td><xsl:value-of select="server/nsstats/QrySuccess"/></td>
-	    <td><xsl:value-of select="server/nsstats/QryAuthAns"/></td>
-	    <td><xsl:value-of select="server/nsstats/QryNoauthAns"/></td>
-	  </tr>
-          <tr class="rowh">
-	    <th>QryReferral</th>
-	    <th>QryNxrrset</th>
-	    <th>QrySERVFAIL</th>
-	    <th>QryFORMERR</th>
-	    <th>QryNXDOMAIN</th>
-	    <th>QryRecursion</th>
-	    <th>QryDuplicate</th>
-	    <th>QryDropped</th>
-	    <th>QryFailure</th>
-	    <th>XfrReqDone</th>
-	  </tr>
-	  <tr class="lrow">
-	    <td><xsl:value-of select="server/nsstats/QryReferral"/></td>
-	    <td><xsl:value-of select="server/nsstats/QryNxrrset"/></td>
-	    <td><xsl:value-of select="server/nsstats/QrySERVFAIL"/></td>
-	    <td><xsl:value-of select="server/nsstats/QryFORMERR"/></td>
-	    <td><xsl:value-of select="server/nsstats/QryNXDOMAIN"/></td>
-	    <td><xsl:value-of select="server/nsstats/QryRecursion"/></td>
-	    <td><xsl:value-of select="server/nsstats/QryDuplicate"/></td>
-	    <td><xsl:value-of select="server/nsstats/QryDropped"/></td>
-	    <td><xsl:value-of select="server/nsstats/QryFailure"/></td>
-	    <td><xsl:value-of select="server/nsstats/XfrReqDone"/></td>
-	  </tr>
-          <tr class="rowh">
-	    <th>UpdateReqFwd</th>
-	    <th>UpdateRespFwd</th>
-	    <th>UpdateFwdFail</th>
-	    <th>UpdateDone</th>
-	    <th>UpdateFail</th>
-	    <th>UpdateBadPrereq</th>
-	    <th>RespMismatch</th>
-	    <th />
-	    <th />
-	    <th />
-	  </tr>
-	  <tr class="lrow">
-	    <td><xsl:value-of select="server/nsstats/UpdateReqFwd"/></td>
-	    <td><xsl:value-of select="server/nsstats/UpdateRespFwd"/></td>
-	    <td><xsl:value-of select="server/nsstats/UpdateFwdFail"/></td>
-	    <td><xsl:value-of select="server/nsstats/UpdateDone"/></td>
-	    <td><xsl:value-of select="server/nsstats/UpdateFail"/></td>
-	    <td><xsl:value-of select="server/nsstats/UpdateBadPrereq"/></td>
-	    <td><xsl:value-of select="server/resstats/Mismatch"/></td>
-	    <td />
-	    <td />
-	    <td />
-	  </tr>
-	</table>
-
-	<br/>
-
-	<table>
-	  <tr class="rowh"><th colspan="10">Zone Maintenance Statistics</th></tr>
-          <tr class="rowh">
-	    <!-- The ordering of the following items must be consistent
-	    with dns_zonestatscounter_xxx -->
-	    <th>NotifyOutv4</th>
-	    <th>NotifyOutv6</th>
-	    <th>NotifyInv4</th>
-	    <th>NotifyInv6</th>
-	    <th>NotifyRej</th>
-	    <th>SOAOutv4</th>
-	    <th>SOAOutv6</th>
-	    <th>AXFRReqv4</th>
-	    <th>AXFRReqv6</th>
-	    <th>IXFRReqv4</th>
-	  </tr>
-	  <tr class="lrow">
-	    <td><xsl:value-of select="server/zonestats/NotifyOutv4"/></td>
-	    <td><xsl:value-of select="server/zonestats/NotifyOutv6"/></td>
-	    <td><xsl:value-of select="server/zonestats/NotifyInv4"/></td>
-	    <td><xsl:value-of select="server/zonestats/NotifyInv6"/></td>
-	    <td><xsl:value-of select="server/zonestats/NotifyRej"/></td>
-	    <td><xsl:value-of select="server/zonestats/SOAOutv4"/></td>
-	    <td><xsl:value-of select="server/zonestats/SOAOutv6"/></td>
-	    <td><xsl:value-of select="server/zonestats/AXFRReqv4"/></td>
-	    <td><xsl:value-of select="server/zonestats/AXFRReqv6"/></td>
-	    <td><xsl:value-of select="server/zonestats/IXFRReqv4"/></td>
-	  </tr>
-	  <tr class="rowh">
-	    <th>IXFRReqv6</th>
-	    <th>XfrSuccess</th>
-	    <th>XfrFail</th>
-	    <th/>
-	    <th/>
-	    <th/>
-	    <th/>
-	    <th/>
-	    <th/>
-	    <th/>
-	  </tr>
-	  <tr class="lrow">
-	    <td><xsl:value-of select="server/zonestats/IXFRReqv6"/></td>
-	    <td><xsl:value-of select="server/zonestats/XfrSuccess"/></td>
-	    <td><xsl:value-of select="server/zonestats/XfrFail"/></td>
-	    <td/>
-	    <td/>
-	    <td/>
-	    <td/>
-	    <td/>
-	    <td/>
-	    <td/>
-	  </tr>
-	</table>
-
-	<br/>
-
-	<xsl:for-each select="views/view">
-	  <table>
-	    <tr class="rowh">
-	      <th colspan="10">Resolver Statistics for View <xsl:value-of select="name"/></th>
-	    </tr>
-	    <tr class="rowh">
-	    <!-- The ordering of the following items must be consistent
-	    with dns_resstatscounter_xxx -->
-	      <th>Queryv4</th>
-	      <th>Queryv6</th>
-	      <th>Responsev4</th>
-	      <th>Responsev6</th>
-	      <th>NXDOMAIN</th>
-	      <th>SERVFAIL</th>
-	      <th>FORMERR</th>
-	      <th>OtherError</th>
-	      <th>EDNS0Fail</th>
-	      <!-- this counter is not applicable to per-view stat,
-	      but keep it for generating the description table used in
-	      the statschannel.c.
-		  <th>Mismatch</th>  -->
-	      <th>Truncated</th>
-	    </tr>
-	    <tr class="lrow">
-	      <td><xsl:value-of select="resstats/Queryv4"/></td>
-	      <td><xsl:value-of select="resstats/Queryv6"/></td>
-	      <td><xsl:value-of select="resstats/Responsev4"/></td>
-	      <td><xsl:value-of select="resstats/Responsev6"/></td>
-	      <td><xsl:value-of select="resstats/NXDOMAIN"/></td>
-	      <td><xsl:value-of select="resstats/SERVFAIL"/></td>
-	      <td><xsl:value-of select="resstats/FORMERR"/></td>
-	      <td><xsl:value-of select="resstats/OtherError"/></td>
-	      <td><xsl:value-of select="resstats/EDNS0Fail"/></td>
-	      <!--  <td><xsl:value-of select="resstats/Mismatch"/></td>  -->
-	      <td><xsl:value-of select="resstats/Truncated"/></td>
-	    </tr>
-	    <tr class="rowh">
-	      <th>Lame</th>
-	      <th>Retry</th>
-	      <th>GlueFetchv4</th>
-	      <th>GlueFetchv6</th>
-	      <th>GlueFetchv4Fail</th>
-	      <th>GlueFetchv6Fail</th>
-	      <th>ValAttempt</th>
-	      <th>ValOk</th>
-	      <th>ValNegOk</th>
-	      <th>ValFail</th>
-	    </tr>
-	    <tr class="lrow">
-	      <td><xsl:value-of select="resstats/Lame"/></td>
-	      <td><xsl:value-of select="resstats/Retry"/></td>
-	      <td><xsl:value-of select="resstats/GlueFetchv4"/></td>
-	      <td><xsl:value-of select="resstats/GlueFetchv6"/></td>
-	      <td><xsl:value-of select="resstats/GlueFetchv4Fail"/></td>
-	      <td><xsl:value-of select="resstats/GlueFetchv6Fail"/></td>
-	      <td><xsl:value-of select="resstats/ValAttempt"/></td>
-	      <td><xsl:value-of select="resstats/ValOk"/></td>
-	      <td><xsl:value-of select="resstats/ValNegOk"/></td>
-	      <td><xsl:value-of select="resstats/ValFail"/></td>
-	    </tr>
-          </table>
-	  <br/>
-        </xsl:for-each>
-
-	<br/>
-
-	<xsl:for-each select="views/view">
-	  <table>
-	    <tr class="rowh">
-	      <th colspan="2">Cache DB RRsets for View <xsl:value-of select="name"/></th>
-	    </tr>
-	    <xsl:for-each select="cache/rrset">
-	      <tr class="lrow">
-		<td><xsl:value-of select="name"/></td>
-		<td><xsl:value-of select="counter"/></td>
-	      </tr>
-	    </xsl:for-each>
-	  </table>
-	  <br/>
-	</xsl:for-each>
-
-	<br/>
+	<br/>	

        <xsl:for-each select="views/view">
          <table>
            <tr class="rowh">
-              <th colspan="10">Zones for View <xsl:value-of select="name"/></th>
+              <th colspan="11">Zones for View <xsl:value-of select="name"/></th>
            </tr>
            <tr class="rowh">
              <th>Name</th>
@@ -400,9 +123,10 @@ td, th {
              <th>Referral</th>
              <th>NXRRSET</th>
              <th>NXDOMAIN</th>
+              <th>Recursion</th>
              <th>Failure</th>
-	      <th>XfrReqDone</th>
-	      <th>XfrRej</th>
+              <th>Duplicate</th>
+              <th>Dropped</th>
            </tr>
            <xsl:for-each select="zones/zone">
              <tr class="lrow">
@@ -416,25 +140,28 @@ td, th {
                  <xsl:value-of select="serial"/>
                </td>
                <td>
-                  <xsl:value-of select="counters/QrySuccess"/>
+                  <xsl:value-of select="counters/success"/>
                </td>
                <td>
-                  <xsl:value-of select="counters/QryReferral"/>
+                  <xsl:value-of select="counters/referral"/>
                </td>
                <td>
-                  <xsl:value-of select="counters/QryNxrrset"/>
+                  <xsl:value-of select="counters/nxrrset"/>
                </td>
                <td>
-                  <xsl:value-of select="counters/QryNXDOMAIN"/>
+                  <xsl:value-of select="counters/nxdomain"/>
                </td>
                <td>
-                  <xsl:value-of select="counters/QryFailure"/>
+                  <xsl:value-of select="counters/recursion"/>
                </td>
                <td>
-                  <xsl:value-of select="counters/XfrReqDone"/>
+                  <xsl:value-of select="counters/failure"/>
                </td>
                <td>
-                  <xsl:value-of select="counters/XfrRej"/>
+                  <xsl:value-of select="counters/duplicate"/>
+                </td>
+                <td>
+                  <xsl:value-of select="counters/dropped"/>
                </td>
              </tr>
            </xsl:for-each>
@@ -547,70 +274,6 @@ td, th {
            </tr>
          </xsl:for-each>
        </table>
-	<br />
-	<table>
-          <tr class="rowh">
-            <th colspan="4">Memory Usage Summary</th>
-          </tr>
-	  <xsl:for-each select="memory/summary/*">
-	    <tr class="lrow">
-	      <td><xsl:value-of select="name()"/></td>
-	      <td><xsl:value-of select="."/></td>
-	    </tr>
-	  </xsl:for-each>
-	</table>
-	<br />
-	<table>
-          <tr class="rowh">
-            <th colspan="10">Memory Contexts</th>
-          </tr>
-	  <tr class="rowh">
-	    <th>ID</th>
-	    <th>Name</th>
-	    <th>References</th>
-	    <th>TotalUse</th>
-	    <th>InUse</th>
-	    <th>MaxUse</th>
-	    <th>BlockSize</th>
-	    <th>Pools</th>
-	    <th>HiWater</th>
-	    <th>LoWater</th>
-	  </tr>
-	  <xsl:for-each select="memory/contexts/context">
-	    <tr class="lrow">
-	      <td>
-		<xsl:value-of select="id"/>
-	      </td>
-              <td>
-                <xsl:value-of select="name"/>
-              </td>
-	      <td>
-		<xsl:value-of select="references"/>
-	      </td>
-	      <td>
-		<xsl:value-of select="total"/>
-	      </td>
-	      <td>
-		<xsl:value-of select="inuse"/>
-	      </td>
-	      <td>
-		<xsl:value-of select="maxinuse"/>
-	      </td>
-	      <td>
-		<xsl:value-of select="blocksize"/>
-	      </td>
-	      <td>
-		<xsl:value-of select="pools"/>
-	      </td>
-	      <td>
-		<xsl:value-of select="hiwater"/>
-	      </td>
-	      <td>
-		<xsl:value-of select="lowater"/>
-	      </td>
-	    </tr>
-	  </xsl:for-each>
-	</table>

      </body>
    </html>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: client.c,v 1.257 2008/04/03 06:09:04 tbox Exp $ */
+/* $Id: client.c,v 1.250 2007/11/26 04:47:17 marka Exp $ */

 #include <config.h>

@@ -41,7 +41,6 @@
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 #include <dns/resolver.h>
-#include <dns/stats.h>
 #include <dns/tsig.h>
 #include <dns/view.h>
 #include <dns/zone.h>
@@ -49,7 +48,6 @@
 #include <named/interfacemgr.h>
 #include <named/log.h>
 #include <named/notify.h>
-#include <named/os.h>
 #include <named/server.h>
 #include <named/update.h>

@@ -134,7 +132,7 @@ struct ns_clientmgr {
 #define MANAGER_MAGIC			ISC_MAGIC('N', 'S', 'C', 'm')
 #define VALID_MANAGER(m)		ISC_MAGIC_VALID(m, MANAGER_MAGIC)

-/*!
+/*! 
 * Client object states.  Ordering is significant: higher-numbered
 * states are generally "more active", meaning that the client can
 * have more dynamically allocated data, outstanding events, etc.
@@ -288,7 +286,7 @@ exit_check(ns_client_t *client) {
 	 *
 	 * Keep the view attached until any outstanding updates complete.
 	 */
-	if (client->nupdates == 0 &&
+	if (client->nupdates == 0 && 
 	    client->newstate == NS_CLIENTSTATE_FREED && client->view != NULL)
 		dns_view_detach(&client->view);

@@ -465,8 +463,6 @@ exit_check(ns_client_t *client) {

 		if (client->state == client->newstate) {
 			client->newstate = NS_CLIENTSTATE_MAX;
-			if (client->needshutdown)
-				isc_task_shutdown(client->task);
 			goto unlock;
 		}
 	}
@@ -523,14 +519,6 @@ exit_check(ns_client_t *client) {

 		CTRACE("free");
 		client->magic = 0;
-		/*
-		 * Check that there are no other external references to
-		 * the memory context.
-		 */
-		if (ns_g_clienttest && isc_mem_references(client->mctx) != 1) {
-			isc_mem_stats(client->mctx, stderr);
-			INSIST(0);
-		}
 		isc_mem_putanddetach(&client->mctx, client, sizeof(*client));

 		goto unlock;
@@ -604,7 +592,6 @@ client_shutdown(isc_task_t *task, isc_event_t *event) {
 	}

 	client->newstate = NS_CLIENTSTATE_FREED;
-	client->needshutdown = ISC_FALSE;
 	(void)exit_check(client);
 }

@@ -657,7 +644,7 @@ ns_client_checkactive(ns_client_t *client) {
 		 * keep it active to make up for the shortage.
 		 */
 		isc_boolean_t need_another_client = ISC_FALSE;
-		if (TCP_CLIENT(client) && !ns_g_clienttest) {
+		if (TCP_CLIENT(client)) {
 			LOCK(&client->interface->lock);
 			if (client->interface->ntcpcurrent <
 			    client->interface->ntcptarget)
@@ -847,7 +834,7 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 	isc_buffer_usedregion(buffer, &r);

 	CTRACE("sendto");
-
+	
 	result = isc_socket_sendto2(socket, &r, client->task,
 				    address, pktinfo,
 				    client->sendevent, sockflags);
@@ -919,7 +906,6 @@ ns_client_send(ns_client_t *client) {
 	unsigned char sendbuf[SEND_BUFFER_SIZE];
 	unsigned int dnssec_opts;
 	unsigned int preferred_glue;
-	isc_boolean_t opt_included = ISC_FALSE;

 	REQUIRE(NS_CLIENT_VALID(client));

@@ -957,10 +943,11 @@ ns_client_send(ns_client_t *client) {
 	result = dns_message_renderbegin(client->message, &cctx, &buffer);
 	if (result != ISC_R_SUCCESS)
 		goto done;
-
 	if (client->opt != NULL) {
 		result = dns_message_setopt(client->message, client->opt);
-		opt_included = ISC_TRUE;
+		/*
+		 * XXXRTH dns_message_setopt() should probably do this...
+		 */
 		client->opt = NULL;
 		if (result != ISC_R_SUCCESS)
 			goto done;
@@ -1016,26 +1003,6 @@ ns_client_send(ns_client_t *client) {
 		result = client_sendpkg(client, &tcpbuffer);
 	} else
 		result = client_sendpkg(client, &buffer);
-
-	/* update statistics (XXXJT: is it okay to access message->xxxkey?) */
-	dns_generalstats_increment(ns_g_server->nsstats,
-				   dns_nsstatscounter_response);
-	if (opt_included) {
-		dns_generalstats_increment(ns_g_server->nsstats,
-					   dns_nsstatscounter_edns0out);
-	}
-	if (client->message->tsigkey != NULL) {
-		dns_generalstats_increment(ns_g_server->nsstats,
-					   dns_nsstatscounter_tsigout);
-	}
-	if (client->message->sig0key != NULL) {
-		dns_generalstats_increment(ns_g_server->nsstats,
-					   dns_nsstatscounter_sig0out);
-	}
-	if ((client->message->flags & DNS_MESSAGEFLAG_TC) != 0)
-		dns_generalstats_increment(ns_g_server->nsstats,
-					   dns_nsstatscounter_truncatedresp);
-
 	if (result == ISC_R_SUCCESS)
 		return;

@@ -1141,8 +1108,8 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 	/*
 	 * FORMERR loop avoidance:  If we sent a FORMERR message
 	 * with the same ID to the same client less than two
-	 * seconds ago, assume that we are in an infinite error
-	 * packet dialog with a server for some protocol whose
+	 * seconds ago, assume that we are in an infinite error 
+	 * packet dialog with a server for some protocol whose 
 	 * error responses look enough like DNS queries to
 	 * elicit a FORMERR response.  Drop a packet to break
 	 * the loop.
@@ -1212,46 +1179,11 @@ client_addopt(ns_client_t *client) {
 	 */
 	rdatalist->ttl = (client->extflags & DNS_MESSAGEEXTFLAG_REPLYPRESERVE);

-	/* Set EDNS options if applicable */
-	if (client->attributes & NS_CLIENTATTR_WANTNSID &&
-	    (ns_g_server->server_id != NULL ||
-	     ns_g_server->server_usehostname)) {
-		/*
-		 * Space required for NSID data:
-		 *   2 bytes for opt code
-		 * + 2 bytes for NSID length
-		 * + NSID itself
-		 */
-		char nsid[BUFSIZ];
-		isc_buffer_t *buffer = NULL;
-
-		if (ns_g_server->server_usehostname) {
-			isc_result_t result;
-			result = ns_os_gethostname(nsid, sizeof(nsid));
-			if (result != ISC_R_SUCCESS) {
-				goto no_nsid;
-			}
-		} else {
-			strncpy(nsid, ns_g_server->server_id, sizeof(nsid));
-		}
-
-		rdata->length = strlen(nsid) + 4;
-		result = isc_buffer_allocate(client->mctx, &buffer,
-					     rdata->length);
-		if (result != ISC_R_SUCCESS)
-			goto no_nsid;
-
-		isc_buffer_putuint16(buffer, DNS_OPT_NSID);
-		isc_buffer_putuint16(buffer, strlen(nsid));
-		isc_buffer_putstr(buffer, nsid);
-		rdata->data = buffer->base;
-		dns_message_takebuffer(client->message, &buffer);
-	} else {
-no_nsid:
-		rdata->data = NULL;
-		rdata->length = 0;
-	}
-
+	/*
+	 * No EDNS options in the default case.
+	 */
+	rdata->data = NULL;
+	rdata->length = 0;
 	rdata->rdclass = rdatalist->rdclass;
 	rdata->type = rdatalist->type;
 	rdata->flags = 0;
@@ -1352,7 +1284,6 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	isc_buffer_t tbuffer;
 	dns_view_t *view;
 	dns_rdataset_t *opt;
-	dns_name_t *signame;
 	isc_boolean_t ra;	/* Recursion available. */
 	isc_netaddr_t netaddr;
 	isc_netaddr_t destaddr;
@@ -1360,8 +1291,6 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	dns_messageid_t id;
 	unsigned int flags;
 	isc_boolean_t notimp;
-	dns_rdata_t rdata;
-	isc_uint16_t optcode;

 	REQUIRE(event != NULL);
 	client = event->ev_arg;
@@ -1510,20 +1439,6 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		}
 	}

-	/*
-	 * Update some statistics counters.  Don't count responses.
-	 */
-	if (isc_sockaddr_pf(&client->peeraddr) == PF_INET) {
-		dns_generalstats_increment(ns_g_server->nsstats,
-					   dns_nsstatscounter_requestv4);
-	} else {
-		dns_generalstats_increment(ns_g_server->nsstats,
-					   dns_nsstatscounter_requestv6);
-	}
-	if (TCP_CLIENT(client))
-		dns_generalstats_increment(ns_g_server->nsstats,
-					   dns_nsstatscounter_tcp);
-
 	/*
 	 * Hash the incoming request here as it is after
 	 * dns_dispatch_importrecv().
@@ -1545,8 +1460,6 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		goto cleanup;
 	}

-	dns_opcodestats_increment(ns_g_server->opcodestats,
-				  client->message->opcode);
 	switch (client->message->opcode) {
 	case dns_opcode_query:
 	case dns_opcode_update:
@@ -1594,35 +1507,12 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		 */
 		client->ednsversion = (opt->ttl & 0x00FF0000) >> 16;
 		if (client->ednsversion > 0) {
-			dns_generalstats_increment(ns_g_server->nsstats,
-						dns_nsstatscounter_badednsver);
 			result = client_addopt(client);
 			if (result == ISC_R_SUCCESS)
 				result = DNS_R_BADVERS;
 			ns_client_error(client, result);
 			goto cleanup;
 		}
-
-		/* Check for NSID request */
-		result = dns_rdataset_first(opt);
-		if (result == ISC_R_SUCCESS) {
-			dns_rdata_init(&rdata);
-			dns_rdataset_current(opt, &rdata);
-			if (rdata.length >= 2) {
-				isc_buffer_t nsidbuf;
-				isc_buffer_init(&nsidbuf,
-						rdata.data, rdata.length);
-				isc_buffer_add(&nsidbuf, rdata.length);
-				optcode = isc_buffer_getuint16(&nsidbuf);
-				if (optcode == DNS_OPT_NSID)
-					client->attributes |=
-						NS_CLIENTATTR_WANTNSID;
-			}
-		}
-
-		dns_generalstats_increment(ns_g_server->nsstats,
-					   dns_nsstatscounter_edns0in);
-
 		/*
 		 * Create an OPT for our reply.
 		 */
@@ -1652,7 +1542,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	 * For IPv6 UDP queries, we get this from the pktinfo structure (if
 	 * supported).
 	 * If all the attempts fail (this can happen due to memory shortage,
-	 * etc), we regard this as an error for safety.
+	 * etc), we regard this as an error for safety. 
 	 */
 	if ((client->interface->flags & NS_INTERFACEFLAG_ANYADDR) == 0)
 		isc_netaddr_fromsockaddr(&destaddr, &client->interface->addr);
@@ -1767,17 +1657,6 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	client->signer = NULL;
 	dns_name_init(&client->signername, NULL);
 	result = dns_message_signer(client->message, &client->signername);
-	if (result != ISC_R_NOTFOUND) {
-		signame = NULL;
-		if (dns_message_gettsig(client->message, &signame) != NULL) {
-			dns_generalstats_increment(ns_g_server->nsstats,
-						   dns_nsstatscounter_tsigin);
-		} else {
-			dns_generalstats_increment(ns_g_server->nsstats,
-						   dns_nsstatscounter_sig0in);
-		}
-
-	}
 	if (result == ISC_R_SUCCESS) {
 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
@@ -1794,17 +1673,15 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	} else {
 		char tsigrcode[64];
 		isc_buffer_t b;
+		dns_name_t *name = NULL;
 		dns_rcode_t status;
 		isc_result_t tresult;

 		/* There is a signature, but it is bad. */
-		dns_generalstats_increment(ns_g_server->nsstats,
-					   dns_nsstatscounter_invalidsig);
-		signame = NULL;
-		if (dns_message_gettsig(client->message, &signame) != NULL) {
+		if (dns_message_gettsig(client->message, &name) != NULL) {
 			char namebuf[DNS_NAME_FORMATSIZE];
 			char cnamebuf[DNS_NAME_FORMATSIZE];
-			dns_name_format(signame, namebuf, sizeof(namebuf));
+			dns_name_format(name, namebuf, sizeof(namebuf));
 			status = client->message->tsigstatus;
 			isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
 			tresult = dns_tsigrcode_totext(status, &b);
@@ -1960,17 +1837,13 @@ client_timeout(isc_task_t *task, isc_event_t *event) {
 static isc_result_t
 get_clientmctx(ns_clientmgr_t *manager, isc_mem_t **mctxp) {
 	isc_mem_t *clientmctx;
+#if NMCTXS > 0
 	isc_result_t result;
+#endif

 	/*
 	 * Caller must be holding the manager lock.
 	 */
-	if (ns_g_clienttest) {
-		result = isc_mem_create(0, 0, mctxp);
-		if (result == ISC_R_SUCCESS)
-			isc_mem_setname(*mctxp, "client", NULL);
-		return (result);
-	}
 #if NMCTXS > 0
 	INSIST(manager->nextmctx < NMCTXS);
 	clientmctx = manager->mctxpool[manager->nextmctx];
@@ -1978,7 +1851,6 @@ get_clientmctx(ns_clientmgr_t *manager, isc_mem_t **mctxp) {
 		result = isc_mem_create(0, 0, &clientmctx);
 		if (result != ISC_R_SUCCESS)
 			return (result);
-		isc_mem_setname(clientmctx, "client", NULL);

 		manager->mctxpool[manager->nextmctx] = clientmctx;
 	}
@@ -2127,8 +1999,6 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) {
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_query;

-	client->needshutdown = ns_g_clienttest;
-
 	CTRACE("create");

 	*clientp = client;
@@ -2550,9 +2420,7 @@ ns_clientmgr_createclients(ns_clientmgr_t *manager, unsigned int n,
 		 * Allocate a client.  First try to get a recycled one;
 		 * if that fails, make a new one.
 		 */
-		client = NULL;
-		if (!ns_g_clienttest)
-			client = ISC_LIST_HEAD(manager->inactive);
+		client = ISC_LIST_HEAD(manager->inactive);
 		if (client != NULL) {
 			MTRACE("recycle");
 			ISC_LIST_UNLINK(manager->inactive, client, link);
@@ -2622,12 +2490,12 @@ ns_client_checkaclsilent(ns_client_t *client, isc_sockaddr_t *sockaddr,
 			goto deny;
 	}

-
+  
 	if (sockaddr == NULL)
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 	else
 		isc_netaddr_fromsockaddr(&netaddr, sockaddr);
-
+  
 	result = dns_acl_match(&netaddr, client->signer, acl,
 			       &ns_g_server->aclenv,
 			       &match, NULL);
@@ -2653,7 +2521,7 @@ ns_client_checkacl(ns_client_t *client, isc_sockaddr_t *sockaddr,
 	isc_result_t result =
 		ns_client_checkaclsilent(client, sockaddr, acl, default_allow);

-	if (result == ISC_R_SUCCESS)
+	if (result == ISC_R_SUCCESS) 
 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
 			      "%s approved", opname);
@@ -2709,7 +2577,7 @@ ns_client_log(ns_client_t *client, isc_logcategory_t *category,

 void
 ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdatatype_t type,
-		 dns_rdataclass_t rdclass, char *buf, size_t len)
+		 dns_rdataclass_t rdclass, char *buf, size_t len) 
 {
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char typebuf[DNS_RDATATYPE_FORMATSIZE];
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: config.c,v 1.88 2008/05/28 21:02:45 each Exp $ */
+/* $Id: config.c,v 1.82 2007/10/19 17:15:53 explorer Exp $ */

 /*! \file */

@@ -99,7 +99,6 @@ options {\n\
 	use-ixfr true;\n\
 	edns-udp-size 4096;\n\
 	max-udp-size 4096;\n\
-	request-nsid false;\n\
 \n\
 	/* view */\n\
 	allow-notify {none;};\n\
@@ -124,13 +123,13 @@ options {\n\
 	query-source-v6 address *;\n\
 	notify-source *;\n\
 	notify-source-v6 *;\n\
-	cleaning-interval 0;  /* now meaningless */\n\
+	cleaning-interval 60;\n\
 	min-roots 2;\n\
 	lame-ttl 600;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-cache-ttl 604800; /* 1 week */\n\
 	transfer-format many-answers;\n\
-#	max-cache-size default; /* set default in server.c */\n\
+	max-cache-size 32M;\n\
 	check-names master fail;\n\
 	check-names slave warn;\n\
 	check-names response ignore;\n\
@@ -139,7 +138,7 @@ options {\n\
 	acache-cleaning-interval 60;\n\
 	max-acache-size 16M;\n\
 	dnssec-enable yes;\n\
-	dnssec-validation yes; \n\
+	dnssec-validation no; /* Make yes for 9.5. */ \n\
 	dnssec-accept-expired no;\n\
 	clients-per-query 10;\n\
 	max-clients-per-query 100;\n\
@@ -173,9 +172,6 @@ options {\n\
 	min-refresh-time 300;\n\
 	multi-master no;\n\
 	sig-validity-interval 30; /* days */\n\
-	sig-signing-nodes 100;\n\
-	sig-signing-signatures 10;\n\
-	sig-signing-type 65535;\n\
 	zone-statistics false;\n\
 	max-journal-size unlimited;\n\
 	ixfr-from-differences false;\n\
@@ -411,7 +407,7 @@ ns_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,

 static isc_result_t
 get_masters_def(const cfg_obj_t *cctx, const char *name,
-		const cfg_obj_t **ret)
+	        const cfg_obj_t **ret)
 {
 	isc_result_t result;
 	const cfg_obj_t *masters = NULL;
@@ -529,7 +525,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			tresult = get_masters_def(config, listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, ns_g_lctx, ISC_LOG_ERROR,
-				    "masters \"%s\" not found", listname);
+                                    "masters \"%s\" not found", listname);

 				result = tresult;
 				goto cleanup;
@@ -607,7 +603,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		if (keys[i] == NULL)
 			goto cleanup;
 		dns_name_init(keys[i], NULL);
-
+		
 		keystr = cfg_obj_asstring(key);
 		isc_buffer_init(&b, keystr, strlen(keystr));
 		isc_buffer_add(&b, strlen(keystr));
@@ -663,7 +659,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		isc_mem_put(mctx, lists, listcount * sizeof(*lists));
 	if (stack != NULL)
 		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
-
+	
 	INSIST(keycount == addrcount);

 	*addrsp = addrs;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: controlconf.c,v 1.58 2008/01/18 23:46:57 tbox Exp $ */
+/* $Id: controlconf.c,v 1.55 2007/09/12 01:09:07 each Exp $ */

 /*! \file */

@@ -345,9 +345,9 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	listener = conn->listener;
 	secret.rstart = NULL;

-	/* Is the server shutting down? */
-	if (listener->controls->shuttingdown)
-		goto cleanup;
+        /* Is the server shutting down? */
+        if (listener->controls->shuttingdown)
+                goto cleanup;

 	if (conn->ccmsg.result != ISC_R_SUCCESS) {
 		if (conn->ccmsg.result != ISC_R_CANCELED &&
@@ -364,6 +364,9 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	{
 		ccregion.rstart = isc_buffer_base(&conn->ccmsg.buffer);
 		ccregion.rend = isc_buffer_used(&conn->ccmsg.buffer);
+		if (secret.rstart != NULL)
+			isc_mem_put(listener->mctx, secret.rstart,
+				    REGION_SIZE(secret));
 		secret.rstart = isc_mem_get(listener->mctx, key->secret.length);
 		if (secret.rstart == NULL)
 			goto cleanup;
@@ -372,8 +375,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		result = isccc_cc_fromwire(&ccregion, &request, &secret);
 		if (result == ISC_R_SUCCESS)
 			break;
-		isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
-		if (result == ISCCC_R_BADAUTH) {
+		else if (result == ISCCC_R_BADAUTH) {
 			/*
 			 * For some reason, request is non-NULL when
 			 * isccc_cc_fromwire returns ISCCC_R_BADAUTH.
@@ -394,7 +396,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	/* We shouldn't be getting a reply. */
 	if (isccc_cc_isreply(request)) {
 		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
-		goto cleanup_request;
+		goto cleanup;
 	}

 	isc_stdtime_get(&now);
@@ -405,17 +407,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	_ctrl = isccc_alist_lookup(request, "_ctrl");
 	if (_ctrl == NULL) {
 		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
-		goto cleanup_request;
+		goto cleanup;
 	}

 	if (isccc_cc_lookupuint32(_ctrl, "_tim", &sent) == ISC_R_SUCCESS) {
 		if ((sent + CLOCKSKEW) < now || (sent - CLOCKSKEW) > now) {
 			log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
-			goto cleanup_request;
+			goto cleanup;
 		}
 	} else {
 		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
-		goto cleanup_request;
+		goto cleanup;
 	}

 	/*
@@ -424,7 +426,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	if (isccc_cc_lookupuint32(_ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
 	    now > exp) {
 		log_invalid(&conn->ccmsg, ISCCC_R_EXPIRED);
-		goto cleanup_request;
+		goto cleanup;
 	}

 	/*
@@ -434,16 +436,16 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	result = isccc_cc_checkdup(listener->controls->symtab, request, now);
 	if (result != ISC_R_SUCCESS) {
 		if (result == ISC_R_EXISTS)
-			result = ISCCC_R_DUPLICATE;
+                        result = ISCCC_R_DUPLICATE; 
 		log_invalid(&conn->ccmsg, result);
-		goto cleanup_request;
+		goto cleanup;
 	}

 	if (conn->nonce != 0 &&
 	    (isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS ||
 	     conn->nonce != nonce)) {
 		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
-		goto cleanup_request;
+		goto cleanup;
 	}

 	/*
@@ -457,7 +459,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

 	result = isccc_cc_createresponse(request, now, now + 60, &response);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup_request;
+		goto cleanup;
 	if (eresult != ISC_R_SUCCESS) {
 		isccc_sexpr_t *data;

@@ -465,7 +467,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		if (data != NULL) {
 			const char *estr = isc_result_totext(eresult);
 			if (isccc_cc_definestring(data, "err", estr) == NULL)
-				goto cleanup_response;
+				goto cleanup;
 		}
 	}

@@ -476,20 +478,20 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		if (data != NULL) {
 			char *str = (char *)isc_buffer_base(&text);
 			if (isccc_cc_definestring(data, "text", str) == NULL)
-				goto cleanup_response;
+				goto cleanup;
 		}
 	}

 	_ctrl = isccc_alist_lookup(response, "_ctrl");
 	if (_ctrl == NULL ||
 	    isccc_cc_defineuint32(_ctrl, "_nonce", conn->nonce) == NULL)
-		goto cleanup_response;
+		goto cleanup;

 	ccregion.rstart = conn->buffer + 4;
 	ccregion.rend = conn->buffer + sizeof(conn->buffer);
 	result = isccc_cc_towire(response, &ccregion, &secret);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup_response;
+		goto cleanup;
 	isc_buffer_init(&b, conn->buffer, 4);
 	len = sizeof(conn->buffer) - REGION_SIZE(ccregion);
 	isc_buffer_putuint32(&b, len - 4);
@@ -498,27 +500,31 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

 	result = isc_socket_send(conn->sock, &r, task, control_senddone, conn);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup_response;
+		goto cleanup;
 	conn->sending = ISC_TRUE;

-	isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
-	isccc_sexpr_free(&request);
-	isccc_sexpr_free(&response);
+	if (secret.rstart != NULL)
+		isc_mem_put(listener->mctx, secret.rstart,
+			    REGION_SIZE(secret));
+	if (request != NULL)
+		isccc_sexpr_free(&request);
+	if (response != NULL)
+		isccc_sexpr_free(&response);
 	return;

- cleanup_response:
-	isccc_sexpr_free(&response);
-
- cleanup_request:
-	isccc_sexpr_free(&request);
-	isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
-
 cleanup:
+	if (secret.rstart != NULL)
+		isc_mem_put(listener->mctx, secret.rstart,
+			    REGION_SIZE(secret));
 	isc_socket_detach(&conn->sock);
 	isccc_ccmsg_invalidate(&conn->ccmsg);
 	conn->ccmsg_valid = ISC_FALSE;
 	maybe_free_connection(conn);
 	maybe_free_listener(listener);
+	if (request != NULL)
+		isccc_sexpr_free(&request);
+	if (response != NULL)
+		isccc_sexpr_free(&response);
 }

 static void
@@ -542,7 +548,7 @@ newconnection(controllistener_t *listener, isc_socket_t *sock) {
 	conn = isc_mem_get(listener->mctx, sizeof(*conn));
 	if (conn == NULL)
 		return (ISC_R_NOMEMORY);
-
+	
 	conn->sock = sock;
 	isccc_ccmsg_init(listener->mctx, sock, &conn->ccmsg);
 	conn->ccmsg_valid = ISC_TRUE;
@@ -655,7 +661,7 @@ ns_controls_shutdown(ns_controls_t *controls) {

 static isc_result_t
 cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
-		const cfg_obj_t **objp)
+	        const cfg_obj_t **objp)
 {
 	const cfg_listelt_t *element;
 	const char *str;
@@ -803,7 +809,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 		 if (result != ISC_R_SUCCESS) \
 			goto cleanup; \
 	} while (0)
-
+		
 static isc_result_t
 get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	isc_result_t result;
@@ -823,14 +829,14 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	CHECK(cfg_map_get(config, "key", &key));

 	keyid = isc_mem_get(mctx, sizeof(*keyid));
-	if (keyid == NULL)
+	if (keyid == NULL) 
 		CHECK(ISC_R_NOMEMORY);
 	keyid->keyname = isc_mem_strdup(mctx,
 					cfg_obj_asstring(cfg_map_getname(key)));
 	keyid->secret.base = NULL;
 	keyid->secret.length = 0;
 	ISC_LINK_INIT(keyid, link);
-	if (keyid->keyname == NULL)
+	if (keyid->keyname == NULL) 
 		CHECK(ISC_R_NOMEMORY);

 	CHECK(bind9_check_key(key, ns_g_lctx));
@@ -886,7 +892,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		cfg_parser_destroy(&pctx);
 	return (result);
 }
-
+			
 /*
 * Ensures that both '*global_keylistp' and '*control_keylistp' are
 * valid or both are NULL.
@@ -920,7 +926,7 @@ static void
 update_listener(ns_controls_t *cp, controllistener_t **listenerp,
 		const cfg_obj_t *control, const cfg_obj_t *config,
 		isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
-		const char *socktext, isc_sockettype_t type)
+	        const char *socktext, isc_sockettype_t type)
 {
 	controllistener_t *listener;
 	const cfg_obj_t *allow;
@@ -940,7 +946,7 @@ update_listener(ns_controls_t *cp, controllistener_t **listenerp,
 		*listenerp = NULL;
 		return;
 	}
-
+		
 	/*
 	 * There is already a listener for this sockaddr.
 	 * Update the access list and key information.
@@ -1096,7 +1102,7 @@ add_listener(ns_controls_t *cp, controllistener_t **listenerp,
 			allow = cfg_tuple_get(control, "allow");
 			result = cfg_acl_fromconfig(allow, config, ns_g_lctx,
 						    aclconfctx, mctx, 0,
-						    &new_acl);
+                                                    &new_acl);
 		} else {
 			result = dns_acl_any(mctx, &new_acl);
 		}
@@ -1337,7 +1343,7 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,

 				update_listener(cp, &listener, control, config,
 						&addr, aclconfctx,
-						cfg_obj_asstring(path),
+					        cfg_obj_asstring(path),
 						isc_sockettype_unix);

 				if (listener != NULL)
@@ -1383,10 +1389,10 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
 			isc_sockaddr_setport(&addr, NS_CONTROL_PORT);

 			isc_sockaddr_format(&addr, socktext, sizeof(socktext));
-
+			
 			update_listener(cp, &listener, NULL, NULL,
 					&addr, NULL, socktext,
-					isc_sockettype_tcp);
+				        isc_sockettype_tcp);

 			if (listener != NULL)
 				/*
@@ -1,6 +1,6 @@
 #!/usr/bin/env perl
 #
-# Copyright (C) 2006-2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,19 +14,19 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: convertxsl.pl,v 1.13 2008/04/03 10:52:46 marka Exp $
+# $Id: convertxsl.pl,v 1.9 2007/09/14 06:14:44 marka Exp $

 use strict;
 use warnings;

-my $rev = '$Id: convertxsl.pl,v 1.13 2008/04/03 10:52:46 marka Exp $';
+my $rev = '$Id: convertxsl.pl,v 1.9 2007/09/14 06:14:44 marka Exp $';
 $rev =~ s/\$//g;
 $rev =~ s/,v//g;
 $rev =~ s/Id: //;

 my $xsl = "unknown";
+
 my $lines = '';
-my (@nsstatsdesc, @zonestatsdesc, @resstatsdesc);

 while (<>) {
    chomp;
@@ -34,23 +34,7 @@ while (<>) {
    $xsl = $_ if (/<!-- .Id:.* -->/);
    # convert Id string to a form not recognisable by cvs.
    $_ =~ s/<!-- .Id:(.*). -->/<!-- \\045Id: $1\\045 -->/;
-    if (/server\/nsstats\/(\w+)\"/) {
-	push(@nsstatsdesc, $1);
-    } elsif (/server\/zonestats\/(\w+)\"/) {
-	push(@zonestatsdesc, $1);
-    } elsif (/\"resstats\/(\w+)\"/) {
-	push(@resstatsdesc, $1);
-    }
-    s/[\ \t]+/ /g;
-    s/\>\ \</\>\</g;
-    s/\"/\\\"/g;
-    s/^/\t\"/;
-    s/$/\\n\"/;
-    if ($lines eq "") {
-	    $lines .= $_;
-    } else {
-	    $lines .= "\n" . $_;
-    }
+    $lines .= $_;
 }

 $xsl =~ s/\$//g;
@@ -58,34 +42,12 @@ $xsl =~ s/<!-- Id: //;
 $xsl =~ s/ -->.*//;
 $xsl =~ s/,v//;

+$lines =~ s/[\ \t]+/ /g;
+$lines =~ s/\>\ \</\>\</g;
+$lines =~ s/\"/\\\"/g;
+
 print "/*\n * Generated by $rev \n * From $xsl\n */\n";
-print 'static char xslmsg[] =',"\n";
+print 'static char msg[] = "';
 print $lines;

-print ';', "\n";
-
-print '#ifdef HAVE_LIBXML2', "\n";
-print "static const char *nsstats_xmldesc[] = {";
-while (my $desc = shift(@nsstatsdesc)) {
-	print "\t\"$desc\"";
-	print "," if (@nsstatsdesc);
-	print "\n";
-}
-print "};\n";
-
-print "static const char *zonestats_xmldesc[] = {";
-while (my $desc = shift(@zonestatsdesc)) {
-	print "\t\"$desc\"";
-	print "," if (@zonestatsdesc);
-	print "\n";
-}
-print "};\n";
-
-print "static const char *resstats_xmldesc[] = {";
-while (my $desc = shift(@resstatsdesc)) {
-	print "\t\"$desc\"";
-	print "," if (@resstatsdesc);
-	print "\n";
-}
-print "};\n";
-print '#endif', "\n";
+print '\\n";', "\n";
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: client.h,v 1.86 2008/04/03 02:01:08 marka Exp $ */
+/* $Id: client.h,v 1.82 2007/06/18 23:47:19 tbox Exp $ */

 #ifndef NAMED_CLIENT_H
 #define NAMED_CLIENT_H 1
@@ -24,7 +24,7 @@
 ***** Module Info
 *****/

-/*! \file
+/*! \file 
 * \brief
 * This module defines two objects, ns_client_t and ns_clientmgr_t.
 *
@@ -97,13 +97,6 @@ struct ns_client {
 	int			nupdates;
 	int			nctls;
 	int			references;
-	isc_boolean_t		needshutdown; 	/*
-						 * Used by clienttest to get
-						 * the client to go from
-						 * inactive to free state
-						 * by shutting down the
-						 * client's task.
-						 */
 	unsigned int		attributes;
 	isc_task_t *		task;
 	dns_view_t *		view;
@@ -166,7 +159,6 @@ struct ns_client {
 #define NS_CLIENTATTR_PKTINFO		0x04 /*%< pktinfo is valid */
 #define NS_CLIENTATTR_MULTICAST		0x08 /*%< recv'd from multicast */
 #define NS_CLIENTATTR_WANTDNSSEC	0x10 /*%< include dnssec records */
-#define NS_CLIENTATTR_WANTNSID          0x20 /*%< include nameserver ID */

 extern unsigned int ns_client_requests;

@@ -366,8 +358,8 @@ ns_client_qnamereplace(ns_client_t *client, dns_name_t *name);

 isc_boolean_t
 ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,
-		 isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr,
-		 dns_rdataclass_t rdclass, void *arg);
+                 isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr,
+                 dns_rdataclass_t rdclass, void *arg);
 /*%
 * Isself callback.
 */
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: globals.h,v 1.75 2008/01/02 23:47:01 tbox Exp $ */
+/* $Id: globals.h,v 1.73 2007/09/26 03:22:43 marka Exp $ */

 #ifndef NAMED_GLOBALS_H
 #define NAMED_GLOBALS_H 1
@@ -115,7 +115,6 @@ EXTERN const char *		ns_g_username		INIT(NULL);
 EXTERN int			ns_g_listen		INIT(3);
 EXTERN isc_time_t		ns_g_boottime;
 EXTERN isc_boolean_t		ns_g_memstatistics	INIT(ISC_FALSE);
-EXTERN isc_boolean_t		ns_g_clienttest		INIT(ISC_FALSE);

 #undef EXTERN
 #undef INIT
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,13 +15,14 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: server.h,v 1.93 2008/04/03 05:55:51 marka Exp $ */
+/* $Id: server.h,v 1.87 2007/06/19 23:46:59 tbox Exp $ */

 #ifndef NAMED_SERVER_H
 #define NAMED_SERVER_H 1

 /*! \file */

+#include <isc/httpd.h>
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/quota.h>
@@ -63,7 +64,7 @@ struct ns_server {
 	isc_boolean_t		server_usehostname;
 	char *			server_id;	/*%< User-specified server id */

-	/*%
+        /*%
 	 * Current ACL environment.  This defines the
 	 * current values of the localhost and localnets
 	 * ACLs.
@@ -91,11 +92,7 @@ struct ns_server {
 	isc_boolean_t		flushonshutdown;
 	isc_boolean_t		log_queries;	/*%< For BIND 8 compatibility */

-	dns_stats_t *		nsstats;	/*%< Server statistics */
-	dns_stats_t *		rcvquerystats;	/*% Incoming query statistics */
-	dns_stats_t *		opcodestats;	/*%< Incoming message statistics */
-	dns_stats_t *		zonestats;	/*% Zone management statistics */
-	dns_stats_t *		resolverstats;	/*% Resolver statistics */
+	isc_uint64_t *		querystats;	/*%< Query statistics counters */

 	ns_controls_t *		controls;	/*%< Control channels */
 	unsigned int		dispatchgen;
@@ -103,61 +100,13 @@ struct ns_server {

 	dns_acache_t		*acache;

-	ns_statschannellist_t	statschannels;
+	isc_httpdmgr_t		*httpd;
+	isc_sockaddr_t		httpd_sockaddr;
 };

 #define NS_SERVER_MAGIC			ISC_MAGIC('S','V','E','R')
 #define NS_SERVER_VALID(s)		ISC_MAGIC_VALID(s, NS_SERVER_MAGIC)

-/*%
- * Server statistics counters.  Used as dns_statscounter_t values.
- */
-enum {
-	dns_nsstatscounter_requestv4 = 0,
-	dns_nsstatscounter_requestv6 = 1,
-	dns_nsstatscounter_edns0in = 2,
-	dns_nsstatscounter_badednsver = 3,
-	dns_nsstatscounter_tsigin = 4,
-	dns_nsstatscounter_sig0in = 5,
-	dns_nsstatscounter_invalidsig = 6,
-	dns_nsstatscounter_tcp = 7,
-
-	dns_nsstatscounter_authrej = 8,
-	dns_nsstatscounter_recurserej = 9,
-	dns_nsstatscounter_xfrrej = 10,
-	dns_nsstatscounter_updaterej = 11,
-
-	dns_nsstatscounter_response = 12,
-	dns_nsstatscounter_truncatedresp = 13,
-	dns_nsstatscounter_edns0out = 14,
-	dns_nsstatscounter_tsigout = 15,
-	dns_nsstatscounter_sig0out = 16,
-
-	dns_nsstatscounter_success = 17,
-	dns_nsstatscounter_authans = 18,
-	dns_nsstatscounter_nonauthans = 19,
-	dns_nsstatscounter_referral = 20,
-	dns_nsstatscounter_nxrrset = 21,
-	dns_nsstatscounter_servfail = 22,
-	dns_nsstatscounter_formerr = 23,
-	dns_nsstatscounter_nxdomain = 24,
-	dns_nsstatscounter_recursion = 25,
-	dns_nsstatscounter_duplicate = 26,
-	dns_nsstatscounter_dropped = 27,
-	dns_nsstatscounter_failure = 28,
-
-	dns_nsstatscounter_xfrdone = 29,
-
-	dns_nsstatscounter_updatereqfwd = 30,
-	dns_nsstatscounter_updaterespfwd = 31,
-	dns_nsstatscounter_updatefwdfail = 32,
-	dns_nsstatscounter_updatedone = 33,
-	dns_nsstatscounter_updatefail = 34,
-	dns_nsstatscounter_updatebadprereq = 35,
-
-	dns_nsstatscounter_max = 36
-};
-
 void
 ns_server_create(isc_mem_t *mctx, ns_server_t **serverp);
 /*%<
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: statschannel.h,v 1.3 2008/04/03 05:55:51 marka Exp $ */
+/* $Id: statschannel.h,v 1.2 2008/01/17 00:15:13 jinmei Exp $ */

 #ifndef NAMED_STATSCHANNEL_H
 #define NAMED_STATSCHANNEL_H 1
@@ -52,10 +52,4 @@ ns_statschannels_shutdown(ns_server_t *server);
 * Initiate shutdown of all the statistics channel listeners.
 */

-isc_result_t
-ns_stats_dump(ns_server_t *server, FILE *fp);
-/*%<
- * Dump statistics counters managed by the server to the file fp.
- */
-
 #endif	/* NAMED_STATSCHANNEL_H */
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: types.h,v 1.29 2008/01/17 23:46:59 tbox Exp $ */
+/* $Id: types.h,v 1.27 2007/06/19 23:46:59 tbox Exp $ */

 #ifndef NAMED_TYPES_H
 #define NAMED_TYPES_H 1
@@ -41,6 +41,5 @@ typedef struct ns_lwsearchctx		ns_lwsearchctx_t;
 typedef struct ns_controls		ns_controls_t;
 typedef struct ns_dispatch		ns_dispatch_t;
 typedef ISC_LIST(ns_dispatch_t)		ns_dispatchlist_t;
-typedef struct ns_statschannel		ns_statschannel_t;
-typedef ISC_LIST(ns_statschannel_t)	ns_statschannellist_t;
+
 #endif /* NAMED_TYPES_H */
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: lwaddr.c,v 1.10 2008/01/11 23:46:56 tbox Exp $ */
+/* $Id: lwaddr.c,v 1.8 2007/06/19 23:46:59 tbox Exp $ */

 /*! \file */

@@ -81,7 +81,7 @@ lwaddr_lwresaddr_fromnetaddr(lwres_addr_t *la, isc_netaddr_t *na) {
 	} else {
 		la->family = LWRES_ADDRTYPE_V6;
 		la->length = 16;
-		memcpy(la->address, &na->type.in6, 16);
+		memcpy(la->address, &na->type.in, 16);
 	}
 	return (ISC_R_SUCCESS);
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: lwdgnba.c,v 1.22 2008/01/14 23:46:56 tbox Exp $ */
+/* $Id: lwdgnba.c,v 1.20 2007/06/19 23:46:59 tbox Exp $ */

 /*! \file */

@@ -220,6 +220,8 @@ ns_lwdclient_processgnba(ns_lwdclient_t *client, lwres_buffer_t *b) {
 					 b, &client->pkt, &req);
 	if (result != LWRES_R_SUCCESS)
 		goto out;
+	if (req->addr.address == NULL)
+		goto out;

 	client->options = 0;
 	if (req->addr.family == LWRES_ADDRTYPE_V4) {
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: lwdnoop.c,v 1.13 2008/01/22 23:28:04 tbox Exp $ */
+/* $Id: lwdnoop.c,v 1.11 2007/06/19 23:46:59 tbox Exp $ */

 /*! \file */

@@ -44,7 +44,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {
 	result = lwres_nooprequest_parse(client->clientmgr->lwctx,
 					 b, &client->pkt, &req);
 	if (result != LWRES_R_SUCCESS)
-		goto send_error;
+		goto out;

 	client->pkt.recvlength = LWRES_RECVLENGTH;
 	client->pkt.authtype = 0; /* XXXMLG */
@@ -57,7 +57,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {
 	lwres = lwres_noopresponse_render(client->clientmgr->lwctx, &resp,
 					  &client->pkt, &lwb);
 	if (lwres != LWRES_R_SUCCESS)
-		goto cleanup_req;
+		goto out;

 	r.base = lwb.base;
 	r.length = lwb.used;
@@ -65,7 +65,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {
 	client->sendlength = r.length;
 	result = ns_lwdclient_sendreply(client, &r);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup_lwb;
+		goto out;

 	/*
 	 * We can now destroy request.
@@ -76,12 +76,13 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {

 	return;

- cleanup_lwb:
-	lwres_context_freemem(client->clientmgr->lwctx, lwb.base, lwb.length);
+ out:
+	if (req != NULL)
+		lwres_nooprequest_free(client->clientmgr->lwctx, &req);

- cleanup_req:
-	lwres_nooprequest_free(client->clientmgr->lwctx, &req);
+	if (lwb.base != NULL)
+		lwres_context_freemem(client->clientmgr->lwctx,
+				      lwb.base, lwb.length);

- send_error:
 	ns_lwdclient_errorpktsend(client, LWRES_R_FAILURE);
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: main.c,v 1.162 2008/04/03 23:14:52 jinmei Exp $ */
+/* $Id: main.c,v 1.158 2007/09/26 03:22:43 marka Exp $ */

 /*! \file */

@@ -356,7 +356,7 @@ parse_command_line(int argc, char *argv[]) {

 	isc_commandline_errprint = ISC_FALSE;
 	while ((ch = isc_commandline_parse(argc, argv,
-				 "46c:C:d:fgi:lm:n:N:p:P:st:T:u:vx:")) != -1) {
+			           "46c:C:d:fgi:lm:n:N:p:P:st:u:vx:")) != -1) {
 		switch (ch) {
 		case '4':
 			if (disable4)
@@ -439,17 +439,6 @@ parse_command_line(int argc, char *argv[]) {
 			/* XXXJAB should we make a copy? */
 			ns_g_chrootdir = isc_commandline_argument;
 			break;
-		case 'T':
-			/*
-			 * clienttest: make clients single shot with their
-			 * 	       own memory context.
-			 */
-			if (strcmp(isc_commandline_argument, "clienttest") == 0)
-				ns_g_clienttest = ISC_TRUE;
-			else
-				fprintf(stderr, "unknown -T flag '%s\n",
-					isc_commandline_argument);
-			break;
 		case 'u':
 			ns_g_username = isc_commandline_argument;
 			break;
@@ -678,7 +667,7 @@ setup(void) {
 					       sizeof(absolute_conffile));
 		if (result != ISC_R_SUCCESS)
 			ns_main_earlyfatal("could not construct absolute path of "
-					   "configuration file: %s",
+					   "configuration file: %s", 
 					   isc_result_totext(result));
 		ns_g_conffile = absolute_conffile;
 	}
@@ -778,7 +767,7 @@ ns_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 		if (debug)
 			UNEXPECTED_ERROR(__FILE__, __LINE__,
 					 "scf_handle_create() failed: %s",
-					 scf_strerror(scf_error()));
+			 		 scf_strerror(scf_error()));
 		return (ISC_R_FAILURE);
 	}

@@ -878,7 +867,6 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		ns_main_earlyfatal("isc_mem_create() failed: %s",
 				   isc_result_totext(result));
-	isc_mem_setname(ns_g_mctx, "main", NULL);

 	setup();

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.conf.5,v 1.34 2008/04/03 01:09:59 tbox Exp $
+.\" $Id: named.conf.5,v 1.31 2007/10/21 22:15:32 marka Exp $
 .\"
 .hy 0
 .ad l
@@ -283,10 +283,6 @@ options {
 	min\-refresh\-time \fIinteger\fR;
 	multi\-master \fIboolean\fR;
 	sig\-validity\-interval \fIinteger\fR;
-	sig\-re\-signing\-interval \fIinteger\fR;
-	sig\-signing\-nodes \fIinteger\fR;
-	sig\-signing\-signatures \fIinteger\fR;
-	sig\-signing\-type \fIinteger\fR;
 	transfer\-source ( \fIipv4_address\fR | * )
 		[ port ( \fIinteger\fR | * ) ];
 	transfer\-source\-v6 ( \fIipv6_address\fR | * )
@@ -481,9 +477,7 @@ zone \fIstring\fR \fIoptional_class\fR {
 	allow\-update\-forwarding { \fIaddress_match_element\fR; ... };
 	update\-policy {
 		( grant | deny ) \fIstring\fR
-		( name | subdomain | wildcard | self | selfsub | selfwild |
-                  krb5\-self | ms\-self | krb5\-subdomain | ms\-subdomain |
-		  tcp\-self | 6to4\-self ) \fIstring\fR
+		( name | subdomain | wildcard | self ) \fIstring\fR
 		\fIrrtypelist\fR; ...
 	};
 	update\-check\-ksk \fIboolean\fR;
@@ -541,5 +535,5 @@ zone \fIstring\fR \fIoptional_class\fR {
 \fBrndc\fR(8),
 BIND 9 Administrator Reference Manual.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -17,7 +17,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: named.conf.docbook,v 1.37 2008/04/02 02:37:41 marka Exp $ -->
+<!-- $Id: named.conf.docbook,v 1.34 2007/10/19 17:15:53 explorer Exp $ -->
 <refentry>
  <refentryinfo>
    <date>Aug 13, 2004</date>
@@ -40,7 +40,6 @@
      <year>2005</year>
      <year>2006</year>
      <year>2007</year>
-      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -316,12 +315,7 @@ options {
 	max-refresh-time <replaceable>integer</replaceable>;
 	min-refresh-time <replaceable>integer</replaceable>;
 	multi-master <replaceable>boolean</replaceable>;
-
 	sig-validity-interval <replaceable>integer</replaceable>;
-	sig-re-signing-interval <replaceable>integer</replaceable>;
-	sig-signing-nodes <replaceable>integer</replaceable>;
-	sig-signing-signatures <replaceable>integer</replaceable>;
-	sig-signing-type <replaceable>integer</replaceable>;

 	transfer-source ( <replaceable>ipv4_address</replaceable> | * )
 		<optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
@@ -538,9 +532,7 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 	allow-update-forwarding { <replaceable>address_match_element</replaceable>; ... };
 	update-policy {
 		( grant | deny ) <replaceable>string</replaceable>
-		( name | subdomain | wildcard | self | selfsub | selfwild |
-                  krb5-self | ms-self | krb5-subdomain | ms-subdomain |
-		  tcp-self | 6to4-self ) <replaceable>string</replaceable>
+		( name | subdomain | wildcard | self ) <replaceable>string</replaceable>
 		<replaceable>rrtypelist</replaceable>; ...
 	};
 	update-check-ksk <replaceable>boolean</replaceable>;
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.conf.html,v 1.43 2008/04/03 01:09:59 tbox Exp $ -->
+<!-- $Id: named.conf.html,v 1.40 2007/10/21 22:15:32 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543342"></a><h2>DESCRIPTION</h2>
+<a name="id2542042"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">named.conf</code> is the configuration file
      for
      <span><strong class="command">named</strong></span>.  Statements are enclosed
@@ -50,14 +50,14 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543370"></a><h2>ACL</h2>
+<a name="id2543367"></a><h2>ACL</h2>
 <div class="literallayout"><p><br>
 acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 <br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543386"></a><h2>KEY</h2>
+<a name="id2543383"></a><h2>KEY</h2>
 <div class="literallayout"><p><br>
 key <em class="replaceable"><code>domain_name</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -66,7 +66,7 @@ key
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543405"></a><h2>MASTERS</h2>
+<a name="id2543402"></a><h2>MASTERS</h2>
 <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
 	( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
@@ -75,7 +75,7 @@ masters
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543451"></a><h2>SERVER</h2>
+<a name="id2543448"></a><h2>SERVER</h2>
 <div class="literallayout"><p><br>
 server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/prefixlen</span>]</code></em> | <em class="replaceable"><code>ipv6_address[<span class="optional">/prefixlen</span>]</code></em> ) {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -97,7 +97,7 @@ server
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543520"></a><h2>TRUSTED-KEYS</h2>
+<a name="id2543516"></a><h2>TRUSTED-KEYS</h2>
 <div class="literallayout"><p><br>
 trusted-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br>
@@ -105,7 +105,7 @@ trusted-keys
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543545"></a><h2>CONTROLS</h2>
+<a name="id2543542"></a><h2>CONTROLS</h2>
 <div class="literallayout"><p><br>
 controls {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br>
@@ -117,7 +117,7 @@ controls
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543580"></a><h2>LOGGING</h2>
+<a name="id2543577"></a><h2>LOGGING</h2>
 <div class="literallayout"><p><br>
 logging {<br>
 	channel <em class="replaceable"><code>string</code></em> {<br>
@@ -135,7 +135,7 @@ logging
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543619"></a><h2>LWRES</h2>
+<a name="id2543616"></a><h2>LWRES</h2>
 <div class="literallayout"><p><br>
 lwres {<br>
 	listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
@@ -148,7 +148,7 @@ lwres
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543660"></a><h2>OPTIONS</h2>
+<a name="id2543657"></a><h2>OPTIONS</h2>
 <div class="literallayout"><p><br>
 options {<br>
 	avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br>
@@ -286,12 +286,7 @@ options
 	max-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
 	multi-master <em class="replaceable"><code>boolean</code></em>;<br>
-<br>
 	sig-validity-interval <em class="replaceable"><code>integer</code></em>;<br>
-	sig-re-signing-interval <em class="replaceable"><code>integer</code></em>;<br>
-	sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
-	sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
-	sig-signing-type <em class="replaceable"><code>integer</code></em>;<br>
 <br>
 	transfer-source ( <em class="replaceable"><code>ipv4_address</code></em> | * )<br>
 		[<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
@@ -326,7 +321,7 @@ options
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544444"></a><h2>VIEW</h2>
+<a name="id2544428"></a><h2>VIEW</h2>
 <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -474,7 +469,7 @@ view
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545106"></a><h2>ZONE</h2>
+<a name="id2545090"></a><h2>ZONE</h2>
 <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	type ( master | slave | stub | hint |<br>
@@ -506,9 +501,7 @@ zone
 	allow-update-forwarding { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	update-policy {<br>
 		( grant | deny ) <em class="replaceable"><code>string</code></em><br>
-		( name | subdomain | wildcard | self | selfsub | selfwild |<br>
-                  krb5-self | ms-self | krb5-subdomain | ms-subdomain |<br>
-		  tcp-self | 6to4-self ) <em class="replaceable"><code>string</code></em><br>
+		( name | subdomain | wildcard | self ) <em class="replaceable"><code>string</code></em><br>
 		<em class="replaceable"><code>rrtypelist</code></em>; ...<br>
 	};<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
@@ -564,12 +557,12 @@ zone
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545399"></a><h2>FILES</h2>
+<a name="id2545384"></a><h2>FILES</h2>
 <p><code class="filename">/etc/named.conf</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545411"></a><h2>SEE ALSO</h2>
+<a name="id2545396"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: query.c,v 1.307 2008/04/29 00:54:28 marka Exp $ */
+/* $Id: query.c,v 1.298 2007/09/26 03:04:45 each Exp $ */

 /*! \file */

@@ -128,37 +128,35 @@ static inline void
 inc_stats(ns_client_t *client, dns_statscounter_t counter) {
 	dns_zone_t *zone = client->query.authzone;

-	dns_generalstats_increment(ns_g_server->nsstats, counter);
+	REQUIRE(counter < DNS_STATS_NCOUNTERS);
+
+	ns_g_server->querystats[counter]++;

 	if (zone != NULL) {
-		dns_stats_t *zonestats = dns_zone_getrequeststats(zone);
+		isc_uint64_t *zonestats = dns_zone_getstatscounters(zone);
 		if (zonestats != NULL)
-			dns_generalstats_increment(zonestats, counter);
+			zonestats[counter]++;
 	}
 }

 static void
 query_send(ns_client_t *client) {
 	dns_statscounter_t counter;
-	if ((client->message->flags & DNS_MESSAGEFLAG_AA) == 0)
-		inc_stats(client, dns_nsstatscounter_nonauthans);
-	else
-		inc_stats(client, dns_nsstatscounter_authans);
 	if (client->message->rcode == dns_rcode_noerror) {
 		if (ISC_LIST_EMPTY(client->message->sections[DNS_SECTION_ANSWER])) {
 			if (client->query.isreferral) {
-				counter = dns_nsstatscounter_referral;
+				counter = dns_statscounter_referral;
 			} else {
-				counter = dns_nsstatscounter_nxrrset;
+				counter = dns_statscounter_nxrrset;
 			}
 		} else {
-			counter = dns_nsstatscounter_success;
+			counter = dns_statscounter_success;
 		}
 	} else if (client->message->rcode == dns_rcode_nxdomain) {
-		counter = dns_nsstatscounter_nxdomain;
+		counter = dns_statscounter_nxdomain;
 	} else {
 		/* We end up here in case of YXDOMAIN, and maybe others */
-		counter = dns_nsstatscounter_failure;
+		counter = dns_statscounter_failure;
 	}
 	inc_stats(client, counter);
 	ns_client_send(client);
@@ -166,28 +164,18 @@ query_send(ns_client_t *client) {

 static void
 query_error(ns_client_t *client, isc_result_t result) {
-	switch (result) {
-	case DNS_R_SERVFAIL:
-		inc_stats(client, dns_nsstatscounter_servfail);
-		break;
-	case DNS_R_FORMERR:
-		inc_stats(client, dns_nsstatscounter_formerr);
-		break;
-	default:
-		inc_stats(client, dns_nsstatscounter_failure);
-		break;
-	}
+	inc_stats(client, dns_statscounter_failure);
 	ns_client_error(client, result);
 }

 static void
 query_next(ns_client_t *client, isc_result_t result) {
 	if (result == DNS_R_DUPLICATE)
-		inc_stats(client, dns_nsstatscounter_duplicate);
+		inc_stats(client, dns_statscounter_duplicate);
 	else if (result == DNS_R_DROP)
-		inc_stats(client, dns_nsstatscounter_dropped);
+		inc_stats(client, dns_statscounter_dropped);
 	else
-		inc_stats(client, dns_nsstatscounter_failure);
+		inc_stats(client, dns_statscounter_failure);
 	ns_client_next(client, result);
 }

@@ -1099,12 +1087,8 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 	result = dns_db_find(db, name, version, type, client->query.dboptions,
 			     client->now, &node, fname, rdataset,
 			     sigrdataset);
-	if (result == ISC_R_SUCCESS) {
-		if (sigrdataset != NULL && !dns_db_issecure(db) &&
-		    dns_rdataset_isassociated(sigrdataset))
-			dns_rdataset_disassociate(sigrdataset);
+	if (result == ISC_R_SUCCESS)
 		goto found;
-	}

 	if (dns_rdataset_isassociated(rdataset))
 		dns_rdataset_disassociate(rdataset);
@@ -2041,7 +2025,7 @@ query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version,
 		eresult = DNS_R_SERVFAIL;
 		goto cleanup;
 	}
-	if (WANTDNSSEC(client) && dns_db_issecure(db)) {
+	if (WANTDNSSEC(client)) {
 		sigrdataset = query_newrdataset(client);
 		if (sigrdataset == NULL) {
 			eresult = DNS_R_SERVFAIL;
@@ -2159,7 +2143,7 @@ query_addns(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version) {
 		eresult = DNS_R_SERVFAIL;
 		goto cleanup;
 	}
-	if (WANTDNSSEC(client) && dns_db_issecure(db)) {
+	if (WANTDNSSEC(client)) {
 		sigrdataset = query_newrdataset(client);
 		if (sigrdataset == NULL) {
 			CTRACE("query_addns: query_newrdataset failed");
@@ -2315,7 +2299,7 @@ mark_secure(ns_client_t *client, dns_db_t *db, dns_name_t *name,
 static isc_boolean_t
 get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,
 	dns_rdataset_t *keyrdataset, dst_key_t **keyp)
-{
+{ 
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
 	isc_boolean_t secure = ISC_FALSE;
@@ -2348,12 +2332,12 @@ get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,
 		isc_buffer_init(&b, rdata.data, rdata.length);
 		isc_buffer_add(&b, rdata.length);
 		result = dst_key_fromdns(&rrsig->signer, rdata.rdclass, &b,
-					 client->mctx, keyp);
+                                         client->mctx, keyp);
 		if (result != ISC_R_SUCCESS)
 			continue;
 		if (rrsig->algorithm == (dns_secalg_t)dst_key_alg(*keyp) &&
-		    rrsig->keyid == (dns_keytag_t)dst_key_id(*keyp) &&
-		    dst_key_iszonekey(*keyp)) {
+                    rrsig->keyid == (dns_keytag_t)dst_key_id(*keyp) &&
+                    dst_key_iszonekey(*keyp)) {
 			secure = ISC_TRUE;
 			break;
 		}
@@ -2371,7 +2355,7 @@ verify(dst_key_t *key, dns_name_t *name, dns_rdataset_t *rdataset,
 	isc_boolean_t ignore = ISC_FALSE;

 	dns_fixedname_init(&fixed);
-
+	
 again:
 	result = dns_dnssec_verify2(name, rdataset, key, ignore, mctx,
 				    rdata, NULL);
@@ -2399,7 +2383,7 @@ validate(ns_client_t *client, dns_db_t *db, dns_name_t *name,

 	if (sigrdataset == NULL || !dns_rdataset_isassociated(sigrdataset))
 		return (ISC_FALSE);
-
+	
 	for (result = dns_rdataset_first(sigrdataset);
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(sigrdataset)) {
@@ -2774,13 +2758,6 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 						   &olabels);
 			(void)dns_name_fullcompare(name, &nsec.next, &order,
 						   &nlabels);
-			/*
-			 * Check for a pathological condition created when
-			 * serving some malformed signed zones and bail out.
-			 */
-			if (dns_name_countlabels(name) == nlabels)
-				goto cleanup;
-
 			if (olabels > nlabels)
 				dns_name_split(name, olabels, NULL, wname);
 			else
@@ -2948,14 +2925,13 @@ query_resume(isc_task_t *task, isc_event_t *event) {

 static isc_result_t
 query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain,
-	      dns_rdataset_t *nameservers, isc_boolean_t resuming)
+	      dns_rdataset_t *nameservers)
 {
 	isc_result_t result;
 	dns_rdataset_t *rdataset, *sigrdataset;
 	isc_sockaddr_t *peeraddr;

-	if (!resuming)
-		inc_stats(client, dns_nsstatscounter_recursion);
+	inc_stats(client, dns_statscounter_recursion);

 	/*
 	 * We are about to recurse, which means that this client will
@@ -3187,11 +3163,11 @@ query_addnoqnameproof(ns_client_t *client, dns_rdataset_t *rdataset) {

 cleanup:
 	if (nsec != NULL)
-		query_putrdataset(client, &nsec);
-	if (nsecsig != NULL)
-		query_putrdataset(client, &nsecsig);
-	if (fname != NULL)
-		query_releasename(client, &fname);
+                query_putrdataset(client, &nsec);
+        if (nsecsig != NULL)
+                query_putrdataset(client, &nsecsig);
+        if (fname != NULL)
+                query_releasename(client, &fname);
 }

 static inline void
@@ -3294,12 +3270,12 @@ warn_rfc1918(ns_client_t *client, dns_name_t *fname, dns_rdataset_t *rdataset) {
 	dns_rdata_soa_t soa;
 	dns_rdataset_t found;
 	isc_result_t result;
-
+	
 	for (i = 0; i < (sizeof(rfc1918names)/sizeof(*rfc1918names)); i++) {
 		if (dns_name_issubdomain(fname, &rfc1918names[i])) {
 			dns_rdataset_init(&found);
 			result = dns_ncache_getrdataset(rdataset,
-							&rfc1918names[i],
+						        &rfc1918names[i],
 							dns_rdatatype_soa,
 							&found);
 			if (result != ISC_R_SUCCESS)
@@ -3360,7 +3336,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	unsigned int options;
 	isc_boolean_t empty_wild;
 	dns_rdataset_t *noqname;
-	isc_boolean_t resuming;

 	CTRACE("query_find");

@@ -3386,7 +3361,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	need_wildcardproof = ISC_FALSE;
 	empty_wild = ISC_FALSE;
 	options = 0;
-	resuming = ISC_FALSE;

 	if (event != NULL) {
 		/*
@@ -3429,7 +3403,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		}

 		result = event->result;
-		resuming = ISC_TRUE;

 		goto resume;
 	}
@@ -3517,11 +3490,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	}
 	if (result != ISC_R_SUCCESS) {
 		if (result == DNS_R_REFUSED) {
-			if (WANTRECURSION(client)) {
-				inc_stats(client,
-					  dns_nsstatscounter_recurserej);
-			} else
-				inc_stats(client, dns_nsstatscounter_authrej);
 			if (!PARTIALANSWER(client))
 				QUERY_ERROR(DNS_R_REFUSED);
 		} else
@@ -3566,7 +3534,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		QUERY_ERROR(DNS_R_SERVFAIL);
 		goto cleanup;
 	}
-	if (WANTDNSSEC(client) && (!is_zone || dns_db_issecure(db))) {
+	if (WANTDNSSEC(client)) {
 		sigrdataset = query_newrdataset(client);
 		if (sigrdataset == NULL) {
 			QUERY_ERROR(DNS_R_SERVFAIL);
@@ -3635,7 +3603,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			 */
 			if (RECURSIONOK(client)) {
 				result = query_recurse(client, qtype,
-						       NULL, NULL, resuming);
+						       NULL, NULL);
 				if (result == ISC_R_SUCCESS)
 					client->query.attributes |=
 						NS_QUERYATTR_RECURSING;
@@ -3806,12 +3774,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				 */
 				if (dns_rdatatype_atparent(type))
 					result = query_recurse(client, qtype,
-							       NULL, NULL,
-							       resuming);
+							       NULL, NULL);
 				else
 					result = query_recurse(client, qtype,
-							       fname, rdataset,
-							       resuming);
+							       fname, rdataset);
 				if (result == ISC_R_SUCCESS)
 					client->query.attributes |=
 						NS_QUERYATTR_RECURSING;
@@ -4207,16 +4173,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		result = dns_rdatasetiter_first(rdsiter);
 		while (result == ISC_R_SUCCESS) {
 			dns_rdatasetiter_current(rdsiter, rdataset);
-			if (is_zone && qtype == dns_rdatatype_any &&
-			    !dns_db_issecure(db) &&
-			    dns_rdatatype_isdnssec(rdataset->type)) {
-				/*
-				 * The zone is transitioning from insecure
-				 * to secure. Hide the dnssec records from
-				 * ANY queries.
-				 */
-				dns_rdataset_disassociate(rdataset);
-			} else if ((qtype == dns_rdatatype_any ||
+			if ((qtype == dns_rdatatype_any ||
 			     rdataset->type == qtype) && rdataset->type != 0) {
 				query_addrrset(client,
 					       fname != NULL ? &fname : &tname,
@@ -4264,8 +4221,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 						result = query_recurse(client,
 								       qtype,
 								       NULL,
-								       NULL,
-								       resuming);
+								       NULL);
 						if (result == ISC_R_SUCCESS)
 						    client->query.attributes |=
 							NS_QUERYATTR_RECURSING;
@@ -4486,16 +4442,9 @@ ns_query_start(ns_client_t *client) {
 	dns_rdatatype_t qtype;
 	unsigned int saved_extflags = client->extflags;
 	unsigned int saved_flags = client->message->flags;
-	isc_boolean_t want_ad;

 	CTRACE("ns_query_start");

-	/*
-	 * Test only.
-	 */
-	if (ns_g_clienttest && (client->attributes & NS_CLIENTATTR_TCP) == 0)
-		RUNTIME_CHECK(ns_client_replace(client) == ISC_R_SUCCESS);
-
 	/*
 	 * Ensure that appropriate cleanups occur.
 	 */
@@ -4581,7 +4530,6 @@ ns_query_start(ns_client_t *client) {
 	rdataset = ISC_LIST_HEAD(client->query.qname->list);
 	INSIST(rdataset != NULL);
 	qtype = rdataset->type;
-	dns_rdatatypestats_increment(ns_g_server->rcvquerystats, qtype);
 	if (dns_rdatatype_ismeta(qtype)) {
 		switch (qtype) {
 		case dns_rdatatype_any:
@@ -4632,15 +4580,6 @@ ns_query_start(ns_client_t *client) {
 	if (message->flags & DNS_MESSAGEFLAG_CD)
 		client->query.attributes &= ~NS_QUERYATTR_SECURE;

-	/*
-	 * Set 'want_ad' if the client has set AD in the query.
-	 * This allows AD to be returned on queries without DO set.
-	 */
-	if ((message->flags & DNS_MESSAGEFLAG_AD) != 0)
-		want_ad = ISC_TRUE;
-	else
-		want_ad = ISC_FALSE;
-
 	/*
 	 * This is an ordinary query.
 	 */
@@ -4660,7 +4599,7 @@ ns_query_start(ns_client_t *client) {
 	 * Set AD.  We must clear it if we add non-validated data to a
 	 * response.
 	 */
-	if (WANTDNSSEC(client) || want_ad)
+	if (WANTDNSSEC(client))
 		message->flags |= DNS_MESSAGEFLAG_AD;

 	qclient = NULL;
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: statschannel.c,v 1.10 2008/04/09 22:53:36 tbox Exp $ */
+/* $Id: statschannel.c,v 1.2.2.3 2008/01/17 23:46:36 tbox Exp $ */

 /*! \file */

@@ -23,25 +23,17 @@
 #include <isc/buffer.h>
 #include <isc/httpd.h>
 #include <isc/mem.h>
-#include <isc/once.h>
 #include <isc/print.h>
 #include <isc/socket.h>
 #include <isc/task.h>

-#include <dns/db.h>
-#include <dns/opcode.h>
-#include <dns/rdataclass.h>
-#include <dns/rdatatype.h>
 #include <dns/stats.h>
 #include <dns/view.h>
-#include <dns/zt.h>

 #include <named/log.h>
 #include <named/server.h>
 #include <named/statschannel.h>

-#include "bind9.xsl.h"
-
 struct ns_statschannel {
 	/* Unlocked */
 	isc_httpdmgr_t				*httpdmgr;
@@ -59,190 +51,6 @@ struct ns_statschannel {
 	ISC_LINK(struct ns_statschannel)	link;
 };

-typedef enum { statsformat_file, statsformat_xml } statsformat_t;
-
-typedef struct
-stats_dumparg {
-	statsformat_t	type;
-	void		*arg;		/* type dependent argument */
-	const char	**desc;		/* used for general statistics */
-	int		ncounters;	/* used for general statistics */
-} stats_dumparg_t;
-
-static isc_once_t once = ISC_ONCE_INIT;
-
-static void
-generalstat_dump(dns_statscounter_t counter, isc_uint64_t val, void *arg) {
-	stats_dumparg_t *dumparg = arg;
-	FILE *fp;
-#ifdef HAVE_LIBXML2
-	xmlTextWriterPtr writer;
-#endif
-
-	REQUIRE(counter < dumparg->ncounters);
-
-	switch (dumparg->type) {
-	case statsformat_file:
-		fp = dumparg->arg;
-		fprintf(fp, "%20" ISC_PRINT_QUADFORMAT "u %s\n", val,
-			dumparg->desc[counter]);
-		break;
-	case statsformat_xml:
-#ifdef HAVE_LIBXML2
-		writer = dumparg->arg;
-
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR
-					  dumparg->desc[counter]);
-		xmlTextWriterWriteFormatString(writer,
-					       "%" ISC_PRINT_QUADFORMAT "u",
-					       val);
-		xmlTextWriterEndElement(writer);
-#endif
-		break;
-	}
-}
-
-static void
-rdtypestat_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
-	char typebuf[64];
-	const char *typestr;
-	stats_dumparg_t *dumparg = arg;
-	FILE *fp;
-#ifdef HAVE_LIBXML2
-	xmlTextWriterPtr writer;
-#endif
-
-	if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_OTHERTYPE)
-	    == 0) {
-		dns_rdatatype_format(DNS_RDATASTATSTYPE_BASE(type), typebuf,
-				     sizeof(typebuf));
-		typestr = typebuf;
-	} else
-		typestr = "Others";
-
-	switch (dumparg->type) {
-	case statsformat_file:
-		fp = dumparg->arg;
-		fprintf(fp, "%20" ISC_PRINT_QUADFORMAT "u %s\n", val, typestr);
-		break;
-	case statsformat_xml:
-#ifdef HAVE_LIBXML2
-		writer = dumparg->arg;
-
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdtype");
-
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
-		xmlTextWriterWriteString(writer, ISC_XMLCHAR typestr);
-		xmlTextWriterEndElement(writer); /* name */
-
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter");
-		xmlTextWriterWriteFormatString(writer,
-					       "%" ISC_PRINT_QUADFORMAT "u",
-					       val);
-		xmlTextWriterEndElement(writer); /* counter */
-
-		xmlTextWriterEndElement(writer); /* rdtype */
-#endif
-		break;
-	}
-}
-
-static void
-rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
-	stats_dumparg_t *dumparg = arg;
-	FILE *fp;
-	char typebuf[64];
-	const char *typestr;
-	isc_boolean_t nxrrset = ISC_FALSE;
-#ifdef HAVE_LIBXML2
-	xmlTextWriterPtr writer;
-#endif
-
-	if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_NXDOMAIN)
-	    != 0) {
-		typestr = "NXDOMAIN";
-	} else if ((DNS_RDATASTATSTYPE_ATTR(type) &
-		    DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) != 0) {
-		typestr = "Others";
-	} else {
-		dns_rdatatype_format(DNS_RDATASTATSTYPE_BASE(type), typebuf,
-				     sizeof(typebuf));
-		typestr = typebuf;
-	}
-
-	if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_NXRRSET)
-	    != 0)
-		nxrrset = ISC_TRUE;
-
-	switch (dumparg->type) {
-	case statsformat_file:
-		fp = dumparg->arg;
-		fprintf(fp, "%20" ISC_PRINT_QUADFORMAT "u %s%s\n", val,
-			nxrrset ? "!" : "", typestr);
-		break;
-	case statsformat_xml:
-#ifdef HAVE_LIBXML2
-		writer = dumparg->arg;
-
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "rrset");
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
-		xmlTextWriterWriteFormatString(writer, "%s%s",
-					       nxrrset ? "!" : "", typestr);
-		xmlTextWriterEndElement(writer); /* name */
-
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter");
-		xmlTextWriterWriteFormatString(writer,
-					       "%" ISC_PRINT_QUADFORMAT "u",
-					       val);
-		xmlTextWriterEndElement(writer); /* counter */
-
-		xmlTextWriterEndElement(writer); /* rrset */
-#endif
-		break;
-	}
-}
-
-static void
-opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) {
-	FILE *fp = arg;
-	isc_buffer_t b;
-	char codebuf[64];
-	stats_dumparg_t *dumparg = arg;
-#ifdef HAVE_LIBXML2
-	xmlTextWriterPtr writer;
-#endif
-
-	isc_buffer_init(&b, codebuf, sizeof(codebuf) - 1);
-	dns_opcode_totext(code, &b);
-	codebuf[isc_buffer_usedlength(&b)] = '\0';
-
-	switch (dumparg->type) {
-	case statsformat_file:
-		fp = dumparg->arg;
-		fprintf(fp, "%20" ISC_PRINT_QUADFORMAT "u %s\n", val, codebuf);
-		break;
-	case statsformat_xml:
-#ifdef HAVE_LIBXML2
-		writer = dumparg->arg;
-
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "opcode");
-
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
-		xmlTextWriterWriteString(writer, ISC_XMLCHAR codebuf);
-		xmlTextWriterEndElement(writer); /* name */
-
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter");
-		xmlTextWriterWriteFormatString(writer,
-					       "%" ISC_PRINT_QUADFORMAT "u",
-					       val);
-		xmlTextWriterEndElement(writer); /* counter */
-
-		xmlTextWriterEndElement(writer); /* opcode */
-#endif
-		break;
-	}
-}
-
 #ifdef HAVE_LIBXML2

 /* XXXMLG below here sucks. */
@@ -250,50 +58,8 @@ opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) {
 #define TRY(a) do { result = (a); INSIST(result == ISC_R_SUCCESS); } while(0);
 #define TRY0(a) do { xmlrc = (a); INSIST(xmlrc >= 0); } while(0);

-static isc_result_t
-zone_xmlrender(dns_zone_t *zone, void *arg) {
-	char buf[1024 + 32];	/* sufficiently large for zone name and class */
-	dns_rdataclass_t rdclass;
-	isc_uint32_t serial;
-	xmlTextWriterPtr writer = arg;
-	stats_dumparg_t dumparg;
-	dns_stats_t *zonestats;
-
-	xmlTextWriterStartElement(writer, ISC_XMLCHAR "zone");
-
-	dns_zone_name(zone, buf, sizeof(buf));
-	xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
-	xmlTextWriterWriteString(writer, ISC_XMLCHAR buf);
-	xmlTextWriterEndElement(writer);
-
-	rdclass = dns_zone_getclass(zone);
-	dns_rdataclass_format(rdclass, buf, sizeof(buf));
-	xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdataclass");
-	xmlTextWriterWriteString(writer, ISC_XMLCHAR buf);
-	xmlTextWriterEndElement(writer);
-
-	serial = dns_zone_getserial(zone);
-	xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial");
-	xmlTextWriterWriteFormatString(writer, "%u", serial);
-	xmlTextWriterEndElement(writer);
-
-	dumparg.type = statsformat_xml;
-	dumparg.arg = writer;
-	dumparg.desc = nsstats_xmldesc;
-	dumparg.ncounters = dns_nsstatscounter_max;
-
-	zonestats = dns_zone_getrequeststats(zone);
-	if (zonestats != NULL) {
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters");
-		dns_generalstats_dump(zonestats, generalstat_dump,
-				      &dumparg, DNS_STATSDUMP_VERBOSE);
-		xmlTextWriterEndElement(writer); /* counters */
-	}
-
-	xmlTextWriterEndElement(writer); /* zone */
-
-	return (ISC_R_SUCCESS);
-}
+#define NODES 8
+#define SPACES 3

 static void
 generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
@@ -304,8 +70,7 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	xmlDocPtr doc;
 	int xmlrc;
 	dns_view_t *view;
-	stats_dumparg_t dumparg;
-	dns_stats_t *cachestats;
+	int i;

 	isc_time_now(&now);
 	isc_time_formatISO8601(&ns_g_boottime, boottime, sizeof boottime);
@@ -324,10 +89,6 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
 					 ISC_XMLCHAR "1.0"));

-	/* Set common fields for statistics dump */
-	dumparg.type = statsformat_xml;
-	dumparg.arg = writer;
-
 	/*
 	 * Start by rendering the views we know of here.  For each view we
 	 * know of, call its rendering function.
@@ -335,43 +96,7 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	view = ISC_LIST_HEAD(server->viewlist);
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "views"));
 	while (view != NULL) {
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "view");
-
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
-		xmlTextWriterWriteString(writer, ISC_XMLCHAR view->name);
-		xmlTextWriterEndElement(writer);
-
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "zones");
-		dns_zt_apply(view->zonetable, ISC_FALSE, zone_xmlrender,
-			     writer);
-		xmlTextWriterEndElement(writer);
-
-		if (view->resquerystats != NULL) {
-			dns_rdatatypestats_dump(view->resquerystats,
-						rdtypestat_dump, &dumparg, 0);
-		}
-
-		if (view->resstats != NULL) {
-			xmlTextWriterStartElement(writer,
-						  ISC_XMLCHAR "resstats");
-			dumparg.ncounters = dns_resstatscounter_max;
-			dumparg.desc = resstats_xmldesc; /* auto-generated */
-			dns_generalstats_dump(view->resstats, generalstat_dump,
-					      &dumparg, DNS_STATSDUMP_VERBOSE);
-			xmlTextWriterEndElement(writer); /* resstats */
-		}
-
-		cachestats = dns_db_getrrsetstats(view->cachedb);
-		if (cachestats != NULL) {
-			xmlTextWriterStartElement(writer,
-						  ISC_XMLCHAR "cache");
-			dns_rdatasetstats_dump(cachestats, rdatasetstats_dump,
-					       &dumparg, 0);
-			xmlTextWriterEndElement(writer); /* cache */
-		}
-
-		xmlTextWriterEndElement(writer); /* view */
-
+		dns_view_xmlrender(view, writer, ISC_XML_RENDERALL);
 		view = ISC_LIST_NEXT(view, link);
 	}
 	TRY0(xmlTextWriterEndElement(writer)); /* views */
@@ -391,42 +116,20 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	xmlTextWriterStartElement(writer, ISC_XMLCHAR "current-time");
 	xmlTextWriterWriteString(writer, ISC_XMLCHAR nowstr);
 	xmlTextWriterEndElement(writer);
-
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "requests"));
-	dns_opcodestats_dump(server->opcodestats, opcodestat_dump, &dumparg,
-			     0);
-	xmlTextWriterEndElement(writer); /* requests */
-
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "queries-in"));
-	dns_rdatatypestats_dump(server->rcvquerystats, rdtypestat_dump,
-				&dumparg, 0);
-	xmlTextWriterEndElement(writer); /* queries-in */
-
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nsstats"));
-	dumparg.desc = nsstats_xmldesc; /* auto-generated in bind9.xsl.h */
-	dumparg.ncounters = dns_nsstatscounter_max;
-	dns_generalstats_dump(server->nsstats, generalstat_dump, &dumparg,
-			      DNS_STATSDUMP_VERBOSE);
-	xmlTextWriterEndElement(writer); /* nsstats */
-
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "zonestats"));
-	dumparg.desc = zonestats_xmldesc; /* auto-generated in bind9.xsl.h */
-	dumparg.ncounters = dns_zonestatscounter_max;
-	dns_generalstats_dump(server->zonestats, generalstat_dump, &dumparg,
-			      DNS_STATSDUMP_VERBOSE);
-	xmlTextWriterEndElement(writer); /* zonestats */
-
-	xmlTextWriterStartElement(writer, ISC_XMLCHAR "resstats");
-	dumparg.ncounters = dns_resstatscounter_max;
-	dumparg.desc = resstats_xmldesc;
-	dns_generalstats_dump(server->resolverstats, generalstat_dump,
-			      &dumparg, DNS_STATSDUMP_VERBOSE);
-	xmlTextWriterEndElement(writer); /* resstats */
-
+	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"));
+	for (i = 0; i < DNS_STATS_NCOUNTERS; i++) {
+		xmlTextWriterStartElement(writer,
+					ISC_XMLCHAR dns_statscounter_names[i]);
+		xmlTextWriterWriteFormatString(writer,
+					       "%" ISC_PRINT_QUADFORMAT "u",
+					       server->querystats[i]);
+		xmlTextWriterEndElement(writer);
+	}
+	xmlTextWriterEndElement(writer); /* counters */
 	xmlTextWriterEndElement(writer); /* server */

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "memory"));
-	isc_mem_renderxml(writer);
+	isc_mem_renderxml(server->mctx, writer);
 	TRY0(xmlTextWriterEndElement(writer)); /* memory */

 	TRY0(xmlTextWriterEndElement(writer)); /* statistics */
@@ -482,6 +185,8 @@ render_xsl(const char *url, const char *querystring, void *args,
 	   isc_buffer_t *b, isc_httpdfree_t **freecb,
 	   void **freecb_args)
 {
+#include "bind9.xsl.h"
+
 	UNUSED(url);
 	UNUSED(querystring);
 	UNUSED(args);
@@ -489,8 +194,8 @@ render_xsl(const char *url, const char *querystring, void *args,
 	*retcode = 200;
 	*retmsg = "OK";
 	*mimetype = "text/xslt+xml";
-	isc_buffer_reinit(b, xslmsg, strlen(xslmsg));
-	isc_buffer_add(b, strlen(xslmsg));
+	isc_buffer_reinit(b, msg, strlen(msg));
+	isc_buffer_add(b, strlen(msg));
 	*freecb = NULL;
 	*freecb_args = NULL;

@@ -542,7 +247,7 @@ destroy_listener(void *arg) {
 	REQUIRE(listener != NULL);
 	REQUIRE(!ISC_LINK_LINKED(listener, link));

-	/* We don't have to acquire the lock here since it's already unlinked */
+	/* We don't to have acquire the lock here since it's already unlinked */
 	dns_acl_detach(&listener->acl);

 	DESTROYLOCK(&listener->lock);
@@ -826,302 +531,3 @@ ns_statschannels_shutdown(ns_server_t *server) {
 		shutdown_listener(listener);
 	}
 }
-
-/*%
- * Statistics descriptions.  These could be statistically initialized at
- * compile time, but we configure them run time in the init_desc() function
- * below so that they'll be less susceptible to counter name changes.
- * Note that bind9.xsl must still be updated consistently with the counter
- * numbering.
- */
-static const char *nsstats_desc[dns_nsstatscounter_max];
-static const char *resstats_desc[dns_resstatscounter_max];
-static const char *zonestats_desc[dns_zonestatscounter_max];
-
-static inline void
-set_desc(int counter, int maxcounter, const char *desc, const char **descs) {
-	REQUIRE(counter < maxcounter);
-	REQUIRE(descs[counter] == NULL);
-
-	descs[counter] = desc;
-}
-
-static void
-init_desc() {
-	int i;
-
-	/* Initialize name server statistics */
-	memset(nsstats_desc, 0,
-	       dns_nsstatscounter_max * sizeof(nsstats_desc[0]));
-	set_desc(dns_nsstatscounter_requestv4, dns_nsstatscounter_max,
-		 "IPv4 requests received", nsstats_desc);
-	set_desc(dns_nsstatscounter_requestv6, dns_nsstatscounter_max,
-		 "IPv6 requests received", nsstats_desc);
-	set_desc(dns_nsstatscounter_edns0in, dns_nsstatscounter_max,
-		 "requests with EDNS(0) received", nsstats_desc);
-	set_desc(dns_nsstatscounter_badednsver, dns_nsstatscounter_max,
-		 "requests with unsupported EDNS version received",
-		 nsstats_desc);
-	set_desc(dns_nsstatscounter_tsigin, dns_nsstatscounter_max,
-		 "requests with TSIG received", nsstats_desc);
-	set_desc(dns_nsstatscounter_sig0in, dns_nsstatscounter_max,
-		 "requests with SIG(0) received", nsstats_desc);
-	set_desc(dns_nsstatscounter_invalidsig, dns_nsstatscounter_max,
-		 "requests with invalid signature", nsstats_desc);
-	set_desc(dns_nsstatscounter_tcp, dns_nsstatscounter_max,
-		 "TCP requests received", nsstats_desc);
-	set_desc(dns_nsstatscounter_authrej, dns_nsstatscounter_max,
-		 "auth queries rejected", nsstats_desc);
-	set_desc(dns_nsstatscounter_recurserej, dns_nsstatscounter_max,
-		 "recursive queries rejected", nsstats_desc);
-	set_desc(dns_nsstatscounter_xfrrej, dns_nsstatscounter_max,
-		 "transfer requests rejected", nsstats_desc);
-	set_desc(dns_nsstatscounter_updaterej, dns_nsstatscounter_max,
-		 "update requests rejected", nsstats_desc);
-	set_desc(dns_nsstatscounter_response, dns_nsstatscounter_max,
-		 "responses sent", nsstats_desc);
-	set_desc(dns_nsstatscounter_truncatedresp, dns_nsstatscounter_max,
-		 "truncated responses sent", nsstats_desc);
-	set_desc(dns_nsstatscounter_edns0out, dns_nsstatscounter_max,
-		 "responses with EDNS(0) sent", nsstats_desc);
-	set_desc(dns_nsstatscounter_tsigout, dns_nsstatscounter_max,
-		 "responses with TSIG sent", nsstats_desc);
-	set_desc(dns_nsstatscounter_sig0out, dns_nsstatscounter_max,
-		 "responses with SIG(0) sent", nsstats_desc);
-	set_desc(dns_nsstatscounter_success, dns_nsstatscounter_max,
-		 "queries resulted in successful answer", nsstats_desc);
-	set_desc(dns_nsstatscounter_authans, dns_nsstatscounter_max,
-		 "queries resulted in authoritative answer", nsstats_desc);
-	set_desc(dns_nsstatscounter_nonauthans, dns_nsstatscounter_max,
-		 "queries resulted in non authoritative answer", nsstats_desc);
-	set_desc(dns_nsstatscounter_referral, dns_nsstatscounter_max,
-		 "queries resulted in referral answer", nsstats_desc);
-	set_desc(dns_nsstatscounter_nxrrset, dns_nsstatscounter_max,
-		 "queries resulted in nxrrset", nsstats_desc);
-	set_desc(dns_nsstatscounter_servfail, dns_nsstatscounter_max,
-		 "queries resulted in SERVFAIL", nsstats_desc);
-	set_desc(dns_nsstatscounter_formerr, dns_nsstatscounter_max,
-		 "queries resulted in FORMERR", nsstats_desc);
-	set_desc(dns_nsstatscounter_nxdomain, dns_nsstatscounter_max,
-		 "queries resulted in NXDOMAIN", nsstats_desc);
-	set_desc(dns_nsstatscounter_recursion, dns_nsstatscounter_max,
-		 "queries caused recursion", nsstats_desc);
-	set_desc(dns_nsstatscounter_duplicate, dns_nsstatscounter_max,
-		 "duplicate queries received", nsstats_desc);
-	set_desc(dns_nsstatscounter_dropped, dns_nsstatscounter_max,
-		 "queries dropped", nsstats_desc);
-	set_desc(dns_nsstatscounter_failure, dns_nsstatscounter_max,
-		 "other query failures", nsstats_desc);
-	set_desc(dns_nsstatscounter_xfrdone, dns_nsstatscounter_max,
-		 "requested transfers completed", nsstats_desc);
-	set_desc(dns_nsstatscounter_updatereqfwd, dns_nsstatscounter_max,
-		 "update requests forwarded", nsstats_desc);
-	set_desc(dns_nsstatscounter_updaterespfwd, dns_nsstatscounter_max,
-		 "update responses forwarded", nsstats_desc);
-	set_desc(dns_nsstatscounter_updatefwdfail, dns_nsstatscounter_max,
-		 "update forward failed", nsstats_desc);
-	set_desc(dns_nsstatscounter_updatedone, dns_nsstatscounter_max,
-		 "updates completed", nsstats_desc);
-	set_desc(dns_nsstatscounter_updatefail, dns_nsstatscounter_max,
-		 "updates failed", nsstats_desc);
-	set_desc(dns_nsstatscounter_updatebadprereq, dns_nsstatscounter_max,
-		 "updates rejected due to prerequisite failure", nsstats_desc);
-
-	/* Initialize resolver statistics */
-	memset(resstats_desc, 0,
-	       dns_resstatscounter_max * sizeof(resstats_desc[0]));
-	set_desc(dns_resstatscounter_queryv4, dns_resstatscounter_max,
-		 "IPv4 queries sent", resstats_desc);
-	set_desc(dns_resstatscounter_queryv6, dns_resstatscounter_max,
-		 "IPv6 queries sent", resstats_desc);
-	set_desc(dns_resstatscounter_responsev4, dns_resstatscounter_max,
-		 "IPv4 responses received", resstats_desc);
-	set_desc(dns_resstatscounter_responsev6, dns_resstatscounter_max,
-		 "IPv6 responses received", resstats_desc);
-	set_desc(dns_resstatscounter_nxdomain, dns_resstatscounter_max,
-		 "NXDOMAIN received", resstats_desc);
-	set_desc(dns_resstatscounter_servfail, dns_resstatscounter_max,
-		 "SERVFAIL received", resstats_desc);
-	set_desc(dns_resstatscounter_formerr, dns_resstatscounter_max,
-		 "FORMERR received", resstats_desc);
-	set_desc(dns_resstatscounter_othererror, dns_resstatscounter_max,
-		 "other errors received", resstats_desc);
-	set_desc(dns_resstatscounter_edns0fail, dns_resstatscounter_max,
-		 "EDNS(0) query failures", resstats_desc);
-	set_desc(dns_resstatscounter_mismatch, dns_resstatscounter_max,
-		 "mismatch responses received", resstats_desc);
-	set_desc(dns_resstatscounter_truncated, dns_resstatscounter_max,
-		 "truncated responses received", resstats_desc);
-	set_desc(dns_resstatscounter_lame, dns_resstatscounter_max,
-		 "lame delegations received", resstats_desc);
-	set_desc(dns_resstatscounter_retry, dns_resstatscounter_max,
-		 "query retries", resstats_desc);
-	set_desc(dns_resstatscounter_gluefetchv4, dns_resstatscounter_max,
-		 "IPv4 NS address fetches", resstats_desc);
-	set_desc(dns_resstatscounter_gluefetchv6, dns_resstatscounter_max,
-		 "IPv6 NS address fetches", resstats_desc);
-	set_desc(dns_resstatscounter_gluefetchv4fail, dns_resstatscounter_max,
-		 "IPv4 NS address fetch failed", resstats_desc);
-	set_desc(dns_resstatscounter_gluefetchv6fail, dns_resstatscounter_max,
-		 "IPv6 NS address fetch failed", resstats_desc);
-	set_desc(dns_resstatscounter_val, dns_resstatscounter_max,
-		 "DNSSEC validation attempted", resstats_desc);
-	set_desc(dns_resstatscounter_valsuccess, dns_resstatscounter_max,
-		 "DNSSEC validation succeeded", resstats_desc);
-	set_desc(dns_resstatscounter_valnegsuccess, dns_resstatscounter_max,
-		 "DNSSEC NX validation succeeded", resstats_desc);
-	set_desc(dns_resstatscounter_valfail, dns_resstatscounter_max,
-		 "DNSSEC validation failed", resstats_desc);
-
-	/* Initialize zone statistics */
-	memset(zonestats_desc, 0,
-	       dns_zonestatscounter_max * sizeof(zonestats_desc[0]));
-	set_desc(dns_zonestatscounter_notifyoutv4, dns_zonestatscounter_max,
-		 "IPv4 notifies sent", zonestats_desc);
-	set_desc(dns_zonestatscounter_notifyoutv6, dns_zonestatscounter_max,
-		 "IPv6 notifies sent", zonestats_desc);
-	set_desc(dns_zonestatscounter_notifyinv4, dns_zonestatscounter_max,
-		 "IPv4 notifies received", zonestats_desc);
-	set_desc(dns_zonestatscounter_notifyinv6, dns_zonestatscounter_max,
-		 "IPv6 notifies received", zonestats_desc);
-	set_desc(dns_zonestatscounter_notifyrej, dns_zonestatscounter_max,
-		 "notifies rejected", zonestats_desc);
-	set_desc(dns_zonestatscounter_soaoutv4, dns_zonestatscounter_max,
-		 "IPv4 SOA queries sent", zonestats_desc);
-	set_desc(dns_zonestatscounter_soaoutv6, dns_zonestatscounter_max,
-		 "IPv6 SOA queries sent", zonestats_desc);
-	set_desc(dns_zonestatscounter_axfrreqv4, dns_zonestatscounter_max,
-		 "IPv4 AXFR requested", zonestats_desc);
-	set_desc(dns_zonestatscounter_axfrreqv6, dns_zonestatscounter_max,
-		 "IPv6 AXFR requested", zonestats_desc);
-	set_desc(dns_zonestatscounter_ixfrreqv4, dns_zonestatscounter_max,
-		 "IPv4 IXFR requested", zonestats_desc);
-	set_desc(dns_zonestatscounter_ixfrreqv6, dns_zonestatscounter_max,
-		 "IPv6 IXFR requested", zonestats_desc);
-	set_desc(dns_zonestatscounter_xfrsuccess, dns_zonestatscounter_max,
-		 "transfer requests succeeded", zonestats_desc);
-	set_desc(dns_zonestatscounter_xfrfail, dns_zonestatscounter_max,
-		 "transfer requests failed", zonestats_desc);
-
-	/* Sanity check */
-	for (i = 0; i < dns_nsstatscounter_max; i++)
-		INSIST(nsstats_desc[i] != NULL);
-	for (i = 0; i < dns_resstatscounter_max; i++)
-		INSIST(resstats_desc[i] != NULL);
-	for (i = 0; i < dns_zonestatscounter_max; i++)
-		INSIST(zonestats_desc[i] != NULL);
-}
-
-isc_result_t
-ns_stats_dump(ns_server_t *server, FILE *fp) {
-	isc_stdtime_t now;
-	isc_result_t result;
-	dns_view_t *view;
-	dns_zone_t *zone, *next;
-	stats_dumparg_t dumparg;
-
-	RUNTIME_CHECK(isc_once_do(&once, init_desc) == ISC_R_SUCCESS);
-
-	/* Set common fields */
-	dumparg.type = statsformat_file;
-	dumparg.arg = fp;
-
-	isc_stdtime_get(&now);
-	fprintf(fp, "+++ Statistics Dump +++ (%lu)\n", (unsigned long)now);
-
-	fprintf(fp, "++ Incoming Requests ++\n");
-	dns_opcodestats_dump(server->opcodestats, opcodestat_dump, &dumparg, 0);
-
-	fprintf(fp, "++ Incoming Queries ++\n");
-	dns_rdatatypestats_dump(server->rcvquerystats, rdtypestat_dump,
-				&dumparg, 0);
-
-	fprintf(fp, "++ Outgoing Queries ++\n");
-	for (view = ISC_LIST_HEAD(server->viewlist);
-	     view != NULL;
-	     view = ISC_LIST_NEXT(view, link)) {
-		if (view->resquerystats == NULL)
-			continue;
-		if (strcmp(view->name, "_default") == 0)
-			fprintf(fp, "[View: default]\n");
-		else
-			fprintf(fp, "[View: %s]\n", view->name);
-		dns_rdatatypestats_dump(view->resquerystats, rdtypestat_dump,
-					&dumparg, 0);
-	}
-
-	fprintf(fp, "++ Name Server Statistics ++\n");
-	dumparg.desc = nsstats_desc;
-	dumparg.ncounters = dns_nsstatscounter_max;
-	dns_generalstats_dump(server->nsstats, generalstat_dump, &dumparg, 0);
-	fprintf(fp, "++ Zone Maintenance Statistics ++\n");
-	dumparg.desc = zonestats_desc;
-	dumparg.ncounters = dns_zonestatscounter_max;
-	dns_generalstats_dump(server->zonestats, generalstat_dump, &dumparg, 0);
-
-	fprintf(fp, "++ Resolver Statistics ++\n");
-	fprintf(fp, "[Common]\n");
-	dumparg.desc = resstats_desc;
-	dumparg.ncounters = dns_resstatscounter_max;
-	dns_generalstats_dump(server->resolverstats, generalstat_dump, &dumparg,
-			      0);
-	for (view = ISC_LIST_HEAD(server->viewlist);
-	     view != NULL;
-	     view = ISC_LIST_NEXT(view, link)) {
-		if (view->resstats == NULL)
-			continue;
-		if (strcmp(view->name, "_default") == 0)
-			fprintf(fp, "[View: default]\n");
-		else
-			fprintf(fp, "[View: %s]\n", view->name);
-		dns_generalstats_dump(view->resstats, generalstat_dump,
-				      &dumparg, 0);
-	}
-
-	fprintf(fp, "++ Cache DB RRsets ++\n");
-	for (view = ISC_LIST_HEAD(server->viewlist);
-	     view != NULL;
-	     view = ISC_LIST_NEXT(view, link)) {
-		dns_stats_t *cachestats;
-
-		cachestats = dns_db_getrrsetstats(view->cachedb);
-		if (cachestats == NULL)
-			continue;
-		if (strcmp(view->name, "_default") == 0)
-			fprintf(fp, "[View: default]\n");
-		else
-			fprintf(fp, "[View: %s]\n", view->name);
-		dns_rdatasetstats_dump(cachestats, rdatasetstats_dump, &dumparg,
-				       0);
-	}
-
-	fprintf(fp, "++ Per Zone Query Statistics ++\n");
-	zone = NULL;
-	for (result = dns_zone_first(server->zonemgr, &zone);
-	     result == ISC_R_SUCCESS;
-	     next = NULL, result = dns_zone_next(zone, &next), zone = next)
-	{
-		dns_stats_t *zonestats = dns_zone_getrequeststats(zone);
-		if (zonestats != NULL) {
-			char zonename[DNS_NAME_FORMATSIZE];
-
-			dns_name_format(dns_zone_getorigin(zone),
-					zonename, sizeof(zonename));
-			view = dns_zone_getview(zone);
-
-			fprintf(fp, "[%s", zonename);
-			if (strcmp(view->name, "_default") != 0)
-				fprintf(fp, " (view: %s)", view->name);
-			fprintf(fp, "]\n");
-
-			dumparg.desc = nsstats_desc;
-			dumparg.ncounters = dns_nsstatscounter_max;
-			dns_generalstats_dump(zonestats, generalstat_dump,
-					      &dumparg, 0);
-		}
-	}
-
-	fprintf(fp, "--- Statistics Dump --- (%lu)\n", (unsigned long)now);
-
-	return (ISC_R_SUCCESS);	/* this function currently always succeeds */
-}
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: os.c,v 1.84 2008/05/06 01:30:26 each Exp $ */
+/* $Id: os.c,v 1.79 2007/06/19 23:46:59 tbox Exp $ */

 /*! \file */

@@ -69,7 +69,7 @@ static int devnullfd = -1;
 /*
 * Linux defines:
 *	(T) HAVE_LINUXTHREADS
- *	(C) HAVE_SYS_CAPABILITY_H (or HAVE_LINUX_CAPABILITY_H)
+ *	(C) HAVE_LINUX_CAPABILITY_H
 *	(P) HAVE_SYS_PRCTL_H
 * The possible cases are:
 *	none:	setuid() normally
@@ -116,9 +116,6 @@ static int dfd[2] = { -1, -1 };
 static isc_boolean_t non_root = ISC_FALSE;
 static isc_boolean_t non_root_caps = ISC_FALSE;

-#ifdef HAVE_SYS_CAPABILITY_H
-#include <sys/capability.h>
-#else
 /*%
 * We define _LINUX_FS_H to prevent it from being included.  We don't need
 * anything from it, and the files it includes cause warnings with 2.2
@@ -126,15 +123,9 @@ static isc_boolean_t non_root_caps = ISC_FALSE;
 * and <string.h>) on 2.3 kernels.
 */
 #define _LINUX_FS_H
-#include <linux/capability.h>
-#include <syscall.h>
-#ifndef SYS_capset
-#ifndef __NR_capset
-#include <asm/unistd.h> /* Slackware 4.0 needs this. */
-#endif /* __NR_capset */
-#define SYS_capset __NR_capset
-#endif /* SYS_capset */
-#endif /* HAVE_SYS_CAPABILITY_H */
+
+#include <sys/syscall.h>	/* Required for syscall(). */
+#include <linux/capability.h>	/* Required for _LINUX_CAPABILITY_VERSION. */

 #ifdef HAVE_SYS_PRCTL_H
 #include <sys/prctl.h>		/* Required for prctl(). */
@@ -151,24 +142,22 @@ static isc_boolean_t non_root_caps = ISC_FALSE;

 #endif /* HAVE_SYS_PRCTL_H */

-#ifdef HAVE_LIBCAP
-#define SETCAPS_FUNC "cap_set_proc "
-#else
-typedef unsigned int cap_t;
-#define SETCAPS_FUNC "syscall(capset) "
-#endif /* HAVE_LIBCAP */
+#ifndef SYS_capset
+#ifndef __NR_capset
+#include <asm/unistd.h> /* Slackware 4.0 needs this. */
+#endif
+#define SYS_capset __NR_capset
+#endif

 static void
-linux_setcaps(cap_t caps) {
-#ifndef HAVE_LIBCAP
+linux_setcaps(unsigned int caps) {
 	struct __user_cap_header_struct caphead;
 	struct __user_cap_data_struct cap;
-#endif
 	char strbuf[ISC_STRERRORSIZE];

 	if ((getuid() != 0 && !non_root_caps) || non_root)
 		return;
-#ifndef HAVE_LIBCAP
+
 	memset(&caphead, 0, sizeof(caphead));
 	caphead.version = _LINUX_CAPABILITY_VERSION;
 	caphead.pid = 0;
@@ -176,74 +165,36 @@ linux_setcaps(cap_t caps) {
 	cap.effective = caps;
 	cap.permitted = caps;
 	cap.inheritable = 0;
-#endif
-#ifdef HAVE_LIBCAP
-	if (cap_set_proc(caps) < 0) {
-#else
 	if (syscall(SYS_capset, &caphead, &cap) < 0) {
-#endif
 		isc__strerror(errno, strbuf, sizeof(strbuf));
-		ns_main_earlyfatal(SETCAPS_FUNC "failed: %s:"
+		ns_main_earlyfatal("capset failed: %s:"
 				   " please ensure that the capset kernel"
 				   " module is loaded.  see insmod(8)",
 				   strbuf);
 	}
 }

-#ifdef HAVE_LIBCAP
-#define SET_CAP(flag) \
-	do { \
-		capval = (flag); \
-		err = cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); \
-		if (err == -1) { \
-			isc__strerror(errno, strbuf, sizeof(strbuf)); \
-			ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
-		} \
-		\
-		err = cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); \
-		if (err == -1) { \
-			isc__strerror(errno, strbuf, sizeof(strbuf)); \
-			ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
-		} \
-	} while (0)
-#define INIT_CAP \
-	do { \
-		caps = cap_init(); \
-		if (caps == NULL) { \
-			isc__strerror(errno, strbuf, sizeof(strbuf)); \
-			ns_main_earlyfatal("cap_init failed: %s", strbuf); \
-		} \
-	} while (0)
-#else
-#define SET_CAP(flag) { caps |= (1 << (flag)); }
-#define INIT_CAP { caps = 0; }
-#endif /* HAVE_LIBCAP */
-
 static void
 linux_initialprivs(void) {
-	cap_t caps;
-#ifdef HAVE_LIBCAP
-	cap_value_t capval;
-	char strbuf[ISC_STRERRORSIZE];
-	int err;
-#endif
+	unsigned int caps;

 	/*%
 	 * We don't need most privileges, so we drop them right away.
 	 * Later on linux_minprivs() will be called, which will drop our
 	 * capabilities to the minimum needed to run the server.
 	 */
-	INIT_CAP;
+
+	caps = 0;

 	/*
 	 * We need to be able to bind() to privileged ports, notably port 53!
 	 */
-	SET_CAP(CAP_NET_BIND_SERVICE);
+	caps |= (1 << CAP_NET_BIND_SERVICE);

 	/*
 	 * We need chroot() initially too.
 	 */
-	SET_CAP(CAP_SYS_CHROOT);
+	caps |= (1 << CAP_SYS_CHROOT);

 #if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
 	/*
@@ -252,19 +203,19 @@ linux_initialprivs(void) {
 	 * tried) or we're not using threads.  If either of these is
 	 * true, we want the setuid capability.
 	 */
-	SET_CAP(CAP_SETUID);
+	caps |= (1 << CAP_SETUID);
 #endif

 	/*
 	 * Since we call initgroups, we need this.
 	 */
-	SET_CAP(CAP_SETGID);
+	caps |= (1 << CAP_SETGID);

 	/*
 	 * Without this, we run into problems reading a configuration file
 	 * owned by a non-root user and non-world-readable on startup.
 	 */
-	SET_CAP(CAP_DAC_READ_SEARCH);
+	caps |= (1 << CAP_DAC_READ_SEARCH);

 	/*
 	 * XXX  We might want to add CAP_SYS_RESOURCE, though it's not
@@ -273,21 +224,15 @@ linux_initialprivs(void) {
 	 * of files, the stack size, data size, and core dump size to
 	 * support named.conf options, this is now being added to test.
 	 */
-	SET_CAP(CAP_SYS_RESOURCE);
+	caps |= (1 << CAP_SYS_RESOURCE);

 	linux_setcaps(caps);
 }

 static void
 linux_minprivs(void) {
-	cap_t caps;
-#ifdef HAVE_LIBCAP
-	cap_value_t capval;
-	char strbuf[ISC_STRERRORSIZE];
-	int err;
-#endif
+	unsigned int caps;

-	INIT_CAP;
 	/*%
 	 * Drop all privileges except the ability to bind() to privileged
 	 * ports.
@@ -296,7 +241,8 @@ linux_minprivs(void) {
 	 * chroot() could be used to escape from the chrooted area.
 	 */

-	SET_CAP(CAP_NET_BIND_SERVICE);
+	caps = 0;
+	caps |= (1 << CAP_NET_BIND_SERVICE);

 	/*
 	 * XXX  We might want to add CAP_SYS_RESOURCE, though it's not
@@ -305,7 +251,7 @@ linux_minprivs(void) {
 	 * of files, the stack size, data size, and core dump size to
 	 * support named.conf options, this is now being added to test.
 	 */
-	SET_CAP(CAP_SYS_RESOURCE);
+	caps |= (1 << CAP_SYS_RESOURCE);

 	linux_setcaps(caps);
 }
@@ -380,7 +326,7 @@ ns_os_daemonize(void) {
 		/*
 		 * Wait for the child to finish loading for the first time.
 		 * This would be so much simpler if fork() worked once we
-		 * were multi-threaded.
+	         * were multi-threaded.
 		 */
 		(void)close(dfd[1]);
 		do {
@@ -550,19 +496,15 @@ ns_os_changeuser(void) {
 		ns_main_earlyfatal("setuid(): %s", strbuf);
 	}

+#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
+	linux_minprivs();
+#endif
 #if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)
 	/*
 	 * Restore the ability of named to drop core after the setuid()
 	 * call has disabled it.
 	 */
-	if (prctl(PR_SET_DUMPABLE,1,0,0,0) < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
-		ns_main_earlywarning("prctl(PR_SET_DUMPABLE) failed: %s",
-				     strbuf);
-	}
-#endif
-#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
-	linux_minprivs();
+	prctl(PR_SET_DUMPABLE,1,0,0,0);
 #endif
 }

@@ -723,7 +665,7 @@ ns_os_shutdownmsg(char *command, isc_buffer_t *text) {
 	ptr = next_token(&input, " \t");
 	if (ptr == NULL)
 		return;
-
+	
 	if (strcmp(ptr, "-p") != 0)
 		return;

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,13 +15,11 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: update.c,v 1.146 2008/04/03 05:55:51 marka Exp $ */
+/* $Id: update.c,v 1.137 2007/08/28 00:05:06 marka Exp $ */

 #include <config.h>

-#include <isc/netaddr.h>
 #include <isc/print.h>
-#include <isc/serial.h>
 #include <isc/string.h>
 #include <isc/taskpool.h>
 #include <isc/util.h>
@@ -43,14 +41,12 @@
 #include <dns/rdatatype.h>
 #include <dns/soa.h>
 #include <dns/ssu.h>
-#include <dns/stats.h>
 #include <dns/view.h>
 #include <dns/zone.h>
 #include <dns/zt.h>

 #include <named/client.h>
 #include <named/log.h>
-#include <named/server.h>
 #include <named/update.h>

 /*! \file
@@ -121,11 +117,6 @@
 			   msg, isc_result_totext(result));	\
 		if (result != ISC_R_SUCCESS) goto failure;	\
 	} while (0)
-#define PREREQFAILC(code, msg) \
-	do {							\
-		inc_stats(zone, dns_nsstatscounter_updatebadprereq); \
-		FAILC(code, msg);				\
-	} while (0)

 #define FAILN(code, name, msg) \
 	do {								\
@@ -147,11 +138,6 @@
 		}							\
 		if (result != ISC_R_SUCCESS) goto failure;		\
 	} while (0)
-#define PREREQFAILN(code, name, msg) \
-	do {								\
-		inc_stats(zone, dns_nsstatscounter_updatebadprereq); \
-		FAILN(code, name, msg);					\
-	} while (0)

 #define FAILNT(code, name, type, msg) \
 	do {								\
@@ -176,12 +162,6 @@
 		}							\
 		if (result != ISC_R_SUCCESS) goto failure;		\
 	} while (0)
-#define PREREQFAILNT(code, name, type, msg)				\
-	do {								\
-		inc_stats(zone, dns_nsstatscounter_updatebadprereq); \
-		FAILNT(code, name, type, msg);				\
-	} while (0)
-
 /*%
 * Fail unconditionally and log as a server error.
 * The test against ISC_R_SUCCESS is there to keep the Solaris compiler
@@ -196,11 +176,6 @@
 		if (result != ISC_R_SUCCESS) goto failure;	\
 	} while (0)

-/*
- * Return TRUE if NS_CLIENTATTR_TCP is set in the attibutes other FALSE.
- */
-#define TCPCLIENT(client) (((client)->attributes & NS_CLIENTATTR_TCP) != 0)
-
 /**************************************************************************/

 typedef struct rr rr_t;
@@ -265,20 +240,6 @@ update_log(ns_client_t *client, dns_zone_t *zone,
 		      namebuf, classbuf, message);
 }

-/*%
- * Increment updated-related statistics counters.
- */
-static inline void
-inc_stats(dns_zone_t *zone, dns_statscounter_t counter) {
-	dns_generalstats_increment(ns_g_server->nsstats, counter);
-
-	if (zone != NULL) {
-		dns_stats_t *zonestats = dns_zone_getrequeststats(zone);
-		if (zonestats != NULL)
-			dns_generalstats_increment(zonestats, counter);
-	}
-}
-
 /*%
 * Override the default acl logging when checking whether a client
 * can update the zone or whether we can forward the request to the
@@ -354,7 +315,6 @@ do_one_tuple(dns_difftuple_t **tuple, dns_db_t *db, dns_dbversion_t *ver,
 	 * Create a singleton diff.
 	 */
 	dns_diff_init(diff->mctx, &temp_diff);
-	temp_diff.resign = diff->resign;
 	ISC_LIST_APPEND(temp_diff.tuples, *tuple, link);

 	/*
@@ -466,7 +426,7 @@ foreach_node_rr_action(void *data, dns_rdataset_t *rdataset) {
 	     result = dns_rdataset_next(rdataset))
 	{
 		rr_t rr = { 0, DNS_RDATA_INIT };
-
+		
 		dns_rdataset_current(rdataset, &rr.rdata);
 		rr.ttl = rdataset->ttl;
 		result = (*ctx->rr_action)(ctx->rr_action_data, &rr);
@@ -748,22 +708,9 @@ name_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	RETURN_EXISTENCE_FLAG;
 }

-/*
- *	'ssu_check_t' is used to pass the arguements to
- *	dns_ssutable_checkrules() to the callback function
- *	ssu_checkrule().
- */
 typedef struct {
-	/* The ownername of the record to be updated. */
 	dns_name_t *name;
-
-	/* The signature's name if the request was signed. */
 	dns_name_t *signer;
-
-	/* The address of the client if the request was received via TCP. */
-	isc_netaddr_t *tcpaddr;
-
-	/* The ssu table to check against. */
 	dns_ssutable_t *table;
 } ssu_check_t;

@@ -780,15 +727,13 @@ ssu_checkrule(void *data, dns_rdataset_t *rrset) {
 	    rrset->type == dns_rdatatype_nsec)
 		return (ISC_R_SUCCESS);
 	result = dns_ssutable_checkrules(ssuinfo->table, ssuinfo->signer,
-					 ssuinfo->name, ssuinfo->tcpaddr,
-					 rrset->type);
+					 ssuinfo->name, rrset->type);
 	return (result == ISC_TRUE ? ISC_R_SUCCESS : ISC_R_FAILURE);
 }

 static isc_boolean_t
 ssu_checkall(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
-	     dns_ssutable_t *ssutable, dns_name_t *signer,
-	     isc_netaddr_t *tcpaddr)
+	     dns_ssutable_t *ssutable, dns_name_t *signer)
 {
 	isc_result_t result;
 	ssu_check_t ssuinfo;
@@ -796,7 +741,6 @@ ssu_checkall(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	ssuinfo.name = name;
 	ssuinfo.table = ssutable;
 	ssuinfo.signer = signer;
-	ssuinfo.tcpaddr = tcpaddr;
 	result = foreach_rrset(db, ver, name, ssu_checkrule, &ssuinfo);
 	return (ISC_TF(result == ISC_R_SUCCESS));
 }
@@ -913,14 +857,10 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
 		/* A new unique name begins here. */
 		node = NULL;
 		result = dns_db_findnode(db, name, ISC_FALSE, &node);
-		if (result == ISC_R_NOTFOUND) {
-			dns_diff_clear(&trash);
+		if (result == ISC_R_NOTFOUND)
 			return (DNS_R_NXRRSET);
-		}
-		if (result != ISC_R_SUCCESS) {
-			dns_diff_clear(&trash);
+		if (result != ISC_R_SUCCESS)
 			return (result);
-		}

 		/* A new unique type begins here. */
 		while (t != NULL && dns_name_equal(&t->name, name)) {
@@ -948,7 +888,6 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
 						     &rdataset, NULL);
 			if (result != ISC_R_SUCCESS) {
 				dns_db_detachnode(db, &node);
-				dns_diff_clear(&trash);
 				return (DNS_R_NXRRSET);
 			}

@@ -1097,17 +1036,9 @@ rr_equal_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) {
 *
 * RFC2136 does not mention NSEC or DNAME, but multiple NSECs or DNAMEs
 * make little sense, so we replace those, too.
- *
- * Additionally replace RRSIG that have been generated by the same key
- * for the same type.  This simplifies refreshing a offline KSK by not
- * requiring that the old RRSIG be deleted.  It also simpifies key
- * rollover by only requiring that the new RRSIG be added.
 */
 static isc_boolean_t
 replaces_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) {
-	dns_rdata_rrsig_t updatesig, dbsig;
-	isc_result_t result;
-
 	if (db_rr->type != update_rr->type)
 		return (ISC_FALSE);
 	if (db_rr->type == dns_rdatatype_cname)
@@ -1118,20 +1049,6 @@ replaces_p(dns_rdata_t *update_rr, dns_rdata_t *db_rr) {
 		return (ISC_TRUE);
 	if (db_rr->type == dns_rdatatype_nsec)
 		return (ISC_TRUE);
-	if (db_rr->type == dns_rdatatype_rrsig) {
-		/*
-		 * Replace existing RRSIG with the same keyid,
-		 * covered and algorithm.
-		 */
-		result = dns_rdata_tostruct(db_rr, &dbsig, NULL);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		result = dns_rdata_tostruct(update_rr, &updatesig, NULL);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		if (dbsig.keyid == updatesig.keyid &&
-		    dbsig.covered == updatesig.covered &&
-		    dbsig.algorithm == updatesig.algorithm)
-			return (ISC_TRUE);
-	}
 	if (db_rr->type == dns_rdatatype_wks) {
 		/*
 		 * Compare the address and protocol fields only.  These
@@ -1211,7 +1128,7 @@ typedef struct {

 static isc_result_t
 add_rr_prepare_action(void *data, rr_t *rr) {
-	isc_result_t result = ISC_R_SUCCESS;
+	isc_result_t result = ISC_R_SUCCESS;	
 	add_rr_prepare_ctx_t *ctx = data;
 	dns_difftuple_t *tuple = NULL;
 	isc_boolean_t equal;
@@ -1549,7 +1466,6 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	dns_dbiterator_t *dbit = NULL;
 	isc_boolean_t has_nsec;
 	unsigned int wraps = 0;
-	isc_boolean_t secure = dns_db_issecure(db);

 	CHECK(dns_db_createiterator(db, ISC_FALSE, &dbit));

@@ -1587,29 +1503,9 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 		 * we must pause the iterator first.
 		 */
 		CHECK(dns_dbiterator_pause(dbit));
-		if (secure) {
-			CHECK(rrset_exists(db, ver, newname,
-					   dns_rdatatype_nsec, 0, &has_nsec));
-		} else {
-			dns_fixedname_t ffound;
-			dns_name_t *found;
-			dns_fixedname_init(&ffound);
-			found = dns_fixedname_name(&ffound);
-			result = dns_db_find(db, newname, ver,
-					     dns_rdatatype_soa,
-					     DNS_DBFIND_NOWILD, 0, NULL, found,
-					     NULL, NULL);
-			if (result == ISC_R_SUCCESS ||
-			    result == DNS_R_EMPTYNAME ||
-			    result == DNS_R_NXRRSET ||
-			    result == DNS_R_CNAME ||
-			    (result == DNS_R_DELEGATION &&
-			     dns_name_equal(newname, found))) {
-				has_nsec = ISC_TRUE;
-				result = ISC_R_SUCCESS;
-			} else if (result != DNS_R_NXDOMAIN)
-				break;
-		}
+		CHECK(rrset_exists(db, ver, newname,
+				   dns_rdatatype_nsec, 0, &has_nsec));
+
 	} while (! has_nsec);
 failure:
 	if (dbit != NULL)
@@ -1618,35 +1514,6 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	return (result);
 }

-static isc_boolean_t
-has_opt_bit(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node) {
-	isc_result_t result;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dns_rdataset_t rdataset;
-	isc_boolean_t has_bit = ISC_FALSE;
-
-	dns_rdataset_init(&rdataset);
-	CHECK(dns_db_findrdataset(db, node, version, dns_rdatatype_nsec,
-				  dns_rdatatype_none, 0, &rdataset, NULL));
-	CHECK(dns_rdataset_first(&rdataset));
-	dns_rdataset_current(&rdataset, &rdata);
-	has_bit = dns_nsec_typepresent(&rdata, dns_rdatatype_opt);
- failure:
-	if (dns_rdataset_isassociated(&rdataset))
-		dns_rdataset_disassociate(&rdataset);
-	return (has_bit);
-}
-
-static void
-set_bit(unsigned char *array, unsigned int index) {
-	unsigned int shift, mask;
-
-	shift = 7 - (index % 8);
-	mask = 1 << shift;
-
-	array[index / 8] |= mask;
-}
-
 /*%
 * Add a NSEC record for "name", recording the change in "diff".
 * The existing NSEC is removed.
@@ -1678,24 +1545,6 @@ add_nsec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	CHECK(dns_db_findnode(db, name, ISC_FALSE, &node));
 	dns_rdata_init(&rdata);
 	CHECK(dns_nsec_buildrdata(db, ver, node, target, buffer, &rdata));
-	/*
-	 * Preserve the status of the OPT bit in the origin's NSEC record.
-	 */
-	if (dns_name_equal(dns_db_origin(db), name) &&
-	    has_opt_bit(db, ver, node))
-	{
-			isc_region_t region;
-			dns_name_t next;
-
-			dns_name_init(&next, NULL);
-			dns_rdata_toregion(&rdata, &region);
-			dns_name_fromregion(&next, &region);
-			isc_region_consume(&region, next.length);
-			INSIST(region.length > (2 + dns_rdatatype_opt / 8) &&
-			       region.base[0] == 0 &&
-			       region.base[1] > dns_rdatatype_opt / 8);
-			set_bit(region.base + 2, dns_rdatatype_opt);
-	}
 	dns_db_detachnode(db, &node);

 	/*
@@ -1799,11 +1648,10 @@ ksk_sanity(dns_db_t *db, dns_dbversion_t *ver) {
 * Add RRSIG records for an RRset, recording the change in "diff".
 */
 static isc_result_t
-add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
-	 dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type,
-	 dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys,
-	 isc_mem_t *mctx, isc_stdtime_t inception, isc_stdtime_t expire,
-	 isc_boolean_t check_ksk)
+add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
+	 dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys,
+	 unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception,
+	 isc_stdtime_t expire, isc_boolean_t check_ksk)
 {
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
@@ -1812,7 +1660,6 @@ add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	isc_buffer_t buffer;
 	unsigned char data[1024]; /* XXX */
 	unsigned int i;
-	isc_boolean_t added_sig = ISC_FALSE;

 	dns_rdataset_init(&rdataset);
 	isc_buffer_init(&buffer, data, sizeof(data));
@@ -1824,14 +1671,14 @@ add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	dns_db_detachnode(db, &node);

 	for (i = 0; i < nkeys; i++) {
-
+		
 		if (check_ksk && type != dns_rdatatype_dnskey &&
 		    (dst_key_flags(keys[i]) & DNS_KEYFLAG_KSK) != 0)
 			continue;

 		if (!dst_key_isprivate(keys[i]))
 			continue;
-
+		
 		/* Calculate the signature, creating a RRSIG RDATA. */
 		CHECK(dns_dnssec_sign(name, &rdataset, keys[i],
 				      &inception, &expire,
@@ -1839,16 +1686,9 @@ add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,

 		/* Update the database and journal with the RRSIG. */
 		/* XXX inefficient - will cause dataset merging */
-		CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADDRESIGN, name,
+		CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADD, name,
 				    rdataset.ttl, &sig_rdata));
 		dns_rdata_reset(&sig_rdata);
-		added_sig = ISC_TRUE;
-	}
-	if (!added_sig) {
-		update_log(client, zone, ISC_LOG_ERROR,
-			   "found no private keys, "
-			   "unable to generate any signatures");
-		result = ISC_R_NOTFOUND;
 	}

 failure:
@@ -1859,82 +1699,6 @@ add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	return (result);
 }

-/*
- * Delete expired RRsigs and any RRsigs we are about to re-sign.
- * See also zone.c:del_sigs().
- */
-static isc_result_t
-del_keysigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
-	    dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys)
-{
-	isc_result_t result;
-	dns_dbnode_t *node = NULL;
-	dns_rdataset_t rdataset;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	unsigned int i;
-	dns_rdata_rrsig_t rrsig;
-	isc_boolean_t found;
-
-	dns_rdataset_init(&rdataset);
-
-	result = dns_db_findnode(db, name, ISC_FALSE, &node);
-	if (result == ISC_R_NOTFOUND)
-		return (ISC_R_SUCCESS);
-	if (result != ISC_R_SUCCESS)
-		goto failure;
-	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_rrsig,
-				     dns_rdatatype_dnskey, (isc_stdtime_t) 0,
-				     &rdataset, NULL);
-	dns_db_detachnode(db, &node);
-
-	if (result == ISC_R_NOTFOUND)
-		return (ISC_R_SUCCESS);
-	if (result != ISC_R_SUCCESS)
-		goto failure;
-
-	for (result = dns_rdataset_first(&rdataset);
-	     result == ISC_R_SUCCESS;
-	     result = dns_rdataset_next(&rdataset)) {
-		dns_rdataset_current(&rdataset, &rdata);
-		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
-		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		found = ISC_FALSE;
-		for (i = 0; i < nkeys; i++) {
-			if (rrsig.keyid == dst_key_id(keys[i])) {
-				found = ISC_TRUE;
-				if (!dst_key_isprivate(keys[i])) {
-					/*
-					 * The re-signing code in zone.c
-					 * will mark this as offline.
-					 * Just skip the record for now.
-					 */
-					break;
-				}
-				result = update_one_rr(db, ver, diff,
-						       DNS_DIFFOP_DEL, name,
-						       rdataset.ttl, &rdata);
-				break;
-			}
-		}
-		/*
-		 * If there is not a matching DNSKEY then delete the RRSIG.
-		 */
-		if (!found)
-			result = update_one_rr(db, ver, diff, DNS_DIFFOP_DEL,
-					       name, rdataset.ttl, &rdata);
-		dns_rdata_reset(&rdata);
-		if (result != ISC_R_SUCCESS)
-			break;
-	}
-	dns_rdataset_disassociate(&rdataset);
-	if (result == ISC_R_NOMORE)
-		result = ISC_R_SUCCESS;
-failure:
-	if (node != NULL)
-		dns_db_detachnode(db, &node);
-	return (result);
-}
-
 /*%
 * Update RRSIG and NSEC records affected by an update.  The original
 * update, including the SOA serial update but exluding the RRSIG & NSEC
@@ -1949,8 +1713,7 @@ failure:
 static isc_result_t
 update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 		  dns_dbversion_t *oldver, dns_dbversion_t *newver,
-		  dns_diff_t *diff, isc_uint32_t sigvalidityinterval,
-		  isc_boolean_t *deleted_zsk)
+		  dns_diff_t *diff, isc_uint32_t sigvalidityinterval)
 {
 	isc_result_t result;
 	dns_difftuple_t *t;
@@ -1975,7 +1738,6 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	dns_diff_init(client->mctx, &affected);

 	dns_diff_init(client->mctx, &sig_diff);
-	sig_diff.resign = dns_zone_getsigresigninginterval(zone);
 	dns_diff_init(client->mctx, &nsec_diff);
 	dns_diff_init(client->mctx, &nsec_mindiff);

@@ -1999,27 +1761,8 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	 */
 	check_ksk = ISC_TF((dns_zone_getoptions(zone) &
 			    DNS_ZONEOPT_UPDATECHECKKSK) != 0);
-	/*
-	 * If we are not checking the ZSK flag then all DNSKEY's are
-	 * already signing all RRsets so we don't need to trigger special
-	 * changes.
-	 */
-	if (*deleted_zsk && (!check_ksk || !ksk_sanity(db, oldver)))
-		*deleted_zsk = ISC_FALSE;
-
-	if (check_ksk) {
+	if (check_ksk)
 		check_ksk = ksk_sanity(db, newver);
-		if (!check_ksk && ksk_sanity(db, oldver))
-			update_log(client, zone, ISC_LOG_WARNING,
-				   "disabling update-check-ksk");
-	}
-
-	/*
-	 * If we have deleted a ZSK and we we still have some ZSK's
-	 * we don't need to convert the KSK's to a ZSK's.
-	 */
-	if (*deleted_zsk && check_ksk)
-		*deleted_zsk = ISC_FALSE;

 	/*
 	 * Get the NSEC's TTL from the SOA MINIMUM field.
@@ -2066,16 +1809,10 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 			 * Delete all old RRSIGs covering this type, since they
 			 * are all invalid when the signed RRset has changed.
 			 * We may not be able to recreate all of them - tough.
-			 * Special case changes to the zone's DNSKEY records
-			 * to support offline KSKs.
 			 */
-			if (type == dns_rdatatype_dnskey)
-				del_keysigs(db, newver, name, &sig_diff,
-					    zone_keys, nkeys);
-			else
-				CHECK(delete_if(true_p, db, newver, name,
-						dns_rdatatype_rrsig, type,
-						NULL, &sig_diff));
+			CHECK(delete_if(true_p, db, newver, name,
+					dns_rdatatype_rrsig, type,
+					NULL, &sig_diff));

 			/*
 			 * If this RRset still exists after the update,
@@ -2083,9 +1820,9 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 			 */
 			CHECK(rrset_exists(db, newver, name, type, 0, &flag));
 			if (flag) {
-				CHECK(add_sigs(client, zone, db, newver, name,
-					       type, &sig_diff, zone_keys,
-					       nkeys, client->mctx, inception,
+				CHECK(add_sigs(db, newver, name, type,
+					       &sig_diff, zone_keys, nkeys,
+					       client->mctx, inception,
 					       expire, check_ksk));
 			}
 		skip:
@@ -2269,10 +2006,10 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 					dns_rdatatype_rrsig, dns_rdatatype_nsec,
 					NULL, &sig_diff));
 		} else if (t->op == DNS_DIFFOP_ADD) {
-			CHECK(add_sigs(client, zone, db, newver, &t->name,
-				       dns_rdatatype_nsec, &sig_diff,
-				       zone_keys, nkeys, client->mctx,
-				       inception, expire, check_ksk));
+			CHECK(add_sigs(db, newver, &t->name, dns_rdatatype_nsec,
+				       &sig_diff, zone_keys, nkeys,
+				       client->mctx, inception, expire,
+				       check_ksk));
 		} else {
 			INSIST(0);
 		}
@@ -2425,10 +2162,6 @@ ns_update_start(ns_client_t *client, isc_result_t sigresult) {
 	return;

 failure:
-	if (result == DNS_R_REFUSED) {
-		INSIST(dns_zone_gettype(zone) == dns_zone_slave);
-		inc_stats(zone, dns_nsstatscounter_updaterej);
-	}
 	/*
 	 * We failed without having sent an update event to the zone.
 	 * We are still in the client task context, so we can
@@ -2539,7 +2272,7 @@ check_mx(ns_client_t *client, dns_zone_t *zone,
 				   ownerbuf, namebuf,
 				   dns_result_totext(DNS_R_MXISADDRESS));
 		}
-
+		
 		/*
 		 * Check zone integrity checks.
 		 */
@@ -2580,52 +2313,6 @@ check_mx(ns_client_t *client, dns_zone_t *zone,
 	return (ok ? ISC_R_SUCCESS : DNS_R_REFUSED);
 }

-static isc_result_t
-add_signing_records(dns_db_t *db, dns_name_t *name, dns_dbversion_t *ver,
-		    dns_rdatatype_t privatetype, dns_diff_t *diff)
-{
-	isc_result_t result = ISC_R_SUCCESS;
-	dns_difftuple_t *tuple, *newtuple = NULL;
-	dns_rdata_dnskey_t dnskey;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	unsigned char buf[4];
-	isc_region_t r;
-	isc_uint16_t keyid;
-
-	for (tuple = ISC_LIST_HEAD(diff->tuples);
-	     tuple != NULL;
-	     tuple = ISC_LIST_NEXT(tuple, link)) {
-		if (tuple->rdata.type != dns_rdatatype_dnskey ||
-		    tuple->op != DNS_DIFFOP_ADD)
-			continue;
-
-		dns_rdata_tostruct(&tuple->rdata, &dnskey, NULL);
-		if ((dnskey.flags &
-		     (DNS_KEYFLAG_OWNERMASK|DNS_KEYTYPE_NOAUTH))
-			 != DNS_KEYOWNER_ZONE)
-			continue;
-
-		dns_rdata_toregion(&tuple->rdata, &r);
-		keyid = dst_region_computeid(&r, dnskey.algorithm);
-
-		buf[0] = dnskey.algorithm;
-		buf[1] = (keyid & 0xff00) >> 8;
-		buf[2] = (keyid & 0xff);
-		buf[3] = 0;
-		rdata.data = buf;
-		rdata.length = sizeof(buf);
-		rdata.type = privatetype;
-		rdata.rdclass = tuple->rdata.rdclass;
-
-		CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name,
-					   0, &rdata, &newtuple));
-		CHECK(do_one_tuple(&newtuple, db, ver, diff));
-		INSIST(newtuple == NULL);
-	}
- failure:
-	return (result);
-}
-
 static void
 update_action(isc_task_t *task, isc_event_t *event) {
 	update_event_t *uev = (update_event_t *) event;
@@ -2648,9 +2335,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_fixedname_t tmpnamefixed;
 	dns_name_t *tmpname = NULL;
 	unsigned int options;
-	isc_boolean_t deleted_zsk;
-	dns_difftuple_t *tuple;
-	dns_rdata_dnskey_t dnskey;

 	INSIST(event->ev_type == DNS_EVENT_UPDATE);

@@ -2682,59 +2366,54 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			       &name, &rdata, &covers, &ttl, &update_class);

 		if (ttl != 0)
-			PREREQFAILC(DNS_R_FORMERR,
-				    "prerequisite TTL is not zero");
+			FAILC(DNS_R_FORMERR, "prerequisite TTL is not zero");

 		if (! dns_name_issubdomain(name, zonename))
-			PREREQFAILN(DNS_R_NOTZONE, name,
-				    "prerequisite name is out of zone");
+			FAILN(DNS_R_NOTZONE, name,
+				"prerequisite name is out of zone");

 		if (update_class == dns_rdataclass_any) {
 			if (rdata.length != 0)
-				PREREQFAILC(DNS_R_FORMERR,
+				FAILC(DNS_R_FORMERR,
 				      "class ANY prerequisite "
 				      "RDATA is not empty");
 			if (rdata.type == dns_rdatatype_any) {
 				CHECK(name_exists(db, ver, name, &flag));
 				if (! flag) {
-					PREREQFAILN(DNS_R_NXDOMAIN, name,
-						    "'name in use' "
-						    "prerequisite not "
-						    "satisfied");
+					FAILN(DNS_R_NXDOMAIN, name,
+					      "'name in use' prerequisite "
+					      "not satisfied");
 				}
 			} else {
 				CHECK(rrset_exists(db, ver, name,
 						   rdata.type, covers, &flag));
 				if (! flag) {
 					/* RRset does not exist. */
-					PREREQFAILNT(DNS_R_NXRRSET, name, rdata.type,
+					FAILNT(DNS_R_NXRRSET, name, rdata.type,
 					"'rrset exists (value independent)' "
 					"prerequisite not satisfied");
 				}
 			}
 		} else if (update_class == dns_rdataclass_none) {
 			if (rdata.length != 0)
-				PREREQFAILC(DNS_R_FORMERR,
-					    "class NONE prerequisite "
-					    "RDATA is not empty");
+				FAILC(DNS_R_FORMERR,
+				      "class NONE prerequisite "
+				      "RDATA is not empty");
 			if (rdata.type == dns_rdatatype_any) {
 				CHECK(name_exists(db, ver, name, &flag));
 				if (flag) {
-					PREREQFAILN(DNS_R_YXDOMAIN, name,
-						    "'name not in use' "
-						    "prerequisite not "
-						    "satisfied");
+					FAILN(DNS_R_YXDOMAIN, name,
+					      "'name not in use' prerequisite "
+					      "not satisfied");
 				}
 			} else {
 				CHECK(rrset_exists(db, ver, name,
 						   rdata.type, covers, &flag));
 				if (flag) {
 					/* RRset exists. */
-					PREREQFAILNT(DNS_R_YXRRSET, name,
-						     rdata.type,
-						     "'rrset does not exist' "
-						     "prerequisite not "
-						     "satisfied");
+					FAILNT(DNS_R_YXRRSET, name, rdata.type,
+					       "'rrset does not exist' "
+					       "prerequisite not satisfied");
 				}
 			}
 		} else if (update_class == zoneclass) {
@@ -2747,7 +2426,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 				FAIL(ISC_R_UNEXPECTED);
 			}
 		} else {
-			PREREQFAILC(DNS_R_FORMERR, "malformed prerequisite");
+			FAILC(DNS_R_FORMERR, "malformed prerequisite");
 		}
 	}
 	if (result != ISC_R_NOMORE)
@@ -2790,13 +2469,13 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	if (ssutable == NULL)
 		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 				     "update", zonename, ISC_FALSE, ISC_FALSE));
-	else if (client->signer == NULL && !TCPCLIENT(client))
+	else if (client->signer == NULL)
 		CHECK(checkupdateacl(client, NULL, "update", zonename,
 				     ISC_FALSE, ISC_TRUE));
-
+	
 	if (dns_zone_getupdatedisabled(zone))
 		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled "
-				     "because the zone is frozen.  Use "
+			             "because the zone is frozen.  Use "
 				     "'rndc thaw' to re-enable updates.");

 	/*
@@ -2857,39 +2536,25 @@ update_action(isc_task_t *task, isc_event_t *event) {
 				FAILC(DNS_R_REFUSED,
 				      "explicit NSEC updates are not allowed "
 				      "in secure zones");
-			} else if (rdata.type == dns_rdatatype_rrsig &&
-				   !dns_name_equal(name, zonename)) {
+			}
+			else if (rdata.type == dns_rdatatype_rrsig) {
 				FAILC(DNS_R_REFUSED,
-				      "explicit RRSIG updates are currently "
-				      "not supported in secure zones except "
-				      "at the apex");
+				      "explicit RRSIG updates are currently not "
+				      "supported in secure zones");
 			}
 		}

-		if (ssutable != NULL) {
-			isc_netaddr_t *tcpaddr, netaddr;
-			/*
-			 * If this is a TCP connection then pass the
-			 * address of the client through for tcp-self
-			 * and 6to4-self otherwise pass NULL.  This
-			 * provides weak address based authentication.
-			 */
-			if (TCPCLIENT(client)) {
-				isc_netaddr_fromsockaddr(&netaddr,
-							 &client->peeraddr);
-				tcpaddr = &netaddr;
-			} else
-				tcpaddr = NULL;
+		if (ssutable != NULL && client->signer != NULL) {
 			if (rdata.type != dns_rdatatype_any) {
 				if (!dns_ssutable_checkrules(ssutable,
 							     client->signer,
-							     name, tcpaddr,
-							     rdata.type))
+							     name, rdata.type))
 					FAILC(DNS_R_REFUSED,
 					      "rejected by secure update");
-			} else {
+			}
+			else {
 				if (!ssu_checkall(db, ver, name, ssutable,
-						  client->signer, tcpaddr))
+						  client->signer))
 					FAILC(DNS_R_REFUSED,
 					      "rejected by secure update");
 			}
@@ -3138,7 +2803,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	if (! ISC_LIST_EMPTY(diff.tuples)) {
 		char *journalfile;
 		dns_journal_t *journal;
-		isc_boolean_t has_dnskey;

 		/*
 		 * Increment the SOA serial, but only if it was not
@@ -3152,19 +2816,10 @@ update_action(isc_task_t *task, isc_event_t *event) {

 		CHECK(remove_orphaned_ds(db, ver, &diff));

-		CHECK(add_signing_records(db, zonename, ver,
-					  dns_zone_getprivatetype(zone),
-					  &diff));
-
-		CHECK(rrset_exists(db, ver, zonename, dns_rdatatype_dnskey,
-				   0, &has_dnskey));
-
-		if (has_dnskey && dns_db_isdnssec(db)) {
-			isc_uint32_t interval;
-			interval = dns_zone_getsigvalidityinterval(zone);
+		if (dns_db_issecure(db)) {
 			result = update_signatures(client, zone, db, oldver,
-						   ver, &diff, interval,
-						   &deleted_zsk);
+						   ver, &diff,
+					 dns_zone_getsigvalidityinterval(zone));
 			if (result != ISC_R_SUCCESS) {
 				update_log(client, zone,
 					   ISC_LOG_ERROR,
@@ -3201,7 +2856,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
 		 */
 		update_log(client, zone, LOGLEVEL_DEBUG,
 			   "committing update transaction");
-
 		dns_db_closeversion(db, &ver, ISC_TRUE);

 		/*
@@ -3213,35 +2867,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
 		 * Notify slaves of the change we just made.
 		 */
 		dns_zone_notify(zone);
-
-		for (tuple = ISC_LIST_HEAD(diff.tuples);
-		     tuple != NULL;
-		     tuple = ISC_LIST_NEXT(tuple, link)) {
-			isc_region_t r;
-			dns_secalg_t algorithm;
-			isc_uint16_t keyid;
-
-			if (tuple->rdata.type != dns_rdatatype_dnskey ||
-			    tuple->op != DNS_DIFFOP_ADD)
-				continue;
-
-			dns_rdata_tostruct(&tuple->rdata, &dnskey, NULL);
-			if ((dnskey.flags &
-			     (DNS_KEYFLAG_OWNERMASK|DNS_KEYTYPE_NOAUTH))
-				 != DNS_KEYOWNER_ZONE)
-				continue;
-
-			dns_rdata_toregion(&tuple->rdata, &r);
-			algorithm = dnskey.algorithm;
-			keyid = dst_region_computeid(&r, algorithm);
-
-			result = dns_zone_signwithkey(zone, algorithm, keyid);
-			if (result != ISC_R_SUCCESS) {
-				update_log(client, zone, ISC_LOG_ERROR,
-					   "dns_zone_signwithkey failed: %s",
-					   dns_result_totext(result));
-			}
-		}
 	} else {
 		update_log(client, zone, LOGLEVEL_DEBUG, "redundant request");
 		dns_db_closeversion(db, &ver, ISC_TRUE);
@@ -3250,14 +2875,11 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	goto common;

 failure:
-	if (result == DNS_R_REFUSED)
-		inc_stats(zone, dns_nsstatscounter_updaterej);
-
 	/*
 	 * The reason for failure should have been logged at this point.
 	 */
 	if (ver != NULL) {
-		update_log(client, zone, LOGLEVEL_DEBUG,
+		update_log(client, zone, LOGLEVEL_DEBUG, 
 			   "rolling back");
 		dns_db_closeversion(db, &ver, ISC_FALSE);
 	}
@@ -3275,10 +2897,11 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	if (ssutable != NULL)
 		dns_ssutable_detach(&ssutable);

+	if (zone != NULL)
+		dns_zone_detach(&zone);
+
 	isc_task_detach(&task);
 	uev->result = result;
-	if (zone != NULL)
-		INSIST(uev->zone == zone); /* we use this later */
 	uev->ev_type = DNS_EVENT_UPDATEDONE;
 	uev->ev_action = updatedone_action;
 	isc_task_send(client->task, &event);
@@ -3296,19 +2919,6 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
 	INSIST(task == client->task);

 	INSIST(client->nupdates > 0);
-	switch (uev->result) {
-	case ISC_R_SUCCESS:
-		inc_stats(uev->zone, dns_nsstatscounter_updatedone);
-		break;
-	case DNS_R_REFUSED:
-		inc_stats(uev->zone, dns_nsstatscounter_updaterej);
-		break;
-	default:
-		inc_stats(uev->zone, dns_nsstatscounter_updatefail);
-		break;
-	}
-	if (uev->zone != NULL)
-		dns_zone_detach(&uev->zone);
 	client->nupdates--;
 	respond(client, uev->result);
 	isc_event_free(&event);
@@ -3337,21 +2947,17 @@ static void
 forward_callback(void *arg, isc_result_t result, dns_message_t *answer) {
 	update_event_t *uev = arg;
 	ns_client_t *client = uev->ev_arg;
-	dns_zone_t *zone = uev->zone;

 	if (result != ISC_R_SUCCESS) {
 		INSIST(answer == NULL);
 		uev->ev_type = DNS_EVENT_UPDATEDONE;
 		uev->ev_action = forward_fail;
-		inc_stats(zone, dns_nsstatscounter_updatefwdfail);
 	} else {
 		uev->ev_type = DNS_EVENT_UPDATEDONE;
 		uev->ev_action = forward_done;
 		uev->answer = answer;
-		inc_stats(zone, dns_nsstatscounter_updaterespfwd);
 	}
 	isc_task_send(client->task, ISC_EVENT_PTR(&uev));
-	dns_zone_detach(&zone);
 }

 static void
@@ -3382,10 +2988,8 @@ forward_action(isc_task_t *task, isc_event_t *event) {
 		uev->ev_type = DNS_EVENT_UPDATEDONE;
 		uev->ev_action = forward_fail;
 		isc_task_send(client->task, &event);
-		inc_stats(zone, dns_nsstatscounter_updatefwdfail);
-		dns_zone_detach(&zone);
-	} else
-		inc_stats(zone, dns_nsstatscounter_updatereqfwd);
+	}
+	dns_zone_detach(&zone);
 	isc_task_detach(&task);
 }

@@ -188,10 +188,6 @@ SOURCE=..\sortlist.c
 # End Source File
 # Begin Source File

-SOURCE=..\statschannel.c
-# End Source File
-# Begin Source File
-
 SOURCE=..\tkeyconf.c
 # End Source File
 # Begin Source File
@@ -292,10 +288,6 @@ SOURCE=..\include\named\sortlist.h
 # End Source File
 # Begin Source File

-SOURCE=..\include\named\statschannel.h
-# End Source File
-# Begin Source File
-
 SOURCE=..\include\named\tkeyconf.h
 # End Source File
 # Begin Source File
@@ -148,7 +148,6 @@ CLEAN :
 	-@erase "$(INTDIR)\query.obj"
 	-@erase "$(INTDIR)\server.obj"
 	-@erase "$(INTDIR)\sortlist.obj"
-	-@erase "$(INTDIR)\statschannel.obj"
 	-@erase "$(INTDIR)\tkeyconf.obj"
 	-@erase "$(INTDIR)\tsigconf.obj"
 	-@erase "$(INTDIR)\update.obj"
@@ -193,7 +192,6 @@ LINK32_OBJS= \
 	"$(INTDIR)\query.obj" \
 	"$(INTDIR)\server.obj" \
 	"$(INTDIR)\sortlist.obj" \
-	"$(INTDIR)\statschannel.obj" \
 	"$(INTDIR)\tkeyconf.obj" \
 	"$(INTDIR)\tsigconf.obj" \
 	"$(INTDIR)\update.obj" \
@@ -286,8 +284,6 @@ CLEAN :
 	-@erase "$(INTDIR)\server.sbr"
 	-@erase "$(INTDIR)\sortlist.obj"
 	-@erase "$(INTDIR)\sortlist.sbr"
-	-@erase "$(INTDIR)\statschannel.obj"
-	-@erase "$(INTDIR)\statschannel.sbr"
 	-@erase "$(INTDIR)\tkeyconf.obj"
 	-@erase "$(INTDIR)\tkeyconf.sbr"
 	-@erase "$(INTDIR)\tsigconf.obj"
@@ -338,7 +334,6 @@ BSC32_SBRS= \
 	"$(INTDIR)\query.sbr" \
 	"$(INTDIR)\server.sbr" \
 	"$(INTDIR)\sortlist.sbr" \
-	"$(INTDIR)\statschannel.sbr" \
 	"$(INTDIR)\tkeyconf.sbr" \
 	"$(INTDIR)\tsigconf.sbr" \
 	"$(INTDIR)\update.sbr" \
@@ -378,7 +373,6 @@ LINK32_OBJS= \
 	"$(INTDIR)\query.obj" \
 	"$(INTDIR)\server.obj" \
 	"$(INTDIR)\sortlist.obj" \
-	"$(INTDIR)\statschannel.obj" \
 	"$(INTDIR)\tkeyconf.obj" \
 	"$(INTDIR)\tsigconf.obj" \
 	"$(INTDIR)\update.obj" \
@@ -885,24 +879,6 @@ SOURCE=..\sortlist.c
 	$(CPP) $(CPP_PROJ) $(SOURCE)


-!ENDIF 
-
-SOURCE=..\statschannel.c
-
-!IF  "$(CFG)" == "named - Win32 Release"
-
-
-"$(INTDIR)\statschannel.obj" : $(SOURCE) "$(INTDIR)"
-	$(CPP) $(CPP_PROJ) $(SOURCE)
-
-
-!ELSEIF  "$(CFG)" == "named - Win32 Debug"
-
-
-"$(INTDIR)\statschannel.obj"	"$(INTDIR)\statschannel.sbr" : $(SOURCE) "$(INTDIR)"
-	$(CPP) $(CPP_PROJ) $(SOURCE)
-
-
 !ENDIF 

 SOURCE=..\tkeyconf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: os.c,v 1.28 2008/01/18 23:46:57 tbox Exp $ */
+/* $Id: os.c,v 1.25 2007/06/19 23:46:59 tbox Exp $ */

 #include <config.h>
 #include <stdarg.h>
@@ -51,7 +51,7 @@ static int devnullfd = -1;

 static BOOL Initialized = FALSE;

-static char *version_error =
+static char *version_error = 
 	"named requires Windows 2000 Service Pack 2 or later to run correctly";

 void
@@ -83,7 +83,7 @@ version_check(const char *progname) {
 	if(isc_win32os_versioncheck(5, 0, 2, 0) < 0)
 		if (ntservice_isservice())
 			NTReportError(progname, version_error);
-		else
+		else 
 			fprintf(stderr, "%s\n", version_error);
 }

@@ -103,16 +103,7 @@ void
 ns_os_init(const char *progname) {
 	ns_paths_init();
 	setup_syslog(progname);
-	/*
-	 * XXXMPA. We may need to split ntservice_init() in two and
-	 * just mark as running in ns_os_started().  If we do that
-	 * this is where the first part of ntservice_init() should be
-	 * called from.
-	 *
-	 * XXX970 Remove comment if no problems by 9.7.0.
-	 *
-	 * ntservice_init();
-	 */
+	ntservice_init();
 	version_check(progname);
 }

@@ -294,5 +285,4 @@ ns_os_tzset(void) {

 void
 ns_os_started(void) {
-	ntservice_init();
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: xfrout.c,v 1.128 2008/04/03 06:09:04 tbox Exp $ */
+/* $Id: xfrout.c,v 1.126 2007/06/18 23:47:19 tbox Exp $ */

 #include <config.h>

@@ -40,7 +40,6 @@
 #include <dns/rdatasetiter.h>
 #include <dns/result.h>
 #include <dns/soa.h>
-#include <dns/stats.h>
 #include <dns/timer.h>
 #include <dns/tsig.h>
 #include <dns/view.h>
@@ -52,7 +51,7 @@
 #include <named/server.h>
 #include <named/xfrout.h>

-/*! \file
+/*! \file 
 * \brief
 * Outgoing AXFR and IXFR.
 */
@@ -87,7 +86,7 @@
 		ns_client_log(client, DNS_LOGCATEGORY_XFER_OUT, \
 			   NS_LOGMODULE_XFER_OUT, ISC_LOG_INFO, \
 			   "bad zone transfer request: %s (%s)", \
-			   msg, isc_result_totext(code));	\
+		      	   msg, isc_result_totext(code));	\
 		if (result != ISC_R_SUCCESS) goto failure;	\
 	} while (0)

@@ -101,12 +100,12 @@
 		ns_client_log(client, DNS_LOGCATEGORY_XFER_OUT, \
 			   NS_LOGMODULE_XFER_OUT, ISC_LOG_INFO, \
 			   "bad zone transfer request: '%s/%s': %s (%s)", \
-			   _buf1, _buf2, msg, isc_result_totext(code));	\
+		      	   _buf1, _buf2, msg, isc_result_totext(code));	\
 		if (result != ISC_R_SUCCESS) goto failure;	\
 	} while (0)

 #define CHECK(op) \
-	do { result = (op); 					\
+     	do { result = (op); 					\
 		if (result != ISC_R_SUCCESS) goto failure; 	\
 	} while (0)

@@ -122,12 +121,12 @@ typedef struct db_rr_iterator db_rr_iterator_t;
 struct db_rr_iterator {
 	isc_result_t		result;
 	dns_db_t		*db;
-	dns_dbiterator_t 	*dbit;
+    	dns_dbiterator_t 	*dbit;
 	dns_dbversion_t 	*ver;
 	isc_stdtime_t		now;
 	dns_dbnode_t		*node;
 	dns_fixedname_t		fixedname;
-	dns_rdatasetiter_t 	*rdatasetit;
+    	dns_rdatasetiter_t 	*rdatasetit;
 	dns_rdataset_t 		rdataset;
 	dns_rdata_t		rdata;
 };
@@ -149,16 +148,6 @@ db_rr_iterator_current(db_rr_iterator_t *it, dns_name_t **name,
 static void
 db_rr_iterator_destroy(db_rr_iterator_t *it);

-static inline void
-inc_stats(dns_zone_t *zone, dns_statscounter_t counter) {
-	dns_generalstats_increment(ns_g_server->nsstats, counter);
-	if (zone != NULL) {
-		dns_stats_t *zonestats = dns_zone_getrequeststats(zone);
-		if (zonestats != NULL)
-			dns_generalstats_increment(zonestats, counter);
-	}
-}
-
 static isc_result_t
 db_rr_iterator_init(db_rr_iterator_t *it, dns_db_t *db, dns_dbversion_t *ver,
 		    isc_stdtime_t now)
@@ -337,7 +326,7 @@ log_rr(dns_name_t *name, dns_rdata_t *rdata, isc_uint32_t ttl) {
 		INSIST(buf.used >= 1 &&
 		       ((char *) buf.base)[buf.used - 1] == '\n');
 		buf.used--;
-
+		
 		isc_log_write(XFROUT_RR_LOGARGS, "%.*s",
 			      (int)isc_buffer_usedlength(&buf),
 			      (char *)isc_buffer_base(&buf));
@@ -829,7 +818,6 @@ typedef struct {
 	dns_name_t		*qname;		/* Question name of request */
 	dns_rdatatype_t		qtype;		/* dns_rdatatype_{a,i}xfr */
 	dns_rdataclass_t	qclass;
-	dns_zone_t 		*zone;		/* (necessary for stats) */
 	dns_db_t 		*db;
 	dns_dbversion_t 	*ver;
 	isc_quota_t		*quota;
@@ -853,7 +841,7 @@ typedef struct {
 static isc_result_t
 xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client,
 		  unsigned int id, dns_name_t *qname, dns_rdatatype_t qtype,
-		  dns_rdataclass_t qclass, dns_zone_t *zone,
+		  dns_rdataclass_t qclass,
 		  dns_db_t *db, dns_dbversion_t *ver, isc_quota_t *quota,
 		  rrstream_t *stream, dns_tsigkey_t *tsigkey,
 		  isc_buffer_t *lasttsig,
@@ -981,7 +969,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		/*
 		 * Normal zone table does not have a match.  Try the DLZ database
 		 */
-		if (client->view->dlzdatabase != NULL) {
+	    	if (client->view->dlzdatabase != NULL) {
 			result = dns_dlzallowzonexfr(client->view,
 						     question_name, &client->peeraddr,
 						     &db);
@@ -1018,7 +1006,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {

 		} else {
 			/*
-			 * not DLZ and not in normal zone table, we are
+		 	 * not DLZ and not in normal zone table, we are
 			 * not authoritative
 			 */
 			FAILQ(DNS_R_NOTAUTH, "non-authoritative zone",
@@ -1222,28 +1210,26 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {

 #ifdef DLZ
 	if (is_dlz)
-		CHECK(xfrout_ctx_create(mctx, client, request->id, question_name,
-					reqtype, question_class, zone, db, ver,
-					quota, stream,
-					dns_message_gettsigkey(request),
-					tsigbuf,
-					3600,
-					3600,
-					(format == dns_many_answers) ?
-					ISC_TRUE : ISC_FALSE,
-					&xfr));
-	else
+ 		CHECK(xfrout_ctx_create(mctx, client, request->id, question_name,
+ 					reqtype, question_class, db, ver, quota,
+ 					stream, dns_message_gettsigkey(request),
+ 					tsigbuf,
+ 					3600,
+ 					3600,
+ 					(format == dns_many_answers) ?
+  					ISC_TRUE : ISC_FALSE,
+ 					&xfr));
+ 	else
 #endif
-		CHECK(xfrout_ctx_create(mctx, client, request->id, question_name,
-					reqtype, question_class, zone, db, ver,
-					quota, stream,
-					dns_message_gettsigkey(request),
-					tsigbuf,
-					dns_zone_getmaxxfrout(zone),
-					dns_zone_getidleout(zone),
-					(format == dns_many_answers) ?
-					ISC_TRUE : ISC_FALSE,
-					&xfr));
+ 		CHECK(xfrout_ctx_create(mctx, client, request->id, question_name,
+ 					reqtype, question_class, db, ver, quota,
+ 					stream, dns_message_gettsigkey(request),
+ 					tsigbuf,
+ 					dns_zone_getmaxxfrout(zone),
+ 					dns_zone_getidleout(zone),
+ 					(format == dns_many_answers) ?
+ 					ISC_TRUE : ISC_FALSE,
+ 					&xfr));

 	xfr->mnemonic = mnemonic;
 	stream = NULL;
@@ -1275,8 +1261,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	result = ISC_R_SUCCESS;

 failure:
-	if (result == DNS_R_REFUSED)
-		inc_stats(zone, dns_nsstatscounter_xfrrej);
 	if (quota != NULL)
 		isc_quota_detach(&quota);
 	if (current_soa_tuple != NULL)
@@ -1307,7 +1291,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 static isc_result_t
 xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 		  dns_name_t *qname, dns_rdatatype_t qtype,
-		  dns_rdataclass_t qclass, dns_zone_t *zone,
+		  dns_rdataclass_t qclass,
 		  dns_db_t *db, dns_dbversion_t *ver, isc_quota_t *quota,
 		  rrstream_t *stream, dns_tsigkey_t *tsigkey,
 		  isc_buffer_t *lasttsig, unsigned int maxtime,
@@ -1330,10 +1314,8 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 	xfr->qname = qname;
 	xfr->qtype = qtype;
 	xfr->qclass = qclass;
-	xfr->zone = NULL;
 	xfr->db = NULL;
 	xfr->ver = NULL;
-	dns_zone_attach(zone, &xfr->zone);
 	dns_db_attach(db, &xfr->db);
 	dns_db_attachversion(db, ver, &xfr->ver);
 	xfr->end_of_stream = ISC_FALSE;
@@ -1681,7 +1663,7 @@ sendstream(xfrout_ctx_t *xfr) {
 	 * iterators before returning from the event handler.
 	 */
 	xfr->stream->methods->pause(xfr->stream);
-
+	
 	if (result == ISC_R_SUCCESS)
 		return;

@@ -1709,8 +1691,6 @@ xfrout_ctx_destroy(xfrout_ctx_t **xfrp) {
 		isc_quota_detach(&xfr->quota);
 	if (xfr->ver != NULL)
 		dns_db_closeversion(xfr->db, &xfr->ver, ISC_FALSE);
-	if (xfr->zone != NULL)
-		dns_zone_detach(&xfr->zone);
 	if (xfr->db != NULL)
 		dns_db_detach(&xfr->db);

@@ -1744,7 +1724,6 @@ xfrout_senddone(isc_task_t *task, isc_event_t *event) {
 		sendstream(xfr);
 	} else {
 		/* End of zone transfer stream. */
-		inc_stats(xfr->zone, dns_nsstatscounter_xfrdone);
 		xfrout_log(xfr, ISC_LOG_INFO, "%s ended", xfr->mnemonic);
 		ns_client_next(xfr->client, ISC_R_SUCCESS);
 		xfrout_ctx_destroy(&xfr);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: zoneconf.c,v 1.146 2008/05/21 23:47:00 tbox Exp $ */
+/* $Id: zoneconf.c,v 1.139 2007/09/18 00:22:30 marka Exp $ */

 /*% */

@@ -34,7 +34,6 @@
 #include <dns/name.h>
 #include <dns/rdatatype.h>
 #include <dns/ssu.h>
-#include <dns/stats.h>
 #include <dns/view.h>
 #include <dns/zone.h>

@@ -45,15 +44,6 @@
 #include <named/server.h>
 #include <named/zoneconf.h>

-/* ACLs associated with zone */
-typedef enum {
-	allow_notify,
-	allow_query,
-	allow_transfer,
-	allow_update,
-	allow_update_forwarding
-} acl_type_t;
-
 /*%
 * These are BIND9 server defaults, not necessarily identical to the
 * library defaults defined in zone.c.
@@ -69,69 +59,19 @@ typedef enum {
 */
 static isc_result_t
 configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
-		   const cfg_obj_t *config, acl_type_t acltype,
-		   cfg_aclconfctx_t *actx, dns_zone_t *zone,
+		   const cfg_obj_t *config, const char *aclname,
+		   cfg_aclconfctx_t *actx, dns_zone_t *zone, 
 		   void (*setzacl)(dns_zone_t *, dns_acl_t *),
 		   void (*clearzacl)(dns_zone_t *))
 {
 	isc_result_t result;
-	const cfg_obj_t *maps[5] = {NULL, NULL, NULL, NULL, NULL};
+	const cfg_obj_t *maps[5];
 	const cfg_obj_t *aclobj = NULL;
 	int i = 0;
-	dns_acl_t **aclp = NULL, *acl = NULL;
-	const char *aclname;
-	dns_view_t *view;
+	dns_acl_t *dacl = NULL;

-	view = dns_zone_getview(zone);
-
-	switch (acltype) {
-	    case allow_notify:
-		if (view != NULL)
-			aclp = &view->notifyacl;
-		aclname = "allow-notify";
-		break;
-	    case allow_query:
-		if (view != NULL)
-			aclp = &view->queryacl;
-		aclname = "allow-query";
-		break;
-	    case allow_transfer:
-		if (view != NULL)
-			aclp = &view->transferacl;
-		aclname = "allow-transfer";
-		break;
-	    case allow_update:
-		if (view != NULL)
-			aclp = &view->updateacl;
-		aclname = "allow-update";
-		break;
-	    case allow_update_forwarding:
-		if (view != NULL)
-			aclp = &view->upfwdacl;
-		aclname = "allow-update-forwarding";
-		break;
-	    default:
-		INSIST(0);
-		return (ISC_R_FAILURE);
-	}
-
-	/* First check to see if ACL is defined within the zone */
-	if (zconfig != NULL) {
-		maps[0] = cfg_tuple_get(zconfig, "options");
-		ns_config_get(maps, aclname, &aclobj);
-		if (aclobj != NULL) {
-			aclp = NULL;
-			goto parse_acl;
-		}
-	}
-
-	/* Failing that, see if there's a default ACL already in the view */
-	if (aclp != NULL && *aclp != NULL) {
-		(*setzacl)(zone, *aclp);
-		return (ISC_R_SUCCESS);
-	}
-
-	/* Check for default ACLs that haven't been parsed yet */
+	if (zconfig != NULL)
+		maps[i++] = cfg_tuple_get(zconfig, "options");
 	if (vconfig != NULL)
 		maps[i++] = cfg_tuple_get(vconfig, "options");
 	if (config != NULL) {
@@ -149,18 +89,12 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 		return (ISC_R_SUCCESS);
 	}

-parse_acl:
 	result = cfg_acl_fromconfig(aclobj, config, ns_g_lctx, actx,
-				    dns_zone_getmctx(zone), 0, &acl);
+				    dns_zone_getmctx(zone), 0, &dacl);
 	if (result != ISC_R_SUCCESS)
 		return (result);
-	(*setzacl)(zone, acl);
-
-	/* Set the view default now */
-	if (aclp != NULL)
-		dns_acl_attach(acl, aclp);
-
-	dns_acl_detach(&acl);
+	(*setzacl)(zone, dacl);
+	dns_acl_detach(&dacl);
 	return (ISC_R_SUCCESS);
 }

@@ -232,10 +166,6 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {
 			mtype = DNS_SSUMATCHTYPE_SUBDOMAINMS;
 		else if (strcasecmp(str, "krb5-subdomain") == 0)
 			mtype = DNS_SSUMATCHTYPE_SUBDOMAINKRB5;
-		else if (strcasecmp(str, "tcp-self") == 0)
-			mtype = DNS_SSUMATCHTYPE_TCPSELF;
-		else if (strcasecmp(str, "6to4-self") == 0)
-			mtype = DNS_SSUMATCHTYPE_6TO4SELF;
 		else
 			INSIST(0);

@@ -342,11 +272,11 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp,
 	     char ***argvp, unsigned int n)
 {
 	isc_result_t result;
-
+	
 	/* Discard leading whitespace. */
 	while (*s == ' ' || *s == '\t')
 		s++;
-
+	
 	if (*s == '\0') {
 		/* We have reached the end of the string. */
 		*argcp = n;
@@ -431,9 +361,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	isc_boolean_t warn = ISC_FALSE, ignore = ISC_FALSE;
 	isc_boolean_t ixfrdiff;
 	dns_masterformat_t masterformat;
-	dns_stats_t *zoneqrystats;
-	isc_boolean_t zonestats_on;
-	int seconds;

 	i = 0;
 	if (zconfig != NULL) {
@@ -524,14 +451,14 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 	if (ztype == dns_zone_slave)
 		RETERR(configure_zone_acl(zconfig, vconfig, config,
-					  allow_notify, ac, zone,
+					  "allow-notify", ac, zone,
 					  dns_zone_setnotifyacl,
 					  dns_zone_clearnotifyacl));
 	/*
 	 * XXXAG This probably does not make sense for stubs.
 	 */
 	RETERR(configure_zone_acl(zconfig, vconfig, config,
-				  allow_query, ac, zone,
+				  "allow-query", ac, zone,
 				  dns_zone_setqueryacl,
 				  dns_zone_clearqueryacl));

@@ -561,15 +488,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	obj = NULL;
 	result = ns_config_get(maps, "zone-statistics", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	zonestats_on = cfg_obj_asboolean(obj);
-	zoneqrystats = NULL;
-	if (zonestats_on) {
-		RETERR(dns_generalstats_create(mctx, &zoneqrystats,
-					       dns_nsstatscounter_max));
-	}
-	dns_zone_setrequeststats(zone, zoneqrystats);
-	if (zoneqrystats != NULL)
-		dns_stats_detach(&zoneqrystats);
+	RETERR(dns_zone_setstatistics(zone, cfg_obj_asboolean(obj)));

 	/*
 	 * Configure master functionality.  This applies
@@ -634,7 +553,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		dns_zone_setisself(zone, ns_client_isself, NULL);

 		RETERR(configure_zone_acl(zconfig, vconfig, config,
-					  allow_transfer, ac, zone,
+					  "allow-transfer", ac, zone,
 					  dns_zone_setxfracl,
 					  dns_zone_clearxfracl));

@@ -709,7 +628,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = ns_config_get(maps, "check-sibling", &obj);
 		INSIST(result == ISC_R_SUCCESS);
-		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
+		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING, 
 				   cfg_obj_asboolean(obj));

 		obj = NULL;
@@ -725,10 +644,10 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype == dns_zone_master) {
 		dns_acl_t *updateacl;
 		RETERR(configure_zone_acl(zconfig, vconfig, config,
-					  allow_update, ac, zone,
+					  "allow-update", ac, zone,
 					  dns_zone_setupdateacl,
 					  dns_zone_clearupdateacl));
-
+		
 		updateacl = dns_zone_getupdateacl(zone);
 		if (updateacl != NULL  && dns_acl_isinsecure(updateacl))
 			isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
@@ -736,32 +655,14 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				      "zone '%s' allows updates by IP "
 				      "address, which is insecure",
 				      zname);
-
+		
 		RETERR(configure_zone_ssutable(zoptions, zone));

 		obj = NULL;
 		result = ns_config_get(maps, "sig-validity-interval", &obj);
 		INSIST(result == ISC_R_SUCCESS);
-		{
-			const cfg_obj_t *validity, *resign;
-
-			validity = cfg_tuple_get(obj, "validity");
-			seconds = cfg_obj_asuint32(validity) * 86400;
-			dns_zone_setsigvalidityinterval(zone, seconds);
-
-			resign = cfg_tuple_get(obj, "re-sign");
-			if (cfg_obj_isvoid(resign)) {
-				seconds /= 4;
-			} else {
-				if (seconds > 7 * 86400)
-					seconds = cfg_obj_asuint32(resign) *
-							86400;
-				else
-					seconds = cfg_obj_asuint32(resign) *
-							3600;
-			}
-			dns_zone_setsigresigninginterval(zone, seconds);
-		}
+		dns_zone_setsigvalidityinterval(zone,
+						cfg_obj_asuint32(obj) * 86400);

 		obj = NULL;
 		result = ns_config_get(maps, "key-directory", &obj);
@@ -776,39 +677,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			RETERR(dns_zone_setkeydirectory(zone, filename));
 		}

-		obj = NULL;
-		result = ns_config_get(maps, "sig-signing-signatures", &obj);
-		INSIST(result == ISC_R_SUCCESS);
-		dns_zone_setsignatures(zone, cfg_obj_asuint32(obj));
-
-		obj = NULL;
-		result = ns_config_get(maps, "sig-signing-nodes", &obj);
-		INSIST(result == ISC_R_SUCCESS);
-		dns_zone_setnodes(zone, cfg_obj_asuint32(obj));
-
-		obj = NULL;
-		result = ns_config_get(maps, "sig-signing-type", &obj);
-		INSIST(result == ISC_R_SUCCESS);
-		dns_zone_setprivatetype(zone, cfg_obj_asuint32(obj));
-
-		obj = NULL;
-		result = ns_config_get(maps, "update-check-ksk", &obj);
-		INSIST(result == ISC_R_SUCCESS);
-		dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
-				   cfg_obj_asboolean(obj));
-
-	} else if (ztype == dns_zone_slave) {
-		RETERR(configure_zone_acl(zconfig, vconfig, config,
-					  allow_update_forwarding, ac, zone,
-					  dns_zone_setforwardacl,
-					  dns_zone_clearforwardacl));
-	}
-
-
-	/*%
-	 * Primary master functionality.
-	 */
-	if (ztype == dns_zone_master) {
 		obj = NULL;
 		result = ns_config_get(maps, "check-wildcard", &obj);
 		if (result == ISC_R_SUCCESS)
@@ -835,7 +703,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = ns_config_get(maps, "check-integrity", &obj);
 		INSIST(obj != NULL);
-		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY,
+		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY, 
 				   cfg_obj_asboolean(obj));

 		obj = NULL;
@@ -867,6 +735,59 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			INSIST(0);
 		dns_zone_setoption(zone, DNS_ZONEOPT_WARNSRVCNAME, warn);
 		dns_zone_setoption(zone, DNS_ZONEOPT_IGNORESRVCNAME, ignore);
+
+		obj = NULL;
+		result = ns_config_get(maps, "update-check-ksk", &obj);
+		INSIST(result == ISC_R_SUCCESS);
+		dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK, 
+				   cfg_obj_asboolean(obj));
+	}
+
+	/*
+	 * Configure update-related options.  These apply to
+	 * primary masters only.
+	 */
+	if (ztype == dns_zone_master) {
+		dns_acl_t *updateacl;
+		RETERR(configure_zone_acl(zconfig, vconfig, config,
+					  "allow-update", ac, zone,
+					  dns_zone_setupdateacl,
+					  dns_zone_clearupdateacl));
+		
+		updateacl = dns_zone_getupdateacl(zone);
+		if (updateacl != NULL  && dns_acl_isinsecure(updateacl))
+			isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
+				      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
+				      "zone '%s' allows updates by IP "
+				      "address, which is insecure",
+				      zname);
+		
+		RETERR(configure_zone_ssutable(zoptions, zone));
+
+		obj = NULL;
+		result = ns_config_get(maps, "sig-validity-interval", &obj);
+		INSIST(result == ISC_R_SUCCESS);
+		dns_zone_setsigvalidityinterval(zone,
+						cfg_obj_asuint32(obj) * 86400);
+
+		obj = NULL;
+		result = ns_config_get(maps, "key-directory", &obj);
+		if (result == ISC_R_SUCCESS) {
+			filename = cfg_obj_asstring(obj);
+			if (!isc_file_isabsolute(filename)) {
+				cfg_obj_log(obj, ns_g_lctx, ISC_LOG_ERROR,
+					    "key-directory '%s' "
+					    "is not absolute", filename);
+				return (ISC_R_FAILURE);
+			}
+			RETERR(dns_zone_setkeydirectory(zone, filename));
+		}
+
+	} else if (ztype == dns_zone_slave) {
+		RETERR(configure_zone_acl(zconfig, vconfig, config,
+					  "allow-update-forwarding", ac, zone,
+					  dns_zone_setforwardacl,
+					  dns_zone_clearforwardacl));
 	}

 	/*
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: nsupdate.c,v 1.159 2008/04/02 02:37:41 marka Exp $ */
+/* $Id: nsupdate.c,v 1.154 2007/09/16 02:37:12 marka Exp $ */

 /*! \file */

@@ -195,7 +195,7 @@ static void
 start_gssrequest(dns_name_t *master);
 static void
 send_gssrequest(isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr,
-		dns_message_t *msg, dns_request_t **request,
+		dns_message_t *msg, dns_request_t **request, 
 		gss_ctx_id_t context);
 static void
 recvgss(isc_task_t *task, isc_event_t *event);
@@ -421,7 +421,7 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len) {

 	strncpy(buf, hmacstr, len);
 	buf[len] = 0;
-
+	
 	if (strcasecmp(buf, "hmac-md5") == 0) {
 		*hmac = DNS_TSIG_HMACMD5_NAME;
 	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
@@ -1032,7 +1032,7 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 		check_result(result, "isc_lex_openbuffer");
 		result = isc_buffer_allocate(mctx, &buf, MAXWIRE);
 		check_result(result, "isc_buffer_allocate");
-		result = dns_rdata_fromtext(NULL, rdataclass, rdatatype, lex,
+		result = dns_rdata_fromtext(rdata, rdataclass, rdatatype, lex,
 					    dns_rootname, 0, mctx, buf,
 					    &callbacks);
 		isc_lex_destroy(&lex);
@@ -1126,7 +1126,8 @@ make_prereq(char *cmdline, isc_boolean_t ispositive, isc_boolean_t isrrset) {
 	result = dns_message_gettemprdata(updatemsg, &rdata);
 	check_result(result, "dns_message_gettemprdata");

-	dns_rdata_init(rdata);
+	rdata->data = NULL;
+	rdata->length = 0;

 	if (isrrset && ispositive) {
 		retval = parse_rdata(&cmdline, rdataclass, rdatatype,
@@ -1333,7 +1334,7 @@ evaluate_key(char *cmdline) {
 	secret = isc_mem_allocate(mctx, secretlen);
 	if (secret == NULL)
 		fatal("out of memory");
-
+	
 	isc_buffer_init(&secretbuf, secret, secretlen);
 	result = isc_base64_decodestring(secretstr, &secretbuf);
 	if (result != ISC_R_SUCCESS) {
@@ -1445,7 +1446,10 @@ update_addordelete(char *cmdline, isc_boolean_t isdelete) {
 	result = dns_message_gettemprdata(updatemsg, &rdata);
 	check_result(result, "dns_message_gettemprdata");

-	dns_rdata_init(rdata);
+	rdata->rdclass = 0;
+	rdata->type = 0;
+	rdata->data = NULL;
+	rdata->length = 0;

 	/*
 	 * If this is an add, read the TTL and verify that it's in range.
@@ -1582,7 +1586,8 @@ update_addordelete(char *cmdline, isc_boolean_t isdelete) {
 failure:
 	if (name != NULL)
 		dns_message_puttempname(updatemsg, &name);
-	dns_message_puttemprdata(updatemsg, &rdata);
+	if (rdata != NULL)
+		dns_message_puttemprdata(updatemsg, &rdata);
 	return (STATUS_SYNTAX);
 }

@@ -1654,7 +1659,7 @@ show_message(FILE *stream, dns_message_t *msg, const char *description) {
 	setzone(userzone);

 	bufsz = INITTEXT;
-	do {
+	do { 
 		if (bufsz > MAXTEXT) {
 			fprintf(stderr, "could not allocate large enough "
 				"buffer to display message\n");
@@ -1888,7 +1893,7 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 			char buf[64];
 			isc_buffer_t b;
 			dns_rdataset_t *rds;
-
+			
 			isc_buffer_init(&b, buf, sizeof(buf) - 1);
 			result = dns_rcode_totext(answer->rcode, &b);
 			check_result(result, "dns_rcode_totext");
@@ -1974,7 +1979,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	ddebug("recvsoa()");

 	requests--;
-
+	
 	REQUIRE(event->ev_type == DNS_EVENT_REQUESTDONE);
 	reqev = (dns_requestevent_t *)event;
 	request = reqev->request;
@@ -2071,7 +2076,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		section = DNS_SECTION_ANSWER;
 	else if (pass == 1)
 		section = DNS_SECTION_AUTHORITY;
-	else
+	else 
 		goto droplabel;

 	result = dns_message_firstname(rcvmsg, section);
@@ -2097,7 +2102,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 				break;
 			}
 		}
-
+				
 		result = dns_message_nextname(rcvmsg, section);
 	}

@@ -2175,7 +2180,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	dns_message_destroy(&rcvmsg);
 	ddebug("Out of recvsoa");
 	return;
-
+ 
 droplabel:
 	result = dns_message_firstname(soaquery, DNS_SECTION_QUESTION);
 	INSIST(result == ISC_R_SUCCESS);
@@ -2239,7 +2244,7 @@ start_gssrequest(dns_name_t *master)
 		dns_tsigkeyring_destroy(&gssring);
 	gssring = NULL;
 	result = dns_tsigkeyring_create(mctx, &gssring);
-
+	
 	if (result != ISC_R_SUCCESS)
 		fatal("dns_tsigkeyring_create failed: %s",
 		      isc_result_totext(result));
@@ -2270,7 +2275,7 @@ start_gssrequest(dns_name_t *master)
 	if (result != ISC_R_SUCCESS)
 		fatal("dns_name_fromtext(servname) failed: %s",
 		      isc_result_totext(result));
-
+      
 	dns_fixedname_init(&fkname);
 	keyname = dns_fixedname_name(&fkname);

@@ -2359,7 +2364,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 	ddebug("recvgss()");

 	requests--;
-
+      
 	REQUIRE(event->ev_type == DNS_EVENT_REQUESTDONE);
 	reqev = (dns_requestevent_t *)event;
 	request = reqev->request;
@@ -2410,7 +2415,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 					 DNS_MESSAGEPARSE_PRESERVEORDER);
 	check_result(result, "dns_request_getresponse");

-	if (debugging)
+	if (debugging) 
 		show_message(stderr, rcvmsg,
 			     "recvmsg reply from GSS-TSIG query");

@@ -2441,7 +2446,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {

 	tsigkey = NULL;
 	result = dns_tkey_gssnegotiate(tsigquery, rcvmsg, servname,
-				       &context, &tsigkey, gssring,
+				       &context, &tsigkey, gssring, 
 				       use_win2k_gsstsig);
 	switch (result) {

@@ -2469,7 +2474,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 		 */
 #if 0
 		/*
-		 * Verify the signature.
+		 * Verify the signature. 
 		 */
 		rcvmsg->state = DNS_SECTION_ANY;
 		dns_message_setquerytsig(rcvmsg, NULL);
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: rndc.8,v 1.42 2007/12/14 22:37:22 marka Exp $
+.\" $Id: rndc.8,v 1.41 2007/06/20 02:27:32 marka Exp $
 .\"
 .hy 0
 .ad l
@@ -133,7 +133,6 @@ Several error messages could be clearer.
 .SH "SEE ALSO"
 .PP
 \fBrndc.conf\fR(5),
-\fBrndc\-confgen\fR(8),
 \fBnamed\fR(8),
 \fBnamed.conf\fR(5),
 \fBndc\fR(8),
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: rndc.docbook,v 1.21 2007/12/14 20:39:14 marka Exp $ -->
+<!-- $Id: rndc.docbook,v 1.20 2007/06/19 06:58:03 marka Exp $ -->
 <refentry id="man.rndc">
  <refentryinfo>
    <date>June 30, 2000</date>
@@ -224,9 +224,6 @@
    <para><citerefentry>
        <refentrytitle>rndc.conf</refentrytitle><manvolnum>5</manvolnum>
      </citerefentry>,
-      <citerefentry>
-        <refentrytitle>rndc-confgen</refentrytitle><manvolnum>8</manvolnum>
-      </citerefentry>,
      <citerefentry>
        <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: rndc.html,v 1.31 2007/12/14 22:37:22 marka Exp $ -->
+<!-- $Id: rndc.html,v 1.30 2007/06/20 02:27:32 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -149,7 +149,6 @@
 <div class="refsect1" lang="en">
 <a name="id2543683"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
-      <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
      <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
@@ -157,7 +156,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543738"></a><h2>AUTHOR</h2>
+<a name="id2543730"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2006-2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1999-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: Makefile.in,v 1.46 2008/05/19 23:47:03 tbox Exp $
+# $Id: Makefile.in,v 1.44 2007/06/19 23:47:00 tbox Exp $

 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -54,7 +54,7 @@ t_dst@EXEEXT@: t_dst.@O@ ${DEPLIBS} ${TLIB}
 		t_dst.@O@ ${TLIB} ${LIBS}

 gsstest@EXEEXT@: gsstest.@O@ ${DEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} -o $@ \
 		gsstest.@O@ ${LIBS}

 test: t_dst@EXEEXT@
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: t_dst.c,v 1.55 2008/01/12 23:47:13 tbox Exp $ */
+/* $Id: t_dst.c,v 1.53 2007/06/19 23:47:00 tbox Exp $ */

 #include <config.h>

@@ -377,7 +377,7 @@ t1(void) {
 		t_result(T_UNRESOLVED);
 		return;
 	}
-	isc_result = isc_entropy_createfilesource(ectx, "randomfile");
+	result = isc_entropy_createfilesource(ectx, "randomfile");
 	if (isc_result != ISC_R_SUCCESS) {
 		t_info("isc_entropy_create failed %s\n",
 		       isc_result_totext(isc_result));
@@ -876,7 +876,7 @@ t2_vfy(char **av) {
 		       isc_result_totext(isc_result));
 		return(T_UNRESOLVED);
 	}
-	isc_result = isc_entropy_createfilesource(ectx, "randomfile");
+	result = isc_entropy_createfilesource(ectx, "randomfile");
 	if (isc_result != ISC_R_SUCCESS) {
 		t_info("isc_entropy_create failed %s\n",
 		       isc_result_totext(isc_result));
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: inter_test.c,v 1.16 2008/03/20 23:47:00 tbox Exp $ */
+/* $Id: inter_test.c,v 1.14 2007/06/19 23:46:59 tbox Exp $ */

 /*! \file */
 #include <config.h>
@@ -83,53 +83,6 @@ main(int argc, char **argv) {
 		}
 	}
 	isc_interfaceiter_destroy(&iter);
-
-	fprintf(stdout, "\nPass 2\n\n");
-
-	result = isc_interfaceiter_create(mctx, &iter);
-	if (result != ISC_R_SUCCESS)
-		goto cleanup;
-	result = isc_interfaceiter_first(iter);
-	while (result == ISC_R_SUCCESS) {
-		result = isc_interfaceiter_current(iter, &ifdata);
-		if (result != ISC_R_SUCCESS) {
-			fprintf(stdout, "isc_interfaceiter_current: %s",
-				isc_result_totext(result));
-			continue;
-		}
-		fprintf(stdout, "%s %d %x\n", ifdata.name, ifdata.af,
-			ifdata.flags);
-		INSIST(ifdata.af == AF_INET || ifdata.af == AF_INET6);
-		res = inet_ntop(ifdata.af, &ifdata.address.type, buf,
-				sizeof(buf));
-		if (ifdata.address.zone != 0)
-			fprintf(stdout, "address = %s (zone %u)\n",
-				res == NULL ? "BAD" : res,
-				ifdata.address.zone);
-		else
-			fprintf(stdout, "address = %s\n",
-				res == NULL ? "BAD" : res);
-		INSIST(ifdata.address.family == ifdata.af);
-		res = inet_ntop(ifdata.af, &ifdata.netmask.type, buf,
-				sizeof(buf));
-		fprintf(stdout, "netmask = %s\n", res == NULL ? "BAD" : res);
-		INSIST(ifdata.netmask.family == ifdata.af);
-		if ((ifdata.flags & INTERFACE_F_POINTTOPOINT) != 0) {
-			res = inet_ntop(ifdata.af, &ifdata.dstaddress.type,
-					 buf, sizeof(buf));
-			fprintf(stdout, "dstaddress = %s\n",
-				res == NULL ? "BAD" : res);
-
-			INSIST(ifdata.dstaddress.family == ifdata.af);
-		}
-		result = isc_interfaceiter_next(iter);
-		if (result != ISC_R_SUCCESS && result != ISC_R_NOMORE) {
-			fprintf(stdout, "isc_interfaceiter_next: %s",
-				isc_result_totext(result));
-			continue;
-		}
-	}
-	isc_interfaceiter_destroy(&iter);
 cleanup:
 	isc_mem_destroy(&mctx);

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: t_names.c,v 1.46 2008/01/18 23:46:57 tbox Exp $ */
+/* $Id: t_names.c,v 1.43 2007/06/19 23:47:00 tbox Exp $ */

 #include <config.h>

@@ -209,7 +209,6 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
 		else if (('A' <= c) && (c <= 'Z'))
 			val = c - 'A'+ 10;
 		else {
-			(void)fclose(fp);
 			t_info("Bad format in datafile\n");
 			return (0);
 		}
@@ -223,7 +222,6 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
 				/*
 				 * Buffer too small.
 				 */
-				(void)fclose(fp);
 				t_info("Buffer overflow error\n");
 				return (0);
 			}
@@ -581,7 +579,7 @@ t_dns_name_isabsolute(void) {
 				 * label, bitpos, expected value.
 				 */
 				result = test_dns_name_isabsolute(Tokens[0],
-								atoi(Tokens[1])
+							        atoi(Tokens[1])
 								  == 0 ?
 								  ISC_FALSE :
 								  ISC_TRUE);
@@ -1366,7 +1364,7 @@ t_dns_name_getlabel(void) {
 				 */
 				result = test_dns_name_getlabel(Tokens[0],
 							      atoi(Tokens[1]),
-								   Tokens[2],
+							           Tokens[2],
 							      atoi(Tokens[3]));
 			} else {
 				t_info("bad format at line %d\n", line);
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: clean.sh,v 1.3 2008/01/10 23:47:01 tbox Exp $
+# $Id: clean.sh,v 1.2.2.2 2008/01/10 23:46:34 tbox Exp $

 #
 # Clean up after zone transfer tests.
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named2.conf,v 1.3 2008/01/21 20:38:54 each Exp $ */
+/* $Id: named2.conf,v 1.2.2.2 2008/01/21 21:02:23 each Exp $ */

 controls { /* empty */ };

@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: setup.sh,v 1.3 2008/01/10 23:47:01 tbox Exp $
+# $Id: setup.sh,v 1.2.2.2 2008/01/10 23:46:34 tbox Exp $

 sh ../genzone.sh 2 3 >ns2/example.db
 sh ../genzone.sh 2 3 >ns2/tsigzone.db
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: tests.sh,v 1.3 2008/01/10 23:47:01 tbox Exp $
+# $Id: tests.sh,v 1.2.2.2 2008/01/10 23:46:34 tbox Exp $

 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: conf.sh.in,v 1.39 2008/01/10 23:47:01 tbox Exp $
+# $Id: conf.sh.in,v 1.37 2007/06/19 23:47:00 tbox Exp $

 #
 # Common configuration data for system tests, to be sourced into
@@ -43,7 +43,7 @@ CHECKCONF=$TOP/bin/check/named-checkconf
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
 # v6synth
-SUBDIRS="acl cacheclean checkconf checknames dnssec forward glue ixfr limits
+SUBDIRS="cacheclean checkconf checknames dnssec forward glue ixfr limits
    lwresd masterfile masterformat notify nsupdate resolver rrsetorder
    sortlist stub tkey unknown upforwd views xfer xferquota zonechecks"

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: ifconfig.sh,v 1.53 2008/03/03 23:47:02 tbox Exp $
+# $Id: ifconfig.sh,v 1.51 2007/06/19 23:47:00 tbox Exp $

 #
 # Set up interface aliases for bind9 system tests.
@@ -85,9 +85,6 @@ case "$1" in
 		    *-unknown-netbsd*)
 			ifconfig lo0 10.53.0.$ns alias netmask 255.255.255.0
 			;;
-		    *-unknown-openbsd*)
-			ifconfig lo0 10.53.0.$ns alias netmask 255.255.255.0
-			;;
 		    *-*-bsdi[3-5].*)
 			ifconfig lo0 add 10.53.0.$ns netmask 255.255.255.0
 			;;
@@ -148,9 +145,6 @@ case "$1" in
 		    *-unknown-netbsd*)
 			ifconfig lo0 10.53.0.$ns delete
 			;;
-		    *-unknown-openbsd*)
-			ifconfig lo0 10.53.0.$ns delete
-			;;
 		    *-*-bsdi[3-5].*)
 			ifconfig lo0 remove 10.53.0.$ns
 			;;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: lwtest.c,v 1.32 2008/04/02 02:37:42 marka Exp $ */
+/* $Id: lwtest.c,v 1.29 2007/09/13 04:45:18 each Exp $ */

 #include <config.h>

@@ -350,7 +350,6 @@ test_getipnodebyname(const char *name, const char *address, int af,
 		if (hp->h_addrtype != af) {
 			printf("I:getipnodebyname(%s) returned wrong family\n",
 			       name);
-			freehostent(hp);
 			fails++;
 			return;
 		}
@@ -362,7 +361,6 @@ test_getipnodebyname(const char *name, const char *address, int af,
 					outbuf, sizeof(outbuf));
 			printf("I:getipnodebyname(%s) returned %s, "
 			       "expected %s\n", name, outbuf, address);
-			freehostent(hp);
 			fails++;
 			return;
 		}
@@ -429,21 +427,20 @@ test_getipnodebyaddr(const char *address, int af, const char *name) {
 		if (name == NULL && error_num == HOST_NOT_FOUND)
 			return;
 		else if (error_num != HOST_NOT_FOUND) {
-			printf("I:getipnodebyaddr(%s) failed: %d\n",
+			printf("I:gethostbyaddr(%s) failed: %d\n",
 			       address, error_num);
 			fails++;
 			return;
 		} else {
-			printf("I:getipnodebyaddr(%s) returned not found\n",
+			printf("I:gethostbyaddr(%s) returned not found\n",
 			       address);
 			fails++;
 			return;
 		}
 	} else {
 		if (strcmp(hp->h_name, name) != 0) {
-			printf("I:getipnodebyaddr(%s) returned %s, "
+			printf("I:gethostbyname(%s) returned %s, "
 			       "expected %s\n", address, hp->h_name, name);
-			freehostent(hp);
 			fails++;
 			return;
 		}
@@ -591,12 +588,12 @@ test_getnameinfo(const char *address, int af, const char *name) {
 		}
 	} else {
 		if (name == NULL) {
-			printf("I:getnameinfo(%s) returned %s, "
+			printf("I:getaddrinfo(%s) returned %s, "
 			       "expected NULL\n", address, host);
 			fails++;
 			return;
 		} else if (strcmp(host, name) != 0) {
-			printf("I:getnameinfo(%s) returned %s, expected %s\n",
+			printf("I:getaddrinfo(%s) returned %s, expected %s\n",
 			       address, host, name);
 			fails++;
 			return;
@@ -764,7 +761,7 @@ main(void) {
 	test_getrrsetbyname("a.example1.", 1, 1, 1, 0, 1);
 	test_getrrsetbyname("e.example1.", 1, 1, 1, 1, 1);
 	test_getrrsetbyname("e.example1.", 1, 255, 1, 1, 0);
-	test_getrrsetbyname("e.example1.", 1, 46, 2, 0, 1);
+	test_getrrsetbyname("e.example1.", 1, 46, 1, 0, 1);
 	test_getrrsetbyname("", 1, 1, 0, 0, 0);

 	if (fails == 0)
@@ -1,54 +0,0 @@
-; File written on Wed Mar  5 10:20:40 2008
-; dnssec_signzone version 9.3.4-P1
-e.example1.		300	IN SOA	mname1. . (
-					2002082210 ; serial
-					20         ; refresh (20 seconds)
-					20         ; retry (20 seconds)
-					1814400    ; expire (3 weeks)
-					3600       ; minimum (1 hour)
-					)
-			300	RRSIG	SOA 5 2 300 20010101000000 (
-					20000101000000 14043 e.example1.
-					KtYwrnKM7Tu53BNf8XuTix53r9kDdCneJ1X7
-					xklFbp4YjRKC3NhwVK9PFe0jdHOkIDMtrwxn
-					n7/Rp07xIyURqw== )
-			300	NS	ns.e.example1.
-			300	RRSIG	NS 5 2 300 20010101000000 (
-					20000101000000 14043 e.example1.
-					KBPx3XmNl4swVPdwuUEFuzZedMSfsyK2a0Fu
-					o2wBnbCuS7G7DtfW9690lP/eTyixLOIwlFLQ
-					MrjN3+XgpkdgIw== )
-			300	A	10.0.1.1
-			300	RRSIG	A 5 2 300 20010101000000 (
-					20000101000000 14043 e.example1.
-					KYlxMQUvv8DQtVgS23lNL5tFYmRppJ7vTgH3
-					btvgKbyHxW/04ewRsgCa82iu3iJipdEhKM11
-					ALkRNhqL7frnig== )
-			3600	NSEC	ns.e.example1. A NS SOA RRSIG NSEC DNSKEY
-			3600	RRSIG	NSEC 5 2 3600 20010101000000 (
-					20000101000000 14043 e.example1.
-					azSgagb7bldM06qSZg8nDZWOY2FbqeZY0/T8
-					nC+6VhCs7YTfNvXynLWmvmpqL7gVT6/O+Yi2
-					2lmdntld7GORrQ== )
-			300	DNSKEY	256 3 5 (
-					AwEAAcvAUMfH7wA0z077fJaF7RMrxAFyvo0/
-					7aAL4d2/yA5TqTaUCVnJtE+XgGO34kH9mwae
-					we+Nyv2kRWDeLl6nhGk=
-					) ; key id = 14043
-			300	RRSIG	DNSKEY 5 2 300 20010101000000 (
-					20000101000000 14043 e.example1.
-					BQFWOHopXuBNdzcopkdl1YVKGF0QvIaYpywM
-					fcpG5gi+sy9EoTofQ1UGsLOjU3nFXCvJFG4K
-					1gUhzEEti440/g== )
-ns.e.example1.		300	IN A	10.53.0.1
-			300	RRSIG	A 5 3 300 20010101000000 (
-					20000101000000 14043 e.example1.
-					cYPzsWNQ/eL4h2lihKRjKT2jhGpOqV9woGJA
-					/Jstx2iethOAvYtgY22CsAbCUr/6E4bSgBZR
-					TMoC604cNdFzIw== )
-			3600	NSEC	e.example1. A RRSIG NSEC
-			3600	RRSIG	NSEC 5 3 3600 20010101000000 (
-					20000101000000 14043 e.example1.
-					J8Md544zDLP4GjyAtkjH/rSFvpzXY/7bgJRS
-					YDoARwFQRmlrJvavXEjqElb2fTQqlNNz1cal
-					QROz/WJ3GLwOWw== )
@@ -1,4 +1,4 @@
-; Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 ; Copyright (C) 2000-2003  Internet Software Consortium.
 ;
 ; Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.

-; $Id: example1.db,v 1.19 2008/04/02 23:46:57 tbox Exp $
+; $Id: example1.db,v 1.17 2007/06/19 23:47:04 tbox Exp $

 $TTL 300	; 5 minutes
@			IN SOA	mname1. . (
@@ -32,4 +32,7 @@ a3			CNAME	nowhere
 b			AAAA	eeee:eeee:eeee:eeee:ffff:ffff:ffff:ffff
 8.8.7.7			DNAME	net
 0.0.f.f.e.e.d.d.c.c.b.b.a.a.9.9.net PTR     dname
-e			NS	ns.e
+e			A	10.0.1.1
+			RRSIG	A 1 1 300 20001202003412 (
+				20001102003412 1 example. abcd )
+
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.21 2008/04/02 23:46:57 tbox Exp $ */
+/* $Id: named.conf,v 1.19 2007/06/19 23:47:04 tbox Exp $ */

 controls { /* empty */ };

@@ -43,11 +43,6 @@ zone "example1." {
 	file "example1.db";
 };

-zone "e.example1." {
-	type master;
-	file "e.example1.db";
-};
-
 zone "example2." {
 	type master;
 	file "example2.db";
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2006-2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,10 +14,9 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: clean.sh,v 1.8 2008/04/24 23:46:59 tbox Exp $
+# $Id: clean.sh,v 1.6 2007/09/26 03:22:44 marka Exp $

 rm -f dig.out.cyclic dig.out.fixed dig.out.random
-rm -f dig.out.0 dig.out.1 dig.out.2 dig.out.3
 rm -f ns2/root.bk
 rm -f ns?/named.run ns?/named.core
 rm -f */named.memstats
@@ -0,0 +1,4 @@
+1.2.3.1
+1.2.3.4
+1.2.3.3
+1.2.3.2
@@ -0,0 +1,4 @@
+1.2.3.4
+1.2.3.3
+1.2.3.2
+1.2.3.1
@@ -0,0 +1,4 @@
+1.2.3.3
+1.2.3.2
+1.2.3.1
+1.2.3.4
@@ -0,0 +1,4 @@
+1.2.3.2
+1.2.3.1
+1.2.3.4
+1.2.3.3
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2006-2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,60 +14,54 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: tests.sh,v 1.7 2008/04/24 23:46:59 tbox Exp $
+# $Id: tests.sh,v 1.5 2007/06/19 23:47:05 tbox Exp $

 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

 status=0

-if grep -q "^#define DNS_RDATASET_FIXED" $TOP/config.h; then
-        test_fixed=true
-else
-        echo "I: Order 'fixed' disabled at compile time"
-        test_fixed=false
-fi
-
 #
 #
 #
-if $test_fixed; then
-    echo "I: Checking order fixed (master)"
-    ret=0
-    for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
-    do
-    $DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
-	    -p 5300 @10.53.0.1 fixed.example > dig.out.fixed || ret=1
-    cmp -s dig.out.fixed dig.out.fixed.good || ret=1
-    done
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
-fi
+echo "I: Checking order fixed (master)"
+ret=0
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
+do
+$DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
+	-p 5300 @10.53.0.1 fixed.example > dig.out.fixed || ret=1
+cmp -s dig.out.fixed dig.out.fixed.good || ret=1
+done
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

 #
 #
 #
 echo "I: Checking order cyclic (master)"
 ret=0
-matches=0
-for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
+match1=0
+match2=0
+match3=0
+match4=0
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
 do
-    j=`expr $i % 4`
-    $DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
-	    -p 5300 @10.53.0.1 cyclic.example > dig.out.cyclic || ret=1
-    if [ $i -le 4 ]; then
-        cp dig.out.cyclic dig.out.$j
-    else
-        cmp -s dig.out.cyclic dig.out.$j && matches=`expr $matches + 1`
-    fi
+$DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
+	-p 5300 @10.53.0.1 cyclic.example > dig.out.cyclic || ret=1
+cmp -s dig.out.cyclic dig.out.cyclic.good1 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good2 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good3 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good4 || \
+ret=1
+
+cmp -s dig.out.cyclic dig.out.cyclic.good1 && match1=1
+cmp -s dig.out.cyclic dig.out.cyclic.good2 && match2=1
+cmp -s dig.out.cyclic dig.out.cyclic.good3 && match3=1
+cmp -s dig.out.cyclic dig.out.cyclic.good4 && match4=1
+
 done
-cmp -s dig.out.0 dig.out.1 && ret=1
-cmp -s dig.out.0 dig.out.2 && ret=1
-cmp -s dig.out.0 dig.out.3 && ret=1
-cmp -s dig.out.1 dig.out.2 && ret=1
-cmp -s dig.out.1 dig.out.3 && ret=1
-cmp -s dig.out.2 dig.out.3 && ret=1
-if [ $matches -ne 16 ]; then ret=1; fi
+match=`expr $match1 + $match2 + $match3 + $match4`
+if [ $match != 4 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -102,43 +96,44 @@ status=`expr $status + $ret`
 #
 #
 #
-if $test_fixed; then
-    echo "I: Checking order fixed (slave)"
-    ret=0
-    for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
-    do
-    $DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
-	    -p 5300 @10.53.0.2 fixed.example > dig.out.fixed || ret=1
-    cmp -s dig.out.fixed dig.out.fixed.good || ret=1
-    done
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
-fi
+echo "I: Checking order fixed (slave)"
+ret=0
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
+do
+$DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
+	-p 5300 @10.53.0.2 fixed.example > dig.out.fixed || ret=1
+cmp -s dig.out.fixed dig.out.fixed.good || ret=1
+done
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

 #
 #
 #
 echo "I: Checking order cyclic (slave)"
 ret=0
-matches=0
-for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
+match1=0
+match2=0
+match3=0
+match4=0
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
 do
-    j=`expr $i % 4`
-    $DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
-	    -p 5300 @10.53.0.2 cyclic.example > dig.out.cyclic || ret=1
-    if [ $i -le 4 ]; then
-        cp dig.out.cyclic dig.out.$j
-    else
-        cmp -s dig.out.cyclic dig.out.$j && matches=`expr $matches + 1`
-    fi
+$DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
+	-p 5300 @10.53.0.2 cyclic.example > dig.out.cyclic || ret=1
+cmp -s dig.out.cyclic dig.out.cyclic.good1 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good2 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good3 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good4 || \
+ret=1
+
+cmp -s dig.out.cyclic dig.out.cyclic.good1 && match1=1
+cmp -s dig.out.cyclic dig.out.cyclic.good2 && match2=1
+cmp -s dig.out.cyclic dig.out.cyclic.good3 && match3=1
+cmp -s dig.out.cyclic dig.out.cyclic.good4 && match4=1
+
 done
-cmp -s dig.out.0 dig.out.1 && ret=1
-cmp -s dig.out.0 dig.out.2 && ret=1
-cmp -s dig.out.0 dig.out.3 && ret=1
-cmp -s dig.out.1 dig.out.2 && ret=1
-cmp -s dig.out.1 dig.out.3 && ret=1
-cmp -s dig.out.2 dig.out.3 && ret=1
-if [ $matches -ne 16 ]; then ret=1; fi
+match=`expr $match1 + $match2 + $match3 + $match4`
+if [ $match != 4 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -189,43 +184,44 @@ echo "I: Re-starting slave"
 #
 #
 #
-if $test_fixed; then
-    echo "I: Checking order fixed (slave loaded from disk)"
-    ret=0
-    for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
-    do
-    $DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
-	    -p 5300 @10.53.0.2 fixed.example > dig.out.fixed || ret=1
-    cmp -s dig.out.fixed dig.out.fixed.good || ret=1
-    done
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
-fi
+echo "I: Checking order fixed (slave loaded from disk)"
+ret=0
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
+do
+$DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
+	-p 5300 @10.53.0.2 fixed.example > dig.out.fixed || ret=1
+cmp -s dig.out.fixed dig.out.fixed.good || ret=1
+done
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

 #
 #
 #
 echo "I: Checking order cyclic (slave loaded from disk)"
 ret=0
-matches=0
-for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
+match1=0
+match2=0
+match3=0
+match4=0
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
 do
-    j=`expr $i % 4`
-    $DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
-	    -p 5300 @10.53.0.2 cyclic.example > dig.out.cyclic || ret=1
-    if [ $i -le 4 ]; then
-        cp dig.out.cyclic dig.out.$j
-    else
-        cmp -s dig.out.cyclic dig.out.$j && matches=`expr $matches + 1`
-    fi
+$DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
+	-p 5300 @10.53.0.2 cyclic.example > dig.out.cyclic || ret=1
+cmp -s dig.out.cyclic dig.out.cyclic.good1 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good2 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good3 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good4 || \
+ret=1
+
+cmp -s dig.out.cyclic dig.out.cyclic.good1 && match1=1
+cmp -s dig.out.cyclic dig.out.cyclic.good2 && match2=1
+cmp -s dig.out.cyclic dig.out.cyclic.good3 && match3=1
+cmp -s dig.out.cyclic dig.out.cyclic.good4 && match4=1
+
 done
-cmp -s dig.out.0 dig.out.1 && ret=1
-cmp -s dig.out.0 dig.out.2 && ret=1
-cmp -s dig.out.0 dig.out.3 && ret=1
-cmp -s dig.out.1 dig.out.2 && ret=1
-cmp -s dig.out.1 dig.out.3 && ret=1
-cmp -s dig.out.2 dig.out.3 && ret=1
-if [ $matches -ne 16 ]; then ret=1; fi
+match=`expr $match1 + $match2 + $match3 + $match4`
+if [ $match != 4 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -260,43 +256,44 @@ status=`expr $status + $ret`
 #
 #
 #
-if $test_fixed; then
-    echo "I: Checking order fixed (cache)"
-    ret=0
-    for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
-    do
-    $DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
-	    -p 5300 @10.53.0.3 fixed.example > dig.out.fixed || ret=1
-    cmp -s dig.out.fixed dig.out.fixed.good || ret=1
-    done
-    if [ $ret != 0 ]; then echo "I:failed"; fi
-    status=`expr $status + $ret`
-fi
+echo "I: Checking order fixed (cache)"
+ret=0
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
+do
+$DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
+	-p 5300 @10.53.0.3 fixed.example > dig.out.fixed || ret=1
+cmp -s dig.out.fixed dig.out.fixed.good || ret=1
+done
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

 #
 #
 #
 echo "I: Checking order cyclic (cache)"
 ret=0
-matches=0
-for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
+match1=0
+match2=0
+match3=0
+match4=0
+for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
 do
-    j=`expr $i % 4`
-    $DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
-	    -p 5300 @10.53.0.3 cyclic.example > dig.out.cyclic || ret=1
-    if [ $i -le 4 ]; then
-        cp dig.out.cyclic dig.out.$j
-    else
-        cmp -s dig.out.cyclic dig.out.$j && matches=`expr $matches + 1`
-    fi
+$DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat +short \
+	-p 5300 @10.53.0.3 cyclic.example > dig.out.cyclic || ret=1
+cmp -s dig.out.cyclic dig.out.cyclic.good1 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good2 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good3 || \
+cmp -s dig.out.cyclic dig.out.cyclic.good4 || \
+ret=1
+
+cmp -s dig.out.cyclic dig.out.cyclic.good1 && match1=1
+cmp -s dig.out.cyclic dig.out.cyclic.good2 && match2=1
+cmp -s dig.out.cyclic dig.out.cyclic.good3 && match3=1
+cmp -s dig.out.cyclic dig.out.cyclic.good4 && match4=1
+
 done
-cmp -s dig.out.0 dig.out.1 && ret=1
-cmp -s dig.out.0 dig.out.2 && ret=1
-cmp -s dig.out.0 dig.out.3 && ret=1
-cmp -s dig.out.1 dig.out.2 && ret=1
-cmp -s dig.out.1 dig.out.3 && ret=1
-cmp -s dig.out.2 dig.out.3 && ret=1
-if [ $matches -ne 16 ]; then ret=1; fi
+match=`expr $match1 + $match2 + $match3 + $match4`
+if [ $match != 4 ]; then ret=1; fi
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -1,6 +1,6 @@
 #!/usr/bin/perl -w
 #
-# Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: start.pl,v 1.13 2008/01/02 23:47:01 tbox Exp $
+# $Id: start.pl,v 1.11 2007/06/19 23:47:00 tbox Exp $

 # Framework for starting test servers.
 # Based on the type of server specified, check for port availability, remove
@@ -129,9 +129,7 @@ sub start_server {
 		if ($options) {
 			$command .= "$options";
 		} else {
-			$command .= "-m record,size,mctx ";
-			$command .= "-T clienttest ";
-			$command .= "-c named.conf -d 99 -g";
+			$command .= "-m record,size,mctx -c named.conf -d 99 -g";
 		}
 		$command .= " >named.run 2>&1 &";
 		$pid_file = "named.pid";
@@ -141,10 +139,7 @@ sub start_server {
 		if ($options) {
 			$command .= "$options";
 		} else {
-			$command .= "-m record,size,mctx ";
-			$command .= "-T clienttest ";
-			$command .= "-C resolv.conf -d 99 -g ";
-			$command .= "-i lwresd.pid -P 9210 -p 5300";
+			$command .= "-m record,size,mctx -C resolv.conf -d 99 -g -i lwresd.pid -P 9210 -p 5300";
 		}
 		$command .= " >lwresd.run 2>&1 &";
 		$pid_file = "lwresd.pid";
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.24 2007/12/20 01:48:29 marka Exp $ */
+/* $Id: named.conf,v 1.23 2007/06/19 23:47:07 tbox Exp $ */

 controls { /* empty */ };

@@ -36,12 +36,8 @@ options {
 include "../../common/controls.conf";

 key tsigzone. {
-	algorithm hmac-md5;
-	secret "1234abcd8765";
-};
-
-acl tzkey {
-	key tsigzone.;
+        algorithm hmac-md5;
+        secret "1234abcd8765";
 };

 zone "." {
@@ -57,5 +53,5 @@ zone "example" {
 zone "tsigzone" {
 	type master;
 	file "tsigzone.db";
-	allow-transfer { tzkey; };
+	allow-transfer { key tsigzone.; };
 };
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: t_timers.c,v 1.28 2008/01/12 23:47:13 tbox Exp $ */
+/* $Id: t_timers.c,v 1.26 2007/06/19 23:47:07 tbox Exp $ */

 #include <config.h>

@@ -256,7 +256,7 @@ t_timers_x(isc_timertype_t timertype, isc_time_t *expires,
 		return;
 	}

-	isc_result = isc_mutex_lock(&Tx_mx);
+	isc_mutex_lock(&Tx_mx);
 	if (isc_result != ISC_R_SUCCESS) {
 		t_info("isc_mutex_lock failed %s\n",
 		       isc_result_totext(isc_result));
@@ -16,7 +16,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: config.h.in,v 1.99 2008/05/06 01:30:26 each Exp $ */
+/* $Id: config.h.in,v 1.90 2007/09/14 03:40:36 marka Exp $ */

 /*! \file */

@@ -157,9 +157,6 @@ int sigwait(const unsigned int *set, int *sig);
 /* Define if you cannot bind() before connect() for TCP sockets. */
 #undef BROKEN_TCP_BIND_BEFORE_CONNECT

-/* Define to enable "rrset-order fixed" syntax. */
-#undef DNS_RDATASET_FIXED
-
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H

@@ -178,9 +175,6 @@ int sigwait(const unsigned int *set, int *sig);
 /* Define to 1 if you have the `c' library (-lc). */
 #undef HAVE_LIBC

-/* Define to 1 if you have the `cap' library (-lcap). */
-#undef HAVE_LIBCAP
-
 /* Define to 1 if you have the `c_r' library (-lc_r). */
 #undef HAVE_LIBC_R

@@ -229,9 +223,6 @@ int sigwait(const unsigned int *set, int *sig);
 /* Define to 1 if you have the <string.h> header file. */
 #undef HAVE_STRING_H

-/* Define to 1 if you have the <sys/capability.h> header file. */
-#undef HAVE_SYS_CAPABILITY_H
-
 /* Define to 1 if you have the <sys/param.h> header file. */
 #undef HAVE_SYS_PARAM_H

@@ -325,7 +316,3 @@ int sigwait(const unsigned int *set, int *sig);

 /* Define to `unsigned long' if <sys/types.h> does not define. */
 #undef uintptr_t
-
-/* Define to empty if the keyword `volatile' does not work. Warning: valid
-   code using `volatile' can become incorrect without. Disable with care. */
-#undef volatile
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: config.h.win32,v 1.18 2008/04/02 23:46:57 tbox Exp $ */
+/* $Id: config.h.win32,v 1.16 2007/06/19 23:46:59 tbox Exp $ */

 /*
 * win32 configuration file
@@ -123,7 +123,9 @@
 /* Define if you have DH_generate_parameters(). */
 #define HAVE_DH_GENERATE_PARAMETERS

-#define WANT_IPV6
+#define ISC_PLATFORM_NEEDSTRLCAT
+
+#define ISC_PLATFORM_NEEDSTRLCPY

 #define S_IFMT   _S_IFMT         /* file type mask */
 #define S_IFDIR  _S_IFDIR        /* directory */
@@ -144,7 +146,7 @@

 /* open() under unix allows setting of read/write permissions
 * at the owner, group and other levels.  These don't exist in NT
- * We'll just map them all to the NT equivalent
+ * We'll just map them all to the NT equivalent 
 */

 #define S_IRUSR _S_IREAD	/* Owner read permission */
@@ -194,7 +196,7 @@ typedef long off_t;
 */
 #include <versions.h>

-/* We actually are using the CryptAPI and not a device */
+/* We actually are using the CryptAPI and not a device */ 
 #define PATH_RANDOMDEV		"CryptAPI"

 #include <stddef.h>
@@ -1,5 +1,5 @@
 #! /bin/sh
-# Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1996-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 #
-# $Id: configure,v 1.429 2008/06/17 03:58:27 marka Exp $
+# $Id: configure,v 1.418 2007/09/14 03:40:36 marka Exp $
 #
 # Portions Copyright (C) 1996-2001  Nominum, Inc.
 #
@@ -29,7 +29,7 @@
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-# From configure.in Revision: 1.443 .
+# From configure.in Revision: 1.432 .
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.61.
 #
@@ -876,7 +876,6 @@ ISC_PLATFORM_NEEDSYSSELECTH
 LWRES_PLATFORM_NEEDSYSSELECTH
 USE_OPENSSL
 DST_OPENSSL_INC
-USE_PKCS11
 ISC_PLATFORM_HAVEGSSAPI
 ISC_PLATFORM_GSSAPIHEADER
 USE_GSSAPI
@@ -979,7 +978,6 @@ ISC_PLATFORM_BRACEPTHREADONCEINIT
 ISC_PLATFORM_HAVESTRINGSH
 ISC_PLATFORM_HAVEIFNAMETOINDEX
 ISC_PLATFORM_HAVEXADD
-ISC_PLATFORM_HAVEXADDQ
 ISC_PLATFORM_HAVECMPXCHG
 ISC_PLATFORM_HAVEATOMICSTORE
 ISC_PLATFORM_USEGCCASM
@@ -1633,20 +1631,18 @@ Optional Features:
  --disable-libtool-lock  avoid locking (might break parallel builds)
  --enable-libbind		build libbind default=no
  --enable-ipv6		use IPv6 default=autodetect
-  --enable-getifaddrs    Enable the use of getifaddrs() [yes|no].
+  --enable-getifaddrs    Enable the use of getifaddrs() [yes|no|glibc].
+	     glibc: Use getifaddrs() in glibc if you know it supports IPv6.
  --disable-isc-spnego		use SPNEGO from GSSAPI library
  --disable-linux-caps	disable linux capabilities
  --enable-atomic	enable machine specific atomic operations
 			[default=autodetect]
-  --enable-fixed-rrset        enable fixed rrset ordering
-			[default=no]

 Optional Packages:
  --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
  --without-PACKAGE       do not use PACKAGE (same as --with-PACKAGE=no)
  --with-openssl=PATH   Build with OpenSSL yes|no|path.
 			  (Required for DNSSEC)
-  --with-pkcs11     Build with PKCS11 support
  --with-gssapi=PATH   Specify path for system-supplied GSSAPI
  --with-randomdev=PATH Specify path for random device
  --with-ptl2		on NetBSD, use the ptl2 thread library (experimental)
@@ -1658,7 +1654,6 @@ Optional Packages:
                          both]
  --with-tags[=TAGS]      include additional configurations [automatic]
  --with-kame=PATH	use Kame IPv6 default path /usr/local/v6
-  --with-docbook-xsl=PATH    Specify path for Docbook-XSL stylesheets
  --with-idn=MPREFIX   enable IDN support using idnkit default PREFIX
  --with-libiconv=IPREFIX   GNU libiconv are in IPREFIX default PREFIX
  --with-iconv=LIBSPEC   specify iconv library default -liconv
@@ -4524,66 +4519,6 @@ _ACEOF
    ;;
 esac

-{ echo "$as_me:$LINENO: checking for working volatile" >&5
-echo $ECHO_N "checking for working volatile... $ECHO_C" >&6; }
-if test "${ac_cv_c_volatile+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-
-int
-main ()
-{
-
-volatile int x;
-int * volatile y = (int *) 0;
-return !x && !y;
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext
-if { (ac_try="$ac_compile"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
-  (eval "$ac_compile") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && {
-	 test -z "$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       } && test -s conftest.$ac_objext; then
-  ac_cv_c_volatile=yes
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-	ac_cv_c_volatile=no
-fi
-
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-{ echo "$as_me:$LINENO: result: $ac_cv_c_volatile" >&5
-echo "${ECHO_T}$ac_cv_c_volatile" >&6; }
-if test $ac_cv_c_volatile = no; then
-
-cat >>confdefs.h <<\_ACEOF
-#define volatile
-_ACEOF
-
-fi
-
 { echo "$as_me:$LINENO: checking for sysctlbyname" >&5
 echo $ECHO_N "checking for sysctlbyname... $ECHO_C" >&6; }
 if test "${ac_cv_func_sysctlbyname+set}" = set; then
@@ -5985,38 +5920,6 @@ esac

 DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DNS_OPENSSL_LIBS"

-#
-# PKCS11 (aka crypto hardware) support
-#
-# This works only with the right OpenSSL with PKCS11 engine!
-#
-
-{ echo "$as_me:$LINENO: checking for PKCS11 support" >&5
-echo $ECHO_N "checking for PKCS11 support... $ECHO_C" >&6; }
-
-# Check whether --with-pkcs11 was given.
-if test "${with_pkcs11+set}" = set; then
-  withval=$with_pkcs11; use_pkcs11="yes"
-else
-  use_pkcs11="no"
-fi
-
-
-case "$use_pkcs11" in
-	no)
-		{ echo "$as_me:$LINENO: result: disabled" >&5
-echo "${ECHO_T}disabled" >&6; }
-		USE_PKCS11=""
-		;;
-	yes)
-		{ echo "$as_me:$LINENO: result: using OpenSSL with PKCS11 support" >&5
-echo "${ECHO_T}using OpenSSL with PKCS11 support" >&6; }
-		USE_PKCS11='-DUSE_PKCS11'
-		;;
-esac
-
-
-
 { echo "$as_me:$LINENO: checking for GSSAPI library" >&5
 echo $ECHO_N "checking for GSSAPI library... $ECHO_C" >&6; }

@@ -9080,14 +8983,6 @@ esac
 #
 # GNU libtool support
 #
-case $host in
-sunos*)
-    # Just set the maximum command line length for sunos as it otherwise
-    # takes a exceptionally long time to work it out. Required for libtool.
-    lt_cv_sys_max_cmd_len=4096;
-    ;;
-esac
-

 # Check whether --with-libtool was given.
 if test "${with_libtool+set}" = set; then
@@ -9624,7 +9519,7 @@ ia64-*-hpux*)
  ;;
 *-*-irix6*)
  # Find out which ABI we are using.
-  echo '#line 9627 "configure"' > conftest.$ac_ext
+  echo '#line 9522 "configure"' > conftest.$ac_ext
  if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
  (eval $ac_compile) 2>&5
  ac_status=$?
@@ -11746,11 +11641,11 @@ else
   -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:11749: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:11644: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:11753: \$? = $ac_status" >&5
+   echo "$as_me:11648: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings
@@ -11989,11 +11884,11 @@ else
   -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:11992: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:11887: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:11996: \$? = $ac_status" >&5
+   echo "$as_me:11891: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings
@@ -12049,11 +11944,11 @@ else
   -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:12052: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:11947: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:12056: \$? = $ac_status" >&5
+   echo "$as_me:11951: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -14197,7 +14092,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 14200 "configure"
+#line 14095 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -14295,7 +14190,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 14298 "configure"
+#line 14193 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -16488,11 +16383,11 @@ else
   -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16491: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16386: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:16495: \$? = $ac_status" >&5
+   echo "$as_me:16390: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings
@@ -16548,11 +16443,11 @@ else
   -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16551: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16446: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:16555: \$? = $ac_status" >&5
+   echo "$as_me:16450: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -17876,7 +17771,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 17879 "configure"
+#line 17774 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -17974,7 +17869,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 17977 "configure"
+#line 17872 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -18811,11 +18706,11 @@ else
   -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:18814: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:18709: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:18818: \$? = $ac_status" >&5
+   echo "$as_me:18713: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings
@@ -18871,11 +18766,11 @@ else
   -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:18874: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:18769: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:18878: \$? = $ac_status" >&5
+   echo "$as_me:18773: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -20905,11 +20800,11 @@ else
   -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:20908: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:20803: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:20912: \$? = $ac_status" >&5
+   echo "$as_me:20807: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings
@@ -21148,11 +21043,11 @@ else
   -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:21151: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:21046: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:21155: \$? = $ac_status" >&5
+   echo "$as_me:21050: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings
@@ -21208,11 +21103,11 @@ else
   -e 's:.*FLAGS}? :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:21211: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:21106: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:21215: \$? = $ac_status" >&5
+   echo "$as_me:21110: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -23356,7 +23251,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 23359 "configure"
+#line 23254 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -23454,7 +23349,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 23457 "configure"
+#line 23352 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -26343,16 +26238,21 @@ else
 fi


-#
-# This interface iteration code for getifaddrs() will fall back to using
-# /proc/net/if_inet6 if getifaddrs() in glibc doesn't return any IPv6
-# addresses.
-#
 case $want_getifaddrs in
-glibc)
-{ echo "$as_me:$LINENO: WARNING: \"--enable-getifaddrs=glibc is no longer required\"" >&5
-echo "$as_me: WARNING: \"--enable-getifaddrs=glibc is no longer required\"" >&2;}
-{ echo "$as_me:$LINENO: checking for getifaddrs" >&5
+yes|glibc)
+#
+# Do we have getifaddrs() ?
+#
+case $host in
+*-linux*)
+	# Some recent versions of glibc support getifaddrs() which does not
+	# provide AF_INET6 addresses while the function provided by the USAGI
+	# project handles the AF_INET6 case correctly.  We need to avoid
+	# using the former but prefer the latter unless overridden by
+	# --enable-getifaddrs=glibc.
+	if test $want_getifaddrs = glibc
+	then
+		{ echo "$as_me:$LINENO: checking for getifaddrs" >&5
 echo $ECHO_N "checking for getifaddrs... $ECHO_C" >&6; }
 if test "${ac_cv_func_getifaddrs+set}" = set; then
  echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -26440,9 +26340,84 @@ _ACEOF

 fi

-;;
-yes)
-{ echo "$as_me:$LINENO: checking for getifaddrs" >&5
+	else
+		save_LIBS="$LIBS"
+		LIBS="-L/usr/local/v6/lib $LIBS"
+		{ echo "$as_me:$LINENO: checking for getifaddrs in -linet6" >&5
+echo $ECHO_N "checking for getifaddrs in -linet6... $ECHO_C" >&6; }
+if test "${ac_cv_lib_inet6_getifaddrs+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-linet6  $LIBS"
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char getifaddrs ();
+int
+main ()
+{
+return getifaddrs ();
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_link") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest$ac_exeext &&
+       $as_test_x conftest$ac_exeext; then
+  ac_cv_lib_inet6_getifaddrs=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_lib_inet6_getifaddrs=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+      conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_lib_inet6_getifaddrs" >&5
+echo "${ECHO_T}$ac_cv_lib_inet6_getifaddrs" >&6; }
+if test $ac_cv_lib_inet6_getifaddrs = yes; then
+  LIBS="$LIBS -linet6"
+			cat >>confdefs.h <<\_ACEOF
+#define HAVE_GETIFADDRS 1
+_ACEOF
+
+else
+  LIBS=${save_LIBS}
+fi
+
+	fi
+	;;
+*)
+	{ echo "$as_me:$LINENO: checking for getifaddrs" >&5
 echo $ECHO_N "checking for getifaddrs... $ECHO_C" >&6; }
 if test "${ac_cv_func_getifaddrs+set}" = set; then
  echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -26530,6 +26505,8 @@ _ACEOF

 fi

+	;;
+esac
 ;;
 no)
 ;;
@@ -27451,8 +27428,7 @@ fi
 case "$enable_linux_caps" in
 	yes|'')

-
-for ac_header in linux/capability.h sys/capability.h
+for ac_header in linux/capability.h
 do
 as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
 if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
@@ -27591,77 +27567,6 @@ fi

 done

-
-{ echo "$as_me:$LINENO: checking for cap_set_proc in -lcap" >&5
-echo $ECHO_N "checking for cap_set_proc in -lcap... $ECHO_C" >&6; }
-if test "${ac_cv_lib_cap_cap_set_proc+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lcap  $LIBS"
-cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char cap_set_proc ();
-int
-main ()
-{
-return cap_set_proc ();
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext conftest$ac_exeext
-if { (ac_try="$ac_link"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
-  (eval "$ac_link") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && {
-	 test -z "$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       } && test -s conftest$ac_exeext &&
-       $as_test_x conftest$ac_exeext; then
-  ac_cv_lib_cap_cap_set_proc=yes
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-	ac_cv_lib_cap_cap_set_proc=no
-fi
-
-rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
-      conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ echo "$as_me:$LINENO: result: $ac_cv_lib_cap_cap_set_proc" >&5
-echo "${ECHO_T}$ac_cv_lib_cap_cap_set_proc" >&6; }
-if test $ac_cv_lib_cap_cap_set_proc = yes; then
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_LIBCAP 1
-_ACEOF
-
-  LIBS="-lcap $LIBS"
-
-fi
-
 		;;
 	no)
 		;;
@@ -28981,7 +28886,6 @@ eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
  echo "$as_me:$LINENO: \$? = $ac_status" >&5
  (exit $ac_status); }; }; then
  arch=x86_64
-		have_xaddq=yes
 else
  echo "$as_me: program exited with status $ac_status" >&5
 echo "$as_me: failed program was:" >&5
@@ -28996,7 +28900,6 @@ fi

 	;;
 	x86_64-*)
-		have_xaddq=yes
 		arch=x86_64
 	;;
 	alpha*-*)
@@ -29226,13 +29129,6 @@ else
 	ISC_PLATFORM_HAVEATOMICSTORE="#undef ISC_PLATFORM_HAVEATOMICSTORE"
 fi

-if test "$have_xaddq" = "yes"; then
-        ISC_PLATFORM_HAVEXADDQ="#define ISC_PLATFORM_HAVEXADDQ 1"
-else
-        ISC_PLATFORM_HAVEXADDQ="#undef ISC_PLATFORM_HAVEXADDQ"
-fi
-
-



@@ -29245,30 +29141,6 @@ fi
 ISC_ARCH_DIR=$arch


-#
-# Activate "rrset-order fixed" or not?
-#
-# Check whether --enable-fixed-rrset was given.
-if test "${enable_fixed_rrset+set}" = set; then
-  enableval=$enable_fixed_rrset; enable_fixed="$enableval"
-else
-  enable_fixed="no"
-fi
-
-case "$enable_fixed" in
-	yes)
-
-cat >>confdefs.h <<\_ACEOF
-#define DNS_RDATASET_FIXED 1
-_ACEOF
-
-		;;
-	no)
-		;;
-	*)
-		;;
-esac
-
 #
 #  The following sets up how non-blocking i/o is established.
 #  Sunos, cygwin and solaris 2.x (x<5) require special handling.
@@ -29628,33 +29500,13 @@ fi


 #
-# Look for Docbook-XSL stylesheets.  Location probably varies by system.
-# If it's not explicitly specified, guess where it might be found, based on
-# where SGML stuff lives on some systems (FreeBSD is the only one we're sure
-# of at the moment).
+# Look for Docbook-XSL stylesheets.  Location probably varies by
+# system.  Guessing where it might be found, based on where SGML stuff
+# lives on some systems.  FreeBSD is the only one I'm sure of at the
+# moment.
 #
-{ echo "$as_me:$LINENO: checking for Docbook-XSL path" >&5
-echo $ECHO_N "checking for Docbook-XSL path... $ECHO_C" >&6; }

-# Check whether --with-docbook-xsl was given.
-if test "${with_docbook_xsl+set}" = set; then
-  withval=$with_docbook_xsl; docbook_path="$withval"
-else
-  docbook_path="auto"
-fi
-
-case "$docbook_path" in
-auto)
-	{ echo "$as_me:$LINENO: result: auto" >&5
-echo "${ECHO_T}auto" >&6; }
-	docbook_xsl_trees="/usr/pkg/share/xsl/docbook /usr/local/share/xsl/docbook /usr/share/xsl/docbook"
-	;;
-*)
-	docbook_xsl_trees="$withval"
-    	{ echo "$as_me:$LINENO: result: $docbook_xsl_trees" >&5
-echo "${ECHO_T}$docbook_xsl_trees" >&6; }
-	;;
-esac
+docbook_xsl_trees="/usr/pkg/share/xsl /usr/local/share/xsl /usr/share/xsl"

 #
 # Look for stylesheets we need.
@@ -29662,11 +29514,11 @@ esac


 XSLT_DOCBOOK_STYLE_HTML=""
-{ echo "$as_me:$LINENO: checking for html/docbook.xsl" >&5
-echo $ECHO_N "checking for html/docbook.xsl... $ECHO_C" >&6; }
+{ echo "$as_me:$LINENO: checking for docbook/html/docbook.xsl" >&5
+echo $ECHO_N "checking for docbook/html/docbook.xsl... $ECHO_C" >&6; }
 for d in $docbook_xsl_trees
 do
-	f=$d/html/docbook.xsl
+	f=$d/docbook/html/docbook.xsl
 	if test -f $f
 	then
 		XSLT_DOCBOOK_STYLE_HTML=$f
@@ -29679,17 +29531,17 @@ if test "X$XSLT_DOCBOOK_STYLE_HTML" = "X"
 then
 	{ echo "$as_me:$LINENO: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6; };
-	XSLT_DOCBOOK_STYLE_HTML=html/docbook.xsl
+	XSLT_DOCBOOK_STYLE_HTML=docbook/html/docbook.xsl
 fi



 XSLT_DOCBOOK_STYLE_XHTML=""
-{ echo "$as_me:$LINENO: checking for xhtml/docbook.xsl" >&5
-echo $ECHO_N "checking for xhtml/docbook.xsl... $ECHO_C" >&6; }
+{ echo "$as_me:$LINENO: checking for docbook/xhtml/docbook.xsl" >&5
+echo $ECHO_N "checking for docbook/xhtml/docbook.xsl... $ECHO_C" >&6; }
 for d in $docbook_xsl_trees
 do
-	f=$d/xhtml/docbook.xsl
+	f=$d/docbook/xhtml/docbook.xsl
 	if test -f $f
 	then
 		XSLT_DOCBOOK_STYLE_XHTML=$f
@@ -29702,17 +29554,17 @@ if test "X$XSLT_DOCBOOK_STYLE_XHTML" = "X"
 then
 	{ echo "$as_me:$LINENO: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6; };
-	XSLT_DOCBOOK_STYLE_XHTML=xhtml/docbook.xsl
+	XSLT_DOCBOOK_STYLE_XHTML=docbook/xhtml/docbook.xsl
 fi



 XSLT_DOCBOOK_STYLE_MAN=""
-{ echo "$as_me:$LINENO: checking for manpages/docbook.xsl" >&5
-echo $ECHO_N "checking for manpages/docbook.xsl... $ECHO_C" >&6; }
+{ echo "$as_me:$LINENO: checking for docbook/manpages/docbook.xsl" >&5
+echo $ECHO_N "checking for docbook/manpages/docbook.xsl... $ECHO_C" >&6; }
 for d in $docbook_xsl_trees
 do
-	f=$d/manpages/docbook.xsl
+	f=$d/docbook/manpages/docbook.xsl
 	if test -f $f
 	then
 		XSLT_DOCBOOK_STYLE_MAN=$f
@@ -29725,17 +29577,17 @@ if test "X$XSLT_DOCBOOK_STYLE_MAN" = "X"
 then
 	{ echo "$as_me:$LINENO: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6; };
-	XSLT_DOCBOOK_STYLE_MAN=manpages/docbook.xsl
+	XSLT_DOCBOOK_STYLE_MAN=docbook/manpages/docbook.xsl
 fi



 XSLT_DOCBOOK_CHUNK_HTML=""
-{ echo "$as_me:$LINENO: checking for html/chunk.xsl" >&5
-echo $ECHO_N "checking for html/chunk.xsl... $ECHO_C" >&6; }
+{ echo "$as_me:$LINENO: checking for docbook/html/chunk.xsl" >&5
+echo $ECHO_N "checking for docbook/html/chunk.xsl... $ECHO_C" >&6; }
 for d in $docbook_xsl_trees
 do
-	f=$d/html/chunk.xsl
+	f=$d/docbook/html/chunk.xsl
 	if test -f $f
 	then
 		XSLT_DOCBOOK_CHUNK_HTML=$f
@@ -29748,17 +29600,17 @@ if test "X$XSLT_DOCBOOK_CHUNK_HTML" = "X"
 then
 	{ echo "$as_me:$LINENO: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6; };
-	XSLT_DOCBOOK_CHUNK_HTML=html/chunk.xsl
+	XSLT_DOCBOOK_CHUNK_HTML=docbook/html/chunk.xsl
 fi



 XSLT_DOCBOOK_CHUNK_XHTML=""
-{ echo "$as_me:$LINENO: checking for xhtml/chunk.xsl" >&5
-echo $ECHO_N "checking for xhtml/chunk.xsl... $ECHO_C" >&6; }
+{ echo "$as_me:$LINENO: checking for docbook/xhtml/chunk.xsl" >&5
+echo $ECHO_N "checking for docbook/xhtml/chunk.xsl... $ECHO_C" >&6; }
 for d in $docbook_xsl_trees
 do
-	f=$d/xhtml/chunk.xsl
+	f=$d/docbook/xhtml/chunk.xsl
 	if test -f $f
 	then
 		XSLT_DOCBOOK_CHUNK_XHTML=$f
@@ -29771,17 +29623,17 @@ if test "X$XSLT_DOCBOOK_CHUNK_XHTML" = "X"
 then
 	{ echo "$as_me:$LINENO: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6; };
-	XSLT_DOCBOOK_CHUNK_XHTML=xhtml/chunk.xsl
+	XSLT_DOCBOOK_CHUNK_XHTML=docbook/xhtml/chunk.xsl
 fi



 XSLT_DOCBOOK_CHUNKTOC_HTML=""
-{ echo "$as_me:$LINENO: checking for html/chunktoc.xsl" >&5
-echo $ECHO_N "checking for html/chunktoc.xsl... $ECHO_C" >&6; }
+{ echo "$as_me:$LINENO: checking for docbook/html/chunktoc.xsl" >&5
+echo $ECHO_N "checking for docbook/html/chunktoc.xsl... $ECHO_C" >&6; }
 for d in $docbook_xsl_trees
 do
-	f=$d/html/chunktoc.xsl
+	f=$d/docbook/html/chunktoc.xsl
 	if test -f $f
 	then
 		XSLT_DOCBOOK_CHUNKTOC_HTML=$f
@@ -29794,17 +29646,17 @@ if test "X$XSLT_DOCBOOK_CHUNKTOC_HTML" = "X"
 then
 	{ echo "$as_me:$LINENO: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6; };
-	XSLT_DOCBOOK_CHUNKTOC_HTML=html/chunktoc.xsl
+	XSLT_DOCBOOK_CHUNKTOC_HTML=docbook/html/chunktoc.xsl
 fi



 XSLT_DOCBOOK_CHUNKTOC_XHTML=""
-{ echo "$as_me:$LINENO: checking for xhtml/chunktoc.xsl" >&5
-echo $ECHO_N "checking for xhtml/chunktoc.xsl... $ECHO_C" >&6; }
+{ echo "$as_me:$LINENO: checking for docbook/xhtml/chunktoc.xsl" >&5
+echo $ECHO_N "checking for docbook/xhtml/chunktoc.xsl... $ECHO_C" >&6; }
 for d in $docbook_xsl_trees
 do
-	f=$d/xhtml/chunktoc.xsl
+	f=$d/docbook/xhtml/chunktoc.xsl
 	if test -f $f
 	then
 		XSLT_DOCBOOK_CHUNKTOC_XHTML=$f
@@ -29817,17 +29669,17 @@ if test "X$XSLT_DOCBOOK_CHUNKTOC_XHTML" = "X"
 then
 	{ echo "$as_me:$LINENO: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6; };
-	XSLT_DOCBOOK_CHUNKTOC_XHTML=xhtml/chunktoc.xsl
+	XSLT_DOCBOOK_CHUNKTOC_XHTML=docbook/xhtml/chunktoc.xsl
 fi



 XSLT_DOCBOOK_MAKETOC_HTML=""
-{ echo "$as_me:$LINENO: checking for html/maketoc.xsl" >&5
-echo $ECHO_N "checking for html/maketoc.xsl... $ECHO_C" >&6; }
+{ echo "$as_me:$LINENO: checking for docbook/html/maketoc.xsl" >&5
+echo $ECHO_N "checking for docbook/html/maketoc.xsl... $ECHO_C" >&6; }
 for d in $docbook_xsl_trees
 do
-	f=$d/html/maketoc.xsl
+	f=$d/docbook/html/maketoc.xsl
 	if test -f $f
 	then
 		XSLT_DOCBOOK_MAKETOC_HTML=$f
@@ -29840,17 +29692,17 @@ if test "X$XSLT_DOCBOOK_MAKETOC_HTML" = "X"
 then
 	{ echo "$as_me:$LINENO: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6; };
-	XSLT_DOCBOOK_MAKETOC_HTML=html/maketoc.xsl
+	XSLT_DOCBOOK_MAKETOC_HTML=docbook/html/maketoc.xsl
 fi



 XSLT_DOCBOOK_MAKETOC_XHTML=""
-{ echo "$as_me:$LINENO: checking for xhtml/maketoc.xsl" >&5
-echo $ECHO_N "checking for xhtml/maketoc.xsl... $ECHO_C" >&6; }
+{ echo "$as_me:$LINENO: checking for docbook/xhtml/maketoc.xsl" >&5
+echo $ECHO_N "checking for docbook/xhtml/maketoc.xsl... $ECHO_C" >&6; }
 for d in $docbook_xsl_trees
 do
-	f=$d/xhtml/maketoc.xsl
+	f=$d/docbook/xhtml/maketoc.xsl
 	if test -f $f
 	then
 		XSLT_DOCBOOK_MAKETOC_XHTML=$f
@@ -29863,7 +29715,7 @@ if test "X$XSLT_DOCBOOK_MAKETOC_XHTML" = "X"
 then
 	{ echo "$as_me:$LINENO: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6; };
-	XSLT_DOCBOOK_MAKETOC_XHTML=xhtml/maketoc.xsl
+	XSLT_DOCBOOK_MAKETOC_XHTML=docbook/xhtml/maketoc.xsl
 fi


@@ -30516,8 +30368,6 @@ else
 fi


-mysql_include=""
-mysql_lib=""
 if test "$use_dlz_mysql" = "yes"
 then
 	# User did not specify a path - guess it
@@ -30527,49 +30377,9 @@ then
 		if test -f $d/include/mysql/mysql.h
 		then
 			use_dlz_mysql=$d
-			mysql_include=$d/include/mysql
-			if test -d $d/lib/mysql
-			then
-				mysql_lib=$d/lib/mysql
-			else
-				mysql_lib=$d/lib
-			fi
-			break
-		elif test -f $d/include/mysql.h
-		then
-			use_dlz_mysql=$d
-			mysql_include=$d/include
-			if test -d $d/lib/mysql
-			then
-				mysql_lib=$d/lib/mysql
-			else
-				mysql_lib=$d/lib
-			fi
 			break
 		fi
 	done
-elif test "$use_dlz_mysql" != "no"
-then
-	d = $use_dlz_mysql
-	if test -f $d/include/mysql/mysql.h
-	then
-		mysql_include=$d/include/mysql
-		if test -d $d/lib/mysql
-		then
-			mysql_lib=$d/lib/mysql
-		else
-			mysql_lib=$d/lib
-		fi
-	elif test -f $d/include/mysql.h
-	then
-		mysql_include=$d/include
-		if test -d $d/lib/mysql
-		then
-			mysql_lib=$d/lib/mysql
-		else
-			mysql_lib=$d/lib
-		fi
-	fi
 fi

 if test "$use_dlz_mysql" = "yes"
@@ -30594,18 +30404,18 @@ echo "${ECHO_T}no" >&6; }
 		DLZ_DRIVER_SRCS="$DLZ_DRIVER_SRCS $dlzdir/$i.c"
 		DLZ_DRIVER_OBJS="$DLZ_DRIVER_OBJS $i.$O"
 	done
-	if test -n "-I${mysql_include}"
+	if test -n "-I$use_dlz_mysql/include/mysql"
 	then
-		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I${mysql_include}"
+		DLZ_DRIVER_INCLUDES="$DLZ_DRIVER_INCLUDES -I$use_dlz_mysql/include/mysql"
 	fi
-	if test -n "-L${mysql_lib} -lmysqlclient -lz -lcrypt -lm"
+	if test -n "-L$use_dlz_mysql/lib/mysql -lmysqlclient -lz -lcrypt -lm"
 	then
-		DLZ_DRIVER_LIBS="$DLZ_DRIVER_LIBS -L${mysql_lib} -lmysqlclient -lz -lcrypt -lm"
+		DLZ_DRIVER_LIBS="$DLZ_DRIVER_LIBS -L$use_dlz_mysql/lib/mysql -lmysqlclient -lz -lcrypt -lm"
 	fi


-		{ echo "$as_me:$LINENO: result: using mysql from ${mysql_lib} and ${mysql_include}" >&5
-echo "${ECHO_T}using mysql from ${mysql_lib} and ${mysql_include}" >&6; }
+		{ echo "$as_me:$LINENO: result: using mysql from $use_dlz_mysql/lib/mysql and $use_dlz_mysql/include/mysql" >&5
+echo "${ECHO_T}using mysql from $use_dlz_mysql/lib/mysql and $use_dlz_mysql/include/mysql" >&6; }
 		;;
 esac

@@ -32015,7 +31825,6 @@ ISC_PLATFORM_NEEDSYSSELECTH!$ISC_PLATFORM_NEEDSYSSELECTH$ac_delim
 LWRES_PLATFORM_NEEDSYSSELECTH!$LWRES_PLATFORM_NEEDSYSSELECTH$ac_delim
 USE_OPENSSL!$USE_OPENSSL$ac_delim
 DST_OPENSSL_INC!$DST_OPENSSL_INC$ac_delim
-USE_PKCS11!$USE_PKCS11$ac_delim
 ISC_PLATFORM_HAVEGSSAPI!$ISC_PLATFORM_HAVEGSSAPI$ac_delim
 ISC_PLATFORM_GSSAPIHEADER!$ISC_PLATFORM_GSSAPIHEADER$ac_delim
 USE_GSSAPI!$USE_GSSAPI$ac_delim
@@ -32104,6 +31913,7 @@ LWRES_PLATFORM_NEEDSPRINTF!$LWRES_PLATFORM_NEEDSPRINTF$ac_delim
 ISC_PLATFORM_NEEDVSNPRINTF!$ISC_PLATFORM_NEEDVSNPRINTF$ac_delim
 LWRES_PLATFORM_NEEDVSNPRINTF!$LWRES_PLATFORM_NEEDVSNPRINTF$ac_delim
 ISC_EXTRA_OBJS!$ISC_EXTRA_OBJS$ac_delim
+ISC_EXTRA_SRCS!$ISC_EXTRA_SRCS$ac_delim
 _ACEOF

  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 97; then
@@ -32145,7 +31955,6 @@ _ACEOF
 ac_delim='%!_!# '
 for ac_last_try in false false false false false :; do
  cat >conf$$subs.sed <<_ACEOF
-ISC_EXTRA_SRCS!$ISC_EXTRA_SRCS$ac_delim
 USE_ISC_SPNEGO!$USE_ISC_SPNEGO$ac_delim
 DST_EXTRA_OBJS!$DST_EXTRA_OBJS$ac_delim
 DST_EXTRA_SRCS!$DST_EXTRA_SRCS$ac_delim
@@ -32159,7 +31968,6 @@ ISC_PLATFORM_BRACEPTHREADONCEINIT!$ISC_PLATFORM_BRACEPTHREADONCEINIT$ac_delim
 ISC_PLATFORM_HAVESTRINGSH!$ISC_PLATFORM_HAVESTRINGSH$ac_delim
 ISC_PLATFORM_HAVEIFNAMETOINDEX!$ISC_PLATFORM_HAVEIFNAMETOINDEX$ac_delim
 ISC_PLATFORM_HAVEXADD!$ISC_PLATFORM_HAVEXADD$ac_delim
-ISC_PLATFORM_HAVEXADDQ!$ISC_PLATFORM_HAVEXADDQ$ac_delim
 ISC_PLATFORM_HAVECMPXCHG!$ISC_PLATFORM_HAVECMPXCHG$ac_delim
 ISC_PLATFORM_HAVEATOMICSTORE!$ISC_PLATFORM_HAVEATOMICSTORE$ac_delim
 ISC_PLATFORM_USEGCCASM!$ISC_PLATFORM_USEGCCASM$ac_delim
@@ -32208,7 +32016,7 @@ LIBOBJS!$LIBOBJS$ac_delim
 LTLIBOBJS!$LTLIBOBJS$ac_delim
 _ACEOF

-  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 61; then
+  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 59; then
    break
  elif $ac_last_try; then
    { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl
 esyscmd([sed "s/^/# /" COPYRIGHT])dnl
 AC_DIVERT_POP()dnl

-AC_REVISION($Revision: 1.443 $)
+AC_REVISION($Revision: 1.432 $)

 AC_INIT(lib/dns/name.c)
 AC_PREREQ(2.59)
@@ -245,7 +245,6 @@ AC_CHECK_HEADERS(fcntl.h sys/time.h unistd.h sys/sockio.h sys/select.h sys/param

 AC_C_CONST
 AC_C_INLINE
-AC_C_VOLATILE
 AC_CHECK_FUNC(sysctlbyname, AC_DEFINE(HAVE_SYSCTLBYNAME))

 #
@@ -545,30 +544,6 @@ AC_SUBST(USE_OPENSSL)
 AC_SUBST(DST_OPENSSL_INC)
 DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DNS_OPENSSL_LIBS"

-#
-# PKCS11 (aka crypto hardware) support
-#
-# This works only with the right OpenSSL with PKCS11 engine!
-#
-
-AC_MSG_CHECKING(for PKCS11 support)
-AC_ARG_WITH(pkcs11,
-[  --with-pkcs11     Build with PKCS11 support],
-   use_pkcs11="yes", use_pkcs11="no")
-
-case "$use_pkcs11" in
-	no)
-		AC_MSG_RESULT(disabled)
-		USE_PKCS11=""
-		;;
-	yes)
-		AC_MSG_RESULT(using OpenSSL with PKCS11 support)
-		USE_PKCS11='-DUSE_PKCS11'
-		;;
-esac
-
-AC_SUBST(USE_PKCS11)
-
 AC_MSG_CHECKING(for GSSAPI library)
 AC_ARG_WITH(gssapi,
 [  --with-gssapi=PATH   Specify path for system-supplied GSSAPI],
@@ -1121,14 +1096,6 @@ AC_SUBST(PURIFY)
 #
 # GNU libtool support
 #
-case $host in
-sunos*)
-    # Just set the maximum command line length for sunos as it otherwise
-    # takes a exceptionally long time to work it out. Required for libtool.
-    lt_cv_sys_max_cmd_len=4096;
-    ;;
-esac
-
 AC_ARG_WITH(libtool,
 	    [  --with-libtool	use GNU libtool (following indented options supported)],
 	    use_libtool="$withval", use_libtool="no")
@@ -1701,21 +1668,38 @@ AC_SUBST(ISC_LWRES_GETADDRINFOPROTO)
 AC_SUBST(ISC_LWRES_GETNAMEINFOPROTO)

 AC_ARG_ENABLE(getifaddrs,
-[  --enable-getifaddrs    Enable the use of getifaddrs() [[yes|no]].],
+[  --enable-getifaddrs    Enable the use of getifaddrs() [[yes|no|glibc]].
+	     glibc: Use getifaddrs() in glibc if you know it supports IPv6.],
    want_getifaddrs="$enableval",  want_getifaddrs="yes")

-#
-# This interface iteration code for getifaddrs() will fall back to using
-# /proc/net/if_inet6 if getifaddrs() in glibc doesn't return any IPv6
-# addresses.
-# 
 case $want_getifaddrs in
-glibc)
-AC_MSG_WARN("--enable-getifaddrs=glibc is no longer required")
-AC_CHECK_FUNC(getifaddrs, AC_DEFINE(HAVE_GETIFADDRS))
-;;
-yes)
-AC_CHECK_FUNC(getifaddrs, AC_DEFINE(HAVE_GETIFADDRS))
+yes|glibc)
+#
+# Do we have getifaddrs() ?
+#
+case $host in
+*-linux*)
+	# Some recent versions of glibc support getifaddrs() which does not
+	# provide AF_INET6 addresses while the function provided by the USAGI
+	# project handles the AF_INET6 case correctly.  We need to avoid
+	# using the former but prefer the latter unless overridden by
+	# --enable-getifaddrs=glibc.
+	if test $want_getifaddrs = glibc
+	then
+		AC_CHECK_FUNC(getifaddrs, AC_DEFINE(HAVE_GETIFADDRS))
+	else
+		save_LIBS="$LIBS"
+		LIBS="-L/usr/local/v6/lib $LIBS"
+		AC_CHECK_LIB(inet6, getifaddrs,
+			LIBS="$LIBS -linet6"
+			AC_DEFINE(HAVE_GETIFADDRS),
+			LIBS=${save_LIBS})
+	fi
+	;;
+*)
+	AC_CHECK_FUNC(getifaddrs, AC_DEFINE(HAVE_GETIFADDRS))
+	;;
+esac
 ;;
 no)
 ;;
@@ -1890,8 +1874,7 @@ AC_ARG_ENABLE(linux-caps,
 	[  --disable-linux-caps	disable linux capabilities])
 case "$enable_linux_caps" in
 	yes|'')
-		AC_CHECK_HEADERS(linux/capability.h sys/capability.h)
-		AC_CHECK_LIB(cap, cap_set_proc)
+		AC_CHECK_HEADERS(linux/capability.h)
 		;;
 	no)
 		;;
@@ -2139,13 +2122,11 @@ main() {
 	exit((sizeof(void *) == 8) ? 0 : 1);
 }
 ],
-		[arch=x86_64
-		have_xaddq=yes],
+		[arch=x86_64],
 		[arch=x86_32],
 		[arch=x86_32])
 	;;
 	x86_64-*)
-		have_xaddq=yes
 		arch=x86_64
 	;;
 	alpha*-*)
@@ -2250,14 +2231,7 @@ else
 	ISC_PLATFORM_HAVEATOMICSTORE="#undef ISC_PLATFORM_HAVEATOMICSTORE"
 fi

-if test "$have_xaddq" = "yes"; then
-        ISC_PLATFORM_HAVEXADDQ="#define ISC_PLATFORM_HAVEXADDQ 1"
-else
-        ISC_PLATFORM_HAVEXADDQ="#undef ISC_PLATFORM_HAVEXADDQ"
-fi
-
 AC_SUBST(ISC_PLATFORM_HAVEXADD)
-AC_SUBST(ISC_PLATFORM_HAVEXADDQ)
 AC_SUBST(ISC_PLATFORM_HAVECMPXCHG)
 AC_SUBST(ISC_PLATFORM_HAVEATOMICSTORE)

@@ -2269,25 +2243,6 @@ AC_SUBST(ISC_PLATFORM_USEMACASM)
 ISC_ARCH_DIR=$arch
 AC_SUBST(ISC_ARCH_DIR)

-#
-# Activate "rrset-order fixed" or not?
-#
-AC_ARG_ENABLE(fixed-rrset,
-	[  --enable-fixed-rrset        enable fixed rrset ordering
-			[[default=no]]],
-			enable_fixed="$enableval",
-			enable_fixed="no")
-case "$enable_fixed" in
-	yes)
-		AC_DEFINE(DNS_RDATASET_FIXED, 1,
-                          [Define to enable "rrset-order fixed" syntax.])
-		;;
-	no)
-		;;
-	*)
-		;;
-esac
-
 #
 #  The following sets up how non-blocking i/o is established.
 #  Sunos, cygwin and solaris 2.x (x<5) require special handling.
@@ -2393,39 +2348,27 @@ AC_SUBST($1)
 ])

 #
-# Look for Docbook-XSL stylesheets.  Location probably varies by system.
-# If it's not explicitly specified, guess where it might be found, based on
-# where SGML stuff lives on some systems (FreeBSD is the only one we're sure
-# of at the moment).
+# Look for Docbook-XSL stylesheets.  Location probably varies by
+# system.  Guessing where it might be found, based on where SGML stuff
+# lives on some systems.  FreeBSD is the only one I'm sure of at the
+# moment.
 #
-AC_MSG_CHECKING(for Docbook-XSL path)
-AC_ARG_WITH(docbook-xsl,
-[  --with-docbook-xsl=PATH    Specify path for Docbook-XSL stylesheets],
-   docbook_path="$withval", docbook_path="auto")
-case "$docbook_path" in
-auto)
-	AC_MSG_RESULT(auto)
-	docbook_xsl_trees="/usr/pkg/share/xsl/docbook /usr/local/share/xsl/docbook /usr/share/xsl/docbook"
-	;;
-*)
-	docbook_xsl_trees="$withval"
-    	AC_MSG_RESULT($docbook_xsl_trees)
-	;;
-esac
+
+docbook_xsl_trees="/usr/pkg/share/xsl /usr/local/share/xsl /usr/share/xsl"

 #
 # Look for stylesheets we need.
 #

-NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_HTML, html/docbook.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_XHTML, xhtml/docbook.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_MAN, manpages/docbook.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_CHUNK_HTML, html/chunk.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_CHUNK_XHTML, xhtml/chunk.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_CHUNKTOC_HTML, html/chunktoc.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_CHUNKTOC_XHTML, xhtml/chunktoc.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_MAKETOC_HTML, html/maketoc.xsl, $docbook_xsl_trees)
-NOM_PATH_FILE(XSLT_DOCBOOK_MAKETOC_XHTML, xhtml/maketoc.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_HTML, docbook/html/docbook.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_XHTML, docbook/xhtml/docbook.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_STYLE_MAN, docbook/manpages/docbook.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_CHUNK_HTML, docbook/html/chunk.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_CHUNK_XHTML, docbook/xhtml/chunk.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_CHUNKTOC_HTML, docbook/html/chunktoc.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_CHUNKTOC_XHTML, docbook/xhtml/chunktoc.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_MAKETOC_HTML, docbook/html/maketoc.xsl, $docbook_xsl_trees)
+NOM_PATH_FILE(XSLT_DOCBOOK_MAKETOC_XHTML, docbook/xhtml/maketoc.xsl, $docbook_xsl_trees)

 #
 # Same dance for db2latex
@@ -167,9 +167,6 @@ dbus_mgr_init_dbus(ns_dbus_mgr_t *);
 static isc_result_t
 dbus_mgr_record_initial_fwdtable(ns_dbus_mgr_t *);

-static
-dns_fwdtable_t *dbus_mgr_get_fwdtable(void);
-
 static void
 dbus_mgr_free_initial_fwdtable(ns_dbus_mgr_t *);

@@ -275,8 +272,6 @@ dbus_mgr_create
    return ISC_R_SUCCESS;

 cleanup_mgr:
-    if ( dbus_mgr_get_fwdtable() != NULL)
-	dbus_mgr_free_initial_fwdtable (mgr);
    if( mgr->task != 0L )
 	isc_task_detach(&(mgr->task));
    isc_mem_put(mctx, mgr, sizeof(*mgr));
@@ -628,7 +623,7 @@ static void dbus_mgr_record_initial_forwarder( dns_name_t *name, dns_forwarders_

    dns_name_init(&(ifwdr->dn), NULL);
    if( dns_name_dupwithoffsets(name, mgr->mctx, &(ifwdr->dn)) != ISC_R_SUCCESS )
-	goto namedup_err;
+	return;

    ISC_LIST_INIT(ifwdr->sa);
    
@@ -639,27 +634,14 @@ static void dbus_mgr_record_initial_forwarder( dns_name_t *name, dns_forwarders_
    {
 	nsa = isc_mem_get(mgr->mctx, sizeof(isc_sockaddr_t));
 	if( nsa == 0L ) 
-	    goto nsa_err;
+	    return;
 	*nsa = *sa;
 	ISC_LINK_INIT(nsa, link);
 	ISC_LIST_APPEND(ifwdr->sa, nsa, link);
    }
    ISC_LINK_INIT(ifwdr, link);
    tsearch( ifwdr, &(mgr->ifwdt), dbus_mgr_ifwdr_comparator);
-
-    return;
-
-nsa_err:
-    while ( (sa = ISC_LIST_HEAD (ifwdr->sa)) != NULL) {
-	ISC_LIST_UNLINK (ifwdr->sa, sa, link);
-	isc_mem_put (mgr->mctx, sa, sizeof (*sa));
-    }
-
-namedup_err:
-    isc_mem_put (mgr->mctx, ifwdr, sizeof (*ifwdr));
-
-    return;
-}
+} 

 static isc_result_t
 dbus_mgr_record_initial_fwdtable( ns_dbus_mgr_t *mgr )
@@ -200,7 +200,6 @@ dbus_svc_add_filter
 	    }
 	}
    }
-    va_end(va);
    return( 1 );
 }

@@ -425,7 +424,6 @@ dbus_svc_message_append_args(DBusConnectionState *cs, dbus_svc_MessageHandle msg
    if( !dbus_message_append_args_valist( msg, firstType, va ) )
    {
 	if( cs->eh != 0L ) (*(cs->eh))("dbus_svc_send: dbus_message_append_args failed");
-	va_end(va);
 	return 0;	
    }
    va_end(va);
@@ -490,7 +488,6 @@ dbus_svc_call
 	va_end(va);
 	return(0L);
    }
-    va_end(va);
    return reply;
 }

@@ -123,8 +123,6 @@ AC_ARG_WITH(dlz_mysql,
                               (Required to use MySQL with DLZ)],
    use_dlz_mysql="$withval", use_dlz_mysql="no")

-mysql_include=""
-mysql_lib=""
 if test "$use_dlz_mysql" = "yes"
 then
 	# User did not specify a path - guess it
@@ -134,49 +132,9 @@ then
 		if test -f $d/include/mysql/mysql.h
 		then
 			use_dlz_mysql=$d
-			mysql_include=$d/include/mysql
-			if test -d $d/lib/mysql
-			then
-				mysql_lib=$d/lib/mysql
-			else
-				mysql_lib=$d/lib
-			fi
-			break
-		elif test -f $d/include/mysql.h
-		then
-			use_dlz_mysql=$d
-			mysql_include=$d/include
-			if test -d $d/lib/mysql
-			then
-				mysql_lib=$d/lib/mysql
-			else
-				mysql_lib=$d/lib
-			fi
 			break
 		fi
 	done
-elif test "$use_dlz_mysql" != "no"
-then
-	d=$use_dlz_mysql
-	if test -f $d/include/mysql/mysql.h
-	then
-		mysql_include=$d/include/mysql
-		if test -d $d/lib/mysql
-		then
-			mysql_lib=$d/lib/mysql
-		else
-			mysql_lib=$d/lib
-		fi
-	elif test -f $d/include/mysql.h
-	then
-		mysql_include=$d/include
-		if test -d $d/lib/mysql
-		then
-			mysql_lib=$d/lib/mysql
-		else
-			mysql_lib=$d/lib
-		fi
-	fi
 fi

 if test "$use_dlz_mysql" = "yes"
@@ -192,11 +150,11 @@ case "$use_dlz_mysql" in
 		;;
 	*)
 		DLZ_ADD_DRIVER(MYSQL, dlz_mysql_driver,
-				[-I${mysql_include}],
-				[-L${mysql_lib} -lmysqlclient -lz -lcrypt -lm])
+				[-I$use_dlz_mysql/include/mysql],
+				[-L$use_dlz_mysql/lib/mysql -lmysqlclient -lz -lcrypt -lm])

 		AC_MSG_RESULT(
-[using mysql from ${mysql_lib} and ${mysql_include}])
+[using mysql from $use_dlz_mysql/lib/mysql and $use_dlz_mysql/include/mysql])
 		;;
 esac

@@ -1,124 +0,0 @@
-/* OpenSSL tool
- *
- * usage: PEM_write_pubkey -e engine -p pin -k keyname -f filename
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <openssl/engine.h>
-#include <openssl/conf.h>
-#include <unistd.h>
-#include <errno.h>
-
-extern int PEM_write_PUBKEY(FILE *fp, EVP_PKEY *x);
-
-int
-main(int argc, char *argv[])
-{
-    ENGINE *e;
-    EVP_PKEY *pub_key;
-    FILE *fp;
-    char *engine = NULL;
-    char *pin = NULL;
-    char *keyname = NULL;
-    char *filename = NULL;
-    int c, errflg = 0;
-    extern char *optarg;
-    extern int optopt;
-       
-    while ((c = getopt(argc, argv, ":e:p:k:f:")) != -1) {
-        switch (c) {
-        case 'e':
-            engine = optarg;
-            break;
-	case 'p':
-	    pin = optarg;
-	    break;
-        case 'k':
-            keyname = optarg;
-            break;
-        case 'f':
-            filename = optarg;
-            break;
-        case ':':
-            fprintf(stderr, "Option -%c requires an operand\n", optopt);
-            errflg++;
-            break;
-        case '?':
-	default:
-            fprintf(stderr, "Unrecognised option: -%c\n", optopt);
-            errflg++;
-        }
-    }
-    if ((errflg) || (!engine) || (!filename) || (!keyname)) {
-        fprintf(stderr,
-		"usage: PEM_write_pubkey -e engine [-p pin] "
-		"-k keyname -f filename\n");
-        exit(1);
-    }
-    
-    /* Load the config file */
-    OPENSSL_config(NULL);
-
-    /* Register engine */
-    e = ENGINE_by_id(engine);
-    if (!e) {
-        /* the engine isn't available */
-        printf("The engine isn't available\n");
-	ERR_print_errors_fp(stderr);
-        exit(1);
-    }
-    
-    /* Send PIN to engine */
-    if (pin && !ENGINE_ctrl_cmd_string(e, "PIN", pin, 0)){
-        printf("Error sending PIN to engine\n");
-	ERR_print_errors_fp(stderr);
-        ENGINE_free(e);
-        exit(1);
-    }
-    
-    if (!ENGINE_init(e)) {
-        /* the engine couldn't initialise, release 'e' */
-        printf("The engine couldn't initialise\n");
-	ERR_print_errors_fp(stderr);
-        ENGINE_free(e);
-        exit(1);
-    }
-
-    if (!ENGINE_register_RSA(e)){
-        /* This should only happen when 'e' can't initialise, but the previous
-	 * statement suggests it did. */
-        printf("This should not happen\n");
-	ERR_print_errors_fp(stderr);
-        exit(1);
-    }
-    
-    /* Load public key */
-    pub_key = ENGINE_load_public_key(e, keyname, NULL, NULL);
-    if (pub_key == NULL) {
-        /* No public key */
-        printf("Error loading public key\n");
-	ERR_print_errors_fp(stderr);
-        ENGINE_free(e);
-        exit(1);
-    }
-
-    /* write public key to file in PEM format */
-    fp = fopen(filename, "w");
-    if (fp == NULL) {
-        printf("Error opening output file.\n");
-	ENGINE_free(e);
-        exit(1);
-    }
-     
-    if (!PEM_write_PUBKEY(fp, pub_key)) {
-        /* Error writing public key */
-        printf("Error writing public key");
-	ERR_print_errors_fp(stderr);
-        ENGINE_free(e);
-        exit(1);
-    }
-    
-    fclose(fp);
-    exit(0);
-}
@@ -1,18 +0,0 @@
-This is a set of utilities that when used together create rsa keys in
-a PKCS11 keystore. The keys will have a label of "zone,zsk|ksk,xxx" and
-an id of the keytag in hex.
-
-Run genkey.sh to generate a new key and call the other programs in turn.
-Run writekey.sh to load key to the key store from Kxxx.{key,private}.
-
-genkey[.c] uses PKCS11 calls to generate keys.
-PEM_write_pubkey[.c] uses OpenSSL to write a public key from the key store
- into a file in PEM format.
-keyconv.pl uses Net::DNS::SEC to calculate the key tag and to write out
- a DNSKEY RR into a file.
-set_key_id[.c] uses PKCS11 to set to the key id == keytag in the key store.
-readkey[.c] and writekey[.c] extracts and loads a key from/to the key store.
-keydump.pl uses Net::DNS::SEC to get the key from a Kxxx.private file and
- write it into a file in PEM format.
-
-listobjs and destroyobjs browse the key store, prints or destroys objects.
@@ -1,183 +0,0 @@
-/* destroyobj [-s $slot] [-i $id | -l $label] [-p $pin] */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <string.h>
-#include <sys/types.h>
-#ifndef OPENCRYPTOKI
-#include <security/cryptoki.h>
-#include <security/pkcs11.h>
-#else
-#include <opencryptoki/pkcs11.h>
-#endif
-
-int
-main(int argc, char *argv[])
-{
-    CK_RV rv;
-    CK_SLOT_ID slot = 0;
-    CK_SESSION_HANDLE hSession;
-    CK_UTF8CHAR *pin = NULL;
-    CK_BYTE attr_id[2];
-    CK_OBJECT_HANDLE akey[50];
-    char *label = NULL;
-    int error = 0;
-    int id = 0, i = 0;
-    int c, errflg = 0;
-    CK_ULONG ulObjectCount;
-    CK_ATTRIBUTE search_template[] = {
-	{CKA_ID, &attr_id, sizeof(attr_id)}
-    };
-    extern char *optarg;
-    extern int optopt;
-
-    while ((c = getopt(argc, argv, ":s:i:l:p:")) != -1) {
-	switch (c) {
-	case 's':
-	    slot = atoi(optarg);
-	    break;
-	case 'i':
-	    id = atoi(optarg);
-	    id &= 0xffff;
-	    break;
-	case 'l':
-	    label = optarg;
-	    break;
-	case 'p':
-	    pin = (CK_UTF8CHAR *)optarg;
-	    break;
-	case ':':
-	    fprintf(stderr, "Option -%c requires an operand\n", optopt);
-	    errflg++;
-	    break;
-	case '?':
-	default:
-	    fprintf(stderr, "Unrecognised option: -%c\n", optopt);
-	    errflg++;
-	}
-    }
-    if (errflg || ((!id) && (!label))) {
-	fprintf(stderr,
-		"usage: destroykey [-s slot] [-i id | -l label] [-p pin]\n");
-	exit(1);
-    }
-    if (id) {
-	printf("id %i\n", id);
-	attr_id[0] = (id >> 8) & 0xff;
-	attr_id[1] = id & 0xff;
-    } else if (label) {
-	printf("label %s\n", label);
-	search_template[0].type = CKA_LABEL;
-	search_template[0].pValue = label;
-	search_template[0].ulValueLen = strlen(label);
-    }
-
-    /* Initialize the CRYPTOKI library */
-    rv = C_Initialize(NULL_PTR);
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_Initialize: Error = 0x%.8X\n", rv);
-	exit(1);
-    }
-
-    /* Open a session on the slot found */
-    rv = C_OpenSession(slot, CKF_RW_SESSION+CKF_SERIAL_SESSION,
-		       NULL_PTR, NULL_PTR, &hSession);
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_OpenSession: Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_program;
-    }
-
-    /* Login to the Token (Keystore) */
-    if (!pin)
-#ifndef OPENCRYPTOKI
-	pin = (CK_UTF8CHAR *)getpassphrase("Enter Pin: ");
-#else
-	pin = (CK_UTF8CHAR *)getpass("Enter Pin: ");
-#endif
-    rv = C_Login(hSession, CKU_USER, pin, strlen((char *)pin));
-    memset(pin, 0, strlen((char *)pin));
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_Login: Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_session;
-    }
-
-    rv = C_FindObjectsInit(hSession, search_template,
-			   ((id != 0) || (label != NULL)) ? 1 : 0); 
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_session;
-    }
-    
-    rv = C_FindObjects(hSession, akey, 50, &ulObjectCount);
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_FindObjects: Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_search;
-    }
-
-    for (i = 0; i < ulObjectCount; i++) {
-	CK_OBJECT_CLASS oclass = 0;
-	CK_BYTE labelbuf[64 + 1];
-	CK_BYTE idbuf[64];
-	CK_ATTRIBUTE attr_template[] = {
-	    {CKA_CLASS, &oclass, sizeof(oclass)},
-	    {CKA_LABEL, labelbuf, sizeof(labelbuf) - 1},
-	    {CKA_ID, idbuf, sizeof(idbuf)}
-	};
-	int j, len;
-
-	memset(labelbuf, 0, sizeof(labelbuf));
-	memset(idbuf, 0, sizeof(idbuf));
-
-	rv = C_GetAttributeValue(hSession, akey[i], attr_template, 3);
-	if (rv != CKR_OK) {
-	    fprintf(stderr, "C_GetAttributeValue[%d]: rv = 0x%.8X\n", i, rv);
-	    error = 1;
-	    goto exit_search;
-	}
-	len = attr_template[2].ulValueLen;
-	printf("object[%d]: class %d label '%s' id[%u] ",
-	       i, oclass, labelbuf, attr_template[2].ulValueLen);
-	if (len > 4)
-	    len = 4;
-	for (j = 0; j < len; j++)
-	    printf("%02x", idbuf[j]);
-	if (attr_template[2].ulValueLen > len)
-	    printf("...\n");
-	else
-	    printf("\n");
-    }
-
-    /* give a chance to kill this */
-    printf("sleeping 5 seconds...\n");
-    sleep(5);
-
-    for (i = 0; i < ulObjectCount; i++) {
-	rv = C_DestroyObject(hSession, akey[i]);
-	if (rv != CKR_OK) {
-	    fprintf(stderr, "C_DestroyObject[%d]: rv = 0x%.8X\n", i, rv);
-	    error = 1;
-	}
-    }
-
- exit_search:
-    rv = C_FindObjectsFinal(hSession);
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_FindObjectsFinal: Error = 0x%.8X\n", rv);
-	error = 1;
-    }
-
- exit_session:
-    (void) C_CloseSession(hSession);
-
- exit_program:
-    (void) C_Finalize(NULL_PTR);
-
-    exit(error);
-}
@@ -1,206 +0,0 @@
-/* genkey - pkcs11 rsa key generator
- *
- * create RSASHA1 key in the keystore of an SCA6000
- * The calculation of key tag is left to the script
- * that converts the key into a DNSKEY RR and inserts 
- * it into a zone file.
- *
- * usage:
- * genkey [-P] [-s slot] -b keysize -l label [-p pin] 
- *
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <string.h>
-#include <sys/types.h>
-#ifndef OPENCRYPTOKI
-#include <security/cryptoki.h>
-#include <security/pkcs11.h>
-#else
-#include <opencryptoki/pkcs11.h>
-#endif
-
-/* Define static key template values */
-static CK_BBOOL truevalue = TRUE;
-static CK_BBOOL falsevalue = FALSE;
-
-int
-main(int argc, char *argv[])
-{
-    CK_RV rv;
-    CK_SLOT_ID slot = 0;
-    CK_MECHANISM genmech;
-    CK_SESSION_HANDLE hSession;
-    CK_UTF8CHAR *pin = NULL;
-    CK_ULONG modulusbits = 0;
-    CK_CHAR *label = NULL;
-    CK_OBJECT_HANDLE privatekey, publickey;
-    CK_BYTE public_exponent[3];
-    int error = 0;
-    int i = 0;
-    int c, errflg = 0;
-    int hide = 1;
-    CK_ULONG ulObjectCount;
-    /* Set search template */
-    CK_ATTRIBUTE search_template[] = {
-        {CKA_LABEL, NULL_PTR, 0}
-    };
-    CK_ATTRIBUTE publickey_template[] = {
-        {CKA_LABEL, NULL_PTR, 0},
-        {CKA_VERIFY, &truevalue, sizeof (truevalue)},
-        {CKA_TOKEN, &truevalue, sizeof (truevalue)},
-        {CKA_MODULUS_BITS, &modulusbits, sizeof (modulusbits)},
-        {CKA_PUBLIC_EXPONENT, &public_exponent, sizeof (public_exponent)}
-    };
-    CK_ATTRIBUTE privatekey_template[] = {
-        {CKA_LABEL, NULL_PTR, 0},
-        {CKA_SIGN, &truevalue, sizeof (truevalue)},
-        {CKA_TOKEN, &truevalue, sizeof (truevalue)},
-        {CKA_PRIVATE, &truevalue, sizeof (truevalue)},
-        {CKA_SENSITIVE, &truevalue, sizeof (truevalue)},
-        {CKA_EXTRACTABLE, &falsevalue, sizeof (falsevalue)}
-    };
-    extern char *optarg;
-    extern int optopt;
-    
-    while ((c = getopt(argc, argv, ":Ps:b:i:l:p:")) != -1) {
-        switch (c) {
-	case 'P':
-	    hide = 0;
-	    break;
-	case 's':
-	    slot = atoi(optarg);
-	    break;
-        case 'b':
-            modulusbits = atoi(optarg);
-            break;
-        case 'l':
-            label = (CK_CHAR *)optarg;
-            break;
-        case 'p':
-            pin = (CK_UTF8CHAR *)optarg;
-            break;
-        case ':':
-            fprintf(stderr, "Option -%c requires an operand\n", optopt);
-            errflg++;
-            break;
-        case '?':
-	default:
-            fprintf(stderr, "Unrecognised option: -%c\n", optopt);
-            errflg++;
-        }
-    }
-    if ((errflg) || (!modulusbits) || (!label)) {
-        fprintf(stderr,
-		"usage: genkey [-P] [-s slot] -b keysize -l label [-p pin]\n");
-        exit(2);
-    }
-    
-    search_template[0].pValue = label;
-    search_template[0].ulValueLen = strlen((char *)label);
-    publickey_template[0].pValue = label;
-    publickey_template[0].ulValueLen = strlen((char *)label);
-    privatekey_template[0].pValue = label;
-    privatekey_template[0].ulValueLen = strlen((char *)label);
-
-    /* Set public exponent to 65537 */
-    public_exponent[0] = 0x01;
-    public_exponent[1] = 0x00;
-    public_exponent[2] = 0x01;
-
-    /* Set up mechanism for generating key pair */
-    genmech.mechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
-    genmech.pParameter = NULL_PTR;
-    genmech.ulParameterLen = 0;
-
-    /* Initialize the CRYPTOKI library */
-    rv = C_Initialize(NULL_PTR);
-
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_Initialize: Error = 0x%.8X\n", rv);
-	exit(1);
-    }
-
-    /* Open a session on the slot found */
-    rv = C_OpenSession(slot, CKF_RW_SESSION+CKF_SERIAL_SESSION,
-		       NULL_PTR, NULL_PTR, &hSession);
-
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_OpenSession: Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_program;
-    }
-
-    /* Login to the Token (Keystore) */
-    if (!pin)
-#ifndef OPENCRYPTOKI
-        pin = (CK_UTF8CHAR *)getpassphrase("Enter Pin: ");
-#else
-        pin = (CK_UTF8CHAR *)getpass("Enter Pin: ");
-#endif
-    rv = C_Login(hSession, CKU_USER, pin, strlen((char *)pin));
-    memset(pin, 0, strlen((char *)pin));
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_Login: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_session;
-    }
-   
-    /* check if a key with the same id already exists */
-    rv = C_FindObjectsInit(hSession, search_template, 1); 
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_session;
-    }
-    rv = C_FindObjects(hSession, &privatekey, 1, &ulObjectCount);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjects: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_search;
-    }
-    if (ulObjectCount != 0) {
-        fprintf(stderr, "Key already exists.\n");
-        error = 1;
-        goto exit_search;
-    }
-    
-    /* Set attributes if the key is not to be hidden */
-    if (!hide) {
-        privatekey_template[4].pValue = &falsevalue;
-	privatekey_template[5].pValue = &truevalue;
-    }
-
-    /* Generate Key pair for signing/verifying */
-    rv = C_GenerateKeyPair(hSession, &genmech, publickey_template,
-			   (sizeof (publickey_template) /
-			    sizeof (CK_ATTRIBUTE)),
-			   privatekey_template,
-			   (sizeof (privatekey_template) /
-			    sizeof (CK_ATTRIBUTE)),
-			   &publickey, &privatekey);
-        
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_GenerateKeyPair: Error = 0x%.8X\n", rv);
-        error = 1;
-    }
-    
- exit_search:
-    rv = C_FindObjectsFinal(hSession);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjectsFinal: Error = 0x%.8X\n", rv);
-        error = 1;
-    }
-
- exit_session:
-    (void) C_CloseSession(hSession);
-
- exit_program:
-    (void) C_Finalize(NULL_PTR);
-
-    exit(error);
-}
@@ -1,55 +0,0 @@
-#!/usr/bin/bash
-
-usage="Usage: $0 -z zone -x ext -p pin -b bits -e engine [-f] -k key_path"
-tmp_file=/tmp/cur_key.$$
-while getopts ":z:x:p:t:k:b:e:f" opt; do
-  case $opt in
-    z  ) zone=$OPTARG ;;
-    x  ) ext=$OPTARG ;;
-    p  ) pin=$OPTARG ;;
-    t  ) id=$OPTARG ;;
-    f  ) flag="ksk" ;;
-    e  ) engine=$OPTARG ;;
-    b  ) bits=$OPTARG ;;
-    k  ) key_path=$OPTARG ;;
-    \? ) echo $usage 
-	 exit 1 ;;
-   esac
-done
-shift $(($OPTIND -1))
-
-if [ ! "$zone" -o ! "$ext" -o ! "$pin" -o ! "$engine" -o ! "$bits" -o ! "$key_path" ] ; then
-  echo $usage
-  exit 1
-fi
-
-if [ "$flag" ] ; then
-  label="$zone,$flag,$ext"
-else
-  label="$zone,zsk,$ext"
-fi
-
-# for testing
-mypath=.
-
-echo "Generating key"
-$mypath/genkey -b $bits -l $label -p $pin
-if [ $? -ne 0 ] ; then exit 1 ; fi
-
-echo "Exporting public key"
-$mypath/PEM_write_pubkey -e $engine -p $pin -k pkcs11:$label -f $tmp_file
-if [ $? -ne 0 ] ; then exit 1 ; fi
-
-echo "Generating DNSKEY RR"
-if [ "$flag" ] ; then
-  keytag=`$mypath/keyconv.pl -a 5 -k -e $engine -l $label -p $key_path -i $tmp_file $zone`
-else
-  keytag=`$mypath/keyconv.pl -a 5 -e $engine -l $label -p $key_path -i $tmp_file $zone`
-fi
-
-if [ ! $keytag ] ; then rm $tmp_file; exit 1 ; fi
-
-echo "Set key id"
-$mypath/set_key_id -l $label -n $keytag -p $pin
-
-rm $tmp_file
@@ -1,61 +0,0 @@
-#!/usr/bin/perl -w
-
-use strict;
-use Crypt::OpenSSL::RSA;
-use Getopt::Std;
-use MIME::Base64;
-use Net::DNS;
-use Net::DNS::SEC;
-
-my %option;
-getopts('a:e:i:l:p:hk',\%option);
-
-die "usage: keyconv.pl [-a alg] [-k (to indicate KSK)] -e engine -l label [-p (path to store key)] -i filename domainname\n" if $option{h} || (not defined $option{i}) || (not defined $option{e}) || (not defined $option{l});
-
-# The default path is local.
-$option{p} || ($option{p}="./");
-
-# The default algorithm is 5.
-$option{a} || ($option{a}=5);
-
-$option{k} || ($option{k}=0);
-
-# The algorithm is either 5 or 133.
-$option{a}==5 || $option{a}==133 || die "algorithm must be 5 or 133\n";
-
-# standard flags (value is 256) plus optionally the KSK flag.
-my $flags=(256 + $option{k});
-
-open(PFILE, $option{i});
-   my @fc = <PFILE>;
-close(PFILE);
-
-my $rsa = Crypt::OpenSSL::RSA->new_public_key(join "", @fc);
-
-my ($m,$e)= $rsa->get_key_parameters;
-
-(my $l=pack("Cn",0,length($e->to_bin))) =~ s/^\000{2}//;
-
-my $rrkey=$l.$e->to_bin.$m->to_bin;
-my $keystr = $ARGV[0]. ". IN DNSKEY $flags 3 $option{a} ".encode_base64($rrkey,"");
-my $keyrr = Net::DNS::RR->new($keystr);
-
-open(PFILE, "> $option{p}/K".$ARGV[0].".+".sprintf("%03d",$option{a})."+".$keyrr->keytag.".key");
-print PFILE $ARGV[0], ". IN DNSKEY $flags 3 $option{a} ",encode_base64($rrkey,"")."\n";
-close(PFILE);
-
-open(PFILE, "> $option{p}/K".$ARGV[0].".+".sprintf("%03d",$option{a})."+".$keyrr->keytag.".private");
-print PFILE "Private-key-format: v1.2\n";
-print PFILE "Algorithm: ", $option{a}, " (RSASHA1)\n";
-print PFILE "Modulus: ".encode_base64($m->to_bin,"")."\n";
-print PFILE "PublicExponent: ".encode_base64($e->to_bin,"")."\n";
-my $engine="";
-$engine=encode_base64($option{e}."\0","");
-print PFILE "Engine: ", $engine, "\n";
-my $label="";
-$option{k}==0 && ($label=encode_base64($option{e}.":".$option{l}."\0",""));
-$option{k}!=0 && ($label=encode_base64($option{e}.":".$option{l}."\0",""));
-print PFILE "Label: ", $label, "\n";
-close(PFILE);
-
-print $keyrr->keytag;
@@ -1,26 +0,0 @@
-#!/usr/bin/perl -w
-
-use strict;
-use Getopt::Std;
-use Crypt::OpenSSL::RSA;
-use Net::DNS::SEC;
-
-my %option;
-getopts('k:p:o:h',\%option);
-
-$option{h} || (not defined $option{k}) || (not defined $option{p}) || (not defined $option{o}) && die "usage: keydump.pl -k Kxxx.key -p Kxxx.priv -o pem\n";
-
-my $rsa = Net::DNS::SEC::Private->new($option{p});
-
-open(PFILE, "> $option{o}");
-print PFILE $rsa->dump_rsa_private_der;
-close(PFILE);
-
-open(KFILE, "< $option{k}");
-my @fc = <KFILE>;
-close(KFILE);
-
-my $keyrr = Net::DNS::RR->new(join "", @fc);
-
-print $keyrr->flags;
-
@@ -1,197 +0,0 @@
-/* listobjs [-P] [-s slot] [-i $id | -l $label] [-p $pin] */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <string.h>
-#include <sys/types.h>
-#ifndef OPENCRYPTOKI
-#include <security/cryptoki.h>
-#include <security/pkcs11.h>
-#else
-#include <opencryptoki/pkcs11.h>
-#endif
-
-int
-main(int argc, char *argv[])
-{
-    CK_RV rv;
-    CK_SLOT_ID slot = 0;
-    CK_SESSION_HANDLE hSession;
-    CK_UTF8CHAR *pin = NULL;
-    CK_BYTE attr_id[2];
-    CK_OBJECT_HANDLE akey[50];
-    char *label = NULL;
-    int error = 0, public = 0, all = 0;
-    int i = 0, id = 0;
-    int c, errflg = 0;
-    CK_ULONG ulObjectCount;
-    CK_ATTRIBUTE search_template[] = {
-	{CKA_ID, &attr_id, sizeof(attr_id)}
-    };
-    extern char *optarg;
-    extern int optopt;
-
-    while ((c = getopt(argc, argv, ":s:i:l:p:P")) != -1) {
-	switch (c) {
-	case 'P':
-	    public = 1;
-	    break;
-	case 's':
-	    slot = atoi(optarg);
-	    break;
-	case 'i':
-	    id = atoi(optarg);
-	    id &= 0xffff;
-	    break;
-	case 'l':
-	    label = optarg;
-	    break;
-	case 'p':
-	    pin = (CK_UTF8CHAR *)optarg;
-	    break;
-	case ':':
-	    fprintf(stderr, "Option -%c requires an operand\n", optopt);
-	    errflg++;
-	    break;
-	case '?':
-	default:
-	    fprintf(stderr, "Unrecognised option: -%c\n", optopt);
-	    errflg++;
-	}
-    }
-    if (errflg) {
-	fprintf(stderr,
-		"usage: listobjs [-P] [-s slot] [-p pin] -i id | $label\n");
-	exit(1);
-    }
-    if ((!id) && (!label))
-	all = 1;
-    if (slot)
-	printf("slot %d\n", slot);
-    if (id) {
-	printf("id %i\n", id);
-	attr_id[0] = (id >> 8) & 0xff;
-	attr_id[1] = id & 0xff;
-    } else if (label) {
-	printf("label %s\n", label);
-	search_template[0].type = CKA_LABEL;
-	search_template[0].pValue = label;
-	search_template[0].ulValueLen = strlen(label);
-    }
-
-    /* Initialize the CRYPTOKI library */
-    rv = C_Initialize(NULL_PTR);
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_Initialize: Error = 0x%.8X\n", rv);
-	exit(1);
-    }
-
-    /* Open a session on the slot found */
-    rv = C_OpenSession(slot, CKF_SERIAL_SESSION,
-		       NULL_PTR, NULL_PTR, &hSession);
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_OpenSession: Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_program;
-    }
-
-    /* Login to the Token (Keystore) */
-    if (!public) {
-	if (!pin)
-#ifndef OPENCRYPTOKI
-	    pin = (CK_UTF8CHAR *)getpassphrase("Enter Pin: ");
-#else
-	    pin = (CK_UTF8CHAR *)getpass("Enter Pin: ");
-#endif
-	rv = C_Login(hSession, CKU_USER, pin, strlen((char *)pin));
-	memset(pin, 0, strlen((char *)pin));
-	if (rv != CKR_OK) {
-	    fprintf(stderr, "C_Login: Error = 0x%.8X\n", rv);
-	    error = 1;
-	    goto exit_session;
-	}
-    }
-
-    rv = C_FindObjectsInit(hSession, search_template, all ? 0 : 1); 
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_session;
-    }
-    
-    ulObjectCount = 1;
-    while (ulObjectCount) {
-	rv = C_FindObjects(hSession, akey, 50, &ulObjectCount);
-	if (rv != CKR_OK) {
-	    fprintf(stderr, "C_FindObjects: Error = 0x%.8X\n", rv);
-	    error = 1;
-	    goto exit_search;
-	}
-
-	for (i = 0; i < ulObjectCount; i++) {
-	    CK_OBJECT_CLASS oclass = 0;
-	    CK_BYTE labelbuf[64 + 1];
-	    CK_BYTE idbuf[64];
-	    CK_ATTRIBUTE attr_template[] = {
-		{CKA_CLASS, &oclass, sizeof(oclass)},
-		{CKA_LABEL, labelbuf, sizeof(labelbuf) - 1},
-		{CKA_ID, idbuf, sizeof(idbuf)}
-	    };
-	    int j, len;
-
-	    memset(labelbuf, 0, sizeof(labelbuf));
-	    memset(idbuf, 0, sizeof(idbuf));
-
-	    rv = C_GetAttributeValue(hSession, akey[i], attr_template, 3);
-	    if (rv != CKR_OK) {
-		fprintf(stderr,
-			"C_GetAttributeValue[%d]: rv = 0x%.8X\n", i, rv);
-		if (rv = CKR_BUFFER_TOO_SMALL)
-		    fprintf(stderr, "%d too small: %u %u %u\n", i,
-			    attr_template[0].ulValueLen,
-			    attr_template[1].ulValueLen,
-			    attr_template[2].ulValueLen);
-		error = 1;
-		continue;
-	    }
-
-	    len = attr_template[2].ulValueLen;
-	    printf("object[%d]: handle %u class %d label[%u] '%s' id[%u] ",
-		   i, akey[i], oclass,
-		   attr_template[1].ulValueLen, labelbuf,
-		   attr_template[2].ulValueLen);
-	    if (len == 2) {
-		id = (idbuf[0] << 8) & 0xff00;
-		id |= idbuf[1] & 0xff;
-		printf("%i\n", id);
-	    } else {
-		if (len > 8)
-		    len = 8;
-		for (j = 0; j < len; j++)
-		    printf("%02x", idbuf[j]);
-		if (attr_template[2].ulValueLen > len)
-		    printf("...\n");
-		else
-		    printf("\n");
-	    }
-	}
-    }
-
- exit_search:
-    rv = C_FindObjectsFinal(hSession);
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_FindObjectsFinal: Error = 0x%.8X\n", rv);
-	error = 1;
-    }
-
- exit_session:
-    (void) C_CloseSession(hSession);
-
- exit_program:
-    (void) C_Finalize(NULL_PTR);
-
-    exit(error);
-}
@@ -1,230 +0,0 @@
-/* readkey [-s $slot] -l $label [-p $pin] -f $filename */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <string.h>
-#include <sys/types.h>
-#ifndef OPENCRYPTOKI
-#include <security/cryptoki.h>
-#include <security/pkcs11.h>
-#else
-#include <opencryptoki/pkcs11.h>
-#endif
-#include <openssl/conf.h>
-#include <openssl/err.h>
-#include <openssl/rsa.h>
-#include <openssl/pem.h>
-
-static CK_BBOOL truevalue = TRUE;
-
-int
-main(int argc, char *argv[])
-{
-    RSA *rsa = NULL;
-    FILE *fp;
-    CK_RV rv;
-    CK_SLOT_ID slot = 0;
-    CK_SESSION_HANDLE hSession;
-    CK_UTF8CHAR *pin = NULL;
-    char *label;
-    CK_OBJECT_HANDLE key = CK_INVALID_HANDLE;
-    CK_OBJECT_CLASS kclass = CKO_PRIVATE_KEY;
-    char *filename;
-    int error = 0;
-    int i = 0;
-    int c, errflg = 0;
-    CK_ULONG ulObjectCount;
-    CK_ATTRIBUTE search_template[] = {
-	{CKA_LABEL, NULL, 0},
-        {CKA_TOKEN, &truevalue, sizeof (truevalue)},
-	{CKA_CLASS, &kclass, sizeof (kclass)}
-    };
-    CK_BYTE id[32];
-    CK_BYTE data[8][1024];
-    CK_ATTRIBUTE attr_template[] = {
-        {CKA_ID, &id, sizeof (id)},
-	{CKA_MODULUS, (void *)data[0], 1024},          /* n */
-	{CKA_PUBLIC_EXPONENT, (void *)data[1], 1024},  /* e */
-	{CKA_PRIVATE_EXPONENT, (void *)data[2], 1024}, /* d */
-	{CKA_PRIME_1, (void *)data[3], 1024},          /* p */
-	{CKA_PRIME_2, (void *)data[4], 1024},          /* q */
-	{CKA_EXPONENT_1, (void *)data[5], 1024},       /* dmp1 */
-	{CKA_EXPONENT_2, (void *)data[6], 1024},       /* dmq1 */
-	{CKA_COEFFICIENT, (void *)data[7], 1024}       /* iqmp */
-    };
-    extern char *optarg;
-    extern int optopt;
-
-    while ((c = getopt(argc, argv, ":s:l:p:f:")) != -1) {
-        switch (c) {
-	case 's':
-	    slot = atoi(optarg);
-	    break;
-        case 'l':
-            label = optarg;
-            break;
-        case 'p':
-            pin = (CK_UTF8CHAR *)optarg;
-            break;
-        case ':':
-            fprintf(stderr, "Option -%c requires an operand\n", optopt);
-            errflg++;
-            break;
-	case 'f':
-	    filename = optarg;
-	    break;
-        case '?':
-	default:
-            fprintf(stderr, "Unrecognised option: -%c\n", optopt);
-            errflg++;
-        }
-    }
-    if ((errflg) || (!label) || (!filename)) {
-        fprintf(stderr,
-		"usage: readkey [-s slot] -l label [-p pin] -f filename\n");
-        exit(1);
-    }
-    if (slot)
-        printf("slot %d\n", slot);
-
-    /* Initialize OpenSSL library */
-    OPENSSL_config(NULL);
-    rsa = RSA_new();
-    if (!rsa) {
-        fprintf(stderr, "RSA_new failed\n");
-	ERR_print_errors_fp(stderr);
-	exit(1);
-    }
-
-    /* Initialize the CRYPTOKI library */
-    rv = C_Initialize(NULL_PTR);
-    if ((rv != CKR_OK) && (rv != CKR_CRYPTOKI_ALREADY_INITIALIZED)) {
-        fprintf(stderr, "C_Initialize: Error = 0x%.8X\n", rv);
-        exit(1);
-    }
-
-    /* Open a session on the slot found */
-    rv = C_OpenSession(slot, CKF_SERIAL_SESSION,
-		       NULL_PTR, NULL_PTR, &hSession);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_OpenSession: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_program;
-    }
-
-    /* Login to the Token (Keystore) */
-    if (!pin)
-#ifndef OPENCRYPTOKI
-        pin = (CK_UTF8CHAR *)getpassphrase("Enter Pin: ");
-#else
-        pin = (CK_UTF8CHAR *)getpass("Enter Pin: ");
-#endif
-    rv = C_Login(hSession, CKU_USER, pin, strlen((char *)pin));
-    memset(pin, 0, strlen((char *)pin));
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_Login: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_session;
-    }
-
-    /* Set search template. */
-    if (strstr(label, "pkcs11:") == label)
-        label = strstr(label, ":") + 1;
-    search_template[0].pValue = label;
-    search_template[0].ulValueLen = strlen(label);
-
-    rv = C_FindObjectsInit(hSession, search_template, 3); 
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_session;
-    }
-    
-    rv = C_FindObjects(hSession, &key, 1, &ulObjectCount);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjects: Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_search;
-    }
-    if (ulObjectCount == 0) {
-        fprintf(stderr, "C_FindObjects: can't find the key\n");
-	error = 1;
-	goto exit_search;
-    }
-
-    rv = C_GetAttributeValue(hSession, key, attr_template, 9);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_GetAttributeValue: Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_search;
-    }
-
-    printf("ID[%u]=", attr_template[0].ulValueLen);
-    for (i = 0; i < attr_template[0].ulValueLen; i++)
-        printf("%02x", id[i]);
-    printf("\n");
-
-    if (attr_template[1].ulValueLen > 0)
-        rsa->n = BN_bin2bn(data[0], attr_template[1].ulValueLen, NULL);
-    if (attr_template[2].ulValueLen > 0)
-        rsa->e = BN_bin2bn(data[1], attr_template[2].ulValueLen, NULL);
-    if (attr_template[3].ulValueLen > 0)
-        rsa->d = BN_bin2bn(data[2], attr_template[3].ulValueLen, NULL);
-    if (attr_template[4].ulValueLen > 0)
-        rsa->p = BN_bin2bn(data[3], attr_template[4].ulValueLen, NULL);
-    if (attr_template[5].ulValueLen > 0)
-        rsa->q = BN_bin2bn(data[4], attr_template[5].ulValueLen, NULL);
-    if (attr_template[6].ulValueLen > 0)
-        rsa->dmp1 = BN_bin2bn(data[5], attr_template[6].ulValueLen, NULL);
-    if (attr_template[7].ulValueLen > 0)
-        rsa->dmq1 = BN_bin2bn(data[6], attr_template[7].ulValueLen, NULL);
-    if (attr_template[8].ulValueLen > 0)
-        rsa->iqmp = BN_bin2bn(data[7], attr_template[8].ulValueLen, NULL);
-
-    rv = C_FindObjects(hSession, &key, 1, &ulObjectCount);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjects: Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_search;
-    }
-    if (ulObjectCount != 0) {
-        fprintf(stderr, "C_FindObjects: found extra keys?\n");
-	error = 1;
-	goto exit_search;
-    }
-
-    printf("RSA=");
-    RSA_print_fp(stdout, rsa, 4);
-
-    fp = fopen(filename, "w");
-    if (fp == NULL) {
-        printf("Error opening output file.\n");
-	error = 1;
-	goto exit_search;
-    }
-
-    if (!PEM_write_RSAPrivateKey(fp, rsa, NULL, NULL, 0, NULL, NULL)) {
-        printf("Error writing output file.\n");
-	ERR_print_errors_fp(stderr);
-	error = 1;
-	goto exit_search;
-    }
-
- exit_search:
-    rv = C_FindObjectsFinal(hSession);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjectsFinal: Error = 0x%.8X\n", rv);
-        error = 1;
-    }
-
- exit_session:
-    (void) C_CloseSession(hSession);
-
- exit_program:
-    (void) C_Finalize(NULL_PTR);
-
-    exit(error);
-}
@@ -1,159 +0,0 @@
-/* set_key_id [-s slot] [-p $pin] -n $keytag {-i $id | -l $label} */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <string.h>
-#include <sys/types.h>
-#ifndef OPENCRYPTOKI
-#include <security/cryptoki.h>
-#include <security/pkcs11.h>
-#else
-#include <opencryptoki/pkcs11.h>
-#endif
-
-int
-main(int argc, char *argv[])
-{
-    CK_RV rv;
-    CK_SLOT_ID slot = 0;
-    CK_SESSION_HANDLE hSession;
-    CK_UTF8CHAR *pin = NULL;
-    CK_BYTE old_id[2], new_id[2];
-    CK_OBJECT_HANDLE akey;
-    int error = 0;
-    int i = 0;
-    int c, errflg = 0;
-    char *label = NULL;
-    CK_ULONG ulObjectCount;
-    int oid = 0, nid = 0;
-    CK_ATTRIBUTE search_template[] = {
-	{CKA_ID, &old_id, sizeof(old_id)}
-    };
-    extern char *optarg;
-    extern int optopt;
-
-    while ((c = getopt(argc, argv, ":s:i:n:l:p:")) != -1) {
-        switch (c) {
-	case 's':
-	    slot = atoi(optarg);
-	    break;
-        case 'i':
-            oid = atoi(optarg);
-	    oid &= 0xffff;
-	    old_id[0] = (oid >> 8) & 0xff;
-	    old_id[1] = oid & 0xff;
-            break;
-        case 'n':
-            nid = atoi(optarg);
-	    nid &= 0xffff;
-            new_id[0] = (nid >> 8) & 0xff;
-            new_id[1] = nid & 0xff;
-            break;
-	case 'l':
-	    label = optarg;
-	    break;
-        case 'p':
-            pin = (CK_UTF8CHAR *)optarg;
-            break;
-        case ':':
-            fprintf(stderr, "Option -%c requires an operand\n", optopt);
-            errflg++;
-            break;
-        case '?':
-	default:
-            fprintf(stderr, "Unrecognised option: -%c\n", optopt);
-            errflg++;
-        }
-    }
-    if ((errflg) || (!nid) || ((!oid) && (!label))) {
-        fprintf(stderr,
-		"usage: set_key_id [-s slot] [-p pin] -n new_id "
-		"{ -i old_id | -l label }\n");
-        exit(1);
-    }
-    if (!label)
-	printf("old %i new %i\n", oid, nid);
-    else {
-	printf("label %s new %i\n", label, nid);
-	search_template[0].type = CKA_LABEL;
-	search_template[0].pValue = label;
-	search_template[0].ulValueLen = strlen(label);
-    }
-
-    /* Initialize the CRYPTOKI library */
-    rv = C_Initialize(NULL_PTR);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_Initialize: Error = 0x%.8X\n", rv);
-        exit(1);
-    }
-
-    /* Open a session on the slot found */
-    rv = C_OpenSession(slot, CKF_RW_SESSION+CKF_SERIAL_SESSION,
-		       NULL_PTR, NULL_PTR, &hSession);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_OpenSession: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_program;
-    }
-
-    /* Login to the Token (Keystore) */
-    if (!pin)
-#ifndef OPENCRYPTOKI
-        pin = (CK_UTF8CHAR *)getpassphrase("Enter Pin: ");
-#else
-        pin = (CK_UTF8CHAR *)getpass("Enter Pin: ");
-#endif
-    rv = C_Login(hSession, CKU_USER, pin, strlen((char *)pin));
-    memset(pin, 0, strlen((char *)pin));
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_Login: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_session;
-    }
-
-    rv = C_FindObjectsInit(hSession, search_template, 1); 
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_session;
-    }
-    
-    ulObjectCount = 1;
-    while(ulObjectCount) {
-        rv = C_FindObjects(hSession, &akey, 1, &ulObjectCount);
-        if (rv != CKR_OK) {
-            fprintf(stderr, "C_FindObjects: Error = 0x%.8X\n", rv);
-            error = 1;
-            goto exit_search;
-        } else if (ulObjectCount) {       
-            /* Set update template. */
-            CK_ATTRIBUTE new_template[] = {
-                {CKA_ID, &new_id, sizeof(new_id)}
-            };
-
-            rv = C_SetAttributeValue(hSession, akey, new_template, 1);
-            if (rv != CKR_OK) {
-                fprintf(stderr, "C_SetAttributeValue: rv = 0x%.8X\n", rv);
-                error = 1;
-            }
-        }
-    }
-
- exit_search:
-    rv = C_FindObjectsFinal(hSession);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjectsFinal: Error = 0x%.8X\n", rv);
-        error = 1;
-    }
-
- exit_session:
-    (void) C_CloseSession(hSession);
-
- exit_program:
-    (void) C_Finalize(NULL_PTR);
-
-    exit(error);
-}
@@ -1,360 +0,0 @@
-/* writekey [-s $slot] [-p $pin] -l $label -i $id -f $filename */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <string.h>
-#include <sys/types.h>
-#ifndef OPENCRYPTOKI
-#include <security/cryptoki.h>
-#include <security/pkcs11.h>
-#else
-#include <opencryptoki/pkcs11.h>
-#endif
-#include <openssl/conf.h>
-#include <openssl/engine.h>
-#include <openssl/err.h>
-#include <openssl/rsa.h>
-#include <openssl/pem.h>
-
-/* Define static key template values */
-static CK_BBOOL truevalue = TRUE;
-static CK_BBOOL falsevalue = FALSE;
-
-int
-main(int argc, char *argv[])
-{
-    ENGINE *e;
-    RSA *rsa = NULL;
-    FILE *fp;
-    CK_RV rv;
-    CK_SLOT_ID slot = 0;
-    CK_SESSION_HANDLE hSession;
-    CK_UTF8CHAR *pin = NULL;
-    CK_BYTE new_id[2];
-    CK_OBJECT_HANDLE key = CK_INVALID_HANDLE;
-    CK_OBJECT_CLASS kclass;
-    CK_KEY_TYPE ktype = CKK_RSA;
-    CK_ATTRIBUTE template[50];
-    CK_ULONG template_size;
-    CK_BYTE data[8][1024];
-    CK_ULONG ulObjectCount;
-    char *label = NULL, *filename = NULL;
-    int id = 0;
-    int error = 0;
-    int c, errflg = 0;
-    extern char *optarg;
-    extern int optopt;
-    
-    while ((c = getopt(argc, argv, ":s:l:i:p:f:")) != -1) {
-        switch (c) {
-	case 's':
-	    slot = atoi(optarg);
-	    break;
-        case 'l':
-            label = optarg;
-            break;
-        case 'i':
-            id = atoi(optarg);
-	    id &= 0xffff;
-            break;
-        case 'p':
-            pin = (CK_UTF8CHAR *)optarg;
-            break;
-	case 'f':
-	    filename = optarg;
-	    break;
-        case ':':
-            fprintf(stderr, "Option -%c requires an operand\n", optopt);
-            errflg++;
-            break;
-        case '?':
-	default:
-            fprintf(stderr, "Unrecognised option: -%c\n", optopt);
-            errflg++;
-        }
-    }
-    if ((errflg) || (!label) || (!id) || (!filename)) {
-        fprintf(stderr,
-		"usage: writekey [-s slot] [-p pin] -l label -i id "
-		"-f filename\n");
-        exit(2);
-    }
-    
-    /* Load the config file */
-    OPENSSL_config(NULL);
-
-    /* Register engine */
-    e = ENGINE_by_id("pkcs11");
-    if (!e) {
-        /* the engine isn't available */
-        printf("The engine isn't available\n");
-	ERR_print_errors_fp(stderr);
-        exit(1);
-    }
-    
-    if (!ENGINE_init(e)) {
-        /* the engine couldn't initialise, release 'e' */
-        printf("The engine couldn't initialise\n");
-	ERR_print_errors_fp(stderr);
-        ENGINE_free(e);
-        exit(1);
-    }
-
-    /* Read the key */
-    fp = fopen(filename, "r");
-    if (fp == NULL) {
-        printf("Error opening input file.\n");
-	ENGINE_free(e);
-	exit(1);
-    }
-
-    rsa = PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL);
-    (void) fclose(fp);
-    if (rsa == NULL) {
-        printf("Error reading input file.\n");
-	ERR_print_errors_fp(stderr);
-	ENGINE_free(e);
-	exit(1);
-    }
-
-    /* Initialize the CRYPTOKI library */
-    rv = C_Initialize(NULL_PTR);
-    if ((rv != CKR_OK) && (rv != CKR_CRYPTOKI_ALREADY_INITIALIZED)) {
-        fprintf(stderr, "C_Initialize: Error = 0x%.8X\n", rv);
-	ENGINE_free(e);
-	exit(1);
-    }
-
-    /* Open a session on the slot found */
-    rv = C_OpenSession(slot, CKF_RW_SESSION+CKF_SERIAL_SESSION,
-		       NULL_PTR, NULL_PTR, &hSession);
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_OpenSession: Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_program;
-    }
-
-    /* Login to the Token (Keystore) */
-    if (!pin)
-#ifndef OPENCRYPTOKI
-        pin = (CK_UTF8CHAR *)getpassphrase("Enter Pin: ");
-#else
-        pin = (CK_UTF8CHAR *)getpass("Enter Pin: ");
-#endif
-    rv = C_Login(hSession, CKU_USER, pin, strlen((char *)pin));
-    memset(pin, 0, strlen((char *)pin));
-    if (rv != CKR_OK) {
-	fprintf(stderr, "C_Login: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_session;
-    }
-   
-    /* fill the search template */
-    if (strstr(label, "pkcs11:") == label)
-        label = strstr(label, ":") + 1;
-    kclass = CKO_PRIVATE_KEY;
-    template[0].type = CKA_TOKEN;
-    template[0].pValue = &truevalue;
-    template[0].ulValueLen = sizeof (truevalue);
-    template[1].type = CKA_CLASS;
-    template[1].pValue = &kclass;
-    template[1].ulValueLen = sizeof (kclass);
-    template[2].type = CKA_LABEL;
-    template[2].pValue = label;
-    template[2].ulValueLen = strlen(label);
-
-    /* check if a key with the same label already exists */
-    rv = C_FindObjectsInit(hSession, template, 3); 
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjectsInit: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_session;
-    }
-    rv = C_FindObjects(hSession, &key, 1, &ulObjectCount);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjects: Error = 0x%.8X\n", rv);
-        error = 1;
-        goto exit_search;
-    }
-    if (ulObjectCount != 0) {
-        fprintf(stderr, "Key already exists.\n");
-        error = 1;
-        goto exit_search;
-    }
-    
-    /* fill attributes for the public key */
-    new_id[0] = (id >> 8) & 0xff;
-    new_id[1] = id & 0xff;
-    kclass = CKO_PUBLIC_KEY;
-    if (BN_num_bytes(rsa->n) > 1024) {
-        fprintf(stderr, "RSA modulus too large\n");
-	error = 1;
-	goto exit_search;
-    }
-    BN_bn2bin(rsa->n, data[0]);
-    if (BN_num_bytes(rsa->e) > 1024) {
-        fprintf(stderr, "RSA public exponent too large\n");
-	error = 1;
-	goto exit_search;
-    }
-    BN_bn2bin(rsa->e, data[1]);
-    if (BN_num_bytes(rsa->d) > 1024) {
-        fprintf(stderr, "RSA private exponent too large\n");
-	error = 1;
-	goto exit_search;
-    }
-    BN_bn2bin(rsa->d, data[2]);
-    if (BN_num_bytes(rsa->p) > 1024) {
-        fprintf(stderr, "RSA prime 1 too large\n");
-	error = 1;
-	goto exit_search;
-    }
-    BN_bn2bin(rsa->p, data[3]);
-    if (BN_num_bytes(rsa->q) > 1024) {
-        fprintf(stderr, "RSA prime 2 too large\n");
-	error = 1;
-	goto exit_search;
-    }
-    BN_bn2bin(rsa->q, data[4]);
-    if (BN_num_bytes(rsa->dmp1) > 1024) {
-        fprintf(stderr, "RSA exponent 1 too large\n");
-	error = 1;
-	goto exit_search;
-    }
-    BN_bn2bin(rsa->dmp1, data[5]);
-    if (BN_num_bytes(rsa->dmq1) > 1024) {
-        fprintf(stderr, "RSA exponent 2 too large\n");
-	error = 1;
-	goto exit_search;
-    }
-    BN_bn2bin(rsa->dmq1, data[6]);
-    if (BN_num_bytes(rsa->iqmp) > 1024) {
-        fprintf(stderr, "RSA coefficient too large\n");
-	error = 1;
-	goto exit_search;
-    }
-    BN_bn2bin(rsa->iqmp, data[7]);
-
-    template[0].type = CKA_TOKEN;
-    template[0].pValue = &truevalue;
-    template[0].ulValueLen = sizeof (truevalue);
-    template[1].type = CKA_CLASS;
-    template[1].pValue = &kclass;
-    template[1].ulValueLen = sizeof (kclass);
-    template[2].type = CKA_LABEL;
-    template[2].pValue = label;
-    template[2].ulValueLen = strlen(label);
-    template[3].type = CKA_ID;
-    template[3].pValue = new_id;
-    template[3].ulValueLen = sizeof (new_id);
-    template[4].type = CKA_KEY_TYPE;
-    template[4].pValue = &ktype;
-    template[4].ulValueLen = sizeof (ktype);
-    template[5].type = CKA_ENCRYPT;
-    template[5].pValue = &truevalue;
-    template[5].ulValueLen = sizeof (truevalue);
-    template[6].type = CKA_VERIFY;
-    template[6].pValue = &truevalue;
-    template[6].ulValueLen = sizeof (truevalue);
-    template[7].type = CKA_VERIFY_RECOVER;
-    template[7].pValue = &truevalue;
-    template[7].ulValueLen = sizeof (truevalue);
-    template[8].type = CKA_MODULUS;
-    template[8].pValue = data[0];
-    template[8].ulValueLen = BN_num_bytes(rsa->n);
-    template[9].type = CKA_PUBLIC_EXPONENT;
-    template[9].pValue = data[1];
-    template[9].ulValueLen = BN_num_bytes(rsa->e);
-
-    rv = C_CreateObject(hSession, template, 10, &key);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_CreateObject (pub): Error = 0x%.8X\n", rv);
-	error = 1;
-	goto exit_search;
-    }
-
-    /* fill attributes for the private key */
-    kclass = CKO_PRIVATE_KEY;
-    template[0].type = CKA_TOKEN;
-    template[0].pValue = &truevalue;
-    template[0].ulValueLen = sizeof (truevalue);
-    template[1].type = CKA_CLASS;
-    template[1].pValue = &kclass;
-    template[1].ulValueLen = sizeof (kclass);
-    template[2].type = CKA_LABEL;
-    template[2].pValue = label;
-    template[2].ulValueLen = strlen(label);
-    template[3].type = CKA_ID;
-    template[3].pValue = new_id;
-    template[3].ulValueLen = sizeof (new_id);
-    template[4].type = CKA_KEY_TYPE;
-    template[4].pValue = &ktype;
-    template[4].ulValueLen = sizeof (ktype);
-    template[5].type = CKA_SENSITIVE;
-    template[5].pValue = &falsevalue;
-    template[5].ulValueLen = sizeof (falsevalue);
-    template[6].type = CKA_EXTRACTABLE;
-    template[6].pValue = &truevalue;
-    template[6].ulValueLen = sizeof (truevalue);
-    template[7].type = CKA_DECRYPT;
-    template[7].pValue = &truevalue;
-    template[7].ulValueLen = sizeof (truevalue);
-    template[8].type = CKA_SIGN;
-    template[8].pValue = &truevalue;
-    template[8].ulValueLen = sizeof (truevalue);
-    template[9].type = CKA_SIGN_RECOVER;
-    template[9].pValue = &truevalue;
-    template[9].ulValueLen = sizeof (truevalue);
-    template[10].type = CKA_MODULUS;
-    template[10].pValue = data[0];
-    template[10].ulValueLen = BN_num_bytes(rsa->n);
-    template[11].type = CKA_PUBLIC_EXPONENT;
-    template[11].pValue = data[1];
-    template[11].ulValueLen = BN_num_bytes(rsa->e);
-    template[12].type = CKA_PRIVATE_EXPONENT;
-    template[12].pValue = data[2];
-    template[12].ulValueLen = BN_num_bytes(rsa->d);
-    template[13].type = CKA_PRIME_1;
-    template[13].pValue = data[3];
-    template[13].ulValueLen = BN_num_bytes(rsa->p);
-    template[14].type = CKA_PRIME_2;
-    template[14].pValue = data[4];
-    template[14].ulValueLen = BN_num_bytes(rsa->q);
-    template[15].type = CKA_EXPONENT_1;
-    template[15].pValue = data[5];
-    template[15].ulValueLen = BN_num_bytes(rsa->dmp1);
-    template[16].type = CKA_EXPONENT_2;
-    template[16].pValue = data[6];
-    template[16].ulValueLen = BN_num_bytes(rsa->dmq1);
-    template[17].type = CKA_COEFFICIENT;
-    template[17].pValue = data[7];
-    template[17].ulValueLen = BN_num_bytes(rsa->iqmp);
-
-    rv = C_CreateObject(hSession, template, 18, &key);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_CreateObject (priv): Error = 0x%.8X\n", rv);
-	(void) C_DestroyObject(hSession, key);
-	error = 1;
-	goto exit_search;
-    }
-
- exit_search:
-    rv = C_FindObjectsFinal(hSession);
-    if (rv != CKR_OK) {
-        fprintf(stderr, "C_FindObjectsFinal: Error = 0x%.8X\n", rv);
-        error = 1;
-    }
-
- exit_session:
-    (void) C_CloseSession(hSession);
-
- exit_program:
-    (void) C_Finalize(NULL_PTR);
-    ENGINE_free(e);
-    ENGINE_cleanup();
-
-    exit(error);
-}
--- a/Show More
+++ b/Show More