This commit was manufactured by cvs2git to create tag 'v9_4_2_P1'.

the function header.

CHANGES

@@ -1,3 +1,673 @@
+	--- 9.4.2-P1 released ---
+
+2375.   [security]      Fully randomize UDP query ports to improve
+			forgery resilience. [RT #17949]
+
+	--- 9.4.2 released ---
+	--- 9.4.2rc2 released ---
+
+2259.	[bug]		Reverse incorrect LIBINTERFACE bump of libisc
+			in 9.4.2rc1.  Applications built against 9.4.2rc1
+			will need to be rebuilt.
+
+2258.	[bug]		Fallback from IXFR/TSIG to SOA/AXFR/TSIG broken.
+			[RT #17241]
+
+2257.	[bug]		win32: Use the full path to vcredist_x86.exe when
+			calling it. [RT #17222]
+
+2256.	[bug]		win32: Correctly register the installation location of
+			bindevt.dll. [RT #17159]
+
+2255.	[bug]		L.ROOT-SERVERS.NET is now 199.7.83.42.
+
+2254.	[bug]		timer.c:dispatch() failed to lock timer->lock
+			when reading timer->idle allowing it to see
+			intermediate values as timer->idle was reset by
+			isc_timer_touch(). [RT #17243]
+
+	--- 9.4.2rc1 released ---
+
+2251.	[doc]		Update memstatistics-file documentation to reflect
+			reality. Note there is behaviour change for BIND 9.5.
+			[RT #17113]
+
+2249.   [bug]           Only set Authentic Data bit if client requested
+                        DNSSEC, per RFC 3655 [RT #17175]
+
+2248.   [cleanup]       Fix several errors reported by Coverity. [RT #17160]
+
+2245.	[bug]		Validating lack of DS records at trust anchors wasn't
+			working. [RT #17151]
+
+2238.	[bug]		It was possible to trigger a REQUIRE when a
+			validation was cancelled. [RT #17106]
+
+2237.	[bug]		libbind: res_init() was not thread aware. [RT #17123]
+
+2236.	[bug]		dnssec-signzone failed to preserve the case of
+			of wildcard owner names. [RT #17085]
+
+2235.	[bug]		<isc/atomic.h> was not being installed. [RT #17135]
+
+2234.   [port]          Correct some compiler warnings on SCO OSr5 [RT #17134]
+  
+2232.	[bug]		dns_adb_findaddrinfo() could fail and return
+			ISC_R_SUCCESS. [RT #17137]
+
+2231.	[bug]		Building dlzbdb (contrib/dlz/bin/dlzbdb) was broken.
+			[RT #17088]
+
+2230.	[bug]		We could INSIST reading a corrupted journal.
+			[RT #17132]
+
+2228.	[contrib]	contrib: Change 2188 was incomplete.
+
+2227.	[cleanup]	Tidied up the FAQ. [RT #17121]
+
+2225.	[bug]		More support for systems with no IPv4 addresses.
+		        [RT #17111]
+
+2224.	[bug]		Defer journal compaction if a xfrin is in progress.
+			[RT #17119]
+
+2223.	[bug]		Make a new journal when compacting. [RT #17119]
+
+2221.	[bug]		Set the event result code to reflect the actual
+			record returned to caller when a cache update is
+			rejected due to a more credible answer existing.
+			[RT #17017]
+
+2220.	[bug]		win32: Address a race condition in final shutdown of
+			the Windows socket code. [RT #17028]
+			
+2219.	[bug]		Apply zone consistancy checks to additions, not
+			removals, when updating. [RT #17049]
+
+2218.	[bug]		Remove unnecessary REQUIRE from dns_validator_create().
+			[RT #16976]
+
+2216.	[cleanup]	Fix a number of errors reported by Coverity.
+		        [RT #17094]
+
+2215.	[bug]		Bad REQUIRE check isc_hmacsha1_verify(). [RT #17094]
+
+2214.	[bug]		Deregister OpenSSL lock callback when cleaning
+			up.  Reorder OpenSSL cleanup so that RAND_cleanup()
+			is called before the locks are destroyed. [RT #17098]
+
+2213.	[bug]		SIG0 diagnostic failure messages were looking at the
+			wrong status code. [RT #17101]
+
+2212.	[func]		'host -m' now causes memory statistics and active
+			memory to be printed at exit. [RT 17028]
+
+2210.	[bug]		Deleting class specific records via UPDATE could
+			fail.  [RT #17074]
+
+2209.	[port]		osx: linking against user supplied static OpenSSL
+			libraries failed as the system ones were still being
+			found. [RT #17078]
+
+2208.	[port]		win32: make sure both build methods produce the
+			same output. [RT #17058]
+
+2207.	[port]		Some implementations of getaddrinfo() fail to set
+			ai_canonname correctly. [RT #17061]
+
+	--- 9.4.2b1 released ---
+
+2206.	[security]	"allow-query-cache" and "allow-recursion" now
+			cross inherit from each other.
+
+			If allow-query-cache is not set in named.conf then
+			allow-recursion is used if set, otherwise allow-query
+			is used if set, otherwise the default (localnets;
+			localhost;) is used.
+
+			If allow-recursion is not set in named.conf then
+			allow-query-cache is used if set, otherwise allow-query
+			is used if set, otherwise the default (localnets;
+			localhost;) is used.
+
+			[RT #16987]
+	
+2205.	[bug]		libbind: change #2119 broke thread support. [RT #16982]
+
+2203.	[security]	Query id generation was cryptographically weak.
+			[RT # 16915]
+
+2202.	[security]	The default acls for allow-query-cache and 
+			allow-recursion were not being applied. [RT #16960]
+
+2200.	[bug]		The search for cached NSEC records was stopping to
+			early leading to excessive DLV queries. [RT #16930]
+
+2199.	[bug]		win32: don't call WSAStartup() while loading dlls.
+			[RT #16911]
+
+2198.	[bug]		win32: RegCloseKey() could be called when
+			RegOpenKeyEx() failed. [RT #16911]
+
+2197.	[bug]		Add INSIST to catch negative responses which are
+			not setting the event result code appropriately.
+			[RT #16909]
+
+2196.	[port]		win32: yield processor while waiting for once to
+			to complete. [RT #16958]
+
+2194.	[bug]		Close journal before calling 'done' in xfrin.c.
+
+2193.	[port]		win32: BINDInstall.exe is now linked statically.
+			[RT #16906]
+
+2192.	[port]		win32: use vcredist_x86.exe to install Visual
+			Studio's redistributable dlls if building with
+			Visual Stdio 2005 or later.
+
+2189.	[bug]		Handle socket() returning EINTR. [RT #15949]
+
+2188.	[contrib]	queryperf: autoconf changes to make the search for
+			libresolv or libbind more robust. [RT #16299]
+
+2187.	[bug]		query_addds(), query_addwildcardproof() and
+			query_addnxrrsetnsec() should take a version
+			arguement. [RT #16368]
+
+2186.	[port]		cygwin: libbind: check for struct sockaddr_storage
+			independently of IPv6. [RT #16482]
+
+2185.	[port]		sunos: libbind: check for ssize_t, memmove() and
+			memchr(). [RT #16463]
+
+2183.	[bug]		dnssec-signzone didn't handle offline private keys
+			well.  [RT #16832]
+
+2182.	[bug]		dns_dispatch_createtcp() and dispatch_createudp()
+			could return ISC_R_SUCCESS when they ran out of
+			memory. [RT #16365]
+
+2181.	[port]		sunos: libbind: add paths.h from BIND 8. [RT #16462]
+
+2180.	[cleanup]	Remove bit test from 'compress_test' as they
+			are no longer needed. [RT #16497]
+
+2178.	[bug]		'rndc reload' of a slave or stub zone resulted in
+			a reference leak. [RT #16867]
+
+2177.	[bug]		Array bounds overrun on read (rcodetext) at
+			debug level 10+. [RT #16798]
+
+2176.	[contrib]	dbus update to handle race condition during
+			initialisation (Bugzilla 235809). [RT #16842]
+
+2175.	[bug]		win32: windows broadcast condition variable support
+			was broken. [RT #16592]
+
+2174.	[bug]		I/O errors should always be fatal when reading
+			master files. [RT #16825]
+
+2173.	[port]		win32: When compiling with MSVS 2005 SP1 we also
+			need to ship Microsoft.VC80.MFCLOC.
+
+2171.	[bug]		Handle breaks in DNSSEC trust chains where the parent
+			servers are not DS aware (DS queries to the parent
+			return a referral to the child).
+
+2170.	[func]		Add acache processing to test suite. [RT #16711]
+
+2169.	[bug]		host, nslookup: when reporting NXDOMAIN report the
+			given name and not the last name searched for.
+			[RT #16763]
+
+2168.	[bug]		nsupdate: in non-interactive mode treat syntax errors
+			as fatal errors. [RT #16785]
+
+2167.	[bug]		When re-using a automatic zone named failed to
+			attach it to the new view. [RT #16786]
+
+2166.	[bug]		When running in batch mode, dig could misinterpret
+			a server address as a name to be looked up, causing
+			unexpected output. [RT #16743]
+
+2164.	[bug]		The code to determine how named-checkzone / 
+			named-compilezone was called failed under windows.
+			[RT #16764]
+
+2162.	[func]		Allow "rrset-order fixed" to be disabled at compile
+			time. [RT #16665]
+
+2161.	[bug]		'rndc flush' could report a false success. [RT #16698]
+
+2160.	[bug]		libisc wasn't handling NULL ifa_addr pointers returned
+			from getifaddrs(). [RT #16708]
+
+2159.	[bug]		Array bounds overrun in acache processing. [RT #16710]
+
+2158.	[bug]		ns_client_isself() failed to initialise key
+			leading to a REQUIRE failure. [RT #16688]
+
+2156.	[bug]		Fix node reference leaks in lookup.c:lookup_find(),
+			resolver.c:validated() and resolver.c:cache_name().
+			Fix a memory leak in rbtdb.c:free_noqname().
+			Make lookup.c:lookup_find() robust against
+			event leaks. [RT #16685]
+
+2155.	[contrib]	SQLite sdb module from jaboydjr@netwalk.com.
+			[RT #16694]
+
+2153.	[bug]		nsupdate could leak memory. [RT #16691]
+
+2152.	[cleanup]	Use sizeof(buf) instead of fixed number in
+			dighost.c:get_trusted_key(). [RT #16678]
+
+2151.	[bug]		Missing newline in usage message for journalprint.
+			[RT #16679]
+
+2150.	[bug]		'rrset-order cyclic' uniformly distribute the
+			starting point for the first response for a given
+			RRset. [RT #16655]
+
+2149.	[bug]		isc_mem_checkdestroyed() failed to abort on
+			if there were still active memory contexts.
+			[RT #16672]
+
+2147.	[bug]		libbind: remove potential buffer overflow from
+			hmac_link.c. [RT #16437]
+
+2146.	[cleanup]	Silence Linux's spurious "obsolete setsockopt
+			SO_BSDCOMPAT" message. [RT #16641]
+
+2145.	[bug]		Check DS/DLV digest lengths for known digests.
+			[RT #16622]
+
+2144.	[cleanup]	Suppress logging of SERVFAIL from forwarders.
+			[RT #16619]
+
+2143.	[bug]		We failed to restart the IPv6 client when the
+			kernel failed to return the destination the
+			packet was sent to. [RT #16613]
+
+2142.	[bug]		Handle master files with a modification time that
+			matches the epoch. [RT# 16612]
+
+2141.	[bug]		dig/host should not be setting IDN_ASCCHECK (IDN
+			equivalent of LDH checks).  [RT #16609]
+
+2140.	[bug]		libbind: missing unlock on pthread_key_create()
+			failures. [RT #16654]
+
+2139.	[bug]		dns_view_find() was being called with wrong type
+			in adb.c. [RT #16670]
+
+2119.	[compat]	libbind: allow res_init() to succeed enough to
+			return the default domain even if it was unable
+			to allocate memory.
+
+	--- 9.4.1 released ---
+
+2172.	[bug]		query_addsoa() was being called with a non zone db.
+			[RT #16834]
+
+	--- 9.4.0 released ---
+
+2138.	[bug]		Lock order reversal in resolver.c. [RT #16653]
+
+2137.	[port]		Mips little endian and/or mips 64 bit are now
+			supported for atomic operations. [RT#16648]
+
+2136.	[bug]		nslookup/host looped if there was no search list
+			and the host didn't exist. [RT #16657]
+
+2135.	[bug]		Uninitialised rdataset in sdlz.c. [RT# 16656]
+
+2133.	[port]		powerpc:  Support both IBM and MacOS Power PC
+			assembler syntaxes. [RT #16647]
+
+2132.	[bug]		Missing unlock on out of memory in
+			dns_dispatchmgr_setudp().
+
+2131.	[contrib]	dlz/mysql: AXFR was broken. [RT #16630]
+
+2128.	[doc]		xsltproc --nonet, update DTD versions.  [RT #16635]
+
+	--- 9.4.0rc2 released ---
+
+2127.	[port]		Improved OpenSSL 0.9.8 support. [RT #16563]
+
+2126.	[security]	Serialise validation of type ANY responses. [RT #16555]
+
+2125.	[bug]		dns_zone_getzeronosoattl() REQUIRE failure if DLZ
+			was defined. [RT #16574]
+
+2124.	[security]	It was possible to dereference a freed fetch
+			context. [RT #16584]
+
+2120.	[doc]		Fix markup on nsupdate man page. [RT #16556]
+
+	--- 9.4.0rc1 released ---
+
+2118.	[bug]		Handle response with long chains of domain name
+			compression pointers which point to other compression
+			pointers. [RT #16427]
+
+2117.	[bug]		DNSSEC fixes: named could fail to cache NSEC records
+			which could lead to validation failures.  named didn't
+			handle negative DS responses that were in the process
+			of being validated.  Check CNAME bit before accepting
+			NODATA proof. To be able to ignore a child NSEC there
+			must be SOA (and NS) set in the bitmap. [RT #16399]
+
+2116.	[bug]		'rndc reload' could cause the cache to continually
+			be cleaned. [RT #16401]
+
+2115.	[bug]		'rndc reconfig' could trigger a INSIST if the
+			number of masters for a zone was reduced. [RT #16444]
+
+2114.	[bug]		dig/host/nslookup: searches for names with multiple
+			labels were failing. [RT #16447]
+
+2113.	[bug]		nsupdate: if a zone is specified it should be used
+			for server discover. [RT# 16455]
+
+2112.	[security]	Warn if weak RSA exponent is used. [RT #16460]
+
+2111.	[bug]		Fix a number of errors reported by Coverity.
+			[RT #16507]
+
+2110.	[bug]		"minimal-response yes;" interacted badly with BIND 8
+			priming queries. [RT #16491]
+
+2109.	[port]		libbind: silence aix 5.3 compiler warnings. [RT #16502]
+
+2107.	[bug]		dighost.c: more cleanup of buffers. [RT #16499]
+
+2104.	[port]		Fix Solaris SMF error message.
+
+2103.	[port]		Add /usr/sfw to list of locations for OpenSSL
+			under Solaris.
+
+2102.	[port]		Silence solaris 10 warnings.
+
+	--- 9.4.0b4 released ---
+
+2101.	[bug]		OpenSSL version checks were not quite right.
+			[RT #16476]
+
+2100.	[port]		win32: copy libeay32.dll to Build\Debug.
+			Copy Debug\named-checkzone to Debug\named-compilezone.
+
+2099.	[port]		win32: more manifiest issues.
+
+2098.	[bug]		Race in rbtdb.c:no_references(), which occasionally
+			triggered an INSIST failure about the node lock
+			reference.  [RT #16411]
+
+	--- 9.4.0b3 released ---
+
+2097.	[bug]		named could reference a destroyed memory context
+			after being reloaded / reconfigured. [RT #16428]
+
+2096.	[bug]		libbind: handle applications that fail to detect
+			res_init() failures better.
+
+2095.	[port]		libbind: alway prototype inet_cidr_ntop_ipv6() and
+			net_cidr_ntop_ipv6(). [RT #16388]
+ 
+2094.	[contrib]	Update named-bootconf.  [RT# 16404]
+
+2093.	[bug]		named-checkzone -s was broken.
+
+2092.	[bug]		win32: dig, host, nslookup.  Use registry config
+			if resolv.conf does not exist or no nameservers
+			listed. [RT #15877] 
+
+2091.	[port]		dighost.c: race condition on cleanup. [RT #16417]
+
+2090.	[port]		win32: Visual C++ 2005 command line manifest support.
+			[RT #16417]
+
+2089.	[security]	Raise the minimum safe OpenSSL versions to
+			OpenSSL 0.9.7l and OpenSSL 0.9.8d.  Versions
+			prior to these have known security flaws which
+			are (potentially) exploitable in named. [RT #16391]
+
+2088.	[security]	Change the default RSA exponent from 3 to 65537.
+			[RT #16391]
+
+2087.	[port]		libisc failed to compile on OS's w/o a vsnprintf.
+			[RT #16382]
+
+2086.	[port]		libbind: FreeBSD now has get*by*_r() functions.
+			[RT #16403]
+
+2085.	[doc]		win32: added index.html and README to zip. [RT #16201]
+
+2084.	[contrib]	dbus update for 9.3.3rc2.
+
+2083.	[port]		win32: Visual C++ 2005 support.
+
+2082.	[doc]		Document 'cache-file' as a test only option.
+
+	--- 9.4.0b2 released ---
+
+2081.	[port]		libbind: minor 64-bit portability fix in memcluster.c.
+			[RT #16360]
+
+2080.	[port]		libbind: res_init.c did not compile on older versions
+			of Solaris. [RT #16363]
+
+2079.	[bug]		The lame cache was not handling multiple types
+			correctly. [RT #16361]
+
+2078.	[bug]		dnssec-checkzone output style "default" was badly
+			named.  It is now called "relative". [RT #16326]
+
+2077.	[bug]		'dnssec-signzone -O raw' wasn't outputing the
+			complete signed zone. [RT #16326]
+
+2076.	[bug]		Several files were missing #include <config.h>
+			causing build failures on OSF. [RT #16341]
+
+2075.	[bug]		The spillat timer event hander could leak memory.
+			[RT #16357]
+
+2074.	[bug]		dns_request_createvia2(), dns_request_createvia3(),
+			dns_request_createraw2() and dns_request_createraw3()
+			failed to send multiple UDP requests. [RT #16349]
+
+2073.	[bug]		Incorrect semantics check for update policy "wildcard".
+			[RT #16353]
+
+2072.	[bug]		We were not generating valid HMAC SHA digests.
+			[RT #16320]
+
+2071.	[port]		Test whether gcc accepts -fno-strict-aliasing.
+			[RT #16324]
+
+2070.	[bug]		The remote address was not always displayed when
+			reporting dispatch failures. [RT #16315]
+
+2069.	[bug]		Cross compiling was not working. [RT #16330]
+
+2068.	[cleanup]	Lower incremental tuning message to debug 1.
+			[RT #16319]
+
+2067.	[bug]		'rndc' could close the socket too early triggering
+			a INSIST under Windows. [RT #16317]
+
+2066.	[security]	Handle SIG queries gracefully. [RT #16300]
+
+2065.	[bug]		libbind: probe for HPUX prototypes for
+			endprotoent_r() and endservent_r().  [RT 16313]
+
+2064.	[bug]		libbind: silence AIX compiler warnings. [RT #16218]
+
+2063.	[bug]		Change #1955 introduced a bug which caused the first
+			'rndc flush' call to not free memory. [RT #16244]
+
+2062.	[bug]		'dig +nssearch' was reusing a buffer before it had
+			been returned by the socket code. [RT #16307]
+
+2061.	[bug]		Accept expired wildcard message reversed. [RT #16296]
+
+2060.	[bug]		Enabling DLZ support could leave views partially
+			configured. [RT #16295]
+
+	--- 9.4.0b1 released ---
+
+2059.	[bug]		Search into cache rbtdb could trigger an INSIST
+			failure while cleaning up a stale rdataset.
+			[RT #16292]
+
+2058.	[bug]		Adjust how we calculate rtt estimates in the presence
+			of authoritative servers that drop EDNS and/or CD
+			requests.  Also fallback to EDNS/512 and plain DNS
+			faster for zones with less than 3 servers.  [RT #16187]
+
+2057.	[bug]		Make setting "ra" dependent on both allow-query-cache
+			and allow-recursion. [RT #16290]
+
+2056.	[bug]		dig: ixfr= was not being treated case insensitively
+			at all times. [RT #15955]
+
+2055.	[bug]		Missing goto after dropping multicast query.
+			[RT #15944]
+
+2054.	[port]		freebsd: do not explicitly link against -lpthread.
+			[RT #16170]
+
+2053.	[port]		netbsd:libbind: silence compiler warnings. [RT #16220]
+
+2052.	[bug]		'rndc' improve connect failed message to report
+			the failing address. [RT #15978]
+
+2051.	[port]		More strtol() fixes. [RT #16249]
+
+2050.	[bug]		Parsing of NSAP records was not case insensitive.
+			[RT #16287]
+
+2049.	[bug]		Restore SOA before AXFR when falling back from
+			a attempted IXFR when transfering in a zone.
+			Allow a initial SOA query before attempting
+			a AXFR to be requested. [RT #16156]
+
+2048.	[bug]		It was possible to loop forever when using
+			avoid-v4-udp-ports / avoid-v6-udp-ports when
+			the OS always returned the same local port.
+			[RT #16182]
+
+2047.	[bug]		Failed to initialise the interface flags to zero.
+			[RT #16245]
+
+2046.	[bug]		rbtdb.c:rdataset_setadditional() could cause duplicate
+			cleanup [RT #16247].
+
+2045.	[func]		Use lock buckets for acache entries to limit memory
+			consumption. [RT #16183]
+
+2044.	[port]		Add support for atomic operations for Itanium.
+			[RT #16179]
+
+2043.	[port]		nsupdate/nslookup: Force the flushing of the prompt
+			for interactive sessions. [RT#16148]
+
+2042.	[bug]		named-checkconf was incorrectly rejecting the
+			logging category "config". [RT #16117]
+
+2041.	[bug]		"configure --with-dlz-bdb=yes" produced a bad
+			set of libraries to be linked. [RT #16129]
+
+2040.	[bug]		rbtdb no_references() could trigger an INSIST
+			failure with --enable-atomic.  [RT #16022]
+
+2039.	[func]		Check that all buffers passed to the socket code
+			have been retrieved when the socket event is freed.
+			[RT #16122]
+
+2038.	[bug]		dig/nslookup/host was unlinking from wrong list
+			when handling errors. [RT #16122]
+
+2037.	[func]		When unlinking the first or last element in a list
+			check that the list head points to the element to
+			be unlinked. [RT #15959]
+
+2036.	[bug]		'rndc recursing' could cause trigger a REQUIRE.
+			[RT #16075]
+
+2034.	[bug]		gcc: set -fno-strict-aliasing. [RT #16124]
+
+2033.	[bug]		We wern't creating multiple client memory contexts
+			on demand as expected. [RT #16095]
+
+	--- 9.4.0a6 released ---
+
+2032.	[bug]		Remove a INSIST in query_addadditional2(). [RT #16074]
+
+2031.	[bug]		Emit a error message when "rndc refresh" is called on
+			a non slave/stub zone. [RT # 16073]
+
+2030.	[bug]		We were being overly conservative when disabling
+			openssl engine support. [RT #16030]
+
+2029.	[bug]		host printed out the server multiple times when
+			specified on the command line. [RT #15992]
+
+2028.	[port]		linux: socket.c compatability for old systems.
+			[RT #16015]
+
+2027.	[port]		libbind: Solaris x86 support. [RT #16020]
+
+2026.	[bug]		Rate limit the two recursive client exceeded messages.
+			[RT #16044]
+
+2025.	[func]		Update "zone serial unchanged" message. [RT #16026]
+
+2024.	[bug]		named emited spurious "zone serial unchanged"
+			messages on reload. [RT #16027]
+
+2023.	[bug]		"make install" should create ${localstatedir}/run and
+			${sysconfdir} if they do not exist. [RT #16033]
+
+2022.	[bug]		If dnssec validation is disabled only assert CD if
+			CD was requested. [RT #16037]
+
+2021.	[bug]		dnssec-enable no; triggered a REQUIRE. [RT #16037]
+
+2020.	[bug]		rdataset_setadditional() could leak memory. [RT #16034]
+
+2019.	[tuning]	Reduce the amount of work performed per quantum
+			when cleaning the cache. [RT #15986]
+
+2018.	[bug]		Checking if the HMAC MD5 private file was broken.
+			[RT #15960]
+
+2017.	[bug]		allow-query default was not correct. [RT #15946]
+
+2016.	[bug]		Return a partial answer if recursion is not
+			allowed but requested and we had the answer
+			to the original qname. [RT #15945]
+
+	--- 9.4.0a5 released ---
+
+2015.	[cleanup]	use-additional-cache is now acache-enable for
+			consistancy.  Default acache-enable off in BIND 9.4
+			as it requires memory usage to be configured.
+			It may be enabled by default in BIND 9.5 once we
+			have more experience with it.
+
+2014.	[func]		Statistics about acache now recorded and sent
+			to log. [RT #15976]
+
+2013.	[bug]		Handle unexpected TSIGs on unsigned AXFR/IXFR
+			responses more gracefully. [RT #15941]
+
+2012.	[func]		Don't insert new acache entries if acache is full.
+			[RT #15970]
+
+2011.	[func]		dnssec-signzone can now update the SOA record of
+			the signed zone, either as an increment or as the
+			system time(). [RT #15633]
 
 	--- 9.4.0a4 released ---
 
@@ -129,7 +799,7 @@
 			hex strings with comments. [RT #15814]
 
 1974.	[doc]		List each of the zone types and associated zone
-			options seperately in the ARM.
+			options separately in the ARM.
 
 1973.	[func]		TSIG HMACSHA1, HMACSHA224, HMACSHA256, HMACSHA384 and
 			HMACSHA512 support. [RT #13606]
@@ -138,7 +808,7 @@
 			Jason Vas Dias <jvdias@redhat.com>.
 
 1971.	[port]		linux: make detection of missing IF_NAMESIZE more
-                        robust. [RT #15443]
+			robust. [RT #15443]
 
 1970.	[bug]		nsupdate: adjust UDP timeout when falling back to
 			unsigned SOA query. [RT #15775]
@@ -156,7 +826,7 @@
 1965.	[func]		Suppress spurious "recusion requested but not
 			available" warning with 'dig +qr'. [RT #15780].
 
-1964.	[func]		Seperate out MX and SRV to CNAME checks. [RT #15723]
+1964.	[func]		Separate out MX and SRV to CNAME checks. [RT #15723]
 
 1963.	[port]		Tru64 4.0E doesn't support send() and recv(). 
 			[RT #15586]
@@ -260,7 +930,7 @@
 1935.	[bug]		'acache' was DO sensitive. [RT #15430]
 
 1934.	[func]		Validate pending NS RRsets, in the authority section,
-			prior to returning them if it can be done without 
+			prior to returning them if it can be done without
 			requiring DNSKEYs to be fetched.  [RT #15430]
 
 1919.	[contrib]	queryperf: a set of new features: collecting/printing
@@ -376,7 +1046,7 @@
 1898.	[bug]		Extend ISC_SOCKADDR_FORMATSIZE and
 			ISC_NETADDR_FORMATSIZE to allow for scope details.
 
-1897.	[func]		x86 and x86_64 now have seperate atomic locking
+1897.	[func]		x86 and x86_64 now have separate atomic locking
 			implementations.
 
 1896.	[bug]		Recursive clients soft quota support wasn't working
@@ -430,7 +1100,7 @@
 			[RT #14892]
 
 1878.	[func]		Detect duplicates of UDP queries we are recursing on
-			and drop them.  New stats category "duplicates".
+			and drop them.  New stats category "duplicate".
 			[RT #2471]
 
 1877.	[bug]		Fix unreasonably low quantum on call to
@@ -727,14 +1397,14 @@
 
 1779.	[port]		OSF 5.1: libtool didn't handle -pthread correctly.
 
-1778.   [port]   	HUX 11.11: fix broken IN6ADDR_ANY_INIT and
+1778.	[port]		HUX 11.11: fix broken IN6ADDR_ANY_INIT and
 			IN6ADDR_LOOPBACK_INIT macros.
 
-1777.   [port]   	OSF 5.1: fix broken IN6ADDR_ANY_INIT and
+1777.	[port]		OSF 5.1: fix broken IN6ADDR_ANY_INIT and
 			IN6ADDR_LOOPBACK_INIT macros.
 
-1776.   [port]   	Solaris 2.9: fix broken IN6ADDR_ANY_INIT and
-                        IN6ADDR_LOOPBACK_INIT macros.
+1776.	[port]		Solaris 2.9: fix broken IN6ADDR_ANY_INIT and
+			IN6ADDR_LOOPBACK_INIT macros.
 
 1775.	[bug]		Only compile getnetent_r.c when threaded. [RT #13205]
 
@@ -1374,7 +2044,7 @@
 			[RT #6427]
 
 1555.	[func]		'rrset-order cyclic' no longer has a random starting
-			point. [RT #7572]
+			point per query. [RT #7572]
 
 1554.	[bug]		dig, host, nslookup failed when no nameservers
 			were specified in /etc/resolv.conf. [RT #8232]
@@ -5855,7 +6525,7 @@
 			and has been removed.
 
  170.	[cleanup]	Remove inter server consistancy checks from zone,
-			these should return as a seperate module in 9.1.
+			these should return as a separate module in 9.1.
 			dns_zone_checkservers(), dns_zone_checkparents(),
 			dns_zone_checkchildren(), dns_zone_checkglue().
 

COPYRIGHT

@@ -1,7 +1,7 @@
-Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 1996-2003  Internet Software Consortium.
 
-Permission to use, copy, modify, and distribute this software for any
+Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.
 
@@ -13,7 +13,7 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.
 
-$Id: COPYRIGHT,v 1.9.18.2 2006/01/04 00:37:23 marka Exp $
+$Id: COPYRIGHT,v 1.9.18.4 2007/08/28 07:19:54 tbox Exp $
 
 Portions Copyright (C) 1996-2001  Nominum, Inc.
 

FAQ

@@ -1,96 +1,74 @@
 Frequently Asked Questions about BIND 9
 
--------------------------------------------------------------------------------
+Copyright © 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 
-Q: Why doesn't -u work on Linux 2.2.x when I build with --enable-threads?
+Copyright © 2000-2003 Internet Software Consortium.
 
-A: Linux threads do not fully implement the Posix threads (pthreads) standard. In
-   particular, setuid() operates only on the current thread, not the full process.
-   Because of this limitation, BIND 9 cannot use setuid() on Linux as it can on
-   all other supported platforms. setuid() cannot be called before creating
-   threads, since the server does not start listening on reserved ports until
-   after threads have started.
+-----------------------------------------------------------------------
 
-   In the 2.2.18 or 2.3.99-pre3 and newer kernels, the ability to preserve
-   capabilities across a setuid() call is present. This allows BIND 9 to call
-   setuid() early, while retaining the ability to bind reserved ports. This is a
-   Linux-specific hack.
+1. Compilation and Installation Questions
 
-   On a 2.2 kernel, BIND 9 does drop many root privileges, so it should be less of
-   a security risk than a root process that has not dropped privileges.
+Q: I'm trying to compile BIND 9, and "make" is failing due to files not
+   being found. Why?
 
-   If Linux threads ever work correctly, this restriction will go away.
+A: Using a parallel or distributed "make" to build BIND 9 is not
+   supported, and doesn't work. If you are using one of these, use normal
+   make or gmake instead.
 
-   Configuring BIND9 with the --disable-threads option (the default) causes a
-   non-threaded version to be built, which will allow -u to be used.
+Q: Isn't "make install" supposed to generate a default named.conf?
 
-Q: Why do I get the following errors:
+A: Short Answer: No.
 
-   general: errno2result.c:109: unexpected error:
-   general: unable to convert errno to isc_result: 14: Bad address
-   client: UDP client handler shutting down due to fatal receive error: unexpected error
+   Long Answer: There really isn't a default configuration which fits any
+   site perfectly. There are lots of decisions that need to be made and
+   there is no consensus on what the defaults should be. For example
+   FreeBSD uses /etc/namedb as the location where the configuration files
+   for named are stored. Others use /var/named.
 
-A: This is the result of a Linux kernel bug.
+   What addresses to listen on? For a laptop on the move a lot you may
+   only want to listen on the loop back interfaces.
 
-   See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2
+   Who do you offer recursive service to? Is there are firewall to
+   consider? If so is it stateless or stateful. Are you directly on the
+   Internet? Are you on a private network? Are you on a NAT'd network? The
+   answers to all these questions change how you configure even a caching
+   name server.
 
-Q: Why does named log the warning message "no TTL specified - using SOA MINTTL
-   instead"?
+2. Configuration and Setup Questions
 
-A: Your zone file is illegal according to RFC1035. It must either have a line
-   like:
+Q: Why does named log the warning message "no TTL specified - using SOA
+   MINTTL instead"?
+
+A: Your zone file is illegal according to RFC1035. It must either have a
+   line like:
 
    $TTL 86400
 
-   at the beginning, or the first record in it must have a TTL field, like the
-   "84600" in this example:
+   at the beginning, or the first record in it must have a TTL field, like
+   the "84600" in this example:
 
    example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 )
 
-Q: Why do I see 5 (or more) copies of named on Linux?
+Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master
+   file bar: ran out of space"?
 
-A: Linux threads each show up as a process under ps. The approximate number of
-   threads running is n+4, where n is the number of CPUs. Note that the amount of
-   memory used is not cumulative; if each process is using 10M of memory, only a
-   total of 10M is used.
-
-   Newer versions of Linux's ps command hide the individual threads and require -L
-   to display them.
-
-Q: Why does BIND 9 log "permission denied" errors accessing its configuration
-   files or zones on my Linux system even though it is running as root?
-
-A: On Linux, BIND 9 drops most of its root privileges on startup. This including
-   the privilege to open files owned by other users. Therefore, if the server is
-   running as root, the configuration files and zone files should also be owned by
-   root.
-
-Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master file bar:
-   ran out of space"?
-
-A: This is often caused by TXT records with missing close quotes. Check that all
-   TXT records containing quoted strings have both open and close quotes.
-
-Q: How do I produce a usable core file from a multithreaded named on Linux?
-
-A: If the Linux kernel is 2.4.7 or newer, multithreaded core dumps are usable
-   (that is, the correct thread is dumped). Otherwise, if using a 2.2 kernel,
-   apply the kernel patch found in contrib/linux/coredump-patch and rebuild the
-   kernel. This patch will cause multithreaded programs to dump the correct
-   thread.
+A: This is often caused by TXT records with missing close quotes. Check
+   that all TXT records containing quoted strings have both open and close
+   quotes.
 
 Q: How do I restrict people from looking up the server version?
 
-A: Put a "version" option containing something other than the real version in the
-   "options" section of named.conf. Note doing this will not prevent attacks and
-   may impede people trying to diagnose problems with your server. Also it is
-   possible to "fingerprint" nameservers to determine their version.
+A: Put a "version" option containing something other than the real version
+   in the "options" section of named.conf. Note doing this will not
+   prevent attacks and may impede people trying to diagnose problems with
+   your server. Also it is possible to "fingerprint" nameservers to
+   determine their version.
 
 Q: How do I restrict only remote users from looking up the server version?
 
-A: The following view statement will intercept lookups as the internal view that
-   holds the version information will be matched last. The caveats of the previous
-   answer still apply, of course.
+A: The following view statement will intercept lookups as the internal
+   view that holds the version information will be matched last. The
+   caveats of the previous answer still apply, of course.
 
    view "chaos" chaos {
            match-clients { <those to be refused>; };
@@ -101,120 +79,46 @@ A: The following view statement will intercept lookups as the internal view that
            };
    };
 
-Q: What do "no source of entropy found" or "could not open entropy source foo"
-   mean?
+Q: What do "no source of entropy found" or "could not open entropy source
+   foo" mean?
 
-A: The server requires a source of entropy to perform certain operations, mostly
-   DNSSEC related. These messages indicate that you have no source of entropy. On
-   systems with /dev/random or an equivalent, it is used by default. A source of
-   entropy can also be defined using the random-device option in named.conf.
+A: The server requires a source of entropy to perform certain operations,
+   mostly DNSSEC related. These messages indicate that you have no source
+   of entropy. On systems with /dev/random or an equivalent, it is used by
+   default. A source of entropy can also be defined using the
+   random-device option in named.conf.
 
-Q: I installed BIND 9 and restarted named, but it's still BIND 8. Why?
+Q: I'm trying to use TSIG to authenticate dynamic updates or zone
+   transfers. I'm sure I have the keys set up correctly, but the server is
+   rejecting the TSIG. Why?
 
-A: BIND 9 is installed under /usr/local by default. BIND 8 is often installed
-   under /usr. Check that the correct named is running.
-
-Q: I'm trying to use TSIG to authenticate dynamic updates or zone transfers. I'm
-   sure I have the keys set up correctly, but the server is rejecting the TSIG.
-   Why?
-
-A: This may be a clock skew problem. Check that the the clocks on the client and
-   server are properly synchronised (e.g., using ntp).
-
-Q: I'm trying to compile BIND 9, and "make" is failing due to files not being
-   found. Why?
-
-A: Using a parallel or distributed "make" to build BIND 9 is not supported, and
-   doesn't work. If you are using one of these, use normal make or gmake instead.
-
-Q: I have a BIND 9 master and a BIND 8.2.3 slave, and the master is logging error
-   messages like "notify to 10.0.0.1#53 failed: unexpected end of input". What's
-   wrong?
-
-A: This error message is caused by a known bug in BIND 8.2.3 and is fixed in BIND
-   8.2.4. It can be safely ignored - the notify has been acted on by the slave
-   despite the error message.
-
-Q: I keep getting log messages like the following. Why?
-
-   Dec 4 23:47:59 client 10.0.0.1#1355: updating zone 'example.com/IN': update
-   failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
-
-A: DNS updates allow the update request to test to see if certain conditions are
-   met prior to proceeding with the update. The message above is saying that
-   conditions were not met and the update is not proceeding. See doc/rfc/
-   rfc2136.txt for more details on prerequisites.
-
-Q: I keep getting log messages like the following. Why?
-
-   Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied
-
-A: Someone is trying to update your DNS data using the RFC2136 Dynamic Update
-   protocol. Windows 2000 machines have a habit of sending dynamic update requests
-   to DNS servers without being specifically configured to do so. If the update
-   requests are coming from a Windows 2000 machine, see http://
-   support.microsoft.com/support/kb/articles/q246/8/04.asp for information about
-   how to turn them off.
+A: This may be a clock skew problem. Check that the the clocks on the
+   client and server are properly synchronised (e.g., using ntp).
 
 Q: I see a log message like the following. Why?
 
    couldn't open pid file '/var/run/named.pid': Permission denied
 
-A: You are most likely running named as a non-root user, and that user does not
-   have permission to write in /var/run. The common ways of fixing this are to
-   create a /var/run/named directory owned by the named user and set pid-file to "
-   /var/run/named/named.pid", or set pid-file to "named.pid", which will put the
-   file in the directory specified by the directory option (which, in this case,
-   must be writable by the named user).
+A: You are most likely running named as a non-root user, and that user
+   does not have permission to write in /var/run. The common ways of
+   fixing this are to create a /var/run/named directory owned by the named
+   user and set pid-file to "/var/run/named/named.pid", or set pid-file to
+   "named.pid", which will put the file in the directory specified by the
+   directory option (which, in this case, must be writable by the named
+   user).
 
-Q: When I do a "dig . ns", many of the A records for the root servers are missing.
-   Why?
+Q: I can query the nameserver from the nameserver but not from other
+   machines. Why?
 
-A: This is normal and harmless. It is a somewhat confusing side effect of the way
-   BIND 9 does RFC2181 trust ranking and of the efforts BIND 9 makes to avoid
-   promoting glue into answers.
+A: This is usually the result of the firewall configuration stopping the
+   queries and / or the replies.
 
-   When BIND 9 first starts up and primes its cache, it receives the root server
-   addresses as additional data in an authoritative response from a root server,
-   and these records are eligible for inclusion as additional data in responses.
-   Subsequently it receives a subset of the root server addresses as additional
-   data in a non-authoritative (referral) response from a root server. This causes
-   the addresses to now be considered non-authoritative (glue) data, which is not
-   eligible for inclusion in responses.
+Q: How can I make a server a slave for both an internal and an external
+   view at the same time? When I tried, both views on the slave were
+   transferred from the same view on the master.
 
-   The server does have a complete set of root server addresses cached at all
-   times, it just may not include all of them as additional data, depending on
-   whether they were last received as answers or as glue. You can always look up
-   the addresses with explicit queries like "dig a.root-servers.net A".
-
-Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail. Why?
-
-A: This may be caused by a bug in the Windows 2000 DNS server where DNS messages
-   larger than 16K are not handled properly. This can be worked around by setting
-   the option "transfer-format one-answer;". Also check whether your zone contains
-   domain names with embedded spaces or other special characters, like "John\
-   032Doe\213s\032Computer", since such names have been known to cause Windows
-   2000 slaves to incorrectly reject the zone.
-
-Q: Why don't my zones reload when I do an "rndc reload" or SIGHUP?
-
-A: A zone can be updated either by editing zone files and reloading the server or
-   by dynamic update, but not both. If you have enabled dynamic update for a zone
-   using the "allow-update" option, you are not supposed to edit the zone file by
-   hand, and the server will not attempt to reload it.
-
-Q: I can query the nameserver from the nameserver but not from other machines.
-   Why?
-
-A: This is usually the result of the firewall configuration stopping the queries
-   and / or the replies.
-
-Q: How can I make a server a slave for both an internal and an external view at
-   the same time? When I tried, both views on the slave were transferred from the
-   same view on the master.
-
-A: You will need to give the master and slave multiple IP addresses and use those
-   to make sure you reach the correct view on the other machine.
+A: You will need to give the master and slave multiple IP addresses and
+   use those to make sure you reach the correct view on the other machine.
 
    Master: 10.0.1.1 (internal), 10.0.1.2 (external, IP alias)
        internal:
@@ -242,8 +146,8 @@ A: You will need to give the master and slave multiple IP addresses and use thos
            transfer-source 10.0.1.4;
            query-source address 10.0.1.4;
 
-   You put the external address on the alias so that all the other dns clients on
-   these boxes see the internal view by default.
+   You put the external address on the alias so that all the other dns
+   clients on these boxes see the internal view by default.
 
 A: BIND 9.3 and later: Use TSIG to select the appropriate view.
 
@@ -279,64 +183,38 @@ A: BIND 9.3 and later: Use TSIG to select the appropriate view.
                    ...
            };
 
-Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
+Q: I get error messages like "multiple RRs of singleton type" and "CNAME
+   and other data" when transferring a zone. What does this mean?
 
-A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to use
-   certain interrupts as a source of random events. You can make this permanent by
-   setting rand_irqs in /etc/rc.conf.
-
-   /etc/rc.conf
-   rand_irqs="3 14 15"
-
-   See also http://people.freebsd.org/~dougb/randomness.html
-
-Q: Why is named listening on UDP port other than 53?
-
-A: Named uses a system selected port to make queries of other nameservers. This
-   behaviour can be overridden by using query-source to lock down the port and/or
-   address. See also notify-source and transfer-source.
-
-Q: I get error messages like "multiple RRs of singleton type" and "CNAME and other
-   data" when transferring a zone. What does this mean?
-
-A: These indicate a malformed master zone. You can identify the exact records
-   involved by transferring the zone using dig then running named-checkzone on it.
+A: These indicate a malformed master zone. You can identify the exact
+   records involved by transferring the zone using dig then running
+   named-checkzone on it.
 
    dig axfr example.com @master-server > tmp
    named-checkzone example.com tmp
 
-   A CNAME record cannot exist with the same name as another record except for the
-   DNSSEC records which prove its existance (NSEC).
+   A CNAME record cannot exist with the same name as another record except
+   for the DNSSEC records which prove its existence (NSEC).
 
-   RFC 1034, Section 3.6.2: "If a CNAME RR is present at a node, no other data
-   should be present; this ensures that the data for a canonical name and its
-   aliases cannot be different. This rule also insures that a cached CNAME can be
-   used without checking with an authoritative server for other RR types."
+   RFC 1034, Section 3.6.2: "If a CNAME RR is present at a node, no other
+   data should be present; this ensures that the data for a canonical name
+   and its aliases cannot be different. This rule also insures that a
+   cached CNAME can be used without checking with an authoritative server
+   for other RR types."
 
-Q: I get error messages like "named.conf:99: unexpected end of input" where 99 is
-   the last line of named.conf.
+Q: I get error messages like "named.conf:99: unexpected end of input"
+   where 99 is the last line of named.conf.
 
-A: Some text editors (notepad and wordpad) fail to put a line title indication
-   (e.g. CR/LF) on the last line of a text file. This can be fixed by "adding" a
-   blank line to the end of the file. Named expects to see EOF immediately after
-   EOL and treats text files where this is not met as truncated.
-
-Q: I get warning messages like "zone example.com/IN: refresh: failure trying
-   master 1.2.3.4#53: timed out".
-
-A: Check that you can make UDP queries from the slave to the master
-
-   dig +norec example.com soa @1.2.3.4
-
-   You could be generating queries faster than the slave can cope with. Lower the
-   serial query rate.
-
-   serial-query-rate 5; // default 20
+A: Some text editors (notepad and wordpad) fail to put a line title
+   indication (e.g. CR/LF) on the last line of a text file. This can be
+   fixed by "adding" a blank line to the end of the file. Named expects to
+   see EOF immediately after EOL and treats text files where this is not
+   met as truncated.
 
 Q: How do I share a dynamic zone between multiple views?
 
-A: You choose one view to be master and the second a slave and transfer the zone
-   between views.
+A: You choose one view to be master and the second a slave and transfer
+   the zone between views.
 
    Master 10.0.1.1:
            key "external" {
@@ -350,7 +228,7 @@ A: You choose one view to be master and the second a slave and transfer the zone
            };
 
            view "internal" {
-                   match-clients { !external; 10.0.1/24; };
+                   match-clients { !key external; 10.0.1/24; };
                    server 10.0.1.1 {
                            /* Deliver notify messages to external view. */
                            keys { external; };
@@ -364,7 +242,7 @@ A: You choose one view to be master and the second a slave and transfer the zone
            };
 
            view "external" {
-                   match-clients { external; any; };
+                   match-clients { key external; any; };
                    zone "example.com" {
                            type slave;
                            file "external/example.db";
@@ -375,18 +253,19 @@ A: You choose one view to be master and the second a slave and transfer the zone
                    };
            };
 
-Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading master
-   file primaries/wireless.ietf56.ietf.org: no owner".
+Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading
+   master file primaries/wireless.ietf56.ietf.org: no owner".
 
-A: This error is produced when a line in the master file contains leading white
-   space (tab/space) but the is no current record owner name to inherit the name
-   from. Usually this is the result of putting white space before a comment.
-   Forgeting the "@" for the SOA record or indenting the master file.
+A: This error is produced when a line in the master file contains leading
+   white space (tab/space) but the is no current record owner name to
+   inherit the name from. Usually this is the result of putting white
+   space before a comment, forgetting the "@" for the SOA record, or
+   indenting the master file.
 
 Q: Why are my logs in GMT (UTC).
 
-A: You are running chrooted (-t) and have not supplied local timzone information
-   in the chroot area.
+A: You are running chrooted (-t) and have not supplied local timezone
+   information in the chroot area.
 
    FreeBSD: /etc/localtime
    Solaris: /etc/TIMEZONE and /usr/share/lib/zoneinfo
@@ -394,71 +273,51 @@ A: You are running chrooted (-t) and have not supplied local timzone information
 
    See also tzset(3) and zic(8).
 
-Q: I get the error message "named: capset failed: Operation not permitted" when
-   starting named.
-
-A: The capability module, part of "Linux Security Modules/LSM", has not been
-   loaded into the kernel. See insmod(8).
-
-Q: I get "rndc: connect failed: connection refused" when I try to run rndc.
+Q: I get "rndc: connect failed: connection refused" when I try to run
+   rndc.
 
 A: This is usually a configuration error.
 
-   First ensure that named is running and no errors are being reported at startup
-   (/var/log/messages or equivalent). Running "named -g <usual arguments>" from a
-   title can help at this point.
+   First ensure that named is running and no errors are being reported at
+   startup (/var/log/messages or equivalent). Running "named -g <usual
+   arguments>" from a title can help at this point.
 
-   Secondly ensure that named is configured to use rndc either by "rndc-confgen
-   -a", rndc-confgen or manually. The Administrators Reference manual has details
-   on how to do this.
+   Secondly ensure that named is configured to use rndc either by
+   "rndc-confgen -a", rndc-confgen or manually. The Administrators
+   Reference manual has details on how to do this.
 
-   Old versions of rndc-confgen used localhost rather than 127.0.0.1 in /etc/
-   rndc.conf for the default server. Update /etc/rndc.conf if necessary so that
-   the default server listed in /etc/rndc.conf matches the addresses used in
-   named.conf. "localhost" has two address (127.0.0.1 and ::1).
+   Old versions of rndc-confgen used localhost rather than 127.0.0.1 in /
+   etc/rndc.conf for the default server. Update /etc/rndc.conf if
+   necessary so that the default server listed in /etc/rndc.conf matches
+   the addresses used in named.conf. "localhost" has two address
+   (127.0.0.1 and ::1).
 
-   If you use "rndc-confgen -a" and named is running with -t or -u ensure that /
-   etc/rndc.conf has the correct ownership and that a copy is in the chroot area.
-   You can do this by re-running "rndc-confgen -a" with appropriate -t and -u
-   arguments.
-
-Q: I don't get RRSIG's returned when I use "dig +dnssec".
-
-A: You need to ensure DNSSEC is enabled (dnssec-enable yes;).
-
-Q: I get "Error 1067" when starting named under Windows.
-
-A: This is the service manager saying that named exited. You need to examine the
-   Application log in the EventViewer to find out why.
-
-   Common causes are that you failed to create "named.conf" (usually "C:\windows\
-   dns\etc\named.conf") or failed to specify the directory in named.conf.
-
-   options {
-           Directory "C:\windows\dns\etc";
-   };
+   If you use "rndc-confgen -a" and named is running with -t or -u ensure
+   that /etc/rndc.conf has the correct ownership and that a copy is in the
+   chroot area. You can do this by re-running "rndc-confgen -a" with
+   appropriate -t and -u arguments.
 
 Q: I get "transfer of 'example.net/IN' from 192.168.4.12#53: failed while
    receiving responses: permission denied" error messages.
 
-A: These indicate a filesystem permission error preventing named creating /
-   renaming the temporary file. These will usually also have other associated
-   error messages like
+A: These indicate a filesystem permission error preventing named creating
+   / renaming the temporary file. These will usually also have other
+   associated error messages like
 
    "dumping master file: sl/tmp-XXXX5il3sQ: open: permission denied"
 
-   Named needs write permission on the directory containing the file. Named writes
-   the new cache file to a temporary file then renames it to the name specified in
-   named.conf to ensure that the contents are always complete. This is to prevent
-   named loading a partial zone in the event of power failure or similar
-   interrupting the write of the master file.
+   Named needs write permission on the directory containing the file.
+   Named writes the new cache file to a temporary file then renames it to
+   the name specified in named.conf to ensure that the contents are always
+   complete. This is to prevent named loading a partial zone in the event
+   of power failure or similar interrupting the write of the master file.
 
-   Note file names are relative to the directory specified in options and any
-   chroot directory ([<chroot dir>/][<options dir>]).
+   Note file names are relative to the directory specified in options and
+   any chroot directory ([<chroot dir>/][<options dir>]).
 
-   If named is invoked as "named -t /chroot/DNS" with the following named.conf
-   then "/chroot/DNS/var/named/sl" needs to be writable by the user named is
-   running as.
+   If named is invoked as "named -t /chroot/DNS" with the following
+   named.conf then "/chroot/DNS/var/named/sl" needs to be writable by the
+   user named is running as.
 
    options {
            directory "/var/named";
@@ -470,35 +329,153 @@ A: These indicate a filesystem permission error preventing named creating /
            masters { 192.168.4.12; };
    };
 
-Q: How do I intergrate BIND 9 and Solaris SMF
+Q: I want to forward all DNS queries from my caching nameserver to another
+   server. But there are some domains which have to be served locally, via
+   rbldnsd.
 
-A: Sun has a blog entry describing how to do this.
+   How do I achieve this ?
 
-   http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris
+A: options {
+           forward only;
+           forwarders { <ip.of.primary.nameserver>; };
+   };
+
+   zone "sbl-xbl.spamhaus.org" {
+           type forward; forward only;
+           forwarders { <ip.of.rbldns.server> port 530; };
+   };
+
+   zone "list.dsbl.org" {
+           type forward; forward only;
+           forwarders { <ip.of.rbldns.server> port 530; };
+   };
+
+
+Q: Can you help me understand how BIND 9 uses memory to store DNS zones?
+
+   Some times it seems to take several times the amount of memory it needs
+   to store the zone.
+
+A: When reloading a zone named my have multiple copies of the zone in
+   memory at one time. The zone it is serving and the one it is loading.
+   If reloads are ultra fast it can have more still.
+
+   e.g. Ones that are transferring out, the one that it is serving and the
+   one that is loading.
+
+   BIND 8 destroyed the zone before loading and also killed off outgoing
+   transfers of the zone.
+
+   The new strategy allows slaves to get copies of the new zone regardless
+   of how often the master is loaded compared to the transfer time. The
+   slave might skip some intermediate versions but the transfers will
+   complete and it will keep reasonably in sync with the master.
+
+   The new strategy also allows the master to recover from syntax and
+   other errors in the master file as it still has an in-core copy of the
+   old contents.
+
+3. General Questions
+
+Q: I keep getting log messages like the following. Why?
+
+   Dec 4 23:47:59 client 10.0.0.1#1355: updating zone 'example.com/IN':
+   update failed: 'RRset exists (value dependent)' prerequisite not
+   satisfied (NXRRSET)
+
+A: DNS updates allow the update request to test to see if certain
+   conditions are met prior to proceeding with the update. The message
+   above is saying that conditions were not met and the update is not
+   proceeding. See doc/rfc/rfc2136.txt for more details on prerequisites.
+
+Q: I keep getting log messages like the following. Why?
+
+   Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied
+
+A: Someone is trying to update your DNS data using the RFC2136 Dynamic
+   Update protocol. Windows 2000 machines have a habit of sending dynamic
+   update requests to DNS servers without being specifically configured to
+   do so. If the update requests are coming from a Windows 2000 machine,
+   see http://support.microsoft.com/support/kb/articles/q246/8/04.asp for
+   information about how to turn them off.
+
+Q: When I do a "dig . ns", many of the A records for the root servers are
+   missing. Why?
+
+A: This is normal and harmless. It is a somewhat confusing side effect of
+   the way BIND 9 does RFC2181 trust ranking and of the efforts BIND 9
+   makes to avoid promoting glue into answers.
+
+   When BIND 9 first starts up and primes its cache, it receives the root
+   server addresses as additional data in an authoritative response from a
+   root server, and these records are eligible for inclusion as additional
+   data in responses. Subsequently it receives a subset of the root server
+   addresses as additional data in a non-authoritative (referral) response
+   from a root server. This causes the addresses to now be considered
+   non-authoritative (glue) data, which is not eligible for inclusion in
+   responses.
+
+   The server does have a complete set of root server addresses cached at
+   all times, it just may not include all of them as additional data,
+   depending on whether they were last received as answers or as glue. You
+   can always look up the addresses with explicit queries like "dig
+   a.root-servers.net A".
+
+Q: Why don't my zones reload when I do an "rndc reload" or SIGHUP?
+
+A: A zone can be updated either by editing zone files and reloading the
+   server or by dynamic update, but not both. If you have enabled dynamic
+   update for a zone using the "allow-update" option, you are not supposed
+   to edit the zone file by hand, and the server will not attempt to
+   reload it.
+
+Q: Why is named listening on UDP port other than 53?
+
+A: Named uses a system selected port to make queries of other nameservers.
+   This behaviour can be overridden by using query-source to lock down the
+   port and/or address. See also notify-source and transfer-source.
+
+Q: I get warning messages like "zone example.com/IN: refresh: failure
+   trying master 1.2.3.4#53: timed out".
+
+A: Check that you can make UDP queries from the slave to the master
+
+   dig +norec example.com soa @1.2.3.4
+
+   You could be generating queries faster than the slave can cope with.
+   Lower the serial query rate.
+
+   serial-query-rate 5; // default 20
+
+Q: I don't get RRSIG's returned when I use "dig +dnssec".
+
+A: You need to ensure DNSSEC is enabled (dnssec-enable yes;).
 
 Q: Can a NS record refer to a CNAME.
 
-A: No. The rules for glue (copies of the *address* records in the parent zones)
-   and additional section processing do not allow it to work.
+A: No. The rules for glue (copies of the *address* records in the parent
+   zones) and additional section processing do not allow it to work.
 
-   You would have to add both the CNAME and address records (A/AAAA) as glue to
-   the parent zone and have CNAMEs be followed when doing additional section
-   processing to make it work. No namesever implementation supports either of
-   these requirements.
+   You would have to add both the CNAME and address records (A/AAAA) as
+   glue to the parent zone and have CNAMEs be followed when doing
+   additional section processing to make it work. No nameserver
+   implementation supports either of these requirements.
 
-Q: What does "RFC 1918 response from Internet for 0.0.0.10.IN-ADDR.ARPA" mean?
+Q: What does "RFC 1918 response from Internet for 0.0.0.10.IN-ADDR.ARPA"
+   mean?
 
-A: If the IN-ADDR.ARPA name covered refers to a internal address space you are
-   using then you have failed to follow RFC 1918 usage rules and are leaking
-   queries to the Internet. You should establish your own zones for these
-   addresses to prevent you quering the Internet's name servers for these
-   addresses. Please see http://as112.net/ for details of the problems you are
-   causing and the counter measures that have had to be deployed.
+A: If the IN-ADDR.ARPA name covered refers to a internal address space you
+   are using then you have failed to follow RFC 1918 usage rules and are
+   leaking queries to the Internet. You should establish your own zones
+   for these addresses to prevent you querying the Internet's name servers
+   for these addresses. Please see http://as112.net/ for details of the
+   problems you are causing and the counter measures that have had to be
+   deployed.
 
-   If you are not using these private addresses then a client has queried for
-   them. You can just ignore the messages, get the offending client to stop
-   sending you these messages as they are most probably leaking them or setup your
-   own zones empty zones to serve answers to these queries.
+   If you are not using these private addresses then a client has queried
+   for them. You can just ignore the messages, get the offending client to
+   stop sending you these messages as they are most probably leaking them
+   or setup your own zones empty zones to serve answers to these queries.
 
    zone "10.IN-ADDR.ARPA" {
            type master;
@@ -531,42 +508,133 @@ A: If the IN-ADDR.ARPA name covered refers to a internal address space you are
 
    Future versions of named are likely to do this automatically.
 
+Q: Will named be affected by the 2007 changes to daylight savings rules in
+   the US.
+
+A: No, so long as the machines internal clock (as reported by "date -u")
+   remains at UTC. The only visible change if you fail to upgrade your OS,
+   if you are in a affected area, will be that log messages will be a hour
+   out during the period where the old rules do not match the new rules.
+
+   For most OS's this change just means that you need to update the
+   conversion rules from UTC to local time. Normally this involves
+   updating a file in /etc (which sets the default timezone for the
+   machine) and possibly a directory which has all the conversion rules
+   for the world (e.g. /usr/share/zoneinfo). When updating the OS do not
+   forget to update any chroot areas as well. See your OS's documentation
+   for more details.
+
+   The local timezone conversion rules can also be done on a individual
+   basis by setting the TZ environment variable appropriately. See your
+   OS's documentation for more details.
+
+Q: Is there a bugzilla (or other tool) database that mere mortals can have
+   (read-only) access to for bind?
+
+A: No. The BIND 9 bug database is kept closed for a number of reasons.
+   These include, but are not limited to, that the database contains
+   proprietory information from people reporting bugs. The database has in
+   the past and may in future contain unfixed bugs which are capable of
+   bringing down most of the Internet's DNS infrastructure.
+
+   The release pages for each version contain up to date lists of bugs
+   that have been fixed post release. That is as close as we can get to
+   providing a bug database.
+
+4. Operating-System Specific Questions
+
+4.1. HPUX
+
+Q: I get the following error trying to configure BIND:
+
+   checking if unistd.h or sys/types.h defines fd_set... no
+   configure: error: need either working unistd.h or sys/select.h
+
+A: You have attempted to configure BIND with the bundled C compiler. This
+   compiler does not meet the minimum compiler requirements to for
+   building BIND. You need to install a ANSI C compiler and / or teach
+   configure how to find the ANSI C compiler. The later can be done by
+   adjusting the PATH environment variable and / or specifying the
+   compiler via CC.
+
+   ./configure CC=<compiler> ...
+
+4.2. Linux
+
+Q: Why do I get the following errors:
+
+   general: errno2result.c:109: unexpected error:
+   general: unable to convert errno to isc_result: 14: Bad address
+   client: UDP client handler shutting down due to fatal receive error: unexpected error
+
+A: This is the result of a Linux kernel bug.
+
+   See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2
+
+Q: Why do I see 5 (or more) copies of named on Linux?
+
+A: Linux threads each show up as a process under ps. The approximate
+   number of threads running is n+4, where n is the number of CPUs. Note
+   that the amount of memory used is not cumulative; if each process is
+   using 10M of memory, only a total of 10M is used.
+
+   Newer versions of Linux's ps command hide the individual threads and
+   require -L to display them.
+
+Q: Why does BIND 9 log "permission denied" errors accessing its
+   configuration files or zones on my Linux system even though it is
+   running as root?
+
+A: On Linux, BIND 9 drops most of its root privileges on startup. This
+   including the privilege to open files owned by other users. Therefore,
+   if the server is running as root, the configuration files and zone
+   files should also be owned by root.
+
+Q: I get the error message "named: capset failed: Operation not permitted"
+   when starting named.
+
+A: The capability module, part of "Linux Security Modules/LSM", has not
+   been loaded into the kernel. See insmod(8).
+
 Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core -
 
    Why can't named update slave zone database files?
 
-   Why can't named create DDNS journal files or update the master zones from
-   journals?
+   Why can't named create DDNS journal files or update the master zones
+   from journals?
 
    Why can't named create custom log files?
 
 A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
 
-   Red Hat have adopted the National Security Agency's SELinux security policy (
-   see http://www.nsa.gov/selinux ) and recommendations for BIND security , which
-   are more secure than running named in a chroot and make use of the bind-chroot
-   environment unecessary .
+   Red Hat have adopted the National Security Agency's SELinux security
+   policy ( see http://www.nsa.gov/selinux ) and recommendations for BIND
+   security , which are more secure than running named in a chroot and
+   make use of the bind-chroot environment unnecessary .
 
-   By default, named is not allowed by the SELinux policy to write, create or
-   delete any files EXCEPT in these directories:
+   By default, named is not allowed by the SELinux policy to write, create
+   or delete any files EXCEPT in these directories:
 
    $ROOTDIR/var/named/slaves
    $ROOTDIR/var/named/data
    $ROOTDIR/var/tmp
 
 
-   where $ROOTDIR may be set in /etc/sysconfig/named if bind-chroot is installed.
+   where $ROOTDIR may be set in /etc/sysconfig/named if bind-chroot is
+   installed.
 
-   The SELinux policy particularly does NOT allow named to modify the $ROOTDIR/var
-   /named directory, the default location for master zone database files.
+   The SELinux policy particularly does NOT allow named to modify the
+   $ROOTDIR/var/named directory, the default location for master zone
+   database files.
 
-   SELinux policy overrules file access permissions - so even if all the files
-   under /var/named have ownership named:named and mode rw-rw-r--, named will
-   still not be able to write or create files except in the directories above,
-   with SELinux in Enforcing mode.
+   SELinux policy overrules file access permissions - so even if all the
+   files under /var/named have ownership named:named and mode rw-rw-r--,
+   named will still not be able to write or create files except in the
+   directories above, with SELinux in Enforcing mode.
 
-   So, to allow named to update slave or DDNS zone files, it is best to locate
-   them in $ROOTDIR/var/named/slaves, with named.conf zone statements such as:
+   So, to allow named to update slave or DDNS zone files, it is best to
+   locate them in $ROOTDIR/var/named/slaves, with named.conf zone
+   statements such as:
 
    zone "slave.zone." IN {
            type slave;
@@ -580,8 +648,8 @@ A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
    };
 
 
-   To allow named to create its cache dump and statistics files, for example, you
-   could use named.conf options statements such as:
+   To allow named to create its cache dump and statistics files, for
+   example, you could use named.conf options statements such as:
 
    options {
            ...
@@ -591,10 +659,11 @@ A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
    };
 
 
-   You can also tell SELinux to allow named to update any zone database files, by
-   setting the SELinux tunable boolean parameter 'named_write_master_zones=1',
-   using the system-config-securitylevel GUI, using the 'setsebool' command, or in
-   /etc/selinux/targeted/booleans.
+   You can also tell SELinux to allow named to update any zone database
+   files, by setting the SELinux tunable boolean parameter
+   'named_write_master_zones=1', using the system-config-securitylevel
+   GUI, using the 'setsebool' command, or in /etc/selinux/targeted/
+   booleans.
 
    You can disable SELinux protection for named entirely by setting the
    'named_disable_trans=1' SELinux tunable boolean parameter.
@@ -606,27 +675,107 @@ A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
    named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,data}}
 
 
-   If you want to retain use of the SELinux policy for named, and put named files
-   in different locations, you can do so by changing the context of the custom
-   file locations .
+   If you want to retain use of the SELinux policy for named, and put
+   named files in different locations, you can do so by changing the
+   context of the custom file locations .
 
-   To create a custom configuration file location, eg. '/root/named.conf', to use
-   with the 'named -c' option, do:
+   To create a custom configuration file location, e.g. '/root/
+   named.conf', to use with the 'named -c' option, do:
 
    # chcon system_u:object_r:named_conf_t /root/named.conf
 
 
-   To create a custom modifiable named data location, eg. '/var/log/named' for a
-   log file, do:
+   To create a custom modifiable named data location, e.g. '/var/log/
+   named' for a log file, do:
 
    # chcon system_u:object_r:named_cache_t /var/log/named
 
 
-   To create a custom zone file location, eg. /root/zones/, do:
+   To create a custom zone file location, e.g. /root/zones/, do:
 
    # chcon system_u:object_r:named_zone_t /root/zones/{.,*}
 
 
-   See these man-pages for more information : selinux(8), named_selinux(8), chcon
-   (1), setsebool(8)
+   See these man-pages for more information : selinux(8), named_selinux
+   (8), chcon(1), setsebool(8)
+
+4.3. Windows
+
+Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail.
+   Why?
+
+A: This may be caused by a bug in the Windows 2000 DNS server where DNS
+   messages larger than 16K are not handled properly. This can be worked
+   around by setting the option "transfer-format one-answer;". Also check
+   whether your zone contains domain names with embedded spaces or other
+   special characters, like "John\032Doe\213s\032Computer", since such
+   names have been known to cause Windows 2000 slaves to incorrectly
+   reject the zone.
+
+Q: I get "Error 1067" when starting named under Windows.
+
+A: This is the service manager saying that named exited. You need to
+   examine the Application log in the EventViewer to find out why.
+
+   Common causes are that you failed to create "named.conf" (usually "C:\
+   windows\dns\etc\named.conf") or failed to specify the directory in
+   named.conf.
+
+   options {
+           Directory "C:\windows\dns\etc";
+   };
+
+4.4. FreeBSD
+
+Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
+
+A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to
+   use certain interrupts as a source of random events. You can make this
+   permanent by setting rand_irqs in /etc/rc.conf.
+
+   /etc/rc.conf
+   rand_irqs="3 14 15"
+
+   See also http://people.freebsd.org/~dougb/randomness.html
+
+4.5. Solaris
+
+Q: How do I integrate BIND 9 and Solaris SMF
+
+A: Sun has a blog entry describing how to do this.
+
+   http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris
+
+4.6. Apple Mac OS X
+
+Q: How do I run BIND 9 on Apple Mac OS X?
+
+A: If you run Tiger(Mac OS 10.4) or later then this is all you need to do:
+
+   % sudo rndc-confgen  > /etc/rndc.conf
+
+   Copy the key statement from /etc/rndc.conf into /etc/rndc.key, e.g.:
+
+   key "rndc-key" {
+           algorithm hmac-md5;
+           secret "uvceheVuqf17ZwIcTydddw==";
+   };
+
+   Then start the relevant service:
+
+   % sudo service org.isc.named start
+
+   This is persistent upon a reboot, so you will have to do it only once.
+
+A: Alternatively you can just generate /etc/rndc.key by running:
+
+   % sudo rndc-confgen -a
+
+   Then start the relevant service:
+
+   % sudo service org.isc.named start
+
+   Named will look for /etc/rndc.key when it starts if it doesn't have a
+   controls section or the existing controls are missing keys sub-clauses.
+   This is persistent upon a reboot, so you will have to do it only once.
 

Makefile.in

@@ -1,7 +1,7 @@
-# Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.43.18.2 2005/09/06 03:47:14 marka Exp $
+# $Id: Makefile.in,v 1.43.18.6 2007/09/03 23:46:21 tbox Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -44,7 +44,8 @@ maintainer-clean::
 	rm -f configure
 
 installdirs:
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
+	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir} \
+	${DESTDIR}${localstatedir}/run ${DESTDIR}${sysconfdir}
 
 install:: isc-config.sh installdirs
 	${INSTALL_SCRIPT} isc-config.sh ${DESTDIR}${bindir}
@@ -60,7 +61,7 @@ test:
 
 FAQ: FAQ.xml
 	${XSLTPROC} doc/xsl/isc-docbook-text.xsl FAQ.xml | \
-	${W3M} -T text/html -dump >$@.tmp
+	LC_ALL=C ${W3M} -T text/html -dump -cols 72 >$@.tmp
 	mv $@.tmp $@
 
 clean::

README

@@ -43,12 +43,25 @@ BIND 9
 		Nominum, Inc.
 
 
+BIND 9.4.2
+
+	BIND 9.4.2 is a maintenance release, containing fixes for
+	a number of bugs in 9.4.1.
+
+	Warning: If you installed BIND 9.4.2rc1 then any applications
+	linked against this release candidate will need to be rebuilt.
+
+BIND 9.4.1
+
+	BIND 9.4.1 is a security release, containing a fix for
+	a security bugs in 9.4.0.
+
 BIND 9.4.0
 
 	BIND 9.4.0 has a number of new features over 9.3,
 	including:
 
-	Implemented "additional section caching (or acache)", an
+	Implemented "additional section caching" (or "acache"), an
 	internal cache framework for additional section content to
 	improve response performance.  Several configuration options
 	were provided to control the behavior.
@@ -64,7 +77,9 @@ BIND 9.4.0
 	used to specify the default zone access level rather than
 	having to have every zone override the global value.
 	allow-query-cache can be set at both the options and view
-	levels.  If allow-query-cache is not set allow-query applies.
+	levels. If allow-query-cache is not set then allow-recursion
+	is used if set, otherwise allow-query is used if set, otherwise
+	the default (localhost; localnets;) is used.
 
 	rndc: the source address can now be specified.
 
@@ -137,12 +152,11 @@ BIND 9.4.0
 
 	Add support for CH A record.
 
-	Add additional zone data constancy checks.  named-checkzone
+	Add additional zone data consistancy checks.  named-checkzone
 	has extended checking of NS, MX and SRV record and the hosts
 	they reference.  named has extended post zone load checks.
 	New zone options: check-mx and integrity-check.
 
-
 	edns-udp-size can now be overridden on a per server basis.
 
 	dig can now specify the EDNS version when making a query.
@@ -155,7 +169,7 @@ BIND 9.4.0
 	Detect duplicates of UDP queries we are recursing on and
 	drop them.  New stats category "duplicates".
 
-	"USE INTERNAL MALLOC" is now runtime selectable.
+	Memory management. "USE INTERNAL MALLOC" is now runtime selectable.
 
 	The lame cache is now done on a <qname,qclass,qtype> basis
 	as some servers only appear to be lame for certain query
@@ -170,9 +184,9 @@ BIND 9.4.0
 
 	Support for IPSECKEY rdata type.
 
-	Raise the UDP recieve buffer size to 32k if it is less than 32k.
+	Raise the UDP receive buffer size to 32k if it is less than 32k.
 
-	x86 and x86_64 now have seperate atomic locking implementations.
+	x86 and x86_64 now have separate atomic locking implementations.
 
 	named-checkconf now validates update-policy entries.
 
@@ -200,9 +214,69 @@ BIND 9.4.0
 	to set 'RA' when 'RD' is set unless a server is explicitly
 	set.
 
-	Integrate contibuted DLZ code into named.
+	Integrate contributed DLZ code into named.
 
-	Integrate contibuted IDN code from JPNIC.
+	Integrate contributed IDN code from JPNIC.
+
+	Validate pending NS RRsets, in the authority section, prior
+	to returning them if it can be done without requiring DNSKEYs
+	to be fetched.
+
+	It is now possible to configure named to accept expired
+	RRSIGs.  Default "dnssec-accept-expired no;".  Setting
+	"dnssec-accept-expired yes;" leaves named vulnerable to
+	replay attacks.
+
+	Additional memory leakage checks.
+
+	The maximum EDNS UDP response named will send can now be
+	set in named.conf (max-udp-size).  This is independent of
+	the advertised receive buffer (edns-udp-size).
+
+	Named now falls back to advertising EDNS with a 512 byte
+	receive buffer if the initial EDNS queries fail.
+
+	Control the zeroing of the negative response TTL to a soa
+	query.  Defaults "zero-no-soa-ttl yes;" and
+	"zero-no-soa-ttl-cache no;".
+			
+	Separate out MX and SRV to CNAME checks.
+
+	dig/nslookup/host: warn about missing "QR".
+
+	TSIG HMACSHA1, HMACSHA224, HMACSHA256, HMACSHA384 and
+	HMACSHA512 support.
+
+	dnssec-signzone: output the SOA record as the first record
+	in the signed zone.
+
+	Two new update policies.  "selfsub" and "selfwild".
+
+	dig, nslookup and host now advertise a 4096 byte EDNS UDP
+	buffer size by default.
+
+	Report when a zone is removed.
+
+	DS/DLV SHA256 digest algorithm support.
+
+	Implement "rrset-order fixed".
+
+	Check the KSK flag when updating a secure dynamic zone.
+	New zone option "update-check-ksk yes;".
+
+	It is now possible to explicitly enable DNSSEC validation.
+	default dnssec-validation no; to be changed to yes in 9.5.0.
+
+	It is now possible to enable/disable DNSSEC validation
+	from rndc.  This is useful for the mobile hosts where the
+	current connection point breaks DNSSEC (firewall/proxy).
+
+		rndc validation newstate [view]
+
+	dnssec-signzone can now update the SOA record of the signed
+	zone, either as an increment or as the system time().
+
+	Statistics about acache now recorded and sent to log.
 
 	libbind: corresponds to that from BIND 8.4.7.
 
@@ -330,6 +404,9 @@ BIND 9.2.0
 
 		--with-libtool does not work on AIX.
 
+		--with-libtool does not work on SunOS 4.  configure
+		requires "printf" which is not available.
+
 	A bug in the Windows 2000 DNS server can cause zone transfers
 	from a BIND 9 server to a W2K server to fail.  For details,
 	see the "Zone Transfers" section in doc/misc/migration.
@@ -346,7 +423,7 @@ Building
 	We've had successful builds and tests on the following systems:
 
 		COMPAQ Tru64 UNIX 5.1B
-		FreeBSD 4.10, 5.2.1
+		FreeBSD 4.10, 5.2.1, 6.2
 		HP-UX 11.11
 		NetBSD 1.5
 		Slackware Linux 8.1
@@ -362,7 +439,7 @@ Building
 	        Red Hat Linux 7.1
 		Debian GNU/Linux 2.2 and 3.0
 		Mandrake 8.1
-		OpenBSD 2.6, 2.8, 2.9
+		OpenBSD 2.6, 2.8, 2.9, 3.1, 3.6, 3.8
 		UnixWare 7.1.1
 		HP-UX 10.20
 		BSD/OS 4.2
@@ -403,6 +480,8 @@ Building
 				    -DDIG_SIGCHASE_BU=1)
 		Disable dropping queries from particular well known ports.
 		  -DNS_CLIENT_DROPPORT=0
+		Disable support for "rrset-order fixed".
+		  -DDNS_RDATASET_FIXED=0
 
 	    LDFLAGS
 		Linker flags. Defaults to empty string.
@@ -515,9 +594,8 @@ Bug Reports and Mailing Lists
 		http://www.isc.org/ops/lists/
 
 	If you're planning on making changes to the BIND 9 source
-	code, you might want to join the BIND Workers mailing list.
-	Send mail to
-
-		bind-workers-request@isc.org
-
+	code, you might want to join the BIND Forum as a Worker.
+	This gives you access to the bind-workers@isc.org mailing
+	list and pre-release access to the code.
 
+		http://www.isc.org/sw/guild/bf/

bin/check/Makefile.in

@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.24.18.4 2005/09/07 00:29:53 marka Exp $
+# $Id: Makefile.in,v 1.24.18.6 2006/06/09 00:54:08 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -75,7 +75,8 @@ named-checkconf@EXEEXT@: named-checkconf.@O@ check-tool.@O@ ${ISCDEPLIBS} \
 
 named-checkzone@EXEEXT@: named-checkzone.@O@ check-tool.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
-	named-checkzone.@O@ check-tool.@O@ ${DNSLIBS} ${ISCLIBS} ${LIBS}
+	named-checkzone.@O@ check-tool.@O@ ${ISCCFGLIBS} ${DNSLIBS} \
+	${ISCLIBS} ${LIBS}
 
 doc man:: ${MANOBJS}
 

bin/check/check-tool.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,14 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: check-tool.c,v 1.10.18.13 2006/01/07 00:23:34 marka Exp $ */
+/* $Id: check-tool.c,v 1.10.18.18 2007/09/13 05:04:01 each Exp $ */
 
 /*! \file */
 
 #include <config.h>
 
 #include <stdio.h>
-#include <string.h>
 
 #include "check-tool.h"
 #include <isc/util.h>
@@ -33,6 +32,7 @@
 #include <isc/netdb.h>
 #include <isc/region.h>
 #include <isc/stdio.h>
+#include <isc/string.h>
 #include <isc/types.h>
 
 #include <dns/fixedname.h>
@@ -44,6 +44,8 @@
 #include <dns/types.h>
 #include <dns/zone.h>
 
+#include <isccfg/log.h>
+
 #ifdef HAVE_ADDRINFO
 #ifdef HAVE_GETADDRINFO
 #ifdef HAVE_GAISTRERROR
@@ -128,7 +130,16 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	switch (result) {
 	case 0:
-		if (strcasecmp(ai->ai_canonname, namebuf) != 0) {
+		/*
+		 * Work around broken getaddrinfo() implementations that
+		 * fail to set ai_canonname on first entry.
+		 */
+		cur = ai;
+		while (cur != NULL && cur->ai_canonname == NULL &&
+		       cur->ai_next != NULL)
+			cur = cur->ai_next;
+		if (cur != NULL && cur->ai_canonname != NULL &&
+		    strcasecmp(ai->ai_canonname, namebuf) != 0) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "%s/NS '%s' (out of zone) "
 				     "is a CNAME (illegal)",
@@ -266,7 +277,7 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
 static isc_boolean_t
 checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 #ifdef USE_GETADDRINFO
-	struct addrinfo hints, *ai;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	int result;
@@ -291,7 +302,16 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	switch (result) {
 	case 0:
-		if (strcasecmp(ai->ai_canonname, namebuf) != 0) {
+		/*
+		 * Work around broken getaddrinfo() implementations that
+		 * fail to set ai_canonname on first entry.
+		 */
+		cur = ai;
+		while (cur != NULL && cur->ai_canonname == NULL &&
+		       cur->ai_next != NULL)
+			cur = cur->ai_next;
+		if (cur != NULL && cur->ai_canonname != NULL &&
+		    strcasecmp(cur->ai_canonname, namebuf) != 0) {
 			if ((zone_options & DNS_ZONEOPT_WARNMXCNAME) != 0)
 				level = ISC_LOG_WARNING;
 			if ((zone_options & DNS_ZONEOPT_IGNOREMXCNAME) == 0) {
@@ -330,7 +350,7 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 static isc_boolean_t
 checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 #ifdef USE_GETADDRINFO
-	struct addrinfo hints, *ai;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	int result;
@@ -355,7 +375,16 @@ checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	switch (result) {
 	case 0:
-		if (strcasecmp(ai->ai_canonname, namebuf) != 0) {
+		/*
+		 * Work around broken getaddrinfo() implementations that
+		 * fail to set ai_canonname on first entry.
+		 */
+		cur = ai;
+		while (cur != NULL && cur->ai_canonname == NULL &&
+		       cur->ai_next != NULL)
+			cur = cur->ai_next;
+		if (cur != NULL && cur->ai_canonname != NULL &&
+		    strcasecmp(cur->ai_canonname, namebuf) != 0) {
 			if ((zone_options & DNS_ZONEOPT_WARNSRVCNAME) != 0)
 				level = ISC_LOG_WARNING;
 			if ((zone_options & DNS_ZONEOPT_IGNORESRVCNAME) == 0) {
@@ -402,6 +431,7 @@ setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
 	isc_log_setcontext(log);
 	dns_log_init(log);
 	dns_log_setcontext(log);
+	cfg_log_init(log);
 
 	destination.file.stream = stdout;
 	destination.file.name = NULL;

bin/check/named-checkconf.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named-checkconf.8,v 1.16.18.8 2005/10/13 02:52:58 marka Exp $
+.\" $Id: named-checkconf.8,v 1.16.18.13 2007/06/20 02:26:58 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: named\-checkconf
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: June 14, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "NAMED\-CHECKCONF" "8" "June 14, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -36,27 +39,37 @@ named\-checkconf \- named configuration file syntax checking tool
 \fBnamed\-checkconf\fR
 checks the syntax, but not the semantics, of a named configuration file.
 .SH "OPTIONS"
-.TP
+.PP
 \-t \fIdirectory\fR
-chroot to
+.RS 4
+Chroot to
 \fIdirectory\fR
 so that include directives in the configuration file are processed as if run by a similarly chrooted named.
-.TP
+.RE
+.PP
 \-v
+.RS 4
 Print the version of the
 \fBnamed\-checkconf\fR
 program and exit.
-.TP
+.RE
+.PP
 \-z
-Perform a check load the master zonefiles found in
+.RS 4
+Perform a test load of all master zones found in
 \fInamed.conf\fR.
-.TP
+.RE
+.PP
 \-j
+.RS 4
 When loading a zonefile read the journal if it exists.
-.TP
+.RE
+.PP
 filename
+.RS 4
 The name of the configuration file to be checked. If not specified, it defaults to
 \fI/etc/named.conf\fR.
+.RE
 .SH "RETURN VALUES"
 .PP
 \fBnamed\-checkconf\fR
@@ -64,7 +77,13 @@ returns an exit status of 1 if errors were detected and 0 otherwise.
 .SH "SEE ALSO"
 .PP
 \fBnamed\fR(8),
+\fBnamed\-checkzone\fR(8),
 BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000\-2002 Internet Software Consortium.
+.br

bin/check/named-checkconf.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2002  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: named-checkconf.docbook,v 1.8.18.5 2005/07/19 05:55:41 marka Exp $ -->
+<!-- $Id: named-checkconf.docbook,v 1.8.18.10 2007/08/28 07:19:55 tbox Exp $ -->
 <refentry id="man.named-checkconf">
   <refentryinfo>
     <date>June 14, 2000</date>
@@ -34,6 +34,7 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -76,7 +77,7 @@
         <term>-t <replaceable class="parameter">directory</replaceable></term>
         <listitem>
           <para>
-            chroot to <filename>directory</filename> so that
+            Chroot to <filename>directory</filename> so that
             include
             directives in the configuration file are processed as if
             run by a similarly chrooted named.
@@ -98,8 +99,8 @@
         <term>-z</term>
         <listitem>
           <para>
-            Perform a check load the master zonefiles found in
-            <filename>named.conf</filename>.
+	    Perform a test load of all master zones found in
+	    <filename>named.conf</filename>.
           </para>
         </listitem>
       </varlistentry>
@@ -140,6 +141,9 @@
     <para><citerefentry>
         <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
+      <citerefentry>
+        <refentrytitle>named-checkzone</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry>,
       <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
     </para>
   </refsect1>

bin/check/named-checkconf.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2002 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named-checkconf.html,v 1.9.18.13 2005/10/13 02:52:58 marka Exp $ -->
+<!-- $Id: named-checkconf.html,v 1.9.18.20 2007/06/20 02:26:58 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named-checkconf</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
 <a name="man.named-checkconf"></a><div class="titlepage"></div>
@@ -32,18 +32,18 @@
 <div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-z</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525876"></a><h2>DESCRIPTION</h2>
+<a name="id2543383"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
       checks the syntax, but not the semantics, of a named
       configuration file.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525888"></a><h2>OPTIONS</h2>
+<a name="id2543395"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            chroot to <code class="filename">directory</code> so that
+            Chroot to <code class="filename">directory</code> so that
             include
             directives in the configuration file are processed as if
             run by a similarly chrooted named.
@@ -55,8 +55,8 @@
           </p></dd>
 <dt><span class="term">-z</span></dt>
 <dd><p>
-            Perform a check load the master zonefiles found in
-            <code class="filename">named.conf</code>.
+	    Perform a test load of all master zones found in
+	    <code class="filename">named.conf</code>.
           </p></dd>
 <dt><span class="term">-j</span></dt>
 <dd><p>
@@ -70,20 +70,21 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525980"></a><h2>RETURN VALUES</h2>
+<a name="id2543489"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
       returns an exit status of 1 if
       errors were detected and 0 otherwise.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525992"></a><h2>SEE ALSO</h2>
+<a name="id2543500"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526013"></a><h2>AUTHOR</h2>
+<a name="id2543530"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/check/named-checkzone.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named-checkzone.8,v 1.18.18.15 2006/01/07 03:40:23 marka Exp $
+.\" $Id: named-checkzone.8,v 1.18.18.23 2007/06/20 02:26:58 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: named\-checkzone
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: June 13, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "NAMED\-CHECKZONE" "8" "June 13, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -45,30 +48,41 @@ useful for checking zone files before configuring them into a name server.
 \fBnamed\-compilezone\fR
 is similar to
 \fBnamed\-checkzone\fR, but it always dumps the zone contents to a specified file in a specified format. Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by
-\fBnamed\fR. When manaully specified otherwise, the check levels must at least be as strict as those specified in the
+\fBnamed\fR. When manually specified otherwise, the check levels must at least be as strict as those specified in the
 \fBnamed\fR
 configuration file.
 .SH "OPTIONS"
-.TP
+.PP
 \-d
+.RS 4
 Enable debugging.
-.TP
+.RE
+.PP
 \-q
+.RS 4
 Quiet mode \- exit code only.
-.TP
+.RE
+.PP
 \-v
+.RS 4
 Print the version of the
 \fBnamed\-checkzone\fR
 program and exit.
-.TP
+.RE
+.PP
 \-j
+.RS 4
 When loading the zone file read the journal if it exists.
-.TP
+.RE
+.PP
 \-c \fIclass\fR
+.RS 4
 Specify the class of the zone. If not specified "IN" is assumed.
-.TP
+.RE
+.PP
 \-i \fImode\fR
-Perform post load zone integrity checks. Possible modes are
+.RS 4
+Perform post\-load zone integrity checks. Possible modes are
 \fB"full"\fR
 (default),
 \fB"full\-sibling"\fR,
@@ -91,7 +105,7 @@ only checks SRV records which refer to in\-zone hostnames.
 .sp
 Mode
 \fB"full"\fR
-checks that delegation NS records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames). It also checks that glue addresses records in the zone match those advertised by the child. Mode
+checks that delegation NS records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode
 \fB"local"\fR
 only checks NS records which refer to in\-zone hostnames or that some required glue exists, that is when the nameserver is in a child zone.
 .sp
@@ -108,23 +122,29 @@ respectively.
 Mode
 \fB"none"\fR
 disables the checks.
-.TP
+.RE
+.PP
 \-f \fIformat\fR
+.RS 4
 Specify the format of the zone file. Possible formats are
 \fB"text"\fR
 (default) and
 \fB"raw"\fR.
-.TP
+.RE
+.PP
 \-F \fIformat\fR
+.RS 4
 Specify the format of the output file specified. Possible formats are
 \fB"text"\fR
 (default) and
 \fB"raw"\fR. For
 \fBnamed\-checkzone\fR, this does not cause any effects unless it dumps the zone contents.
-.TP
+.RE
+.PP
 \-k \fImode\fR
+.RS 4
 Perform
-\fB"check\-name"\fR
+\fB"check\-names"\fR
 checks with the specified failure mode. Possible modes are
 \fB"fail"\fR
 (default for
@@ -133,22 +153,28 @@ checks with the specified failure mode. Possible modes are
 (default for
 \fBnamed\-checkzone\fR) and
 \fB"ignore"\fR.
-.TP
+.RE
+.PP
 \-m \fImode\fR
+.RS 4
 Specify whether MX records should be checked to see if they are addresses. Possible modes are
 \fB"fail"\fR,
 \fB"warn"\fR
 (default) and
 \fB"ignore"\fR.
-.TP
+.RE
+.PP
 \-M \fImode\fR
+.RS 4
 Check if a MX record refers to a CNAME. Possible modes are
 \fB"fail"\fR,
 \fB"warn"\fR
 (default) and
 \fB"ignore"\fR.
-.TP
+.RE
+.PP
 \-n \fImode\fR
+.RS 4
 Specify whether NS records should be checked to see if they are addresses. Possible modes are
 \fB"fail"\fR
 (default for
@@ -157,53 +183,72 @@ Specify whether NS records should be checked to see if they are addresses. Possi
 (default for
 \fBnamed\-checkzone\fR) and
 \fB"ignore"\fR.
-.TP
+.RE
+.PP
 \-o \fIfilename\fR
+.RS 4
 Write zone output to
 \fIfilename\fR. This is mandatory for
 \fBnamed\-compilezone\fR.
-.TP
+.RE
+.PP
 \-s \fIstyle\fR
+.RS 4
 Specify the style of the dumped zone file. Possible styles are
 \fB"full"\fR
 (default) and
-\fB"default"\fR. The full format is most suitable for processing automatically by a separate script. On the other hand, the default format is more human\-readable and is thus suitable for editing by hand. For
+\fB"relative"\fR. The full format is most suitable for processing automatically by a separate script. On the other hand, the relative format is more human\-readable and is thus suitable for editing by hand. For
 \fBnamed\-checkzone\fR
 this does not cause any effects unless it dumps the zone contents. It also does not have any meaning if the output format is not text.
-.TP
+.RE
+.PP
 \-S \fImode\fR
+.RS 4
 Check if a SRV record refers to a CNAME. Possible modes are
 \fB"fail"\fR,
 \fB"warn"\fR
 (default) and
 \fB"ignore"\fR.
-.TP
+.RE
+.PP
 \-t \fIdirectory\fR
-chroot to
+.RS 4
+Chroot to
 \fIdirectory\fR
 so that include directives in the configuration file are processed as if run by a similarly chrooted named.
-.TP
+.RE
+.PP
 \-w \fIdirectory\fR
+.RS 4
 chdir to
 \fIdirectory\fR
 so that relative filenames in master file $INCLUDE directives work. This is similar to the directory clause in
 \fInamed.conf\fR.
-.TP
+.RE
+.PP
 \-D
+.RS 4
 Dump zone file in canonical format. This is always enabled for
 \fBnamed\-compilezone\fR.
-.TP
+.RE
+.PP
 \-W \fImode\fR
+.RS 4
 Specify whether to check for non\-terminal wildcards. Non\-terminal wildcards are almost always the result of a failure to understand the wildcard matching algorithm (RFC 1034). Possible modes are
 \fB"warn"\fR
 (default) and
 \fB"ignore"\fR.
-.TP
+.RE
+.PP
 zonename
+.RS 4
 The domain name of the zone being checked.
-.TP
+.RE
+.PP
 filename
+.RS 4
 The name of the zone file.
+.RE
 .SH "RETURN VALUES"
 .PP
 \fBnamed\-checkzone\fR
@@ -211,8 +256,14 @@ returns an exit status of 1 if errors were detected and 0 otherwise.
 .SH "SEE ALSO"
 .PP
 \fBnamed\fR(8),
+\fBnamed\-checkconf\fR(8),
 RFC 1035,
 BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000\-2002 Internet Software Consortium.
+.br

bin/check/named-checkzone.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named-checkzone.c,v 1.29.18.14 2006/01/07 00:23:34 marka Exp $ */
+/* $Id: named-checkzone.c,v 1.29.18.19 2007/08/28 07:19:55 tbox Exp $ */
 
 /*! \file */
 
@@ -109,6 +109,8 @@ main(int argc, char **argv) {
 	outputstyle = &dns_master_style_full;
 
 	prog_name = strrchr(argv[0], '/');
+	if (prog_name == NULL)
+		prog_name = strrchr(argv[0], '\\');
 	if (prog_name != NULL)
 		prog_name++;
 	else
@@ -138,7 +140,7 @@ main(int argc, char **argv) {
 #define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)
 
 	while ((c = isc_commandline_parse(argc, argv,
-					  "c:df:i:jk:m:n:qst:o:vw:DF:M:S:W:"))
+					  "c:df:i:jk:m:n:qs:t:o:vw:DF:M:S:W:"))
 	       != EOF) {
 		switch (c) {
 		case 'c':
@@ -273,7 +275,7 @@ main(int argc, char **argv) {
 		case 's':
 			if (ARGCMP("full"))
 				outputstyle = &dns_master_style_full;
-			else if (ARGCMP("default")) {
+			else if (ARGCMP("relative")) {
 				outputstyle = &dns_master_style_default;
 			} else {
 				fprintf(stderr,

bin/check/named-checkzone.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2002  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: named-checkzone.docbook,v 1.11.18.13 2006/01/07 00:23:34 marka Exp $ -->
+<!-- $Id: named-checkzone.docbook,v 1.11.18.21 2007/08/28 07:19:55 tbox Exp $ -->
 <refentry id="man.named-checkzone">
   <refentryinfo>
     <date>June 13, 2000</date>
@@ -35,6 +35,7 @@
       <year>2004</year>
       <year>2005</year>
       <year>2006</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -116,7 +117,7 @@
 	Additionally, it applies stricter check levels by default,
         since the dump output will be used as an actual zone file
 	loaded by <command>named</command>.
-	When manaully specified otherwise, the check levels must at
+	When manually specified otherwise, the check levels must at
         least be as strict as those specified in the
 	<command>named</command> configuration file.
      </para>
@@ -176,7 +177,7 @@
         <term>-i <replaceable class="parameter">mode</replaceable></term>
 	<listitem>
 	  <para>
-	      Perform post load zone integrity checks.  Possible modes are
+	      Perform post-load zone integrity checks.  Possible modes are
 	      <command>"full"</command> (default),
 	      <command>"full-sibling"</command>,
 	      <command>"local"</command>,
@@ -198,7 +199,7 @@
 	  <para>
 	      Mode <command>"full"</command> checks that delegation NS
 	      records refer to A or AAAA record (both in-zone and out-of-zone
-	      hostnames).  It also checks that glue addresses records
+	      hostnames).  It also checks that glue address records
 	      in the zone match those advertised by the child.
 	      Mode <command>"local"</command> only checks NS records which
 	      refer to in-zone hostnames or that some required glue exists,
@@ -245,7 +246,7 @@
         <term>-k <replaceable class="parameter">mode</replaceable></term>
         <listitem>
           <para>
-            Perform <command>"check-name"</command> checks with the
+            Perform <command>"check-names"</command> checks with the
 	    specified failure mode.
             Possible modes are <command>"fail"</command>
 	    (default for <command>named-compilezone</command>),
@@ -311,10 +312,10 @@
 	  <para>
 	    Specify the style of the dumped zone file.
 	    Possible styles are <command>"full"</command> (default)
-	    and <command>"default"</command>.
+	    and <command>"relative"</command>.
 	    The full format is most suitable for processing
 	    automatically by a separate script.
-	    On the other hand, the default format is more
+	    On the other hand, the relative format is more
 	    human-readable and is thus suitable for editing by hand.
 	    For <command>named-checkzone</command>
 	    this does not cause any effects unless it dumps the zone
@@ -341,7 +342,7 @@
         <term>-t <replaceable class="parameter">directory</replaceable></term>
         <listitem>
           <para>
-            chroot to <filename>directory</filename> so that
+            Chroot to <filename>directory</filename> so that
             include
             directives in the configuration file are processed as if
             run by a similarly chrooted named.
@@ -421,6 +422,9 @@
     <para><citerefentry>
         <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
+      <citerefentry>
+        <refentrytitle>named-checkconf</refentrytitle><manvolnum>8</manvolnum>  
+      </citerefentry>,
       <citetitle>RFC 1035</citetitle>,
       <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
     </para>

bin/check/named-checkzone.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2002 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named-checkzone.html,v 1.11.18.20 2006/01/07 03:40:23 marka Exp $ -->
+<!-- $Id: named-checkzone.html,v 1.11.18.30 2007/06/20 02:26:58 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named-checkzone</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
 <a name="man.named-checkzone"></a><div class="titlepage"></div>
@@ -33,7 +33,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-compilezone</code>  [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526157"></a><h2>DESCRIPTION</h2>
+<a name="id2543665"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
       checks the syntax and integrity of a zone file.  It performs the
       same checks as <span><strong class="command">named</strong></span> does when loading a
@@ -47,13 +47,13 @@
 	Additionally, it applies stricter check levels by default,
         since the dump output will be used as an actual zone file
 	loaded by <span><strong class="command">named</strong></span>.
-	When manaully specified otherwise, the check levels must at
+	When manually specified otherwise, the check levels must at
         least be as strict as those specified in the
 	<span><strong class="command">named</strong></span> configuration file.
      </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526193"></a><h2>OPTIONS</h2>
+<a name="id2543700"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-d</span></dt>
 <dd><p>
@@ -79,7 +79,7 @@
 <dt><span class="term">-i <em class="replaceable"><code>mode</code></em></span></dt>
 <dd>
 <p>
-	      Perform post load zone integrity checks.  Possible modes are
+	      Perform post-load zone integrity checks.  Possible modes are
 	      <span><strong class="command">"full"</strong></span> (default),
 	      <span><strong class="command">"full-sibling"</strong></span>,
 	      <span><strong class="command">"local"</strong></span>,
@@ -101,7 +101,7 @@
 <p>
 	      Mode <span><strong class="command">"full"</strong></span> checks that delegation NS
 	      records refer to A or AAAA record (both in-zone and out-of-zone
-	      hostnames).  It also checks that glue addresses records
+	      hostnames).  It also checks that glue address records
 	      in the zone match those advertised by the child.
 	      Mode <span><strong class="command">"local"</strong></span> only checks NS records which
 	      refer to in-zone hostnames or that some required glue exists,
@@ -134,7 +134,7 @@
 	  </p></dd>
 <dt><span class="term">-k <em class="replaceable"><code>mode</code></em></span></dt>
 <dd><p>
-            Perform <span><strong class="command">"check-name"</strong></span> checks with the
+            Perform <span><strong class="command">"check-names"</strong></span> checks with the
 	    specified failure mode.
             Possible modes are <span><strong class="command">"fail"</strong></span>
 	    (default for <span><strong class="command">named-compilezone</strong></span>),
@@ -175,10 +175,10 @@
 <dd><p>
 	    Specify the style of the dumped zone file.
 	    Possible styles are <span><strong class="command">"full"</strong></span> (default)
-	    and <span><strong class="command">"default"</strong></span>.
+	    and <span><strong class="command">"relative"</strong></span>.
 	    The full format is most suitable for processing
 	    automatically by a separate script.
-	    On the other hand, the default format is more
+	    On the other hand, the relative format is more
 	    human-readable and is thus suitable for editing by hand.
 	    For <span><strong class="command">named-checkzone</strong></span>
 	    this does not cause any effects unless it dumps the zone
@@ -195,7 +195,7 @@
 	  </p></dd>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            chroot to <code class="filename">directory</code> so that
+            Chroot to <code class="filename">directory</code> so that
             include
             directives in the configuration file are processed as if
             run by a similarly chrooted named.
@@ -233,21 +233,22 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526792"></a><h2>RETURN VALUES</h2>
+<a name="id2544299"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
       returns an exit status of 1 if
       errors were detected and 0 otherwise.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526804"></a><h2>SEE ALSO</h2>
+<a name="id2544311"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
       <em class="citetitle">RFC 1035</em>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526828"></a><h2>AUTHOR</h2>
+<a name="id2544344"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/check/win32/checktool.dsp

@@ -0,0 +1,113 @@
+# Microsoft Developer Studio Project File - Name="checktool" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "Win32 (x86) Static-Link Library" 0x0104
+
+CFG=checktool - Win32 Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "checktool.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "checktool.mak" CFG="checktool - Win32 Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "checktool - Win32 Release" (based on "Win32 (x86) Static-Link Library")
+!MESSAGE "checktool - Win32 Debug" (based on "Win32 (x86) Static-Link Library")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+MTL=midl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "checktool - Win32 Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MT /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /YX /FD /c
+# ADD CPP /nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /D "NDEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /YX /FD /c /Fdchecktool
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /out:"Release/checktool.lib"
+
+!ELSEIF  "$(CFG)" == "checktool - Win32 Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MTd /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /YX /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isccfg/include" /I "../../../lib/dns/include" /D "_DEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /FR /YX /FD /GZ /c /Fdchecktool
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /debug out:"Debug/checktool.lib"
+
+!ENDIF 
+
+# Begin Target
+
+# Name "checktool - Win32 Release"
+# Name "checktool - Win32 Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# Begin Group "Main Dns Lib"
+
+# PROP Default_Filter "c"
+# Begin Source File
+
+SOURCE=..\check-tool.c
+# End Source File
+# End Group
+# End Target
+# End Project

bin/check/win32/checktool.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "checktool"=".\checktool.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/check/win32/namedcheckconf.dsp

@@ -42,7 +42,7 @@ RSC=rc.exe
 # PROP Ignore_Export_Lib 0
 # PROP Target_Dir ""
 # ADD BASE CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /c
-# ADD CPP /nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" /I "../../../lib/bind9/include" /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" /FR /YX /FD /c
+# ADD CPP /nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/isccfg/include" /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" /FR /YX /FD /c
 # ADD BASE RSC /l 0x409 /d "NDEBUG"
 # ADD RSC /l 0x409 /d "NDEBUG"
 BSC32=bscmake.exe
@@ -50,7 +50,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/bind9/win32/Release/libbind9.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/named-checkconf.exe"
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/checktool.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/bind9/win32/Release/libbind9.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/named-checkconf.exe"
 
 !ELSEIF  "$(CFG)" == "namedcheckconf - Win32 Debug"
 
@@ -66,7 +66,7 @@ LINK32=link.exe
 # PROP Ignore_Export_Lib 0
 # PROP Target_Dir ""
 # ADD BASE CPP /nologo /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /GZ /c
-# ADD CPP /nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" /I "../../../lib/bind9/include" /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/isccfg/include" /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
 # SUBTRACT CPP /X /YX
 # ADD BASE RSC /l 0x409 /d "_DEBUG"
 # ADD RSC /l 0x409 /d "_DEBUG"
@@ -75,7 +75,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/bind9/win32/Debug/libbind9.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/named-checkconf.exe" /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/checktool.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/bind9/win32/Debug/libbind9.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/named-checkconf.exe" /pdbtype:sept
 
 !ENDIF 
 
@@ -88,10 +88,6 @@ LINK32=link.exe
 # PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
 # Begin Source File
 
-SOURCE="..\check-tool.c"
-# End Source File
-# Begin Source File
-
 SOURCE="..\named-checkconf.c"
 # End Source File
 # End Group

bin/check/win32/namedcheckconf.mak

@@ -28,6 +28,81 @@ NULL=nul
 CPP=cl.exe
 RSC=rc.exe
 
+!IF  "$(CFG)" == "namedcheckconf - Win32 Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
 !IF  "$(CFG)" == "namedcheckconf - Win32 Release"
 
 OUTDIR=.\Release
@@ -58,11 +133,12 @@ CLEAN :
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "$(OUTDIR)\namedcheckconf.bsc"
 	-@erase "..\..\..\Build\Release\named-checkconf.exe"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
 
-CPP_PROJ=/nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" /I "../../../lib/bind9/include" /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" /FR"$(INTDIR)\\" /Fp"$(INTDIR)\namedcheckconf.pch" /YX /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+CPP_PROJ=/nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/isccfg/include" /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" /FR"$(INTDIR)\\" /Fp"$(INTDIR)\namedcheckconf.pch" /YX /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
 BSC32=bscmake.exe
 BSC32_FLAGS=/nologo /o"$(OUTDIR)\namedcheckconf.bsc" 
 BSC32_SBRS= \
@@ -87,6 +163,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ELSEIF  "$(CFG)" == "namedcheckconf - Win32 Debug"
 
@@ -121,11 +198,12 @@ CLEAN :
 	-@erase "$(OUTDIR)\namedcheckconf.bsc"
 	-@erase "..\..\..\Build\Debug\named-checkconf.exe"
 	-@erase "..\..\..\Build\Debug\named-checkconf.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
 
-CPP_PROJ=/nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" /I "../../../lib/bind9/include" /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+CPP_PROJ=/nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /I "../../../lib/isccfg/include" /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
 BSC32=bscmake.exe
 BSC32_FLAGS=/nologo /o"$(OUTDIR)\namedcheckconf.bsc" 
 BSC32_SBRS= \
@@ -150,6 +228,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ENDIF 
 
@@ -287,3 +366,39 @@ SOURCE="..\named-checkconf.c"
 
 !ENDIF 
 
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/check/win32/namedcheckzone.dsp

@@ -42,7 +42,7 @@ RSC=rc.exe
 # PROP Ignore_Export_Lib 0
 # PROP Target_Dir ""
 # ADD BASE CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /c
-# ADD CPP /nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" /YX /FD /c
+# ADD CPP /nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" /YX /FD /c
 # SUBTRACT CPP /Fr
 # ADD BASE RSC /l 0x409 /d "NDEBUG"
 # ADD RSC /l 0x409 /d "NDEBUG"
@@ -51,7 +51,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/named-checkzone.exe"
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/checktool.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/dns/win32/Release/libdns.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/named-checkzone.exe"
 
 !ELSEIF  "$(CFG)" == "namedcheckzone - Win32 Debug"
 
@@ -67,7 +67,7 @@ LINK32=link.exe
 # PROP Ignore_Export_Lib 0
 # PROP Target_Dir ""
 # ADD BASE CPP /nologo /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_CONSOLE" /D "_MBCS" /YX /FD /GZ /c
-# ADD CPP /nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR /FD /GZ /c
 # SUBTRACT CPP /X /YX
 # ADD BASE RSC /l 0x409 /d "_DEBUG"
 # ADD RSC /l 0x409 /d "_DEBUG"
@@ -76,7 +76,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/named-checkzone.exe" /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/checktool.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/dns/win32/Debug/libdns.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/named-checkzone.exe" /pdbtype:sept
 
 !ENDIF 
 
@@ -89,10 +89,6 @@ LINK32=link.exe
 # PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
 # Begin Source File
 
-SOURCE="..\check-tool.c"
-# End Source File
-# Begin Source File
-
 SOURCE="..\named-checkzone.c"
 # End Source File
 # End Group

bin/check/win32/namedcheckzone.mak

@@ -25,6 +25,81 @@ NULL=
 NULL=nul
 !ENDIF 
 
+!IF  "$(CFG)" == "namedcheckzone - Win32 Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
 !IF  "$(CFG)" == "namedcheckzone - Win32 Release"
 
 OUTDIR=.\Release
@@ -49,12 +124,13 @@ CLEAN :
 	-@erase "$(INTDIR)\named-checkzone.obj"
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "..\..\..\Build\Release\named-checkzone.exe"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
 
 CPP=cl.exe
-CPP_PROJ=/nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" /Fp"$(INTDIR)\namedcheckzone.pch" /YX /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
+CPP_PROJ=/nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" /D "NDEBUG" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /D "__STDC__" /Fp"$(INTDIR)\namedcheckzone.pch" /YX /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /c 
 
 .c{$(INTDIR)}.obj::
    $(CPP) @<<
@@ -92,17 +168,19 @@ BSC32_FLAGS=/nologo /o"$(OUTDIR)\namedcheckzone.bsc"
 BSC32_SBRS= \
 	
 LINK32=link.exe
-LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\named-checkzone.pdb" /machine:I386 /out:"../../../Build/Release/named-checkzone.exe" 
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/dns/win32/Release/libdns.lib /nologo /subsystem:console /incremental:no /pdb:"$(OUTDIR)\named-checkzone.pdb" /machine:I386 /out:"../../../Build/Release/named-checkzone.exe" 
 LINK32_OBJS= \
 	"$(INTDIR)\check-tool.obj" \
 	"$(INTDIR)\named-checkzone.obj" \
 	"..\..\..\lib\dns\win32\Release\libdns.lib" \
+	"..\..\..\lib\isccfg\win32\Release\libisccfg.lib" \
 	"..\..\..\lib\isc\win32\Release\libisc.lib"
 
 "..\..\..\Build\Release\named-checkzone.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ELSEIF  "$(CFG)" == "namedcheckzone - Win32 Debug"
 
@@ -137,12 +215,13 @@ CLEAN :
 	-@erase "$(OUTDIR)\namedcheckzone.bsc"
 	-@erase "..\..\..\Build\Debug\named-checkzone.exe"
 	-@erase "..\..\..\Build\Debug\named-checkzone.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
 
 CPP=cl.exe
-CPP_PROJ=/nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
+CPP_PROJ=/nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/dns/include" /I "../../../lib/isccfg/include" /D "_DEBUG" /D "__STDC__" /D "WIN32" /D "_CONSOLE" /D "_MBCS" /FR"$(INTDIR)\\" /Fo"$(INTDIR)\\" /Fd"$(INTDIR)\\" /FD /GZ /c 
 
 .c{$(INTDIR)}.obj::
    $(CPP) @<<
@@ -187,17 +266,19 @@ BSC32_SBRS= \
 <<
 
 LINK32=link.exe
-LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\named-checkzone.pdb" /debug /machine:I386 /out:"../../../Build/Debug/named-checkzone.exe" /pdbtype:sept 
+LINK32_FLAGS=user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/dns/win32/Debug/libdns.lib /nologo /subsystem:console /incremental:yes /pdb:"$(OUTDIR)\named-checkzone.pdb" /debug /machine:I386 /out:"../../../Build/Debug/named-checkzone.exe" /pdbtype:sept 
 LINK32_OBJS= \
 	"$(INTDIR)\check-tool.obj" \
 	"$(INTDIR)\named-checkzone.obj" \
 	"..\..\..\lib\dns\win32\Debug\libdns.lib" \
+	"..\..\..\lib\isccfg\win32\Debug\libisccfg.lib" \
 	"..\..\..\lib\isc\win32\Debug\libisc.lib"
 
 "..\..\..\Build\Debug\named-checkzone.exe" : "$(OUTDIR)" $(DEF_FILE) $(LINK32_OBJS)
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ENDIF 
 
@@ -303,3 +384,21 @@ SOURCE="..\named-checkzone.c"
 
 !ENDIF 
 
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/dig/dig.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dig.1,v 1.23.18.15 2006/01/28 02:15:40 marka Exp $
+.\" $Id: dig.1,v 1.23.18.22 2007/05/16 06:11:27 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: dig
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: Jun 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "DIG" "1" "Jun 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -47,7 +50,7 @@ Although
 \fBdig\fR
 is normally used with command\-line arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command\-line arguments and options is printed when the
 \fB\-h\fR
-option is given. Unlike earlier versions, the BIND9 implementation of
+option is given. Unlike earlier versions, the BIND 9 implementation of
 \fBdig\fR
 allows multiple lookups to be issued from the command line.
 .PP
@@ -62,19 +65,30 @@ It is possible to set per\-user defaults for
 \fBdig\fR
 via
 \fI${HOME}/.digrc\fR. This file is read and any options in it are applied before the command line arguments.
+.PP
+The IN and CH class names overlap with the IN and CH top level domains names. Either use the
+\fB\-t\fR
+and
+\fB\-c\fR
+options to specify the type and class or use the
+\fB\-q\fR
+the specify the domain name or use "IN." and "CH." when looking up these top level domains.
 .SH "SIMPLE USAGE"
 .PP
 A typical invocation of
 \fBdig\fR
 looks like:
 .sp
+.RS 4
 .nf
  dig @server name type 
 .fi
+.RE
 .sp
 where:
-.TP
+.PP
 \fBserver\fR
+.RS 4
 is the name or IP address of the name server to query. This can be an IPv4 address in dotted\-decimal notation or an IPv6 address in colon\-delimited notation. When the supplied
 \fIserver\fR
 argument is a hostname,
@@ -86,11 +100,15 @@ argument is provided,
 consults
 \fI/etc/resolv.conf\fR
 and queries the name servers listed there. The reply from the name server that responds is displayed.
-.TP
+.RE
+.PP
 \fBname\fR
+.RS 4
 is the name of the resource record that is to be looked up.
-.TP
+.RE
+.PP
 \fBtype\fR
+.RS 4
 indicates what type of query is required \(em ANY, A, MX, SIG, etc.
 \fItype\fR
 can be any valid query type. If no
@@ -98,6 +116,7 @@ can be any valid query type. If no
 argument is supplied,
 \fBdig\fR
 will perform a lookup for an A record.
+.RE
 .SH "OPTIONS"
 .PP
 The
@@ -109,14 +128,14 @@ The default query class (IN for internet) is overridden by the
 \fB\-c\fR
 option.
 \fIclass\fR
-is any valid class, such as HS for Hesiod records or CH for CHAOSNET records.
+is any valid class, such as HS for Hesiod records or CH for Chaosnet records.
 .PP
 The
 \fB\-f\fR
 option makes
 \fBdig \fR
 operate in batch mode by reading a list of lookup requests to process from the file
-\fIfilename\fR. The file contains a number of queries, one per line. Each entry in the file should be organised in the same way they would be presented as queries to
+\fIfilename\fR. The file contains a number of queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to
 \fBdig\fR
 using the command\-line interface.
 .PP
@@ -141,7 +160,7 @@ to only use IPv6 query transport.
 The
 \fB\-t\fR
 option sets the query type to
-\fItype\fR. It can be any valid query type which is supported in BIND9. The default query type "A", unless the
+\fItype\fR. It can be any valid query type which is supported in BIND 9. The default query type is "A", unless the
 \fB\-x\fR
 option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required,
 \fItype\fR
@@ -152,11 +171,11 @@ ixfr=N. The incremental zone transfer will contain the changes made to the zone
 The
 \fB\-q\fR
 option sets the query name to
-\fIname\fR. This useful do distingish the
+\fIname\fR. This useful do distinguish the
 \fIname\fR
 from other arguments.
 .PP
-Reverse lookups \- mapping addresses to names \- are simplified by the
+Reverse lookups \(em mapping addresses to names \(em are simplified by the
 \fB\-x\fR
 option.
 \fIaddr\fR
@@ -206,19 +225,26 @@ Each query option is identified by a keyword preceded by a plus sign (+). Some k
 no
 to negate the meaning of that keyword. Other keywords assign values to options like the timeout interval. They have the form
 \fB+keyword=value\fR. The query options are:
-.TP
+.PP
 \fB+[no]tcp\fR
-Use [do not use] TCP when querying name servers. The default behaviour is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used.
-.TP
+.RS 4
+Use [do not use] TCP when querying name servers. The default behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used.
+.RE
+.PP
 \fB+[no]vc\fR
+.RS 4
 Use [do not use] TCP when querying name servers. This alternate syntax to
 \fI+[no]tcp\fR
 is provided for backwards compatibility. The "vc" stands for "virtual circuit".
-.TP
+.RE
+.PP
 \fB+[no]ignore\fR
+.RS 4
 Ignore truncation in UDP responses instead of retrying with TCP. By default, TCP retries are performed.
-.TP
+.RE
+.PP
 \fB+domain=somename\fR
+.RS 4
 Set the search list to contain the single domain
 \fIsomename\fR, as if specified in a
 \fBdomain\fR
@@ -226,39 +252,59 @@ directive in
 \fI/etc/resolv.conf\fR, and enable search list processing as if the
 \fI+search\fR
 option were given.
-.TP
+.RE
+.PP
 \fB+[no]search\fR
+.RS 4
 Use [do not use] the search list defined by the searchlist or domain directive in
 \fIresolv.conf\fR
 (if any). The search list is not used by default.
-.TP
+.RE
+.PP
 \fB+[no]showsearch\fR
+.RS 4
 Perform [do not perform] a search showing intermediate results.
-.TP
+.RE
+.PP
 \fB+[no]defname\fR
+.RS 4
 Deprecated, treated as a synonym for
 \fI+[no]search\fR
-.TP
+.RE
+.PP
 \fB+[no]aaonly\fR
+.RS 4
 Sets the "aa" flag in the query.
-.TP
+.RE
+.PP
 \fB+[no]aaflag\fR
+.RS 4
 A synonym for
 \fI+[no]aaonly\fR.
-.TP
+.RE
+.PP
 \fB+[no]adflag\fR
+.RS 4
 Set [do not set] the AD (authentic data) bit in the query. The AD bit currently has a standard meaning only in responses, not in queries, but the ability to set the bit in the query is provided for completeness.
-.TP
+.RE
+.PP
 \fB+[no]cdflag\fR
+.RS 4
 Set [do not set] the CD (checking disabled) bit in the query. This requests the server to not perform DNSSEC validation of responses.
-.TP
+.RE
+.PP
 \fB+[no]cl\fR
+.RS 4
 Display [do not display] the CLASS when printing the record.
-.TP
+.RE
+.PP
 \fB+[no]ttlid\fR
+.RS 4
 Display [do not display] the TTL when printing the record.
-.TP
+.RE
+.PP
 \fB+[no]recurse\fR
+.RS 4
 Toggle the setting of the RD (recursion desired) bit in the query. This bit is set by default, which means
 \fBdig\fR
 normally sends recursive queries. Recursion is automatically disabled when the
@@ -266,75 +312,109 @@ normally sends recursive queries. Recursion is automatically disabled when the
 or
 \fI+trace\fR
 query options are used.
-.TP
+.RE
+.PP
 \fB+[no]nssearch\fR
+.RS 4
 When this option is set,
 \fBdig\fR
 attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone.
-.TP
+.RE
+.PP
 \fB+[no]trace\fR
+.RS 4
 Toggle tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled,
 \fBdig\fR
 makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup.
-.TP
+.RE
+.PP
 \fB+[no]cmd\fR
-toggles the printing of the initial comment in the output identifying the version of
+.RS 4
+Toggles the printing of the initial comment in the output identifying the version of
 \fBdig\fR
 and the query options that have been applied. This comment is printed by default.
-.TP
+.RE
+.PP
 \fB+[no]short\fR
+.RS 4
 Provide a terse answer. The default is to print the answer in a verbose form.
-.TP
+.RE
+.PP
 \fB+[no]identify\fR
+.RS 4
 Show [or do not show] the IP address and port number that supplied the answer when the
 \fI+short\fR
 option is enabled. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer.
-.TP
+.RE
+.PP
 \fB+[no]comments\fR
+.RS 4
 Toggle the display of comment lines in the output. The default is to print comments.
-.TP
+.RE
+.PP
 \fB+[no]stats\fR
-This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behaviour is to print the query statistics.
-.TP
+.RS 4
+This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behavior is to print the query statistics.
+.RE
+.PP
 \fB+[no]qr\fR
+.RS 4
 Print [do not print] the query as it is sent. By default, the query is not printed.
-.TP
+.RE
+.PP
 \fB+[no]question\fR
+.RS 4
 Print [do not print] the question section of a query when an answer is returned. The default is to print the question section as a comment.
-.TP
+.RE
+.PP
 \fB+[no]answer\fR
+.RS 4
 Display [do not display] the answer section of a reply. The default is to display it.
-.TP
+.RE
+.PP
 \fB+[no]authority\fR
+.RS 4
 Display [do not display] the authority section of a reply. The default is to display it.
-.TP
+.RE
+.PP
 \fB+[no]additional\fR
+.RS 4
 Display [do not display] the additional section of a reply. The default is to display it.
-.TP
+.RE
+.PP
 \fB+[no]all\fR
+.RS 4
 Set or clear all display flags.
-.TP
+.RE
+.PP
 \fB+time=T\fR
+.RS 4
 Sets the timeout for a query to
 \fIT\fR
-seconds. The default time out is 5 seconds. An attempt to set
+seconds. The default timeout is 5 seconds. An attempt to set
 \fIT\fR
 to less than 1 will result in a query timeout of 1 second being applied.
-.TP
+.RE
+.PP
 \fB+tries=T\fR
+.RS 4
 Sets the number of times to try UDP queries to server to
 \fIT\fR
 instead of the default, 3. If
 \fIT\fR
 is less than or equal to zero, the number of tries is silently rounded up to 1.
-.TP
+.RE
+.PP
 \fB+retry=T\fR
+.RS 4
 Sets the number of times to retry UDP queries to server to
 \fIT\fR
 instead of the default, 2. Unlike
 \fI+tries\fR, this does not include the initial query.
-.TP
+.RE
+.PP
 \fB+ndots=D\fR
+.RS 4
 Set the number of dots that have to appear in
 \fIname\fR
 to
@@ -346,35 +426,51 @@ or
 \fBdomain\fR
 directive in
 \fI/etc/resolv.conf\fR.
-.TP
+.RE
+.PP
 \fB+bufsize=B\fR
+.RS 4
 Set the UDP message buffer size advertised using EDNS0 to
 \fIB\fR
 bytes. The maximum and minimum sizes of this buffer are 65535 and 0 respectively. Values outside this range are rounded up or down appropriately. Values other than zero will cause a EDNS query to be sent.
-.TP
+.RE
+.PP
 \fB+edns=#\fR
+.RS 4
 Specify the EDNS version to query with. Valid values are 0 to 255. Setting the EDNS version will cause a EDNS query to be sent.
 \fB+noedns\fR
 clears the remembered EDNS version.
-.TP
+.RE
+.PP
 \fB+[no]multiline\fR
+.RS 4
 Print records like the SOA records in a verbose multi\-line format with human\-readable comments. The default is to print each record on a single line, to facilitate machine parsing of the
 \fBdig\fR
 output.
-.TP
+.RE
+.PP
 \fB+[no]fail\fR
-Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behaviour.
-.TP
+.RS 4
+Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behavior.
+.RE
+.PP
 \fB+[no]besteffort\fR
+.RS 4
 Attempt to display the contents of messages which are malformed. The default is to not display malformed answers.
-.TP
+.RE
+.PP
 \fB+[no]dnssec\fR
+.RS 4
 Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO) in the OPT record in the additional section of the query.
-.TP
+.RE
+.PP
 \fB+[no]sigchase\fR
+.RS 4
 Chase DNSSEC signature chains. Requires dig be compiled with \-DDIG_SIGCHASE.
-.TP
+.RE
+.PP
 \fB+trusted\-key=####\fR
+.RS 4
 Specifies a file containing trusted keys to be used with
 \fB+sigchase\fR. Each DNSKEY record must be on its own line.
 .sp
@@ -387,9 +483,12 @@ then
 in the current directory.
 .sp
 Requires dig be compiled with \-DDIG_SIGCHASE.
-.TP
+.RE
+.PP
 \fB+[no]topdown\fR
-When chasing DNSSEC signature chains perform a top down validation. Requires dig be compiled with \-DDIG_SIGCHASE.
+.RS 4
+When chasing DNSSEC signature chains perform a top\-down validation. Requires dig be compiled with \-DDIG_SIGCHASE.
+.RE
 .SH "MULTIPLE QUERIES"
 .PP
 The BIND 9 implementation of
@@ -406,9 +505,11 @@ A global set of query options, which should be applied to all queries, can also
 \fB+[no]cmd\fR
 option) can be overridden by a query\-specific set of query options. For example:
 .sp
+.RS 4
 .nf
 dig +qr www.isc.org any \-x 127.0.0.1 isc.org ns +noqr
 .fi
+.RE
 .sp
 shows how
 \fBdig\fR
@@ -449,3 +550,8 @@ RFC1035.
 .SH "BUGS"
 .PP
 There are probably too many query options.
+.SH "COPYRIGHT"
+Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000\-2003 Internet Software Consortium.
+.br

bin/dig/dig.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dig.c,v 1.186.18.24 2006/01/27 02:50:50 marka Exp $ */
+/* $Id: dig.c,v 1.186.18.29 2007/08/28 07:19:55 tbox Exp $ */
 
 /*! \file */
 
@@ -495,7 +495,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 			if (msg != query->lookup->sendmsg &&
 			    (msg->flags & DNS_MESSAGEFLAG_RD) != 0 &&
 			    (msg->flags & DNS_MESSAGEFLAG_RA) == 0)
-				printf(";; WARNING: recusion requested "
+				printf(";; WARNING: recursion requested "
 				       "but not available\n");
 		}
 		if (msg != query->lookup->sendmsg && extrabytes != 0U)
@@ -650,42 +650,6 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 	}
 }
 
-/*%
- * Reorder an argument list so that server names all come at the end.
- * This is a bit of a hack, to allow batch-mode processing to properly
- * handle the server options.
- */
-static void
-reorder_args(int argc, char *argv[]) {
-	int i, j;
-	char *ptr;
-	int end;
-
-	debug("reorder_args()");
-	end = argc - 1;
-	while (argv[end][0] == '@') {
-		end--;
-		if (end == 0)
-			return;
-	}
-	debug("arg[end]=%s", argv[end]);
-	for (i = 1; i < end - 1; i++) {
-		if (argv[i][0] == '@') {
-			debug("arg[%d]=%s", i, argv[i]);
-			ptr = argv[i];
-			for (j = i + 1; j < end; j++) {
-				debug("Moving %s to %d", argv[j], j - 1);
-				argv[j - 1] = argv[j];
-			}
-			debug("moving %s to end, %d", ptr, end - 1);
-			argv[end - 1] = ptr;
-			end--;
-			if (end < 1)
-				return;
-		}
-	}
-}
-
 static isc_uint32_t
 parse_uint(char *arg, const char *desc, isc_uint32_t max) {
 	isc_result_t result;
@@ -1104,7 +1068,9 @@ static const char *single_dash_opts = "46dhimnv";
 static const char *dash_opts = "46bcdfhikmnptvyx";
 static isc_boolean_t
 dash_option(char *option, char *next, dig_lookup_t **lookup,
-	    isc_boolean_t *open_type_class, isc_boolean_t config_only)
+	    isc_boolean_t *open_type_class, isc_boolean_t *need_clone,
+	    isc_boolean_t config_only, int argc, char **argv,
+	    isc_boolean_t *firstarg)
 {
 	char opt, *value, *ptr, *ptr2, *ptr3;
 	isc_result_t result;
@@ -1241,14 +1207,20 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		return (value_from_next);
 	case 'q':
 		if (!config_only) {
-			(*lookup) = clone_lookup(default_lookup,
-					         ISC_TRUE);
+			if (*need_clone)
+				(*lookup) = clone_lookup(default_lookup,
+							 ISC_TRUE);
+			*need_clone = ISC_TRUE;
 			strncpy((*lookup)->textname, value, 
 				sizeof((*lookup)->textname));
 			(*lookup)->textname[sizeof((*lookup)->textname)-1]=0;
 			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
 						     (*lookup)->ns_search_only);
 			(*lookup)->new_search = ISC_TRUE;
+			if (*firstarg) {
+				printgreeting(argc, argv, *lookup);
+				*firstarg = ISC_FALSE;
+			}
 			ISC_LIST_APPEND(lookup_list, (*lookup), link);
 			debug("looking up %s", (*lookup)->textname);
 		}
@@ -1376,7 +1348,9 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		keysecret[sizeof(keysecret)-1]=0;
 		return (value_from_next);
 	case 'x':
-		*lookup = clone_lookup(default_lookup, ISC_TRUE);
+		if (*need_clone)
+			*lookup = clone_lookup(default_lookup, ISC_TRUE);
+		*need_clone = ISC_TRUE;
 		if (get_reverse(textname, sizeof(textname), value,
 				ip6_int, ISC_FALSE) == ISC_R_SUCCESS) {
 			strncpy((*lookup)->textname, textname,
@@ -1390,6 +1364,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			if (!(*lookup)->rdclassset)
 				(*lookup)->rdclass = dns_rdataclass_in;
 			(*lookup)->new_search = ISC_TRUE;
+			if (*firstarg) {
+				printgreeting(argc, argv, *lookup);
+				*firstarg = ISC_FALSE;
+			}
 			ISC_LIST_APPEND(lookup_list, *lookup, link);
 		} else {
 			fprintf(stderr, "Invalid IP address %s\n", value);
@@ -1481,6 +1459,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 	char rcfile[256];
 #endif
 	char *input;
+	int i;
+	isc_boolean_t need_clone = ISC_TRUE;
 
 	/*
 	 * The semantics for parsing the args is a bit complex; if
@@ -1528,7 +1508,9 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 				bargv[0] = argv[0];
 				argv0 = argv[0];
 
-				reorder_args(bargc, (char **)bargv);
+				for(i = 0; i < bargc; i++)
+					debug(".digrc argv %d: %s",
+					      i, bargv[i]);
 				parse_args(ISC_TRUE, ISC_TRUE, bargc,
 					   (char **)bargv);
 			}
@@ -1537,7 +1519,12 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 #endif
 	}
 
-	lookup = default_lookup;
+	if (is_batchfile && !config_only) {
+		/* Processing '-f batchfile'. */
+		lookup = clone_lookup(default_lookup, ISC_TRUE);
+		need_clone = ISC_FALSE;
+	} else
+		lookup = default_lookup;
 
 	rc = argc;
 	rv = argv;
@@ -1554,14 +1541,16 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			if (rc <= 1) {
 				if (dash_option(&rv[0][1], NULL,
 						&lookup, &open_type_class,
-						config_only)) {
+						&need_clone, config_only,
+						argc, argv, &firstarg)) {
 					rc--;
 					rv++;
 				}
 			} else {
 				if (dash_option(&rv[0][1], rv[1],
 						&lookup, &open_type_class,
-						config_only)) {
+						&need_clone, config_only,
+						argc, argv, &firstarg)) {
 					rc--;
 					rv++;
 				}
@@ -1571,7 +1560,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			 * Anything which isn't an option
 			 */
 			if (open_type_class) {
-				if (strncmp(rv[0], "ixfr=", 5) == 0) {
+				if (strncasecmp(rv[0], "ixfr=", 5) == 0) {
 					rdtype = dns_rdatatype_ixfr;
 					result = ISC_R_SUCCESS;
 				} else {
@@ -1629,21 +1618,29 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 					continue;
 				}
 			}
+
 			if (!config_only) {
-				lookup = clone_lookup(default_lookup,
-						      ISC_TRUE);
+				if (need_clone)
+					lookup = clone_lookup(default_lookup,
+								      ISC_TRUE);
+				need_clone = ISC_TRUE;
 				strncpy(lookup->textname, rv[0], 
 					sizeof(lookup->textname));
 				lookup->textname[sizeof(lookup->textname)-1]=0;
 				lookup->trace_root = ISC_TF(lookup->trace  ||
 						     lookup->ns_search_only);
 				lookup->new_search = ISC_TRUE;
+				if (firstarg) {
+					printgreeting(argc, argv, lookup);
+					firstarg = ISC_FALSE;
+				}
 				ISC_LIST_APPEND(lookup_list, lookup, link);
 				debug("looking up %s", lookup->textname);
 			}
 			/* XXX Error message */
 		}
 	}
+
 	/*
 	 * If we have a batchfile, seed the lookup list with the
 	 * first entry, then trust the callback in dighost_shutdown
@@ -1678,15 +1675,20 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			bargv[0] = argv[0];
 			argv0 = argv[0];
 
-			reorder_args(bargc, (char **)bargv);
+			for(i = 0; i < bargc; i++)
+				debug("batch argv %d: %s", i, bargv[i]);
 			parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
+			return;
 		}
+		return;
 	}
 	/*
 	 * If no lookup specified, search for root
 	 */
 	if ((lookup_list.head == NULL) && !config_only) {
-		lookup = clone_lookup(default_lookup, ISC_TRUE);
+		if (need_clone)
+			lookup = clone_lookup(default_lookup, ISC_TRUE);
+		need_clone = ISC_TRUE;
 		lookup->trace_root = ISC_TF(lookup->trace ||
 					    lookup->ns_search_only);
 		lookup->new_search = ISC_TRUE;
@@ -1698,10 +1700,9 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			firstarg = ISC_FALSE;
 		}
 		ISC_LIST_APPEND(lookup_list, lookup, link);
-	} else if (!config_only && firstarg) {
-			printgreeting(argc, argv, lookup);
-			firstarg = ISC_FALSE;
 	}
+	if (!need_clone)
+		destroy_lookup(lookup);
 }
 
 /*
@@ -1715,7 +1716,7 @@ dighost_shutdown(void) {
 	int bargc;
 	char *bargv[16];
 	char *input;
-
+	int i;
 
 	if (batchname == NULL) {
 		isc_app_shutdown();
@@ -1743,7 +1744,8 @@ dighost_shutdown(void) {
 
 		bargv[0] = argv0;
 
-		reorder_args(bargc, (char **)bargv);
+		for(i = 0; i < bargc; i++)
+			debug("batch argv %d: %s", i, bargv[i]);
 		parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 		start_lookup();
 	} else {
@@ -1759,7 +1761,6 @@ dighost_shutdown(void) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
-	dig_server_t *s, *s2;
 
 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
@@ -1780,16 +1781,7 @@ main(int argc, char **argv) {
 	result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
 	check_result(result, "isc_app_onrun");
 	isc_app_run();
-	s = ISC_LIST_HEAD(default_lookup->my_server_list);
-	while (s != NULL) {
-		debug("freeing server %p belonging to %p",
-		      s, default_lookup);
-		s2 = s;
-		s = ISC_LIST_NEXT(s, link);
-		ISC_LIST_DEQUEUE(default_lookup->my_server_list, s2, link);
-		isc_mem_free(mctx, s2);
-	}
-	isc_mem_free(mctx, default_lookup);
+	destroy_lookup(default_lookup);
 	if (batchname != NULL) {
 		if (batchfp != stdin)
 			fclose(batchfp);

bin/dig/dig.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: dig.docbook,v 1.17.18.13 2006/01/27 23:57:44 marka Exp $ -->
+<!-- $Id: dig.docbook,v 1.17.18.21 2007/08/28 07:19:55 tbox Exp $ -->
 <refentry id="man.dig">
 
   <refentryinfo>
@@ -41,6 +41,7 @@
       <year>2004</year>
       <year>2005</year>
       <year>2006</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -103,7 +104,7 @@
       arguments, it also has a batch mode of operation for reading lookup
       requests from a file.  A brief summary of its command-line arguments
       and options is printed when the <option>-h</option> option is given.
-      Unlike earlier versions, the BIND9 implementation of
+      Unlike earlier versions, the BIND 9 implementation of
       <command>dig</command> allows multiple lookups to be issued
       from the
       command line.
@@ -128,6 +129,14 @@
       are applied before the command line arguments.
     </para>
 
+    <para>
+      The IN and CH class names overlap with the IN and CH top level
+      domains names.  Either use the <option>-t</option> and
+      <option>-c</option> options to specify the type and class or
+      use the <option>-q</option> the specify the domain name or
+      use "IN." and "CH." when looking up these top level domains.
+    </para>
+
   </refsect1>
 
   <refsect1>
@@ -207,7 +216,7 @@
       The default query class (IN for internet) is overridden by the
       <option>-c</option> option.  <parameter>class</parameter> is
       any valid
-      class, such as HS for Hesiod records or CH for CHAOSNET records.
+      class, such as HS for Hesiod records or CH for Chaosnet records.
     </para>
 
     <para>
@@ -216,7 +225,7 @@
       in batch mode by reading a list of lookup requests to process from the
       file <parameter>filename</parameter>.  The file contains a
       number of
-      queries, one per line.  Each entry in the file should be organised in
+      queries, one per line.  Each entry in the file should be organized in
       the same way they would be presented as queries to
       <command>dig</command> using the command-line interface.
     </para>
@@ -242,7 +251,7 @@
       The <option>-t</option> option sets the query type to
       <parameter>type</parameter>.  It can be any valid query type
       which is
-      supported in BIND9.  The default query type "A", unless the
+      supported in BIND 9.  The default query type is "A", unless the
       <option>-x</option> option is supplied to indicate a reverse lookup.
       A zone transfer can be requested by specifying a type of AXFR.  When
       an incremental zone transfer (IXFR) is required,
@@ -254,12 +263,12 @@
 
     <para>
       The <option>-q</option> option sets the query name to 
-      <parameter>name</parameter>.  This useful do distingish the
+      <parameter>name</parameter>.  This useful do distinguish the
       <parameter>name</parameter> from other arguments.
     </para>
 
     <para>
-      Reverse lookups - mapping addresses to names - are simplified by the
+      Reverse lookups &mdash; mapping addresses to names &mdash; are simplified by the
       <option>-x</option> option.  <parameter>addr</parameter> is
       an IPv4
       address in dotted-decimal notation, or a colon-delimited IPv6 address.
@@ -334,7 +343,7 @@
           <listitem>
             <para>
               Use [do not use] TCP when querying name servers.  The default
-              behaviour is to use UDP unless an AXFR or IXFR query is
+              behavior is to use UDP unless an AXFR or IXFR query is
               requested, in
               which case a TCP connection is used.
             </para>
@@ -527,7 +536,7 @@
           <term><option>+[no]cmd</option></term>
           <listitem>
             <para>
-              toggles the printing of the initial comment in the output
+              Toggles the printing of the initial comment in the output
               identifying
               the version of <command>dig</command> and the query
               options that have
@@ -579,7 +588,7 @@
               This query option toggles the printing of statistics: when the
               query
               was made, the size of the reply and so on.  The default
-              behaviour is
+              behavior is
               to print the query statistics.
             </para>
           </listitem>
@@ -653,8 +662,8 @@
             <para>
 
               Sets the timeout for a query to
-              <parameter>T</parameter> seconds.  The default time
-              out is 5 seconds.
+              <parameter>T</parameter> seconds.  The default
+	      timeout is 5 seconds.
               An attempt to set <parameter>T</parameter> to less
               than 1 will result
               in a query timeout of 1 second being applied.
@@ -754,7 +763,7 @@
               default is
               to not try the next server which is the reverse of normal stub
               resolver
-              behaviour.
+              behavior.
             </para>
           </listitem>
         </varlistentry>
@@ -813,7 +822,7 @@
           <term><option>+[no]topdown</option></term>
           <listitem>
             <para>
-              When chasing DNSSEC signature chains perform a top down
+              When chasing DNSSEC signature chains perform a top-down
               validation.
               Requires dig be compiled with -DDIG_SIGCHASE.
             </para>

bin/dig/dig.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dig.html,v 1.13.18.19 2006/01/28 02:15:40 marka Exp $ -->
+<!-- $Id: dig.html,v 1.13.18.28 2007/05/16 06:11:27 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dig</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
 <a name="man.dig"></a><div class="titlepage"></div>
@@ -34,7 +34,7 @@
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526001"></a><h2>DESCRIPTION</h2>
+<a name="id2543508"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
       (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
@@ -50,7 +50,7 @@
       arguments, it also has a batch mode of operation for reading lookup
       requests from a file.  A brief summary of its command-line arguments
       and options is printed when the <code class="option">-h</code> option is given.
-      Unlike earlier versions, the BIND9 implementation of
+      Unlike earlier versions, the BIND 9 implementation of
       <span><strong class="command">dig</strong></span> allows multiple lookups to be issued
       from the
       command line.
@@ -71,9 +71,16 @@
       any options in it
       are applied before the command line arguments.
     </p>
+<p>
+      The IN and CH class names overlap with the IN and CH top level
+      domains names.  Either use the <code class="option">-t</code> and
+      <code class="option">-c</code> options to specify the type and class or
+      use the <code class="option">-q</code> the specify the domain name or
+      use "IN." and "CH." when looking up these top level domains.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526056"></a><h2>SIMPLE USAGE</h2>
+<a name="id2543577"></a><h2>SIMPLE USAGE</h2>
 <p>
       A typical invocation of <span><strong class="command">dig</strong></span> looks like:
       </p>
@@ -119,7 +126,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526215"></a><h2>OPTIONS</h2>
+<a name="id2543668"></a><h2>OPTIONS</h2>
 <p>
       The <code class="option">-b</code> option sets the source IP address of the query
       to <em class="parameter"><code>address</code></em>.  This must be a valid
@@ -132,7 +139,7 @@
       The default query class (IN for internet) is overridden by the
       <code class="option">-c</code> option.  <em class="parameter"><code>class</code></em> is
       any valid
-      class, such as HS for Hesiod records or CH for CHAOSNET records.
+      class, such as HS for Hesiod records or CH for Chaosnet records.
     </p>
 <p>
       The <code class="option">-f</code> option makes <span><strong class="command">dig </strong></span>
@@ -140,7 +147,7 @@
       in batch mode by reading a list of lookup requests to process from the
       file <em class="parameter"><code>filename</code></em>.  The file contains a
       number of
-      queries, one per line.  Each entry in the file should be organised in
+      queries, one per line.  Each entry in the file should be organized in
       the same way they would be presented as queries to
       <span><strong class="command">dig</strong></span> using the command-line interface.
     </p>
@@ -163,7 +170,7 @@
       The <code class="option">-t</code> option sets the query type to
       <em class="parameter"><code>type</code></em>.  It can be any valid query type
       which is
-      supported in BIND9.  The default query type "A", unless the
+      supported in BIND 9.  The default query type is "A", unless the
       <code class="option">-x</code> option is supplied to indicate a reverse lookup.
       A zone transfer can be requested by specifying a type of AXFR.  When
       an incremental zone transfer (IXFR) is required,
@@ -174,11 +181,11 @@
     </p>
 <p>
       The <code class="option">-q</code> option sets the query name to 
-      <em class="parameter"><code>name</code></em>.  This useful do distingish the
+      <em class="parameter"><code>name</code></em>.  This useful do distinguish the
       <em class="parameter"><code>name</code></em> from other arguments.
     </p>
 <p>
-      Reverse lookups - mapping addresses to names - are simplified by the
+      Reverse lookups &#8212; mapping addresses to names &#8212; are simplified by the
       <code class="option">-x</code> option.  <em class="parameter"><code>addr</code></em> is
       an IPv4
       address in dotted-decimal notation, or a colon-delimited IPv6 address.
@@ -219,7 +226,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526418"></a><h2>QUERY OPTIONS</h2>
+<a name="id2543939"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">dig</strong></span>
       provides a number of query options which affect
       the way in which lookups are made and the results displayed.  Some of
@@ -242,7 +249,7 @@
 <dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
 <dd><p>
               Use [do not use] TCP when querying name servers.  The default
-              behaviour is to use UDP unless an AXFR or IXFR query is
+              behavior is to use UDP unless an AXFR or IXFR query is
               requested, in
               which case a TCP connection is used.
             </p></dd>
@@ -355,7 +362,7 @@
             </p></dd>
 <dt><span class="term"><code class="option">+[no]cmd</code></span></dt>
 <dd><p>
-              toggles the printing of the initial comment in the output
+              Toggles the printing of the initial comment in the output
               identifying
               the version of <span><strong class="command">dig</strong></span> and the query
               options that have
@@ -387,7 +394,7 @@
               This query option toggles the printing of statistics: when the
               query
               was made, the size of the reply and so on.  The default
-              behaviour is
+              behavior is
               to print the query statistics.
             </p></dd>
 <dt><span class="term"><code class="option">+[no]qr</code></span></dt>
@@ -426,8 +433,8 @@
 <dd><p>
 
               Sets the timeout for a query to
-              <em class="parameter"><code>T</code></em> seconds.  The default time
-              out is 5 seconds.
+              <em class="parameter"><code>T</code></em> seconds.  The default
+	      timeout is 5 seconds.
               An attempt to set <em class="parameter"><code>T</code></em> to less
               than 1 will result
               in a query timeout of 1 second being applied.
@@ -492,7 +499,7 @@
               default is
               to not try the next server which is the reverse of normal stub
               resolver
-              behaviour.
+              behavior.
             </p></dd>
 <dt><span class="term"><code class="option">+[no]besteffort</code></span></dt>
 <dd><p>
@@ -528,7 +535,7 @@
 </dd>
 <dt><span class="term"><code class="option">+[no]topdown</code></span></dt>
 <dd><p>
-              When chasing DNSSEC signature chains perform a top down
+              When chasing DNSSEC signature chains perform a top-down
               validation.
               Requires dig be compiled with -DDIG_SIGCHASE.
             </p></dd>
@@ -538,7 +545,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527675"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2545128"></a><h2>MULTIPLE QUERIES</h2>
 <p>
       The BIND 9 implementation of <span><strong class="command">dig </strong></span>
       supports
@@ -584,7 +591,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527737"></a><h2>IDN SUPPORT</h2>
+<a name="id2545258"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names.
@@ -598,14 +605,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527760"></a><h2>FILES</h2>
+<a name="id2545281"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 <p><code class="filename">${HOME}/.digrc</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527777"></a><h2>SEE ALSO</h2>
+<a name="id2545298"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -613,7 +620,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527814"></a><h2>BUGS</h2>
+<a name="id2545335"></a><h2>BUGS</h2>
 <p>
       There are probably too many query options.
     </p>

bin/dig/dighost.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.259.18.32 2006/02/17 00:14:21 marka Exp $ */
+/* $Id: dighost.c,v 1.259.18.43 2007/08/28 07:19:55 tbox Exp $ */
 
 /*! \file
  *  \note
@@ -144,6 +144,7 @@ static idn_result_t	append_textname(char *name, const char *origin,
 static void		idn_check_result(idn_result_t r, const char *msg);
 
 #define MAXDLEN		256
+int  idnoptions	= 0;
 #endif
 
 /*%
@@ -344,6 +345,9 @@ cancel_lookup(dig_lookup_t *lookup);
 static void
 recv_done(isc_task_t *task, isc_event_t *event);
 
+static void
+send_udp(dig_query_t *query);
+
 static void
 connect_timeout(isc_task_t *task, isc_event_t *event);
 
@@ -751,6 +755,8 @@ make_empty_lookup(void) {
 	looknew->section_authority = ISC_TRUE;
 	looknew->section_additional = ISC_TRUE;
 	looknew->new_search = ISC_FALSE;
+	looknew->done_as_is = ISC_FALSE;
+	looknew->need_search = ISC_FALSE;
 	ISC_LINK_INIT(looknew, link);
 	ISC_LIST_INIT(looknew->q);
 	ISC_LIST_INIT(looknew->my_server_list);
@@ -823,6 +829,8 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->section_additional = lookold->section_additional;
 	looknew->retries = lookold->retries;
 	looknew->tsigctx = NULL;
+	looknew->need_search = lookold->need_search;
+	looknew->done_as_is = lookold->done_as_is;
 
 	if (servers)
 		clone_server_list(lookold->my_server_list,
@@ -1001,9 +1009,8 @@ setup_system(void) {
 	if (lwresult != LWRES_R_SUCCESS)
 		fatal("lwres_context_create failed");
 
-	if (isc_file_exists(RESOLV_CONF))
-		lwresult = lwres_conf_parse(lwctx, RESOLV_CONF);
-	if (lwresult != LWRES_R_SUCCESS)
+	lwresult = lwres_conf_parse(lwctx, RESOLV_CONF);
+	if (lwresult != LWRES_R_SUCCESS && lwresult != LWRES_R_NOTFOUND)
 		fatal("parse of %s failed", RESOLV_CONF);
 
 	lwconf = lwres_conf_get(lwctx);
@@ -1256,7 +1263,10 @@ clear_query(dig_query_t *query) {
 	isc_mempool_put(commctx, query->recvspace);
 	isc_buffer_invalidate(&query->recvbuf);
 	isc_buffer_invalidate(&query->lengthbuf);
-	isc_mem_free(mctx, query);
+	if (query->waiting_senddone)
+		query->pending_free = ISC_TRUE;
+	else
+		isc_mem_free(mctx, query);
 }
 
 /*%
@@ -1266,9 +1276,7 @@ clear_query(dig_query_t *query) {
  */
 static isc_boolean_t
 try_clear_lookup(dig_lookup_t *lookup) {
-	dig_server_t *s;
 	dig_query_t *q;
-	void *ptr;
 
 	REQUIRE(lookup != NULL);
 
@@ -1281,14 +1289,24 @@ try_clear_lookup(dig_lookup_t *lookup) {
 				debug("query to %s still pending", q->servname);
 				q = ISC_LIST_NEXT(q, link);
 			}
-			return (ISC_FALSE);
 		}
+		return (ISC_FALSE);
 	}
+
 	/*
 	 * At this point, we know there are no queries on the lookup,
 	 * so can make it go away also.
 	 */
-	debug("cleared");
+	destroy_lookup(lookup);
+	return (ISC_TRUE);
+}
+
+void
+destroy_lookup(dig_lookup_t *lookup) {
+	dig_server_t *s;
+	void *ptr;
+
+	debug("destroy");
 	s = ISC_LIST_HEAD(lookup->my_server_list);
 	while (s != NULL) {
 		debug("freeing server %p belonging to %p", s, lookup);
@@ -1313,10 +1331,8 @@ try_clear_lookup(dig_lookup_t *lookup) {
 		dst_context_destroy(&lookup->tsigctx);
 
 	isc_mem_free(mctx, lookup);
-	return (ISC_TRUE);
 }
 
-
 /*%
  * If we can, start the next lookup in the queue running.
  * This assumes that the lookup on the head of the queue hasn't been
@@ -1469,6 +1485,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 	isc_boolean_t success = ISC_FALSE;
 	int numLookups = 0;
 	dns_name_t *domain;
+	isc_boolean_t horizontal = ISC_FALSE, bad = ISC_FALSE;
 
 	INSIST(!free_now);
 
@@ -1503,10 +1520,16 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 			domain = dns_fixedname_name(&query->lookup->fdomain);
 			namereln = dns_name_fullcompare(name, domain,
 							&order, &nlabels);
-			if (namereln == dns_namereln_equal)
-				printf(";; BAD (HORIZONTAL) REFERRAL\n");
-			else if (namereln != dns_namereln_subdomain)
-				printf(";; BAD REFERRAL\n");
+			if (namereln == dns_namereln_equal) {
+				if (!horizontal)
+					printf(";; BAD (HORIZONTAL) REFERRAL\n");
+				horizontal = ISC_TRUE;
+			} else if (namereln != dns_namereln_subdomain) {
+				if (!bad)
+					printf(";; BAD REFERRAL\n");
+				bad = ISC_TRUE;
+				continue;
+			}
 		}
 
 		for (result = dns_rdataset_first(rdataset);
@@ -1596,6 +1619,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 static isc_boolean_t
 next_origin(dns_message_t *msg, dig_query_t *query) {
 	dig_lookup_t *lookup;
+	dig_searchlist_t *search;
 
 	UNUSED(msg);
 
@@ -1610,13 +1634,22 @@ next_origin(dns_message_t *msg, dig_query_t *query) {
 		 * about finding the next entry.
 		 */
 		return (ISC_FALSE);
-	if (query->lookup->origin == NULL)
+	if (query->lookup->origin == NULL && !query->lookup->need_search)
 		/*
 		 * Then we just did rootorg; there's nothing left.
 		 */
 		return (ISC_FALSE);
-	lookup = requeue_lookup(query->lookup, ISC_TRUE);
-	lookup->origin = ISC_LIST_NEXT(query->lookup->origin, link);
+	if (query->lookup->origin == NULL && query->lookup->need_search) {
+		lookup = requeue_lookup(query->lookup, ISC_TRUE);
+		lookup->origin = ISC_LIST_HEAD(search_list);
+		lookup->need_search = ISC_FALSE;
+	} else {
+		search = ISC_LIST_NEXT(query->lookup->origin, link);
+		if (search == NULL && query->lookup->done_as_is)
+			return (ISC_FALSE);
+		lookup = requeue_lookup(query->lookup, ISC_TRUE);
+		lookup->origin = search;
+	}
 	cancel_lookup(query->lookup);
 	return (ISC_TRUE);
 }
@@ -1758,18 +1791,27 @@ setup_lookup(dig_lookup_t *lookup) {
 	 * take the first entry in the searchlist iff either usesearch
 	 * is TRUE or we got a domain line in the resolv.conf file.
 	 */
-	/* XXX New search here? */
+	if (lookup->new_search) {
 #ifdef WITH_IDN
-	if ((count_dots(utf8_textname) >= ndots) || !usesearch)
-		lookup->origin = NULL; /* Force abs lookup */
-	else if (lookup->origin == NULL && lookup->new_search && usesearch)
-               lookup->origin = ISC_LIST_HEAD(search_list);
+		if ((count_dots(utf8_textname) >= ndots) || !usesearch) {
+			lookup->origin = NULL; /* Force abs lookup */
+			lookup->done_as_is = ISC_TRUE;
+			lookup->need_search = usesearch;
+		} else if (lookup->origin == NULL && usesearch) {
+			lookup->origin = ISC_LIST_HEAD(search_list);
+			lookup->need_search = ISC_FALSE;
+		}
 #else
-	if ((count_dots(lookup->textname) >= ndots) || !usesearch)
-		lookup->origin = NULL; /* Force abs lookup */
-	else if (lookup->origin == NULL && lookup->new_search && usesearch)
-		lookup->origin = ISC_LIST_HEAD(search_list);
+		if ((count_dots(lookup->textname) >= ndots) || !usesearch) {
+			lookup->origin = NULL; /* Force abs lookup */
+			lookup->done_as_is = ISC_TRUE;
+			lookup->need_search = usesearch;
+		} else if (lookup->origin == NULL && usesearch) {
+			lookup->origin = ISC_LIST_HEAD(search_list);
+			lookup->need_search = ISC_FALSE;
+		}
 #endif
+	}
 
 #ifdef WITH_IDN
 	if (lookup->origin != NULL) {
@@ -1781,7 +1823,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				     sizeof(utf8_textname));
 		idn_check_result(mr, "append origin to textname");
 	}
-	mr = idn_encodename(IDN_LOCALMAP | IDN_NAMEPREP | IDN_ASCCHECK |
+	mr = idn_encodename(idnoptions | IDN_LOCALMAP | IDN_NAMEPREP |
 			    IDN_IDNCONV | IDN_LENCHECK, utf8_textname,
 			    idn_textname, sizeof(idn_textname));
 	idn_check_result(mr, "convert UTF-8 textname to IDN encoding");
@@ -1940,9 +1982,9 @@ setup_lookup(dig_lookup_t *lookup) {
 	check_result(result, "dns_compress_init");
 
 	debug("starting to render the message");
-	isc_buffer_init(&lookup->sendbuf, lookup->sendspace, COMMSIZE);
+	isc_buffer_init(&lookup->renderbuf, lookup->sendspace, COMMSIZE);
 	result = dns_message_renderbegin(lookup->sendmsg, &cctx,
-					 &lookup->sendbuf);
+					 &lookup->renderbuf);
 	check_result(result, "dns_message_renderbegin");
 	if (lookup->udpsize > 0 || lookup->dnssec || lookup->edns > -1) {
 		if (lookup->udpsize == 0)
@@ -1968,7 +2010,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	/*
 	 * Force TCP mode if the request is larger than 512 bytes.
 	 */
-	if (isc_buffer_usedlength(&lookup->sendbuf) > 512)
+	if (isc_buffer_usedlength(&lookup->renderbuf) > 512)
 		lookup->tcp_mode = ISC_TRUE;
 
 	lookup->pending = ISC_FALSE;
@@ -1984,6 +2026,8 @@ setup_lookup(dig_lookup_t *lookup) {
 		       query, lookup);
 		query->lookup = lookup;
 		query->waiting_connect = ISC_FALSE;
+		query->waiting_senddone = ISC_FALSE;
+		query->pending_free = ISC_FALSE;
 		query->recv_made = ISC_FALSE;
 		query->first_pass = ISC_TRUE;
 		query->first_soa_rcvd = ISC_FALSE;
@@ -2008,6 +2052,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
 		isc_buffer_init(&query->lengthbuf, query->lengthspace, 2);
 		isc_buffer_init(&query->slbuf, query->slspace, 2);
+		query->sendbuf = lookup->renderbuf;
 
 		ISC_LINK_INIT(query, link);
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
@@ -2026,18 +2071,43 @@ setup_lookup(dig_lookup_t *lookup) {
  */
 static void
 send_done(isc_task_t *_task, isc_event_t *event) {
+	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
+	isc_buffer_t *b = NULL;
+	dig_query_t *query, *next;
+	dig_lookup_t *l;
+
 	REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
 
 	UNUSED(_task);
 
 	LOCK_LOOKUP;
 
-	isc_event_free(&event);
-
 	debug("send_done()");
 	sendcount--;
 	debug("sendcount=%d", sendcount);
 	INSIST(sendcount >= 0);
+
+	for  (b = ISC_LIST_HEAD(sevent->bufferlist);
+	      b != NULL;
+	      b = ISC_LIST_HEAD(sevent->bufferlist)) 
+		ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
+
+	query = event->ev_arg;
+	query->waiting_senddone = ISC_FALSE;
+	l = query->lookup;
+
+	if (l->ns_search_only && !l->trace_root) {
+		debug("sending next, since searching");
+		next = ISC_LIST_NEXT(query, link);
+		if (next != NULL)
+			send_udp(next);
+	}
+
+	isc_event_free(&event);
+
+	if (query->pending_free)
+		isc_mem_free(mctx, query);
+
 	check_if_done();
 	UNLOCK_LOOKUP;
 }
@@ -2181,7 +2251,6 @@ send_tcp_connect(dig_query_t *query) {
 static void
 send_udp(dig_query_t *query) {
 	dig_lookup_t *l = NULL;
-	dig_query_t *next;
 	isc_result_t result;
 
 	debug("send_udp(%p)", query);
@@ -2223,27 +2292,16 @@ send_udp(dig_query_t *query) {
 		debug("recvcount=%d", recvcount);
 	}
 	ISC_LIST_INIT(query->sendlist);
-	ISC_LINK_INIT(&l->sendbuf, link);
-	ISC_LIST_ENQUEUE(query->sendlist, &l->sendbuf,
-			 link);
+	ISC_LIST_ENQUEUE(query->sendlist, &query->sendbuf, link);
 	debug("sending a request");
 	TIME_NOW(&query->time_sent);
 	INSIST(query->sock != NULL);
+	query->waiting_senddone = ISC_TRUE;
 	result = isc_socket_sendtov(query->sock, &query->sendlist,
 				    global_task, send_done, query,
 				    &query->sockaddr, NULL);
 	check_result(result, "isc_socket_sendtov");
 	sendcount++;
-	/*
-	 * If we're at the endgame of a nameserver search, we need to
-	 * immediately bring up all the queries.  Do it here.
-	 */
-	if (l->ns_search_only && !l->trace_root) {
-		debug("sending next, since searching");
-		next = ISC_LIST_NEXT(query, link);
-		if (next != NULL)
-			send_udp(next);
-	}
 }
 
 /*%
@@ -2332,6 +2390,10 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 	recvcount--;
 	INSIST(recvcount >= 0);
 
+	b = ISC_LIST_HEAD(sevent->bufferlist);
+	INSIST(b ==  &query->lengthbuf);
+	ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
+
 	if (sevent->result == ISC_R_CANCELED) {
 		isc_event_free(&event);
 		l = query->lookup;
@@ -2357,8 +2419,6 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 		UNLOCK_LOOKUP;
 		return;
 	}
-	b = ISC_LIST_HEAD(sevent->bufferlist);
-	ISC_LIST_DEQUEUE(sevent->bufferlist, &query->lengthbuf, link);
 	length = isc_buffer_getuint16(b);
 	if (length == 0) {
 		isc_event_free(&event);
@@ -2415,16 +2475,12 @@ launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
 
 	isc_buffer_clear(&query->slbuf);
 	isc_buffer_clear(&query->lengthbuf);
-	isc_buffer_putuint16(&query->slbuf,
-			     (isc_uint16_t) query->lookup->sendbuf.used);
+	isc_buffer_putuint16(&query->slbuf, (isc_uint16_t) query->sendbuf.used);
 	ISC_LIST_INIT(query->sendlist);
 	ISC_LINK_INIT(&query->slbuf, link);
 	ISC_LIST_ENQUEUE(query->sendlist, &query->slbuf, link);
-	if (include_question) {
-		ISC_LINK_INIT(&query->lookup->sendbuf, link);
-		ISC_LIST_ENQUEUE(query->sendlist, &query->lookup->sendbuf,
-				 link);
-	}
+	if (include_question)
+		ISC_LIST_ENQUEUE(query->sendlist, &query->sendbuf, link);
 	ISC_LINK_INIT(&query->lengthbuf, link);
 	ISC_LIST_ENQUEUE(query->lengthlist, &query->lengthbuf, link);
 
@@ -2436,6 +2492,7 @@ launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
 	if (!query->first_soa_rcvd) {
 		debug("sending a request in launch_next_query");
 		TIME_NOW(&query->time_sent);
+		query->waiting_senddone = ISC_TRUE;
 		result = isc_socket_sendv(query->sock, &query->sendlist,
 					  global_task, send_done, query);
 		check_result(result, "isc_socket_sendv");
@@ -2720,6 +2777,10 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE);
 	sevent = (isc_socketevent_t *)event;
 
+	b = ISC_LIST_HEAD(sevent->bufferlist);
+	INSIST(b == &query->recvbuf);
+	ISC_LIST_DEQUEUE(sevent->bufferlist, &query->recvbuf, link);
+
 	if ((l->tcp_mode) && (l->timer != NULL))
 		isc_timer_touch(l->timer);
 	if ((!l->pending && !l->ns_search_only) || cancel_now) {
@@ -2753,9 +2814,6 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		return;
 	}
 
-	b = ISC_LIST_HEAD(sevent->bufferlist);
-	ISC_LIST_DEQUEUE(sevent->bufferlist, &query->recvbuf, link);
-
 	if (!l->tcp_mode &&
 	    !isc_sockaddr_compare(&sevent->address, &query->sockaddr,
 				  ISC_SOCKADDR_CMPADDR|
@@ -2997,7 +3055,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	}
 
 	if (!l->doing_xfr || l->xfr_q == query) {
-		if (msg->rcode != dns_rcode_noerror && l->origin != NULL) {
+		if (msg->rcode != dns_rcode_noerror &&
+		    (l->origin != NULL || l->need_search)) {
 			if (!next_origin(msg, query) || showsearch) {
 				printmessage(query, msg, ISC_TRUE);
 				received(b->used, &sevent->address, query);
@@ -3087,7 +3146,6 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			chase_msg2->msg = msg;
 		}
 #endif
-	
 	}
        
 #ifdef DIG_SIGCHASE
@@ -3840,7 +3898,7 @@ get_trusted_key(isc_mem_t *mctx)
 		       filename);
 		return (ISC_R_FAILURE);
 	}
-	while (fgets(buf, 1500, fp) != NULL) {
+	while (fgets(buf, sizeof(buf), fp) != NULL) {
 		result = opentmpkey(mctx,"tmp_file", &filetemp, &fptemp);
 		if (result != ISC_R_SUCCESS) {
 			fclose(fp);

bin/dig/host.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: host.1,v 1.14.18.10 2005/10/13 02:52:59 marka Exp $
+.\" $Id: host.1,v 1.14.18.14 2007/05/09 03:33:12 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: host
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: Jun 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "HOST" "1" "Jun 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -127,7 +130,7 @@ makes. This should mean that the name server receiving the query will not attemp
 \fB\-r\fR
 option enables
 \fBhost\fR
-to mimic the behaviour of a name server by making non\-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers.
+to mimic the behavior of a name server by making non\-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers.
 .PP
 By default
 \fBhost\fR
@@ -149,7 +152,7 @@ The
 \fB\-t\fR
 option is used to select the query type.
 \fItype\fR
-can be any recognised query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified,
+can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified,
 \fBhost\fR
 automatically selects an appropriate query type. By default it looks for A records, but if the
 \fB\-C\fR
@@ -180,8 +183,9 @@ will effectively wait forever for a reply. The time to wait for a response will
 The
 \fB\-s\fR
 option tells
-\fBhost\fR\fInot\fR
-to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behaviour.
+\fBhost\fR
+\fInot\fR
+to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behavior.
 .PP
 The
 \fB\-m\fR
@@ -208,3 +212,8 @@ runs.
 .PP
 \fBdig\fR(1),
 \fBnamed\fR(8).
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000\-2002 Internet Software Consortium.
+.br

bin/dig/host.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,13 +15,25 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: host.c,v 1.94.18.13 2006/03/02 23:48:49 marka Exp $ */
+/* $Id: host.c,v 1.94.18.19 2007/08/28 07:19:55 tbox Exp $ */
 
 /*! \file */
 
 #include <config.h>
+#include <stdlib.h>
 #include <limits.h>
 
+#ifdef HAVE_LOCALE_H
+#include <locale.h>
+#endif
+
+#ifdef WITH_IDN
+#include <idn/result.h>
+#include <idn/log.h>
+#include <idn/resconf.h>
+#include <idn/api.h>
+#endif
+
 #include <isc/app.h>
 #include <isc/commandline.h>
 #include <isc/netaddr.h>
@@ -48,6 +60,7 @@ static isc_boolean_t default_lookups = ISC_TRUE;
 static int seen_error = -1;
 static isc_boolean_t list_addresses = ISC_TRUE;
 static dns_rdatatype_t list_type = dns_rdatatype_a;
+static isc_boolean_t printed_server = ISC_FALSE;
 
 static const char *opcodetext[] = {
 	"QUERY",
@@ -398,7 +411,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	 */
 	force_error = (seen_error == 1) ? 1 : 0;
 	seen_error = 1;
-	if (listed_server) {
+	if (listed_server && !printed_server) {
 		char sockstr[ISC_SOCKADDR_FORMATSIZE];
 
 		printf("Using domain server:\n");
@@ -407,13 +420,16 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 				    sizeof(sockstr));
 		printf("Address: %s\n", sockstr);
 		printf("Aliases: \n\n");
+		printed_server = ISC_TRUE;
 	}
 
 	if (msg->rcode != 0) {
 		char namestr[DNS_NAME_FORMATSIZE];
 		dns_name_format(query->lookup->name, namestr, sizeof(namestr));
-		printf("Host %s not found: %d(%s)\n", namestr,
-		       msg->rcode, rcodetext[msg->rcode]);
+		printf("Host %s not found: %d(%s)\n",
+		       (msg->rcode != dns_rcode_nxdomain) ? namestr :
+		       query->lookup->textname, msg->rcode,
+		       rcodetext[msg->rcode]);
 		return (ISC_R_SUCCESS);
 	}
 
@@ -567,6 +583,7 @@ pre_parse_args(int argc, char **argv) {
 	while ((c = isc_commandline_parse(argc, argv, optstring)) != -1) {
 		switch (c) {
 		case 'm':
+			memdebugging = ISC_TRUE;
 			if (strcasecmp("trace", isc_commandline_argument) == 0)
 				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
 			else if (!strcasecmp("record",
@@ -662,6 +679,9 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = rdtype;
 			lookup->rdtypeset = ISC_TRUE;
+#ifdef WITH_IDN
+			idnoptions = 0;
+#endif
 			if (rdtype == dns_rdatatype_axfr) {
 				/* -l -t any -v */
 				list_type = dns_rdatatype_any;
@@ -670,6 +690,13 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			} else if (rdtype == dns_rdatatype_ixfr) {
 				lookup->ixfr_serial = serial;
 				list_type = rdtype;
+#ifdef WITH_IDN
+			} else if (rdtype == dns_rdatatype_a ||
+				   rdtype == dns_rdatatype_aaaa ||
+				   rdtype == dns_rdatatype_mx) {
+				idnoptions = IDN_ASCCHECK;
+				list_type = rdtype;
+#endif
 			} else
 				list_type = rdtype;
 			list_addresses = ISC_FALSE;
@@ -812,6 +839,9 @@ main(int argc, char **argv) {
 	ISC_LIST_INIT(search_list);
 	
 	fatalexit = 1;
+#ifdef WITH_IDN
+	idnoptions = IDN_ASCCHECK;
+#endif
 
 	debug("main()");
 	progname = argv[0];

bin/dig/host.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2002  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: host.docbook,v 1.5.18.7 2005/09/09 06:22:06 marka Exp $ -->
+<!-- $Id: host.docbook,v 1.5.18.11 2007/08/28 07:19:55 tbox Exp $ -->
 <refentry id="man.host">
 
   <refentryinfo>
@@ -40,6 +40,7 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -172,7 +173,7 @@
       attempt to resolve <parameter>name</parameter>.  The
       <option>-r</option> option enables <command>host</command>
       to mimic
-      the behaviour of a name server by making non-recursive queries and
+      the behavior of a name server by making non-recursive queries and
       expecting to receive answers to those queries that are usually
       referrals to other name servers.
     </para>
@@ -193,7 +194,7 @@
 
     <para>
       The <option>-t</option> option is used to select the query type.
-      <parameter>type</parameter> can be any recognised query
+      <parameter>type</parameter> can be any recognized query
       type: CNAME,
       NS, SOA, SIG, KEY, AXFR, etc.  When no query type is specified,
       <command>host</command> automatically selects an appropriate
@@ -226,7 +227,7 @@
       The <option>-s</option> option tells <command>host</command> 
       <emphasis>not</emphasis> to send the query to the next nameserver
       if any server responds with a SERVFAIL response, which is the
-      reverse of normal stub resolver behaviour.
+      reverse of normal stub resolver behavior.
     </para>
 
     <para>

bin/dig/host.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2002 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: host.html,v 1.7.18.14 2005/10/13 02:52:59 marka Exp $ -->
+<!-- $Id: host.html,v 1.7.18.20 2007/05/09 03:33:12 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>host</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
 <a name="man.host"></a><div class="titlepage"></div>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">host</code>  [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] {name} [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525921"></a><h2>DESCRIPTION</h2>
+<a name="id2543428"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">host</strong></span>
       is a simple utility for performing DNS lookups.
       It is normally used to convert names to IP addresses and vice versa.
@@ -125,7 +125,7 @@
       attempt to resolve <em class="parameter"><code>name</code></em>.  The
       <code class="option">-r</code> option enables <span><strong class="command">host</strong></span>
       to mimic
-      the behaviour of a name server by making non-recursive queries and
+      the behavior of a name server by making non-recursive queries and
       expecting to receive answers to those queries that are usually
       referrals to other name servers.
     </p>
@@ -143,7 +143,7 @@
     </p>
 <p>
       The <code class="option">-t</code> option is used to select the query type.
-      <em class="parameter"><code>type</code></em> can be any recognised query
+      <em class="parameter"><code>type</code></em> can be any recognized query
       type: CNAME,
       NS, SOA, SIG, KEY, AXFR, etc.  When no query type is specified,
       <span><strong class="command">host</strong></span> automatically selects an appropriate
@@ -174,7 +174,7 @@
       The <code class="option">-s</code> option tells <span><strong class="command">host</strong></span> 
       <span class="emphasis"><em>not</em></span> to send the query to the next nameserver
       if any server responds with a SERVFAIL response, which is the
-      reverse of normal stub resolver behaviour.
+      reverse of normal stub resolver behavior.
     </p>
 <p>
       The <code class="option">-m</code> can be used to set the memory usage debugging
@@ -184,7 +184,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526286"></a><h2>IDN SUPPORT</h2>
+<a name="id2543725"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">host</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names. 
@@ -198,12 +198,12 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526309"></a><h2>FILES</h2>
+<a name="id2543748"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526321"></a><h2>SEE ALSO</h2>
+<a name="id2543828"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
     </p>

bin/dig/include/dig/dig.h

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dig.h,v 1.82.18.16 2006/01/27 23:57:44 marka Exp $ */
+/* $Id: dig.h,v 1.82.18.23 2007/08/28 07:19:55 tbox Exp $ */
 
 #ifndef DIG_H
 #define DIG_H
@@ -126,6 +126,8 @@ struct dig_lookup {
 		section_additional,
 		servfail_stops,
 		new_search,
+		need_search,
+		done_as_is,
 		besteffort,
 		dnssec;
 #ifdef DIG_SIGCHASE
@@ -156,7 +158,7 @@ isc_boolean_t	sigchase;
 	char onamespace[BUFSIZE];
 	isc_buffer_t namebuf;
 	isc_buffer_t onamebuf;
-	isc_buffer_t sendbuf;
+	isc_buffer_t renderbuf;
 	char *sendspace;
 	dns_name_t *name;
 	isc_timer_t *timer;
@@ -186,6 +188,8 @@ isc_boolean_t	sigchase;
 struct dig_query {
 	dig_lookup_t *lookup;
 	isc_boolean_t waiting_connect,
+		pending_free,
+		waiting_senddone,
 		first_pass,
 		first_soa_rcvd,
 		second_rr_rcvd,
@@ -212,6 +216,7 @@ struct dig_query {
 	isc_sockaddr_t sockaddr;
 	isc_time_t time_sent;
 	isc_uint64_t byte_count;
+	isc_buffer_t sendbuf;
 };
 
 struct dig_server {
@@ -272,6 +277,9 @@ extern isc_boolean_t debugging, memdebugging;
 extern char *progname;
 extern int tries;
 extern int fatalexit;
+#ifdef WITH_IDN
+extern int idnoptions;
+#endif
 
 /*
  * Routines in dighost.c.
@@ -295,6 +303,9 @@ check_result(isc_result_t result, const char *msg);
 void
 setup_lookup(dig_lookup_t *lookup);
 
+void
+destroy_lookup(dig_lookup_t *lookup);
+
 void
 do_lookup(dig_lookup_t *lookup);
 

bin/dig/nslookup.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -12,14 +12,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: nslookup.1,v 1.1.10.8 2006/01/06 01:48:03 marka Exp $
+.\" $Id: nslookup.1,v 1.1.10.14 2007/05/16 06:11:27 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: nslookup
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: Jun 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "NSLOOKUP" "1" "Jun 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -39,27 +42,34 @@ has two modes: interactive and non\-interactive. Interactive mode allows the use
 .SH "ARGUMENTS"
 .PP
 Interactive mode is entered in the following cases:
-.TP 3
+.TP 4
 1.
 when no arguments are given (the default name server will be used)
-.TP
+.TP 4
 2.
 when the first argument is a hyphen (\-) and the second argument is the host name or Internet address of a name server.
+.sp
+.RE
 .PP
 Non\-interactive mode is used when the name or Internet address of the host to be looked up is given as the first argument. The optional second argument specifies the host name or address of a name server.
 .PP
 Options can also be specified on the command line if they precede the arguments and are prefixed with a hyphen. For example, to change the default query type to host information, and the initial timeout to 10 seconds, type:
-.IP .sp .nf nslookup \-query=hinfo \-timeout=10 .fi
+.sp .RS 4 .nf nslookup \-query=hinfo \-timeout=10 .fi .RE
 .SH "INTERACTIVE COMMANDS"
-.TP
-host [server]
+.PP
+\fBhost\fR [server]
+.RS 4
 Look up information for host using the current default server or using server, if specified. If host is an Internet address and the query type is A or PTR, the name of the host is returned. If host is a name and does not have a trailing period, the search list is used to qualify the name.
 .sp
 To look up a host not in the current domain, append a period to the name.
-.TP
+.RE
+.PP
 \fBserver\fR \fIdomain\fR
-.TP
+.RS 4
+.RE
+.PP
 \fBlserver\fR \fIdomain\fR
+.RS 4
 Change the default server to
 \fIdomain\fR;
 \fBlserver\fR
@@ -67,112 +77,165 @@ uses the initial server to look up information about
 \fIdomain\fR, while
 \fBserver\fR
 uses the current default server. If an authoritative answer can't be found, the names of servers that might have the answer are returned.
-.TP
+.RE
+.PP
 \fBroot\fR
+.RS 4
 not implemented
-.TP
+.RE
+.PP
 \fBfinger\fR
+.RS 4
 not implemented
-.TP
+.RE
+.PP
 \fBls\fR
+.RS 4
 not implemented
-.TP
+.RE
+.PP
 \fBview\fR
+.RS 4
 not implemented
-.TP
+.RE
+.PP
 \fBhelp\fR
+.RS 4
 not implemented
-.TP
+.RE
+.PP
 \fB?\fR
+.RS 4
 not implemented
-.TP
+.RE
+.PP
 \fBexit\fR
+.RS 4
 Exits the program.
-.TP
+.RE
+.PP
 \fBset\fR \fIkeyword\fR\fI[=value]\fR
+.RS 4
 This command is used to change state information that affects the lookups. Valid keywords are:
-.RS
-.TP
+.RS 4
+.PP
 \fBall\fR
+.RS 4
 Prints the current values of the frequently used options to
 \fBset\fR. Information about the current default server and host is also printed.
-.TP
+.RE
+.PP
 \fBclass=\fR\fIvalue\fR
+.RS 4
 Change the query class to one of:
-.RS
-.TP
+.RS 4
+.PP
 \fBIN\fR
+.RS 4
 the Internet class
-.TP
+.RE
+.PP
 \fBCH\fR
+.RS 4
 the Chaos class
-.TP
+.RE
+.PP
 \fBHS\fR
+.RS 4
 the Hesiod class
-.TP
+.RE
+.PP
 \fBANY\fR
+.RS 4
 wildcard
 .RE
-.IP
+.RE
+.IP "" 4
 The class specifies the protocol group of the information.
 .sp
 (Default = IN; abbreviation = cl)
-.TP
+.RE
+.PP
 \fB \fR\fB\fI[no]\fR\fR\fBdebug\fR
-Turn debugging mode on. A lot more information is printed about the packet sent to the server and the resulting answer.
+.RS 4
+Turn on or off the display of the full response packet and any intermediate response packets when searching.
 .sp
 (Default = nodebug; abbreviation =
 [no]deb)
-.TP
+.RE
+.PP
 \fB \fR\fB\fI[no]\fR\fR\fBd2\fR
-Turn debugging mode on. A lot more information is printed about the packet sent to the server and the resulting answer.
+.RS 4
+Turn debugging mode on or off. This displays more about what nslookup is doing.
 .sp
 (Default = nod2)
-.TP
+.RE
+.PP
 \fBdomain=\fR\fIname\fR
+.RS 4
 Sets the search list to
 \fIname\fR.
-.TP
+.RE
+.PP
 \fB \fR\fB\fI[no]\fR\fR\fBsearch\fR
+.RS 4
 If the lookup request contains at least one period but doesn't end with a trailing period, append the domain names in the domain search list to the request until an answer is received.
 .sp
 (Default = search)
-.TP
+.RE
+.PP
 \fBport=\fR\fIvalue\fR
+.RS 4
 Change the default TCP/UDP name server port to
 \fIvalue\fR.
 .sp
 (Default = 53; abbreviation = po)
-.TP
+.RE
+.PP
 \fBquerytype=\fR\fIvalue\fR
-.TP
+.RS 4
+.RE
+.PP
 \fBtype=\fR\fIvalue\fR
+.RS 4
 Change the type of the information query.
 .sp
 (Default = A; abbreviations = q, ty)
-.TP
+.RE
+.PP
 \fB \fR\fB\fI[no]\fR\fR\fBrecurse\fR
+.RS 4
 Tell the name server to query other servers if it does not have the information.
 .sp
 (Default = recurse; abbreviation = [no]rec)
-.TP
+.RE
+.PP
 \fBretry=\fR\fInumber\fR
+.RS 4
 Set the number of retries to number.
-.TP
+.RE
+.PP
 \fBtimeout=\fR\fInumber\fR
+.RS 4
 Change the initial timeout interval for waiting for a reply to number seconds.
-.TP
+.RE
+.PP
 \fB \fR\fB\fI[no]\fR\fR\fBvc\fR
+.RS 4
 Always use a virtual circuit when sending requests to the server.
 .sp
 (Default = novc)
-.TP
+.RE
+.PP
 \fB \fR\fB\fI[no]\fR\fR\fBfail\fR
+.RS 4
 Try the next nameserver if a nameserver responds with SERVFAIL or a referral (nofail) or terminate query (fail) on such a response.
 .sp
 (Default = nofail)
 .RE
-.IP
+.RE
+.IP "" 4
+.RE
 .SH "FILES"
 .PP
 \fI/etc/resolv.conf\fR
@@ -184,3 +247,6 @@ Try the next nameserver if a nameserver responds with SERVFAIL or a referral (no
 .SH "AUTHOR"
 .PP
 Andrew Cherenson
+.SH "COPYRIGHT"
+Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+.br

bin/dig/nslookup.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nslookup.c,v 1.101.18.9 2005/08/25 00:43:25 marka Exp $ */
+/* $Id: nslookup.c,v 1.101.18.15 2007/08/28 07:19:55 tbox Exp $ */
 
 #include <config.h>
 
@@ -410,8 +410,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		char nametext[DNS_NAME_FORMATSIZE];
 		dns_name_format(query->lookup->name,
 				nametext, sizeof(nametext));
-		printf("** server can't find %s: %s\n", nametext,
-		       rcodetext[msg->rcode]);
+		printf("** server can't find %s: %s\n",
+		       (msg->rcode != dns_rcode_nxdomain) ? nametext :
+		       query->lookup->textname, rcodetext[msg->rcode]);
 		debug("returning with rcode == 0");
 		return (ISC_R_SUCCESS);
 	}
@@ -620,8 +621,10 @@ setoption(char *opt) {
 		tcpmode = ISC_FALSE;
  	} else if (strncasecmp(opt, "deb", 3) == 0) {
 		short_form = ISC_FALSE;
+		showsearch = ISC_TRUE;
 	} else if (strncasecmp(opt, "nodeb", 5) == 0) {
 		short_form = ISC_TRUE;
+		showsearch = ISC_FALSE;
  	} else if (strncasecmp(opt, "d2", 2) == 0) {
 		debugging = ISC_TRUE;
 	} else if (strncasecmp(opt, "nod2", 4) == 0) {
@@ -715,6 +718,7 @@ get_next_command(void) {
 	if (buf == NULL)
 		fatal("memory allocation failure");
 	fputs("> ", stderr);
+	fflush(stderr);
 	isc_app_block();
 	ptr = fgets(buf, COMMSIZE, stdin);
 	isc_app_unblock();

bin/dig/nslookup.docbook

@@ -1,10 +1,10 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -17,7 +17,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: nslookup.docbook,v 1.4.2.7 2006/01/06 00:01:43 marka Exp $ -->
+<!-- $Id: nslookup.docbook,v 1.4.2.13 2007/08/28 07:19:55 tbox Exp $ -->
 <!--
  - Copyright (c) 1985, 1989
  -    The Regents of the University of California.  All rights reserved.
@@ -72,6 +72,7 @@
       <year>2004</year>
       <year>2005</year>
       <year>2006</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -141,7 +142,7 @@ nslookup -query=hinfo  -timeout=10
     <title>INTERACTIVE COMMANDS</title>
     <variablelist>
       <varlistentry>
-        <term>host <optional>server</optional></term>
+        <term><constant>host</constant> <optional>server</optional></term>
         <listitem>
           <para>
             Look up information for host using the current default server or
@@ -313,9 +314,8 @@ nslookup -query=hinfo  -timeout=10
                     <replaceable><optional>no</optional></replaceable>debug</constant></term>
                 <listitem>
                   <para>
-                    Turn debugging mode on.  A lot more information is
-                    printed about the packet sent to the server and the
-                    resulting answer.
+		    Turn on or off the display of the full response packet and
+		    any intermediate response packets when searching.
                   </para>
 		  <para>
                     (Default = nodebug; abbreviation = <optional>no</optional>deb)
@@ -328,9 +328,8 @@ nslookup -query=hinfo  -timeout=10
                     <replaceable><optional>no</optional></replaceable>d2</constant></term>
                 <listitem>
                   <para>
-                    Turn debugging mode on.  A lot more information is
-                    printed about the packet sent to the server and the
-                    resulting answer.
+                    Turn debugging mode on or off.  This displays more about
+	            what nslookup is doing.
                   </para>
 		  <para>
                     (Default = nod2)

bin/dig/nslookup.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
  - 
  - Permission to use, copy, modify, and distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -13,15 +13,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: nslookup.html,v 1.1.10.13 2006/01/06 01:48:03 marka Exp $ -->
+<!-- $Id: nslookup.html,v 1.1.10.21 2007/05/16 06:11:27 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>nslookup</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463728"></a><div class="titlepage"></div>
+<a name="id2476276"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>nslookup &#8212; query Internet name servers interactively</p>
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">nslookup</code>  [<code class="option">-option</code>] [name | -] [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525985"></a><h2>DESCRIPTION</h2>
+<a name="id2543355"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">Nslookup</strong></span>
       is a program to query Internet domain name servers.  <span><strong class="command">Nslookup</strong></span>
       has two modes: interactive and non-interactive.  Interactive mode allows
@@ -43,7 +43,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526001"></a><h2>ARGUMENTS</h2>
+<a name="id2543371"></a><h2>ARGUMENTS</h2>
 <p>
       Interactive mode is entered in the following cases:
       </p>
@@ -76,9 +76,9 @@ nslookup -query=hinfo  -timeout=10
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526042"></a><h2>INTERACTIVE COMMANDS</h2>
+<a name="id2543413"></a><h2>INTERACTIVE COMMANDS</h2>
 <div class="variablelist"><dl>
-<dt><span class="term">host [<span class="optional">server</span>]</span></dt>
+<dt><span class="term"><code class="constant">host</code> [<span class="optional">server</span>]</span></dt>
 <dd>
 <p>
             Look up information for host using the current default server or
@@ -180,9 +180,8 @@ nslookup -query=hinfo  -timeout=10
                     <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>debug</code></span></dt>
 <dd>
 <p>
-                    Turn debugging mode on.  A lot more information is
-                    printed about the packet sent to the server and the
-                    resulting answer.
+		    Turn on or off the display of the full response packet and
+		    any intermediate response packets when searching.
                   </p>
 <p>
                     (Default = nodebug; abbreviation = [<span class="optional">no</span>]deb)
@@ -192,9 +191,8 @@ nslookup -query=hinfo  -timeout=10
                     <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>d2</code></span></dt>
 <dd>
 <p>
-                    Turn debugging mode on.  A lot more information is
-                    printed about the packet sent to the server and the
-                    resulting answer.
+                    Turn debugging mode on or off.  This displays more about
+	            what nslookup is doing.
                   </p>
 <p>
                     (Default = nod2)
@@ -288,19 +286,19 @@ nslookup -query=hinfo  -timeout=10
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2528906"></a><h2>FILES</h2>
+<a name="id2546279"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2528918"></a><h2>SEE ALSO</h2>
+<a name="id2546291"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2528952"></a><h2>Author</h2>
+<a name="id2546325"></a><h2>Author</h2>
 <p>
       Andrew Cherenson
     </p>

bin/dig/win32/dig.dsp

@@ -50,7 +50,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/bind9/win32/Release/libbind9.lib ../../../lib/lwres/win32/Release/liblwres.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/dig.exe"
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/dighost.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/bind9/win32/Release/libbind9.lib ../../../lib/lwres/win32/Release/liblwres.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/dig.exe"
 
 !ELSEIF  "$(CFG)" == "dig - Win32 Debug"
 
@@ -75,7 +75,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/lwres/win32/Debug/liblwres.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/dig.exe" /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/dighost.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/lwres/win32/Debug/liblwres.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/dig.exe" /pdbtype:sept
 
 !ENDIF 
 
@@ -90,10 +90,6 @@ LINK32=link.exe
 
 SOURCE=..\dig.c
 # End Source File
-# Begin Source File
-
-SOURCE=..\dighost.c
-# End Source File
 # End Group
 # Begin Group "Header Files"
 

bin/dig/win32/dig.mak

@@ -28,6 +28,81 @@ NULL=nul
 CPP=cl.exe
 RSC=rc.exe
 
+!IF  "$(CFG)" == "dig - Win32 Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
 !IF  "$(CFG)" == "dig - Win32 Release"
 
 OUTDIR=.\Release
@@ -52,6 +127,7 @@ CLEAN :
 	-@erase "$(INTDIR)\dighost.obj"
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "..\..\..\Build\Release\dig.exe"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -75,6 +151,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ELSEIF  "$(CFG)" == "dig - Win32 Debug"
 
@@ -109,6 +186,7 @@ CLEAN :
 	-@erase "$(OUTDIR)\dig.pdb"
 	-@erase "..\..\..\Build\Debug\dig.exe"
 	-@erase "..\..\..\Build\Debug\dig.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -139,6 +217,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ENDIF 
 
@@ -326,3 +405,21 @@ SOURCE=..\dighost.c
 
 !ENDIF 
 
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/dig/win32/dighost.dsp

@@ -0,0 +1,113 @@
+# Microsoft Developer Studio Project File - Name="dighost" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "Win32 (x86) Static-Link Library" 0x0104
+
+CFG=dighost - Win32 Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "dighost.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "dighost.mak" CFG="dighost - Win32 Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "dighost - Win32 Release" (based on "Win32 (x86) Static-Link Library")
+!MESSAGE "dighost - Win32 Debug" (based on "Win32 (x86) Static-Link Library")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+MTL=midl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "dighost - Win32 Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MT /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /YX /FD /c
+# ADD CPP /nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /D "NDEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /YX /FD /c /Fddighost
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /out:"Release/dighost.lib"
+
+!ELSEIF  "$(CFG)" == "dighost - Win32 Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MTd /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /YX /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/isc/noatomic/include" /I "../../../lib/lwres/win32/include" /I "../../../lib/lwres/include" /I "../../../lib/dns/include" /I "../../../lib/bind9/include" /D "_DEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /FR /YX /FD /GZ /c /Fddighost
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /debug out:"Debug/dighost.lib"
+
+!ENDIF 
+
+# Begin Target
+
+# Name "dighost - Win32 Release"
+# Name "dighost - Win32 Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# Begin Group "Main Dns Lib"
+
+# PROP Default_Filter "c"
+# Begin Source File
+
+SOURCE=..\dighost.c
+# End Source File
+# End Group
+# End Target
+# End Project

bin/dig/win32/dighost.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "dighost"=".\dighost.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/dig/win32/host.dsp

@@ -50,7 +50,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/bind9/win32/Release/libbind9.lib ../../../lib/lwres/win32/Release/liblwres.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/host.exe"
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/dighost.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/bind9/win32/Release/libbind9.lib ../../../lib/lwres/win32/Release/liblwres.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/host.exe"
 
 !ELSEIF  "$(CFG)" == "host - Win32 Debug"
 
@@ -75,7 +75,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/lwres/win32/Debug/liblwres.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/host.exe" /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/dighost.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/bind9/win32/Debug/libbind9.lib ../../../lib/lwres/win32/Debug/liblwres.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/host.exe" /pdbtype:sept
 
 !ENDIF 
 
@@ -88,10 +88,6 @@ LINK32=link.exe
 # PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
 # Begin Source File
 
-SOURCE=..\dighost.c
-# End Source File
-# Begin Source File
-
 SOURCE=..\host.c
 # End Source File
 # End Group

bin/dig/win32/host.mak

@@ -28,6 +28,81 @@ NULL=nul
 CPP=cl.exe
 RSC=rc.exe
 
+!IF  "$(CFG)" == "host - Win32 Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
 !IF  "$(CFG)" == "host - Win32 Release"
 
 OUTDIR=.\Release
@@ -52,6 +127,7 @@ CLEAN :
 	-@erase "$(INTDIR)\host.obj"
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "..\..\..\Build\Release\host.exe"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -75,6 +151,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ELSEIF  "$(CFG)" == "host - Win32 Debug"
 
@@ -109,6 +186,7 @@ CLEAN :
 	-@erase "$(OUTDIR)\host.pdb"
 	-@erase "..\..\..\Build\Debug\host.exe"
 	-@erase "..\..\..\Build\Debug\host.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -139,6 +217,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ENDIF 
 
@@ -326,3 +405,21 @@ SOURCE=..\host.c
 
 !ENDIF 
 
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/dig/win32/nslookup.mak

@@ -28,6 +28,81 @@ NULL=nul
 CPP=cl.exe
 RSC=rc.exe
 
+!IF  "$(CFG)" == "nslookup - Win32 Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
 !IF  "$(CFG)" == "nslookup - Win32 Release"
 
 OUTDIR=.\Release
@@ -52,6 +127,7 @@ CLEAN :
 	-@erase "$(INTDIR)\nslookup.obj"
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "..\..\..\Build\Release\nslookup.exe"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -75,6 +151,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ELSEIF  "$(CFG)" == "nslookup - Win32 Debug"
 
@@ -109,6 +186,7 @@ CLEAN :
 	-@erase "$(OUTDIR)\nslookup.pdb"
 	-@erase "..\..\..\Build\Debug\nslookup.exe"
 	-@erase "..\..\..\Build\Debug\nslookup.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -139,6 +217,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ENDIF 
 
@@ -326,3 +405,21 @@ SOURCE=..\nslookup.c
 
 !ENDIF 
 
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/dnssec/dnssec-keygen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dnssec-keygen.8,v 1.23.18.10 2005/10/13 02:53:00 marka Exp $
+.\" $Id: dnssec-keygen.8,v 1.23.18.14 2007/05/09 03:33:12 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: dnssec\-keygen
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: June 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "DNSSEC\-KEYGEN" "8" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -34,10 +37,11 @@ dnssec\-keygen \- DNSSEC key generation tool
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
-generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC <TBA\\>. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845.
+generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845.
 .SH "OPTIONS"
-.TP
+.PP
 \-a \fIalgorithm\fR
+.RS 4
 Selects the cryptographic algorithm. The value of
 \fBalgorithm\fR
 must be one of RSAMD5 (RSA) or RSASHA1, DSA, DH (Diffie Hellman), or HMAC\-MD5. These values are case insensitive.
@@ -45,38 +49,58 @@ must be one of RSAMD5 (RSA) or RSASHA1, DSA, DH (Diffie Hellman), or HMAC\-MD5.
 Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement algorithm, and DSA is recommended. For TSIG, HMAC\-MD5 is mandatory.
 .sp
 Note 2: HMAC\-MD5 and DH automatically set the \-k flag.
-.TP
+.RE
+.PP
 \-b \fIkeysize\fR
+.RS 4
 Specifies the number of bits in the key. The choice of key size depends on the algorithm used. RSAMD5 / RSASHA1 keys must be between 512 and 2048 bits. Diffie Hellman keys must be between 128 and 4096 bits. DSA keys must be between 512 and 1024 bits and an exact multiple of 64. HMAC\-MD5 keys must be between 1 and 512 bits.
-.TP
+.RE
+.PP
 \-n \fInametype\fR
+.RS 4
 Specifies the owner type of the key. The value of
 \fBnametype\fR
 must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY). These values are case insensitive.
-.TP
+.RE
+.PP
 \-c \fIclass\fR
+.RS 4
 Indicates that the DNS record containing the key should have the specified class. If not specified, class IN is used.
-.TP
+.RE
+.PP
 \-e
+.RS 4
 If generating an RSAMD5/RSASHA1 key, use a large exponent.
-.TP
+.RE
+.PP
 \-f \fIflag\fR
+.RS 4
 Set the specified flag in the flag field of the KEY/DNSKEY record. The only recognized flag is KSK (Key Signing Key) DNSKEY.
-.TP
+.RE
+.PP
 \-g \fIgenerator\fR
+.RS 4
 If generating a Diffie Hellman key, use this generator. Allowed values are 2 and 5. If no generator is specified, a known prime from RFC 2539 will be used if possible; otherwise the default is 2.
-.TP
+.RE
+.PP
 \-h
+.RS 4
 Prints a short summary of the options and arguments to
 \fBdnssec\-keygen\fR.
-.TP
+.RE
+.PP
 \-k
+.RS 4
 Generate KEY records rather than DNSKEY records.
-.TP
+.RE
+.PP
 \-p \fIprotocol\fR
+.RS 4
 Sets the protocol value for the generated key. The protocol is a number between 0 and 255. The default is 3 (DNSSEC). Other possible values for this argument are listed in RFC 2535 and its successors.
-.TP
+.RE
+.PP
 \-r \fIrandomdev\fR
+.RS 4
 Specifies the source of randomness. If the operating system does not provide a
 \fI/dev/random\fR
 or equivalent device, the default source of randomness is keyboard input.
@@ -84,17 +108,24 @@ or equivalent device, the default source of randomness is keyboard input.
 specifies the name of a character device or file containing random data to be used instead of the default. The special value
 \fIkeyboard\fR
 indicates that keyboard input should be used.
-.TP
+.RE
+.PP
 \-s \fIstrength\fR
+.RS 4
 Specifies the strength value of the key. The strength is a number between 0 and 15, and currently has no defined purpose in DNSSEC.
-.TP
+.RE
+.PP
 \-t \fItype\fR
+.RS 4
 Indicates the use of the key.
 \fBtype\fR
 must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data.
-.TP
+.RE
+.PP
 \-v \fIlevel\fR
+.RS 4
 Sets the debugging level.
+.RE
 .SH "GENERATED KEYS"
 .PP
 When
@@ -102,21 +133,21 @@ When
 completes successfully, it prints a string of the form
 \fIKnnnn.+aaa+iiiii\fR
 to the standard output. This is an identification string for the key it has generated.
-.TP 3
+.TP 4
 \(bu
 \fInnnn\fR
 is the key name.
-.TP
+.TP 4
 \(bu
 \fIaaa\fR
 is the numeric representation of the algorithm.
-.TP
+.TP 4
 \(bu
 \fIiiiii\fR
 is the key identifier (or footprint).
 .PP
 \fBdnssec\-keygen\fR
-creates two file, with names based on the printed string.
+creates two files, with names based on the printed string.
 \fIKnnnn.+aaa+iiiii.key\fR
 contains the public key, and
 \fIKnnnn.+aaa+iiiii.private\fR
@@ -128,13 +159,13 @@ file contains a DNS KEY record that can be inserted into a zone file (directly o
 .PP
 The
 \fI.private\fR
-file contains algorithm specific fields. For obvious security reasons, this file does not have general read permission.
+file contains algorithm\-specific fields. For obvious security reasons, this file does not have general read permission.
 .PP
 Both
 \fI.key\fR
 and
 \fI.private\fR
-files are generated for symmetric encryption algorithm such as HMAC\-MD5, even though the public and private key are equivalent.
+files are generated for symmetric encryption algorithms such as HMAC\-MD5, even though the public and private key are equivalent.
 .SH "EXAMPLE"
 .PP
 To generate a 768\-bit DSA key for the domain
@@ -151,7 +182,7 @@ In this example,
 creates the files
 \fIKexample.com.+003+26160.key\fR
 and
-\fIKexample.com.+003+26160.private\fR
+\fIKexample.com.+003+26160.private\fR.
 .SH "SEE ALSO"
 .PP
 \fBdnssec\-signzone\fR(8),
@@ -162,3 +193,8 @@ RFC 2539.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000\-2003 Internet Software Consortium.
+.br

bin/dnssec/dnssec-keygen.c

@@ -1,9 +1,9 @@
 /*
- * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
- * Portions Copyright (C) 2000-2003  Internet Software Consortium.
+ * Portions Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1999-2003  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -16,7 +16,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-keygen.c,v 1.66.18.7 2006/01/27 02:50:50 marka Exp $ */
+/* $Id: dnssec-keygen.c,v 1.66.18.10 2007/08/28 07:19:55 tbox Exp $ */
 
 /*! \file */
 

bin/dnssec/dnssec-keygen.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: dnssec-keygen.docbook,v 1.7.18.7 2005/08/30 01:42:12 marka Exp $ -->
+<!-- $Id: dnssec-keygen.docbook,v 1.7.18.11 2007/08/28 07:20:00 tbox Exp $ -->
 <refentry id="man.dnssec-keygen">
   <refentryinfo>
     <date>June 30, 2000</date>
@@ -39,6 +39,7 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -75,7 +76,7 @@
     <title>DESCRIPTION</title>
     <para><command>dnssec-keygen</command>
       generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
-      and RFC &lt;TBA\&gt;.  It can also generate keys for use with
+      and RFC 4034.  It can also generate keys for use with
       TSIG (Transaction Signatures), as defined in RFC 2845.
     </para>
   </refsect1>
@@ -285,7 +286,7 @@
       </listitem>
     </itemizedlist>
     <para><command>dnssec-keygen</command> 
-      creates two file, with names based
+      creates two files, with names based
       on the printed string.  <filename>Knnnn.+aaa+iiiii.key</filename>
       contains the public key, and
       <filename>Knnnn.+aaa+iiiii.private</filename> contains the
@@ -299,14 +300,14 @@
       statement).
     </para>
     <para>
-      The <filename>.private</filename> file contains algorithm
-      specific
+      The <filename>.private</filename> file contains
+      algorithm-specific
       fields.  For obvious security reasons, this file does not have
       general read permission.
     </para>
     <para>
       Both <filename>.key</filename> and <filename>.private</filename>
-      files are generated for symmetric encryption algorithm such as
+      files are generated for symmetric encryption algorithms such as
       HMAC-MD5, even though the public and private key are equivalent.
     </para>
   </refsect1>
@@ -329,7 +330,7 @@
       In this example, <command>dnssec-keygen</command> creates
       the files <filename>Kexample.com.+003+26160.key</filename>
       and
-      <filename>Kexample.com.+003+26160.private</filename>
+      <filename>Kexample.com.+003+26160.private</filename>.
     </para>
   </refsect1>
 

bin/dnssec/dnssec-keygen.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dnssec-keygen.html,v 1.9.18.14 2005/10/13 02:53:00 marka Exp $ -->
+<!-- $Id: dnssec-keygen.html,v 1.9.18.20 2007/05/09 03:33:12 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-keygen</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
 <a name="man.dnssec-keygen"></a><div class="titlepage"></div>
@@ -32,15 +32,15 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525966"></a><h2>DESCRIPTION</h2>
+<a name="id2543474"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-keygen</strong></span>
       generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
-      and RFC &lt;TBA\&gt;.  It can also generate keys for use with
+      and RFC 4034.  It can also generate keys for use with
       TSIG (Transaction Signatures), as defined in RFC 2845.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525978"></a><h2>OPTIONS</h2>
+<a name="id2543485"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
@@ -148,7 +148,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526450"></a><h2>GENERATED KEYS</h2>
+<a name="id2543820"></a><h2>GENERATED KEYS</h2>
 <p>
       When <span><strong class="command">dnssec-keygen</strong></span> completes
       successfully,
@@ -168,7 +168,7 @@
         </p></li>
 </ul></div>
 <p><span><strong class="command">dnssec-keygen</strong></span> 
-      creates two file, with names based
+      creates two files, with names based
       on the printed string.  <code class="filename">Knnnn.+aaa+iiiii.key</code>
       contains the public key, and
       <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
@@ -182,19 +182,19 @@
       statement).
     </p>
 <p>
-      The <code class="filename">.private</code> file contains algorithm
-      specific
+      The <code class="filename">.private</code> file contains
+      algorithm-specific
       fields.  For obvious security reasons, this file does not have
       general read permission.
     </p>
 <p>
       Both <code class="filename">.key</code> and <code class="filename">.private</code>
-      files are generated for symmetric encryption algorithm such as
+      files are generated for symmetric encryption algorithms such as
       HMAC-MD5, even though the public and private key are equivalent.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526532"></a><h2>EXAMPLE</h2>
+<a name="id2543902"></a><h2>EXAMPLE</h2>
 <p>
       To generate a 768-bit DSA key for the domain
       <strong class="userinput"><code>example.com</code></strong>, the following command would be
@@ -211,11 +211,11 @@
       In this example, <span><strong class="command">dnssec-keygen</strong></span> creates
       the files <code class="filename">Kexample.com.+003+26160.key</code>
       and
-      <code class="filename">Kexample.com.+003+26160.private</code>
+      <code class="filename">Kexample.com.+003+26160.private</code>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526576"></a><h2>SEE ALSO</h2>
+<a name="id2543946"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 2535</em>,
@@ -224,7 +224,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526606"></a><h2>AUTHOR</h2>
+<a name="id2544045"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/dnssec/dnssec-signzone.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dnssec-signzone.8,v 1.28.18.12 2005/10/13 02:53:00 marka Exp $
+.\" $Id: dnssec-signzone.8,v 1.28.18.17 2007/05/09 03:33:12 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: dnssec\-signzone
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: June 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "DNSSEC\-SIGNZONE" "8" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -30,7 +33,7 @@
 dnssec\-signzone \- DNSSEC zone signing tool
 .SH "SYNOPSIS"
 .HP 16
-\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-n\ \fR\fB\fInthreads\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-p\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-t\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {zonefile} [key...]
+\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-p\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-t\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {zonefile} [key...]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-signzone\fR
@@ -38,51 +41,72 @@ signs a zone. It generates NSEC and RRSIG records and produces a signed version
 \fIkeyset\fR
 file for each child zone.
 .SH "OPTIONS"
-.TP
+.PP
 \-a
+.RS 4
 Verify all generated signatures.
-.TP
+.RE
+.PP
 \-c \fIclass\fR
+.RS 4
 Specifies the DNS class of the zone.
-.TP
+.RE
+.PP
 \-k \fIkey\fR
+.RS 4
 Treat specified key as a key signing key ignoring any key flags. This option may be specified multiple times.
-.TP
+.RE
+.PP
 \-l \fIdomain\fR
+.RS 4
 Generate a DLV set in addition to the key (DNSKEY) and DS sets. The domain is appended to the name of the records.
-.TP
+.RE
+.PP
 \-d \fIdirectory\fR
+.RS 4
 Look for
 \fIkeyset\fR
 files in
 \fBdirectory\fR
 as the directory
-.TP
+.RE
+.PP
 \-g
+.RS 4
 Generate DS records for child zones from keyset files. Existing DS records will be removed.
-.TP
+.RE
+.PP
 \-s \fIstart\-time\fR
+.RS 4
 Specify the date and time when the generated RRSIG records become valid. This can be either an absolute or relative time. An absolute start time is indicated by a number in YYYYMMDDHHMMSS notation; 20000530144500 denotes 14:45:00 UTC on May 30th, 2000. A relative start time is indicated by +N, which is N seconds from the current time. If no
 \fBstart\-time\fR
 is specified, the current time minus 1 hour (to allow for clock skew) is used.
-.TP
+.RE
+.PP
 \-e \fIend\-time\fR
+.RS 4
 Specify the date and time when the generated RRSIG records expire. As with
 \fBstart\-time\fR, an absolute time is indicated in YYYYMMDDHHMMSS notation. A time relative to the start time is indicated with +N, which is N seconds from the start time. A time relative to the current time is indicated with now+N. If no
 \fBend\-time\fR
 is specified, 30 days from the start time is used as a default.
-.TP
+.RE
+.PP
 \-f \fIoutput\-file\fR
+.RS 4
 The name of the output file containing the signed zone. The default is to append
 \fI.signed\fR
-to the input file.
-.TP
+to the input filename.
+.RE
+.PP
 \-h
+.RS 4
 Prints a short summary of the options and arguments to
 \fBdnssec\-signzone\fR.
-.TP
+.RE
+.PP
 \-i \fIinterval\fR
-When a previously signed zone is passed as input, records may be resigned. The
+.RS 4
+When a previously\-signed zone is passed as input, records may be resigned. The
 \fBinterval\fR
 option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the cycle interval, it is retained. Otherwise, it is considered to be expiring soon, and it will be replaced.
 .sp
@@ -93,36 +117,77 @@ or
 are specified,
 \fBdnssec\-signzone\fR
 generates signatures that are valid for 30 days, with a cycle interval of 7.5 days. Therefore, if any existing RRSIG records are due to expire in less than 7.5 days, they would be replaced.
-.TP
+.RE
+.PP
 \-I \fIinput\-format\fR
+.RS 4
 The format of the input zone file. Possible formats are
 \fB"text"\fR
 (default) and
 \fB"raw"\fR. This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non\-text format containing updates can be signed directly. The use of this option does not make much sense for non\-dynamic zones.
-.TP
+.RE
+.PP
 \-j \fIjitter\fR
-When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. a previously signed zone is passed as input to the signer, all expired signatures has to be regenerated at about the same time. The
+.RS 4
+When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. a previously\-signed zone is passed as input to the signer, all expired signatures have to be regenerated at about the same time. The
 \fBjitter\fR
 option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature regeneration over time.
 .sp
 Signature lifetime jitter also to some extent benefits validators and servers by spreading out cache expiration, i.e. if large numbers of RRSIGs don't expire at the same time from all caches there will be less congestion than if all validators need to refetch at mostly the same time.
-.TP
+.RE
+.PP
 \-n \fIncpus\fR
+.RS 4
 Specifies the number of threads to use. By default, one thread is started for each detected CPU.
-.TP
+.RE
+.PP
+\-N \fIsoa\-serial\-format\fR
+.RS 4
+The SOA serial number format of the signed zone. Possible formats are
+\fB"keep"\fR
+(default),
+\fB"increment"\fR
+and
+\fB"unixtime"\fR.
+.RS 4
+.PP
+\fB"keep"\fR
+.RS 4
+Do not modify the SOA serial number.
+.RE
+.PP
+\fB"increment"\fR
+.RS 4
+Increment the SOA serial number using RFC 1982 arithmetics.
+.RE
+.PP
+\fB"unixtime"\fR
+.RS 4
+Set the SOA serial number to the number of seconds since epoch.
+.RE
+.RE
+.RE
+.PP
 \-o \fIorigin\fR
+.RS 4
 The zone origin. If not specified, the name of the zone file is assumed to be the origin.
-.TP
+.RE
+.PP
 \-O \fIoutput\-format\fR
+.RS 4
 The format of the output file containing the signed zone. Possible formats are
 \fB"text"\fR
 (default) and
 \fB"raw"\fR.
-.TP
+.RE
+.PP
 \-p
+.RS 4
 Use pseudo\-random data when signing the zone. This is faster, but less secure, than using real random data. This option may be useful when signing large zones or when the entropy source is limited.
-.TP
+.RE
+.PP
 \-r \fIrandomdev\fR
+.RS 4
 Specifies the source of randomness. If the operating system does not provide a
 \fI/dev/random\fR
 or equivalent device, the default source of randomness is keyboard input.
@@ -130,42 +195,68 @@ or equivalent device, the default source of randomness is keyboard input.
 specifies the name of a character device or file containing random data to be used instead of the default. The special value
 \fIkeyboard\fR
 indicates that keyboard input should be used.
-.TP
+.RE
+.PP
 \-t
+.RS 4
 Print statistics at completion.
-.TP
+.RE
+.PP
 \-v \fIlevel\fR
+.RS 4
 Sets the debugging level.
-.TP
+.RE
+.PP
 \-z
+.RS 4
 Ignore KSK flag on key when determining what to sign.
-.TP
+.RE
+.PP
 zonefile
+.RS 4
 The file containing the zone to be signed.
-.TP
+.RE
+.PP
 key
-The keys used to sign the zone. If no keys are specified, the default all zone keys that have private key files in the current directory.
+.RS 4
+Specify which keys should be used to sign the zone. If no keys are specified, then the zone will be examined for DNSKEY records at the zone apex. If these are found and there are matching private keys, in the current directory, then these will be used for signing.
+.RE
 .SH "EXAMPLE"
 .PP
 The following command signs the
 \fBexample.com\fR
-zone with the DSA key generated in the
+zone with the DSA key generated by
 \fBdnssec\-keygen\fR
-man page. The zone's keys must be in the zone. If there are
+(Kexample.com.+003+17247). The zone's keys must be in the master file (\fIdb.example.com\fR). This invocation looks for
 \fIkeyset\fR
-files associated with child zones, they must be in the current directory.
-\fBexample.com\fR, the following command would be issued:
+files, in the current directory, so that DS records can be generated from them (\fB\-g\fR).
+.sp
+.RS 4
+.nf
+% dnssec\-signzone \-g \-o example.com db.example.com \\
+Kexample.com.+003+17247
+db.example.com.signed
+%
+.fi
+.RE
 .PP
-\fBdnssec\-signzone \-o example.com db.example.com Kexample.com.+003+26160\fR
-.PP
-The command would print a string of the form:
-.PP
-In this example,
+In the above example,
 \fBdnssec\-signzone\fR
 creates the file
 \fIdb.example.com.signed\fR. This file should be referenced in a zone statement in a
 \fInamed.conf\fR
 file.
+.PP
+This example re\-signs a previously signed zone with default parameters. The private keys are assumed to be in the current directory.
+.sp
+.RS 4
+.nf
+% cp db.example.com.signed db.example.com
+% dnssec\-signzone \-o example.com db.example.com
+db.example.com.signed
+%
+.fi
+.RE
 .SH "SEE ALSO"
 .PP
 \fBdnssec\-keygen\fR(8),
@@ -174,3 +265,8 @@ RFC 2535.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000\-2003 Internet Software Consortium.
+.br

bin/dnssec/dnssec-signzone.c

@@ -1,9 +1,9 @@
 /*
- * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2003  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -16,7 +16,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.177.18.19 2006/02/21 23:53:34 marka Exp $ */
+/* $Id: dnssec-signzone.c,v 1.177.18.24 2007/08/28 07:20:00 tbox Exp $ */
 
 /*! \file */
 
@@ -61,6 +61,7 @@
 #include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
 #include <dns/result.h>
+#include <dns/soa.h>
 #include <dns/time.h>
 
 #include <dst/dst.h>
@@ -88,6 +89,10 @@ struct signer_key_struct {
 #define SIGNER_EVENT_WRITE	(SIGNER_EVENTCLASS + 0)
 #define SIGNER_EVENT_WORK	(SIGNER_EVENTCLASS + 1)
 
+#define SOA_SERIAL_KEEP		0
+#define SOA_SERIAL_INCREMENT	1
+#define SOA_SERIAL_UNIXTIME	2
+
 typedef struct signer_event sevent_t;
 struct signer_event {
 	ISC_EVENT_COMMON(sevent_t);
@@ -131,6 +136,7 @@ static isc_boolean_t ignoreksk = ISC_FALSE;
 static dns_name_t *dlv = NULL;
 static dns_fixedname_t dlv_fixed;
 static dns_master_style_t *dsstyle = NULL;
+static unsigned int serialformat = SOA_SERIAL_KEEP;
 
 #define INCSTAT(counter)		\
 	if (printstats) {		\
@@ -1042,6 +1048,81 @@ soattl(void) {
 	return (ttl);
 }
 
+/*%
+ * Increment (or set if nonzero) the SOA serial
+ */
+static isc_result_t
+setsoaserial(isc_uint32_t serial) {
+	isc_result_t result;
+	dns_dbnode_t *node = NULL;
+	dns_rdataset_t rdataset;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	isc_uint32_t old_serial, new_serial;
+
+	result = dns_db_getoriginnode(gdb, &node);
+	if (result != ISC_R_SUCCESS)
+		return result;
+
+	dns_rdataset_init(&rdataset);
+
+	result = dns_db_findrdataset(gdb, node, gversion,
+				     dns_rdatatype_soa, 0,
+				     0, &rdataset, NULL);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
+	result = dns_rdataset_first(&rdataset);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+
+	dns_rdataset_current(&rdataset, &rdata);
+
+	old_serial = dns_soa_getserial(&rdata);
+
+	if (serial) {
+		/* Set SOA serial to the value provided. */
+		new_serial = serial;
+	} else {
+		/* Increment SOA serial using RFC 1982 arithmetics */
+		new_serial = (old_serial + 1) & 0xFFFFFFFF;
+		if (new_serial == 0)
+			new_serial = 1;
+	}
+
+	/* If the new serial is not likely to cause a zone transfer
+	 * (a/ixfr) from servers having the old serial, warn the user.
+	 *
+	 * RFC1982 section 7 defines the maximum increment to be
+	 * (2^(32-1))-1.  Using u_int32_t arithmetic, we can do a single
+	 * comparison.  (5 - 6 == (2^32)-1, not negative-one)
+	 */
+	if (new_serial == old_serial ||
+	    (new_serial - old_serial) > 0x7fffffffU)
+		fprintf(stderr, "%s: warning: Serial number not advanced, "
+			"zone may not transfer\n", program);
+
+	dns_soa_setserial(new_serial, &rdata);
+
+	result = dns_db_deleterdataset(gdb, node, gversion,
+				       dns_rdatatype_soa, 0);
+	check_result(result, "dns_db_deleterdataset");
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
+	result = dns_db_addrdataset(gdb, node, gversion,
+				    0, &rdataset, 0, NULL);
+	check_result(result, "dns_db_addrdataset");
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
+cleanup:
+	dns_rdataset_disassociate(&rdataset);
+	if (node != NULL)
+		dns_db_detachnode(gdb, &node);
+	dns_rdata_reset(&rdata);
+
+	return (result);
+}
+
 /*%
  * Delete any RRSIG records at a node.
  */
@@ -1051,6 +1132,9 @@ cleannode(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node) {
 	dns_rdataset_t set;
 	isc_result_t result, dresult;
 
+	if (outputformat != dns_masterformat_text)
+		return;
+
 	dns_rdataset_init(&set);
 	result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets");
@@ -1397,7 +1481,7 @@ loadzonekeys(dns_db_t *db) {
 	for (i = 0; i < nkeys; i++) {
 		signer_key_t *key;
 
-		key = newkeystruct(keys[i], ISC_TRUE);
+		key = newkeystruct(keys[i], dst_key_isprivate(keys[i]));
 		ISC_LIST_APPEND(keylist, key, link);
 	}
 	dns_db_detachnode(db, &node);
@@ -1690,6 +1774,8 @@ usage(void) {
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-O format:\n");
 	fprintf(stderr, "\t\tfile format of signed zone file (text)\n");
+	fprintf(stderr, "\t-N format:\n");
+	fprintf(stderr, "\t\tsoa serial format of signed zone file (keep)\n");
 	fprintf(stderr, "\t-r randomdev:\n");
 	fprintf(stderr,	"\t\ta file containing random data\n");
 	fprintf(stderr, "\t-a:\t");
@@ -1749,6 +1835,7 @@ main(int argc, char *argv[]) {
 	char *startstr = NULL, *endstr = NULL, *classname = NULL;
 	char *origin = NULL, *file = NULL, *output = NULL;
 	char *inputformatstr = NULL, *outputformatstr = NULL;
+	char *serialformatstr = NULL;
 	char *dskeyfile[MAXDSKEYS];
 	int ndskeys = 0;
 	char *endp;
@@ -1776,7 +1863,7 @@ main(int argc, char *argv[]) {
 	dns_result_register();
 
 	while ((ch = isc_commandline_parse(argc, argv,
-					   "ac:d:e:f:ghi:I:j:k:l:n:o:O:pr:s:Stv:z"))
+					   "ac:d:e:f:ghi:I:j:k:l:n:N:o:O:pr:s:Stv:z"))
 	       != -1) {
 		switch (ch) {
 		case 'a':
@@ -1853,6 +1940,10 @@ main(int argc, char *argv[]) {
 				fatal("number of cpus must be numeric");
 			break;
 
+		case 'N':
+			serialformatstr = isc_commandline_argument;
+			break;
+
 		case 'o':
 			origin = isc_commandline_argument;
 			break;
@@ -1974,6 +2065,18 @@ main(int argc, char *argv[]) {
 			fatal("unknown file format: %s\n", outputformatstr);
 	}
 
+	if (serialformatstr != NULL) {
+		if (strcasecmp(serialformatstr, "keep") == 0)
+			serialformat = SOA_SERIAL_KEEP;
+		else if (strcasecmp(serialformatstr, "increment") == 0 ||
+			 strcasecmp(serialformatstr, "incr") == 0)
+			serialformat = SOA_SERIAL_INCREMENT;
+		else if (strcasecmp(serialformatstr, "unixtime") == 0)
+			serialformat = SOA_SERIAL_UNIXTIME;
+		else
+			fatal("unknown soa serial format: %s\n", serialformatstr);
+	}
+
 	result = dns_master_stylecreate(&dsstyle,  DNS_STYLEFLAG_NO_TTL,
 					0, 24, 0, 0, 0, 8, mctx);
 	check_result(result, "dns_master_stylecreate");
@@ -2078,6 +2181,19 @@ main(int argc, char *argv[]) {
 	result = dns_db_newversion(gdb, &gversion);
 	check_result(result, "dns_db_newversion()");
 
+	switch (serialformat) {
+		case SOA_SERIAL_INCREMENT:
+			setsoaserial(0);
+			break;
+		case SOA_SERIAL_UNIXTIME:
+			setsoaserial(now);
+			break;
+		case SOA_SERIAL_KEEP:
+		default:
+			/* do nothing */
+			break;
+	}
+
 	nsecify();
 
 	if (!nokeys) {

bin/dnssec/dnssec-signzone.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: dnssec-signzone.docbook,v 1.10.18.10 2005/07/19 05:55:43 marka Exp $ -->
+<!-- $Id: dnssec-signzone.docbook,v 1.10.18.17 2007/08/28 07:20:00 tbox Exp $ -->
 <refentry id="man.dnssec-signzone">
   <refentryinfo>
     <date>June 30, 2000</date>
@@ -26,7 +26,7 @@
 
   <refmeta>
     <refentrytitle><application>dnssec-signzone</application></refentrytitle>
-    <manvolnum>8</manvolnum>
+   <manvolnum>8</manvolnum>
     <refmiscinfo>BIND9</refmiscinfo>
   </refmeta>
 
@@ -39,6 +39,8 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2006</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -65,7 +67,7 @@
       <arg><option>-i <replaceable class="parameter">interval</replaceable></option></arg>
       <arg><option>-I <replaceable class="parameter">input-format</replaceable></option></arg>
       <arg><option>-j <replaceable class="parameter">jitter</replaceable></option></arg>
-      <arg><option>-n <replaceable class="parameter">nthreads</replaceable></option></arg>
+      <arg><option>-N <replaceable class="parameter">soa-serial-format</replaceable></option></arg>
       <arg><option>-o <replaceable class="parameter">origin</replaceable></option></arg>
       <arg><option>-O <replaceable class="parameter">output-format</replaceable></option></arg>
       <arg><option>-p</option></arg>
@@ -191,7 +193,7 @@
             The name of the output file containing the signed zone.  The
             default is to append <filename>.signed</filename> to
             the
-            input file.
+            input filename.
           </para>
         </listitem>
       </varlistentry>
@@ -210,7 +212,7 @@
         <term>-i <replaceable class="parameter">interval</replaceable></term>
         <listitem>
           <para>
-            When a previously signed zone is passed as input, records
+            When a previously-signed zone is passed as input, records
             may be resigned.  The <option>interval</option> option
             specifies the cycle interval as an offset from the current
             time (in seconds).  If a RRSIG record expires after the
@@ -254,8 +256,8 @@
             When signing a zone with a fixed signature lifetime, all
             RRSIG records issued at the time of signing expires
             simultaneously.  If the zone is incrementally signed, i.e.
-            a previously signed zone is passed as input to the signer,
-            all expired signatures has to be regenerated at about the
+            a previously-signed zone is passed as input to the signer,
+            all expired signatures have to be regenerated at about the
             same time.  The <option>jitter</option> option specifies a
             jitter window that will be used to randomize the signature
             expire time, thus spreading incremental signature
@@ -281,6 +283,44 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>-N <replaceable class="parameter">soa-serial-format</replaceable></term>
+        <listitem>
+          <para>
+            The SOA serial number format of the signed zone.
+	    Possible formats are <command>"keep"</command> (default),
+            <command>"increment"</command> and
+	    <command>"unixtime"</command>.
+          </para>
+
+          <variablelist>
+	    <varlistentry>
+	      <term><command>"keep"</command></term>
+              <listitem>
+                <para>Do not modify the SOA serial number.</para>
+	      </listitem>
+            </varlistentry>
+
+	    <varlistentry>
+	      <term><command>"increment"</command></term>
+              <listitem>
+                <para>Increment the SOA serial number using RFC 1982
+                      arithmetics.</para>
+	      </listitem>
+            </varlistentry>
+
+	    <varlistentry>
+	      <term><command>"unixtime"</command></term>
+              <listitem>
+                <para>Set the SOA serial number to the number of seconds
+	        since epoch.</para>
+	      </listitem>
+            </varlistentry>
+	 </variablelist>
+
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-o <replaceable class="parameter">origin</replaceable></term>
         <listitem>
@@ -371,9 +411,11 @@
         <term>key</term>
         <listitem>
           <para>
-            The keys used to sign the zone.  If no keys are specified, the
-            default all zone keys that have private key files in the
-            current directory.
+	    Specify which keys should be used to sign the zone.  If
+	    no keys are specified, then the zone will be examined
+	    for DNSKEY records at the zone apex.  If these are found and
+	    there are matching private keys, in the current directory,
+	    then these will be used for signing.
           </para>
         </listitem>
       </varlistentry>
@@ -385,27 +427,30 @@
     <title>EXAMPLE</title>
     <para>
       The following command signs the <userinput>example.com</userinput>
-      zone with the DSA key generated in the <command>dnssec-keygen</command>
-      man page.  The zone's keys must be in the zone.  If there are
-      <filename>keyset</filename> files associated with child
-      zones,
-      they must be in the current directory.
-      <userinput>example.com</userinput>, the following command would be
-      issued:
-    </para>
-    <para><userinput>dnssec-signzone -o example.com db.example.com
-        Kexample.com.+003+26160</userinput>
+      zone with the DSA key generated by <command>dnssec-keygen</command>
+      (Kexample.com.+003+17247).  The zone's keys must be in the master
+      file (<filename>db.example.com</filename>).  This invocation looks
+      for <filename>keyset</filename> files, in the current directory,
+      so that DS records can be generated from them (<command>-g</command>).
     </para>
+<programlisting>% dnssec-signzone -g -o example.com db.example.com \
+Kexample.com.+003+17247
+db.example.com.signed
+%</programlisting>
     <para>
-      The command would print a string of the form:
-    </para>
-    <para>
-      In this example, <command>dnssec-signzone</command> creates
+      In the above example, <command>dnssec-signzone</command> creates
       the file <filename>db.example.com.signed</filename>.  This
-      file
-      should be referenced in a zone statement in a
+      file should be referenced in a zone statement in a
       <filename>named.conf</filename> file.
     </para>
+    <para>
+      This example re-signs a previously signed zone with default parameters.
+      The private keys are assumed to be in the current directory.
+    </para>
+<programlisting>% cp db.example.com.signed db.example.com
+% dnssec-signzone -o example.com db.example.com
+db.example.com.signed
+%</programlisting>
   </refsect1>
 
   <refsect1>

bin/dnssec/dnssec-signzone.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dnssec-signzone.html,v 1.8.18.17 2005/10/13 02:53:00 marka Exp $ -->
+<!-- $Id: dnssec-signzone.html,v 1.8.18.23 2007/05/09 03:33:12 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-signzone</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
 <a name="man.dnssec-signzone"></a><div class="titlepage"></div>
@@ -29,10 +29,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nthreads</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {zonefile} [key...]</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {zonefile} [key...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526016"></a><h2>DESCRIPTION</h2>
+<a name="id2543526"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-signzone</strong></span>
       signs a zone.  It generates
       NSEC and RRSIG records and produces a signed version of the
@@ -43,7 +43,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526030"></a><h2>OPTIONS</h2>
+<a name="id2543541"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd><p>
@@ -99,7 +99,7 @@
             The name of the output file containing the signed zone.  The
             default is to append <code class="filename">.signed</code> to
             the
-            input file.
+            input filename.
           </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
@@ -109,7 +109,7 @@
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
 <p>
-            When a previously signed zone is passed as input, records
+            When a previously-signed zone is passed as input, records
             may be resigned.  The <code class="option">interval</code> option
             specifies the cycle interval as an offset from the current
             time (in seconds).  If a RRSIG record expires after the
@@ -145,8 +145,8 @@
             When signing a zone with a fixed signature lifetime, all
             RRSIG records issued at the time of signing expires
             simultaneously.  If the zone is incrementally signed, i.e.
-            a previously signed zone is passed as input to the signer,
-            all expired signatures has to be regenerated at about the
+            a previously-signed zone is passed as input to the signer,
+            all expired signatures have to be regenerated at about the
             same time.  The <code class="option">jitter</code> option specifies a
             jitter window that will be used to randomize the signature
             expire time, thus spreading incremental signature
@@ -165,6 +165,25 @@
             Specifies the number of threads to use.  By default, one
             thread is started for each detected CPU.
           </p></dd>
+<dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt>
+<dd>
+<p>
+            The SOA serial number format of the signed zone.
+	    Possible formats are <span><strong class="command">"keep"</strong></span> (default),
+            <span><strong class="command">"increment"</strong></span> and
+	    <span><strong class="command">"unixtime"</strong></span>.
+          </p>
+<div class="variablelist"><dl>
+<dt><span class="term"><span><strong class="command">"keep"</strong></span></span></dt>
+<dd><p>Do not modify the SOA serial number.</p></dd>
+<dt><span class="term"><span><strong class="command">"increment"</strong></span></span></dt>
+<dd><p>Increment the SOA serial number using RFC 1982
+                      arithmetics.</p></dd>
+<dt><span class="term"><span><strong class="command">"unixtime"</strong></span></span></dt>
+<dd><p>Set the SOA serial number to the number of seconds
+	        since epoch.</p></dd>
+</dl></div>
+</dd>
 <dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
 <dd><p>
             The zone origin.  If not specified, the name of the zone file
@@ -213,47 +232,52 @@
           </p></dd>
 <dt><span class="term">key</span></dt>
 <dd><p>
-            The keys used to sign the zone.  If no keys are specified, the
-            default all zone keys that have private key files in the
-            current directory.
+	    Specify which keys should be used to sign the zone.  If
+	    no keys are specified, then the zone will be examined
+	    for DNSKEY records at the zone apex.  If these are found and
+	    there are matching private keys, in the current directory,
+	    then these will be used for signing.
           </p></dd>
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526608"></a><h2>EXAMPLE</h2>
+<a name="id2544327"></a><h2>EXAMPLE</h2>
 <p>
       The following command signs the <strong class="userinput"><code>example.com</code></strong>
-      zone with the DSA key generated in the <span><strong class="command">dnssec-keygen</strong></span>
-      man page.  The zone's keys must be in the zone.  If there are
-      <code class="filename">keyset</code> files associated with child
-      zones,
-      they must be in the current directory.
-      <strong class="userinput"><code>example.com</code></strong>, the following command would be
-      issued:
-    </p>
-<p><strong class="userinput"><code>dnssec-signzone -o example.com db.example.com
-        Kexample.com.+003+26160</code></strong>
+      zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>
+      (Kexample.com.+003+17247).  The zone's keys must be in the master
+      file (<code class="filename">db.example.com</code>).  This invocation looks
+      for <code class="filename">keyset</code> files, in the current directory,
+      so that DS records can be generated from them (<span><strong class="command">-g</strong></span>).
     </p>
+<pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \
+Kexample.com.+003+17247
+db.example.com.signed
+%</pre>
 <p>
-      The command would print a string of the form:
-    </p>
-<p>
-      In this example, <span><strong class="command">dnssec-signzone</strong></span> creates
+      In the above example, <span><strong class="command">dnssec-signzone</strong></span> creates
       the file <code class="filename">db.example.com.signed</code>.  This
-      file
-      should be referenced in a zone statement in a
+      file should be referenced in a zone statement in a
       <code class="filename">named.conf</code> file.
     </p>
+<p>
+      This example re-signs a previously signed zone with default parameters.
+      The private keys are assumed to be in the current directory.
+    </p>
+<pre class="programlisting">% cp db.example.com.signed db.example.com
+% dnssec-signzone -o example.com db.example.com
+db.example.com.signed
+%</pre>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526656"></a><h2>SEE ALSO</h2>
+<a name="id2544378"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 2535</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526680"></a><h2>AUTHOR</h2>
+<a name="id2544403"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/dnssec/win32/dnssectool.dsp

@@ -0,0 +1,113 @@
+# Microsoft Developer Studio Project File - Name="dnssectool" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "Win32 (x86) Static-Link Library" 0x0104
+
+CFG=dnssectool - Win32 Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "dnssectool.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "dnssectool.mak" CFG="dnssectool - Win32 Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "dnssectool - Win32 Release" (based on "Win32 (x86) Static-Link Library")
+!MESSAGE "dnssectool - Win32 Debug" (based on "Win32 (x86) Static-Link Library")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+MTL=midl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "dnssectool - Win32 Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MT /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /YX /FD /c
+# ADD CPP /nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /D "NDEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /YX /FD /c /Fddnssectool
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /out:"Release/dnssectool.lib"
+
+!ELSEIF  "$(CFG)" == "dnssectool - Win32 Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MTd /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /YX /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /D "_DEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /FR /YX /FD /GZ /c /Fddnssectool
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /debug out:"Debug/dnssectool.lib"
+
+!ENDIF 
+
+# Begin Target
+
+# Name "dnssectool - Win32 Release"
+# Name "dnssectool - Win32 Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# Begin Group "Main Dns Lib"
+
+# PROP Default_Filter "c"
+# Begin Source File
+
+SOURCE=..\dnssectool.c
+# End Source File
+# End Group
+# End Target
+# End Project

bin/dnssec/win32/dnssectool.dsw

@@ -0,0 +1,29 @@
+Microsoft Developer Studio Workspace File, Format Version 6.00
+# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!
+
+###############################################################################
+
+Project: "dighost"=".\dnssectool.dsp" - Package Owner=<4>
+
+Package=<5>
+{{{
+}}}
+
+Package=<4>
+{{{
+}}}
+
+###############################################################################
+
+Global:
+
+Package=<5>
+{{{
+}}}
+
+Package=<3>
+{{{
+}}}
+
+###############################################################################
+

bin/dnssec/win32/keygen.dsp

@@ -50,7 +50,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
-# ADD LINK32 user32.lib advapi32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/dnssec-keygen.exe"
+# ADD LINK32 user32.lib advapi32.lib Release/dnssectool.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/dnssec-keygen.exe"
 
 !ELSEIF  "$(CFG)" == "keygen - Win32 Debug"
 
@@ -75,7 +75,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 user32.lib advapi32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/dnssec-keygen.exe" /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib Debug/dnssectool.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/dnssec-keygen.exe" /pdbtype:sept
 
 !ENDIF 
 
@@ -90,10 +90,6 @@ LINK32=link.exe
 
 SOURCE="..\dnssec-keygen.c"
 # End Source File
-# Begin Source File
-
-SOURCE=..\dnssectool.c
-# End Source File
 # End Group
 # Begin Group "Header Files"
 

bin/dnssec/win32/keygen.mak

@@ -25,6 +25,81 @@ NULL=
 NULL=nul
 !ENDIF 
 
+!IF  "$(CFG)" == "keygen - Win32 Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
 !IF  "$(CFG)" == "keygen - Win32 Release"
 
 OUTDIR=.\Release
@@ -38,6 +113,7 @@ CLEAN :
 	-@erase "$(INTDIR)\dnssectool.obj"
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "..\..\..\Build\Release\dnssec-keygen.exe"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -90,6 +166,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ELSEIF  "$(CFG)" == "keygen - Win32 Debug"
 
@@ -113,6 +190,7 @@ CLEAN :
 	-@erase "$(OUTDIR)\keygen.bsc"
 	-@erase "..\..\..\Build\Debug\dnssec-keygen.exe"
 	-@erase "..\..\..\Build\Debug\dnssec-keygen.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -172,6 +250,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ENDIF 
 
@@ -225,3 +304,21 @@ SOURCE=..\dnssectool.c
 
 !ENDIF 
 
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/dnssec/win32/signzone.dsp

@@ -50,7 +50,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
-# ADD LINK32 user32.lib advapi32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/dnssec-signzone.exe"
+# ADD LINK32 user32.lib advapi32.lib Release/dnssectool.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/dnssec-signzone.exe"
 
 !ELSEIF  "$(CFG)" == "signzone - Win32 Debug"
 
@@ -75,7 +75,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 user32.lib advapi32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/dnssec-signzone.exe" /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib Debug/dnssectool.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/dnssec-signzone.exe" /pdbtype:sept
 
 !ENDIF 
 
@@ -90,10 +90,6 @@ LINK32=link.exe
 
 SOURCE="..\dnssec-signzone.c"
 # End Source File
-# Begin Source File
-
-SOURCE=..\dnssectool.c
-# End Source File
 # End Group
 # Begin Group "Header Files"
 

bin/dnssec/win32/signzone.mak

@@ -25,6 +25,81 @@ NULL=
 NULL=nul
 !ENDIF 
 
+!IF  "$(CFG)" == "signzone - Win32 Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
 !IF  "$(CFG)" == "signzone - Win32 Release"
 
 OUTDIR=.\Release
@@ -38,6 +113,7 @@ CLEAN :
 	-@erase "$(INTDIR)\dnssectool.obj"
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "..\..\..\Build\Release\dnssec-signzone.exe"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -90,6 +166,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ELSEIF  "$(CFG)" == "signzone - Win32 Debug"
 
@@ -113,6 +190,7 @@ CLEAN :
 	-@erase "$(OUTDIR)\signzone.bsc"
 	-@erase "..\..\..\Build\Debug\dnssec-signzone.exe"
 	-@erase "..\..\..\Build\Debug\dnssec-signzone.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -172,6 +250,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ENDIF 
 
@@ -225,3 +304,21 @@ SOURCE=..\dnssectool.c
 
 !ENDIF 
 
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/named/client.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.219.18.16 2006/01/05 00:10:42 marka Exp $ */
+/* $Id: client.c,v 1.219.18.28.10.1 2008/05/22 21:28:04 each Exp $ */
 
 #include <config.h>
 
@@ -321,8 +321,17 @@ exit_check(ns_client_t *client) {
 		}
 		/*
 		 * I/O cancel is complete.  Burn down all state
-		 * related to the current request.
+		 * related to the current request.  Ensure that
+		 * the client is on the active list and not the
+		 * recursing list.
 		 */
+		LOCK(&client->manager->lock);
+		if (client->list == &client->manager->recursing) {
+			ISC_LIST_UNLINK(*client->list, client, link);
+			ISC_LIST_APPEND(client->manager->active, client, link);
+			client->list = &client->manager->active;
+		}
+		UNLOCK(&client->manager->lock);
 		ns_client_endrequest(client);
 
 		client->state = NS_CLIENTSTATE_READING;
@@ -1171,7 +1180,7 @@ client_addopt(ns_client_t *client) {
 	rdatalist->ttl = (client->extflags & DNS_MESSAGEEXTFLAG_REPLYPRESERVE);
 
 	/*
-	 * No ENDS options in the default case.
+	 * No EDNS options in the default case.
 	 */
 	rdata->data = NULL;
 	rdata->length = 0;
@@ -1217,7 +1226,8 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 		 dns_rdataclass_t rdclass, void *arg)
 {
 	dns_view_t *view;
-	dns_tsigkey_t *key;
+	dns_tsigkey_t *key = NULL;
+	dns_name_t *tsig = NULL;
 	isc_netaddr_t netsrc;
 	isc_netaddr_t netdst;
 
@@ -1232,7 +1242,6 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 	for (view = ISC_LIST_HEAD(ns_g_server->viewlist);
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link)) {
-		dns_name_t *tsig = NULL;
 
 		if (view->matchrecursiveonly)
 			continue;
@@ -1400,6 +1409,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(2),
 			      "dropping multicast request");
 		ns_client_next(client, DNS_R_REFUSED);
+		goto cleanup;
 	}
 
 	result = dns_message_peekheader(buffer, &id, &flags);
@@ -1566,6 +1576,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 					 "failed to get request's "
 					 "destination: %s",
 					 isc_result_totext(result));
+			ns_client_next(client, ISC_R_SUCCESS);
 			goto cleanup;
 		}
 	}
@@ -1654,21 +1665,29 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		char tsigrcode[64];
 		isc_buffer_t b;
 		dns_name_t *name = NULL;
+		dns_rcode_t status;
+		isc_result_t tresult;
 
-		isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
-		RUNTIME_CHECK(dns_tsigrcode_totext(client->message->tsigstatus,
-						   &b) == ISC_R_SUCCESS);
-		tsigrcode[isc_buffer_usedlength(&b)] = '\0';
 		/* There is a signature, but it is bad. */
 		if (dns_message_gettsig(client->message, &name) != NULL) {
 			char namebuf[DNS_NAME_FORMATSIZE];
 			dns_name_format(name, namebuf, sizeof(namebuf));
+			status = client->message->tsigstatus;
+			isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
+			tresult = dns_tsigrcode_totext(status, &b);
+			INSIST(tresult == ISC_R_SUCCESS);
+			tsigrcode[isc_buffer_usedlength(&b)] = '\0';
 			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 				      NS_LOGMODULE_CLIENT, ISC_LOG_ERROR,
 				      "request has invalid signature: "
 				      "TSIG %s: %s (%s)", namebuf,
 				      isc_result_totext(result), tsigrcode);
 		} else {
+			status = client->message->sig0status;
+			isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
+			tresult = dns_tsigrcode_totext(status, &b);
+			INSIST(tresult == ISC_R_SUCCESS);
+			tsigrcode[isc_buffer_usedlength(&b)] = '\0';
 			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 				      NS_LOGMODULE_CLIENT, ISC_LOG_ERROR,
 				      "request has invalid signature: %s (%s)",
@@ -1690,12 +1709,15 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	 * Decide whether recursive service is available to this client.
 	 * We do this here rather than in the query code so that we can
 	 * set the RA bit correctly on all kinds of responses, not just
-	 * responses to ordinary queries.
+	 * responses to ordinary queries.  Note if you can't query the
+	 * cache there is no point in setting RA.
 	 */
 	ra = ISC_FALSE;
 	if (client->view->resolver != NULL &&
 	    client->view->recursion == ISC_TRUE &&
 	    ns_client_checkaclsilent(client, client->view->recursionacl,
+				     ISC_TRUE) == ISC_R_SUCCESS &&
+	    ns_client_checkaclsilent(client, client->view->queryacl,
 				     ISC_TRUE) == ISC_R_SUCCESS)
 		ra = ISC_TRUE;
 
@@ -1782,14 +1804,14 @@ client_timeout(isc_task_t *task, isc_event_t *event) {
 static isc_result_t
 get_clientmctx(ns_clientmgr_t *manager, isc_mem_t **mctxp) {
 	isc_mem_t *clientmctx;
-#if NMCTX > 0
+#if NMCTXS > 0
 	isc_result_t result;
 #endif
 
 	/*
 	 * Caller must be holding the manager lock.
 	 */
-#if NMCTX > 0
+#if NMCTXS > 0
 	INSIST(manager->nextmctx < NMCTXS);
 	clientmctx = manager->mctxpool[manager->nextmctx];
 	if (clientmctx == NULL) {
@@ -2594,3 +2616,20 @@ ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager) {
 	}
 	UNLOCK(&manager->lock);
 }
+
+void
+ns_client_qnamereplace(ns_client_t *client, dns_name_t *name) {
+
+	if (client->manager != NULL)
+		LOCK(&client->manager->lock);
+	if (client->query.restarts > 0) {
+		/*
+		 * client->query.qname was dynamically allocated.
+		 */
+		dns_message_puttempname(client->message,
+					&client->query.qname);
+	}
+	client->query.qname = name;
+	if (client->manager != NULL)
+		UNLOCK(&client->manager->lock);
+}

bin/named/config.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,14 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: config.c,v 1.47.18.27 2006/03/09 23:38:20 marka Exp $ */
+/* $Id: config.c,v 1.47.18.32 2007/09/13 05:04:01 each Exp $ */
 
 /*! \file */
 
 #include <config.h>
 
 #include <stdlib.h>
-#include <string.h>
 
 #include <isc/buffer.h>
 #include <isc/log.h>
@@ -31,6 +30,7 @@
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/sockaddr.h>
+#include <isc/string.h>
 #include <isc/util.h>
 
 #include <isccfg/namedconf.h>
@@ -132,7 +132,7 @@ options {\n\
 	check-names slave warn;\n\
 	check-names response ignore;\n\
 	check-mx warn;\n\
-	use-additional-cache true;\n\
+	acache-enable no;\n\
 	acache-cleaning-interval 60;\n\
 	max-acache-size 0;\n\
 	dnssec-enable yes;\n\
@@ -182,7 +182,7 @@ options {\n\
 "
 
 "#\n\
-#  Zones in the \"_bind\" view are NOT counted is the count of zones.\n\
+#  Zones in the \"_bind\" view are NOT counted in the count of zones.\n\
 #\n\
 view \"_bind\" chaos {\n\
 	recursion no;\n\

bin/named/control.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,17 +15,17 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: control.c,v 1.20.10.8 2006/03/10 00:23:20 marka Exp $ */
+/* $Id: control.c,v 1.20.10.10 2007/09/13 23:46:26 tbox Exp $ */
 
 /*! \file */
 
 #include <config.h>
 
-#include <string.h>
 
 #include <isc/app.h>
 #include <isc/event.h>
 #include <isc/mem.h>
+#include <isc/string.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 

bin/named/controlconf.c

@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: controlconf.c,v 1.40.18.9 2006/02/28 03:10:47 marka Exp $ */
+/* $Id: controlconf.c,v 1.40.18.10 2006/12/07 04:53:02 marka Exp $ */
 
 /*! \file */
 
@@ -690,7 +690,7 @@ controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
 	char *newstr = NULL;
 	const char *str;
 	const cfg_obj_t *obj;
-	controlkey_t *key = NULL;
+	controlkey_t *key;
 
 	for (element = cfg_list_first(keylist);
 	     element != NULL;
@@ -709,7 +709,6 @@ controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
 		key->secret.length = 0;
 		ISC_LINK_INIT(key, link);
 		ISC_LIST_APPEND(*keyids, key, link);
-		key = NULL;
 		newstr = NULL;
 	}
 	return (ISC_R_SUCCESS);
@@ -717,8 +716,6 @@ controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
  cleanup:
 	if (newstr != NULL)
 		isc_mem_free(mctx, newstr);
-	if (key != NULL)
-		isc_mem_put(mctx, key, sizeof(*key));
 	free_controlkeylist(keyids, mctx);
 	return (ISC_R_NOMEMORY);
 }

bin/named/include/named/client.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.h,v 1.69.18.7 2005/08/15 01:46:49 marka Exp $ */
+/* $Id: client.h,v 1.69.18.9 2006/06/06 00:11:41 marka Exp $ */
 
 #ifndef NAMED_CLIENT_H
 #define NAMED_CLIENT_H 1
@@ -344,6 +344,12 @@ ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager);
  * Dump the outstanding recursive queries to 'f'.
  */
 
+void
+ns_client_qnamereplace(ns_client_t *client, dns_name_t *name);
+/*%
+ * Replace the qname.
+ */
+
 isc_boolean_t
 ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,
                  isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr,

bin/named/interfacemgr.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: interfacemgr.c,v 1.76.18.6 2005/11/30 03:44:38 marka Exp $ */
+/* $Id: interfacemgr.c,v 1.76.18.8 2006/07/20 01:10:30 marka Exp $ */
 
 /*! \file */
 
@@ -191,6 +191,7 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
 	ifp->mgr = NULL;
 	ifp->generation = mgr->generation;
 	ifp->addr = *addr;
+	ifp->flags = 0;
 	strncpy(ifp->name, name, sizeof(ifp->name));
 	ifp->name[sizeof(ifp->name)-1] = '\0';
 	ifp->clientmgr = NULL;

bin/named/log.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: log.c,v 1.37.18.4 2005/05/20 01:21:44 marka Exp $ */
+/* $Id: log.c,v 1.37.18.6 2006/06/09 00:54:08 marka Exp $ */
 
 /*! \file */
 
@@ -81,6 +81,9 @@ ns_log_init(isc_boolean_t safe) {
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
+	/*
+	 * named-checktool.c:setup_logging() needs to be kept in sync.
+	 */
 	isc_log_registercategories(ns_g_lctx, ns_g_categories);
 	isc_log_registermodules(ns_g_lctx, ns_g_modules);
 	isc_log_setcontext(ns_g_lctx);

bin/named/lwdgrbn.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwdgrbn.c,v 1.13.18.3 2005/11/30 03:44:38 marka Exp $ */
+/* $Id: lwdgrbn.c,v 1.13.18.5 2006/12/07 23:57:58 marka Exp $ */
 
 /*! \file */
 
@@ -185,8 +185,6 @@ iterate_node(lwres_grbnresponse_t *grbn, dns_db_t *db, dns_dbnode_t *node,
 		isc_mem_put(mctx, oldlens, oldsize * sizeof(*oldlens));
 	if (newrdatas != NULL)
 		isc_mem_put(mctx, newrdatas, used * sizeof(*oldrdatas));
-	if (newlens != NULL)
-		isc_mem_put(mctx, newlens, used * sizeof(*oldlens));
 	return (result);
 }
 

bin/named/lwresd.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwresd.8,v 1.15.18.7 2005/10/13 02:53:01 marka Exp $
+.\" $Id: lwresd.8,v 1.15.18.12 2007/05/16 06:11:27 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: lwresd
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: June 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "LWRESD" "8" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -30,7 +33,7 @@
 lwresd \- lightweight resolver daemon
 .SH "SYNOPSIS"
 .HP 7
-\fBlwresd\fR [\fB\-C\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-i\ \fR\fB\fIpid\-file\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-P\ \fR\fB\fIport\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR]
+\fBlwresd\fR [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-C\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-i\ \fR\fB\fIpid\-file\fR\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-P\ \fR\fB\fIport\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-4\fR] [\fB\-6\fR]
 .SH "DESCRIPTION"
 .PP
 \fBlwresd\fR
@@ -57,42 +60,108 @@ entries are present, or if forwarding fails,
 \fBlwresd\fR
 resolves the queries autonomously starting at the root name servers, using a built\-in list of root server hints.
 .SH "OPTIONS"
-.TP
+.PP
+\-4
+.RS 4
+Use IPv4 only even if the host machine is capable of IPv6.
+\fB\-4\fR
+and
+\fB\-6\fR
+are mutually exclusive.
+.RE
+.PP
+\-6
+.RS 4
+Use IPv6 only even if the host machine is capable of IPv4.
+\fB\-4\fR
+and
+\fB\-6\fR
+are mutually exclusive.
+.RE
+.PP
+\-c \fIconfig\-file\fR
+.RS 4
+Use
+\fIconfig\-file\fR
+as the configuration file instead of the default,
+\fI/etc/lwresd.conf\fR.
+<term>\-c</term>
+can not be used with
+<term>\-C</term>.
+.RE
+.PP
 \-C \fIconfig\-file\fR
+.RS 4
 Use
 \fIconfig\-file\fR
 as the configuration file instead of the default,
 \fI/etc/resolv.conf\fR.
-.TP
+<term>\-C</term>
+can not be used with
+<term>\-c</term>.
+.RE
+.PP
 \-d \fIdebug\-level\fR
+.RS 4
 Set the daemon's debug level to
 \fIdebug\-level\fR. Debugging traces from
 \fBlwresd\fR
 become more verbose as the debug level increases.
-.TP
+.RE
+.PP
 \-f
+.RS 4
 Run the server in the foreground (i.e. do not daemonize).
-.TP
+.RE
+.PP
 \-g
+.RS 4
 Run the server in the foreground and force all logging to
 \fIstderr\fR.
-.TP
+.RE
+.PP
+\-i \fIpid\-file\fR
+.RS 4
+Use
+\fIpid\-file\fR
+as the PID file instead of the default,
+\fI/var/run/lwresd.pid\fR.
+.RE
+.PP
+\-m \fIflag\fR
+.RS 4
+Turn on memory usage debugging flags. Possible flags are
+\fIusage\fR,
+\fItrace\fR,
+\fIrecord\fR,
+\fIsize\fR, and
+\fImctx\fR. These correspond to the ISC_MEM_DEBUGXXXX flags described in
+\fI<isc/mem.h>\fR.
+.RE
+.PP
 \-n \fI#cpus\fR
+.RS 4
 Create
 \fI#cpus\fR
 worker threads to take advantage of multiple CPUs. If not specified,
 \fBlwresd\fR
 will try to determine the number of CPUs present and create one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread will be created.
-.TP
+.RE
+.PP
 \-P \fIport\fR
+.RS 4
 Listen for lightweight resolver queries on port
 \fIport\fR. If not specified, the default is port 921.
-.TP
+.RE
+.PP
 \-p \fIport\fR
+.RS 4
 Send DNS lookups to port
 \fIport\fR. If not specified, the default is port 53. This provides a way of testing the lightweight resolver daemon with a name server that listens for queries on a non\-standard port number.
-.TP
+.RE
+.PP
 \-s
+.RS 4
 Write memory usage statistics to
 \fIstdout\fR
 on exit.
@@ -100,10 +169,11 @@ on exit.
 .B "Note:"
 This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release.
 .RE
-.TP
+.RE
+.PP
 \-t \fIdirectory\fR
-\fBchroot()\fR
-to
+.RS 4
+Chroot to
 \fIdirectory\fR
 after processing the command line arguments, but before reading the configuration file.
 .RS
@@ -111,25 +181,33 @@ after processing the command line arguments, but before reading the configuratio
 This option should be used in conjunction with the
 \fB\-u\fR
 option, as chrooting a process running as root doesn't enhance security on most systems; the way
-\fBchroot()\fR
+\fBchroot(2)\fR
 is defined allows a process with root privileges to escape a chroot jail.
 .RE
-.TP
+.RE
+.PP
 \-u \fIuser\fR
-\fBsetuid()\fR
-to
+.RS 4
+Setuid to
 \fIuser\fR
 after completing privileged operations, such as creating sockets that listen on privileged ports.
-.TP
+.RE
+.PP
 \-v
+.RS 4
 Report the version number and exit.
+.RE
 .SH "FILES"
-.TP
+.PP
 \fI/etc/resolv.conf\fR
+.RS 4
 The default configuration file.
-.TP
+.RE
+.PP
 \fI/var/run/lwresd.pid\fR
+.RS 4
 The default process\-id file.
+.RE
 .SH "SEE ALSO"
 .PP
 \fBnamed\fR(8),
@@ -138,3 +216,8 @@ The default process\-id file.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br

bin/named/lwresd.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwresd.docbook,v 1.7.18.3 2005/05/13 01:32:45 marka Exp $ -->
+<!-- $Id: lwresd.docbook,v 1.7.18.8 2007/08/28 07:20:01 tbox Exp $ -->
 <refentry>
   <refentryinfo>
     <date>June 30, 2000</date>
@@ -39,6 +39,7 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -51,11 +52,13 @@
   <refsynopsisdiv>
     <cmdsynopsis>
       <command>lwresd</command>
+      <arg><option>-c <replaceable class="parameter">config-file</replaceable></option></arg>
       <arg><option>-C <replaceable class="parameter">config-file</replaceable></option></arg>
       <arg><option>-d <replaceable class="parameter">debug-level</replaceable></option></arg>
       <arg><option>-f</option></arg>
       <arg><option>-g</option></arg>
       <arg><option>-i <replaceable class="parameter">pid-file</replaceable></option></arg>
+      <arg><option>-m <replaceable class="parameter">flag</replaceable></option></arg>
       <arg><option>-n <replaceable class="parameter">#cpus</replaceable></option></arg>
       <arg><option>-P <replaceable class="parameter">port</replaceable></option></arg>
       <arg><option>-p <replaceable class="parameter">port</replaceable></option></arg>
@@ -63,6 +66,8 @@
       <arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg>
       <arg><option>-u <replaceable class="parameter">user</replaceable></option></arg>
       <arg><option>-v</option></arg>
+      <arg><option>-4</option></arg>
+      <arg><option>-6</option></arg>
     </cmdsynopsis>
   </refsynopsisdiv>
 
@@ -108,6 +113,43 @@
     <title>OPTIONS</title>
 
     <variablelist>
+
+      <varlistentry>
+        <term>-4</term>
+        <listitem>
+          <para>
+            Use IPv4 only even if the host machine is capable of IPv6.
+            <option>-4</option> and <option>-6</option> are mutually
+            exclusive.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>-6</term>
+        <listitem>
+          <para>
+            Use IPv6 only even if the host machine is capable of IPv4.
+            <option>-4</option> and <option>-6</option> are mutually
+            exclusive.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <!-- this is in source but not mentioned? does this matter? -->
+      <varlistentry>
+        <term>-c <replaceable class="parameter">config-file</replaceable></term>
+        <listitem>
+          <para>
+            Use <replaceable class="parameter">config-file</replaceable> as the
+            configuration file instead of the default,
+            <filename>/etc/lwresd.conf</filename>.
+	    <!-- Should this be an absolute path name? -->
+	    <term>-c</term> can not be used with <term>-C</term>.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-C <replaceable class="parameter">config-file</replaceable></term>
         <listitem>
@@ -115,6 +157,7 @@
             Use <replaceable class="parameter">config-file</replaceable> as the
             configuration file instead of the default,
             <filename>/etc/resolv.conf</filename>.
+	    <term>-C</term> can not be used with <term>-c</term>.
           </para>
         </listitem>
       </varlistentry>
@@ -149,6 +192,33 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>-i <replaceable class="parameter">pid-file</replaceable></term>
+        <listitem>
+          <para>
+            Use <replaceable class="parameter">pid-file</replaceable> as the
+            PID file instead of the default,
+            <filename>/var/run/lwresd.pid</filename>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>-m <replaceable class="parameter">flag</replaceable></term>
+        <listitem>
+          <para>
+            Turn on memory usage debugging flags.  Possible flags are
+            <replaceable class="parameter">usage</replaceable>,
+            <replaceable class="parameter">trace</replaceable>,
+            <replaceable class="parameter">record</replaceable>,
+            <replaceable class="parameter">size</replaceable>, and
+            <replaceable class="parameter">mctx</replaceable>.  
+            These correspond to the ISC_MEM_DEBUGXXXX flags described in
+            <filename>&lt;isc/mem.h&gt;</filename>.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-n <replaceable class="parameter">#cpus</replaceable></term>
         <listitem>
@@ -206,7 +276,7 @@
       <varlistentry>
         <term>-t <replaceable class="parameter">directory</replaceable></term>
         <listitem>
-          <para><function>chroot()</function>
+          <para>Chroot
 	    to <replaceable class="parameter">directory</replaceable> after
             processing the command line arguments, but before
             reading the configuration file.
@@ -216,7 +286,7 @@
               This option should be used in conjunction with the
               <option>-u</option> option, as chrooting a process
               running as root doesn't enhance security on most
-              systems; the way <function>chroot()</function> is
+              systems; the way <function>chroot(2)</function> is
               defined allows a process with root privileges to
               escape a chroot jail.
             </para>
@@ -227,7 +297,7 @@
       <varlistentry>
         <term>-u <replaceable class="parameter">user</replaceable></term>
         <listitem>
-          <para><function>setuid()</function>
+          <para>Setuid
 	    to <replaceable class="parameter">user</replaceable> after completing
             privileged operations, such as creating sockets that
             listen on privileged ports.

bin/named/lwresd.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,25 +14,25 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwresd.html,v 1.5.18.11 2005/10/13 02:53:02 marka Exp $ -->
+<!-- $Id: lwresd.html,v 1.5.18.18 2007/05/16 06:11:27 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwresd</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><span class="application">lwresd</span> &#8212; lightweight resolver daemon</p>
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">lwresd</code>  [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">lwresd</code>  [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-4</code>] [<code class="option">-6</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525928"></a><h2>DESCRIPTION</h2>
+<a name="id2543461"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">lwresd</strong></span>
       is the daemon providing name lookup
       services to clients that use the BIND 9 lightweight resolver
@@ -67,13 +67,34 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525975"></a><h2>OPTIONS</h2>
+<a name="id2543508"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
+<dt><span class="term">-4</span></dt>
+<dd><p>
+            Use IPv4 only even if the host machine is capable of IPv6.
+            <code class="option">-4</code> and <code class="option">-6</code> are mutually
+            exclusive.
+          </p></dd>
+<dt><span class="term">-6</span></dt>
+<dd><p>
+            Use IPv6 only even if the host machine is capable of IPv4.
+            <code class="option">-4</code> and <code class="option">-6</code> are mutually
+            exclusive.
+          </p></dd>
+<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
+<dd><p>
+            Use <em class="replaceable"><code>config-file</code></em> as the
+            configuration file instead of the default,
+            <code class="filename">/etc/lwresd.conf</code>.
+	    
+	    <font color="red">&lt;term&gt;-c&lt;/term&gt;</font> can not be used with <font color="red">&lt;term&gt;-C&lt;/term&gt;</font>.
+          </p></dd>
 <dt><span class="term">-C <em class="replaceable"><code>config-file</code></em></span></dt>
 <dd><p>
             Use <em class="replaceable"><code>config-file</code></em> as the
             configuration file instead of the default,
             <code class="filename">/etc/resolv.conf</code>.
+	    <font color="red">&lt;term&gt;-C&lt;/term&gt;</font> can not be used with <font color="red">&lt;term&gt;-c&lt;/term&gt;</font>.
           </p></dd>
 <dt><span class="term">-d <em class="replaceable"><code>debug-level</code></em></span></dt>
 <dd><p>
@@ -90,6 +111,23 @@
             Run the server in the foreground and force all logging
             to <code class="filename">stderr</code>.
           </p></dd>
+<dt><span class="term">-i <em class="replaceable"><code>pid-file</code></em></span></dt>
+<dd><p>
+            Use <em class="replaceable"><code>pid-file</code></em> as the
+            PID file instead of the default,
+            <code class="filename">/var/run/lwresd.pid</code>.
+          </p></dd>
+<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt>
+<dd><p>
+            Turn on memory usage debugging flags.  Possible flags are
+            <em class="replaceable"><code>usage</code></em>,
+            <em class="replaceable"><code>trace</code></em>,
+            <em class="replaceable"><code>record</code></em>,
+            <em class="replaceable"><code>size</code></em>, and
+            <em class="replaceable"><code>mctx</code></em>.  
+            These correspond to the ISC_MEM_DEBUGXXXX flags described in
+            <code class="filename">&lt;isc/mem.h&gt;</code>.
+          </p></dd>
 <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt>
 <dd><p>
             Create <em class="replaceable"><code>#cpus</code></em> worker threads
@@ -129,7 +167,7 @@
 </dd>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd>
-<p><code class="function">chroot()</code>
+<p>Chroot
 	    to <em class="replaceable"><code>directory</code></em> after
             processing the command line arguments, but before
             reading the configuration file.
@@ -140,14 +178,14 @@
               This option should be used in conjunction with the
               <code class="option">-u</code> option, as chrooting a process
               running as root doesn't enhance security on most
-              systems; the way <code class="function">chroot()</code> is
+              systems; the way <code class="function">chroot(2)</code> is
               defined allows a process with root privileges to
               escape a chroot jail.
             </p>
 </div>
 </dd>
 <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt>
-<dd><p><code class="function">setuid()</code>
+<dd><p>Setuid
 	    to <em class="replaceable"><code>user</code></em> after completing
             privileged operations, such as creating sockets that
             listen on privileged ports.
@@ -159,7 +197,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526307"></a><h2>FILES</h2>
+<a name="id2543925"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/resolv.conf</code></span></dt>
 <dd><p>
@@ -172,14 +210,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526346"></a><h2>SEE ALSO</h2>
+<a name="id2543964"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
       <span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526380"></a><h2>AUTHOR</h2>
+<a name="id2543998"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/named/main.c

@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: main.c,v 1.136.18.16 2006/01/05 01:41:28 marka Exp $ */
+/* $Id: main.c,v 1.136.18.17 2006/11/10 18:51:14 marka Exp $ */
 
 /*! \file */
 
@@ -886,7 +886,7 @@ main(int argc, char *argv[]) {
 		if (result == ISC_R_SUCCESS && instance != NULL) {
 			if (smf_disable_instance(instance, 0) != 0)
 				UNEXPECTED_ERROR(__FILE__, __LINE__,
-						 "smf_disable_instance() ",
+						 "smf_disable_instance() "
 						 "failed for %s : %s",
 						 instance,
 						 scf_strerror(scf_error()));

bin/named/named.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.8,v 1.20.18.9 2006/01/18 04:59:11 marka Exp $
+.\" $Id: named.8,v 1.20.18.15 2007/06/20 02:26:58 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: named
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: June 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "NAMED" "8" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -30,7 +33,7 @@
 named \- Internet domain name server
 .SH "SYNOPSIS"
 .HP 6
-\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR]
+\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR]
 .SH "DESCRIPTION"
 .PP
 \fBnamed\fR
@@ -41,22 +44,27 @@ When invoked without arguments,
 will read the default configuration file
 \fI/etc/named.conf\fR, read any initial data, and listen for queries.
 .SH "OPTIONS"
-.TP
+.PP
 \-4
+.RS 4
 Use IPv4 only even if the host machine is capable of IPv6.
 \fB\-4\fR
 and
 \fB\-6\fR
 are mutually exclusive.
-.TP
+.RE
+.PP
 \-6
+.RS 4
 Use IPv6 only even if the host machine is capable of IPv4.
 \fB\-4\fR
 and
 \fB\-6\fR
 are mutually exclusive.
-.TP
+.RE
+.PP
 \-c \fIconfig\-file\fR
+.RS 4
 Use
 \fIconfig\-file\fR
 as the configuration file instead of the default,
@@ -65,32 +73,55 @@ as the configuration file instead of the default,
 option in the configuration file,
 \fIconfig\-file\fR
 should be an absolute pathname.
-.TP
+.RE
+.PP
 \-d \fIdebug\-level\fR
+.RS 4
 Set the daemon's debug level to
 \fIdebug\-level\fR. Debugging traces from
 \fBnamed\fR
 become more verbose as the debug level increases.
-.TP
+.RE
+.PP
 \-f
+.RS 4
 Run the server in the foreground (i.e. do not daemonize).
-.TP
+.RE
+.PP
 \-g
+.RS 4
 Run the server in the foreground and force all logging to
 \fIstderr\fR.
-.TP
+.RE
+.PP
+\-m \fIflag\fR
+.RS 4
+Turn on memory usage debugging flags. Possible flags are
+\fIusage\fR,
+\fItrace\fR,
+\fIrecord\fR,
+\fIsize\fR, and
+\fImctx\fR. These correspond to the ISC_MEM_DEBUGXXXX flags described in
+\fI<isc/mem.h>\fR.
+.RE
+.PP
 \-n \fI#cpus\fR
+.RS 4
 Create
 \fI#cpus\fR
 worker threads to take advantage of multiple CPUs. If not specified,
 \fBnamed\fR
 will try to determine the number of CPUs present and create one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread will be created.
-.TP
+.RE
+.PP
 \-p \fIport\fR
+.RS 4
 Listen for queries on port
 \fIport\fR. If not specified, the default is port 53.
-.TP
+.RE
+.PP
 \-s
+.RS 4
 Write memory usage statistics to
 \fIstdout\fR
 on exit.
@@ -98,10 +129,11 @@ on exit.
 .B "Note:"
 This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release.
 .RE
-.TP
+.RE
+.PP
 \-t \fIdirectory\fR
-\fBchroot()\fR
-to
+.RS 4
+Chroot to
 \fIdirectory\fR
 after processing the command line arguments, but before reading the configuration file.
 .RS
@@ -109,13 +141,14 @@ after processing the command line arguments, but before reading the configuratio
 This option should be used in conjunction with the
 \fB\-u\fR
 option, as chrooting a process running as root doesn't enhance security on most systems; the way
-\fBchroot()\fR
+\fBchroot(2)\fR
 is defined allows a process with root privileges to escape a chroot jail.
 .RE
-.TP
+.RE
+.PP
 \-u \fIuser\fR
-\fBsetuid()\fR
-to
+.RS 4
+Setuid to
 \fIuser\fR
 after completing privileged operations, such as creating sockets that listen on privileged ports.
 .RS
@@ -123,19 +156,23 @@ after completing privileged operations, such as creating sockets that listen on
 On Linux,
 \fBnamed\fR
 uses the kernel's capability mechanism to drop all root privileges except the ability to
-\fBbind()\fR
+\fBbind(2)\fR
 to a privileged port and set process resource limits. Unfortunately, this means that the
 \fB\-u\fR
 option only works when
 \fBnamed\fR
 is run on kernel 2.2.18 or later, or kernel 2.3.99\-pre3 or later, since previous kernels did not allow privileges to be retained after
-\fBsetuid()\fR.
+\fBsetuid(2)\fR.
 .RE
-.TP
+.RE
+.PP
 \-v
+.RS 4
 Report the version number and exit.
-.TP
+.RE
+.PP
 \-x \fIcache\-file\fR
+.RS 4
 Load data from
 \fIcache\-file\fR
 into the cache of the default view.
@@ -143,17 +180,22 @@ into the cache of the default view.
 .B "Warning:"
 This option must not be used. It is only of interest to BIND 9 developers and may be removed or changed in a future release.
 .RE
+.RE
 .SH "SIGNALS"
 .PP
 In routine operation, signals should not be used to control the nameserver;
 \fBrndc\fR
 should be used instead.
-.TP
+.PP
 SIGHUP
+.RS 4
 Force a reload of the server.
-.TP
+.RE
+.PP
 SIGINT, SIGTERM
+.RS 4
 Shut down the server.
+.RE
 .PP
 The result of sending any other signals to the server is undefined.
 .SH "CONFIGURATION"
@@ -163,17 +205,23 @@ The
 configuration file is too complex to describe in detail here. A complete description is provided in the
 BIND 9 Administrator Reference Manual.
 .SH "FILES"
-.TP
+.PP
 \fI/etc/named.conf\fR
+.RS 4
 The default configuration file.
-.TP
+.RE
+.PP
 \fI/var/run/named.pid\fR
+.RS 4
 The default process\-id file.
+.RE
 .SH "SEE ALSO"
 .PP
 RFC 1033,
 RFC 1034,
 RFC 1035,
+\fBnamed\-checkconf\fR(8),
+\fBnamed\-checkzone\fR(8),
 \fBrndc\fR(8),
 \fBlwresd\fR(8),
 \fBnamed.conf\fR(5),
@@ -181,3 +229,8 @@ BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001, 2003 Internet Software Consortium.
+.br

bin/named/named.conf.5

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -12,15 +12,18 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.conf.5,v 1.1.2.18 2006/03/10 00:47:37 marka Exp $
+.\" $Id: named.conf.5,v 1.1.2.26 2007/08/19 23:26:13 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
-.TH "\\FINAMED.CONF\\FR" "5" "Aug 13, 2004" "BIND9" "BIND9"
+.\"     Title: \fInamed.conf\fR
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: Aug 13, 2004
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
+.TH "\fINAMED.CONF\fR" "5" "Aug 13, 2004" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -43,27 +46,34 @@ C++ style: // to end of line
 Unix style: # to end of line
 .SH "ACL"
 .sp
+.RS 4
 .nf
 acl \fIstring\fR { \fIaddress_match_element\fR; ... };
 .fi
+.RE
 .SH "KEY"
 .sp
+.RS 4
 .nf
 key \fIdomain_name\fR {
 	algorithm \fIstring\fR;
 	secret \fIstring\fR;
 };
 .fi
+.RE
 .SH "MASTERS"
 .sp
+.RS 4
 .nf
 masters \fIstring\fR [ port \fIinteger\fR ] {
 	( \fImasters\fR | \fIipv4_address\fR [port \fIinteger\fR] |
 	\fIipv6_address\fR [port \fIinteger\fR] ) [ key \fIstring\fR ]; ...
 };
 .fi
+.RE
 .SH "SERVER"
 .sp
+.RS 4
 .nf
 server ( \fIipv4_address\fR\fI[/prefixlen]\fR | \fIipv6_address\fR\fI[/prefixlen]\fR ) {
 	bogus \fIboolean\fR;
@@ -82,15 +92,19 @@ server ( \fIipv4_address\fR\fI[/prefixlen]\fR | \fIipv6_address\fR\fI[/prefixlen
 	support\-ixfr \fIboolean\fR; // obsolete
 };
 .fi
+.RE
 .SH "TRUSTED\-KEYS"
 .sp
+.RS 4
 .nf
 trusted\-keys {
 	\fIdomain_name\fR \fIflags\fR \fIprotocol\fR \fIalgorithm\fR \fIkey\fR; ... 
 };
 .fi
+.RE
 .SH "CONTROLS"
 .sp
+.RS 4
 .nf
 controls {
 	inet ( \fIipv4_address\fR | \fIipv6_address\fR | * )
@@ -100,8 +114,10 @@ controls {
 	unix \fIunsupported\fR; // not implemented
 };
 .fi
+.RE
 .SH "LOGGING"
 .sp
+.RS 4
 .nf
 logging {
 	channel \fIstring\fR {
@@ -117,8 +133,10 @@ logging {
 	category \fIstring\fR { \fIstring\fR; ... };
 };
 .fi
+.RE
 .SH "LWRES"
 .sp
+.RS 4
 .nf
 lwres {
 	listen\-on [ port \fIinteger\fR ] {
@@ -129,8 +147,10 @@ lwres {
 	ndots \fIinteger\fR;
 };
 .fi
+.RE
 .SH "OPTIONS"
 .sp
+.RS 4
 .nf
 options {
 	avoid\-v4\-udp\-ports { \fIport\fR; ... };
@@ -186,8 +206,8 @@ options {
 	rfc2308\-type1 \fIboolean\fR; // not yet implemented
 	additional\-from\-auth \fIboolean\fR;
 	additional\-from\-cache \fIboolean\fR;
-	query\-source \fIquerysource4\fR;
-	query\-source\-v6 \fIquerysource6\fR;
+	query\-source ( ( \fIipv4_address\fR | * ) | [ address ( \fIipv4_address\fR | * ) ] ) [ port ( \fIinteger\fR | * ) ];
+	query\-source\-v6 ( ( \fIipv6_address\fR | * ) | [ address ( \fIipv6_address\fR | * ) ] ) [ port ( \fIinteger\fR | * ) ];
 	cleaning\-interval \fIinteger\fR;
 	min\-roots \fIinteger\fR; // not implemented
 	lame\-ttl \fIinteger\fR;
@@ -204,7 +224,7 @@ options {
 	check\-integrity \fIboolean\fR;
 	check\-mx\-cname ( fail | warn | ignore );
 	check\-srv\-cname ( fail | warn | ignore );
-	cache\-file \fIquoted_string\fR;
+	cache\-file \fIquoted_string\fR; // test option
 	suppress\-initial\-notify \fIboolean\fR; // not yet implemented
 	preferred\-glue \fIstring\fR;
 	dual\-stack\-servers [ port \fIinteger\fR ] {
@@ -233,6 +253,7 @@ options {
 	allow\-update { \fIaddress_match_element\fR; ... };
 	allow\-update\-forwarding { \fIaddress_match_element\fR; ... };
 	update\-check\-ksk \fIboolean\fR;
+	masterfile\-format ( text | raw );
 	notify \fInotifytype\fR;
 	notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
@@ -282,8 +303,10 @@ options {
 	use\-id\-pool \fIboolean\fR; // obsolete
 };
 .fi
+.RE
 .SH "VIEW"
 .sp
+.RS 4
 .nf
 view \fIstring\fR \fIoptional_class\fR {
 	match\-clients { \fIaddress_match_element\fR; ... };
@@ -317,8 +340,8 @@ view \fIstring\fR \fIoptional_class\fR {
 	rfc2308\-type1 \fIboolean\fR; // not yet implemented
 	additional\-from\-auth \fIboolean\fR;
 	additional\-from\-cache \fIboolean\fR;
-	query\-source \fIquerysource4\fR;
-	query\-source\-v6 \fIquerysource6\fR;
+	query\-source ( ( \fIipv4_address\fR | * ) | [ address ( \fIipv4_address\fR | * ) ] ) [ port ( \fIinteger\fR | * ) ];
+	query\-source\-v6 ( ( \fIipv6_address\fR | * ) | [ address ( \fIipv6_address\fR | * ) ] ) [ port ( \fIinteger\fR | * ) ];
 	cleaning\-interval \fIinteger\fR;
 	min\-roots \fIinteger\fR; // not implemented
 	lame\-ttl \fIinteger\fR;
@@ -335,7 +358,7 @@ view \fIstring\fR \fIoptional_class\fR {
 	check\-integrity \fIboolean\fR;
 	check\-mx\-cname ( fail | warn | ignore );
 	check\-srv\-cname ( fail | warn | ignore );
-	cache\-file \fIquoted_string\fR;
+	cache\-file \fIquoted_string\fR; // test option
 	suppress\-initial\-notify \fIboolean\fR; // not yet implemented
 	preferred\-glue \fIstring\fR;
 	dual\-stack\-servers [ port \fIinteger\fR ] {
@@ -364,6 +387,7 @@ view \fIstring\fR \fIoptional_class\fR {
 	allow\-update { \fIaddress_match_element\fR; ... };
 	allow\-update\-forwarding { \fIaddress_match_element\fR; ... };
 	update\-check\-ksk \fIboolean\fR;
+	masterfile\-format ( text | raw );
 	notify \fInotifytype\fR;
 	notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
@@ -405,8 +429,10 @@ view \fIstring\fR \fIoptional_class\fR {
 	max\-ixfr\-log\-size \fIsize\fR; // obsolete
 };
 .fi
+.RE
 .SH "ZONE"
 .sp
+.RS 4
 .nf
 zone \fIstring\fR \fIoptional_class\fR {
 	type ( master | slave | stub | hint |
@@ -438,6 +464,7 @@ zone \fIstring\fR \fIoptional_class\fR {
 		\fIrrtypelist\fR; ...
 	};
 	update\-check\-ksk \fIboolean\fR;
+	masterfile\-format ( text | raw );
 	notify \fInotifytype\fR;
 	notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
@@ -478,11 +505,16 @@ zone \fIstring\fR \fIoptional_class\fR {
 	pubkey \fIinteger\fR \fIinteger\fR \fIinteger\fR \fIquoted_string\fR; // obsolete
 };
 .fi
+.RE
 .SH "FILES"
 .PP
 \fI/etc/named.conf\fR
 .SH "SEE ALSO"
 .PP
 \fBnamed\fR(8),
+\fBnamed\-checkconf\fR(8),
 \fBrndc\fR(8),
-\fBBIND 9 Administrator Reference Manual\fR().
+BIND 9 Administrator Reference Manual.
+.SH "COPYRIGHT"
+Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+.br

bin/named/named.conf.docbook

@@ -1,10 +1,10 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -17,7 +17,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: named.conf.docbook,v 1.1.2.21 2006/03/09 23:38:20 marka Exp $ -->
+<!-- $Id: named.conf.docbook,v 1.1.2.29 2007/08/28 07:20:01 tbox Exp $ -->
 <refentry>
   <refentryinfo>
     <date>Aug 13, 2004</date>
@@ -39,6 +39,7 @@
       <year>2004</year>
       <year>2005</year>
       <year>2006</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -232,8 +233,8 @@ options {
 	rfc2308-type1 <replaceable>boolean</replaceable>; // not yet implemented
 	additional-from-auth <replaceable>boolean</replaceable>;
 	additional-from-cache <replaceable>boolean</replaceable>;
-	query-source <replaceable>querysource4</replaceable>;
-	query-source-v6 <replaceable>querysource6</replaceable>;
+	query-source ( ( <replaceable>ipv4_address</replaceable> | * ) | <optional> address ( <replaceable>ipv4_address</replaceable> | * ) </optional> ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
+	query-source-v6 ( ( <replaceable>ipv6_address</replaceable> | * ) | <optional> address ( <replaceable>ipv6_address</replaceable> | * ) </optional> ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
 	cleaning-interval <replaceable>integer</replaceable>;
 	min-roots <replaceable>integer</replaceable>; // not implemented
 	lame-ttl <replaceable>integer</replaceable>;
@@ -250,7 +251,7 @@ options {
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx-cname ( fail | warn | ignore );
 	check-srv-cname ( fail | warn | ignore );
-	cache-file <replaceable>quoted_string</replaceable>;
+	cache-file <replaceable>quoted_string</replaceable>; // test option
 	suppress-initial-notify <replaceable>boolean</replaceable>; // not yet implemented
 	preferred-glue <replaceable>string</replaceable>;
 	dual-stack-servers <optional> port <replaceable>integer</replaceable> </optional> {
@@ -283,6 +284,7 @@ options {
 	allow-update-forwarding { <replaceable>address_match_element</replaceable>; ... };
 	update-check-ksk <replaceable>boolean</replaceable>;
 
+	masterfile-format ( text | raw );
 	notify <replaceable>notifytype</replaceable>;
 	notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
@@ -380,8 +382,8 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 	rfc2308-type1 <replaceable>boolean</replaceable>; // not yet implemented
 	additional-from-auth <replaceable>boolean</replaceable>;
 	additional-from-cache <replaceable>boolean</replaceable>;
-	query-source <replaceable>querysource4</replaceable>;
-	query-source-v6 <replaceable>querysource6</replaceable>;
+	query-source ( ( <replaceable>ipv4_address</replaceable> | * ) | <optional> address ( <replaceable>ipv4_address</replaceable> | * ) </optional> ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
+	query-source-v6 ( ( <replaceable>ipv6_address</replaceable> | * ) | <optional> address ( <replaceable>ipv6_address</replaceable> | * ) </optional> ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
 	cleaning-interval <replaceable>integer</replaceable>;
 	min-roots <replaceable>integer</replaceable>; // not implemented
 	lame-ttl <replaceable>integer</replaceable>;
@@ -398,7 +400,7 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx-cname ( fail | warn | ignore );
 	check-srv-cname ( fail | warn | ignore );
-	cache-file <replaceable>quoted_string</replaceable>;
+	cache-file <replaceable>quoted_string</replaceable>; // test option
 	suppress-initial-notify <replaceable>boolean</replaceable>; // not yet implemented
 	preferred-glue <replaceable>string</replaceable>;
 	dual-stack-servers <optional> port <replaceable>integer</replaceable> </optional> {
@@ -431,6 +433,7 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 	allow-update-forwarding { <replaceable>address_match_element</replaceable>; ... };
 	update-check-ksk <replaceable>boolean</replaceable>;
 
+	masterfile-format ( text | raw );
 	notify <replaceable>notifytype</replaceable>;
 	notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
@@ -517,6 +520,7 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 	};
 	update-check-ksk <replaceable>boolean</replaceable>;
 
+	masterfile-format ( text | raw );
 	notify <replaceable>notifytype</replaceable>;
 	notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
@@ -577,11 +581,12 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
         <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citerefentry>
-        <refentrytitle>rndc</refentrytitle><manvolnum>8</manvolnum>
+        <refentrytitle>named-checkconf</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,
       <citerefentry>
-        <refentrytitle>BIND 9 Administrator Reference Manual</refentrytitle>
-      </citerefentry>.
+        <refentrytitle>rndc</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry>,
+      <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
     </para>
   </refsect1>
 

bin/named/named.conf.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
  - 
  - Permission to use, copy, modify, and distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -13,15 +13,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.conf.html,v 1.1.2.24 2006/03/10 00:47:37 marka Exp $ -->
+<!-- $Id: named.conf.html,v 1.1.2.35 2007/08/19 23:26:13 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named.conf</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><code class="filename">named.conf</code> &#8212; configuration file for named</p>
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525900"></a><h2>DESCRIPTION</h2>
+<a name="id2542042"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">named.conf</code> is the configuration file
       for
       <span><strong class="command">named</strong></span>.  Statements are enclosed
@@ -50,14 +50,14 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525928"></a><h2>ACL</h2>
+<a name="id2543367"></a><h2>ACL</h2>
 <div class="literallayout"><p><br>
 acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 <br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525944"></a><h2>KEY</h2>
+<a name="id2543383"></a><h2>KEY</h2>
 <div class="literallayout"><p><br>
 key <em class="replaceable"><code>domain_name</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -66,7 +66,7 @@ key
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525963"></a><h2>MASTERS</h2>
+<a name="id2543402"></a><h2>MASTERS</h2>
 <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
 	( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
@@ -75,7 +75,7 @@ masters
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526009"></a><h2>SERVER</h2>
+<a name="id2543448"></a><h2>SERVER</h2>
 <div class="literallayout"><p><br>
 server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/prefixlen</span>]</code></em> | <em class="replaceable"><code>ipv6_address[<span class="optional">/prefixlen</span>]</code></em> ) {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -97,7 +97,7 @@ server
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526077"></a><h2>TRUSTED-KEYS</h2>
+<a name="id2543516"></a><h2>TRUSTED-KEYS</h2>
 <div class="literallayout"><p><br>
 trusted-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br>
@@ -105,7 +105,7 @@ trusted-keys
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526103"></a><h2>CONTROLS</h2>
+<a name="id2543542"></a><h2>CONTROLS</h2>
 <div class="literallayout"><p><br>
 controls {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br>
@@ -117,7 +117,7 @@ controls
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526138"></a><h2>LOGGING</h2>
+<a name="id2543577"></a><h2>LOGGING</h2>
 <div class="literallayout"><p><br>
 logging {<br>
 	channel <em class="replaceable"><code>string</code></em> {<br>
@@ -135,7 +135,7 @@ logging
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526177"></a><h2>LWRES</h2>
+<a name="id2543616"></a><h2>LWRES</h2>
 <div class="literallayout"><p><br>
 lwres {<br>
 	listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
@@ -148,7 +148,7 @@ lwres
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526218"></a><h2>OPTIONS</h2>
+<a name="id2543657"></a><h2>OPTIONS</h2>
 <div class="literallayout"><p><br>
 options {<br>
 	avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br>
@@ -204,8 +204,8 @@ options
 	rfc2308-type1 <em class="replaceable"><code>boolean</code></em>; // not yet implemented<br>
 	additional-from-auth <em class="replaceable"><code>boolean</code></em>;<br>
 	additional-from-cache <em class="replaceable"><code>boolean</code></em>;<br>
-	query-source <em class="replaceable"><code>querysource4</code></em>;<br>
-	query-source-v6 <em class="replaceable"><code>querysource6</code></em>;<br>
+	query-source ( ( <em class="replaceable"><code>ipv4_address</code></em> | * ) | [<span class="optional"> address ( <em class="replaceable"><code>ipv4_address</code></em> | * ) </span>] ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
+	query-source-v6 ( ( <em class="replaceable"><code>ipv6_address</code></em> | * ) | [<span class="optional"> address ( <em class="replaceable"><code>ipv6_address</code></em> | * ) </span>] ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
 	cleaning-interval <em class="replaceable"><code>integer</code></em>;<br>
 	min-roots <em class="replaceable"><code>integer</code></em>; // not implemented<br>
 	lame-ttl <em class="replaceable"><code>integer</code></em>;<br>
@@ -222,7 +222,7 @@ options
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx-cname ( fail | warn | ignore );<br>
 	check-srv-cname ( fail | warn | ignore );<br>
-	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
+	cache-file <em class="replaceable"><code>quoted_string</code></em>; // test option<br>
 	suppress-initial-notify <em class="replaceable"><code>boolean</code></em>; // not yet implemented<br>
 	preferred-glue <em class="replaceable"><code>string</code></em>;<br>
 	dual-stack-servers [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
@@ -255,6 +255,7 @@ options
 	allow-update-forwarding { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 <br>
+	masterfile-format ( text | raw );<br>
 	notify <em class="replaceable"><code>notifytype</code></em>;<br>
 	notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
@@ -312,7 +313,7 @@ options
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526934"></a><h2>VIEW</h2>
+<a name="id2544401"></a><h2>VIEW</h2>
 <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -351,8 +352,8 @@ view
 	rfc2308-type1 <em class="replaceable"><code>boolean</code></em>; // not yet implemented<br>
 	additional-from-auth <em class="replaceable"><code>boolean</code></em>;<br>
 	additional-from-cache <em class="replaceable"><code>boolean</code></em>;<br>
-	query-source <em class="replaceable"><code>querysource4</code></em>;<br>
-	query-source-v6 <em class="replaceable"><code>querysource6</code></em>;<br>
+	query-source ( ( <em class="replaceable"><code>ipv4_address</code></em> | * ) | [<span class="optional"> address ( <em class="replaceable"><code>ipv4_address</code></em> | * ) </span>] ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
+	query-source-v6 ( ( <em class="replaceable"><code>ipv6_address</code></em> | * ) | [<span class="optional"> address ( <em class="replaceable"><code>ipv6_address</code></em> | * ) </span>] ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
 	cleaning-interval <em class="replaceable"><code>integer</code></em>;<br>
 	min-roots <em class="replaceable"><code>integer</code></em>; // not implemented<br>
 	lame-ttl <em class="replaceable"><code>integer</code></em>;<br>
@@ -369,7 +370,7 @@ view
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx-cname ( fail | warn | ignore );<br>
 	check-srv-cname ( fail | warn | ignore );<br>
-	cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
+	cache-file <em class="replaceable"><code>quoted_string</code></em>; // test option<br>
 	suppress-initial-notify <em class="replaceable"><code>boolean</code></em>; // not yet implemented<br>
 	preferred-glue <em class="replaceable"><code>string</code></em>;<br>
 	dual-stack-servers [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
@@ -402,6 +403,7 @@ view
 	allow-update-forwarding { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 <br>
+	masterfile-format ( text | raw );<br>
 	notify <em class="replaceable"><code>notifytype</code></em>;<br>
 	notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
@@ -451,7 +453,7 @@ view
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527403"></a><h2>ZONE</h2>
+<a name="id2544966"></a><h2>ZONE</h2>
 <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	type ( master | slave | stub | hint |<br>
@@ -487,6 +489,7 @@ zone
 	};<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 <br>
+	masterfile-format ( text | raw );<br>
 	notify <em class="replaceable"><code>notifytype</code></em>;<br>
 	notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
@@ -535,15 +538,16 @@ zone
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527824"></a><h2>FILES</h2>
+<a name="id2545319"></a><h2>FILES</h2>
 <p><code class="filename">/etc/named.conf</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527835"></a><h2>SEE ALSO</h2>
+<a name="id2545331"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">BIND 9 Administrator Reference Manual</span></span>.
+      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
 </div>
 </div></body>

bin/named/named.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: named.docbook,v 1.7.18.6 2006/01/17 23:49:31 marka Exp $ -->
+<!-- $Id: named.docbook,v 1.7.18.12 2007/08/28 07:20:01 tbox Exp $ -->
 <refentry id="man.named">
   <refentryinfo>
     <date>June 30, 2000</date>
@@ -40,6 +40,7 @@
       <year>2004</year>
       <year>2005</year>
       <year>2006</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -59,6 +60,7 @@
       <arg><option>-d <replaceable class="parameter">debug-level</replaceable></option></arg>
       <arg><option>-f</option></arg>
       <arg><option>-g</option></arg>
+      <arg><option>-m <replaceable class="parameter">flag</replaceable></option></arg>
       <arg><option>-n <replaceable class="parameter">#cpus</replaceable></option></arg>
       <arg><option>-p <replaceable class="parameter">port</replaceable></option></arg>
       <arg><option>-s</option></arg>
@@ -157,6 +159,22 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term>-m <replaceable class="parameter">flag</replaceable></term>
+        <listitem>
+          <para>
+	    Turn on memory usage debugging flags.  Possible flags are
+	    <replaceable class="parameter">usage</replaceable>,
+	    <replaceable class="parameter">trace</replaceable>,
+	    <replaceable class="parameter">record</replaceable>,
+	    <replaceable class="parameter">size</replaceable>, and
+	    <replaceable class="parameter">mctx</replaceable>.
+	    These correspond to the ISC_MEM_DEBUGXXXX flags described in
+	    <filename>&lt;isc/mem.h&gt;</filename>.
+          </para>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term>-n <replaceable class="parameter">#cpus</replaceable></term>
         <listitem>
@@ -199,7 +217,7 @@
       <varlistentry>
         <term>-t <replaceable class="parameter">directory</replaceable></term>
         <listitem>
-          <para><function>chroot()</function>
+          <para>Chroot
 	    to <replaceable class="parameter">directory</replaceable> after
             processing the command line arguments, but before
             reading the configuration file.
@@ -209,7 +227,7 @@
               This option should be used in conjunction with the
               <option>-u</option> option, as chrooting a process
               running as root doesn't enhance security on most
-              systems; the way <function>chroot()</function> is
+              systems; the way <function>chroot(2)</function> is
               defined allows a process with root privileges to
               escape a chroot jail.
             </para>
@@ -220,7 +238,7 @@
       <varlistentry>
         <term>-u <replaceable class="parameter">user</replaceable></term>
         <listitem>
-          <para><function>setuid()</function>
+          <para>Setuid
 	    to <replaceable class="parameter">user</replaceable> after completing
             privileged operations, such as creating sockets that
             listen on privileged ports.
@@ -229,7 +247,7 @@
             <para>
               On Linux, <command>named</command> uses the kernel's
               		capability mechanism to drop all root privileges
-              except the ability to <function>bind()</function> to
+              except the ability to <function>bind(2)</function> to
               a
               privileged port and set process resource limits.
               Unfortunately, this means that the <option>-u</option>
@@ -237,7 +255,7 @@
               run
               on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or
               later, since previous kernels did not allow privileges
-              to be retained after <function>setuid()</function>.
+              to be retained after <function>setuid(2)</function>.
             </para>
           </note>
         </listitem>
@@ -351,6 +369,14 @@
     <para><citetitle>RFC 1033</citetitle>,
       <citetitle>RFC 1034</citetitle>,
       <citetitle>RFC 1035</citetitle>,
+      <citerefentry>
+        <refentrytitle>named-checkconf</refentrytitle>
+	<manvolnum>8</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>named-checkzone</refentrytitle>
+	<manvolnum>8</manvolnum>
+      </citerefentry>,
       <citerefentry>
         <refentrytitle>rndc</refentrytitle>
 	<manvolnum>8</manvolnum>

bin/named/named.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.html,v 1.6.18.13 2006/01/18 04:59:11 marka Exp $ -->
+<!-- $Id: named.html,v 1.6.18.21 2007/06/20 02:26:58 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
 <a name="man.named"></a><div class="titlepage"></div>
@@ -29,10 +29,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525937"></a><h2>DESCRIPTION</h2>
+<a name="id2543452"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named</strong></span>
       is a Domain Name System (DNS) server,
       part of the BIND 9 distribution from ISC.  For more
@@ -47,7 +47,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525961"></a><h2>OPTIONS</h2>
+<a name="id2543477"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -88,6 +88,17 @@
             Run the server in the foreground and force all logging
             to <code class="filename">stderr</code>.
           </p></dd>
+<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt>
+<dd><p>
+	    Turn on memory usage debugging flags.  Possible flags are
+	    <em class="replaceable"><code>usage</code></em>,
+	    <em class="replaceable"><code>trace</code></em>,
+	    <em class="replaceable"><code>record</code></em>,
+	    <em class="replaceable"><code>size</code></em>, and
+	    <em class="replaceable"><code>mctx</code></em>.
+	    These correspond to the ISC_MEM_DEBUGXXXX flags described in
+	    <code class="filename">&lt;isc/mem.h&gt;</code>.
+          </p></dd>
 <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt>
 <dd><p>
             Create <em class="replaceable"><code>#cpus</code></em> worker threads
@@ -117,7 +128,7 @@
 </dd>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd>
-<p><code class="function">chroot()</code>
+<p>Chroot
 	    to <em class="replaceable"><code>directory</code></em> after
             processing the command line arguments, but before
             reading the configuration file.
@@ -128,7 +139,7 @@
               This option should be used in conjunction with the
               <code class="option">-u</code> option, as chrooting a process
               running as root doesn't enhance security on most
-              systems; the way <code class="function">chroot()</code> is
+              systems; the way <code class="function">chroot(2)</code> is
               defined allows a process with root privileges to
               escape a chroot jail.
             </p>
@@ -136,7 +147,7 @@
 </dd>
 <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt>
 <dd>
-<p><code class="function">setuid()</code>
+<p>Setuid
 	    to <em class="replaceable"><code>user</code></em> after completing
             privileged operations, such as creating sockets that
             listen on privileged ports.
@@ -146,7 +157,7 @@
 <p>
               On Linux, <span><strong class="command">named</strong></span> uses the kernel's
               		capability mechanism to drop all root privileges
-              except the ability to <code class="function">bind()</code> to
+              except the ability to <code class="function">bind(2)</code> to
               a
               privileged port and set process resource limits.
               Unfortunately, this means that the <code class="option">-u</code>
@@ -154,7 +165,7 @@
               run
               on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or
               later, since previous kernels did not allow privileges
-              to be retained after <code class="function">setuid()</code>.
+              to be retained after <code class="function">setuid(2)</code>.
             </p>
 </div>
 </dd>
@@ -180,7 +191,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526374"></a><h2>SIGNALS</h2>
+<a name="id2543864"></a><h2>SIGNALS</h2>
 <p>
       In routine operation, signals should not be used to control
       the nameserver; <span><strong class="command">rndc</strong></span> should be used
@@ -201,7 +212,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526422"></a><h2>CONFIGURATION</h2>
+<a name="id2543912"></a><h2>CONFIGURATION</h2>
 <p>
       The <span><strong class="command">named</strong></span> configuration file is too complex
       to describe in detail here.  A complete description is provided
@@ -210,7 +221,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526439"></a><h2>FILES</h2>
+<a name="id2543929"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
 <dd><p>
@@ -223,10 +234,12 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526478"></a><h2>SEE ALSO</h2>
+<a name="id2543969"></a><h2>SEE ALSO</h2>
 <p><em class="citetitle">RFC 1033</em>,
       <em class="citetitle">RFC 1034</em>,
       <em class="citetitle">RFC 1035</em>,
+      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
@@ -234,7 +247,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526530"></a><h2>AUTHOR</h2>
+<a name="id2544039"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/named/query.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.257.18.28 2006/03/09 23:46:20 marka Exp $ */
+/* $Id: query.c,v 1.257.18.40 2007/09/26 03:08:14 each Exp $ */
 
 /*! \file */
 
@@ -179,18 +179,6 @@ query_next(ns_client_t *client, isc_result_t result) {
 	ns_client_next(client, result);
 }
 
-static inline void
-query_maybeputqname(ns_client_t *client) {
-	if (client->query.restarts > 0) {
-		/*
-		 * client->query.qname was dynamically allocated.
-		 */
-		dns_message_puttempname(client->message,
-					&client->query.qname);
-		client->query.qname = NULL;
-	}
-}
-
 static inline void
 query_freefreeversions(ns_client_t *client, isc_boolean_t everything) {
 	ns_dbversion_t *dbversion, *dbversion_next;
@@ -271,8 +259,14 @@ query_reset(ns_client_t *client, isc_boolean_t everything) {
 		}
 	}
 
-	query_maybeputqname(client);
-
+	if (client->query.restarts > 0) {
+		/*
+		 * client->query.qname was dynamically allocated.
+		 */
+		dns_message_puttempname(client->message,
+					&client->query.qname);
+	}
+	client->query.qname = NULL;
 	client->query.attributes = (NS_QUERYATTR_RECURSIONOK |
 				    NS_QUERYATTR_CACHEOK |
 				    NS_QUERYATTR_SECURE);
@@ -1761,8 +1755,6 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 	/* Find AAAA RRset with sig RRset */
 	result = dns_db_findrdataset(db, node, version, dns_rdatatype_aaaa,
 				     0, client->now, rdataset, sigrdataset);
-	/* The NXDOMAIN case should be covered above */
-	INSIST(result != DNS_R_NCACHENXDOMAIN);
 	/*
 	 * If we can't promote glue/pending from the cache to secure
 	 * then drop it.
@@ -1777,13 +1769,6 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 			dns_rdataset_disassociate(sigrdataset);
 		result = ISC_R_NOTFOUND;
 	}
-	if (result == DNS_R_NCACHENXRRSET) {
-		dns_rdataset_disassociate(rdataset);
-		/*
-		 * Negative cache entries don't have sigrdatasets.
-		 */
-		INSIST(! dns_rdataset_isassociated(sigrdataset));
-	}
 	if (result == ISC_R_SUCCESS) {
 		ISC_LIST_APPEND(cfname.list, rdataset, link);
 		rdataset = NULL;
@@ -2607,7 +2592,9 @@ query_addbestns(ns_client_t *client) {
 }
 
 static void
-query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) {
+query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node,
+	    dns_dbversion_t *version)
+{
 	dns_name_t *rname;
 	dns_rdataset_t *rdataset, *sigrdataset;
 	isc_result_t result;
@@ -2628,12 +2615,12 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) {
 	/*
 	 * Look for the DS record, which may or may not be present.
 	 */
-	result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ds, 0,
+	result = dns_db_findrdataset(db, node, version, dns_rdatatype_ds, 0,
 				     client->now, rdataset, sigrdataset);
 	/*
 	 * If we didn't find it, look for an NSEC. */
 	if (result == ISC_R_NOTFOUND)
-		result = dns_db_findrdataset(db, node, NULL,
+		result = dns_db_findrdataset(db, node, version,
 					     dns_rdatatype_nsec, 0, client->now,
 					     rdataset, sigrdataset);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND)
@@ -2672,7 +2659,8 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) {
 
 static void
 query_addwildcardproof(ns_client_t *client, dns_db_t *db,
-		       dns_name_t *name, isc_boolean_t ispositive)
+		       dns_dbversion_t *version, dns_name_t *name,
+		       isc_boolean_t ispositive)
 {
 	isc_buffer_t *dbuf, b;
 	dns_name_t *fname;
@@ -2753,7 +2741,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 	if (fname == NULL || rdataset == NULL || sigrdataset == NULL)
 		goto cleanup;
 
-	result = dns_db_find(db, name, NULL, dns_rdatatype_nsec, options,
+	result = dns_db_find(db, name, version, dns_rdatatype_nsec, options,
 			     0, &node, fname, rdataset, sigrdataset);
 	if (node != NULL)
 		dns_db_detachnode(db, &node);
@@ -2805,8 +2793,9 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 }
 
 static void
-query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, dns_name_t **namep,
-		    dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp)
+query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db,
+		     dns_dbversion_t *version, dns_name_t **namep,
+		     dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp)
 {
 	dns_name_t *name;
 	dns_rdataset_t *sigrdataset;
@@ -2843,8 +2832,7 @@ query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, dns_name_t **namep,
 		return;
 
 	/* XXX */
-	query_addwildcardproof(client, db,
-			       client->query.qname,
+	query_addwildcardproof(client, db, version, client->query.qname,
 			       ISC_TRUE);
 
 	/*
@@ -2958,17 +2946,31 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain,
 		result = isc_quota_attach(&ns_g_server->recursionquota,
 					  &client->recursionquota);
 		if  (result == ISC_R_SOFTQUOTA) {
-			ns_client_log(client, NS_LOGCATEGORY_CLIENT,
-				      NS_LOGMODULE_QUERY, ISC_LOG_WARNING,
-				      "recursive-clients soft limit exceeded, "
-				      "aborting oldest query");
+			static isc_stdtime_t last = 0;
+			isc_stdtime_t now;
+			isc_stdtime_get(&now);
+			if (now != last) {
+				last = now;
+				ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+					      NS_LOGMODULE_QUERY,
+					      ISC_LOG_WARNING,
+					      "recursive-clients soft limit "
+					      "exceeded, aborting oldest query");
+			}
 			ns_client_killoldestquery(client);
 			result = ISC_R_SUCCESS;
 		} else if (result == ISC_R_QUOTA) {
-			ns_client_log(client, NS_LOGCATEGORY_CLIENT,
-				      NS_LOGMODULE_QUERY, ISC_LOG_WARNING,
-				      "no more recursive clients: %s",
-				      isc_result_totext(result));
+			static isc_stdtime_t last = 0;
+			isc_stdtime_t now;
+			isc_stdtime_get(&now);
+			if (now != last) {
+				last = now;
+				ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+					      NS_LOGMODULE_QUERY,
+					      ISC_LOG_WARNING,
+					      "no more recursive clients: %s",
+					      isc_result_totext(result));
+			}
 			ns_client_killoldestquery(client);
 		}
 		if (result == ISC_R_SUCCESS && !client->mortal &&
@@ -3370,7 +3372,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		is_zone = ISC_FALSE;
 
 		qtype = event->qtype;
-		if (qtype == dns_rdatatype_rrsig)
+		if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
 			type = dns_rdatatype_any;
 		else
 			type = qtype;
@@ -3411,7 +3413,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	/*
 	 * If it's a SIG query, we'll iterate the node.
 	 */
-	if (qtype == dns_rdatatype_rrsig)
+	if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
 		type = dns_rdatatype_any;
 	else
 		type = qtype;
@@ -3486,9 +3488,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		}
 	}
 	if (result != ISC_R_SUCCESS) {
-		if (result == DNS_R_REFUSED)
-			QUERY_ERROR(DNS_R_REFUSED);
-		else
+		if (result == DNS_R_REFUSED) {
+			if (!PARTIALANSWER(client))
+				QUERY_ERROR(DNS_R_REFUSED);
+		} else
 			QUERY_ERROR(DNS_R_SERVFAIL);
 		goto cleanup;
 	}
@@ -3705,7 +3708,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 					       dbuf, DNS_SECTION_AUTHORITY);
 				client->query.gluedb = NULL;
 				if (WANTDNSSEC(client) && dns_db_issecure(db))
-					query_addds(client, db, node);
+					query_addds(client, db, node, version);
 			} else {
 				/*
 				 * We might have a better answer or delegation
@@ -3809,7 +3812,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				client->query.attributes &=
 					~NS_QUERYATTR_CACHEGLUEOK;
 				if (WANTDNSSEC(client))
-					query_addds(client, db, node);
+					query_addds(client, db, node, version);
 			}
 		}
 		goto cleanup;
@@ -3846,8 +3849,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		 */
 		if (WANTDNSSEC(client)) {
 			if (dns_rdataset_isassociated(rdataset))
-				query_addnxrrsetnsec(client, db, &fname,
-						    &rdataset, &sigrdataset);
+				query_addnxrrsetnsec(client, db, version,
+						     &fname, &rdataset,
+						     &sigrdataset);
 		}
 		goto cleanup;
 	case DNS_R_EMPTYWILD:
@@ -3877,6 +3881,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		 * resolver and not have it cached.
 		 */
 		if (qtype == dns_rdatatype_soa &&
+#ifdef DLZ
+		    zone != NULL &&
+#endif
 		    dns_zone_getzeronosoattl(zone))
 			result = query_addsoa(client, db, version, ISC_TRUE);
 		else
@@ -3893,7 +3900,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				query_addrrset(client, &fname, &rdataset,
 					       &sigrdataset,
 					       NULL, DNS_SECTION_AUTHORITY);
-				query_addwildcardproof(client, db,
+				query_addwildcardproof(client, db, version,
 						       client->query.qname,
 						       ISC_FALSE);
 			}
@@ -3998,8 +4005,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			goto cleanup;
 		}
 		dns_rdata_freestruct(&cname);
-		query_maybeputqname(client);
-		client->query.qname = tname;
+		ns_client_qnamereplace(client, tname);
 		want_restart = ISC_TRUE;
 		if (!WANTRECURSION(client))
 			options |= DNS_GETDB_NOLOG;
@@ -4116,8 +4122,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		/*
 		 * Switch to the new qname and restart.
 		 */
-		query_maybeputqname(client);
-		client->query.qname = fname;
+		ns_client_qnamereplace(client, fname);
 		fname = NULL;
 		want_restart = ISC_TRUE;
 		if (!WANTRECURSION(client))
@@ -4208,6 +4213,21 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				 * an error unless we were searching for
 				 * glue.  Ugh.
 				 */
+				if (!is_zone) {
+					authoritative = ISC_FALSE;
+					dns_rdatasetiter_destroy(&rdsiter);
+					if (RECURSIONOK(client)) {
+						result = query_recurse(client,
+								       qtype,
+								       NULL,
+								       NULL);
+						if (result == ISC_R_SUCCESS)
+						    client->query.attributes |=
+							NS_QUERYATTR_RECURSING;
+						else
+						    QUERY_ERROR(DNS_R_SERVFAIL);					}
+					goto addauth;
+				}
 				/*
 				 * We were searching for SIG records in
 				 * a nonsecure zone.  Send a "no error,
@@ -4246,6 +4266,13 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			noqname = rdataset;
 		else
 			noqname = NULL;
+		/*
+		 * BIND 8 priming queries need the additional section.
+		 */
+		if (is_zone && qtype == dns_rdatatype_ns &&
+		    dns_name_equal(client->query.qname, dns_rootname))
+			client->query.attributes &= ~NS_QUERYATTR_NOADDITIONAL;
+
 		query_addrrset(client, &fname, &rdataset, sigrdatasetp, dbuf,
 			       DNS_SECTION_ANSWER);
 		if (noqname != NULL)
@@ -4282,7 +4309,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	 * DNSSEC wildcard proofs.
 	 */
 	if (need_wildcardproof && dns_db_issecure(db))
-		query_addwildcardproof(client, db,
+		query_addwildcardproof(client, db, version,
 				       dns_fixedname_name(&wildcardname),
 				       ISC_TRUE);
  cleanup:
@@ -4567,7 +4594,7 @@ ns_query_start(ns_client_t *client) {
 	 * Set AD.  We must clear it if we add non-validated data to a
 	 * response.
 	 */
-	if (client->view->enablednssec)
+	if (WANTDNSSEC(client))
 		message->flags |= DNS_MESSAGEFLAG_AD;
 
 	qclient = NULL;

bin/named/server.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: server.c,v 1.419.18.44 2006/03/09 23:46:20 marka Exp $ */
+/* $Id: server.c,v 1.419.18.57.10.1 2008/05/22 21:28:04 each Exp $ */
 
 /*! \file */
 
@@ -346,6 +346,13 @@ configure_view_dnsseckey(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 	keystruct.datalen = r.length;
 	keystruct.data = r.base;
 
+	if ((keystruct.algorithm == DST_ALG_RSASHA1 ||
+	     keystruct.algorithm == DST_ALG_RSAMD5) &&
+	    r.length > 1 && r.base[0] == 1 && r.base[1] == 3)
+		cfg_obj_log(key, ns_g_lctx, ISC_LOG_WARNING,
+			    "trusted key '%s' has a weak exponent",
+			    keynamestr);
+
 	CHECK(dns_rdata_fromstruct(NULL,
 				   keystruct.common.rdclass,
 				   keystruct.common.rdtype,
@@ -533,6 +540,14 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
 		attrs |= DNS_DISPATCHATTR_IPV6;
 		break;
 	}
+
+	if (isc_sockaddr_getport(&sa) != 0) {
+		INSIST(obj != NULL);
+		cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO,
+			    "using specific query-source port suppresses port "
+			    "randomization and can be insecure.");
+	}
+
 	attrmask = 0;
 	attrmask |= DNS_DISPATCHATTR_UDP;
 	attrmask |= DNS_DISPATCHATTR_TCP;
@@ -542,7 +557,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
 	disp = NULL;
 	result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr,
 				     ns_g_taskmgr, &sa, 4096,
-				     1000, 32768, 16411, 16433,
+				     1024, 32768, 16411, 16433,
 				     attrs, attrmask, &disp);
 	if (result != ISC_R_SUCCESS) {
 		isc_sockaddr_t any;
@@ -968,11 +983,12 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 
 	/*
 	 * Create additional cache for this view and zones under the view
-	 * unless explicitly disabled.
+	 * if explicitly enabled.
+	 * XXX950 default to on.
 	 */
 	obj = NULL;
-	(void)ns_config_get(maps, "use-additional-cache", &obj);
-	if (obj == NULL || cfg_obj_asboolean(obj)) {
+	(void)ns_config_get(maps, "acache-enable", &obj);
+	if (obj != NULL && cfg_obj_asboolean(obj)) {
 		cmctx = NULL;
 		CHECK(isc_mem_create(0, 0, &cmctx));
 		CHECK(dns_acache_create(&view->acache, cmctx, ns_g_taskmgr,
@@ -1061,7 +1077,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 					       &view->dlzdatabase);
 			isc_mem_free(mctx, s);
 			isc_mem_put(mctx, dlzargv, dlzargc * sizeof(*dlzargv));
-			if (result == ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS)
 				goto cleanup;
 		}
 	}
@@ -1427,12 +1443,12 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 		view->additionalfromcache = ISC_TRUE;
 	}
 
+	/*
+	 * Set "allow-query-cache" and "allow-recursion" acls if
+	 * configured in named.conf.
+	 */
 	CHECK(configure_view_acl(vconfig, config, "allow-query-cache",
 				 actx, ns_g_mctx, &view->queryacl));
-	if (view->queryacl == NULL)
-		CHECK(configure_view_acl(NULL, ns_g_defaults,
-					 "allow-query-cache", actx,
-					 ns_g_mctx, &view->queryacl));
 
 	if (strcmp(view->name, "_bind") != 0)
 		CHECK(configure_view_acl(vconfig, config, "allow-recursion",
@@ -1452,11 +1468,29 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			      "active%s%s", forview, viewname);
 
 	/*
-	 * Set default "allow-recursion" acl.
+	 * "allow-query-cache" inherits from "allow-recursion" if set,
+	 * otherwise from "allow-query" if set.
+	 * "allow-recursion" inherits from "allow-query-cache" if set,
+	 * otherwise from "allow-query" if set.
+	 */
+	if (view->queryacl == NULL && view->recursionacl != NULL)
+		dns_acl_attach(view->recursionacl, &view->queryacl);
+	if (view->queryacl == NULL)
+		CHECK(configure_view_acl(vconfig, config, "allow-query",
+					 actx, ns_g_mctx, &view->queryacl));
+	if (view->recursionacl == NULL && view->queryacl != NULL)
+		dns_acl_attach(view->queryacl, &view->recursionacl);
+
+	/*
+	 * Set default "allow-recursion" and "allow-query-cache" acls.
 	 */
 	if (view->recursionacl == NULL && view->recursion)
-		CHECK(configure_view_acl(NULL, ns_g_defaults, "allow-recursion",
+		CHECK(configure_view_acl(NULL, ns_g_config, "allow-recursion",
 					 actx, ns_g_mctx, &view->recursionacl));
+	if (view->queryacl == NULL)
+		CHECK(configure_view_acl(NULL, ns_g_config,
+					 "allow-query-cache", actx,
+					 ns_g_mctx, &view->queryacl));
 
 	CHECK(configure_view_acl(vconfig, config, "sortlist",
 				 actx, ns_g_mctx, &view->sortlist));
@@ -1544,19 +1578,13 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	 * For now, there is only one kind of trusted keys, the
 	 * "security roots".
 	 */
-	if (view->enablednssec) {
-		CHECK(configure_view_dnsseckeys(vconfig, config, mctx,
-						&view->secroots));
-		dns_resolver_resetmustbesecure(view->resolver);
-		obj = NULL;
-		result = ns_config_get(maps, "dnssec-must-be-secure", &obj);
-		if (result == ISC_R_SUCCESS)
-			CHECK(mustbesecure(obj, view->resolver));
-	} else {
-		if (view->secroots != NULL)
-			dns_keytable_detach(&view->secroots);
-		dns_resolver_resetmustbesecure(view->resolver);
-	}
+	CHECK(configure_view_dnsseckeys(vconfig, config, mctx,
+					&view->secroots));
+	dns_resolver_resetmustbesecure(view->resolver);
+	obj = NULL;
+	result = ns_config_get(maps, "dnssec-must-be-secure", &obj);
+	if (result == ISC_R_SUCCESS)
+		CHECK(mustbesecure(obj, view->resolver));
 
 	obj = NULL;
 	result = ns_config_get(maps, "max-cache-ttl", &obj);
@@ -1753,6 +1781,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 						     empty_dbtype, mctx);
 				if (zone != NULL) {
 					dns_zone_setview(zone, view);
+					CHECK(dns_view_addzone(view, zone));
 					dns_zone_detach(&zone);
 					continue;
 				}
@@ -2348,7 +2377,9 @@ scan_interfaces(ns_server_t *server, isc_boolean_t verbose) {
 }
 
 static isc_result_t
-add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr) {
+add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
+	      isc_boolean_t wcardport_ok)
+{
 	ns_listenelt_t *lelt = NULL;
 	dns_acl_t *src_acl = NULL;
 	dns_aclelement_t aelt;
@@ -2358,7 +2389,8 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr) {
 	REQUIRE(isc_sockaddr_pf(addr) == AF_INET6);
 
 	isc_sockaddr_any6(&any_sa6);
-	if (!isc_sockaddr_equal(&any_sa6, addr)) {
+	if (!isc_sockaddr_equal(&any_sa6, addr) &&
+	    (wcardport_ok || isc_sockaddr_getport(addr) != 0)) {
 		aelt.type = dns_aclelementtype_ipprefix;
 		aelt.negative = ISC_FALSE;
 		aelt.u.ip_prefix.prefixlen = 128;
@@ -2417,7 +2449,16 @@ adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {
 		result = dns_dispatch_getlocaladdress(dispatch6, &addr);
 		if (result != ISC_R_SUCCESS)
 			goto fail;
-		result = add_listenelt(mctx, list, &addr);
+
+		/*
+		 * We always add non-wildcard address regardless of whether
+		 * the port is 'any' (the fourth arg is TRUE): if the port is
+		 * specific, we need to add it since it may conflict with a
+		 * listening interface; if it's zero, we'll dynamically open
+		 * query ports, and some of them may override an existing
+		 * wildcard IPv6 port.
+		 */
+		result = add_listenelt(mctx, list, &addr, ISC_TRUE);
 		if (result != ISC_R_SUCCESS)
 			goto fail;
 	}
@@ -2447,12 +2488,12 @@ adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {
 			continue;
 
 		addrp = dns_zone_getnotifysrc6(zone);
-		result = add_listenelt(mctx, list, addrp);
+		result = add_listenelt(mctx, list, addrp, ISC_FALSE);
 		if (result != ISC_R_SUCCESS)
 			goto fail;
 
 		addrp = dns_zone_getxfrsource6(zone);
-		result = add_listenelt(mctx, list, addrp);
+		result = add_listenelt(mctx, list, addrp, ISC_FALSE);
 		if (result != ISC_R_SUCCESS)
 			goto fail;
 	}
@@ -3957,6 +3998,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 		type = dns_zone_gettype(zone);
 		if (type == dns_zone_slave || type == dns_zone_stub) {
 			dns_zone_refresh(zone);
+			dns_zone_detach(&zone);
 			msg = "zone refresh queued";
 		} else {
 			result = dns_zone_load(zone);
@@ -4026,20 +4068,29 @@ isc_result_t
 ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 	isc_result_t result;
 	dns_zone_t *zone = NULL;
-	const unsigned char msg[] = "zone refresh queued";
+	const unsigned char msg1[] = "zone refresh queued";
+	const unsigned char msg2[] = "not a slave or stub zone";
+	dns_zonetype_t type;
 
 	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	if (zone == NULL)
 		return (ISC_R_UNEXPECTEDEND);
-	
-	dns_zone_refresh(zone);
-	dns_zone_detach(&zone);
-	if (sizeof(msg) <= isc_buffer_availablelength(text))
-		isc_buffer_putmem(text, msg, sizeof(msg));
 
-	return (ISC_R_SUCCESS);
+	type = dns_zone_gettype(zone);
+	if (type == dns_zone_slave || type == dns_zone_stub) {
+		dns_zone_refresh(zone);
+		dns_zone_detach(&zone);
+		if (sizeof(msg1) <= isc_buffer_availablelength(text))
+			isc_buffer_putmem(text, msg1, sizeof(msg1));
+		return (ISC_R_SUCCESS);
+	}
+		
+	dns_zone_detach(&zone);
+	if (sizeof(msg2) <= isc_buffer_availablelength(text))
+		isc_buffer_putmem(text, msg2, sizeof(msg2));
+	return (ISC_R_FAILURE);
 }	
 
 isc_result_t
@@ -4564,7 +4615,8 @@ isc_result_t
 ns_server_flushcache(ns_server_t *server, char *args) {
 	char *ptr, *viewname;
 	dns_view_t *view;
-	isc_boolean_t flushed = ISC_FALSE;
+	isc_boolean_t flushed;
+	isc_boolean_t found;
 	isc_result_t result;
 
 	/* Skip the command name. */
@@ -4577,22 +4629,27 @@ ns_server_flushcache(ns_server_t *server, char *args) {
 
 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	flushed = ISC_TRUE;
+	found = ISC_FALSE;
 	for (view = ISC_LIST_HEAD(server->viewlist);
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
 		if (viewname != NULL && strcasecmp(viewname, view->name) != 0)
 			continue;
+		found = ISC_TRUE;
 		result = dns_view_flushcache(view);
 		if (result != ISC_R_SUCCESS)
-			goto out;
-		flushed = ISC_TRUE;
+			flushed = ISC_FALSE;
 	}
-	if (flushed)
+	if (flushed && found) {
 		result = ISC_R_SUCCESS;
-	else
-		result = ISC_R_FAILURE;
- out:
+	} else {
+		if (!found)
+			result = ISC_R_NOTFOUND;
+		else
+			result = ISC_R_FAILURE;
+	}
 	isc_task_endexclusive(server->task);	
 	return (result);
 }
@@ -4601,7 +4658,8 @@ isc_result_t
 ns_server_flushname(ns_server_t *server, char *args) {
 	char *ptr, *target, *viewname;
 	dns_view_t *view;
-	isc_boolean_t flushed = ISC_FALSE;
+	isc_boolean_t flushed;
+	isc_boolean_t found;
 	isc_result_t result;
 	isc_buffer_t b;
 	dns_fixedname_t fixed;
@@ -4631,18 +4689,22 @@ ns_server_flushname(ns_server_t *server, char *args) {
 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	flushed = ISC_TRUE;
+	found = ISC_FALSE;
 	for (view = ISC_LIST_HEAD(server->viewlist);
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
 		if (viewname != NULL && strcasecmp(viewname, view->name) != 0)
 			continue;
+		found = ISC_TRUE;
 		result = dns_view_flushname(view, name);
 		if (result != ISC_R_SUCCESS)
 			flushed = ISC_FALSE;
 	}
-	if (flushed)
+	if (flushed && found)
 		result = ISC_R_SUCCESS;
+	else if (!found)
+		result = ISC_R_NOTFOUND;
 	else
 		result = ISC_R_FAILURE;
 	isc_task_endexclusive(server->task);	

bin/named/update.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: update.c,v 1.109.18.19 2006/03/06 01:38:00 marka Exp $ */
+/* $Id: update.c,v 1.109.18.23 2007/08/28 07:20:01 tbox Exp $ */
 
 #include <config.h>
 
@@ -1675,6 +1675,9 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 		if (check_ksk && type != dns_rdatatype_dnskey &&
 		    (dst_key_flags(keys[i]) & DNS_KEYFLAG_KSK) != 0)
 			continue;
+
+		if (!dst_key_isprivate(keys[i]))
+			continue;
 		
 		/* Calculate the signature, creating a RRSIG RDATA. */
 		CHECK(dns_dnssec_sign(name, &rdataset, keys[i],
@@ -2186,7 +2189,7 @@ remove_orphaned_ds(dns_db_t *db, dns_dbversion_t *newver, dns_diff_t *diff) {
 	for (t = ISC_LIST_HEAD(diff->tuples);
 	     t != NULL;
 	     t = ISC_LIST_NEXT(t, link)) {
-		if (t->op != DNS_DIFFOP_DEL ||
+		if (t->op != DNS_DIFFOP_ADD ||
 		    t->rdata.type != dns_rdatatype_ns)
 			continue;
 		CHECK(rrset_exists(db, newver, &t->name, dns_rdatatype_ns, 0,
@@ -2237,7 +2240,7 @@ check_mx(ns_client_t *client, dns_zone_t *zone,
 	for (t = ISC_LIST_HEAD(diff->tuples);
 	     t != NULL;
 	     t = ISC_LIST_NEXT(t, link)) {
-		if (t->op != DNS_DIFFOP_DEL ||
+		if (t->op != DNS_DIFFOP_ADD ||
 		    t->rdata.type != dns_rdatatype_mx)
 			continue;
 

bin/named/win32/named.mak

@@ -28,6 +28,81 @@ NULL=nul
 CPP=cl.exe
 RSC=rc.exe
 
+!IF  "$(CFG)" == "named - Win32 Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
 !IF  "$(CFG)" == "named - Win32 Release"
 
 OUTDIR=.\Release
@@ -80,6 +155,7 @@ CLEAN :
 	-@erase "$(INTDIR)\xfrout.obj"
 	-@erase "$(INTDIR)\zoneconf.obj"
 	-@erase "..\..\..\Build\Release\named.exe"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -133,6 +209,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ELSEIF  "$(CFG)" == "named - Win32 Debug"
 
@@ -224,6 +301,7 @@ CLEAN :
 	-@erase "$(OUTDIR)\named.pdb"
 	-@erase "..\..\..\Build\Debug\named.exe"
 	-@erase "..\..\..\Build\Debug\named.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -312,6 +390,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ENDIF 
 
@@ -1051,3 +1130,21 @@ SOURCE=..\zoneconf.c
 
 !ENDIF 
 
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/named/zoneconf.c

@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zoneconf.c,v 1.110.18.22 2006/03/06 01:38:00 marka Exp $ */
+/* $Id: zoneconf.c,v 1.110.18.23 2006/05/16 03:39:57 marka Exp $ */
 
 /*% */
 
@@ -65,7 +65,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 		   void (*clearzacl)(dns_zone_t *))
 {
 	isc_result_t result;
-	const cfg_obj_t *maps[4];
+	const cfg_obj_t *maps[5];
 	const cfg_obj_t *aclobj = NULL;
 	int i = 0;
 	dns_acl_t *dacl = NULL;
@@ -80,6 +80,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 		if (options != NULL)
 			maps[i++] = options;
 	}
+	maps[i++] = ns_g_defaults;
 	maps[i] = NULL;
 
 	result = ns_config_get(maps, aclname, &aclobj);

bin/nsupdate/nsupdate.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: nsupdate.8,v 1.30.18.9 2006/01/28 02:15:41 marka Exp $
+.\" $Id: nsupdate.8,v 1.30.18.14 2007/05/09 03:33:13 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: nsupdate
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: Jun 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "NSUPDATE" "8" "Jun 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -30,7 +33,7 @@
 nsupdate \- Dynamic DNS update utility
 .SH "SYNOPSIS"
 .HP 9
-\fBnsupdate\fR [\fB\-d\fR] [[\fB\-y\ \fR\fB\fI[hmac:]\fR\fIkeyname:secret\fR\fR] [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [filename]
+\fBnsupdate\fR [\fB\-d\fR] [[\fB\-y\ \fR\fB\fI[hmac:]\fR\fIkeyname:secret\fR\fR] | [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [filename]
 .SH "DESCRIPTION"
 .PP
 \fBnsupdate\fR
@@ -52,7 +55,7 @@ operate in debug mode. This provides tracing information about the update reques
 .PP
 Transaction signatures can be used to authenticate the Dynamic DNS updates. These use the TSIG resource record type described in RFC2845 or the SIG(0) record described in RFC3535 and RFC2931. TSIG relies on a shared secret that should only be known to
 \fBnsupdate\fR
-and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC\-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. For instance suitable
+and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC\-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. For instance, suitable
 \fBkey\fR
 and
 \fBserver\fR
@@ -79,7 +82,8 @@ reads the shared secret from the file
 must also be present. When the
 \fB\-y\fR
 option is used, a signature is generated from
-[\fIhmac:\fR]\fIkeyname:secret.\fR\fIkeyname\fR
+[\fIhmac:\fR]\fIkeyname:secret.\fR
+\fIkeyname\fR
 is the name of the key, and
 \fIsecret\fR
 is the base64 encoded shared secret. Use of the
@@ -102,15 +106,15 @@ use a TCP connection. This may be preferable when a batch of update requests is
 .PP
 The
 \fB\-t\fR
-option sets the maximum time a update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout.
+option sets the maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout.
 .PP
 The
 \fB\-u\fR
-option sets the UDP retry interval. The default is 3 seconds. If zero the interval will be computed from the timeout interval and number of UDP retries.
+option sets the UDP retry interval. The default is 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries.
 .PP
 The
 \fB\-r\fR
-option sets the number of UDP retries. The default is 3. If zero only one update request will be made.
+option sets the number of UDP retries. The default is 3. If zero, only one update request will be made.
 .SH "INPUT FORMAT"
 .PP
 \fBnsupdate\fR
@@ -123,8 +127,9 @@ Every update request consists of zero or more prerequisites and zero or more upd
 command) causes the accumulated commands to be sent as one Dynamic DNS update request to the name server.
 .PP
 The command formats and their meaning are as follows:
-.TP
-.HP 7 \fBserver\fR {servername} [port]
+.PP
+\fBserver\fR {servername} [port]
+.RS 4
 Sends all dynamic update requests to the name server
 \fIservername\fR. When no server statement is provided,
 \fBnsupdate\fR
@@ -133,49 +138,64 @@ will send updates to the master server of the correct zone. The MNAME field of t
 is the port number on
 \fIservername\fR
 where the dynamic update requests get sent. If no port number is specified, the default DNS port number of 53 is used.
-.TP
-.HP 6 \fBlocal\fR {address} [port]
+.RE
+.PP
+\fBlocal\fR {address} [port]
+.RS 4
 Sends all dynamic update requests using the local
 \fIaddress\fR. When no local statement is provided,
 \fBnsupdate\fR
 will send updates using an address and port chosen by the system.
 \fIport\fR
 can additionally be used to make requests come from a specific port. If no port number is specified, the system will assign one.
-.TP
-.HP 5 \fBzone\fR {zonename}
+.RE
+.PP
+\fBzone\fR {zonename}
+.RS 4
 Specifies that all updates are to be made to the zone
 \fIzonename\fR. If no
 \fIzone\fR
 statement is provided,
 \fBnsupdate\fR
 will attempt determine the correct zone to update based on the rest of the input.
-.TP
-.HP 6 \fBclass\fR {classname}
+.RE
+.PP
+\fBclass\fR {classname}
+.RS 4
 Specify the default class. If no
 \fIclass\fR
-is specified the default class is
+is specified, the default class is
 \fIIN\fR.
-.TP
-.HP 4 \fBkey\fR {name} {secret}
-Specifies that all updates are to be TSIG signed using the
-\fIkeyname\fR\fIkeysecret\fR
+.RE
+.PP
+\fBkey\fR {name} {secret}
+.RS 4
+Specifies that all updates are to be TSIG\-signed using the
+\fIkeyname\fR
+\fIkeysecret\fR
 pair. The
 \fBkey\fR
 command overrides any key specified on the command line via
 \fB\-y\fR
 or
 \fB\-k\fR.
-.TP
-.HP 16 \fBprereq nxdomain\fR {domain\-name}
+.RE
+.PP
+\fBprereq nxdomain\fR {domain\-name}
+.RS 4
 Requires that no resource record of any type exists with name
 \fIdomain\-name\fR.
-.TP
-.HP 16 \fBprereq yxdomain\fR {domain\-name}
+.RE
+.PP
+\fBprereq yxdomain\fR {domain\-name}
+.RS 4
 Requires that
 \fIdomain\-name\fR
 exists (has as at least one resource record, of any type).
-.TP
-.HP 15 \fBprereq nxrrset\fR {domain\-name} [class] {type}
+.RE
+.PP
+\fBprereq nxrrset\fR {domain\-name} [class] {type}
+.RS 4
 Requires that no resource record exists of the specified
 \fItype\fR,
 \fIclass\fR
@@ -183,8 +203,10 @@ and
 \fIdomain\-name\fR. If
 \fIclass\fR
 is omitted, IN (internet) is assumed.
-.TP
-.HP 15 \fBprereq yxrrset\fR {domain\-name} [class] {type}
+.RE
+.PP
+\fBprereq yxrrset\fR {domain\-name} [class] {type}
+.RS 4
 This requires that a resource record of the specified
 \fItype\fR,
 \fIclass\fR
@@ -193,8 +215,10 @@ and
 must exist. If
 \fIclass\fR
 is omitted, IN (internet) is assumed.
-.TP
-.HP 15 \fBprereq yxrrset\fR {domain\-name} [class] {type} {data...}
+.RE
+.PP
+\fBprereq yxrrset\fR {domain\-name} [class] {type} {data...}
+.RS 4
 The
 \fIdata\fR
 from each set of prerequisites of this form sharing a common
@@ -207,8 +231,10 @@ are combined to form a set of RRs. This set of RRs must exactly match the set of
 \fIdomain\-name\fR. The
 \fIdata\fR
 are written in the standard text representation of the resource record's RDATA.
-.TP
-.HP 14 \fBupdate delete\fR {domain\-name} [ttl] [class] [type\ [data...]]
+.RE
+.PP
+\fBupdate delete\fR {domain\-name} [ttl] [class] [type\ [data...]]
+.RS 4
 Deletes any resource records named
 \fIdomain\-name\fR. If
 \fItype\fR
@@ -219,22 +245,31 @@ is provided, only matching resource records will be removed. The internet class
 is not supplied. The
 \fIttl\fR
 is ignored, and is only allowed for compatibility.
-.TP
-.HP 11 \fBupdate add\fR {domain\-name} {ttl} [class] {type} {data...}
+.RE
+.PP
+\fBupdate add\fR {domain\-name} {ttl} [class] {type} {data...}
+.RS 4
 Adds a new resource record with the specified
 \fIttl\fR,
 \fIclass\fR
 and
 \fIdata\fR.
-.TP
-.HP 5 \fBshow\fR
+.RE
+.PP
+\fBshow\fR
+.RS 4
 Displays the current message, containing all of the prerequisites and updates specified since the last send.
-.TP
-.HP 5 \fBsend\fR
+.RE
+.PP
+\fBsend\fR
+.RS 4
 Sends the current message. This is equivalent to entering a blank line.
-.TP
-.HP 7 \fBanswer\fR
+.RE
+.PP
+\fBanswer\fR
+.RS 4
 Displays the answer.
+.RE
 .PP
 Lines beginning with a semicolon are comments and are ignored.
 .SH "EXAMPLES"
@@ -246,42 +281,52 @@ could be used to insert and delete resource records from the
 zone. Notice that the input in each example contains a trailing blank line so that a group of commands are sent as one dynamic update request to the master name server for
 \fBexample.com\fR.
 .sp
+.RS 4
 .nf
 # nsupdate
 > update delete oldhost.example.com A
 > update add newhost.example.com 86400 A 172.16.1.1
 > send
 .fi
+.RE
 .sp
 .PP
 Any A records for
 \fBoldhost.example.com\fR
-are deleted. and an A record for
+are deleted. And an A record for
 \fBnewhost.example.com\fR
-it IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds)
+with IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds).
 .sp
+.RS 4
 .nf
 # nsupdate
 > prereq nxdomain nickname.example.com
 > update add nickname.example.com 86400 CNAME somehost.example.com
 > send
 .fi
+.RE
 .sp
 .PP
 The prerequisite condition gets the name server to check that there are no resource records of any type for
 \fBnickname.example.com\fR. If there are, the update request fails. If this name does not exist, a CNAME for it is added. This ensures that when the CNAME is added, it cannot conflict with the long\-standing rule in RFC1034 that a name must not exist as any other record type if it exists as a CNAME. (The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have RRSIG, DNSKEY and NSEC records.)
 .SH "FILES"
-.TP
+.PP
 \fB/etc/resolv.conf\fR
+.RS 4
 used to identify default name server
-.TP
+.RE
+.PP
 \fBK{name}.+157.+{random}.key\fR
+.RS 4
 base\-64 encoding of HMAC\-MD5 key created by
 \fBdnssec\-keygen\fR(8).
-.TP
+.RE
+.PP
 \fBK{name}.+157.+{random}.private\fR
+.RS 4
 base\-64 encoding of HMAC\-MD5 key created by
 \fBdnssec\-keygen\fR(8).
+.RE
 .SH "SEE ALSO"
 .PP
 \fBRFC2136\fR(),
@@ -296,3 +341,8 @@ base\-64 encoding of HMAC\-MD5 key created by
 .SH "BUGS"
 .PP
 The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases.
+.SH "COPYRIGHT"
+Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000\-2003 Internet Software Consortium.
+.br

bin/nsupdate/nsupdate.c

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
  *
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsupdate.c,v 1.130.18.13 2006/03/02 23:19:20 marka Exp $ */
+/* $Id: nsupdate.c,v 1.130.18.19 2007/08/28 07:20:01 tbox Exp $ */
 
 /*! \file */
 
@@ -161,6 +161,9 @@ debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 static void
 ddebug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 
+static void
+error(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
 #define STATUS_MORE	(isc_uint16_t)0
 #define STATUS_SEND	(isc_uint16_t)1
 #define STATUS_QUIT	(isc_uint16_t)2
@@ -194,6 +197,16 @@ fatal(const char *format, ...) {
 	exit(1);
 }
 
+static void
+error(const char *format, ...) {
+	va_list args;
+
+	va_start(args, format);
+	vfprintf(stderr, format, args);
+	va_end(args);
+	fprintf(stderr, "\n");
+}
+
 static void
 debug(const char *format, ...) {
 	va_list args;
@@ -1499,8 +1512,10 @@ get_next_command(void) {
 	char *word;
 
 	ddebug("get_next_command()");
-	if (interactive)
+	if (interactive) {
 		fprintf(stdout, "> ");
+		fflush(stdout);
+	}
 	isc_app_block();
 	cmdline = fgets(cmdlinebuf, MAXCMD, input);
 	isc_app_unblock();
@@ -1550,8 +1565,11 @@ user_interaction(void) {
 	isc_uint16_t result = STATUS_MORE;
 
 	ddebug("user_interaction()");
-	while ((result == STATUS_MORE) || (result == STATUS_SYNTAX))
+	while ((result == STATUS_MORE) || (result == STATUS_SYNTAX)) {
 		result = get_next_command();
+		if (!interactive && result == STATUS_SYNTAX)
+			fatal("syntax error");
+	}
 	if (result == STATUS_SEND)
 		return (ISC_TRUE);
 	return (ISC_FALSE);
@@ -1786,8 +1804,9 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		setzoneclass(dns_rdataclass_none);
 		return;
 	}
-	isc_mem_put(mctx, reqinfo, sizeof(nsu_requestinfo_t));
 
+	isc_mem_put(mctx, reqinfo, sizeof(nsu_requestinfo_t));
+	reqinfo = NULL;
 	isc_event_free(&event);
 	reqev = NULL;
 
@@ -1846,6 +1865,19 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	    rcvmsg->rcode != dns_rcode_nxdomain)
 		fatal("response to SOA query was unsuccessful");
 
+	if (userzone != NULL && rcvmsg->rcode == dns_rcode_nxdomain) {
+		char namebuf[DNS_NAME_FORMATSIZE];
+		dns_name_format(userzone, namebuf, sizeof(namebuf));
+		error("specified zone '%s' does not exist (NXDOMAIN)",
+		      namebuf);
+		dns_message_destroy(&rcvmsg);
+		dns_request_destroy(&request);
+		dns_message_destroy(&soaquery);
+		ddebug("Out of recvsoa");
+		done_update();
+		return;
+	}
+
  lookforsoa:
 	if (pass == 0)
 		section = DNS_SECTION_ANSWER;
@@ -2002,15 +2034,6 @@ start_update(void) {
 
 	if (answer != NULL)
 		dns_message_destroy(&answer);
-	result = dns_message_firstname(updatemsg, section);
-	if (result == ISC_R_NOMORE) {
-		section = DNS_SECTION_PREREQUISITE;
-		result = dns_message_firstname(updatemsg, section);
-	}
-	if (result != ISC_R_SUCCESS) {
-		done_update();
-		return;
-	}
 
 	if (userzone != NULL && userserver != NULL) {
 		send_update(userzone, userserver, localaddr);
@@ -2022,7 +2045,8 @@ start_update(void) {
 				    &soaquery);
 	check_result(result, "dns_message_create");
 
-	soaquery->flags |= DNS_MESSAGEFLAG_RD;
+	if (userserver == NULL)
+		soaquery->flags |= DNS_MESSAGEFLAG_RD;
 
 	result = dns_message_gettempname(soaquery, &name);
 	check_result(result, "dns_message_gettempname");
@@ -2032,10 +2056,28 @@ start_update(void) {
 
 	dns_rdataset_makequestion(rdataset, getzoneclass(), dns_rdatatype_soa);
 
-	firstname = NULL;
-	dns_message_currentname(updatemsg, section, &firstname);
-	dns_name_init(name, NULL);
-	dns_name_clone(firstname, name);
+	if (userzone != NULL) {
+		dns_name_init(name, NULL);
+		dns_name_clone(userzone, name);
+	} else {
+		result = dns_message_firstname(updatemsg, section);
+		if (result == ISC_R_NOMORE) {
+			section = DNS_SECTION_PREREQUISITE;
+			result = dns_message_firstname(updatemsg, section);
+		}
+		if (result != ISC_R_SUCCESS) {
+			dns_message_puttempname(soaquery, &name);
+			dns_rdataset_disassociate(rdataset);
+			dns_message_puttemprdataset(soaquery, &rdataset);
+			dns_message_destroy(&soaquery);
+			done_update();
+			return;
+		}
+		firstname = NULL;
+		dns_message_currentname(updatemsg, section, &firstname);
+		dns_name_init(name, NULL);
+		dns_name_clone(firstname, name);
+	}
 
 	ISC_LIST_INIT(name->list);
 	ISC_LIST_APPEND(name->list, rdataset, link);

bin/nsupdate/nsupdate.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: nsupdate.docbook,v 1.18.18.5 2006/01/27 23:57:44 marka Exp $ -->
+<!-- $Id: nsupdate.docbook,v 1.18.18.10 2007/08/28 07:20:01 tbox Exp $ -->
 <refentry>
   <refentryinfo>
     <date>Jun 30, 2000</date>
@@ -38,6 +38,7 @@
       <year>2004</year>
       <year>2005</year>
       <year>2006</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -111,7 +112,7 @@
       Once other algorithms are defined for TSIG, applications will need to
       ensure they select the appropriate algorithm as well as the key when
       authenticating each other.
-      For instance suitable
+      For instance, suitable
       <type>key</type>
       and
       <type>server</type>
@@ -169,7 +170,7 @@
       This may be preferable when a batch of update requests is made.
     </para>
     <para>
-      The <option>-t</option> option sets the maximum time a update request
+      The <option>-t</option> option sets the maximum time an update request
       can
       take before it is aborted.  The default is 300 seconds.  Zero can be
       used
@@ -178,14 +179,14 @@
     <para>
       The <option>-u</option> option sets the UDP retry interval.  The default
       is
-      3 seconds.  If zero the interval will be computed from the timeout
+      3 seconds.  If zero, the interval will be computed from the timeout
       interval
       and number of UDP retries.
     </para>
     <para>
       The <option>-r</option> option sets the number of UDP retries. The
       default is
-      3.  If zero only one update request will be made.
+      3.  If zero, only one update request will be made.
     </para>
   </refsect1>
 
@@ -220,11 +221,11 @@
       <variablelist>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>server</command>
               <arg choice="req">servername</arg>
               <arg choice="opt">port</arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Sends all dynamic update requests to the name server
@@ -247,11 +248,11 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>local</command>
               <arg choice="req">address</arg>
               <arg choice="opt">port</arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Sends all dynamic update requests using the local
@@ -270,10 +271,10 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>zone</command>
               <arg choice="req">zonename</arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Specifies that all updates are to be made to the zone
@@ -289,14 +290,14 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>class</command>
               <arg choice="req">classname</arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Specify the default class.
-              If no <parameter>class</parameter> is specified the
+              If no <parameter>class</parameter> is specified, the
               default class is
               <parameter>IN</parameter>.
             </para>
@@ -304,14 +305,14 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>key</command>
               <arg choice="req">name</arg>
               <arg choice="req">secret</arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
-              Specifies that all updates are to be TSIG signed using the
+              Specifies that all updates are to be TSIG-signed using the
               <parameter>keyname</parameter> <parameter>keysecret</parameter> pair.
               The <command>key</command> command
               overrides any key specified on the command line via
@@ -321,10 +322,10 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>prereq nxdomain</command>
               <arg choice="req">domain-name</arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Requires that no resource record of any type exists with name
@@ -335,10 +336,10 @@
 
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>prereq yxdomain</command>
               <arg choice="req">domain-name</arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Requires that
@@ -349,12 +350,12 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>prereq nxrrset</command>
               <arg choice="req">domain-name</arg>
               <arg choice="opt">class</arg>
               <arg choice="req">type</arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Requires that no resource record exists of the specified
@@ -371,12 +372,12 @@
 
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>prereq yxrrset</command>
               <arg choice="req">domain-name</arg>
               <arg choice="opt">class</arg>
               <arg choice="req">type</arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               This requires that a resource record of the specified
@@ -393,13 +394,13 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>prereq yxrrset</command>
               <arg choice="req">domain-name</arg>
               <arg choice="opt">class</arg>
               <arg choice="req">type</arg>
               <arg choice="req" rep="repeat">data</arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               The
@@ -427,13 +428,13 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>update delete</command>
               <arg choice="req">domain-name</arg>
               <arg choice="opt">ttl</arg>
               <arg choice="opt">class</arg>
               <arg choice="opt">type <arg choice="opt" rep="repeat">data</arg></arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Deletes any resource records named
@@ -453,14 +454,14 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>update add</command>
               <arg choice="req">domain-name</arg>
               <arg choice="req">ttl</arg>
               <arg choice="opt">class</arg>
               <arg choice="req">type</arg>
               <arg choice="req" rep="repeat">data</arg>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Adds a new resource record with the specified
@@ -473,9 +474,9 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>show</command>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Displays the current message, containing all of the
@@ -486,9 +487,9 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>send</command>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Sends the current message.  This is equivalent to entering a
@@ -498,9 +499,9 @@
         </varlistentry>
 
         <varlistentry>
-          <term><cmdsynopsis>
+          <term>
               <command>answer</command>
-            </cmdsynopsis></term>
+            </term>
           <listitem>
             <para>
               Displays the answer.
@@ -542,10 +543,10 @@
       Any A records for
       <type>oldhost.example.com</type>
       are deleted.
-      and an A record for
+      And an A record for
       <type>newhost.example.com</type>
-      it IP address 172.16.1.1 is added.
-      The newly-added record has a 1 day TTL (86400 seconds)
+      with IP address 172.16.1.1 is added.
+      The newly-added record has a 1 day TTL (86400 seconds).
       <programlisting>
 # nsupdate
 &gt; prereq nxdomain nickname.example.com

bin/nsupdate/nsupdate.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: nsupdate.html,v 1.14.18.15 2006/01/29 22:56:52 marka Exp $ -->
+<!-- $Id: nsupdate.html,v 1.14.18.22 2007/05/09 03:33:13 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>nsupdate</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>nsupdate &#8212; Dynamic DNS update utility</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">nsupdate</code>  [<code class="option">-d</code>] [[<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-v</code>] [filename]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525910"></a><h2>DESCRIPTION</h2>
+<a name="id2543417"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">nsupdate</strong></span>
       is used to submit Dynamic DNS Update requests as defined in RFC2136
       to a name server.
@@ -77,7 +77,7 @@
       Once other algorithms are defined for TSIG, applications will need to
       ensure they select the appropriate algorithm as well as the key when
       authenticating each other.
-      For instance suitable
+      For instance, suitable
       <span class="type">key</span>
       and
       <span class="type">server</span>
@@ -133,7 +133,7 @@
       This may be preferable when a batch of update requests is made.
     </p>
 <p>
-      The <code class="option">-t</code> option sets the maximum time a update request
+      The <code class="option">-t</code> option sets the maximum time an update request
       can
       take before it is aborted.  The default is 300 seconds.  Zero can be
       used
@@ -142,18 +142,18 @@
 <p>
       The <code class="option">-u</code> option sets the UDP retry interval.  The default
       is
-      3 seconds.  If zero the interval will be computed from the timeout
+      3 seconds.  If zero, the interval will be computed from the timeout
       interval
       and number of UDP retries.
     </p>
 <p>
       The <code class="option">-r</code> option sets the number of UDP retries. The
       default is
-      3.  If zero only one update request will be made.
+      3.  If zero, only one update request will be made.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526206"></a><h2>INPUT FORMAT</h2>
+<a name="id2543645"></a><h2>INPUT FORMAT</h2>
 <p><span><strong class="command">nsupdate</strong></span>
       reads input from
       <em class="parameter"><code>filename</code></em>
@@ -182,7 +182,11 @@
       The command formats and their meaning are as follows:
       </p>
 <div class="variablelist"><dl>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">server</code>  {servername} [port]</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">server</strong></span>
+               {servername}
+               [port]
+            </span></dt>
 <dd><p>
               Sends all dynamic update requests to the name server
               <em class="parameter"><code>servername</code></em>.
@@ -200,7 +204,11 @@
               53 is
               used.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">local</code>  {address} [port]</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">local</strong></span>
+               {address}
+               [port]
+            </span></dt>
 <dd><p>
               Sends all dynamic update requests using the local
               <em class="parameter"><code>address</code></em>.
@@ -214,7 +222,10 @@
               port.
               If no port number is specified, the system will assign one.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">zone</code>  {zonename}</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">zone</strong></span>
+               {zonename}
+            </span></dt>
 <dd><p>
               Specifies that all updates are to be made to the zone
               <em class="parameter"><code>zonename</code></em>.
@@ -225,33 +236,51 @@
               will attempt determine the correct zone to update based on the
               rest of the input.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">class</code>  {classname}</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">class</strong></span>
+               {classname}
+            </span></dt>
 <dd><p>
               Specify the default class.
-              If no <em class="parameter"><code>class</code></em> is specified the
+              If no <em class="parameter"><code>class</code></em> is specified, the
               default class is
               <em class="parameter"><code>IN</code></em>.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">key</code>  {name} {secret}</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">key</strong></span>
+               {name}
+               {secret}
+            </span></dt>
 <dd><p>
-              Specifies that all updates are to be TSIG signed using the
+              Specifies that all updates are to be TSIG-signed using the
               <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>keysecret</code></em> pair.
               The <span><strong class="command">key</strong></span> command
               overrides any key specified on the command line via
               <code class="option">-y</code> or <code class="option">-k</code>.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">prereq nxdomain</code>  {domain-name}</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">prereq nxdomain</strong></span>
+               {domain-name}
+            </span></dt>
 <dd><p>
               Requires that no resource record of any type exists with name
               <em class="parameter"><code>domain-name</code></em>.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">prereq yxdomain</code>  {domain-name}</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">prereq yxdomain</strong></span>
+               {domain-name}
+            </span></dt>
 <dd><p>
               Requires that
               <em class="parameter"><code>domain-name</code></em>
               exists (has as at least one resource record, of any type).
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">prereq nxrrset</code>  {domain-name} [class] {type}</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">prereq nxrrset</strong></span>
+               {domain-name}
+               [class]
+               {type}
+            </span></dt>
 <dd><p>
               Requires that no resource record exists of the specified
               <em class="parameter"><code>type</code></em>,
@@ -262,7 +291,12 @@
               <em class="parameter"><code>class</code></em>
               is omitted, IN (internet) is assumed.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">prereq yxrrset</code>  {domain-name} [class] {type}</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">prereq yxrrset</strong></span>
+               {domain-name}
+               [class]
+               {type}
+            </span></dt>
 <dd><p>
               This requires that a resource record of the specified
               <em class="parameter"><code>type</code></em>,
@@ -274,7 +308,13 @@
               <em class="parameter"><code>class</code></em>
               is omitted, IN (internet) is assumed.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">prereq yxrrset</code>  {domain-name} [class] {type} {data...}</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">prereq yxrrset</strong></span>
+               {domain-name}
+               [class]
+               {type}
+               {data...}
+            </span></dt>
 <dd><p>
               The
               <em class="parameter"><code>data</code></em>
@@ -297,7 +337,13 @@
               record's
               RDATA.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">update delete</code>  {domain-name} [ttl] [class] [type  [data...]]</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">update delete</strong></span>
+               {domain-name}
+               [ttl]
+               [class]
+               [type [data...]]
+            </span></dt>
 <dd><p>
               Deletes any resource records named
               <em class="parameter"><code>domain-name</code></em>.
@@ -312,7 +358,14 @@
               <em class="parameter"><code>ttl</code></em>
               is ignored, and is only allowed for compatibility.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">update add</code>  {domain-name} {ttl} [class] {type} {data...}</p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">update add</strong></span>
+               {domain-name}
+               {ttl}
+               [class]
+               {type}
+               {data...}
+            </span></dt>
 <dd><p>
               Adds a new resource record with the specified
               <em class="parameter"><code>ttl</code></em>,
@@ -320,18 +373,24 @@
               and
               <em class="parameter"><code>data</code></em>.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">show</code> </p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">show</strong></span>
+            </span></dt>
 <dd><p>
               Displays the current message, containing all of the
               prerequisites and
               updates specified since the last send.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">send</code> </p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">send</strong></span>
+            </span></dt>
 <dd><p>
               Sends the current message.  This is equivalent to entering a
               blank line.
             </p></dd>
-<dt><span class="term"><div class="cmdsynopsis"><p><code class="command">answer</code> </p></div></span></dt>
+<dt><span class="term">
+              <span><strong class="command">answer</strong></span>
+            </span></dt>
 <dd><p>
               Displays the answer.
             </p></dd>
@@ -343,7 +402,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527158"></a><h2>EXAMPLES</h2>
+<a name="id2544648"></a><h2>EXAMPLES</h2>
 <p>
       The examples below show how
       <span><strong class="command">nsupdate</strong></span>
@@ -369,10 +428,10 @@
       Any A records for
       <span class="type">oldhost.example.com</span>
       are deleted.
-      and an A record for
+      And an A record for
       <span class="type">newhost.example.com</span>
-      it IP address 172.16.1.1 is added.
-      The newly-added record has a 1 day TTL (86400 seconds)
+      with IP address 172.16.1.1 is added.
+      The newly-added record has a 1 day TTL (86400 seconds).
       </p>
 <pre class="programlisting">
 # nsupdate
@@ -397,7 +456,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527270"></a><h2>FILES</h2>
+<a name="id2544692"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
 <dd><p>
@@ -416,7 +475,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527408"></a><h2>SEE ALSO</h2>
+<a name="id2544829"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">RFC2136</span></span>,
       <span class="citerefentry"><span class="refentrytitle">RFC3007</span></span>,
       <span class="citerefentry"><span class="refentrytitle">RFC2104</span></span>,
@@ -429,7 +488,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527478"></a><h2>BUGS</h2>
+<a name="id2544900"></a><h2>BUGS</h2>
 <p>
       The TSIG key is redundantly stored in two separate files.
       This is a consequence of nsupdate using the DST library

bin/nsupdate/win32/nsupdate.mak

@@ -28,6 +28,81 @@ NULL=nul
 CPP=cl.exe
 RSC=rc.exe
 
+!IF  "$(CFG)" == "nsupdate - Win32 Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
 !IF  "$(CFG)" == "nsupdate - Win32 Release"
 
 OUTDIR=.\Release
@@ -51,6 +126,7 @@ CLEAN :
 	-@erase "$(INTDIR)\nsupdate.obj"
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "..\..\..\Build\Release\nsupdate.exe"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -72,6 +148,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ELSEIF  "$(CFG)" == "nsupdate - Win32 Debug"
 
@@ -104,6 +181,7 @@ CLEAN :
 	-@erase "$(OUTDIR)\nsupdate.pdb"
 	-@erase "..\..\..\Build\Debug\nsupdate.exe"
 	-@erase "..\..\..\Build\Debug\nsupdate.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -131,6 +209,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ENDIF 
 
@@ -274,3 +353,21 @@ SOURCE=..\nsupdate.c
 
 !ENDIF 
 
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/rndc/Makefile.in

@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2002  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.40.18.1 2004/07/20 07:03:20 marka Exp $
+# $Id: Makefile.in,v 1.40.18.4 2007/08/28 07:20:01 tbox Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -47,6 +47,8 @@ RNDCDEPLIBS =	${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${BIND9DEPLIBS} ${DNSDEPLIBS} ${I
 CONFLIBS =	${DNSLIBS} ${ISCLIBS} @LIBS@
 CONFDEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}
 
+SRCS=		rndc.c rndc-confgen.c
+
 SUBDIRS =	unix
 
 TARGETS =	rndc@EXEEXT@ rndc-confgen@EXEEXT@

bin/rndc/rndc-confgen.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: rndc-confgen.8,v 1.9.18.8 2005/10/13 02:53:03 marka Exp $
+.\" $Id: rndc-confgen.8,v 1.9.18.11 2007/01/30 00:23:44 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: rndc\-confgen
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: Aug 27, 2001
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "RNDC\-CONFGEN" "8" "Aug 27, 2001" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -53,8 +56,9 @@ file and a
 \fBcontrols\fR
 statement altogether.
 .SH "OPTIONS"
-.TP
+.PP
 \-a
+.RS 4
 Do automatic
 \fBrndc\fR
 configuration. This creates a file
@@ -97,31 +101,43 @@ option and set up a
 and
 \fInamed.conf\fR
 as directed.
-.TP
+.RE
+.PP
 \-b \fIkeysize\fR
+.RS 4
 Specifies the size of the authentication key in bits. Must be between 1 and 512 bits; the default is 128.
-.TP
+.RE
+.PP
 \-c \fIkeyfile\fR
+.RS 4
 Used with the
 \fB\-a\fR
 option to specify an alternate location for
 \fIrndc.key\fR.
-.TP
+.RE
+.PP
 \-h
+.RS 4
 Prints a short summary of the options and arguments to
 \fBrndc\-confgen\fR.
-.TP
+.RE
+.PP
 \-k \fIkeyname\fR
+.RS 4
 Specifies the key name of the rndc authentication key. This must be a valid domain name. The default is
 \fBrndc\-key\fR.
-.TP
+.RE
+.PP
 \-p \fIport\fR
+.RS 4
 Specifies the command channel port where
 \fBnamed\fR
 listens for connections from
 \fBrndc\fR. The default is 953.
-.TP
+.RE
+.PP
 \-r \fIrandomfile\fR
+.RS 4
 Specifies a source of random data for generating the authorization. If the operating system does not provide a
 \fI/dev/random\fR
 or equivalent device, the default source of randomness is keyboard input.
@@ -129,14 +145,18 @@ or equivalent device, the default source of randomness is keyboard input.
 specifies the name of a character device or file containing random data to be used instead of the default. The special value
 \fIkeyboard\fR
 indicates that keyboard input should be used.
-.TP
+.RE
+.PP
 \-s \fIaddress\fR
+.RS 4
 Specifies the IP address where
 \fBnamed\fR
 listens for command channel connections from
 \fBrndc\fR. The default is the loopback address 127.0.0.1.
-.TP
+.RE
+.PP
 \-t \fIchrootdir\fR
+.RS 4
 Used with the
 \fB\-a\fR
 option to specify a directory where
@@ -145,8 +165,10 @@ will run chrooted. An additional copy of the
 \fIrndc.key\fR
 will be written relative to this directory so that it will be found by the chrooted
 \fBnamed\fR.
-.TP
+.RE
+.PP
 \-u \fIuser\fR
+.RS 4
 Used with the
 \fB\-a\fR
 option to set the owner of the
@@ -154,6 +176,7 @@ option to set the owner of the
 file generated. If
 \fB\-t\fR
 is also specified only the file in the chroot area has its owner changed.
+.RE
 .SH "EXAMPLES"
 .PP
 To allow
@@ -181,3 +204,8 @@ BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2001, 2003 Internet Software Consortium.
+.br

bin/rndc/rndc-confgen.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2001, 2003  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: rndc-confgen.docbook,v 1.6.18.4 2005/07/19 05:55:43 marka Exp $ -->
+<!-- $Id: rndc-confgen.docbook,v 1.6.18.7 2007/08/28 07:20:01 tbox Exp $ -->
 <refentry id="man.rndc-confgen">
   <refentryinfo>
     <date>Aug 27, 2001</date>
@@ -39,6 +39,7 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>

bin/rndc/rndc-confgen.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2001, 2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: rndc-confgen.html,v 1.8.18.12 2005/10/13 02:53:04 marka Exp $ -->
+<!-- $Id: rndc-confgen.html,v 1.8.18.17 2007/01/30 00:23:44 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>rndc-confgen</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
 <a name="man.rndc-confgen"></a><div class="titlepage"></div>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc-confgen</code>  [<code class="option">-a</code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525922"></a><h2>DESCRIPTION</h2>
+<a name="id2543429"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc-confgen</strong></span>
       generates configuration files
       for <span><strong class="command">rndc</strong></span>.  It can be used as a
@@ -48,7 +48,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525966"></a><h2>OPTIONS</h2>
+<a name="id2543474"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd>
@@ -57,7 +57,7 @@
             This creates a file <code class="filename">rndc.key</code>
             in <code class="filename">/etc</code> (or whatever
             <code class="varname">sysconfdir</code>
-            was specified as when <span class="acronym">BIND</span> was
+            was specified as when <acronym class="acronym">BIND</acronym> was
             built)
             that is read by both <span><strong class="command">rndc</strong></span>
             and <span><strong class="command">named</strong></span> on startup.  The
@@ -155,7 +155,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526348"></a><h2>EXAMPLES</h2>
+<a name="id2543787"></a><h2>EXAMPLES</h2>
 <p>
       To allow <span><strong class="command">rndc</strong></span> to be used with
       no manual configuration, run
@@ -172,7 +172,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526390"></a><h2>SEE ALSO</h2>
+<a name="id2543829"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -180,7 +180,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526428"></a><h2>AUTHOR</h2>
+<a name="id2543867"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/rndc/rndc.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: rndc.8,v 1.26.18.9 2005/10/13 02:53:03 marka Exp $
+.\" $Id: rndc.8,v 1.26.18.15 2007/06/20 02:26:58 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"     Title: rndc
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: June 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "RNDC" "8" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -44,25 +47,29 @@ is invoked with no command line options or arguments, it prints a short summary
 communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of
 \fBrndc\fR
 and
-\fBnamed\fR
-named the only supported authentication algorithm is HMAC\-MD5, which uses a shared secret on each end of the connection. This provides TSIG\-style authentication for the command request and the name server's response. All commands sent over the channel must be signed by a key_id known to the server.
+\fBnamed\fR, the only supported authentication algorithm is HMAC\-MD5, which uses a shared secret on each end of the connection. This provides TSIG\-style authentication for the command request and the name server's response. All commands sent over the channel must be signed by a key_id known to the server.
 .PP
 \fBrndc\fR
 reads a configuration file to determine how to contact the name server and decide what algorithm and key it should use.
 .SH "OPTIONS"
-.TP
+.PP
 \-b \fIsource\-address\fR
+.RS 4
 Use
 \fIsource\-address\fR
 as the source address for the connection to the server. Multiple instances are permitted to allow setting of both the IPv4 and IPv6 source addresses.
-.TP
+.RE
+.PP
 \-c \fIconfig\-file\fR
+.RS 4
 Use
 \fIconfig\-file\fR
 as the configuration file instead of the default,
 \fI/etc/rndc.conf\fR.
-.TP
+.RE
+.PP
 \-k \fIkey\-file\fR
+.RS 4
 Use
 \fIkey\-file\fR
 as the key file instead of the default,
@@ -71,30 +78,41 @@ as the key file instead of the default,
 will be used to authenticate commands sent to the server if the
 \fIconfig\-file\fR
 does not exist.
-.TP
+.RE
+.PP
 \-s \fIserver\fR
+.RS 4
 \fIserver\fR
 is the name or address of the server which matches a server statement in the configuration file for
-\fBrndc\fR. If no server is supplied on the command line, the host named by the default\-server clause in the option statement of the configuration file will be used.
-.TP
+\fBrndc\fR. If no server is supplied on the command line, the host named by the default\-server clause in the options statement of the
+\fBrndc\fR
+configuration file will be used.
+.RE
+.PP
 \-p \fIport\fR
+.RS 4
 Send commands to TCP port
 \fIport\fR
 instead of BIND 9's default control channel port, 953.
-.TP
+.RE
+.PP
 \-V
+.RS 4
 Enable verbose logging.
-.TP
-\-y \fIkeyid\fR
+.RE
+.PP
+\-y \fIkey_id\fR
+.RS 4
 Use the key
-\fIkeyid\fR
+\fIkey_id\fR
 from the configuration file.
-\fIkeyid\fR
+\fIkey_id\fR
 must be known by named with the same algorithm and secret string in order for control message validation to succeed. If no
-\fIkeyid\fR
+\fIkey_id\fR
 is specified,
 \fBrndc\fR
 will first look for a key clause in the server statement of the server being used, or if no server statement is present for that host, then the default\-key clause of the options statement. Note that the configuration file contains shared secrets which are used to send authenticated control commands to name servers. It should therefore not have general read or write access.
+.RE
 .PP
 For the complete set of commands supported by
 \fBrndc\fR, see the BIND 9 Administrator Reference Manual or run
@@ -116,8 +134,14 @@ Several error messages could be clearer.
 .PP
 \fBrndc.conf\fR(5),
 \fBnamed\fR(8),
-\fBnamed.conf\fR(5)\fBndc\fR(8),
+\fBnamed.conf\fR(5),
+\fBndc\fR(8),
 BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br

bin/rndc/rndc.c

@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rndc.c,v 1.96.18.15 2006/03/09 23:46:20 marka Exp $ */
+/* $Id: rndc.c,v 1.96.18.17 2006/08/04 03:03:41 marka Exp $ */
 
 /*! \file */
 
@@ -176,6 +176,11 @@ rndc_senddone(isc_task_t *task, isc_event_t *event) {
 	if (sevent->result != ISC_R_SUCCESS)
 		fatal("send failed: %s", isc_result_totext(sevent->result));
 	isc_event_free(&event);
+	if (sends == 0 && recvs == 0) {
+		isc_socket_detach(&sock);
+		isc_task_shutdown(task);
+		RUNTIME_CHECK(isc_app_shutdown() == ISC_R_SUCCESS);
+	}
 }
 
 static void
@@ -228,9 +233,11 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) {
 
 	isc_event_free(&event);
 	isccc_sexpr_free(&response);
-	isc_socket_detach(&sock);
-	isc_task_shutdown(task);
-	RUNTIME_CHECK(isc_app_shutdown() == ISC_R_SUCCESS);
+	if (sends == 0 && recvs == 0) {
+		isc_socket_detach(&sock);
+		isc_task_shutdown(task);
+		RUNTIME_CHECK(isc_app_shutdown() == ISC_R_SUCCESS);
+	}
 }
 
 static void
@@ -314,6 +321,7 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) {
 
 static void
 rndc_connected(isc_task_t *task, isc_event_t *event) {
+	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
 	isccc_sexpr_t *request = NULL;
 	isccc_sexpr_t *data;
@@ -327,17 +335,19 @@ rndc_connected(isc_task_t *task, isc_event_t *event) {
 	connects--;
 
 	if (sevent->result != ISC_R_SUCCESS) {
+		isc_sockaddr_format(&serveraddrs[currentaddr], socktext,
+				    sizeof(socktext));
 		if (sevent->result != ISC_R_CANCELED &&
-		    currentaddr < nserveraddrs)
+		    ++currentaddr < nserveraddrs)
 		{
-			notify("connection failed: %s",
+			notify("connection failed: %s: %s", socktext,
 			       isc_result_totext(sevent->result));
 			isc_socket_detach(&sock);
 			isc_event_free(&event);
-			rndc_startconnect(&serveraddrs[currentaddr++], task);
+			rndc_startconnect(&serveraddrs[currentaddr], task);
 			return;
 		} else
-			fatal("connect failed: %s",
+			fatal("connect failed: %s: %s", socktext,
 			      isc_result_totext(sevent->result));
 	}
 
@@ -408,7 +418,7 @@ rndc_start(isc_task_t *task, isc_event_t *event) {
 	isc_event_free(&event);
 
 	currentaddr = 0;
-	rndc_startconnect(&serveraddrs[currentaddr++], task);
+	rndc_startconnect(&serveraddrs[currentaddr], task);
 }
 
 static void

bin/rndc/rndc.conf.5

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,15 +13,18 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: rndc.conf.5,v 1.23.18.10 2005/10/13 02:53:03 marka Exp $
+.\" $Id: rndc.conf.5,v 1.23.18.15 2007/05/09 13:35:47 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
-.\" Instead of manually editing it, you probably should edit the DocBook XML
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
-.TH "\\FIRNDC.CONF\\FR" "5" "June 30, 2000" "BIND9" "BIND9"
+.\"     Title: \fIrndc.conf\fR
+.\"    Author: 
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
+.\"      Date: June 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
+.TH "\fIRNDC.CONF\fR" "5" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -85,7 +88,7 @@ keyword, the server statement includes a string which is the hostname or address
 and
 \fBaddresses\fR. The key name must match the name of a key statement in the file. The port number specifies the port to connect to. If an
 \fBaddresses\fR
-clause is supplied these addresses will be used instead of the server name. Each address can take a optional port. If an
+clause is supplied these addresses will be used instead of the server name. Each address can take an optional port. If an
 \fBsource\-address\fR
 or
 \fBsource\-address\-v6\fR
@@ -109,43 +112,53 @@ program, also known as
 does not ship with BIND 9 but is available on many systems. See the EXAMPLE section for sample command lines for each.
 .SH "EXAMPLE"
 .PP
+.RS 4
 .nf
       options {
         default\-server  localhost;
         default\-key     samplekey;
       };
 .fi
+.RE
 .sp
 .PP
+.RS 4
 .nf
       server localhost {
         key             samplekey;
       };
 .fi
+.RE
 .sp
 .PP
+.RS 4
 .nf
       server testserver {
         key		testkey;
         addresses	{ localhost port 5353; };
       };
 .fi
+.RE
 .sp
 .PP
+.RS 4
 .nf
       key samplekey {
         algorithm       hmac\-md5;
         secret          "6FMfj43Osz4lyb24OIe2iGEz9lf1llJO+lz";
       };
 .fi
+.RE
 .sp
 .PP
+.RS 4
 .nf
       key testkey {
         algorithm	hmac\-md5;
         secret		"R3HI8P6BKw9ZwXwN3VZKuQ==";
-      }
+      };
 .fi
+.RE
 .sp
 .PP
 In the above example,
@@ -165,7 +178,7 @@ To generate a random secret with
 .PP
 A complete
 \fIrndc.conf\fR
-file, including the randomly generated key, will be written to the standard output. Commented out
+file, including the randomly generated key, will be written to the standard output. Commented\-out
 \fBkey\fR
 and
 \fBcontrols\fR
@@ -194,3 +207,8 @@ BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br

bin/rndc/rndc.conf.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: rndc.conf.docbook,v 1.5.18.7 2005/07/19 05:55:43 marka Exp $ -->
+<!-- $Id: rndc.conf.docbook,v 1.5.18.12 2007/08/28 07:20:01 tbox Exp $ -->
 <refentry id="man.rndc.conf">
   <refentryinfo>
     <date>June 30, 2000</date>
@@ -39,6 +39,7 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -110,7 +111,7 @@
       name of a key statement in the file.  The port number
       specifies the port to connect to.  If an <option>addresses</option>
       clause is supplied these addresses will be used instead of
-      the server name.  Each address can take a optional port.
+      the server name.  Each address can take an optional port.
       If an <option>source-address</option> or <option>source-address-v6</option>
       of supplied then these will be used to specify the IPv4 and IPv6
       source addresses respectively.
@@ -174,7 +175,7 @@
       key testkey {
         algorithm	hmac-md5;
         secret		"R3HI8P6BKw9ZwXwN3VZKuQ==";
-      }
+      };
     </programlisting>
     </para>
 
@@ -201,7 +202,7 @@
       A complete <filename>rndc.conf</filename> file, including
       the
       randomly generated key, will be written to the standard
-      output.  Commented out <option>key</option> and
+      output.  Commented-out <option>key</option> and
       <option>controls</option> statements for
       <filename>named.conf</filename> are also printed.
     </para>

bin/rndc/rndc.conf.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: rndc.conf.html,v 1.6.18.16 2006/01/29 22:56:52 marka Exp $ -->
+<!-- $Id: rndc.conf.html,v 1.6.18.23 2007/05/09 13:35:47 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>rndc.conf</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
 <a name="man.rndc.conf"></a><div class="titlepage"></div>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525299"></a><h2>DESCRIPTION</h2>
+<a name="id2543352"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">rndc.conf</code> is the configuration file
       for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
       utility.  This file has a similar structure and syntax to
@@ -87,7 +87,7 @@
       name of a key statement in the file.  The port number
       specifies the port to connect to.  If an <code class="option">addresses</code>
       clause is supplied these addresses will be used instead of
-      the server name.  Each address can take a optional port.
+      the server name.  Each address can take an optional port.
       If an <code class="option">source-address</code> or <code class="option">source-address-v6</code>
       of supplied then these will be used to specify the IPv4 and IPv6
       source addresses respectively.
@@ -117,7 +117,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525993"></a><h2>EXAMPLE</h2>
+<a name="id2543500"></a><h2>EXAMPLE</h2>
 <pre class="programlisting">
       options {
         default-server  localhost;
@@ -153,7 +153,7 @@
       key testkey {
         algorithm	hmac-md5;
         secret		"R3HI8P6BKw9ZwXwN3VZKuQ==";
-      }
+      };
     </pre>
 <p>
     </p>
@@ -180,7 +180,7 @@
       A complete <code class="filename">rndc.conf</code> file, including
       the
       randomly generated key, will be written to the standard
-      output.  Commented out <code class="option">key</code> and
+      output.  Commented-out <code class="option">key</code> and
       <code class="option">controls</code> statements for
       <code class="filename">named.conf</code> are also printed.
     </p>
@@ -191,7 +191,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526153"></a><h2>NAME SERVER CONFIGURATION</h2>
+<a name="id2543592"></a><h2>NAME SERVER CONFIGURATION</h2>
 <p>
       The name server must be configured to accept rndc connections and
       to recognize the key specified in the <code class="filename">rndc.conf</code>
@@ -201,7 +201,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526174"></a><h2>SEE ALSO</h2>
+<a name="id2543613"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>,
@@ -209,7 +209,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526213"></a><h2>AUTHOR</h2>
+<a name="id2543652"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/rndc/rndc.docbook

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  -
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: rndc.docbook,v 1.8.18.6 2005/07/19 05:55:44 marka Exp $ -->
+<!-- $Id: rndc.docbook,v 1.8.18.12 2007/08/28 07:20:01 tbox Exp $ -->
 <refentry id="man.rndc">
   <refentryinfo>
     <date>June 30, 2000</date>
@@ -39,6 +39,7 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -77,7 +78,7 @@
       communicates with the name server
       over a TCP connection, sending commands authenticated with
       digital signatures.  In the current versions of
-      <command>rndc</command> and <command>named</command> named
+      <command>rndc</command> and <command>named</command>,
       the only supported authentication algorithm is HMAC-MD5,
       which uses a shared secret on each end of the connection.
       This provides TSIG-style authentication for the command
@@ -138,13 +139,12 @@
         <term>-s <replaceable class="parameter">server</replaceable></term>
         <listitem>
           <para><replaceable class="parameter">server</replaceable> is
-            	       the name or address of the server which matches a
+            the name or address of the server which matches a
             server statement in the configuration file for
-            <command>rndc</command>.  If no server is supplied on
-            the
+            <command>rndc</command>.  If no server is supplied on the
             command line, the host named by the default-server clause
-            in the option statement of the configuration file will be
-            used.
+            in the options statement of the <command>rndc</command>
+	    configuration file will be used.
           </para>
         </listitem>
       </varlistentry>
@@ -171,16 +171,16 @@
       </varlistentry>
 
       <varlistentry>
-        <term>-y <replaceable class="parameter">keyid</replaceable></term>
+        <term>-y <replaceable class="parameter">key_id</replaceable></term>
         <listitem>
           <para>
-            Use the key <replaceable class="parameter">keyid</replaceable>
+            Use the key <replaceable class="parameter">key_id</replaceable>
             from the configuration file.
-            <replaceable class="parameter">keyid</replaceable>
+            <replaceable class="parameter">key_id</replaceable>
             must be
             known by named with the same algorithm and secret string
             in order for control message validation to succeed.
-            If no <replaceable class="parameter">keyid</replaceable>
+            If no <replaceable class="parameter">key_id</replaceable>
             is specified, <command>rndc</command> will first look
             for a key clause in the server statement of the server
             being used, or if no server statement is present for that
@@ -229,7 +229,7 @@
       </citerefentry>,
       <citerefentry>
         <refentrytitle>named.conf</refentrytitle><manvolnum>5</manvolnum>
-      </citerefentry>
+      </citerefentry>,
       <citerefentry>
         <refentrytitle>ndc</refentrytitle><manvolnum>8</manvolnum>
       </citerefentry>,

bin/rndc/rndc.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: rndc.html,v 1.8.18.14 2005/10/13 02:53:03 marka Exp $ -->
+<!-- $Id: rndc.html,v 1.8.18.22 2007/06/20 02:26:58 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>rndc</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
 <a name="man.rndc"></a><div class="titlepage"></div>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc</code>  [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525906"></a><h2>DESCRIPTION</h2>
+<a name="id2543413"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc</strong></span>
       controls the operation of a name
       server.  It supersedes the <span><strong class="command">ndc</strong></span> utility
@@ -46,7 +46,7 @@
       communicates with the name server
       over a TCP connection, sending commands authenticated with
       digital signatures.  In the current versions of
-      <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span> named
+      <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>,
       the only supported authentication algorithm is HMAC-MD5,
       which uses a shared secret on each end of the connection.
       This provides TSIG-style authentication for the command
@@ -61,7 +61,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525941"></a><h2>OPTIONS</h2>
+<a name="id2543448"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
 <dd><p>
@@ -88,13 +88,12 @@
           </p></dd>
 <dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt>
 <dd><p><em class="replaceable"><code>server</code></em> is
-            	       the name or address of the server which matches a
+            the name or address of the server which matches a
             server statement in the configuration file for
-            <span><strong class="command">rndc</strong></span>.  If no server is supplied on
-            the
+            <span><strong class="command">rndc</strong></span>.  If no server is supplied on the
             command line, the host named by the default-server clause
-            in the option statement of the configuration file will be
-            used.
+            in the options statement of the <span><strong class="command">rndc</strong></span>
+	    configuration file will be used.
           </p></dd>
 <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
 <dd><p>
@@ -107,15 +106,15 @@
 <dd><p>
             Enable verbose logging.
           </p></dd>
-<dt><span class="term">-y <em class="replaceable"><code>keyid</code></em></span></dt>
+<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt>
 <dd><p>
-            Use the key <em class="replaceable"><code>keyid</code></em>
+            Use the key <em class="replaceable"><code>key_id</code></em>
             from the configuration file.
-            <em class="replaceable"><code>keyid</code></em>
+            <em class="replaceable"><code>key_id</code></em>
             must be
             known by named with the same algorithm and secret string
             in order for control message validation to succeed.
-            If no <em class="replaceable"><code>keyid</code></em>
+            If no <em class="replaceable"><code>key_id</code></em>
             is specified, <span><strong class="command">rndc</strong></span> will first look
             for a key clause in the server statement of the server
             being used, or if no server statement is present for that
@@ -134,7 +133,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526213"></a><h2>LIMITATIONS</h2>
+<a name="id2543656"></a><h2>LIMITATIONS</h2>
 <p><span><strong class="command">rndc</strong></span>
       does not yet support all the commands of
       the BIND 8 <span><strong class="command">ndc</strong></span> utility.
@@ -148,16 +147,16 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526240"></a><h2>SEE ALSO</h2>
+<a name="id2543683"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>
+      <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526286"></a><h2>AUTHOR</h2>
+<a name="id2543730"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>

bin/rndc/win32/confgen.dsp

@@ -50,7 +50,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/isccc/win32/Release/libisccc.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/rndc-confgen.exe"
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/util.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/isccc/win32/Release/libisccc.lib /nologo /subsystem:console /machine:I386 /out:"../../../Build/Release/rndc-confgen.exe"
 
 !ELSEIF  "$(CFG)" == "rndcconfgen - Win32 Debug"
 
@@ -75,7 +75,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/isccc/win32/Debug/libisccc.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/rndc-confgen.exe" /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/util.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/isccc/win32/Debug/libisccc.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/rndc-confgen.exe" /pdbtype:sept
 
 !ENDIF 
 
@@ -94,10 +94,6 @@ SOURCE=.\os.c
 
 SOURCE="..\rndc-confgen.c"
 # End Source File
-# Begin Source File
-
-SOURCE=..\util.c
-# End Source File
 # End Group
 # Begin Group "Header Files"
 

bin/rndc/win32/confgen.mak

@@ -28,6 +28,81 @@ NULL=nul
 CPP=cl.exe
 RSC=rc.exe
 
+!IF  "$(CFG)" == "rndcconfgen - Win32 Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
 !IF  "$(CFG)" == "rndcconfgen - Win32 Release"
 
 OUTDIR=.\Release
@@ -42,6 +117,7 @@ CLEAN :
 	-@erase "$(INTDIR)\util.obj"
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "..\..\..\Build\Release\rndc-confgen.exe"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -62,6 +138,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ELSEIF  "$(CFG)" == "rndcconfgen - Win32 Debug"
 
@@ -87,6 +164,7 @@ CLEAN :
 	-@erase "$(OUTDIR)\rndc-confgen.pdb"
 	-@erase "..\..\..\Build\Debug\rndc-confgen.exe"
 	-@erase "..\..\..\Build\Debug\rndc-confgen.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -115,6 +193,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ENDIF 
 
@@ -214,3 +293,21 @@ SOURCE=..\util.c
 
 !ENDIF 
 
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/rndc/win32/rndc.dsp

@@ -50,7 +50,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/isccc/win32/Release/libisccc.lib ../../../lib/bind9/win32/Release/libbind9.lib /nologo /subsystem:console /profile /machine:I386 /out:"../../../Build/Release/rndc.exe"
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Release/util.lib ../../../lib/isc/win32/Release/libisc.lib ../../../lib/dns/win32/Release/libdns.lib ../../../lib/isccfg/win32/Release/libisccfg.lib ../../../lib/isccc/win32/Release/libisccc.lib ../../../lib/bind9/win32/Release/libbind9.lib /nologo /subsystem:console /profile /machine:I386 /out:"../../../Build/Release/rndc.exe"
 
 !ELSEIF  "$(CFG)" == "rndc - Win32 Debug"
 
@@ -75,7 +75,7 @@ BSC32=bscmake.exe
 # ADD BSC32 /nologo
 LINK32=link.exe
 # ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
-# ADD LINK32 user32.lib advapi32.lib ws2_32.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/isccc/win32/Debug/libisccc.lib ../../../lib/bind9/win32/Debug/libbind9.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/rndc.exe" /pdbtype:sept
+# ADD LINK32 user32.lib advapi32.lib ws2_32.lib Debug/util.lib ../../../lib/isc/win32/Debug/libisc.lib ../../../lib/dns/win32/Debug/libdns.lib ../../../lib/isccfg/win32/Debug/libisccfg.lib ../../../lib/isccc/win32/Debug/libisccc.lib ../../../lib/bind9/win32/Debug/libbind9.lib /nologo /subsystem:console /debug /machine:I386 /out:"../../../Build/Debug/rndc.exe" /pdbtype:sept
 
 !ENDIF 
 
@@ -90,10 +90,6 @@ LINK32=link.exe
 
 SOURCE=..\rndc.c
 # End Source File
-# Begin Source File
-
-SOURCE=..\util.c
-# End Source File
 # End Group
 # Begin Group "Header Files"
 

bin/rndc/win32/rndc.mak

@@ -28,6 +28,81 @@ NULL=nul
 CPP=cl.exe
 RSC=rc.exe
 
+!IF  "$(CFG)" == "rndc - Win32 Release"
+_VC_MANIFEST_INC=0
+_VC_MANIFEST_BASENAME=__VC80
+!ELSE
+_VC_MANIFEST_INC=1
+_VC_MANIFEST_BASENAME=__VC80.Debug
+!ENDIF
+
+####################################################
+# Specifying name of temporary resource file used only in incremental builds:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+_VC_MANIFEST_AUTO_RES=$(_VC_MANIFEST_BASENAME).auto.res
+!else
+_VC_MANIFEST_AUTO_RES=
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_EXE - command to embed manifest in EXE:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;1
+
+!endif
+
+####################################################
+# _VC_MANIFEST_EMBED_DLL - command to embed manifest in DLL:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+#MT_SPECIAL_RETURN=1090650113
+#MT_SPECIAL_SWITCH=-notify_resource_update
+MT_SPECIAL_RETURN=0
+MT_SPECIAL_SWITCH=
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -out:$(_VC_MANIFEST_BASENAME).auto.manifest $(MT_SPECIAL_SWITCH) & \
+if "%ERRORLEVEL%" == "$(MT_SPECIAL_RETURN)" \
+rc /r $(_VC_MANIFEST_BASENAME).auto.rc & \
+link $** /out:$@ $(LFLAGS)
+
+!else
+
+_VC_MANIFEST_EMBED_EXE= \
+if exist $@.manifest mt.exe -manifest $@.manifest -outputresource:$@;2
+
+!endif
+####################################################
+# _VC_MANIFEST_CLEAN - command to clean resources files generated temporarily:
+
+!if "$(_VC_MANIFEST_INC)" == "1"
+
+_VC_MANIFEST_CLEAN=-del $(_VC_MANIFEST_BASENAME).auto.res \
+    $(_VC_MANIFEST_BASENAME).auto.rc \
+    $(_VC_MANIFEST_BASENAME).auto.manifest
+
+!else
+
+_VC_MANIFEST_CLEAN=
+
+!endif
+
 !IF  "$(CFG)" == "rndc - Win32 Release"
 
 OUTDIR=.\Release
@@ -52,6 +127,7 @@ CLEAN :
 	-@erase "$(INTDIR)\util.obj"
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "..\..\..\Build\Release\rndc.exe"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -75,6 +151,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ELSEIF  "$(CFG)" == "rndc - Win32 Debug"
 
@@ -109,6 +186,7 @@ CLEAN :
 	-@erase "$(OUTDIR)\rndc.pdb"
 	-@erase "..\..\..\Build\Debug\rndc.exe"
 	-@erase "..\..\..\Build\Debug\rndc.ilk"
+	-@$(_VC_MANIFEST_CLEAN)
 
 "$(OUTDIR)" :
     if not exist "$(OUTDIR)/$(NULL)" mkdir "$(OUTDIR)"
@@ -139,6 +217,7 @@ LINK32_OBJS= \
     $(LINK32) @<<
   $(LINK32_FLAGS) $(LINK32_OBJS)
 <<
+    $(_VC_MANIFEST_EMBED_EXE)
 
 !ENDIF 
 
@@ -326,3 +405,21 @@ SOURCE=..\util.c
 
 !ENDIF 
 
+####################################################
+# Commands to generate initial empty manifest file and the RC file
+# that references it, and for generating the .res file:
+
+$(_VC_MANIFEST_BASENAME).auto.res : $(_VC_MANIFEST_BASENAME).auto.rc
+
+$(_VC_MANIFEST_BASENAME).auto.rc : $(_VC_MANIFEST_BASENAME).auto.manifest
+    type <<$@
+#include <winuser.h>
+1RT_MANIFEST"$(_VC_MANIFEST_BASENAME).auto.manifest"
+<< KEEP
+
+$(_VC_MANIFEST_BASENAME).auto.manifest :
+    type <<$@
+<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
+<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
+</assembly>
+<< KEEP

bin/rndc/win32/rndcutil.dsp

@@ -0,0 +1,119 @@
+# Microsoft Developer Studio Project File - Name="rndcutil" - Package Owner=<4>
+# Microsoft Developer Studio Generated Build File, Format Version 6.00
+# ** DO NOT EDIT **
+
+# TARGTYPE "Win32 (x86) Static-Link Library" 0x0104
+
+CFG=rndcutil - Win32 Debug
+!MESSAGE This is not a valid makefile. To build this project using NMAKE,
+!MESSAGE use the Export Makefile command and run
+!MESSAGE 
+!MESSAGE NMAKE /f "rndcutil.mak".
+!MESSAGE 
+!MESSAGE You can specify a configuration when running NMAKE
+!MESSAGE by defining the macro CFG on the command line. For example:
+!MESSAGE 
+!MESSAGE NMAKE /f "rndcutil.mak" CFG="rndcutil - Win32 Debug"
+!MESSAGE 
+!MESSAGE Possible choices for configuration are:
+!MESSAGE 
+!MESSAGE "rndcutil - Win32 Release" (based on "Win32 (x86) Static-Link Library")
+!MESSAGE "rndcutil - Win32 Debug" (based on "Win32 (x86) Static-Link Library")
+!MESSAGE 
+
+# Begin Project
+# PROP AllowPerConfigDependencies 0
+# PROP Scc_ProjName ""
+# PROP Scc_LocalPath ""
+CPP=cl.exe
+MTL=midl.exe
+RSC=rc.exe
+
+!IF  "$(CFG)" == "rndcutil - Win32 Release"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 0
+# PROP BASE Output_Dir "Release"
+# PROP BASE Intermediate_Dir "Release"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 0
+# PROP Output_Dir "Release"
+# PROP Intermediate_Dir "Release"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MT /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_WINDOWS" /D "_MBCS" /D "_USRDLL" /YX /FD /c
+# ADD CPP /nologo /MD /W3 /GX /O2 /I "./" /I "../../../" /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /D "NDEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /YX /FD /c /Fdutil
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "NDEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "NDEBUG"
+# ADD RSC /l 0x409 /d "NDEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /out:"Release/util.lib"
+LIB32=lib.exe
+# ADD BASE LIB32
+# ADD LIB32 /out:"Release/util.lib"
+
+!ELSEIF  "$(CFG)" == "rndcutil - Win32 Debug"
+
+# PROP BASE Use_MFC 0
+# PROP BASE Use_Debug_Libraries 1
+# PROP BASE Output_Dir "Debug"
+# PROP BASE Intermediate_Dir "Debug"
+# PROP BASE Target_Dir ""
+# PROP Use_MFC 0
+# PROP Use_Debug_Libraries 1
+# PROP Output_Dir "Debug"
+# PROP Intermediate_Dir "Debug"
+# PROP Ignore_Export_Lib 0
+# PROP Target_Dir ""
+# ADD BASE CPP /nologo /MTd /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_WINDOWS" /D "_MBCS" /YX /FD /GZ /c
+# ADD CPP /nologo /MDd /W3 /Gm /GX /ZI /Od /I "./" /I "../../../" /I "../include" /I "../../../lib/isc/win32" /I "../../../lib/isc/win32/include" /I "../../../lib/isc/include" /I "../../../lib/dns/include" /D "_DEBUG" /D "WIN32" /D "_WINDOWS" /D "__STDC__" /D "_MBCS" /FR /YX /FD /GZ /c /Fdutil
+# SUBTRACT CPP /X
+# ADD BASE MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD MTL /nologo /D "_DEBUG" /mktyplib203 /win32
+# ADD BASE RSC /l 0x409 /d "_DEBUG"
+# ADD RSC /l 0x409 /d "_DEBUG"
+BSC32=bscmake.exe
+# ADD BASE BSC32 /nologo
+# ADD BSC32 /nologo
+LINK32=link.exe
+# ADD BASE LINK32 
+# ADD LINK32 /debug /out:"Debug/util.lib"
+LIB32=lib.exe
+# ADD BASE LIB32
+# ADD LIB32 /out:"Debug/util.lib"
+
+!ENDIF 
+
+# Begin Target
+
+# Name "rndcutil - Win32 Release"
+# Name "rndcutil - Win32 Debug"
+# Begin Group "Source Files"
+
+# PROP Default_Filter "cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
+# End Group
+# Begin Group "Header Files"
+
+# PROP Default_Filter "h;hpp;hxx;hm;inl"
+# End Group
+# Begin Group "Resource Files"
+
+# PROP Default_Filter "ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe"
+# End Group
+# Begin Group "Main Dns Lib"
+
+# PROP Default_Filter "c"
+# Begin Source File
+
+SOURCE=..\util.c
+# End Source File
+# End Group
+# End Target
+# End Project