This commit was manufactured by cvs2git to create tag 'v9_4_3_P2'.

This commit was manufactured by cvs2git to create branch 'v9_4_3_patch'.
2009-12-30 08:02:28 +00:00 · 2009-12-30 08:02:26 +00:00 · 2009-12-30 08:02:25 +00:00 · 2009-12-30 08:02:24 +00:00 · 2009-12-30 08:02:23 +00:00 · 2009-12-30 07:17:54 +00:00
479 changed files with 51157 additions and 40583 deletions
@@ -1,7 +1,7 @@
-Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 1996-2003  Internet Software Consortium.

-Permission to use, copy, modify, and distribute this software for any
+Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
 copyright notice and this permission notice appear in all copies.

@@ -13,7 +13,7 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.

-$Id: COPYRIGHT,v 1.9.18.3 2007/01/08 02:41:59 marka Exp $
+$Id: COPYRIGHT,v 1.9.18.5 2008/01/02 23:46:02 tbox Exp $

 Portions Copyright (C) 1996-2001  Nominum, Inc.

@@ -1,7 +1,7 @@
-# Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: Makefile.in,v 1.43.18.4 2006/05/19 00:04:01 marka Exp $
+# $Id: Makefile.in,v 1.43.18.6 2007/09/03 23:46:21 tbox Exp $

 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -61,7 +61,7 @@ test:

 FAQ: FAQ.xml
 	${XSLTPROC} doc/xsl/isc-docbook-text.xsl FAQ.xml | \
-	${W3M} -T text/html -dump >$@.tmp
+	LC_ALL=C ${W3M} -T text/html -dump -cols 72 >$@.tmp
 	mv $@.tmp $@

 clean::
@@ -42,6 +42,22 @@ BIND 9
 		Stichting NLnet - NLnet Foundation
 		Nominum, Inc.

+BIND 9.4.3
+
+	BIND 9.4.3 is a maintenance release, fixing bugs in 9.4.2.
+
+BIND 9.4.2
+
+	BIND 9.4.2 is a maintenance release, containing fixes for
+	a number of bugs in 9.4.1.
+
+	Warning: If you installed BIND 9.4.2rc1 then any applications
+	linked against this release candidate will need to be rebuilt.
+
+BIND 9.4.1
+
+	BIND 9.4.1 is a security release, containing a fix for
+	a security bugs in 9.4.0.

 BIND 9.4.0

@@ -64,7 +80,9 @@ BIND 9.4.0
 	used to specify the default zone access level rather than
 	having to have every zone override the global value.
 	allow-query-cache can be set at both the options and view
-	levels.  If allow-query-cache is not set allow-query applies.
+	levels. If allow-query-cache is not set then allow-recursion
+	is used if set, otherwise allow-query is used if set, otherwise
+	the default (localhost; localnets;) is used.

 	rndc: the source address can now be specified.

@@ -340,7 +358,7 @@ BIND 9.2.0
 	    This does not apply to the use of TSIG, which does not
 	    require OpenSSL.

-	  - The source distribution now builds on Windows NT/2000.
+	  - The source distribution now builds on Windows.
 	    See win32utils/readme1.txt and win32utils/win32-build.txt
 	    for details.

@@ -389,11 +407,8 @@ BIND 9.2.0

 		--with-libtool does not work on AIX.

-		--with-libtool does not work on SunOS 4.  configure
-		requires "printf" which is not available.
-
-	A bug in the Windows 2000 DNS server can cause zone transfers
-	from a BIND 9 server to a W2K server to fail.  For details,
+	A bug in some versions of the Microsoft DNS server can cause zone
+        transfers from a BIND 9 server to a W2K server to fail.  For details,
 	see the "Zone Transfers" section in doc/misc/migration.

 	For a detailed list of user-visible changes from
@@ -408,12 +423,16 @@ Building
 	We've had successful builds and tests on the following systems:

 		COMPAQ Tru64 UNIX 5.1B
-		FreeBSD 4.10, 5.2.1
+		FreeBSD 4.10, 5.2.1, 6.2
 		HP-UX 11.11
 		NetBSD 1.5
 		Slackware Linux 8.1
 		Solaris 8, 9, 9 (x86)
-		Windows NT/2000/XP/2003
+		Windows XP/2003/2008
+
+        NOTE:  As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of
+        Windows, including Windows NT and Windows 2000, are no longer
+        supported.

 	Additionally, we have unverified reports of success building
 	previous versions of BIND 9 from users of the following systems:
@@ -465,6 +484,16 @@ Building
 				    -DDIG_SIGCHASE_BU=1)
 		Disable dropping queries from particular well known ports.
 		  -DNS_CLIENT_DROPPORT=0
+		Disable support for "rrset-order fixed".
+		  -DDNS_RDATASET_FIXED=0
+		Sibling glue checking in named-checkzone is enabled by default.
+		To disable the default check set.  -DCHECK_SIBLING=0
+		named-checkzone checks out-of-zone addresses by default.
+		To disable this default set.  -DCHECK_LOCAL=0
+		Enable workaround for Solaris kernel bug about /dev/poll
+		  -DISC_SOCKET_USE_POLLWATCH=1
+		  The watch timeout is also configurable, e.g.,
+		  -DISC_SOCKET_POLLWATCH_TIMEOUT=20

 	    LDFLAGS
 		Linker flags. Defaults to empty string.
@@ -493,6 +522,10 @@ Building
 	To build libbind (the BIND 8 resolver library), specify
 	"--enable-libbind" on the configure command line.

+	On some platforms it is necessary to explictly request large
+	file support to handle files bigger than 2GB.  This can be
+	done by "--enable-largefile" on the configure command line.
+
 	On some platforms, BIND 9 can be built with multithreading
 	support, allowing it to take advantage of multiple CPUs.
 	You can specify whether to build a multithreaded BIND 9 
@@ -542,6 +575,9 @@ Building
 	on your system, and some require Perl; see bin/tests/system/README
 	for details.

+	SunOS 4 requires "printf" to be installed to make the shared
+	libraries.  sh-utils-1.16 provides a "printf" which compiles
+	on SunOS 4.

 Documentation

@@ -577,9 +613,8 @@ Bug Reports and Mailing Lists
 		http://www.isc.org/ops/lists/

 	If you're planning on making changes to the BIND 9 source
-	code, you might want to join the BIND Workers mailing list.
-	Send mail to
-
-		bind-workers-request@isc.org
-
+	code, you might want to join the BIND Forum as a Worker.
+	This gives you access to the bind-workers@isc.org mailing
+	list and pre-release access to the code.

+		http://www.isc.org/sw/guild/bf/
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2002  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,14 +15,13 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: check-tool.c,v 1.10.18.14 2006/06/08 01:43:00 marka Exp $ */
+/* $Id: check-tool.c,v 1.10.18.20 2008/10/24 01:43:17 tbox Exp $ */

 /*! \file */

 #include <config.h>

 #include <stdio.h>
-#include <string.h>

 #include "check-tool.h"
 #include <isc/util.h>
@@ -33,6 +32,7 @@
 #include <isc/netdb.h>
 #include <isc/region.h>
 #include <isc/stdio.h>
+#include <isc/string.h>
 #include <isc/types.h>

 #include <dns/fixedname.h>
@@ -46,6 +46,14 @@

 #include <isccfg/log.h>

+#ifndef CHECK_SIBLING
+#define CHECK_SIBLING 1
+#endif
+
+#ifndef CHECK_LOCAL
+#define CHECK_LOCAL 1
+#endif
+
 #ifdef HAVE_ADDRINFO
 #ifdef HAVE_GETADDRINFO
 #ifdef HAVE_GAISTRERROR
@@ -59,20 +67,29 @@
 		result = (r); \
 		if (result != ISC_R_SUCCESS) \
 			goto cleanup; \
-	} while (0)   
+	} while (0)

 static const char *dbtype[] = { "rbt" };

 int debug = 0;
 isc_boolean_t nomerge = ISC_TRUE;
+#if CHECK_LOCAL
 isc_boolean_t docheckmx = ISC_TRUE;
 isc_boolean_t dochecksrv = ISC_TRUE;
 isc_boolean_t docheckns = ISC_TRUE;
-unsigned int zone_options = DNS_ZONEOPT_CHECKNS | 
+#else
+isc_boolean_t docheckmx = ISC_FALSE;
+isc_boolean_t dochecksrv = ISC_FALSE;
+isc_boolean_t docheckns = ISC_FALSE;
+#endif
+unsigned int zone_options = DNS_ZONEOPT_CHECKNS |
 			    DNS_ZONEOPT_CHECKMX |
 			    DNS_ZONEOPT_MANYERRORS |
 			    DNS_ZONEOPT_CHECKNAMES |
 			    DNS_ZONEOPT_CHECKINTEGRITY |
+#if CHECK_SIBLING
+			    DNS_ZONEOPT_CHECKSIBLING |
+#endif
 			    DNS_ZONEOPT_CHECKWILDCARD |
 			    DNS_ZONEOPT_WARNMXCNAME |
 			    DNS_ZONEOPT_WARNSRVCNAME;
@@ -125,12 +142,21 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
 	if (dns_name_countlabels(name) > 1U)
 		strcat(namebuf, ".");
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
-	
+
 	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	switch (result) {
 	case 0:
-		if (strcasecmp(ai->ai_canonname, namebuf) != 0) {
+		/*
+		 * Work around broken getaddrinfo() implementations that
+		 * fail to set ai_canonname on first entry.
+		 */
+		cur = ai;
+		while (cur != NULL && cur->ai_canonname == NULL &&
+		       cur->ai_next != NULL)
+			cur = cur->ai_next;
+		if (cur != NULL && cur->ai_canonname != NULL &&
+		    strcasecmp(ai->ai_canonname, namebuf) != 0) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "%s/NS '%s' (out of zone) "
 				     "is a CNAME (illegal)",
@@ -268,7 +294,7 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
 static isc_boolean_t
 checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 #ifdef USE_GETADDRINFO
-	struct addrinfo hints, *ai;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	int result;
@@ -288,12 +314,21 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 	if (dns_name_countlabels(name) > 1U)
 		strcat(namebuf, ".");
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
-	
+
 	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	switch (result) {
 	case 0:
-		if (strcasecmp(ai->ai_canonname, namebuf) != 0) {
+		/*
+		 * Work around broken getaddrinfo() implementations that
+		 * fail to set ai_canonname on first entry.
+		 */
+		cur = ai;
+		while (cur != NULL && cur->ai_canonname == NULL &&
+		       cur->ai_next != NULL)
+			cur = cur->ai_next;
+		if (cur != NULL && cur->ai_canonname != NULL &&
+		    strcasecmp(cur->ai_canonname, namebuf) != 0) {
 			if ((zone_options & DNS_ZONEOPT_WARNMXCNAME) != 0)
 				level = ISC_LOG_WARNING;
 			if ((zone_options & DNS_ZONEOPT_IGNOREMXCNAME) == 0) {
@@ -332,7 +367,7 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 static isc_boolean_t
 checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 #ifdef USE_GETADDRINFO
-	struct addrinfo hints, *ai;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	int result;
@@ -352,12 +387,21 @@ checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
 	if (dns_name_countlabels(name) > 1U)
 		strcat(namebuf, ".");
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
-	
+
 	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	switch (result) {
 	case 0:
-		if (strcasecmp(ai->ai_canonname, namebuf) != 0) {
+		/*
+		 * Work around broken getaddrinfo() implementations that
+		 * fail to set ai_canonname on first entry.
+		 */
+		cur = ai;
+		while (cur != NULL && cur->ai_canonname == NULL &&
+		       cur->ai_next != NULL)
+			cur = cur->ai_next;
+		if (cur != NULL && cur->ai_canonname != NULL &&
+		    strcasecmp(cur->ai_canonname, namebuf) != 0) {
 			if ((zone_options & DNS_ZONEOPT_WARNSRVCNAME) != 0)
 				level = ISC_LOG_WARNING;
 			if ((zone_options & DNS_ZONEOPT_IGNORESRVCNAME) == 0) {
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named-checkconf.8,v 1.16.18.10 2006/12/12 01:44:27 marka Exp $
+.\" $Id: named-checkconf.8,v 1.16.18.13 2007/06/20 02:26:58 marka Exp $
 .\"
 .hy 0
 .ad l
@@ -42,7 +42,7 @@ checks the syntax, but not the semantics, of a named configuration file.
 .PP
 \-t \fIdirectory\fR
 .RS 4
-chroot to
+Chroot to
 \fIdirectory\fR
 so that include directives in the configuration file are processed as if run by a similarly chrooted named.
 .RE
@@ -56,7 +56,7 @@ program and exit.
 .PP
 \-z
 .RS 4
-Perform a check load the master zonefiles found in
+Perform a test load of all master zones found in
 \fInamed.conf\fR.
 .RE
 .PP
@@ -77,12 +77,13 @@ returns an exit status of 1 if errors were detected and 0 otherwise.
 .SH "SEE ALSO"
 .PP
 \fBnamed\fR(8),
+\fBnamed\-checkzone\fR(8),
 BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2002 Internet Software Consortium.
 .br
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named-checkconf.c,v 1.28.18.14 2006/02/28 03:10:47 marka Exp $ */
+/* $Id: named-checkconf.c,v 1.28.18.16 2007/11/26 23:46:18 tbox Exp $ */

 /*! \file */

@@ -224,7 +224,8 @@ configure_zone(const char *vclass, const char *view,
 			zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
 		else
 			zone_options &= ~DNS_ZONEOPT_CHECKINTEGRITY;
-	}
+	} else
+		zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;

 	obj = NULL;
 	if (get_maps(maps, "check-mx-cname", &obj)) {
@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: named-checkconf.docbook,v 1.8.18.5 2005/07/19 05:55:41 marka Exp $ -->
+<!-- $Id: named-checkconf.docbook,v 1.8.18.10 2007/08/28 07:19:55 tbox Exp $ -->
 <refentry id="man.named-checkconf">
  <refentryinfo>
    <date>June 14, 2000</date>
@@ -34,6 +34,7 @@
    <copyright>
      <year>2004</year>
      <year>2005</year>
+      <year>2007</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -76,7 +77,7 @@
        <term>-t <replaceable class="parameter">directory</replaceable></term>
        <listitem>
          <para>
-            chroot to <filename>directory</filename> so that
+            Chroot to <filename>directory</filename> so that
            include
            directives in the configuration file are processed as if
            run by a similarly chrooted named.
@@ -98,8 +99,8 @@
        <term>-z</term>
        <listitem>
          <para>
-            Perform a check load the master zonefiles found in
-            <filename>named.conf</filename>.
+	    Perform a test load of all master zones found in
+	    <filename>named.conf</filename>.
          </para>
        </listitem>
      </varlistentry>
@@ -140,6 +141,9 @@
    <para><citerefentry>
        <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>named-checkzone</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry>,
      <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
    </para>
  </refsect1>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named-checkconf.html,v 1.9.18.16 2006/12/12 01:44:27 marka Exp $ -->
+<!-- $Id: named-checkconf.html,v 1.9.18.20 2007/06/20 02:26:58 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,18 +32,18 @@
 <div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-z</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543570"></a><h2>DESCRIPTION</h2>
+<a name="id2543383"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
      checks the syntax, but not the semantics, of a named
      configuration file.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543581"></a><h2>OPTIONS</h2>
+<a name="id2543395"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            chroot to <code class="filename">directory</code> so that
+            Chroot to <code class="filename">directory</code> so that
            include
            directives in the configuration file are processed as if
            run by a similarly chrooted named.
@@ -55,8 +55,8 @@
          </p></dd>
 <dt><span class="term">-z</span></dt>
 <dd><p>
-            Perform a check load the master zonefiles found in
-            <code class="filename">named.conf</code>.
+	    Perform a test load of all master zones found in
+	    <code class="filename">named.conf</code>.
          </p></dd>
 <dt><span class="term">-j</span></dt>
 <dd><p>
@@ -70,20 +70,21 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543674"></a><h2>RETURN VALUES</h2>
+<a name="id2543489"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkconf</strong></span>
      returns an exit status of 1 if
      errors were detected and 0 otherwise.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543686"></a><h2>SEE ALSO</h2>
+<a name="id2543500"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543707"></a><h2>AUTHOR</h2>
+<a name="id2543530"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named-checkzone.8,v 1.18.18.19 2006/12/12 01:44:27 marka Exp $
+.\" $Id: named-checkzone.8,v 1.18.18.23 2007/06/20 02:26:58 marka Exp $
 .\"
 .hy 0
 .ad l
@@ -48,7 +48,7 @@ useful for checking zone files before configuring them into a name server.
 \fBnamed\-compilezone\fR
 is similar to
 \fBnamed\-checkzone\fR, but it always dumps the zone contents to a specified file in a specified format. Additionally, it applies stricter check levels by default, since the dump output will be used as an actual zone file loaded by
-\fBnamed\fR. When manaully specified otherwise, the check levels must at least be as strict as those specified in the
+\fBnamed\fR. When manually specified otherwise, the check levels must at least be as strict as those specified in the
 \fBnamed\fR
 configuration file.
 .SH "OPTIONS"
@@ -82,7 +82,7 @@ Specify the class of the zone. If not specified "IN" is assumed.
 .PP
 \-i \fImode\fR
 .RS 4
-Perform post load zone integrity checks. Possible modes are
+Perform post\-load zone integrity checks. Possible modes are
 \fB"full"\fR
 (default),
 \fB"full\-sibling"\fR,
@@ -105,7 +105,7 @@ only checks SRV records which refer to in\-zone hostnames.
 .sp
 Mode
 \fB"full"\fR
-checks that delegation NS records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames). It also checks that glue addresses records in the zone match those advertised by the child. Mode
+checks that delegation NS records refer to A or AAAA record (both in\-zone and out\-of\-zone hostnames). It also checks that glue address records in the zone match those advertised by the child. Mode
 \fB"local"\fR
 only checks NS records which refer to in\-zone hostnames or that some required glue exists, that is when the nameserver is in a child zone.
 .sp
@@ -213,7 +213,7 @@ Check if a SRV record refers to a CNAME. Possible modes are
 .PP
 \-t \fIdirectory\fR
 .RS 4
-chroot to
+Chroot to
 \fIdirectory\fR
 so that include directives in the configuration file are processed as if run by a similarly chrooted named.
 .RE
@@ -256,13 +256,14 @@ returns an exit status of 1 if errors were detected and 0 otherwise.
 .SH "SEE ALSO"
 .PP
 \fBnamed\fR(8),
+\fBnamed\-checkconf\fR(8),
 RFC 1035,
 BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2006 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2002 Internet Software Consortium.
 .br
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named-checkzone.c,v 1.29.18.16 2006/10/05 05:24:35 marka Exp $ */
+/* $Id: named-checkzone.c,v 1.29.18.21 2008/10/24 01:43:17 tbox Exp $ */

 /*! \file */

@@ -77,8 +77,9 @@ usage(void) {
 		"[-f inputformat] [-F outputformat] "
 		"[-t directory] [-w directory] [-k (ignore|warn|fail)] "
 		"[-n (ignore|warn|fail)] [-m (ignore|warn|fail)] "
-		"[-i (full|local|none)] [-M (ignore|warn|fail)] "
-		"[-S (ignore|warn|fail)] [-W (ignore|warn)] "
+		"[-i (full|full-sibling|local|local-sibling|none)] "
+		"[-M (ignore|warn|fail)] [-S (ignore|warn|fail)] "
+		"[-W (ignore|warn)] "
 		"zonename filename\n", prog_name);
 	exit(1);
 }
@@ -109,6 +110,8 @@ main(int argc, char **argv) {
 	outputstyle = &dns_master_style_full;

 	prog_name = strrchr(argv[0], '/');
+	if (prog_name == NULL)
+		prog_name = strrchr(argv[0], '\\');
 	if (prog_name != NULL)
 		prog_name++;
 	else
@@ -225,7 +228,7 @@ main(int argc, char **argv) {
 				zone_options &= ~DNS_ZONEOPT_FATALNS;
 			} else if (ARGCMP("fail")) {
 				zone_options |= DNS_ZONEOPT_CHECKNS|
-					        DNS_ZONEOPT_FATALNS;
+						DNS_ZONEOPT_FATALNS;
 			} else {
 				fprintf(stderr, "invalid argument to -n: %s\n",
 					isc_commandline_argument);
@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: named-checkzone.docbook,v 1.11.18.15 2006/09/29 06:33:00 marka Exp $ -->
+<!-- $Id: named-checkzone.docbook,v 1.11.18.21 2007/08/28 07:19:55 tbox Exp $ -->
 <refentry id="man.named-checkzone">
  <refentryinfo>
    <date>June 13, 2000</date>
@@ -35,6 +35,7 @@
      <year>2004</year>
      <year>2005</year>
      <year>2006</year>
+      <year>2007</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -116,7 +117,7 @@
 	Additionally, it applies stricter check levels by default,
        since the dump output will be used as an actual zone file
 	loaded by <command>named</command>.
-	When manaully specified otherwise, the check levels must at
+	When manually specified otherwise, the check levels must at
        least be as strict as those specified in the
 	<command>named</command> configuration file.
     </para>
@@ -176,7 +177,7 @@
        <term>-i <replaceable class="parameter">mode</replaceable></term>
 	<listitem>
 	  <para>
-	      Perform post load zone integrity checks.  Possible modes are
+	      Perform post-load zone integrity checks.  Possible modes are
 	      <command>"full"</command> (default),
 	      <command>"full-sibling"</command>,
 	      <command>"local"</command>,
@@ -198,7 +199,7 @@
 	  <para>
 	      Mode <command>"full"</command> checks that delegation NS
 	      records refer to A or AAAA record (both in-zone and out-of-zone
-	      hostnames).  It also checks that glue addresses records
+	      hostnames).  It also checks that glue address records
 	      in the zone match those advertised by the child.
 	      Mode <command>"local"</command> only checks NS records which
 	      refer to in-zone hostnames or that some required glue exists,
@@ -341,7 +342,7 @@
        <term>-t <replaceable class="parameter">directory</replaceable></term>
        <listitem>
          <para>
-            chroot to <filename>directory</filename> so that
+            Chroot to <filename>directory</filename> so that
            include
            directives in the configuration file are processed as if
            run by a similarly chrooted named.
@@ -421,6 +422,9 @@
    <para><citerefentry>
        <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>named-checkconf</refentrytitle><manvolnum>8</manvolnum>  
+      </citerefentry>,
      <citetitle>RFC 1035</citetitle>,
      <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
    </para>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named-checkzone.html,v 1.11.18.25 2006/12/12 01:44:27 marka Exp $ -->
+<!-- $Id: named-checkzone.html,v 1.11.18.30 2007/06/20 02:26:58 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -33,7 +33,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-compilezone</code>  [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543851"></a><h2>DESCRIPTION</h2>
+<a name="id2543665"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
      checks the syntax and integrity of a zone file.  It performs the
      same checks as <span><strong class="command">named</strong></span> does when loading a
@@ -47,13 +47,13 @@
 	Additionally, it applies stricter check levels by default,
        since the dump output will be used as an actual zone file
 	loaded by <span><strong class="command">named</strong></span>.
-	When manaully specified otherwise, the check levels must at
+	When manually specified otherwise, the check levels must at
        least be as strict as those specified in the
 	<span><strong class="command">named</strong></span> configuration file.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543886"></a><h2>OPTIONS</h2>
+<a name="id2543700"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-d</span></dt>
 <dd><p>
@@ -79,7 +79,7 @@
 <dt><span class="term">-i <em class="replaceable"><code>mode</code></em></span></dt>
 <dd>
 <p>
-	      Perform post load zone integrity checks.  Possible modes are
+	      Perform post-load zone integrity checks.  Possible modes are
 	      <span><strong class="command">"full"</strong></span> (default),
 	      <span><strong class="command">"full-sibling"</strong></span>,
 	      <span><strong class="command">"local"</strong></span>,
@@ -101,7 +101,7 @@
 <p>
 	      Mode <span><strong class="command">"full"</strong></span> checks that delegation NS
 	      records refer to A or AAAA record (both in-zone and out-of-zone
-	      hostnames).  It also checks that glue addresses records
+	      hostnames).  It also checks that glue address records
 	      in the zone match those advertised by the child.
 	      Mode <span><strong class="command">"local"</strong></span> only checks NS records which
 	      refer to in-zone hostnames or that some required glue exists,
@@ -195,7 +195,7 @@
 	  </p></dd>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
-            chroot to <code class="filename">directory</code> so that
+            Chroot to <code class="filename">directory</code> so that
            include
            directives in the configuration file are processed as if
            run by a similarly chrooted named.
@@ -233,21 +233,22 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544486"></a><h2>RETURN VALUES</h2>
+<a name="id2544299"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
      returns an exit status of 1 if
      errors were detected and 0 otherwise.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544498"></a><h2>SEE ALSO</h2>
+<a name="id2544311"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
      <em class="citetitle">RFC 1035</em>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544522"></a><h2>AUTHOR</h2>
+<a name="id2544344"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dig.1,v 1.23.18.18 2006/12/19 01:35:40 marka Exp $
+.\" $Id: dig.1,v 1.23.18.24 2008/10/14 01:30:11 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -33,7 +33,7 @@
 dig \- DNS lookup utility
 .SH "SYNOPSIS"
 .HP 4
-\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...]
+\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-m\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...]
 .HP 4
 \fBdig\fR [\fB\-h\fR]
 .HP 4
@@ -50,7 +50,7 @@ Although
 \fBdig\fR
 is normally used with command\-line arguments, it also has a batch mode of operation for reading lookup requests from a file. A brief summary of its command\-line arguments and options is printed when the
 \fB\-h\fR
-option is given. Unlike earlier versions, the BIND9 implementation of
+option is given. Unlike earlier versions, the BIND 9 implementation of
 \fBdig\fR
 allows multiple lookups to be issued from the command line.
 .PP
@@ -59,7 +59,9 @@ Unless it is told to query a specific name server,
 will try each of the servers listed in
 \fI/etc/resolv.conf\fR.
 .PP
-When no command line arguments or options are given, will perform an NS query for "." (the root).
+When no command line arguments or options are given,
+\fBdig\fR
+will perform an NS query for "." (the root).
 .PP
 It is possible to set per\-user defaults for
 \fBdig\fR
@@ -70,9 +72,9 @@ The IN and CH class names overlap with the IN and CH top level domains names. Ei
 \fB\-t\fR
 and
 \fB\-c\fR
-options to specify the type and class or use the
+options to specify the type and class, use the
 \fB\-q\fR
-the specify the domain name or use "IN." and "CH." when looking up these top level domains.
+the specify the domain name, or use "IN." and "CH." when looking up these top level domains.
 .SH "SIMPLE USAGE"
 .PP
 A typical invocation of
@@ -128,17 +130,21 @@ The default query class (IN for internet) is overridden by the
 \fB\-c\fR
 option.
 \fIclass\fR
-is any valid class, such as HS for Hesiod records or CH for CHAOSNET records.
+is any valid class, such as HS for Hesiod records or CH for Chaosnet records.
 .PP
 The
 \fB\-f\fR
 option makes
 \fBdig \fR
 operate in batch mode by reading a list of lookup requests to process from the file
-\fIfilename\fR. The file contains a number of queries, one per line. Each entry in the file should be organised in the same way they would be presented as queries to
+\fIfilename\fR. The file contains a number of queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to
 \fBdig\fR
 using the command\-line interface.
 .PP
+The
+\fB\-m\fR
+option enables memory usage debugging.
+.PP
 If a non\-standard port number is to be queried, the
 \fB\-p\fR
 option is used.
@@ -160,7 +166,7 @@ to only use IPv6 query transport.
 The
 \fB\-t\fR
 option sets the query type to
-\fItype\fR. It can be any valid query type which is supported in BIND9. The default query type "A", unless the
+\fItype\fR. It can be any valid query type which is supported in BIND 9. The default query type is "A", unless the
 \fB\-x\fR
 option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required,
 \fItype\fR
@@ -171,11 +177,11 @@ ixfr=N. The incremental zone transfer will contain the changes made to the zone
 The
 \fB\-q\fR
 option sets the query name to
-\fIname\fR. This useful do distingish the
+\fIname\fR. This useful do distinguish the
 \fIname\fR
 from other arguments.
 .PP
-Reverse lookups \- mapping addresses to names \- are simplified by the
+Reverse lookups \(em mapping addresses to names \(em are simplified by the
 \fB\-x\fR
 option.
 \fIaddr\fR
@@ -228,7 +234,7 @@ to negate the meaning of that keyword. Other keywords assign values to options l
 .PP
 \fB+[no]tcp\fR
 .RS 4
-Use [do not use] TCP when querying name servers. The default behaviour is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used.
+Use [do not use] TCP when querying name servers. The default behavior is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used.
 .RE
 .PP
 \fB+[no]vc\fR
@@ -330,7 +336,7 @@ makes iterative queries to resolve the name being looked up. It will follow refe
 .PP
 \fB+[no]cmd\fR
 .RS 4
-toggles the printing of the initial comment in the output identifying the version of
+Toggles the printing of the initial comment in the output identifying the version of
 \fBdig\fR
 and the query options that have been applied. This comment is printed by default.
 .RE
@@ -354,7 +360,7 @@ Toggle the display of comment lines in the output. The default is to print comme
 .PP
 \fB+[no]stats\fR
 .RS 4
-This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behaviour is to print the query statistics.
+This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behavior is to print the query statistics.
 .RE
 .PP
 \fB+[no]qr\fR
@@ -391,7 +397,7 @@ Set or clear all display flags.
 .RS 4
 Sets the timeout for a query to
 \fIT\fR
-seconds. The default time out is 5 seconds. An attempt to set
+seconds. The default timeout is 5 seconds. An attempt to set
 \fIT\fR
 to less than 1 will result in a query timeout of 1 second being applied.
 .RE
@@ -451,7 +457,7 @@ output.
 .PP
 \fB+[no]fail\fR
 .RS 4
-Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behaviour.
+Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behavior.
 .RE
 .PP
 \fB+[no]besteffort\fR
@@ -487,7 +493,7 @@ Requires dig be compiled with \-DDIG_SIGCHASE.
 .PP
 \fB+[no]topdown\fR
 .RS 4
-When chasing DNSSEC signature chains perform a top down validation. Requires dig be compiled with \-DDIG_SIGCHASE.
+When chasing DNSSEC signature chains perform a top\-down validation. Requires dig be compiled with \-DDIG_SIGCHASE.
 .RE
 .SH "MULTIPLE QUERIES"
 .PP
@@ -551,7 +557,7 @@ RFC1035.
 .PP
 There are probably too many query options.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2006 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dig.c,v 1.186.18.26 2006/07/21 23:52:21 marka Exp $ */
+/* $Id: dig.c,v 1.186.18.33 2008/10/15 02:19:18 marka Exp $ */

 /*! \file */

@@ -50,7 +50,7 @@

 #define ADD_STRING(b, s) { 				\
 	if (strlen(s) >= isc_buffer_availablelength(b)) \
- 		return (ISC_R_NOSPACE); 		\
+		return (ISC_R_NOSPACE); 		\
 	else 						\
 		isc_buffer_putstr(b, s); 		\
 }
@@ -71,7 +71,7 @@ static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE,
 	multiline = ISC_FALSE, nottl = ISC_FALSE, noclass = ISC_FALSE;

 /*% opcode text */
-static const char *opcodetext[] = {
+static const char * const opcodetext[] = {
 	"QUERY",
 	"IQUERY",
 	"STATUS",
@@ -91,7 +91,7 @@ static const char *opcodetext[] = {
 };

 /*% return code text */
-static const char *rcodetext[] = {
+static const char * const rcodetext[] = {
 	"NOERROR",
 	"FORMERR",
 	"SERVFAIL",
@@ -144,8 +144,8 @@ help(void) {
 "        q-type   is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n"
 "                 (Use ixfr=version for type ixfr)\n"
 "        q-opt    is one of:\n"
-"                 -x dot-notation     (shortcut for in-addr lookups)\n"
-"                 -i                  (IP6.INT reverse IPv6 lookups)\n"
+"                 -x dot-notation     (shortcut for reverse lookups)\n"
+"                 -i                  (use IP6.INT for IPv6 reverse lookups)\n"
 "                 -f filename         (batch mode)\n"
 "                 -b address[#port]   (bind to source address/port)\n"
 "                 -p port             (specify port number)\n"
@@ -156,6 +156,7 @@ help(void) {
 "                 -y [hmac:]name:key  (specify named base64 tsig key)\n"
 "                 -4                  (use IPv4 query transport only)\n"
 "                 -6                  (use IPv6 query transport only)\n"
+"                 -m                  (enable memory usage debugging)\n"
 "        d-opt    is of the form +keyword[=value], where keyword is:\n"
 "                 +[no]vc             (TCP mode)\n"
 "                 +[no]tcp            (TCP mode, alternate syntax)\n"
@@ -383,7 +384,7 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,
 	else if (nottl || noclass)
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 32, 40, 80, 8, mctx);
-	else 
+	else
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 32, 40, 48, 80, 8, mctx);
 	check_result(result, "dns_master_stylecreate");
@@ -392,7 +393,7 @@ printrdataset(dns_name_t *owner_name, dns_rdataset_t *rdataset,

 	if (style != NULL)
 		dns_master_styledestroy(&style, mctx);
-  
+
 	return(result);
 }
 #endif
@@ -429,7 +430,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	else if (nottl || noclass)
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 24, 32, 40, 80, 8, mctx);
-	else 
+	else
 		result = dns_master_stylecreate(&style, styleflags,
 						24, 32, 40, 48, 80, 8, mctx);
 	check_result(result, "dns_master_stylecreate");
@@ -638,7 +639,7 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 			strncat(lookup->cmdline, append, remaining);
 		}
 		if (first) {
-			snprintf(append, sizeof(append), 
+			snprintf(append, sizeof(append),
 				 ";; global options: %s %s\n",
 			       short_form ? "short_form" : "",
 			       printcmd ? "printcmd" : "");
@@ -650,42 +651,6 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 	}
 }

-/*%
- * Reorder an argument list so that server names all come at the end.
- * This is a bit of a hack, to allow batch-mode processing to properly
- * handle the server options.
- */
-static void
-reorder_args(int argc, char *argv[]) {
-	int i, j;
-	char *ptr;
-	int end;
-
-	debug("reorder_args()");
-	end = argc - 1;
-	while (argv[end][0] == '@') {
-		end--;
-		if (end == 0)
-			return;
-	}
-	debug("arg[end]=%s", argv[end]);
-	for (i = 1; i < end - 1; i++) {
-		if (argv[i][0] == '@') {
-			debug("arg[%d]=%s", i, argv[i]);
-			ptr = argv[i];
-			for (j = i + 1; j < end; j++) {
-				debug("Moving %s to %d", argv[j], j - 1);
-				argv[j - 1] = argv[j];
-			}
-			debug("moving %s to end, %d", ptr, end - 1);
-			argv[end - 1] = ptr;
-			end--;
-			if (end < 1)
-				return;
-		}
-	}
-}
-
 static isc_uint32_t
 parse_uint(char *arg, const char *desc, isc_uint32_t max) {
 	isc_result_t result;
@@ -752,7 +717,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			FULLCHECK2("aaonly", "aaflag");
 			lookup->aaonly = state;
 			break;
-		case 'd': 
+		case 'd':
 			switch (cmd[2]) {
 			case 'd': /* additional */
 				FULLCHECK("additional");
@@ -837,13 +802,13 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			FULLCHECK("defname");
 			usesearch = state;
 			break;
-		case 'n': /* dnssec */	
+		case 'n': /* dnssec */
 			FULLCHECK("dnssec");
 			if (state && lookup->edns == -1)
 				lookup->edns = 0;
 			lookup->dnssec = state;
 			break;
-		case 'o': /* domain */	
+		case 'o': /* domain */
 			FULLCHECK("domain");
 			if (value == NULL)
 				goto need_value;
@@ -917,7 +882,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			goto invalid_option;
 		}
 		break;
-	case 'q': 
+	case 'q':
 		switch (cmd[1]) {
 		case 'r': /* qr */
 			FULLCHECK("qr");
@@ -993,11 +958,11 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			break;
 #ifdef DIG_SIGCHASE
 		case 'i': /* sigchase */
-		        FULLCHECK("sigchase");
+			FULLCHECK("sigchase");
 			lookup->sigchase = state;
 			if (lookup->sigchase)
 				lookup->dnssec = ISC_TRUE;
-			break;	
+			break;
 #endif
 		case 't': /* stats */
 			FULLCHECK("stats");
@@ -1025,7 +990,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 				timeout = 1;
 			break;
 #if DIG_SIGCHASE_TD
-		case 'o': /* topdown */	
+		case 'o': /* topdown */
 			FULLCHECK("topdown");
 			lookup->do_topdown = state;
 			break;
@@ -1060,7 +1025,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 #ifdef DIG_SIGCHASE
 			case 'u': /* trusted-key */
 				FULLCHECK("trusted-key");
-			  	if (value == NULL) 
+				if (value == NULL)
 					goto need_value;
 				if (!state)
 					goto invalid_option;
@@ -1104,7 +1069,9 @@ static const char *single_dash_opts = "46dhimnv";
 static const char *dash_opts = "46bcdfhikmnptvyx";
 static isc_boolean_t
 dash_option(char *option, char *next, dig_lookup_t **lookup,
-	    isc_boolean_t *open_type_class, isc_boolean_t config_only)
+	    isc_boolean_t *open_type_class, isc_boolean_t *need_clone,
+	    isc_boolean_t config_only, int argc, char **argv,
+	    isc_boolean_t *firstarg)
 {
 	char opt, *value, *ptr, *ptr2, *ptr3;
 	isc_result_t result;
@@ -1192,7 +1159,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		hash = strchr(value, '#');
 		if (hash != NULL) {
 			srcport = (in_port_t)
-			  	parse_uint(hash + 1,
+				parse_uint(hash + 1,
 					   "port number", MAXPORT);
 			*hash = '\0';
 		} else
@@ -1241,14 +1208,20 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		return (value_from_next);
 	case 'q':
 		if (!config_only) {
-			(*lookup) = clone_lookup(default_lookup,
-					         ISC_TRUE);
-			strncpy((*lookup)->textname, value, 
+			if (*need_clone)
+				(*lookup) = clone_lookup(default_lookup,
+							 ISC_TRUE);
+			*need_clone = ISC_TRUE;
+			strncpy((*lookup)->textname, value,
 				sizeof((*lookup)->textname));
 			(*lookup)->textname[sizeof((*lookup)->textname)-1]=0;
 			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
 						     (*lookup)->ns_search_only);
 			(*lookup)->new_search = ISC_TRUE;
+			if (*firstarg) {
+				printgreeting(argc, argv, *lookup);
+				*firstarg = ISC_FALSE;
+			}
 			ISC_LIST_APPEND(lookup_list, (*lookup), link);
 			debug("looking up %s", (*lookup)->textname);
 		}
@@ -1278,7 +1251,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				(*lookup)->rdtypeset = ISC_TRUE;
 				(*lookup)->ixfr_serial =
 					parse_uint(&value[5], "serial number",
-					  	MAXSERIAL);
+						MAXSERIAL);
 				(*lookup)->section_question = plusquest;
 				(*lookup)->comments = pluscomm;
 			} else {
@@ -1304,7 +1277,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (ptr2 == NULL)
 			usage();
 		ptr3 = next_token(&value,":"); /* secret or NULL */
-		if (ptr3 != NULL) {	
+		if (ptr3 != NULL) {
 			if (strcasecmp(ptr, "hmac-md5") == 0) {
 				hmacname = DNS_TSIG_HMACMD5_NAME;
 				digestbits = 0;
@@ -1376,7 +1349,9 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		keysecret[sizeof(keysecret)-1]=0;
 		return (value_from_next);
 	case 'x':
-		*lookup = clone_lookup(default_lookup, ISC_TRUE);
+		if (*need_clone)
+			*lookup = clone_lookup(default_lookup, ISC_TRUE);
+		*need_clone = ISC_TRUE;
 		if (get_reverse(textname, sizeof(textname), value,
 				ip6_int, ISC_FALSE) == ISC_R_SUCCESS) {
 			strncpy((*lookup)->textname, textname,
@@ -1390,6 +1365,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			if (!(*lookup)->rdclassset)
 				(*lookup)->rdclass = dns_rdataclass_in;
 			(*lookup)->new_search = ISC_TRUE;
+			if (*firstarg) {
+				printgreeting(argc, argv, *lookup);
+				*firstarg = ISC_FALSE;
+			}
 			ISC_LIST_APPEND(lookup_list, *lookup, link);
 		} else {
 			fprintf(stderr, "Invalid IP address %s\n", value);
@@ -1447,7 +1426,7 @@ getaddresses(dig_lookup_t *lookup, const char *host) {
 	char tmp[ISC_NETADDR_FORMATSIZE];

 	result = bind9_getaddresses(host, 0, sockaddrs,
-				    DIG_MAX_ADDRESSES, &count);   
+				    DIG_MAX_ADDRESSES, &count);
 	if (result != ISC_R_SUCCESS)
 	fatal("couldn't get address for '%s': %s",
 	      host, isc_result_totext(result));
@@ -1481,6 +1460,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 	char rcfile[256];
 #endif
 	char *input;
+	int i;
+	isc_boolean_t need_clone = ISC_TRUE;

 	/*
 	 * The semantics for parsing the args is a bit complex; if
@@ -1507,7 +1488,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		if (homedir != NULL) {
 			unsigned int n;
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
-			             homedir);
+				     homedir);
 			if (n < sizeof(rcfile))
 				batchfp = fopen(rcfile, "r");
 		}
@@ -1528,7 +1509,9 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 				bargv[0] = argv[0];
 				argv0 = argv[0];

-				reorder_args(bargc, (char **)bargv);
+				for(i = 0; i < bargc; i++)
+					debug(".digrc argv %d: %s",
+					      i, bargv[i]);
 				parse_args(ISC_TRUE, ISC_TRUE, bargc,
 					   (char **)bargv);
 			}
@@ -1537,7 +1520,12 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 #endif
 	}

-	lookup = default_lookup;
+	if (is_batchfile && !config_only) {
+		/* Processing '-f batchfile'. */
+		lookup = clone_lookup(default_lookup, ISC_TRUE);
+		need_clone = ISC_FALSE;
+	} else
+		lookup = default_lookup;

 	rc = argc;
 	rv = argv;
@@ -1554,14 +1542,16 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			if (rc <= 1) {
 				if (dash_option(&rv[0][1], NULL,
 						&lookup, &open_type_class,
-						config_only)) {
+						&need_clone, config_only,
+						argc, argv, &firstarg)) {
 					rc--;
 					rv++;
 				}
 			} else {
 				if (dash_option(&rv[0][1], rv[1],
 						&lookup, &open_type_class,
-						config_only)) {
+						&need_clone, config_only,
+						argc, argv, &firstarg)) {
 					rc--;
 					rv++;
 				}
@@ -1578,7 +1568,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 					tr.base = rv[0];
 					tr.length = strlen(rv[0]);
 					result = dns_rdatatype_fromtext(&rdtype,
-					     	(isc_textregion_t *)&tr);
+						(isc_textregion_t *)&tr);
 					if (result == ISC_R_SUCCESS &&
 					    rdtype == dns_rdatatype_ixfr) {
 						result = DNS_R_UNKNOWN;
@@ -1599,8 +1589,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 						lookup->rdtypeset = ISC_TRUE;
 						lookup->ixfr_serial =
 							parse_uint(&rv[0][5],
-							  	"serial number",
-							  	MAXSERIAL);
+								"serial number",
+								MAXSERIAL);
 						lookup->section_question =
 							plusquest;
 						lookup->comments = pluscomm;
@@ -1629,21 +1619,29 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 					continue;
 				}
 			}
+
 			if (!config_only) {
-				lookup = clone_lookup(default_lookup,
-						      ISC_TRUE);
-				strncpy(lookup->textname, rv[0], 
+				if (need_clone)
+					lookup = clone_lookup(default_lookup,
+								      ISC_TRUE);
+				need_clone = ISC_TRUE;
+				strncpy(lookup->textname, rv[0],
 					sizeof(lookup->textname));
 				lookup->textname[sizeof(lookup->textname)-1]=0;
 				lookup->trace_root = ISC_TF(lookup->trace  ||
 						     lookup->ns_search_only);
 				lookup->new_search = ISC_TRUE;
+				if (firstarg) {
+					printgreeting(argc, argv, lookup);
+					firstarg = ISC_FALSE;
+				}
 				ISC_LIST_APPEND(lookup_list, lookup, link);
 				debug("looking up %s", lookup->textname);
 			}
 			/* XXX Error message */
 		}
 	}
+
 	/*
 	 * If we have a batchfile, seed the lookup list with the
 	 * first entry, then trust the callback in dighost_shutdown
@@ -1678,15 +1676,20 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			bargv[0] = argv[0];
 			argv0 = argv[0];

-			reorder_args(bargc, (char **)bargv);
+			for(i = 0; i < bargc; i++)
+				debug("batch argv %d: %s", i, bargv[i]);
 			parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
+			return;
 		}
+		return;
 	}
 	/*
 	 * If no lookup specified, search for root
 	 */
 	if ((lookup_list.head == NULL) && !config_only) {
-		lookup = clone_lookup(default_lookup, ISC_TRUE);
+		if (need_clone)
+			lookup = clone_lookup(default_lookup, ISC_TRUE);
+		need_clone = ISC_TRUE;
 		lookup->trace_root = ISC_TF(lookup->trace ||
 					    lookup->ns_search_only);
 		lookup->new_search = ISC_TRUE;
@@ -1698,10 +1701,9 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			firstarg = ISC_FALSE;
 		}
 		ISC_LIST_APPEND(lookup_list, lookup, link);
-	} else if (!config_only && firstarg) {
-			printgreeting(argc, argv, lookup);
-			firstarg = ISC_FALSE;
 	}
+	if (!need_clone)
+		destroy_lookup(lookup);
 }

 /*
@@ -1715,7 +1717,7 @@ dighost_shutdown(void) {
 	int bargc;
 	char *bargv[16];
 	char *input;
-
+	int i;

 	if (batchname == NULL) {
 		isc_app_shutdown();
@@ -1743,7 +1745,8 @@ dighost_shutdown(void) {

 		bargv[0] = argv0;

-		reorder_args(bargc, (char **)bargv);
+		for(i = 0; i < bargc; i++)
+			debug("batch argv %d: %s", i, bargv[i]);
 		parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 		start_lookup();
 	} else {
@@ -1759,7 +1762,6 @@ dighost_shutdown(void) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
-	dig_server_t *s, *s2;

 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
@@ -1780,16 +1782,7 @@ main(int argc, char **argv) {
 	result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
 	check_result(result, "isc_app_onrun");
 	isc_app_run();
-	s = ISC_LIST_HEAD(default_lookup->my_server_list);
-	while (s != NULL) {
-		debug("freeing server %p belonging to %p",
-		      s, default_lookup);
-		s2 = s;
-		s = ISC_LIST_NEXT(s, link);
-		ISC_LIST_DEQUEUE(default_lookup->my_server_list, s2, link);
-		isc_mem_free(mctx, s2);
-	}
-	isc_mem_free(mctx, default_lookup);
+	destroy_lookup(default_lookup);
 	if (batchname != NULL) {
 		if (batchfp != stdin)
 			fclose(batchfp);
@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: dig.docbook,v 1.17.18.15 2006/12/18 23:37:34 marka Exp $ -->
+<!-- $Id: dig.docbook,v 1.17.18.24 2008/10/14 00:54:40 marka Exp $ -->
 <refentry id="man.dig">

  <refentryinfo>
@@ -41,6 +41,8 @@
      <year>2004</year>
      <year>2005</year>
      <year>2006</year>
+      <year>2007</year>
+      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -60,6 +62,7 @@
      <arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
      <arg><option>-f <replaceable class="parameter">filename</replaceable></option></arg>
      <arg><option>-k <replaceable class="parameter">filename</replaceable></option></arg>
+      <arg><option>-m</option></arg>
      <arg><option>-p <replaceable class="parameter">port#</replaceable></option></arg>
      <arg><option>-q <replaceable class="parameter">name</replaceable></option></arg>
      <arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>
@@ -103,7 +106,7 @@
      arguments, it also has a batch mode of operation for reading lookup
      requests from a file.  A brief summary of its command-line arguments
      and options is printed when the <option>-h</option> option is given.
-      Unlike earlier versions, the BIND9 implementation of
+      Unlike earlier versions, the BIND 9 implementation of
      <command>dig</command> allows multiple lookups to be issued
      from the
      command line.
@@ -117,8 +120,8 @@
    </para>

    <para>
-      When no command line arguments or options are given, will perform an
-      NS query for "." (the root).
+      When no command line arguments or options are given,
+      <command>dig</command> will perform an NS query for "." (the root).
    </para>

    <para>
@@ -131,8 +134,8 @@
    <para>
      The IN and CH class names overlap with the IN and CH top level
      domains names.  Either use the <option>-t</option> and
-      <option>-c</option> options to specify the type and class or
-      use the <option>-q</option> the specify the domain name or
+      <option>-c</option> options to specify the type and class, 
+      use the <option>-q</option> the specify the domain name, or
      use "IN." and "CH." when looking up these top level domains.
    </para>

@@ -215,7 +218,7 @@
      The default query class (IN for internet) is overridden by the
      <option>-c</option> option.  <parameter>class</parameter> is
      any valid
-      class, such as HS for Hesiod records or CH for CHAOSNET records.
+      class, such as HS for Hesiod records or CH for Chaosnet records.
    </para>

    <para>
@@ -224,11 +227,17 @@
      in batch mode by reading a list of lookup requests to process from the
      file <parameter>filename</parameter>.  The file contains a
      number of
-      queries, one per line.  Each entry in the file should be organised in
+      queries, one per line.  Each entry in the file should be organized in
      the same way they would be presented as queries to
      <command>dig</command> using the command-line interface.
    </para>

+    <para>
+      The <option>-m</option> option enables memory usage debugging.
+      <!-- It enables ISC_MEM_DEBUGTRACE and ISC_MEM_DEBUGRECORD
+           documented in include/isc/mem.h -->
+    </para>
+
    <para>
      If a non-standard port number is to be queried, the
      <option>-p</option> option is used.  <parameter>port#</parameter> is
@@ -250,7 +259,7 @@
      The <option>-t</option> option sets the query type to
      <parameter>type</parameter>.  It can be any valid query type
      which is
-      supported in BIND9.  The default query type "A", unless the
+      supported in BIND 9.  The default query type is "A", unless the
      <option>-x</option> option is supplied to indicate a reverse lookup.
      A zone transfer can be requested by specifying a type of AXFR.  When
      an incremental zone transfer (IXFR) is required,
@@ -262,12 +271,12 @@

    <para>
      The <option>-q</option> option sets the query name to 
-      <parameter>name</parameter>.  This useful do distingish the
+      <parameter>name</parameter>.  This useful do distinguish the
      <parameter>name</parameter> from other arguments.
    </para>

    <para>
-      Reverse lookups - mapping addresses to names - are simplified by the
+      Reverse lookups &mdash; mapping addresses to names &mdash; are simplified by the
      <option>-x</option> option.  <parameter>addr</parameter> is
      an IPv4
      address in dotted-decimal notation, or a colon-delimited IPv6 address.
@@ -342,7 +351,7 @@
          <listitem>
            <para>
              Use [do not use] TCP when querying name servers.  The default
-              behaviour is to use UDP unless an AXFR or IXFR query is
+              behavior is to use UDP unless an AXFR or IXFR query is
              requested, in
              which case a TCP connection is used.
            </para>
@@ -535,7 +544,7 @@
          <term><option>+[no]cmd</option></term>
          <listitem>
            <para>
-              toggles the printing of the initial comment in the output
+              Toggles the printing of the initial comment in the output
              identifying
              the version of <command>dig</command> and the query
              options that have
@@ -587,7 +596,7 @@
              This query option toggles the printing of statistics: when the
              query
              was made, the size of the reply and so on.  The default
-              behaviour is
+              behavior is
              to print the query statistics.
            </para>
          </listitem>
@@ -661,8 +670,8 @@
            <para>

              Sets the timeout for a query to
-              <parameter>T</parameter> seconds.  The default time
-              out is 5 seconds.
+              <parameter>T</parameter> seconds.  The default
+	      timeout is 5 seconds.
              An attempt to set <parameter>T</parameter> to less
              than 1 will result
              in a query timeout of 1 second being applied.
@@ -762,7 +771,7 @@
              default is
              to not try the next server which is the reverse of normal stub
              resolver
-              behaviour.
+              behavior.
            </para>
          </listitem>
        </varlistentry>
@@ -821,7 +830,7 @@
          <term><option>+[no]topdown</option></term>
          <listitem>
            <para>
-              When chasing DNSSEC signature chains perform a top down
+              When chasing DNSSEC signature chains perform a top-down
              validation.
              Requires dig be compiled with -DDIG_SIGCHASE.
            </para>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dig.html,v 1.13.18.23 2006/12/19 01:35:40 marka Exp $ -->
+<!-- $Id: dig.html,v 1.13.18.30 2008/10/14 01:30:11 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -29,12 +29,12 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dig</code>  [@server] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-k <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]name:key</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [name] [type] [class] [queryopt...]</p></div>
+<div class="cmdsynopsis"><p><code class="command">dig</code>  [@server] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-k <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-m</code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]name:key</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [name] [type] [class] [queryopt...]</p></div>
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [<code class="option">-h</code>]</p></div>
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543694"></a><h2>DESCRIPTION</h2>
+<a name="id2543515"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
      (domain information groper) is a flexible tool
      for interrogating DNS name servers.  It performs DNS lookups and
@@ -50,7 +50,7 @@
      arguments, it also has a batch mode of operation for reading lookup
      requests from a file.  A brief summary of its command-line arguments
      and options is printed when the <code class="option">-h</code> option is given.
-      Unlike earlier versions, the BIND9 implementation of
+      Unlike earlier versions, the BIND 9 implementation of
      <span><strong class="command">dig</strong></span> allows multiple lookups to be issued
      from the
      command line.
@@ -62,8 +62,8 @@
      <code class="filename">/etc/resolv.conf</code>.
    </p>
 <p>
-      When no command line arguments or options are given, will perform an
-      NS query for "." (the root).
+      When no command line arguments or options are given,
+      <span><strong class="command">dig</strong></span> will perform an NS query for "." (the root).
    </p>
 <p>
      It is possible to set per-user defaults for <span><strong class="command">dig</strong></span> via
@@ -74,13 +74,13 @@
 <p>
      The IN and CH class names overlap with the IN and CH top level
      domains names.  Either use the <code class="option">-t</code> and
-      <code class="option">-c</code> options to specify the type and class or
-      use the <code class="option">-q</code> the specify the domain name or
+      <code class="option">-c</code> options to specify the type and class, 
+      use the <code class="option">-q</code> the specify the domain name, or
      use "IN." and "CH." when looking up these top level domains.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543764"></a><h2>SIMPLE USAGE</h2>
+<a name="id2543589"></a><h2>SIMPLE USAGE</h2>
 <p>
      A typical invocation of <span><strong class="command">dig</strong></span> looks like:
      </p>
@@ -126,7 +126,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543854"></a><h2>OPTIONS</h2>
+<a name="id2543680"></a><h2>OPTIONS</h2>
 <p>
      The <code class="option">-b</code> option sets the source IP address of the query
      to <em class="parameter"><code>address</code></em>.  This must be a valid
@@ -139,7 +139,7 @@
      The default query class (IN for internet) is overridden by the
      <code class="option">-c</code> option.  <em class="parameter"><code>class</code></em> is
      any valid
-      class, such as HS for Hesiod records or CH for CHAOSNET records.
+      class, such as HS for Hesiod records or CH for Chaosnet records.
    </p>
 <p>
      The <code class="option">-f</code> option makes <span><strong class="command">dig </strong></span>
@@ -147,10 +147,14 @@
      in batch mode by reading a list of lookup requests to process from the
      file <em class="parameter"><code>filename</code></em>.  The file contains a
      number of
-      queries, one per line.  Each entry in the file should be organised in
+      queries, one per line.  Each entry in the file should be organized in
      the same way they would be presented as queries to
      <span><strong class="command">dig</strong></span> using the command-line interface.
    </p>
+<p>
+      The <code class="option">-m</code> option enables memory usage debugging.
+      
+    </p>
 <p>
      If a non-standard port number is to be queried, the
      <code class="option">-p</code> option is used.  <em class="parameter"><code>port#</code></em> is
@@ -170,7 +174,7 @@
      The <code class="option">-t</code> option sets the query type to
      <em class="parameter"><code>type</code></em>.  It can be any valid query type
      which is
-      supported in BIND9.  The default query type "A", unless the
+      supported in BIND 9.  The default query type is "A", unless the
      <code class="option">-x</code> option is supplied to indicate a reverse lookup.
      A zone transfer can be requested by specifying a type of AXFR.  When
      an incremental zone transfer (IXFR) is required,
@@ -181,11 +185,11 @@
    </p>
 <p>
      The <code class="option">-q</code> option sets the query name to 
-      <em class="parameter"><code>name</code></em>.  This useful do distingish the
+      <em class="parameter"><code>name</code></em>.  This useful do distinguish the
      <em class="parameter"><code>name</code></em> from other arguments.
    </p>
 <p>
-      Reverse lookups - mapping addresses to names - are simplified by the
+      Reverse lookups &#8212; mapping addresses to names &#8212; are simplified by the
      <code class="option">-x</code> option.  <em class="parameter"><code>addr</code></em> is
      an IPv4
      address in dotted-decimal notation, or a colon-delimited IPv6 address.
@@ -226,7 +230,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544125"></a><h2>QUERY OPTIONS</h2>
+<a name="id2544028"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">dig</strong></span>
      provides a number of query options which affect
      the way in which lookups are made and the results displayed.  Some of
@@ -249,7 +253,7 @@
 <dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
 <dd><p>
              Use [do not use] TCP when querying name servers.  The default
-              behaviour is to use UDP unless an AXFR or IXFR query is
+              behavior is to use UDP unless an AXFR or IXFR query is
              requested, in
              which case a TCP connection is used.
            </p></dd>
@@ -362,7 +366,7 @@
            </p></dd>
 <dt><span class="term"><code class="option">+[no]cmd</code></span></dt>
 <dd><p>
-              toggles the printing of the initial comment in the output
+              Toggles the printing of the initial comment in the output
              identifying
              the version of <span><strong class="command">dig</strong></span> and the query
              options that have
@@ -394,7 +398,7 @@
              This query option toggles the printing of statistics: when the
              query
              was made, the size of the reply and so on.  The default
-              behaviour is
+              behavior is
              to print the query statistics.
            </p></dd>
 <dt><span class="term"><code class="option">+[no]qr</code></span></dt>
@@ -433,8 +437,8 @@
 <dd><p>

              Sets the timeout for a query to
-              <em class="parameter"><code>T</code></em> seconds.  The default time
-              out is 5 seconds.
+              <em class="parameter"><code>T</code></em> seconds.  The default
+	      timeout is 5 seconds.
              An attempt to set <em class="parameter"><code>T</code></em> to less
              than 1 will result
              in a query timeout of 1 second being applied.
@@ -499,7 +503,7 @@
              default is
              to not try the next server which is the reverse of normal stub
              resolver
-              behaviour.
+              behavior.
            </p></dd>
 <dt><span class="term"><code class="option">+[no]besteffort</code></span></dt>
 <dd><p>
@@ -535,7 +539,7 @@
 </dd>
 <dt><span class="term"><code class="option">+[no]topdown</code></span></dt>
 <dd><p>
-              When chasing DNSSEC signature chains perform a top down
+              When chasing DNSSEC signature chains perform a top-down
              validation.
              Requires dig be compiled with -DDIG_SIGCHASE.
            </p></dd>
@@ -545,7 +549,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545246"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2545149"></a><h2>MULTIPLE QUERIES</h2>
 <p>
      The BIND 9 implementation of <span><strong class="command">dig </strong></span>
      supports
@@ -591,7 +595,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545308"></a><h2>IDN SUPPORT</h2>
+<a name="id2545211"></a><h2>IDN SUPPORT</h2>
 <p>
      If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
      domain name) support, it can accept and display non-ASCII domain names.
@@ -605,14 +609,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545399"></a><h2>FILES</h2>
+<a name="id2545234"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
    </p>
 <p><code class="filename">${HOME}/.digrc</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545416"></a><h2>SEE ALSO</h2>
+<a name="id2545251"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -620,7 +624,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545453"></a><h2>BUGS</h2>
+<a name="id2545356"></a><h2>BUGS</h2>
 <p>
      There are probably too many query options.
    </p>
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dighost.c,v 1.259.18.37 2006/12/07 06:08:02 marka Exp $ */
+/* $Id: dighost.c,v 1.259.18.49 2008/07/23 23:33:02 marka Exp $ */

 /*! \file
 *  \note
@@ -144,6 +144,7 @@ static idn_result_t	append_textname(char *name, const char *origin,
 static void		idn_check_result(idn_result_t r, const char *msg);

 #define MAXDLEN		256
+int  idnoptions	= 0;
 #endif

 /*%
@@ -276,7 +277,7 @@ dns_name_t chase_name; /* the query name */
 /*
 * the current name is the parent name when we follow delegation
 */
-dns_name_t chase_current_name; 
+dns_name_t chase_current_name;
 /*
 * the child name is used for delegation (NS DS responses in AUTHORITY section)
 */
@@ -492,6 +493,7 @@ void
 fatal(const char *format, ...) {
 	va_list args;

+	fflush(stdout);
 	fprintf(stderr, "%s: ", progname);
 	va_start(args, format);
 	vfprintf(stderr, format, args);
@@ -509,6 +511,7 @@ debug(const char *format, ...) {
 	va_list args;

 	if (debugging) {
+		fflush(stdout);
 		va_start(args, format);
 		vfprintf(stderr, format, args);
 		va_end(args);
@@ -615,13 +618,13 @@ set_nameserver(char *opt) {
 		return;

 	result = bind9_getaddresses(opt, 0, sockaddrs,
-				    DIG_MAX_ADDRESSES, &count); 
+				    DIG_MAX_ADDRESSES, &count);
 	if (result != ISC_R_SUCCESS)
 		fatal("couldn't get address for '%s': %s",
 		      opt, isc_result_totext(result));

 	flush_server_list();
-	
+
 	for (i = 0; i < count; i++) {
 		isc_netaddr_fromsockaddr(&netaddr, &sockaddrs[i]);
 		isc_netaddr_format(&netaddr, tmp, sizeof(tmp));
@@ -890,7 +893,7 @@ setup_text_key(void) {
 	result = isc_base64_decodestring(keysecret, &secretbuf);
 	if (result != ISC_R_SUCCESS)
 		goto failure;
-	
+
 	secretsize = isc_buffer_usedlength(&secretbuf);

 	result = dns_name_fromtext(&keyname, namebuf,
@@ -1024,7 +1027,7 @@ setup_system(void) {
 			domain  = NULL;
 		}
 	}
-			
+
 	if (ndots == -1) {
 		ndots = lwconf->ndots;
 		debug("ndots is %d.", ndots);
@@ -1087,7 +1090,7 @@ clear_searchlist(void) {
 void
 set_search_domain(char *domain) {
 	dig_searchlist_t *search;
-	
+
 	clear_searchlist();
 	search = make_searchlist_entry(domain);
 	ISC_LIST_APPEND(search_list, search, link);
@@ -1275,9 +1278,7 @@ clear_query(dig_query_t *query) {
 */
 static isc_boolean_t
 try_clear_lookup(dig_lookup_t *lookup) {
-	dig_server_t *s;
 	dig_query_t *q;
-	void *ptr;

 	REQUIRE(lookup != NULL);

@@ -1298,7 +1299,16 @@ try_clear_lookup(dig_lookup_t *lookup) {
 	 * At this point, we know there are no queries on the lookup,
 	 * so can make it go away also.
 	 */
-	debug("cleared");
+	destroy_lookup(lookup);
+	return (ISC_TRUE);
+}
+
+void
+destroy_lookup(dig_lookup_t *lookup) {
+	dig_server_t *s;
+	void *ptr;
+
+	debug("destroy");
 	s = ISC_LIST_HEAD(lookup->my_server_list);
 	while (s != NULL) {
 		debug("freeing server %p belonging to %p", s, lookup);
@@ -1323,7 +1333,6 @@ try_clear_lookup(dig_lookup_t *lookup) {
 		dst_context_destroy(&lookup->tsigctx);

 	isc_mem_free(mctx, lookup);
-	return (ISC_TRUE);
 }

 /*%
@@ -1402,7 +1411,7 @@ start_lookup(void) {
 			current_lookup->qrdtype_sigchase
 				= current_lookup->qrdtype;
 			current_lookup->qrdtype = dns_rdatatype_ns;
-		   
+
 			current_lookup->rdclass_sigchase
 				= current_lookup->rdclass;
 			current_lookup->rdclass_sigchaseset
@@ -1483,7 +1492,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 	INSIST(!free_now);

 	debug("following up %s", query->lookup->textname);
-	
+
 	for (result = dns_message_firstname(msg, section);
 	     result == ISC_R_SUCCESS;
 	     result = dns_message_nextname(msg, section)) {
@@ -1538,7 +1547,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 			dns_rdataset_current(rdataset, &rdata);

 			query->lookup->nsfound++;
-			(void)dns_rdata_tostruct(&rdata, &ns, NULL);
+			result = dns_rdata_tostruct(&rdata, &ns, NULL);
+			check_result(result, "dns_rdata_tostruct");
 			dns_name_format(&ns.name, namestr, sizeof(namestr));
 			dns_rdata_freestruct(&ns);

@@ -1635,7 +1645,7 @@ next_origin(dns_message_t *msg, dig_query_t *query) {
 	if (query->lookup->origin == NULL && query->lookup->need_search) {
 		lookup = requeue_lookup(query->lookup, ISC_TRUE);
 		lookup->origin = ISC_LIST_HEAD(search_list);
-		query->lookup->need_search = ISC_FALSE;
+		lookup->need_search = ISC_FALSE;
 	} else {
 		search = ISC_LIST_NEXT(query->lookup->origin, link);
 		if (search == NULL && query->lookup->done_as_is)
@@ -1816,7 +1826,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				     sizeof(utf8_textname));
 		idn_check_result(mr, "append origin to textname");
 	}
-	mr = idn_encodename(IDN_LOCALMAP | IDN_NAMEPREP | IDN_ASCCHECK |
+	mr = idn_encodename(idnoptions | IDN_LOCALMAP | IDN_NAMEPREP |
 			    IDN_IDNCONV | IDN_LENCHECK, utf8_textname,
 			    idn_textname, sizeof(idn_textname));
 	idn_check_result(mr, "convert UTF-8 textname to IDN encoding");
@@ -1838,7 +1848,7 @@ setup_lookup(dig_lookup_t *lookup) {
 						&lookup->name);
 			dns_message_puttempname(lookup->sendmsg,
 						&lookup->oname);
-			fatal("'%s' is not in legal name syntax (%s)",
+			fatal("Origin '%s' is not in legal name syntax (%s)",
 			      lookup->origin->origin,
 			      isc_result_totext(result));
 		}
@@ -2082,7 +2092,7 @@ send_done(isc_task_t *_task, isc_event_t *event) {

 	for  (b = ISC_LIST_HEAD(sevent->bufferlist);
 	      b != NULL;
-	      b = ISC_LIST_HEAD(sevent->bufferlist)) 
+	      b = ISC_LIST_HEAD(sevent->bufferlist))
 		ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);

 	query = event->ev_arg;
@@ -2162,7 +2172,7 @@ bringup_timer(dig_query_t *query, unsigned int default_timeout) {
 				  &l->interval, global_task, connect_timeout,
 				  l, &l->timer);
 	check_result(result, "isc_timer_create");
-}	
+}

 static void
 connect_done(isc_task_t *task, isc_event_t *event);
@@ -2184,7 +2194,7 @@ send_tcp_connect(dig_query_t *query) {
 	query->waiting_connect = ISC_TRUE;
 	query->lookup->current_query = query;
 	get_address(query->servname, port, &query->sockaddr);
-	
+
 	if (specified_source &&
 	    (isc_sockaddr_pf(&query->sockaddr) !=
 	     isc_sockaddr_pf(&bind_address))) {
@@ -2210,14 +2220,15 @@ send_tcp_connect(dig_query_t *query) {
 	sockcount++;
 	debug("sockcount=%d", sockcount);
 	if (specified_source)
-		result = isc_socket_bind(query->sock, &bind_address);
+		result = isc_socket_bind(query->sock, &bind_address,
+					 ISC_SOCKET_REUSEADDRESS);
 	else {
 		if ((isc_sockaddr_pf(&query->sockaddr) == AF_INET) &&
 		    have_ipv4)
 			isc_sockaddr_any(&bind_any);
 		else
 			isc_sockaddr_any6(&bind_any);
-		result = isc_socket_bind(query->sock, &bind_any);
+		result = isc_socket_bind(query->sock, &bind_any, 0);
 	}
 	check_result(result, "isc_socket_bind");
 	bringup_timer(query, TCP_TIMEOUT);
@@ -2264,11 +2275,12 @@ send_udp(dig_query_t *query) {
 		sockcount++;
 		debug("sockcount=%d", sockcount);
 		if (specified_source) {
-			result = isc_socket_bind(query->sock, &bind_address);
+			result = isc_socket_bind(query->sock, &bind_address,
+						 ISC_SOCKET_REUSEADDRESS);
 		} else {
 			isc_sockaddr_anyofpf(&bind_any,
 					isc_sockaddr_pf(&query->sockaddr));
-			result = isc_socket_bind(query->sock, &bind_any);
+			result = isc_socket_bind(query->sock, &bind_any, 0);
 		}
 		check_result(result, "isc_socket_bind");

@@ -2654,7 +2666,8 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 					goto next_rdata;
 				/* Now we have an SOA.  Work with it. */
 				debug("got an SOA");
-				(void)dns_rdata_tostruct(&rdata, &soa, NULL);
+				result = dns_rdata_tostruct(&rdata, &soa, NULL);
+				check_result(result, "dns_rdata_tostruct");
 				serial = soa.serial;
 				dns_rdata_freestruct(&soa);
 				if (!query->first_soa_rcvd) {
@@ -2817,13 +2830,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		char buf2[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_t any;

-		if (isc_sockaddr_pf(&query->sockaddr) == AF_INET) 
+		if (isc_sockaddr_pf(&query->sockaddr) == AF_INET)
 			isc_sockaddr_any(&any);
 		else
 			isc_sockaddr_any6(&any);

 		/*
-		* We don't expect a match when the packet is 
+		* We don't expect a match when the packet is
 		* sent to 0.0.0.0, :: or to a multicast addresses.
 		* XXXMPA broadcast needs to be handled here as well.
 		*/
@@ -2841,7 +2854,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 	}

- 	result = dns_message_peekheader(b, &id, &msgflags);
+	result = dns_message_peekheader(b, &id, &msgflags);
 	if (result != ISC_R_SUCCESS || l->sendmsg->id != id) {
 		match = ISC_FALSE;
 		if (l->tcp_mode) {
@@ -2946,7 +2959,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		return;
 	}
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 &&
-            !l->ignore && !l->tcp_mode) {
+	    !l->ignore && !l->tcp_mode) {
 		printf(";; Truncated, retrying in TCP mode.\n");
 		n = requeue_lookup(l, ISC_TRUE);
 		n->tcp_mode = ISC_TRUE;
@@ -2958,7 +2971,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		check_next_lookup(l);
 		UNLOCK_LOOKUP;
 		return;
-	}			
+	}
 	if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
 	    (check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
 	{
@@ -3084,7 +3097,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {

 			if (l->trace_root) {
 				/*
-				 * This is the initial NS query. 
+				 * This is the initial NS query.
 				 */
 				int n;

@@ -3099,7 +3112,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				if (!do_sigchase)
 #endif
 				printmessage(query, msg, ISC_TRUE);
-		} 
+		}
 #ifdef DIG_SIGCHASE
 		if (do_sigchase) {
 			chase_msg = isc_mem_allocate(mctx,
@@ -3118,13 +3131,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {

 			isc_buffer_usedregion(b, &r);
 			result = isc_buffer_allocate(mctx, &buf, r.length);
-	   
+
 			check_result(result, "isc_buffer_allocate");
 			result =  isc_buffer_copyregion(buf, &r);
 			check_result(result, "isc_buffer_copyregion");
-	   
+
 			result =  dns_message_parse(msg_temp, buf, 0);
- 
+
 			isc_buffer_free(&buf);
 			chase_msg->msg = msg_temp;

@@ -3140,9 +3153,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		}
 #endif
 	}
-       
+
 #ifdef DIG_SIGCHASE
-	if (l->sigchase && ISC_LIST_EMPTY(lookup_list)) {   
+	if (l->sigchase && ISC_LIST_EMPTY(lookup_list)) {
 		sigchase(msg_temp);
 	}
 #endif
@@ -3299,7 +3312,7 @@ cancel_all(void) {
 */
 void
 destroy_libs(void) {
-#ifdef DIG_SIGCHASE 
+#ifdef DIG_SIGCHASE
 	void * ptr;
 	dig_message_t *chase_msg;
 #endif
@@ -3339,8 +3352,8 @@ destroy_libs(void) {
 	clear_searchlist();

 #ifdef WITH_IDN
-        result = dns_name_settotextfilter(NULL);
-        check_result(result, "dns_name_settotextfilter");
+	result = dns_name_settotextfilter(NULL);
+	check_result(result, "dns_name_settotextfilter");
 #endif
 	dns_name_destroy();

@@ -3412,7 +3425,7 @@ destroy_libs(void) {
 #endif

 	debug("Destroy memory");
-	
+
 #endif
 	if (memdebugging != 0)
 		isc_mem_stats(mctx, stderr);
@@ -3509,7 +3522,7 @@ append_textname(char *name, const char *origin, size_t namesize) {
 	(void)strcpy(name + namelen, origin);
 	return idn_success;
 }
- 
+
 static void
 idn_check_result(idn_result_t r, const char *msg) {
 	if (r != idn_success) {
@@ -3545,14 +3558,14 @@ void
 dump_database_section(dns_message_t *msg, int section)
 {
 	dns_name_t *msg_name=NULL;
- 
+
 	dns_rdataset_t *rdataset;

 	do {
 		dns_message_currentname(msg, section, &msg_name);
-    
+
 		for (rdataset = ISC_LIST_HEAD(msg_name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link)) {	
+		     rdataset = ISC_LIST_NEXT(rdataset, link)) {
 			dns_name_print(msg_name, stdout);
 			printf("\n");
 			print_rdataset(msg_name, rdataset, mctx);
@@ -3569,15 +3582,15 @@ dump_database(void) {
 	for (msg = ISC_LIST_HEAD(chase_message_list);  msg != NULL;
 	     msg = ISC_LIST_NEXT(msg, link)) {
 		if (dns_message_firstname(msg->msg, DNS_SECTION_ANSWER)
-		    == ISC_R_SUCCESS) 
+		    == ISC_R_SUCCESS)
 			dump_database_section(msg->msg, DNS_SECTION_ANSWER);
-       
+
 		if (dns_message_firstname(msg->msg, DNS_SECTION_AUTHORITY)
-		    == ISC_R_SUCCESS) 
+		    == ISC_R_SUCCESS)
 			dump_database_section(msg->msg, DNS_SECTION_AUTHORITY);
-	
+
 		if (dns_message_firstname(msg->msg, DNS_SECTION_ADDITIONAL)
-		    == ISC_R_SUCCESS) 
+		    == ISC_R_SUCCESS)
 			dump_database_section(msg->msg, DNS_SECTION_ADDITIONAL);
 	}
 }
@@ -3607,7 +3620,7 @@ search_type(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers) {
 			if ((siginfo.covered == covers) ||
 			    (covers == dns_rdatatype_any)) {
 				dns_rdata_reset(&sigrdata);
-				dns_rdata_freestruct(&siginfo);	
+				dns_rdata_freestruct(&siginfo);
 				return (rdataset);
 			}
 			dns_rdata_reset(&sigrdata);
@@ -3645,7 +3658,7 @@ chase_scanname(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers)
 {
 	dns_rdataset_t *rdataset = NULL;
 	dig_message_t * msg;
- 
+
 	for (msg = ISC_LIST_HEAD(chase_message_list2);  msg != NULL;
 	     msg = ISC_LIST_NEXT(msg, link)) {
 		if (dns_message_firstname(msg->msg, DNS_SECTION_ANSWER)
@@ -3738,7 +3751,7 @@ insert_trustedkey(dst_key_t * key)
 		return;

 	tk_list.key[tk_list.nb_tk++] = key;
-	return;   
+	return;
 }

 void
@@ -3761,7 +3774,7 @@ char alphnum[] =
 	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";

 isc_result_t
-removetmpkey(isc_mem_t *mctx, const char *file) 
+removetmpkey(isc_mem_t *mctx, const char *file)
 {
 	char *tempnamekey = NULL;
 	int tempnamekeylen;
@@ -3774,7 +3787,7 @@ removetmpkey(isc_mem_t *mctx, const char *file)
 		return (ISC_R_NOMEMORY);

 	memset(tempnamekey, 0, tempnamekeylen);
- 
+
 	strcat(tempnamekey, file);
 	strcat(tempnamekey,".key");
 	isc_file_remove(tempnamekey);
@@ -3814,24 +3827,24 @@ opentmpkey(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {
 			isc_mem_free(mctx, tempname);
 			return (ISC_R_FAILURE);
 		}
-	    
+
 		x = cp--;
 		while (cp >= tempname && *cp == 'X') {
 			isc_random_get(&which);
 			*cp = alphnum[which % (sizeof(alphnum) - 1)];
 			x = cp--;
 		}
- 
+
 		tempnamekeylen = tempnamelen+5;
 		tempnamekey = isc_mem_allocate(mctx, tempnamekeylen);
 		if (tempnamekey == NULL)
 			return (ISC_R_NOMEMORY);
-	
+
 		memset(tempnamekey, 0, tempnamekeylen);
 		strncpy(tempnamekey, tempname, tempnamelen);
 		strcat(tempnamekey ,".key");

-	   
+
 		if (isc_file_exists(tempnamekey)) {
 			isc_mem_free(mctx, tempnamekey);
 			isc_mem_free(mctx, tempname);
@@ -3852,7 +3865,7 @@ opentmpkey(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {

 cleanup:
 	isc_mem_free(mctx, tempname);
-	
+
 	return (result);
 }

@@ -3866,7 +3879,7 @@ get_trusted_key(isc_mem_t *mctx)
 	char buf[1500];
 	FILE *fp, *fptemp;
 	dst_key_t *key = NULL;
- 
+
 	result = isc_file_exists(trustedkey);
 	if (result !=  ISC_TRUE) {
 		result = isc_file_exists("/etc/trusted-key.key");
@@ -3891,7 +3904,7 @@ get_trusted_key(isc_mem_t *mctx)
 		       filename);
 		return (ISC_R_FAILURE);
 	}
-	while (fgets(buf, 1500, fp) != NULL) {
+	while (fgets(buf, sizeof(buf), fp) != NULL) {
 		result = opentmpkey(mctx,"tmp_file", &filetemp, &fptemp);
 		if (result != ISC_R_SUCCESS) {
 			fclose(fp);
@@ -3944,11 +3957,11 @@ nameFromString(const char *str, dns_name_t *p_ret) {

 	result = dns_name_dup(dns_fixedname_name(&fixedname), mctx, p_ret);
 	check_result(result, "nameFromString");
-} 
+}


 #if DIG_SIGCHASE_TD
-isc_result_t 
+isc_result_t
 prepare_lookup(dns_name_t *name)
 {
 	isc_result_t result;
@@ -3966,7 +3979,7 @@ prepare_lookup(dns_name_t *name)
 	lookup->rdtype = lookup->rdtype_sigchase;
 	lookup->rdtypeset = ISC_TRUE;
 	lookup->qrdtype = lookup->qrdtype_sigchase;
-   
+
 	s = ISC_LIST_HEAD(lookup->my_server_list);
 	while (s != NULL) {
 		debug("freeing server %p belonging to %p",
@@ -3999,12 +4012,11 @@ prepare_lookup(dns_name_t *name)

 		dns_rdataset_current(chase_nsrdataset, &rdata);

-		(void)dns_rdata_tostruct(&rdata, &ns, NULL);
-      
-     
-      
+		result = dns_rdata_tostruct(&rdata, &ns, NULL);
+		check_result(result, "dns_rdata_tostruct");
+
 #ifdef __FOLLOW_GLUE__
-      
+
 		result = advanced_rrsearch(&rdataset, &ns.name,
 					   dns_rdatatype_aaaa,
 					   dns_rdatatype_any, &true);
@@ -4028,12 +4040,12 @@ prepare_lookup(dns_name_t *name)


 				srv = make_server(namestr, namestr);
-	     
+
 				ISC_LIST_APPEND(lookup->my_server_list,
 						srv, link);
 			}
 		}
-      
+
 		rdataset = NULL;
 		result = advanced_rrsearch(&rdataset, &ns.name, dns_rdatatype_a,
 					   dns_rdatatype_any, &true);
@@ -4055,28 +4067,28 @@ prepare_lookup(dns_name_t *name)
 				isc_buffer_free(&b);
 				dns_rdata_reset(&a);
 				printf("ns name: %s\n", namestr);
-      
+

 				srv = make_server(namestr, namestr);
-	     
+
 				ISC_LIST_APPEND(lookup->my_server_list,
 						srv, link);
 			}
 		}
 #else
-       
+
 		dns_name_format(&ns.name, namestr, sizeof(namestr));
 		printf("ns name: ");
 		dns_name_print(&ns.name, stdout);
 		printf("\n");
 		srv = make_server(namestr, namestr);
-	     
+
 		ISC_LIST_APPEND(lookup->my_server_list, srv, link);

-#endif 
+#endif
 		dns_rdata_freestruct(&ns);
 		dns_rdata_reset(&rdata);
-      
+
 	}

 	ISC_LIST_APPEND(lookup_list, lookup, link);
@@ -4130,10 +4142,10 @@ grandfather_pb_test(dns_name_t *zone_name, dns_rdataset_t  *sigrdataset)

 	do {
 		dns_rdataset_current(sigrdataset, &sigrdata);
-    
+
 		result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
 		check_result(result, "sigrdata tostruct siginfo");
- 
+
 		if (dns_name_compare(&siginfo.signer, zone_name) == 0) {
 			dns_rdata_freestruct(&siginfo);
 			dns_rdata_reset(&sigrdata);
@@ -4141,7 +4153,7 @@ grandfather_pb_test(dns_name_t *zone_name, dns_rdataset_t  *sigrdataset)
 		}

 		dns_rdata_freestruct(&siginfo);
- 
+
 	} while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);

 	dns_rdata_reset(&sigrdata);
@@ -4171,7 +4183,7 @@ initialization(dns_name_t *name)

 	return (ISC_R_SUCCESS);
 }
-#endif 
+#endif

 void
 print_rdataset(dns_name_t *name, dns_rdataset_t *rdataset, isc_mem_t *mctx)
@@ -4195,10 +4207,10 @@ print_rdataset(dns_name_t *name, dns_rdataset_t *rdataset, isc_mem_t *mctx)
 }


-void 
+void
 dup_name(dns_name_t *source, dns_name_t *target, isc_mem_t *mctx) {
-	isc_result_t result; 
- 
+	isc_result_t result;
+
 	if (dns_name_dynamic(target))
 		free_name(target, mctx);
 	result = dns_name_dup(source, mctx, target);
@@ -4217,7 +4229,7 @@ free_name(dns_name_t *name, isc_mem_t *mctx) {
 * return ISC_R_SUCCESS if the DNSKEY RRset contains a trusted_key
 * 			and the RRset is valid
 * return ISC_R_NOTFOUND if not contains trusted key
- 			or if the RRset isn't valid
+			or if the RRset isn't valid
 * return ISC_R_FAILURE if problem
 *
 */
@@ -4242,17 +4254,17 @@ contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
 	do {
 		dns_rdataset_current(rdataset, &rdata);
 		INSIST(rdata.type == dns_rdatatype_dnskey);
-  	  
+
 		result = dns_dnssec_keyfromrdata(name, &rdata,
 						 mctx, &dnsseckey);
 		check_result(result, "dns_dnssec_keyfromrdata");

-    
+
 		for (i = 0; i < tk_list.nb_tk; i++) {
 			if (dst_key_compare(tk_list.key[i], dnsseckey)
 			    == ISC_TRUE) {
 				dns_rdata_reset(&rdata);
-	
+
 				printf(";; Ok, find a Trusted Key in the "
 				       "DNSKEY RRset: %d\n",
 				       dst_key_id(dnsseckey));
@@ -4267,7 +4279,7 @@ contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
 				}
 			}
 		}
- 
+
 		dns_rdata_reset(&rdata);
 		if (dnsseckey != NULL)
 			dst_key_free(&dnsseckey);
@@ -4297,7 +4309,7 @@ sigchase_verify_sig(dns_name_t *name, dns_rdataset_t *rdataset,
 	do {
 		dns_rdataset_current(keyrdataset, &keyrdata);
 		INSIST(keyrdata.type == dns_rdatatype_dnskey);
-  	  
+
 		result = dns_dnssec_keyfromrdata(name, &keyrdata,
 						 mctx, &dnsseckey);
 		check_result(result, "dns_dnssec_keyfromrdata");
@@ -4329,22 +4341,22 @@ sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
 	result = dns_rdataset_first(sigrdataset);
 	check_result(result, "empty RRSIG dataset");
 	dns_rdata_init(&sigrdata);
-    
+
 	do {
 		dns_rdataset_current(sigrdataset, &sigrdata);

 		result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
 		check_result(result, "sigrdata tostruct siginfo");
- 
+
 		/*
 		 * Test if the id of the DNSKEY is
 		 * the id of the DNSKEY signer's
 		 */
 		if (siginfo.keyid == dst_key_id(dnsseckey)) {
-    
+
 			result = dns_rdataset_first(rdataset);
 			check_result(result, "empty DS dataset");
-    
+
 			result = dns_dnssec_verify(name, rdataset, dnsseckey,
 						   ISC_FALSE, mctx, &sigrdata);

@@ -4361,7 +4373,7 @@ sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
 			}
 		}
 		dns_rdata_freestruct(&siginfo);
- 
+
 	} while (dns_rdataset_next(chase_sigkeyrdataset) == ISC_R_SUCCESS);

 	dns_rdata_reset(&sigrdata);
@@ -4387,18 +4399,18 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 	dns_rdata_init(&dsrdata);
 	do {
 		dns_rdataset_current(dsrdataset, &dsrdata);
-    
+
 		result = dns_rdata_tostruct(&dsrdata, &dsinfo, NULL);
 		check_result(result, "dns_rdata_tostruct  for DS");
-    
+
 		result = dns_rdataset_first(keyrdataset);
 		check_result(result, "empty KEY dataset");
-		dns_rdata_init(&keyrdata);	  
+		dns_rdata_init(&keyrdata);

 		do {
 			dns_rdataset_current(keyrdataset, &keyrdata);
 			INSIST(keyrdata.type == dns_rdatatype_dnskey);
-  	  
+
 			result = dns_dnssec_keyfromrdata(name, &keyrdata,
 							 mctx, &dnsseckey);
 			check_result(result, "dns_dnssec_keyfromrdata");
@@ -4413,20 +4425,20 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 				result = dns_ds_buildrdata(name, &keyrdata,
 							   dsinfo.digest_type,
 							   dsbuf, &newdsrdata);
-				dns_rdata_freestruct(&dsinfo);  
+				dns_rdata_freestruct(&dsinfo);

 				if (result != ISC_R_SUCCESS) {
 					dns_rdata_reset(&keyrdata);
 					dns_rdata_reset(&newdsrdata);
 					dns_rdata_reset(&dsrdata);
 					dst_key_free(&dnsseckey);
-					dns_rdata_freestruct(&dsinfo);  
+					dns_rdata_freestruct(&dsinfo);
 					printf("Oops: impossible to build"
 					       " new DS rdata\n");
 					return (result);
 				}
-	
-	
+
+
 				if (dns_rdata_compare(&dsrdata,
 						      &newdsrdata) == 0) {
 					printf(";; OK a DS valids a DNSKEY"
@@ -4434,7 +4446,7 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 					printf(";; Now verify that this"
 					       " DNSKEY validates the "
 					       "DNSKEY RRset\n");
-	       
+
 					result = sigchase_verify_sig_key(name,
 							 keyrdataset,
 							 dnsseckey,
@@ -4445,7 +4457,7 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 						dns_rdata_reset(&newdsrdata);
 						dns_rdata_reset(&dsrdata);
 						dst_key_free(&dnsseckey);
-		 
+
 						return (result);
 					}
 				} else {
@@ -4459,12 +4471,12 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 			dnsseckey = NULL;
 		} while (dns_rdataset_next(chase_keyrdataset) == ISC_R_SUCCESS);
 		dns_rdata_reset(&keyrdata);
- 
+
 	} while (dns_rdataset_next(chase_dsrdataset) == ISC_R_SUCCESS);
 #if 0
 	dns_rdata_reset(&dsrdata); WARNING
 #endif
- 
+
 	return (ISC_R_NOTFOUND);
 }

@@ -4477,13 +4489,13 @@ sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
 * ISC_R_SUCCESS: if we found the rrset
 * ISC_R_NOTFOUND: we do not found the rrset in cache
 * and we do a query on the net
- * ISC_R_FAILURE: rrset not found 
+ * ISC_R_FAILURE: rrset not found
 */
 isc_result_t
 advanced_rrsearch(dns_rdataset_t **rdataset, dns_name_t *name,
 		  dns_rdatatype_t type, dns_rdatatype_t covers,
 		  isc_boolean_t *lookedup)
-{ 
+{
 	isc_boolean_t  tmplookedup;

 	INSIST(rdataset != NULL);
@@ -4558,7 +4570,7 @@ sigchase_td(dns_message_t *msg)
 		}
 	}

-   
+
 	if (have_answer) {
 		chase_rdataset
 			= chase_scanname_section(msg, &chase_name,
@@ -4618,7 +4630,7 @@ sigchase_td(dns_message_t *msg)
 						    chase_dsrdataset,
 						    mctx);
 		}
-      
+
 		if (result != ISC_R_SUCCESS) {
 			printf("\n;; chain of trust can't be validated:"
 			       " FAILED\n\n");
@@ -4670,7 +4682,7 @@ sigchase_td(dns_message_t *msg)
 			chase_sigrdataset = NULL;
 			have_response = ISC_FALSE;
 			have_delegation_ns = ISC_FALSE;
-	  
+
 			dns_name_init(&tmp_name, NULL);
 			result = child_of_zone(&chase_name, &chase_current_name,
 					       &tmp_name);
@@ -4749,10 +4761,10 @@ sigchase_td(dns_message_t *msg)
 		}
 		chase_keyrdataset = NULL;
 		chase_sigkeyrdataset = NULL;
-    
- 
+
+
 		prepare_lookup(&chase_authority_name);
-	
+
 		have_response = ISC_FALSE;
 		have_delegation_ns = ISC_FALSE;
 		delegation_follow = ISC_TRUE;
@@ -4846,7 +4858,7 @@ sigchase_td(dns_message_t *msg)
 	}
 }

-#endif 
+#endif


 #if DIG_SIGCHASE_BU
@@ -4863,7 +4875,7 @@ getneededrr(dns_message_t *msg)
 	if ((result = dns_message_firstname(msg, DNS_SECTION_ANSWER))
 	    != ISC_R_SUCCESS) {
 		printf(";; NO ANSWERS: %s\n", isc_result_totext(result));
-    
+
 		if (chase_name.ndata == NULL)
 			return (ISC_R_ADDRNOTAVAIL);
 	} else {
@@ -4906,7 +4918,7 @@ getneededrr(dns_message_t *msg)
 	}
 	INSIST(chase_sigrdataset != NULL);

- 
+
 	/* first find the DNSKEY name */
 	result = dns_rdataset_first(chase_sigrdataset);
 	check_result(result, "empty RRSIG dataset");
@@ -4917,7 +4929,7 @@ getneededrr(dns_message_t *msg)
 	dup_name(&siginfo.signer, &chase_signame, mctx);
 	dns_rdata_freestruct(&siginfo);
 	dns_rdata_reset(&sigrdata);
- 
+
 	/* Do we have a key?  */
 	if (chase_keyrdataset == NULL) {
 		result = advanced_rrsearch(&chase_keyrdataset,
@@ -4986,7 +4998,7 @@ getneededrr(dns_message_t *msg)
 			print_rdataset(&chase_signame, chase_dsrdataset, mctx);
 		}
 	}
- 
+
 	if (chase_dsrdataset != NULL) {
 		/*
 		 * if there is no RRSIG of DS,
@@ -5045,7 +5057,7 @@ sigchase_bu(dns_message_t *msg)
 		dns_name_init(&query_name, NULL);
 		dns_name_init(&rdata_name, NULL);
 		nameFromString(current_lookup->textname, &query_name);
-   
+
 		result = prove_nx(msg, &query_name, current_lookup->rdclass,
 				  current_lookup->rdtype, &rdata_name,
 				  &rdataset, &sigrdataset);
@@ -5067,7 +5079,7 @@ sigchase_bu(dns_message_t *msg)
 		}
 		printf(";; An NSEC prove the non-existence of a answers,"
 		       " Now we want validate this NSEC\n");
-	
+
 		dup_name(&rdata_name, &chase_name, mctx);
 		free_name(&rdata_name, mctx);
 		chase_rdataset =  rdataset;
@@ -5148,7 +5160,7 @@ sigchase_bu(dns_message_t *msg)
 	chase_sigdsrdataset = NULL;
 	chase_siglookedup = chase_keylookedup = ISC_FALSE;
 	chase_dslookedup = chase_sigdslookedup = ISC_FALSE;
- 
+
 	printf(";; Now, we want to validate the DS :  recursive call\n");
 	sigchase(msg);
 	return;
@@ -5241,7 +5253,7 @@ prove_nx_domain(dns_message_t *msg,
 		       " validate the non-existence : FAILED\n");
 		return (ISC_R_FAILURE);
 	}
- 
+
 	do {
 		nsecname = NULL;
 		dns_message_currentname(msg, DNS_SECTION_AUTHORITY, &nsecname);
@@ -5319,7 +5331,7 @@ prove_nx_type(dns_message_t *msg, dns_name_t *name, dns_rdataset_t *nsecset,

 	ret = dns_rdataset_first(nsecset);
 	check_result(ret,"dns_rdataset_first");
-	
+
 	dns_rdataset_current(nsecset, &nsec);

 	ret = dns_nsec_typepresent(&nsec, type);
@@ -5387,6 +5399,6 @@ prove_nx(dns_message_t *msg, dns_name_t *name, dns_rdataclass_t class,
 				      rdataset, sigrdataset);
 		return (ret);
 	}
-	/* Never get here */ 
+	/* Never get here */
 }
 #endif
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: host.1,v 1.14.18.12 2006/12/12 01:44:27 marka Exp $
+.\" $Id: host.1,v 1.14.18.16 2008/04/06 01:31:04 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -130,7 +130,7 @@ makes. This should mean that the name server receiving the query will not attemp
 \fB\-r\fR
 option enables
 \fBhost\fR
-to mimic the behaviour of a name server by making non\-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers.
+to mimic the behavior of a name server by making non\-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers.
 .PP
 By default
 \fBhost\fR
@@ -152,9 +152,9 @@ The
 \fB\-t\fR
 option is used to select the query type.
 \fItype\fR
-can be any recognised query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified,
+can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc. When no query type is specified,
 \fBhost\fR
-automatically selects an appropriate query type. By default it looks for A records, but if the
+automatically selects an appropriate query type. By default it looks for A, AAAA, and MX records, but if the
 \fB\-C\fR
 option was given, queries will be made for SOA records, and if
 \fIname\fR
@@ -185,7 +185,7 @@ The
 option tells
 \fBhost\fR
 \fInot\fR
-to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behaviour.
+to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behavior.
 .PP
 The
 \fB\-m\fR
@@ -213,7 +213,7 @@ runs.
 \fBdig\fR(1),
 \fBnamed\fR(8).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2002 Internet Software Consortium.
 .br
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,13 +15,25 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: host.c,v 1.94.18.14 2006/05/23 04:40:42 marka Exp $ */
+/* $Id: host.c,v 1.94.18.19 2007/08/28 07:19:55 tbox Exp $ */

 /*! \file */

 #include <config.h>
+#include <stdlib.h>
 #include <limits.h>

+#ifdef HAVE_LOCALE_H
+#include <locale.h>
+#endif
+
+#ifdef WITH_IDN
+#include <idn/result.h>
+#include <idn/log.h>
+#include <idn/resconf.h>
+#include <idn/api.h>
+#endif
+
 #include <isc/app.h>
 #include <isc/commandline.h>
 #include <isc/netaddr.h>
@@ -414,8 +426,10 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	if (msg->rcode != 0) {
 		char namestr[DNS_NAME_FORMATSIZE];
 		dns_name_format(query->lookup->name, namestr, sizeof(namestr));
-		printf("Host %s not found: %d(%s)\n", namestr,
-		       msg->rcode, rcodetext[msg->rcode]);
+		printf("Host %s not found: %d(%s)\n",
+		       (msg->rcode != dns_rcode_nxdomain) ? namestr :
+		       query->lookup->textname, msg->rcode,
+		       rcodetext[msg->rcode]);
 		return (ISC_R_SUCCESS);
 	}

@@ -569,6 +583,7 @@ pre_parse_args(int argc, char **argv) {
 	while ((c = isc_commandline_parse(argc, argv, optstring)) != -1) {
 		switch (c) {
 		case 'm':
+			memdebugging = ISC_TRUE;
 			if (strcasecmp("trace", isc_commandline_argument) == 0)
 				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
 			else if (!strcasecmp("record",
@@ -664,6 +679,9 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = rdtype;
 			lookup->rdtypeset = ISC_TRUE;
+#ifdef WITH_IDN
+			idnoptions = 0;
+#endif
 			if (rdtype == dns_rdatatype_axfr) {
 				/* -l -t any -v */
 				list_type = dns_rdatatype_any;
@@ -672,6 +690,13 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			} else if (rdtype == dns_rdatatype_ixfr) {
 				lookup->ixfr_serial = serial;
 				list_type = rdtype;
+#ifdef WITH_IDN
+			} else if (rdtype == dns_rdatatype_a ||
+				   rdtype == dns_rdatatype_aaaa ||
+				   rdtype == dns_rdatatype_mx) {
+				idnoptions = IDN_ASCCHECK;
+				list_type = rdtype;
+#endif
 			} else
 				list_type = rdtype;
 			list_addresses = ISC_FALSE;
@@ -814,6 +839,9 @@ main(int argc, char **argv) {
 	ISC_LIST_INIT(search_list);
 	
 	fatalexit = 1;
+#ifdef WITH_IDN
+	idnoptions = IDN_ASCCHECK;
+#endif

 	debug("main()");
 	progname = argv[0];
@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: host.docbook,v 1.5.18.7 2005/09/09 06:22:06 marka Exp $ -->
+<!-- $Id: host.docbook,v 1.5.18.13 2008/04/05 23:46:04 tbox Exp $ -->
 <refentry id="man.host">

  <refentryinfo>
@@ -40,6 +40,8 @@
    <copyright>
      <year>2004</year>
      <year>2005</year>
+      <year>2007</year>
+      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -172,7 +174,7 @@
      attempt to resolve <parameter>name</parameter>.  The
      <option>-r</option> option enables <command>host</command>
      to mimic
-      the behaviour of a name server by making non-recursive queries and
+      the behavior of a name server by making non-recursive queries and
      expecting to receive answers to those queries that are usually
      referrals to other name servers.
    </para>
@@ -193,12 +195,12 @@

    <para>
      The <option>-t</option> option is used to select the query type.
-      <parameter>type</parameter> can be any recognised query
+      <parameter>type</parameter> can be any recognized query
      type: CNAME,
      NS, SOA, SIG, KEY, AXFR, etc.  When no query type is specified,
      <command>host</command> automatically selects an appropriate
      query
-      type.  By default it looks for A records, but if the
+      type.  By default it looks for A, AAAA, and MX records, but if the
      <option>-C</option> option was given, queries will be made for SOA
      records, and if <parameter>name</parameter> is a
      dotted-decimal IPv4
@@ -226,7 +228,7 @@
      The <option>-s</option> option tells <command>host</command> 
      <emphasis>not</emphasis> to send the query to the next nameserver
      if any server responds with a SERVFAIL response, which is the
-      reverse of normal stub resolver behaviour.
+      reverse of normal stub resolver behavior.
    </para>

    <para>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: host.html,v 1.7.18.17 2006/12/12 01:44:27 marka Exp $ -->
+<!-- $Id: host.html,v 1.7.18.22 2008/04/06 01:31:04 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">host</code>  [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] {name} [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543614"></a><h2>DESCRIPTION</h2>
+<a name="id2543431"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">host</strong></span>
      is a simple utility for performing DNS lookups.
      It is normally used to convert names to IP addresses and vice versa.
@@ -125,7 +125,7 @@
      attempt to resolve <em class="parameter"><code>name</code></em>.  The
      <code class="option">-r</code> option enables <span><strong class="command">host</strong></span>
      to mimic
-      the behaviour of a name server by making non-recursive queries and
+      the behavior of a name server by making non-recursive queries and
      expecting to receive answers to those queries that are usually
      referrals to other name servers.
    </p>
@@ -143,12 +143,12 @@
    </p>
 <p>
      The <code class="option">-t</code> option is used to select the query type.
-      <em class="parameter"><code>type</code></em> can be any recognised query
+      <em class="parameter"><code>type</code></em> can be any recognized query
      type: CNAME,
      NS, SOA, SIG, KEY, AXFR, etc.  When no query type is specified,
      <span><strong class="command">host</strong></span> automatically selects an appropriate
      query
-      type.  By default it looks for A records, but if the
+      type.  By default it looks for A, AAAA, and MX records, but if the
      <code class="option">-C</code> option was given, queries will be made for SOA
      records, and if <em class="parameter"><code>name</code></em> is a
      dotted-decimal IPv4
@@ -174,7 +174,7 @@
      The <code class="option">-s</code> option tells <span><strong class="command">host</strong></span> 
      <span class="emphasis"><em>not</em></span> to send the query to the next nameserver
      if any server responds with a SERVFAIL response, which is the
-      reverse of normal stub resolver behaviour.
+      reverse of normal stub resolver behavior.
    </p>
 <p>
      The <code class="option">-m</code> can be used to set the memory usage debugging
@@ -184,7 +184,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543980"></a><h2>IDN SUPPORT</h2>
+<a name="id2543797"></a><h2>IDN SUPPORT</h2>
 <p>
      If <span><strong class="command">host</strong></span> has been built with IDN (internationalized
      domain name) support, it can accept and display non-ASCII domain names. 
@@ -198,12 +198,12 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544003"></a><h2>FILES</h2>
+<a name="id2543819"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544014"></a><h2>SEE ALSO</h2>
+<a name="id2543831"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
    </p>
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dig.h,v 1.82.18.19 2006/12/07 06:08:02 marka Exp $ */
+/* $Id: dig.h,v 1.82.18.23 2007/08/28 07:19:55 tbox Exp $ */

 #ifndef DIG_H
 #define DIG_H
@@ -277,6 +277,9 @@ extern isc_boolean_t debugging, memdebugging;
 extern char *progname;
 extern int tries;
 extern int fatalexit;
+#ifdef WITH_IDN
+extern int idnoptions;
+#endif

 /*
 * Routines in dighost.c.
@@ -300,6 +303,9 @@ check_result(isc_result_t result, const char *msg);
 void
 setup_lookup(dig_lookup_t *lookup);

+void
+destroy_lookup(dig_lookup_t *lookup);
+
 void
 do_lookup(dig_lookup_t *lookup);

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: nslookup.1,v 1.1.10.11 2006/12/17 04:54:15 marka Exp $
+.\" $Id: nslookup.1,v 1.1.10.14 2007/05/16 06:11:27 marka Exp $
 .\"
 .hy 0
 .ad l
@@ -158,7 +158,7 @@ The class specifies the protocol group of the information.
 .PP
 \fB \fR\fB\fI[no]\fR\fR\fBdebug\fR
 .RS 4
-Turn debugging mode on. A lot more information is printed about the packet sent to the server and the resulting answer.
+Turn on or off the display of the full response packet and any intermediate response packets when searching.
 .sp
 (Default = nodebug; abbreviation =
 [no]deb)
@@ -166,7 +166,7 @@ Turn debugging mode on. A lot more information is printed about the packet sent
 .PP
 \fB \fR\fB\fI[no]\fR\fR\fBd2\fR
 .RS 4
-Turn debugging mode on. A lot more information is printed about the packet sent to the server and the resulting answer.
+Turn debugging mode on or off. This displays more about what nslookup is doing.
 .sp
 (Default = nod2)
 .RE
@@ -248,5 +248,5 @@ Try the next nameserver if a nameserver responds with SERVFAIL or a referral (no
 .PP
 Andrew Cherenson
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2006 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: nslookup.c,v 1.101.18.12 2006/12/07 06:08:02 marka Exp $ */
+/* $Id: nslookup.c,v 1.101.18.15 2007/08/28 07:19:55 tbox Exp $ */

 #include <config.h>

@@ -410,8 +410,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		char nametext[DNS_NAME_FORMATSIZE];
 		dns_name_format(query->lookup->name,
 				nametext, sizeof(nametext));
-		printf("** server can't find %s: %s\n", nametext,
-		       rcodetext[msg->rcode]);
+		printf("** server can't find %s: %s\n",
+		       (msg->rcode != dns_rcode_nxdomain) ? nametext :
+		       query->lookup->textname, rcodetext[msg->rcode]);
 		debug("returning with rcode == 0");
 		return (ISC_R_SUCCESS);
 	}
@@ -1,10 +1,10 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -17,7 +17,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: nslookup.docbook,v 1.4.2.8 2006/12/16 01:15:13 sra Exp $ -->
+<!-- $Id: nslookup.docbook,v 1.4.2.13 2007/08/28 07:19:55 tbox Exp $ -->
 <!--
 - Copyright (c) 1985, 1989
 -    The Regents of the University of California.  All rights reserved.
@@ -72,6 +72,7 @@
      <year>2004</year>
      <year>2005</year>
      <year>2006</year>
+      <year>2007</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -313,9 +314,8 @@ nslookup -query=hinfo  -timeout=10
                    <replaceable><optional>no</optional></replaceable>debug</constant></term>
                <listitem>
                  <para>
-                    Turn debugging mode on.  A lot more information is
-                    printed about the packet sent to the server and the
-                    resulting answer.
+		    Turn on or off the display of the full response packet and
+		    any intermediate response packets when searching.
                  </para>
 		  <para>
                    (Default = nodebug; abbreviation = <optional>no</optional>deb)
@@ -328,9 +328,8 @@ nslookup -query=hinfo  -timeout=10
                    <replaceable><optional>no</optional></replaceable>d2</constant></term>
                <listitem>
                  <para>
-                    Turn debugging mode on.  A lot more information is
-                    printed about the packet sent to the server and the
-                    resulting answer.
+                    Turn debugging mode on or off.  This displays more about
+	            what nslookup is doing.
                  </para>
 		  <para>
                    (Default = nod2)
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: nslookup.html,v 1.1.10.17 2006/12/17 04:54:15 marka Exp $ -->
+<!-- $Id: nslookup.html,v 1.1.10.21 2007/05/16 06:11:27 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -21,7 +21,7 @@
 <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2476423"></a><div class="titlepage"></div>
+<a name="id2476276"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>nslookup &#8212; query Internet name servers interactively</p>
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">nslookup</code>  [<code class="option">-option</code>] [name | -] [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543610"></a><h2>DESCRIPTION</h2>
+<a name="id2543355"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">Nslookup</strong></span>
      is a program to query Internet domain name servers.  <span><strong class="command">Nslookup</strong></span>
      has two modes: interactive and non-interactive.  Interactive mode allows
@@ -43,7 +43,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543626"></a><h2>ARGUMENTS</h2>
+<a name="id2543371"></a><h2>ARGUMENTS</h2>
 <p>
      Interactive mode is entered in the following cases:
      </p>
@@ -76,7 +76,7 @@ nslookup -query=hinfo  -timeout=10
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543668"></a><h2>INTERACTIVE COMMANDS</h2>
+<a name="id2543413"></a><h2>INTERACTIVE COMMANDS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">host</code> [<span class="optional">server</span>]</span></dt>
 <dd>
@@ -180,9 +180,8 @@ nslookup -query=hinfo  -timeout=10
                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>debug</code></span></dt>
 <dd>
 <p>
-                    Turn debugging mode on.  A lot more information is
-                    printed about the packet sent to the server and the
-                    resulting answer.
+		    Turn on or off the display of the full response packet and
+		    any intermediate response packets when searching.
                  </p>
 <p>
                    (Default = nodebug; abbreviation = [<span class="optional">no</span>]deb)
@@ -192,9 +191,8 @@ nslookup -query=hinfo  -timeout=10
                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>d2</code></span></dt>
 <dd>
 <p>
-                    Turn debugging mode on.  A lot more information is
-                    printed about the packet sent to the server and the
-                    resulting answer.
+                    Turn debugging mode on or off.  This displays more about
+	            what nslookup is doing.
                  </p>
 <p>
                    (Default = nod2)
@@ -288,19 +286,19 @@ nslookup -query=hinfo  -timeout=10
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544145"></a><h2>FILES</h2>
+<a name="id2546279"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544156"></a><h2>SEE ALSO</h2>
+<a name="id2546291"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2546512"></a><h2>Author</h2>
+<a name="id2546325"></a><h2>Author</h2>
 <p>
      Andrew Cherenson
    </p>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dnssec-keygen.8,v 1.23.18.12 2006/12/12 01:44:27 marka Exp $
+.\" $Id: dnssec-keygen.8,v 1.23.18.16 2008/10/16 01:29:40 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -37,7 +37,7 @@ dnssec\-keygen \- DNSSEC key generation tool
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
-generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC <TBA\\>. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845.
+generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC 4034. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845.
 .SH "OPTIONS"
 .PP
 \-a \fIalgorithm\fR
@@ -147,7 +147,7 @@ is the numeric representation of the algorithm.
 is the key identifier (or footprint).
 .PP
 \fBdnssec\-keygen\fR
-creates two file, with names based on the printed string.
+creates two files, with names based on the printed string.
 \fIKnnnn.+aaa+iiiii.key\fR
 contains the public key, and
 \fIKnnnn.+aaa+iiiii.private\fR
@@ -159,13 +159,13 @@ file contains a DNS KEY record that can be inserted into a zone file (directly o
 .PP
 The
 \fI.private\fR
-file contains algorithm specific fields. For obvious security reasons, this file does not have general read permission.
+file contains algorithm\-specific fields. For obvious security reasons, this file does not have general read permission.
 .PP
 Both
 \fI.key\fR
 and
 \fI.private\fR
-files are generated for symmetric encryption algorithm such as HMAC\-MD5, even though the public and private key are equivalent.
+files are generated for symmetric encryption algorithms such as HMAC\-MD5, even though the public and private key are equivalent.
 .SH "EXAMPLE"
 .PP
 To generate a 768\-bit DSA key for the domain
@@ -182,19 +182,19 @@ In this example,
 creates the files
 \fIKexample.com.+003+26160.key\fR
 and
-\fIKexample.com.+003+26160.private\fR
+\fIKexample.com.+003+26160.private\fR.
 .SH "SEE ALSO"
 .PP
 \fBdnssec\-signzone\fR(8),
 BIND 9 Administrator Reference Manual,
-RFC 2535,
+RFC 2539,
 RFC 2845,
-RFC 2539.
+RFC 4033.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
@@ -1,9 +1,9 @@
 /*
- * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
- * Portions Copyright (C) 2000-2003  Internet Software Consortium.
+ * Portions Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1999-2003  Internet Software Consortium.
 * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -16,7 +16,7 @@
 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssec-keygen.c,v 1.66.18.7 2006/01/27 02:50:50 marka Exp $ */
+/* $Id: dnssec-keygen.c,v 1.66.18.10 2007/08/28 07:19:55 tbox Exp $ */

 /*! \file */

@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: dnssec-keygen.docbook,v 1.7.18.7 2005/08/30 01:42:12 marka Exp $ -->
+<!-- $Id: dnssec-keygen.docbook,v 1.7.18.13 2008/10/15 23:46:06 tbox Exp $ -->
 <refentry id="man.dnssec-keygen">
  <refentryinfo>
    <date>June 30, 2000</date>
@@ -39,6 +39,8 @@
    <copyright>
      <year>2004</year>
      <year>2005</year>
+      <year>2007</year>
+      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -75,7 +77,7 @@
    <title>DESCRIPTION</title>
    <para><command>dnssec-keygen</command>
      generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
-      and RFC &lt;TBA\&gt;.  It can also generate keys for use with
+      and RFC 4034.  It can also generate keys for use with
      TSIG (Transaction Signatures), as defined in RFC 2845.
    </para>
  </refsect1>
@@ -285,7 +287,7 @@
      </listitem>
    </itemizedlist>
    <para><command>dnssec-keygen</command> 
-      creates two file, with names based
+      creates two files, with names based
      on the printed string.  <filename>Knnnn.+aaa+iiiii.key</filename>
      contains the public key, and
      <filename>Knnnn.+aaa+iiiii.private</filename> contains the
@@ -299,14 +301,14 @@
      statement).
    </para>
    <para>
-      The <filename>.private</filename> file contains algorithm
-      specific
+      The <filename>.private</filename> file contains
+      algorithm-specific
      fields.  For obvious security reasons, this file does not have
      general read permission.
    </para>
    <para>
      Both <filename>.key</filename> and <filename>.private</filename>
-      files are generated for symmetric encryption algorithm such as
+      files are generated for symmetric encryption algorithms such as
      HMAC-MD5, even though the public and private key are equivalent.
    </para>
  </refsect1>
@@ -329,7 +331,7 @@
      In this example, <command>dnssec-keygen</command> creates
      the files <filename>Kexample.com.+003+26160.key</filename>
      and
-      <filename>Kexample.com.+003+26160.private</filename>
+      <filename>Kexample.com.+003+26160.private</filename>.
    </para>
  </refsect1>

@@ -339,9 +341,9 @@
        <refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 2535</citetitle>,
+      <citetitle>RFC 2539</citetitle>,
      <citetitle>RFC 2845</citetitle>,
-      <citetitle>RFC 2539</citetitle>.
+      <citetitle>RFC 4033</citetitle>.
    </para>
  </refsect1>

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dnssec-keygen.html,v 1.9.18.17 2006/12/12 01:44:27 marka Exp $ -->
+<!-- $Id: dnssec-keygen.html,v 1.9.18.22 2008/10/16 01:29:40 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,15 +32,15 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543660"></a><h2>DESCRIPTION</h2>
+<a name="id2543477"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-keygen</strong></span>
      generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
-      and RFC &lt;TBA\&gt;.  It can also generate keys for use with
+      and RFC 4034.  It can also generate keys for use with
      TSIG (Transaction Signatures), as defined in RFC 2845.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543672"></a><h2>OPTIONS</h2>
+<a name="id2543489"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
@@ -148,7 +148,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544007"></a><h2>GENERATED KEYS</h2>
+<a name="id2543824"></a><h2>GENERATED KEYS</h2>
 <p>
      When <span><strong class="command">dnssec-keygen</strong></span> completes
      successfully,
@@ -168,7 +168,7 @@
        </p></li>
 </ul></div>
 <p><span><strong class="command">dnssec-keygen</strong></span> 
-      creates two file, with names based
+      creates two files, with names based
      on the printed string.  <code class="filename">Knnnn.+aaa+iiiii.key</code>
      contains the public key, and
      <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
@@ -182,19 +182,19 @@
      statement).
    </p>
 <p>
-      The <code class="filename">.private</code> file contains algorithm
-      specific
+      The <code class="filename">.private</code> file contains
+      algorithm-specific
      fields.  For obvious security reasons, this file does not have
      general read permission.
    </p>
 <p>
      Both <code class="filename">.key</code> and <code class="filename">.private</code>
-      files are generated for symmetric encryption algorithm such as
+      files are generated for symmetric encryption algorithms such as
      HMAC-MD5, even though the public and private key are equivalent.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544089"></a><h2>EXAMPLE</h2>
+<a name="id2543906"></a><h2>EXAMPLE</h2>
 <p>
      To generate a 768-bit DSA key for the domain
      <strong class="userinput"><code>example.com</code></strong>, the following command would be
@@ -211,20 +211,20 @@
      In this example, <span><strong class="command">dnssec-keygen</strong></span> creates
      the files <code class="filename">Kexample.com.+003+26160.key</code>
      and
-      <code class="filename">Kexample.com.+003+26160.private</code>
+      <code class="filename">Kexample.com.+003+26160.private</code>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544201"></a><h2>SEE ALSO</h2>
+<a name="id2543949"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 2535</em>,
+      <em class="citetitle">RFC 2539</em>,
      <em class="citetitle">RFC 2845</em>,
-      <em class="citetitle">RFC 2539</em>.
+      <em class="citetitle">RFC 4033</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544232"></a><h2>AUTHOR</h2>
+<a name="id2544049"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dnssec-signzone.8,v 1.28.18.15 2006/12/12 01:44:27 marka Exp $
+.\" $Id: dnssec-signzone.8,v 1.28.18.19 2008/10/16 01:29:40 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -95,7 +95,7 @@ is specified, 30 days from the start time is used as a default.
 .RS 4
 The name of the output file containing the signed zone. The default is to append
 \fI.signed\fR
-to the input file.
+to the input filename.
 .RE
 .PP
 \-h
@@ -106,7 +106,7 @@ Prints a short summary of the options and arguments to
 .PP
 \-i \fIinterval\fR
 .RS 4
-When a previously signed zone is passed as input, records may be resigned. The
+When a previously\-signed zone is passed as input, records may be resigned. The
 \fBinterval\fR
 option specifies the cycle interval as an offset from the current time (in seconds). If a RRSIG record expires after the cycle interval, it is retained. Otherwise, it is considered to be expiring soon, and it will be replaced.
 .sp
@@ -129,7 +129,7 @@ The format of the input zone file. Possible formats are
 .PP
 \-j \fIjitter\fR
 .RS 4
-When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. a previously signed zone is passed as input to the signer, all expired signatures has to be regenerated at about the same time. The
+When signing a zone with a fixed signature lifetime, all RRSIG records issued at the time of signing expires simultaneously. If the zone is incrementally signed, i.e. a previously\-signed zone is passed as input to the signer, all expired signatures have to be regenerated at about the same time. The
 \fBjitter\fR
 option specifies a jitter window that will be used to randomize the signature expire time, thus spreading incremental signature regeneration over time.
 .sp
@@ -219,39 +219,54 @@ The file containing the zone to be signed.
 .PP
 key
 .RS 4
-The keys used to sign the zone. If no keys are specified, the default all zone keys that have private key files in the current directory.
+Specify which keys should be used to sign the zone. If no keys are specified, then the zone will be examined for DNSKEY records at the zone apex. If these are found and there are matching private keys, in the current directory, then these will be used for signing.
 .RE
 .SH "EXAMPLE"
 .PP
 The following command signs the
 \fBexample.com\fR
-zone with the DSA key generated in the
+zone with the DSA key generated by
 \fBdnssec\-keygen\fR
-man page. The zone's keys must be in the zone. If there are
+(Kexample.com.+003+17247). The zone's keys must be in the master file (\fIdb.example.com\fR). This invocation looks for
 \fIkeyset\fR
-files associated with child zones, they must be in the current directory.
-\fBexample.com\fR, the following command would be issued:
+files, in the current directory, so that DS records can be generated from them (\fB\-g\fR).
+.sp
+.RS 4
+.nf
+% dnssec\-signzone \-g \-o example.com db.example.com \\
+Kexample.com.+003+17247
+db.example.com.signed
+%
+.fi
+.RE
 .PP
-\fBdnssec\-signzone \-o example.com db.example.com Kexample.com.+003+26160\fR
-.PP
-The command would print a string of the form:
-.PP
-In this example,
+In the above example,
 \fBdnssec\-signzone\fR
 creates the file
 \fIdb.example.com.signed\fR. This file should be referenced in a zone statement in a
 \fInamed.conf\fR
 file.
+.PP
+This example re\-signs a previously signed zone with default parameters. The private keys are assumed to be in the current directory.
+.sp
+.RS 4
+.nf
+% cp db.example.com.signed db.example.com
+% dnssec\-signzone \-o example.com db.example.com
+db.example.com.signed
+%
+.fi
+.RE
 .SH "SEE ALSO"
 .PP
 \fBdnssec\-keygen\fR(8),
 BIND 9 Administrator Reference Manual,
-RFC 2535.
+RFC 4033.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2006 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
@@ -1,9 +1,9 @@
 /*
- * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 * Portions Copyright (C) 1999-2003  Internet Software Consortium.
 * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -16,7 +16,7 @@
 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssec-signzone.c,v 1.177.18.21 2006/08/30 23:01:54 marka Exp $ */
+/* $Id: dnssec-signzone.c,v 1.177.18.26 2008/06/02 23:46:01 tbox Exp $ */

 /*! \file */

@@ -128,7 +128,6 @@ static dns_name_t *gorigin;		/* The database origin */
 static isc_task_t *master = NULL;
 static unsigned int ntasks = 0;
 static isc_boolean_t shuttingdown = ISC_FALSE, finished = ISC_FALSE;
-static unsigned int assigned = 0, completed = 0;
 static isc_boolean_t nokeys = ISC_FALSE;
 static isc_boolean_t removefile = ISC_FALSE;
 static isc_boolean_t generateds = ISC_FALSE;
@@ -969,7 +968,7 @@ active_node(dns_dbnode_t *node) {
 			fatal("rdataset iteration failed: %s",
 			      isc_result_totext(result));
 	} else {
-		/* 
+		/*
 		 * Delete RRSIGs for types that no longer exist.
 		 */
 		result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter2);
@@ -1194,7 +1193,7 @@ signapex(void) {
 	dns_fixedname_t fixed;
 	dns_name_t *name;
 	isc_result_t result;
-	
+
 	dns_fixedname_init(&fixed);
 	name = dns_fixedname_name(&fixed);
 	result = dns_dbiterator_current(gdbiter, &node, name);
@@ -1224,16 +1223,19 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	dns_rdataset_t nsec;
 	isc_boolean_t found;
 	isc_result_t result;
+	static unsigned int ended = 0;		/* Protected by namelock. */

 	if (shuttingdown)
 		return;

+	LOCK(&namelock);
 	if (finished) {
-		if (assigned == completed) {
+		ended++;
+		if (ended == ntasks) {
 			isc_task_detach(&task);
 			isc_app_shutdown();
 		}
-		return;
+		goto unlock;
 	}

 	fname = isc_mem_get(mctx, sizeof(dns_fixedname_t));
@@ -1243,7 +1245,6 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	name = dns_fixedname_name(fname);
 	node = NULL;
 	found = ISC_FALSE;
-	LOCK(&namelock);
 	while (!found) {
 		result = dns_dbiterator_current(gdbiter, &node, name);
 		if (result != ISC_R_SUCCESS)
@@ -1270,14 +1271,14 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 			fatal("failure iterating database: %s",
 			      isc_result_totext(result));
 	}
-	UNLOCK(&namelock);
 	if (!found) {
-		if (assigned == completed) {
+		ended++;
+		if (ended == ntasks) {
 			isc_task_detach(&task);
 			isc_app_shutdown();
 		}
 		isc_mem_put(mctx, fname, sizeof(dns_fixedname_t));
-		return;
+		goto unlock;
 	}
 	sevent = (sevent_t *)
 		 isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,
@@ -1288,7 +1289,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 	sevent->node = node;
 	sevent->fname = fname;
 	isc_task_send(worker, ISC_EVENT_PTR(&sevent));
-	assigned++;
+ unlock:
+	UNLOCK(&namelock);
 }

 /*%
@@ -1311,7 +1313,6 @@ writenode(isc_task_t *task, isc_event_t *event) {
 	isc_task_t *worker;
 	sevent_t *sevent = (sevent_t *)event;

-	completed++;
 	worker = (isc_task_t *)event->ev_sender;
 	dumpnode(dns_fixedname_name(sevent->fname), sevent->node);
 	cleannode(gdb, gversion, sevent->node);
@@ -1481,7 +1482,7 @@ loadzonekeys(dns_db_t *db) {
 	for (i = 0; i < nkeys; i++) {
 		signer_key_t *key;

-		key = newkeystruct(keys[i], ISC_TRUE);
+		key = newkeystruct(keys[i], dst_key_isprivate(keys[i]));
 		ISC_LIST_APPEND(keylist, key, link);
 	}
 	dns_db_detachnode(db, &node);
@@ -1605,7 +1606,7 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
 	unsigned char keybuf[DST_KEY_MAXSIZE];
 	unsigned int filenamelen;
-	const dns_master_style_t *style = 
+	const dns_master_style_t *style =
 		(type == dns_rdatatype_dnskey) ? masterstyle : dsstyle;

 	isc_buffer_init(&namebuf, namestr, sizeof(namestr));
@@ -1818,13 +1819,13 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish) {
 	printf("Signatures successfully verified:   %10d\n", nverified);
 	printf("Signatures unsuccessfully verified: %10d\n", nverifyfailed);
 	runtime_ms = runtime_us / 1000;
-	printf("Runtime in seconds:                %7u.%03u\n", 
-	       (unsigned int) (runtime_ms / 1000), 
+	printf("Runtime in seconds:                %7u.%03u\n",
+	       (unsigned int) (runtime_ms / 1000),
 	       (unsigned int) (runtime_ms % 1000));
 	if (runtime_us > 0) {
 		sig_ms = ((isc_uint64_t)nsigned * 1000000000) / runtime_us;
 		printf("Signatures per second:             %7u.%03u\n",
-		       (unsigned int) sig_ms / 1000, 
+		       (unsigned int) sig_ms / 1000,
 		       (unsigned int) sig_ms % 1000);
 	}
 }
@@ -1914,7 +1915,7 @@ main(int argc, char *argv[]) {
 				fatal("jitter must be numeric and positive");
 			break;

-		case 'l': 
+		case 'l':
 			dns_fixedname_init(&dlv_fixed);
 			len = strlen(isc_commandline_argument);
 			isc_buffer_init(&b, isc_commandline_argument, len);
@@ -2080,7 +2081,7 @@ main(int argc, char *argv[]) {
 	result = dns_master_stylecreate(&dsstyle,  DNS_STYLEFLAG_NO_TTL,
 					0, 24, 0, 0, 0, 8, mctx);
 	check_result(result, "dns_master_stylecreate");
-					
+

 	gdb = NULL;
 	TIME_NOW(&timer_start);
@@ -2102,8 +2103,8 @@ main(int argc, char *argv[]) {
 						       DST_TYPE_PRIVATE,
 						       mctx, &newkey);
 			if (result != ISC_R_SUCCESS)
-				fatal("cannot load dnskey %s: %s", argv[i], 
-				      isc_result_totext(result)); 
+				fatal("cannot load dnskey %s: %s", argv[i],
+				      isc_result_totext(result));

 			key = ISC_LIST_HEAD(keylist);
 			while (key != NULL) {
@@ -2111,7 +2112,7 @@ main(int argc, char *argv[]) {
 				if (dst_key_id(dkey) == dst_key_id(newkey) &&
 				    dst_key_alg(dkey) == dst_key_alg(newkey) &&
 				    dns_name_equal(dst_key_name(dkey),
-					    	   dst_key_name(newkey)))
+						   dst_key_name(newkey)))
 				{
 					if (!dst_key_isprivate(dkey))
 						fatal("cannot sign zone with "
@@ -2140,7 +2141,7 @@ main(int argc, char *argv[]) {
 					       mctx, &newkey);
 		if (result != ISC_R_SUCCESS)
 			fatal("cannot load dnskey %s: %s", dskeyfile[i],
-			      isc_result_totext(result)); 
+			      isc_result_totext(result));

 		key = ISC_LIST_HEAD(keylist);
 		while (key != NULL) {
@@ -2148,7 +2149,7 @@ main(int argc, char *argv[]) {
 			if (dst_key_id(dkey) == dst_key_id(newkey) &&
 			    dst_key_alg(dkey) == dst_key_alg(newkey) &&
 			    dns_name_equal(dst_key_name(dkey),
-				    	   dst_key_name(newkey)))
+					   dst_key_name(newkey)))
 			{
 				/* Override key flags. */
 				key->issigningkey = ISC_TRUE;
@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: dnssec-signzone.docbook,v 1.10.18.13 2006/04/15 22:19:21 marka Exp $ -->
+<!-- $Id: dnssec-signzone.docbook,v 1.10.18.19 2008/10/15 23:46:06 tbox Exp $ -->
 <refentry id="man.dnssec-signzone">
  <refentryinfo>
    <date>June 30, 2000</date>
@@ -40,6 +40,8 @@
      <year>2004</year>
      <year>2005</year>
      <year>2006</year>
+      <year>2007</year>
+      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -192,7 +194,7 @@
            The name of the output file containing the signed zone.  The
            default is to append <filename>.signed</filename> to
            the
-            input file.
+            input filename.
          </para>
        </listitem>
      </varlistentry>
@@ -211,7 +213,7 @@
        <term>-i <replaceable class="parameter">interval</replaceable></term>
        <listitem>
          <para>
-            When a previously signed zone is passed as input, records
+            When a previously-signed zone is passed as input, records
            may be resigned.  The <option>interval</option> option
            specifies the cycle interval as an offset from the current
            time (in seconds).  If a RRSIG record expires after the
@@ -255,8 +257,8 @@
            When signing a zone with a fixed signature lifetime, all
            RRSIG records issued at the time of signing expires
            simultaneously.  If the zone is incrementally signed, i.e.
-            a previously signed zone is passed as input to the signer,
-            all expired signatures has to be regenerated at about the
+            a previously-signed zone is passed as input to the signer,
+            all expired signatures have to be regenerated at about the
            same time.  The <option>jitter</option> option specifies a
            jitter window that will be used to randomize the signature
            expire time, thus spreading incremental signature
@@ -410,9 +412,11 @@
        <term>key</term>
        <listitem>
          <para>
-            The keys used to sign the zone.  If no keys are specified, the
-            default all zone keys that have private key files in the
-            current directory.
+	    Specify which keys should be used to sign the zone.  If
+	    no keys are specified, then the zone will be examined
+	    for DNSKEY records at the zone apex.  If these are found and
+	    there are matching private keys, in the current directory,
+	    then these will be used for signing.
          </para>
        </listitem>
      </varlistentry>
@@ -424,27 +428,30 @@
    <title>EXAMPLE</title>
    <para>
      The following command signs the <userinput>example.com</userinput>
-      zone with the DSA key generated in the <command>dnssec-keygen</command>
-      man page.  The zone's keys must be in the zone.  If there are
-      <filename>keyset</filename> files associated with child
-      zones,
-      they must be in the current directory.
-      <userinput>example.com</userinput>, the following command would be
-      issued:
-    </para>
-    <para><userinput>dnssec-signzone -o example.com db.example.com
-        Kexample.com.+003+26160</userinput>
+      zone with the DSA key generated by <command>dnssec-keygen</command>
+      (Kexample.com.+003+17247).  The zone's keys must be in the master
+      file (<filename>db.example.com</filename>).  This invocation looks
+      for <filename>keyset</filename> files, in the current directory,
+      so that DS records can be generated from them (<command>-g</command>).
    </para>
+<programlisting>% dnssec-signzone -g -o example.com db.example.com \
+Kexample.com.+003+17247
+db.example.com.signed
+%</programlisting>
    <para>
-      The command would print a string of the form:
-    </para>
-    <para>
-      In this example, <command>dnssec-signzone</command> creates
+      In the above example, <command>dnssec-signzone</command> creates
      the file <filename>db.example.com.signed</filename>.  This
-      file
-      should be referenced in a zone statement in a
+      file should be referenced in a zone statement in a
      <filename>named.conf</filename> file.
    </para>
+    <para>
+      This example re-signs a previously signed zone with default parameters.
+      The private keys are assumed to be in the current directory.
+    </para>
+<programlisting>% cp db.example.com.signed db.example.com
+% dnssec-signzone -o example.com db.example.com
+db.example.com.signed
+%</programlisting>
  </refsect1>

  <refsect1>
@@ -453,7 +460,7 @@
        <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 2535</citetitle>.
+      <citetitle>RFC 4033</citetitle>.
    </para>
  </refsect1>

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dnssec-signzone.html,v 1.8.18.20 2006/12/12 01:44:27 marka Exp $ -->
+<!-- $Id: dnssec-signzone.html,v 1.8.18.25 2008/10/16 01:29:40 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {zonefile} [key...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543713"></a><h2>DESCRIPTION</h2>
+<a name="id2543529"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-signzone</strong></span>
      signs a zone.  It generates
      NSEC and RRSIG records and produces a signed version of the
@@ -43,7 +43,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543728"></a><h2>OPTIONS</h2>
+<a name="id2543544"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd><p>
@@ -99,7 +99,7 @@
            The name of the output file containing the signed zone.  The
            default is to append <code class="filename">.signed</code> to
            the
-            input file.
+            input filename.
          </p></dd>
 <dt><span class="term">-h</span></dt>
 <dd><p>
@@ -109,7 +109,7 @@
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
 <p>
-            When a previously signed zone is passed as input, records
+            When a previously-signed zone is passed as input, records
            may be resigned.  The <code class="option">interval</code> option
            specifies the cycle interval as an offset from the current
            time (in seconds).  If a RRSIG record expires after the
@@ -145,8 +145,8 @@
            When signing a zone with a fixed signature lifetime, all
            RRSIG records issued at the time of signing expires
            simultaneously.  If the zone is incrementally signed, i.e.
-            a previously signed zone is passed as input to the signer,
-            all expired signatures has to be regenerated at about the
+            a previously-signed zone is passed as input to the signer,
+            all expired signatures have to be regenerated at about the
            same time.  The <code class="option">jitter</code> option specifies a
            jitter window that will be used to randomize the signature
            expire time, thus spreading incremental signature
@@ -232,47 +232,52 @@
          </p></dd>
 <dt><span class="term">key</span></dt>
 <dd><p>
-            The keys used to sign the zone.  If no keys are specified, the
-            default all zone keys that have private key files in the
-            current directory.
+	    Specify which keys should be used to sign the zone.  If
+	    no keys are specified, then the zone will be examined
+	    for DNSKEY records at the zone apex.  If these are found and
+	    there are matching private keys, in the current directory,
+	    then these will be used for signing.
          </p></dd>
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544514"></a><h2>EXAMPLE</h2>
+<a name="id2544330"></a><h2>EXAMPLE</h2>
 <p>
      The following command signs the <strong class="userinput"><code>example.com</code></strong>
-      zone with the DSA key generated in the <span><strong class="command">dnssec-keygen</strong></span>
-      man page.  The zone's keys must be in the zone.  If there are
-      <code class="filename">keyset</code> files associated with child
-      zones,
-      they must be in the current directory.
-      <strong class="userinput"><code>example.com</code></strong>, the following command would be
-      issued:
-    </p>
-<p><strong class="userinput"><code>dnssec-signzone -o example.com db.example.com
-        Kexample.com.+003+26160</code></strong>
+      zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>
+      (Kexample.com.+003+17247).  The zone's keys must be in the master
+      file (<code class="filename">db.example.com</code>).  This invocation looks
+      for <code class="filename">keyset</code> files, in the current directory,
+      so that DS records can be generated from them (<span><strong class="command">-g</strong></span>).
    </p>
+<pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \
+Kexample.com.+003+17247
+db.example.com.signed
+%</pre>
 <p>
-      The command would print a string of the form:
-    </p>
-<p>
-      In this example, <span><strong class="command">dnssec-signzone</strong></span> creates
+      In the above example, <span><strong class="command">dnssec-signzone</strong></span> creates
      the file <code class="filename">db.example.com.signed</code>.  This
-      file
-      should be referenced in a zone statement in a
+      file should be referenced in a zone statement in a
      <code class="filename">named.conf</code> file.
    </p>
+<p>
+      This example re-signs a previously signed zone with default parameters.
+      The private keys are assumed to be in the current directory.
+    </p>
+<pre class="programlisting">% cp db.example.com.signed db.example.com
+% dnssec-signzone -o example.com db.example.com
+db.example.com.signed
+%</pre>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544562"></a><h2>SEE ALSO</h2>
+<a name="id2544381"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 2535</em>.
+      <em class="citetitle">RFC 4033</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544586"></a><h2>AUTHOR</h2>
+<a name="id2544406"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: client.c,v 1.219.18.20 2006/07/22 01:02:36 marka Exp $ */
+/* $Id: client.c,v 1.219.18.31 2008/05/22 23:46:03 tbox Exp $ */

 #include <config.h>

@@ -132,7 +132,7 @@ struct ns_clientmgr {
 #define MANAGER_MAGIC			ISC_MAGIC('N', 'S', 'C', 'm')
 #define VALID_MANAGER(m)		ISC_MAGIC_VALID(m, MANAGER_MAGIC)

-/*! 
+/*!
 * Client object states.  Ordering is significant: higher-numbered
 * states are generally "more active", meaning that the client can
 * have more dynamically allocated data, outstanding events, etc.
@@ -286,7 +286,7 @@ exit_check(ns_client_t *client) {
 	 *
 	 * Keep the view attached until any outstanding updates complete.
 	 */
-	if (client->nupdates == 0 && 
+	if (client->nupdates == 0 &&
 	    client->newstate == NS_CLIENTSTATE_FREED && client->view != NULL)
 		dns_view_detach(&client->view);

@@ -817,7 +817,7 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 		if (ns_g_server->blackholeacl != NULL &&
 		    dns_acl_match(&netaddr, NULL,
-			    	  ns_g_server->blackholeacl,
+				  ns_g_server->blackholeacl,
 				  &ns_g_server->aclenv,
 				  &match, NULL) == ISC_R_SUCCESS &&
 		    match > 0)
@@ -834,7 +834,7 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 	isc_buffer_usedregion(buffer, &r);

 	CTRACE("sendto");
-	
+
 	result = isc_socket_sendto2(socket, &r, client->task,
 				    address, pktinfo,
 				    client->sendevent, sockflags);
@@ -1108,8 +1108,8 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 	/*
 	 * FORMERR loop avoidance:  If we sent a FORMERR message
 	 * with the same ID to the same client less than two
-	 * seconds ago, assume that we are in an infinite error 
-	 * packet dialog with a server for some protocol whose 
+	 * seconds ago, assume that we are in an infinite error
+	 * packet dialog with a server for some protocol whose
 	 * error responses look enough like DNS queries to
 	 * elicit a FORMERR response.  Drop a packet to break
 	 * the loop.
@@ -1180,7 +1180,7 @@ client_addopt(ns_client_t *client) {
 	rdatalist->ttl = (client->extflags & DNS_MESSAGEEXTFLAG_REPLYPRESERVE);

 	/*
-	 * No ENDS options in the default case.
+	 * No EDNS options in the default case.
 	 */
 	rdata->data = NULL;
 	rdata->length = 0;
@@ -1226,7 +1226,8 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 		 dns_rdataclass_t rdclass, void *arg)
 {
 	dns_view_t *view;
-	dns_tsigkey_t *key;
+	dns_tsigkey_t *key = NULL;
+	dns_name_t *tsig = NULL;
 	isc_netaddr_t netsrc;
 	isc_netaddr_t netdst;

@@ -1241,7 +1242,6 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 	for (view = ISC_LIST_HEAD(ns_g_server->viewlist);
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link)) {
-		dns_name_t *tsig = NULL;

 		if (view->matchrecursiveonly)
 			continue;
@@ -1534,7 +1534,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	 * For IPv6 UDP queries, we get this from the pktinfo structure (if
 	 * supported).
 	 * If all the attempts fail (this can happen due to memory shortage,
-	 * etc), we regard this as an error for safety. 
+	 * etc), we regard this as an error for safety.
 	 */
 	if ((client->interface->flags & NS_INTERFACEFLAG_ANYADDR) == 0)
 		isc_netaddr_fromsockaddr(&destaddr, &client->interface->addr);
@@ -1576,6 +1576,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 					 "failed to get request's "
 					 "destination: %s",
 					 isc_result_totext(result));
+			ns_client_next(client, ISC_R_SUCCESS);
 			goto cleanup;
 		}
 	}
@@ -1594,7 +1595,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 							   view);
 			if (sigresult == ISC_R_SUCCESS)
 				tsig = client->message->tsigname;
-				
+
 			if (allowed(&netaddr, tsig, view->matchclients) &&
 			    allowed(&destaddr, tsig, view->matchdestinations) &&
 			    !((client->message->flags & DNS_MESSAGEFLAG_RD)
@@ -1664,21 +1665,29 @@ client_request(isc_task_t *task, isc_event_t *event) {
 		char tsigrcode[64];
 		isc_buffer_t b;
 		dns_name_t *name = NULL;
+		dns_rcode_t status;
+		isc_result_t tresult;

-		isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
-		RUNTIME_CHECK(dns_tsigrcode_totext(client->message->tsigstatus,
-						   &b) == ISC_R_SUCCESS);
-		tsigrcode[isc_buffer_usedlength(&b)] = '\0';
 		/* There is a signature, but it is bad. */
 		if (dns_message_gettsig(client->message, &name) != NULL) {
 			char namebuf[DNS_NAME_FORMATSIZE];
 			dns_name_format(name, namebuf, sizeof(namebuf));
+			status = client->message->tsigstatus;
+			isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
+			tresult = dns_tsigrcode_totext(status, &b);
+			INSIST(tresult == ISC_R_SUCCESS);
+			tsigrcode[isc_buffer_usedlength(&b)] = '\0';
 			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 				      NS_LOGMODULE_CLIENT, ISC_LOG_ERROR,
 				      "request has invalid signature: "
 				      "TSIG %s: %s (%s)", namebuf,
 				      isc_result_totext(result), tsigrcode);
 		} else {
+			status = client->message->sig0status;
+			isc_buffer_init(&b, tsigrcode, sizeof(tsigrcode) - 1);
+			tresult = dns_tsigrcode_totext(status, &b);
+			INSIST(tresult == ISC_R_SUCCESS);
+			tsigrcode[isc_buffer_usedlength(&b)] = '\0';
 			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 				      NS_LOGMODULE_CLIENT, ISC_LOG_ERROR,
 				      "request has invalid signature: %s (%s)",
@@ -1717,7 +1726,7 @@ client_request(isc_task_t *task, isc_event_t *event) {

 	ns_client_log(client, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_CLIENT,
 		      ISC_LOG_DEBUG(3), ra ? "recursion available" :
-		      			     "recursion not available");
+					     "recursion not available");

 	/*
 	 * Adjust maximum UDP response size for this client.
@@ -1811,10 +1820,10 @@ get_clientmctx(ns_clientmgr_t *manager, isc_mem_t **mctxp) {
 			return (result);

 		manager->mctxpool[manager->nextmctx] = clientmctx;
-		manager->nextmctx++;
-		if (manager->nextmctx == NMCTXS)
-			manager->nextmctx = 0;
 	}
+	manager->nextmctx++;
+	if (manager->nextmctx == NMCTXS)
+		manager->nextmctx = 0;
 #else
 	clientmctx = manager->mctx;
 #endif
@@ -2084,7 +2093,7 @@ client_newconn(isc_task_t *task, isc_event_t *event) {

 		if (ns_g_server->blackholeacl != NULL &&
 		    dns_acl_match(&netaddr, NULL,
-			    	  ns_g_server->blackholeacl,
+				  ns_g_server->blackholeacl,
 				  &ns_g_server->aclenv,
 				  &match, NULL) == ISC_R_SUCCESS &&
 		    match > 0)
@@ -2473,7 +2482,7 @@ ns_client_checkacl(ns_client_t *client,
 	isc_result_t result =
 		ns_client_checkaclsilent(client, acl, default_allow);

-	if (result == ISC_R_SUCCESS) 
+	if (result == ISC_R_SUCCESS)
 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
 			      "%s approved", opname);
@@ -2529,16 +2538,16 @@ ns_client_log(ns_client_t *client, isc_logcategory_t *category,

 void
 ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdatatype_t type,
-		 dns_rdataclass_t rdclass, char *buf, size_t len) 
+		 dns_rdataclass_t rdclass, char *buf, size_t len)
 {
-        char namebuf[DNS_NAME_FORMATSIZE];
-        char typebuf[DNS_RDATATYPE_FORMATSIZE];
-        char classbuf[DNS_RDATACLASS_FORMATSIZE];
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
+	char classbuf[DNS_RDATACLASS_FORMATSIZE];

-        dns_name_format(name, namebuf, sizeof(namebuf));
-        dns_rdatatype_format(type, typebuf, sizeof(typebuf));
-        dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf));
-        (void)snprintf(buf, len, "%s '%s/%s/%s'", msg, namebuf, typebuf,
+	dns_name_format(name, namebuf, sizeof(namebuf));
+	dns_rdatatype_format(type, typebuf, sizeof(typebuf));
+	dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf));
+	(void)snprintf(buf, len, "%s '%s/%s/%s'", msg, namebuf, typebuf,
 		       classbuf);
 }

@@ -2566,7 +2575,7 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
 			isc_mem_put(client->mctx, buf, len);
 			len += 1024;
 		} else if (result == ISC_R_SUCCESS)
-		        ns_client_log(client, NS_LOGCATEGORY_UNMATCHED,
+			ns_client_log(client, NS_LOGCATEGORY_UNMATCHED,
 				      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),
 				      "%s\n%.*s", reason,
 				       (int)isc_buffer_usedlength(&buffer),
@@ -2586,7 +2595,7 @@ ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager) {
 	const char *sep;

 	REQUIRE(VALID_MANAGER(manager));
-	      
+
 	LOCK(&manager->lock);
 	client = ISC_LIST_HEAD(manager->recursing);
 	while (client != NULL) {
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,14 +15,13 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: config.c,v 1.47.18.28 2006/05/03 01:46:40 marka Exp $ */
+/* $Id: config.c,v 1.47.18.35 2008/09/04 08:03:07 marka Exp $ */

 /*! \file */

 #include <config.h>

 #include <stdlib.h>
-#include <string.h>

 #include <isc/buffer.h>
 #include <isc/log.h>
@@ -31,6 +30,7 @@
 #include <isc/region.h>
 #include <isc/result.h>
 #include <isc/sockaddr.h>
+#include <isc/string.h>
 #include <isc/util.h>

 #include <isccfg/namedconf.h>
@@ -52,7 +52,7 @@ options {\n\
 #ifndef WIN32
 "	coresize default;\n\
 	datasize default;\n\
-	files default;\n\
+	files unlimited;\n\
 	stacksize default;\n"
 #endif
 "	deallocate-on-exit true;\n\
@@ -99,6 +99,7 @@ options {\n\
 	use-ixfr true;\n\
 	edns-udp-size 4096;\n\
 	max-udp-size 4096;\n\
+	reserved-sockets 512;\n\
 \n\
 	/* view */\n\
 	allow-notify {none;};\n\
@@ -182,7 +183,7 @@ options {\n\
 "

 "#\n\
-#  Zones in the \"_bind\" view are NOT counted is the count of zones.\n\
+#  Zones in the \"_bind\" view are NOT counted in the count of zones.\n\
 #\n\
 view \"_bind\" chaos {\n\
 	recursion no;\n\
@@ -402,7 +403,7 @@ ns_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,

 static isc_result_t
 get_masters_def(const cfg_obj_t *cctx, const char *name,
-	        const cfg_obj_t **ret)
+		const cfg_obj_t **ret)
 {
 	isc_result_t result;
 	const cfg_obj_t *masters = NULL;
@@ -520,7 +521,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			tresult = get_masters_def(config, listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, ns_g_lctx, ISC_LOG_ERROR,
-                                    "masters \"%s\" not found", listname);
+				    "masters \"%s\" not found", listname);

 				result = tresult;
 				goto cleanup;
@@ -598,7 +599,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		if (keys[i] == NULL)
 			goto cleanup;
 		dns_name_init(keys[i], NULL);
-		
+
 		keystr = cfg_obj_asstring(key);
 		isc_buffer_init(&b, keystr, strlen(keystr));
 		isc_buffer_add(&b, strlen(keystr));
@@ -654,7 +655,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		isc_mem_put(mctx, lists, listcount * sizeof(*lists));
 	if (stack != NULL)
 		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
-	
+
 	INSIST(keycount == addrcount);

 	*addrsp = addrs;
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,17 +15,17 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: control.c,v 1.20.10.8 2006/03/10 00:23:20 marka Exp $ */
+/* $Id: control.c,v 1.20.10.10 2007/09/13 23:46:26 tbox Exp $ */

 /*! \file */

 #include <config.h>

-#include <string.h>

 #include <isc/app.h>
 #include <isc/event.h>
 #include <isc/mem.h>
+#include <isc/string.h>
 #include <isc/timer.h>
 #include <isc/util.h>

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: controlconf.c,v 1.40.18.10 2006/12/07 04:53:02 marka Exp $ */
+/* $Id: controlconf.c,v 1.40.18.14 2008/07/23 23:33:02 marka Exp $ */

 /*! \file */

@@ -345,9 +345,9 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	listener = conn->listener;
 	secret.rstart = NULL;

-        /* Is the server shutting down? */
-        if (listener->controls->shuttingdown)
-                goto cleanup;
+	/* Is the server shutting down? */
+	if (listener->controls->shuttingdown)
+		goto cleanup;

 	if (conn->ccmsg.result != ISC_R_SUCCESS) {
 		if (conn->ccmsg.result != ISC_R_CANCELED &&
@@ -364,9 +364,6 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	{
 		ccregion.rstart = isc_buffer_base(&conn->ccmsg.buffer);
 		ccregion.rend = isc_buffer_used(&conn->ccmsg.buffer);
-		if (secret.rstart != NULL)
-			isc_mem_put(listener->mctx, secret.rstart,
-				    REGION_SIZE(secret));
 		secret.rstart = isc_mem_get(listener->mctx, key->secret.length);
 		if (secret.rstart == NULL)
 			goto cleanup;
@@ -375,7 +372,8 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		result = isccc_cc_fromwire(&ccregion, &request, &secret);
 		if (result == ISC_R_SUCCESS)
 			break;
-		else if (result == ISCCC_R_BADAUTH) {
+		isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
+		if (result == ISCCC_R_BADAUTH) {
 			/*
 			 * For some reason, request is non-NULL when
 			 * isccc_cc_fromwire returns ISCCC_R_BADAUTH.
@@ -396,7 +394,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	/* We shouldn't be getting a reply. */
 	if (isccc_cc_isreply(request)) {
 		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
-		goto cleanup;
+		goto cleanup_request;
 	}

 	isc_stdtime_get(&now);
@@ -407,17 +405,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	_ctrl = isccc_alist_lookup(request, "_ctrl");
 	if (_ctrl == NULL) {
 		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
-		goto cleanup;
+		goto cleanup_request;
 	}

 	if (isccc_cc_lookupuint32(_ctrl, "_tim", &sent) == ISC_R_SUCCESS) {
 		if ((sent + CLOCKSKEW) < now || (sent - CLOCKSKEW) > now) {
 			log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
-			goto cleanup;
+			goto cleanup_request;
 		}
 	} else {
 		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
-		goto cleanup;
+		goto cleanup_request;
 	}

 	/*
@@ -426,7 +424,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	if (isccc_cc_lookupuint32(_ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
 	    now > exp) {
 		log_invalid(&conn->ccmsg, ISCCC_R_EXPIRED);
-		goto cleanup;
+		goto cleanup_request;
 	}

 	/*
@@ -436,16 +434,16 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	result = isccc_cc_checkdup(listener->controls->symtab, request, now);
 	if (result != ISC_R_SUCCESS) {
 		if (result == ISC_R_EXISTS)
-                        result = ISCCC_R_DUPLICATE; 
+			result = ISCCC_R_DUPLICATE;
 		log_invalid(&conn->ccmsg, result);
-		goto cleanup;
+		goto cleanup_request;
 	}

 	if (conn->nonce != 0 &&
 	    (isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS ||
 	     conn->nonce != nonce)) {
 		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
-		goto cleanup;
+		goto cleanup_request;
 	}

 	/*
@@ -459,7 +457,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

 	result = isccc_cc_createresponse(request, now, now + 60, &response);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup;
+		goto cleanup_request;
 	if (eresult != ISC_R_SUCCESS) {
 		isccc_sexpr_t *data;

@@ -467,7 +465,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		if (data != NULL) {
 			const char *estr = isc_result_totext(eresult);
 			if (isccc_cc_definestring(data, "err", estr) == NULL)
-				goto cleanup;
+				goto cleanup_response;
 		}
 	}

@@ -478,20 +476,20 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		if (data != NULL) {
 			char *str = (char *)isc_buffer_base(&text);
 			if (isccc_cc_definestring(data, "text", str) == NULL)
-				goto cleanup;
+				goto cleanup_response;
 		}
 	}

 	_ctrl = isccc_alist_lookup(response, "_ctrl");
 	if (_ctrl == NULL ||
 	    isccc_cc_defineuint32(_ctrl, "_nonce", conn->nonce) == NULL)
-		goto cleanup;
+		goto cleanup_response;

 	ccregion.rstart = conn->buffer + 4;
 	ccregion.rend = conn->buffer + sizeof(conn->buffer);
 	result = isccc_cc_towire(response, &ccregion, &secret);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup;
+		goto cleanup_response;
 	isc_buffer_init(&b, conn->buffer, 4);
 	len = sizeof(conn->buffer) - REGION_SIZE(ccregion);
 	isc_buffer_putuint32(&b, len - 4);
@@ -500,31 +498,27 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

 	result = isc_socket_send(conn->sock, &r, task, control_senddone, conn);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup;
+		goto cleanup_response;
 	conn->sending = ISC_TRUE;

-	if (secret.rstart != NULL)
-		isc_mem_put(listener->mctx, secret.rstart,
-			    REGION_SIZE(secret));
-	if (request != NULL)
-		isccc_sexpr_free(&request);
-	if (response != NULL)
-		isccc_sexpr_free(&response);
+	isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
+	isccc_sexpr_free(&request);
+	isccc_sexpr_free(&response);
 	return;

+ cleanup_response:
+	isccc_sexpr_free(&response);
+
+ cleanup_request:
+	isccc_sexpr_free(&request);
+	isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
+
 cleanup:
-	if (secret.rstart != NULL)
-		isc_mem_put(listener->mctx, secret.rstart,
-			    REGION_SIZE(secret));
 	isc_socket_detach(&conn->sock);
 	isccc_ccmsg_invalidate(&conn->ccmsg);
 	conn->ccmsg_valid = ISC_FALSE;
 	maybe_free_connection(conn);
 	maybe_free_listener(listener);
-	if (request != NULL)
-		isccc_sexpr_free(&request);
-	if (response != NULL)
-		isccc_sexpr_free(&response);
 }

 static void
@@ -548,7 +542,7 @@ newconnection(controllistener_t *listener, isc_socket_t *sock) {
 	conn = isc_mem_get(listener->mctx, sizeof(*conn));
 	if (conn == NULL)
 		return (ISC_R_NOMEMORY);
-	
+
 	conn->sock = sock;
 	isccc_ccmsg_init(listener->mctx, sock, &conn->ccmsg);
 	conn->ccmsg_valid = ISC_TRUE;
@@ -660,7 +654,7 @@ ns_controls_shutdown(ns_controls_t *controls) {

 static isc_result_t
 cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
-	        const cfg_obj_t **objp)
+		const cfg_obj_t **objp)
 {
 	const cfg_listelt_t *element;
 	const char *str;
@@ -808,7 +802,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 		 if (result != ISC_R_SUCCESS) \
 			goto cleanup; \
 	} while (0)
-		
+
 static isc_result_t
 get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	isc_result_t result;
@@ -828,14 +822,14 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	CHECK(cfg_map_get(config, "key", &key));

 	keyid = isc_mem_get(mctx, sizeof(*keyid));
-	if (keyid == NULL) 
+	if (keyid == NULL)
 		CHECK(ISC_R_NOMEMORY);
 	keyid->keyname = isc_mem_strdup(mctx,
 					cfg_obj_asstring(cfg_map_getname(key)));
 	keyid->secret.base = NULL;
 	keyid->secret.length = 0;
 	ISC_LINK_INIT(keyid, link);
-	if (keyid->keyname == NULL) 
+	if (keyid->keyname == NULL)
 		CHECK(ISC_R_NOMEMORY);

 	CHECK(bind9_check_key(key, ns_g_lctx));
@@ -891,7 +885,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		cfg_parser_destroy(&pctx);
 	return (result);
 }
-			
+
 /*
 * Ensures that both '*global_keylistp' and '*control_keylistp' are
 * valid or both are NULL.
@@ -925,7 +919,7 @@ static void
 update_listener(ns_controls_t *cp, controllistener_t **listenerp,
 		const cfg_obj_t *control, const cfg_obj_t *config,
 		isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
-	        const char *socktext, isc_sockettype_t type)
+		const char *socktext, isc_sockettype_t type)
 {
 	controllistener_t *listener;
 	const cfg_obj_t *allow;
@@ -945,7 +939,7 @@ update_listener(ns_controls_t *cp, controllistener_t **listenerp,
 		*listenerp = NULL;
 		return;
 	}
-		
+
 	/*
 	 * There is already a listener for this sockaddr.
 	 * Update the access list and key information.
@@ -1151,8 +1145,8 @@ add_listener(ns_controls_t *cp, controllistener_t **listenerp,
 					   type, &listener->sock);

 	if (result == ISC_R_SUCCESS)
-		result = isc_socket_bind(listener->sock,
-					 &listener->address);
+		result = isc_socket_bind(listener->sock, &listener->address,
+					 ISC_SOCKET_REUSEADDRESS);

 	if (result == ISC_R_SUCCESS && type == isc_sockettype_unix) {
 		listener->perm = cfg_obj_asuint32(cfg_tuple_get(control,
@@ -1339,7 +1333,7 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,

 				update_listener(cp, &listener, control, config,
 						&addr, aclconfctx,
-					        cfg_obj_asstring(path),
+						cfg_obj_asstring(path),
 						isc_sockettype_unix);

 				if (listener != NULL)
@@ -1385,10 +1379,10 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
 			isc_sockaddr_setport(&addr, NS_CONTROL_PORT);

 			isc_sockaddr_format(&addr, socktext, sizeof(socktext));
-			
+
 			update_listener(cp, &listener, NULL, NULL,
 					&addr, NULL, socktext,
-				        isc_sockettype_tcp);
+					isc_sockettype_tcp);

 			if (listener != NULL)
 				/*
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: globals.h,v 1.64.18.4 2006/03/02 00:37:21 marka Exp $ */
+/* $Id: globals.h,v 1.64.18.6 2008/10/24 01:43:17 tbox Exp $ */

 #ifndef NAMED_GLOBALS_H
 #define NAMED_GLOBALS_H 1
@@ -48,6 +48,7 @@ EXTERN isc_taskmgr_t *		ns_g_taskmgr		INIT(NULL);
 EXTERN dns_dispatchmgr_t *	ns_g_dispatchmgr	INIT(NULL);
 EXTERN isc_entropy_t *		ns_g_entropy		INIT(NULL);
 EXTERN isc_entropy_t *		ns_g_fallbackentropy	INIT(NULL);
+EXTERN unsigned int		ns_g_cpus_detected	INIT(1);

 /*
 * XXXRTH  We're going to want multiple timer managers eventually.  One
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: interfacemgr.c,v 1.76.18.8 2006/07/20 01:10:30 marka Exp $ */
+/* $Id: interfacemgr.c,v 1.76.18.11 2008/07/23 23:33:02 marka Exp $ */

 /*! \file */

@@ -90,7 +90,7 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	mgr->generation = 1;
 	mgr->listenon4 = NULL;
 	mgr->listenon6 = NULL;
-	
+
 	ISC_LIST_INIT(mgr->interfaces);
 	ISC_LIST_INIT(mgr->listenon);

@@ -307,7 +307,8 @@ ns_interface_accepttcp(ns_interface_t *ifp) {
 #ifndef ISC_ALLOW_MAPPED
 	isc_socket_ipv6only(ifp->tcpsocket, ISC_TRUE);
 #endif
-	result = isc_socket_bind(ifp->tcpsocket, &ifp->addr);
+	result = isc_socket_bind(ifp->tcpsocket, &ifp->addr,
+				 ISC_SOCKET_REUSEADDRESS);
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_ERROR,
 				 "binding TCP socket: %s",
@@ -322,7 +323,7 @@ ns_interface_accepttcp(ns_interface_t *ifp) {
 		goto tcp_listen_failure;
 	}

-	/* 
+	/*
 	 * If/when there a multiple filters listen to the
 	 * result.
 	 */
@@ -509,7 +510,7 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {
 	unsigned int prefixlen;

 	family = interface->address.family;
-	
+
 	elt.type = dns_aclelementtype_ipprefix;
 	elt.negative = ISC_FALSE;
 	elt.u.ip_prefix.address = interface->address;
@@ -549,7 +550,7 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {
 static void
 setup_listenon(ns_interfacemgr_t *mgr, isc_interface_t *interface,
 	       in_port_t port)
-{ 
+{
 	isc_sockaddr_t *addr;
 	isc_sockaddr_t *old;

@@ -563,7 +564,7 @@ setup_listenon(ns_interfacemgr_t *mgr, isc_interface_t *interface,
 	     old != NULL;
 	     old = ISC_LIST_NEXT(old, link))
 		if (isc_sockaddr_equal(addr, old))
-			break;	
+			break;

 	if (old != NULL)
 		isc_mem_put(mgr->mctx, addr, sizeof(*addr));
@@ -699,7 +700,7 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 	{
 		isc_interface_t interface;
 		ns_listenlist_t *ll;
-		unsigned int family; 
+		unsigned int family;

 		result = isc_interfaceiter_current(iter, &interface);
 		if (result != ISC_R_SUCCESS)
@@ -881,7 +882,7 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "interface iteration failed: %s",
 				 isc_result_totext(result));
-	else 
+	else
 		result = ISC_R_SUCCESS;
 cleanup_iter:
 	isc_interfaceiter_destroy(&iter);
@@ -912,7 +913,7 @@ ns_interfacemgr_scan0(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,

 	/*
 	 * Warn if we are not listening on any interface, unless
-	 * we're in lwresd-only mode, in which case that is to 
+	 * we're in lwresd-only mode, in which case that is to
 	 * be expected.
 	 */
 	if (ext_listen == NULL &&
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: lwaddr.c,v 1.4.18.2 2005/04/29 00:15:23 marka Exp $ */
+/* $Id: lwaddr.c,v 1.4.18.4 2008/01/11 23:45:59 tbox Exp $ */

 /*! \file */

@@ -81,7 +81,7 @@ lwaddr_lwresaddr_fromnetaddr(lwres_addr_t *la, isc_netaddr_t *na) {
 	} else {
 		la->family = LWRES_ADDRTYPE_V6;
 		la->length = 16;
-		memcpy(la->address, &na->type.in, 16);
+		memcpy(la->address, &na->type.in6, 16);
 	}
 	return (ISC_R_SUCCESS);
 }
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2002  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: lwdgnba.c,v 1.16.18.2 2005/04/29 00:15:24 marka Exp $ */
+/* $Id: lwdgnba.c,v 1.16.18.4 2008/01/14 23:45:59 tbox Exp $ */

 /*! \file */

@@ -220,8 +220,6 @@ ns_lwdclient_processgnba(ns_lwdclient_t *client, lwres_buffer_t *b) {
 					 b, &client->pkt, &req);
 	if (result != LWRES_R_SUCCESS)
 		goto out;
-	if (req->addr.address == NULL)
-		goto out;

 	client->options = 0;
 	if (req->addr.family == LWRES_ADDRTYPE_V4) {
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: lwdnoop.c,v 1.7.18.2 2005/04/29 00:15:25 marka Exp $ */
+/* $Id: lwdnoop.c,v 1.7.18.4 2008/01/22 23:27:05 tbox Exp $ */

 /*! \file */

@@ -44,7 +44,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {
 	result = lwres_nooprequest_parse(client->clientmgr->lwctx,
 					 b, &client->pkt, &req);
 	if (result != LWRES_R_SUCCESS)
-		goto out;
+		goto send_error;

 	client->pkt.recvlength = LWRES_RECVLENGTH;
 	client->pkt.authtype = 0; /* XXXMLG */
@@ -57,7 +57,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {
 	lwres = lwres_noopresponse_render(client->clientmgr->lwctx, &resp,
 					  &client->pkt, &lwb);
 	if (lwres != LWRES_R_SUCCESS)
-		goto out;
+		goto cleanup_req;

 	r.base = lwb.base;
 	r.length = lwb.used;
@@ -65,7 +65,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {
 	client->sendlength = r.length;
 	result = ns_lwdclient_sendreply(client, &r);
 	if (result != ISC_R_SUCCESS)
-		goto out;
+		goto cleanup_lwb;

 	/*
 	 * We can now destroy request.
@@ -76,13 +76,12 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {

 	return;

- out:
-	if (req != NULL)
-		lwres_nooprequest_free(client->clientmgr->lwctx, &req);
+ cleanup_lwb:
+	lwres_context_freemem(client->clientmgr->lwctx, lwb.base, lwb.length);

-	if (lwb.base != NULL)
-		lwres_context_freemem(client->clientmgr->lwctx,
-				      lwb.base, lwb.length);
+ cleanup_req:
+	lwres_nooprequest_free(client->clientmgr->lwctx, &req);

+ send_error:
 	ns_lwdclient_errorpktsend(client, LWRES_R_FAILURE);
 }
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwresd.8,v 1.15.18.9 2006/12/12 01:44:27 marka Exp $
+.\" $Id: lwresd.8,v 1.15.18.13 2008/10/17 01:29:23 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -33,7 +33,7 @@
 lwresd \- lightweight resolver daemon
 .SH "SYNOPSIS"
 .HP 7
-\fBlwresd\fR [\fB\-C\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-i\ \fR\fB\fIpid\-file\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-P\ \fR\fB\fIport\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR]
+\fBlwresd\fR [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-C\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-i\ \fR\fB\fIpid\-file\fR\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-P\ \fR\fB\fIport\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-4\fR] [\fB\-6\fR]
 .SH "DESCRIPTION"
 .PP
 \fBlwresd\fR
@@ -61,12 +61,44 @@ entries are present, or if forwarding fails,
 resolves the queries autonomously starting at the root name servers, using a built\-in list of root server hints.
 .SH "OPTIONS"
 .PP
+\-4
+.RS 4
+Use IPv4 only even if the host machine is capable of IPv6.
+\fB\-4\fR
+and
+\fB\-6\fR
+are mutually exclusive.
+.RE
+.PP
+\-6
+.RS 4
+Use IPv6 only even if the host machine is capable of IPv4.
+\fB\-4\fR
+and
+\fB\-6\fR
+are mutually exclusive.
+.RE
+.PP
+\-c \fIconfig\-file\fR
+.RS 4
+Use
+\fIconfig\-file\fR
+as the configuration file instead of the default,
+\fI/etc/lwresd.conf\fR.
+\fB\-c\fR
+can not be used with
+\fB\-C\fR.
+.RE
+.PP
 \-C \fIconfig\-file\fR
 .RS 4
 Use
 \fIconfig\-file\fR
 as the configuration file instead of the default,
 \fI/etc/resolv.conf\fR.
+\fB\-C\fR
+can not be used with
+\fB\-c\fR.
 .RE
 .PP
 \-d \fIdebug\-level\fR
@@ -88,6 +120,25 @@ Run the server in the foreground and force all logging to
 \fIstderr\fR.
 .RE
 .PP
+\-i \fIpid\-file\fR
+.RS 4
+Use
+\fIpid\-file\fR
+as the PID file instead of the default,
+\fI/var/run/lwresd.pid\fR.
+.RE
+.PP
+\-m \fIflag\fR
+.RS 4
+Turn on memory usage debugging flags. Possible flags are
+\fIusage\fR,
+\fItrace\fR,
+\fIrecord\fR,
+\fIsize\fR, and
+\fImctx\fR. These correspond to the ISC_MEM_DEBUGXXXX flags described in
+\fI<isc/mem.h>\fR.
+.RE
+.PP
 \-n \fI#cpus\fR
 .RS 4
 Create
@@ -122,8 +173,7 @@ This option is mainly of interest to BIND 9 developers and may be removed or cha
 .PP
 \-t \fIdirectory\fR
 .RS 4
-\fBchroot()\fR
-to
+Chroot to
 \fIdirectory\fR
 after processing the command line arguments, but before reading the configuration file.
 .RS
@@ -131,15 +181,14 @@ after processing the command line arguments, but before reading the configuratio
 This option should be used in conjunction with the
 \fB\-u\fR
 option, as chrooting a process running as root doesn't enhance security on most systems; the way
-\fBchroot()\fR
+\fBchroot(2)\fR
 is defined allows a process with root privileges to escape a chroot jail.
 .RE
 .RE
 .PP
 \-u \fIuser\fR
 .RS 4
-\fBsetuid()\fR
-to
+Setuid to
 \fIuser\fR
 after completing privileged operations, such as creating sockets that listen on privileged ports.
 .RE
@@ -168,7 +217,7 @@ The default process\-id file.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000, 2001 Internet Software Consortium.
 .br
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,9 +15,9 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: lwresd.c,v 1.46.18.7 2006/03/02 00:37:21 marka Exp $ */
+/* $Id: lwresd.c,v 1.46.18.10 2008/07/23 23:33:02 marka Exp $ */

-/*! \file 
+/*! \file
 * \brief
 * Main program for the Lightweight Resolver Daemon.
 *
@@ -224,7 +224,7 @@ ns_lwresd_parseeresolvconf(isc_mem_t *mctx, cfg_parser_t *pctx,
 			for (i = 0; i < lwc->searchnxt; i++) {
 				CHECK(buffer_putstr(&b, "\t\t\""));
 				CHECK(buffer_putstr(&b, lwc->search[i]));
-			        CHECK(buffer_putstr(&b, "\";\n"));
+				CHECK(buffer_putstr(&b, "\";\n"));
 			}
 			CHECK(buffer_putstr(&b, "\t};\n"));
 		}
@@ -576,7 +576,8 @@ listener_bind(ns_lwreslistener_t *listener, isc_sockaddr_t *address) {
 		return (result);
 	}

-	result = isc_socket_bind(sock, &listener->address);
+	result = isc_socket_bind(sock, &listener->address,
+				 ISC_SOCKET_REUSEADDRESS);
 	if (result != ISC_R_SUCCESS) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&listener->address, socktext,
@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: lwresd.docbook,v 1.7.18.3 2005/05/13 01:32:45 marka Exp $ -->
+<!-- $Id: lwresd.docbook,v 1.7.18.10 2008/10/16 23:46:00 tbox Exp $ -->
 <refentry>
  <refentryinfo>
    <date>June 30, 2000</date>
@@ -39,6 +39,8 @@
    <copyright>
      <year>2004</year>
      <year>2005</year>
+      <year>2007</year>
+      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -51,11 +53,13 @@
  <refsynopsisdiv>
    <cmdsynopsis>
      <command>lwresd</command>
+      <arg><option>-c <replaceable class="parameter">config-file</replaceable></option></arg>
      <arg><option>-C <replaceable class="parameter">config-file</replaceable></option></arg>
      <arg><option>-d <replaceable class="parameter">debug-level</replaceable></option></arg>
      <arg><option>-f</option></arg>
      <arg><option>-g</option></arg>
      <arg><option>-i <replaceable class="parameter">pid-file</replaceable></option></arg>
+      <arg><option>-m <replaceable class="parameter">flag</replaceable></option></arg>
      <arg><option>-n <replaceable class="parameter">#cpus</replaceable></option></arg>
      <arg><option>-P <replaceable class="parameter">port</replaceable></option></arg>
      <arg><option>-p <replaceable class="parameter">port</replaceable></option></arg>
@@ -63,6 +67,8 @@
      <arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg>
      <arg><option>-u <replaceable class="parameter">user</replaceable></option></arg>
      <arg><option>-v</option></arg>
+      <arg><option>-4</option></arg>
+      <arg><option>-6</option></arg>
    </cmdsynopsis>
  </refsynopsisdiv>

@@ -108,6 +114,43 @@
    <title>OPTIONS</title>

    <variablelist>
+
+      <varlistentry>
+        <term>-4</term>
+        <listitem>
+          <para>
+            Use IPv4 only even if the host machine is capable of IPv6.
+            <option>-4</option> and <option>-6</option> are mutually
+            exclusive.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>-6</term>
+        <listitem>
+          <para>
+            Use IPv6 only even if the host machine is capable of IPv4.
+            <option>-4</option> and <option>-6</option> are mutually
+            exclusive.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <!-- this is in source but not mentioned? does this matter? -->
+      <varlistentry>
+        <term>-c <replaceable class="parameter">config-file</replaceable></term>
+        <listitem>
+          <para>
+            Use <replaceable class="parameter">config-file</replaceable> as the
+            configuration file instead of the default,
+            <filename>/etc/lwresd.conf</filename>.
+	    <!-- Should this be an absolute path name? -->
+	    <option>-c</option> can not be used with <option>-C</option>.
+          </para>
+        </listitem>
+      </varlistentry>
+
      <varlistentry>
        <term>-C <replaceable class="parameter">config-file</replaceable></term>
        <listitem>
@@ -115,6 +158,7 @@
            Use <replaceable class="parameter">config-file</replaceable> as the
            configuration file instead of the default,
            <filename>/etc/resolv.conf</filename>.
+	    <option>-C</option> can not be used with <option>-c</option>.
          </para>
        </listitem>
      </varlistentry>
@@ -149,6 +193,33 @@
        </listitem>
      </varlistentry>

+      <varlistentry>
+        <term>-i <replaceable class="parameter">pid-file</replaceable></term>
+        <listitem>
+          <para>
+            Use <replaceable class="parameter">pid-file</replaceable> as the
+            PID file instead of the default,
+            <filename>/var/run/lwresd.pid</filename>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>-m <replaceable class="parameter">flag</replaceable></term>
+        <listitem>
+          <para>
+            Turn on memory usage debugging flags.  Possible flags are
+            <replaceable class="parameter">usage</replaceable>,
+            <replaceable class="parameter">trace</replaceable>,
+            <replaceable class="parameter">record</replaceable>,
+            <replaceable class="parameter">size</replaceable>, and
+            <replaceable class="parameter">mctx</replaceable>.  
+            These correspond to the ISC_MEM_DEBUGXXXX flags described in
+            <filename>&lt;isc/mem.h&gt;</filename>.
+          </para>
+        </listitem>
+      </varlistentry>
+
      <varlistentry>
        <term>-n <replaceable class="parameter">#cpus</replaceable></term>
        <listitem>
@@ -206,7 +277,7 @@
      <varlistentry>
        <term>-t <replaceable class="parameter">directory</replaceable></term>
        <listitem>
-          <para><function>chroot()</function>
+          <para>Chroot
 	    to <replaceable class="parameter">directory</replaceable> after
            processing the command line arguments, but before
            reading the configuration file.
@@ -216,7 +287,7 @@
              This option should be used in conjunction with the
              <option>-u</option> option, as chrooting a process
              running as root doesn't enhance security on most
-              systems; the way <function>chroot()</function> is
+              systems; the way <function>chroot(2)</function> is
              defined allows a process with root privileges to
              escape a chroot jail.
            </para>
@@ -227,7 +298,7 @@
      <varlistentry>
        <term>-u <replaceable class="parameter">user</replaceable></term>
        <listitem>
-          <para><function>setuid()</function>
+          <para>Setuid
 	    to <replaceable class="parameter">user</replaceable> after completing
            privileged operations, such as creating sockets that
            listen on privileged ports.
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwresd.html,v 1.5.18.14 2006/12/12 01:44:27 marka Exp $ -->
+<!-- $Id: lwresd.html,v 1.5.18.19 2008/10/17 01:29:23 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -22,17 +22,17 @@
 <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2476419"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><span class="application">lwresd</span> &#8212; lightweight resolver daemon</p>
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">lwresd</code>  [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">lwresd</code>  [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-4</code>] [<code class="option">-6</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543622"></a><h2>DESCRIPTION</h2>
+<a name="id2543464"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">lwresd</strong></span>
      is the daemon providing name lookup
      services to clients that use the BIND 9 lightweight resolver
@@ -67,13 +67,34 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543669"></a><h2>OPTIONS</h2>
+<a name="id2543511"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
+<dt><span class="term">-4</span></dt>
+<dd><p>
+            Use IPv4 only even if the host machine is capable of IPv6.
+            <code class="option">-4</code> and <code class="option">-6</code> are mutually
+            exclusive.
+          </p></dd>
+<dt><span class="term">-6</span></dt>
+<dd><p>
+            Use IPv6 only even if the host machine is capable of IPv4.
+            <code class="option">-4</code> and <code class="option">-6</code> are mutually
+            exclusive.
+          </p></dd>
+<dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
+<dd><p>
+            Use <em class="replaceable"><code>config-file</code></em> as the
+            configuration file instead of the default,
+            <code class="filename">/etc/lwresd.conf</code>.
+	    
+	    <code class="option">-c</code> can not be used with <code class="option">-C</code>.
+          </p></dd>
 <dt><span class="term">-C <em class="replaceable"><code>config-file</code></em></span></dt>
 <dd><p>
            Use <em class="replaceable"><code>config-file</code></em> as the
            configuration file instead of the default,
            <code class="filename">/etc/resolv.conf</code>.
+	    <code class="option">-C</code> can not be used with <code class="option">-c</code>.
          </p></dd>
 <dt><span class="term">-d <em class="replaceable"><code>debug-level</code></em></span></dt>
 <dd><p>
@@ -90,6 +111,23 @@
            Run the server in the foreground and force all logging
            to <code class="filename">stderr</code>.
          </p></dd>
+<dt><span class="term">-i <em class="replaceable"><code>pid-file</code></em></span></dt>
+<dd><p>
+            Use <em class="replaceable"><code>pid-file</code></em> as the
+            PID file instead of the default,
+            <code class="filename">/var/run/lwresd.pid</code>.
+          </p></dd>
+<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt>
+<dd><p>
+            Turn on memory usage debugging flags.  Possible flags are
+            <em class="replaceable"><code>usage</code></em>,
+            <em class="replaceable"><code>trace</code></em>,
+            <em class="replaceable"><code>record</code></em>,
+            <em class="replaceable"><code>size</code></em>, and
+            <em class="replaceable"><code>mctx</code></em>.  
+            These correspond to the ISC_MEM_DEBUGXXXX flags described in
+            <code class="filename">&lt;isc/mem.h&gt;</code>.
+          </p></dd>
 <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt>
 <dd><p>
            Create <em class="replaceable"><code>#cpus</code></em> worker threads
@@ -129,7 +167,7 @@
 </dd>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd>
-<p><code class="function">chroot()</code>
+<p>Chroot
 	    to <em class="replaceable"><code>directory</code></em> after
            processing the command line arguments, but before
            reading the configuration file.
@@ -140,14 +178,14 @@
              This option should be used in conjunction with the
              <code class="option">-u</code> option, as chrooting a process
              running as root doesn't enhance security on most
-              systems; the way <code class="function">chroot()</code> is
+              systems; the way <code class="function">chroot(2)</code> is
              defined allows a process with root privileges to
              escape a chroot jail.
            </p>
 </div>
 </dd>
 <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt>
-<dd><p><code class="function">setuid()</code>
+<dd><p>Setuid
 	    to <em class="replaceable"><code>user</code></em> after completing
            privileged operations, such as creating sockets that
            listen on privileged ports.
@@ -159,7 +197,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543932"></a><h2>FILES</h2>
+<a name="id2543928"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/resolv.conf</code></span></dt>
 <dd><p>
@@ -172,14 +210,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543972"></a><h2>SEE ALSO</h2>
+<a name="id2543968"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
      <span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544006"></a><h2>AUTHOR</h2>
+<a name="id2544002"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: main.c,v 1.136.18.17 2006/11/10 18:51:14 marka Exp $ */
+/* $Id: main.c,v 1.136.18.21 2008/10/24 01:28:08 marka Exp $ */

 /*! \file */

@@ -33,6 +33,7 @@
 #include <isc/hash.h>
 #include <isc/os.h>
 #include <isc/platform.h>
+#include <isc/print.h>
 #include <isc/resource.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
@@ -85,6 +86,7 @@ static char		program_name[ISC_DIR_NAMEMAX] = "named";
 static char		absolute_conffile[ISC_DIR_PATHMAX];
 static char		saved_command_line[512];
 static char		version[512];
+static unsigned int	maxsocks = 0;

 void
 ns_main_earlywarning(const char *format, ...) {
@@ -356,7 +358,8 @@ parse_command_line(int argc, char *argv[]) {

 	isc_commandline_errprint = ISC_FALSE;
 	while ((ch = isc_commandline_parse(argc, argv,
-			           "46c:C:d:fgi:lm:n:N:p:P:st:u:vx:")) != -1) {
+					   "46c:C:d:fgi:lm:n:N:p:P:"
+					   "sS:t:u:vx:")) != -1) {
 		switch (ch) {
 		case '4':
 			if (disable4)
@@ -435,6 +438,10 @@ parse_command_line(int argc, char *argv[]) {
 			/* XXXRTH temporary syntax */
 			want_stats = ISC_TRUE;
 			break;
+		case 'S':
+			maxsocks = parse_int(isc_commandline_argument,
+					     "max number of sockets");
+			break;
 		case 't':
 			/* XXXJAB should we make a copy? */
 			ns_g_chrootdir = isc_commandline_argument;
@@ -466,17 +473,14 @@ parse_command_line(int argc, char *argv[]) {
 static isc_result_t
 create_managers(void) {
 	isc_result_t result;
-#ifdef ISC_PLATFORM_USETHREADS
-	unsigned int cpus_detected;
-#endif
+	unsigned int socks;

 #ifdef ISC_PLATFORM_USETHREADS
-	cpus_detected = isc_os_ncpus();
 	if (ns_g_cpus == 0)
-		ns_g_cpus = cpus_detected;
+		ns_g_cpus = ns_g_cpus_detected;
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
 		      ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
-		      cpus_detected, cpus_detected == 1 ? "" : "s",
+		      ns_g_cpus_detected, ns_g_cpus_detected == 1 ? "" : "s",
 		      ns_g_cpus, ns_g_cpus == 1 ? "" : "s");
 #else
 	ns_g_cpus = 1;
@@ -497,13 +501,19 @@ create_managers(void) {
 		return (ISC_R_UNEXPECTED);
 	}

-	result = isc_socketmgr_create(ns_g_mctx, &ns_g_socketmgr);
+	result = isc_socketmgr_create2(ns_g_mctx, &ns_g_socketmgr, maxsocks);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_socketmgr_create() failed: %s",
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
+	result = isc_socketmgr_getmaxsockets(ns_g_socketmgr, &socks);
+	if (result == ISC_R_SUCCESS) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER,
+			      ISC_LOG_INFO, "using up to %u sockets", socks);
+	}

 	result = isc_entropy_create(ns_g_mctx, &ns_g_entropy);
 	if (result != ISC_R_SUCCESS) {
@@ -550,6 +560,7 @@ destroy_managers(void) {
 static void
 setup(void) {
 	isc_result_t result;
+	isc_resourcevalue_t old_openfiles;
 #ifdef HAVE_LIBSCF
 	char *instance = NULL;
 #endif
@@ -603,6 +614,13 @@ setup(void) {
 	}
 #endif

+#ifdef ISC_PLATFORM_USETHREADS
+	/*
+	 * Check for the number of cpu's before ns_os_chroot().
+	 */
+	ns_g_cpus_detected = isc_os_ncpus();
+#endif
+
 	ns_os_chroot(ns_g_chrootdir);

 	/*
@@ -655,6 +673,23 @@ setup(void) {
 	(void)isc_resource_getlimit(isc_resource_openfiles,
 				    &ns_g_initopenfiles);

+	/*
+	 * System resources cannot effectively be tuned on some systems.
+	 * Raise the limit in such cases for safety.
+	 */
+	old_openfiles = ns_g_initopenfiles;
+	ns_os_adjustnofile();
+	(void)isc_resource_getlimit(isc_resource_openfiles,
+				    &ns_g_initopenfiles);
+	if (old_openfiles != ns_g_initopenfiles) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+			      "adjusted limit on open files from "
+			      "%" ISC_PRINT_QUADFORMAT "u to "
+			      "%" ISC_PRINT_QUADFORMAT "u",
+			      old_openfiles, ns_g_initopenfiles);
+	}
+
 	/*
 	 * If the named configuration filename is relative, prepend the current
 	 * directory's name before possibly changing to another directory.
@@ -665,7 +700,7 @@ setup(void) {
 					       sizeof(absolute_conffile));
 		if (result != ISC_R_SUCCESS)
 			ns_main_earlyfatal("could not construct absolute path of "
-					   "configuration file: %s", 
+					   "configuration file: %s",
 					   isc_result_totext(result));
 		ns_g_conffile = absolute_conffile;
 	}
@@ -757,7 +792,7 @@ ns_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 		if (debug)
 			UNEXPECTED_ERROR(__FILE__, __LINE__,
 					 "scf_handle_create() failed: %s",
-			 		 scf_strerror(scf_error()));
+					 scf_strerror(scf_error()));
 		return (ISC_R_FAILURE);
 	}

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.8,v 1.20.18.11 2006/12/12 01:44:27 marka Exp $
+.\" $Id: named.8,v 1.20.18.16 2008/09/01 02:29:00 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -33,7 +33,7 @@
 named \- Internet domain name server
 .SH "SYNOPSIS"
 .HP 6
-\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR]
+\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-S\ \fR\fB\fI#max\-socks\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR]
 .SH "DESCRIPTION"
 .PP
 \fBnamed\fR
@@ -94,6 +94,17 @@ Run the server in the foreground and force all logging to
 \fIstderr\fR.
 .RE
 .PP
+\-m \fIflag\fR
+.RS 4
+Turn on memory usage debugging flags. Possible flags are
+\fIusage\fR,
+\fItrace\fR,
+\fIrecord\fR,
+\fIsize\fR, and
+\fImctx\fR. These correspond to the ISC_MEM_DEBUGXXXX flags described in
+\fI<isc/mem.h>\fR.
+.RE
+.PP
 \-n \fI#cpus\fR
 .RS 4
 Create
@@ -120,10 +131,24 @@ This option is mainly of interest to BIND 9 developers and may be removed or cha
 .RE
 .RE
 .PP
+\-S \fI#max\-socks\fR
+.RS 4
+Allow
+\fBnamed\fR
+to use up to
+\fI#max\-socks\fR
+sockets.
+.RS
+.B "Warning:"
+This option should be unnecessary for the vast majority of users. The use of this option could even be harmful because the specified value may exceed the limitation of the underlying system API. It is therefore set only when the default configuration causes exhaustion of file descriptors and the operational environment is known to support the specified number of sockets. Note also that the actual maximum number is normally a little fewer than the specified value because
+\fBnamed\fR
+reserves some file descriptors for its internal use.
+.RE
+.RE
+.PP
 \-t \fIdirectory\fR
 .RS 4
-\fBchroot()\fR
-to
+Chroot to
 \fIdirectory\fR
 after processing the command line arguments, but before reading the configuration file.
 .RS
@@ -131,15 +156,14 @@ after processing the command line arguments, but before reading the configuratio
 This option should be used in conjunction with the
 \fB\-u\fR
 option, as chrooting a process running as root doesn't enhance security on most systems; the way
-\fBchroot()\fR
+\fBchroot(2)\fR
 is defined allows a process with root privileges to escape a chroot jail.
 .RE
 .RE
 .PP
 \-u \fIuser\fR
 .RS 4
-\fBsetuid()\fR
-to
+Setuid to
 \fIuser\fR
 after completing privileged operations, such as creating sockets that listen on privileged ports.
 .RS
@@ -147,13 +171,13 @@ after completing privileged operations, such as creating sockets that listen on
 On Linux,
 \fBnamed\fR
 uses the kernel's capability mechanism to drop all root privileges except the ability to
-\fBbind()\fR
+\fBbind(2)\fR
 to a privileged port and set process resource limits. Unfortunately, this means that the
 \fB\-u\fR
 option only works when
 \fBnamed\fR
 is run on kernel 2.2.18 or later, or kernel 2.3.99\-pre3 or later, since previous kernels did not allow privileges to be retained after
-\fBsetuid()\fR.
+\fBsetuid(2)\fR.
 .RE
 .RE
 .PP
@@ -211,6 +235,8 @@ The default process\-id file.
 RFC 1033,
 RFC 1034,
 RFC 1035,
+\fBnamed\-checkconf\fR(8),
+\fBnamed\-checkzone\fR(8),
 \fBrndc\fR(8),
 \fBlwresd\fR(8),
 \fBnamed.conf\fR(5),
@@ -219,7 +245,7 @@ BIND 9 Administrator Reference Manual.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2006 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000, 2001, 2003 Internet Software Consortium.
 .br
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.conf.5,v 1.1.2.22 2006/12/12 01:44:27 marka Exp $
+.\" $Id: named.conf.5,v 1.1.2.27 2008/09/05 01:32:08 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -174,6 +174,7 @@ options {
 	port \fIinteger\fR;
 	querylog \fIboolean\fR;
 	recursing\-file \fIquoted_string\fR;
+	reserved\-sockets \fIinteger\fR;
 	random\-device \fIquoted_string\fR;
 	recursive\-clients \fIinteger\fR;
 	serial\-query\-rate \fIinteger\fR;
@@ -253,6 +254,7 @@ options {
 	allow\-update { \fIaddress_match_element\fR; ... };
 	allow\-update\-forwarding { \fIaddress_match_element\fR; ... };
 	update\-check\-ksk \fIboolean\fR;
+	masterfile\-format ( text | raw );
 	notify \fInotifytype\fR;
 	notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
@@ -386,6 +388,7 @@ view \fIstring\fR \fIoptional_class\fR {
 	allow\-update { \fIaddress_match_element\fR; ... };
 	allow\-update\-forwarding { \fIaddress_match_element\fR; ... };
 	update\-check\-ksk \fIboolean\fR;
+	masterfile\-format ( text | raw );
 	notify \fInotifytype\fR;
 	notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
@@ -462,6 +465,7 @@ zone \fIstring\fR \fIoptional_class\fR {
 		\fIrrtypelist\fR; ...
 	};
 	update\-check\-ksk \fIboolean\fR;
+	masterfile\-format ( text | raw );
 	notify \fInotifytype\fR;
 	notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
 	notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
@@ -509,8 +513,9 @@ zone \fIstring\fR \fIoptional_class\fR {
 .SH "SEE ALSO"
 .PP
 \fBnamed\fR(8),
+\fBnamed\-checkconf\fR(8),
 \fBrndc\fR(8),
-\fBBIND 9 Administrator Reference Manual\fR().
+BIND 9 Administrator Reference Manual.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2006 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,10 +1,10 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -17,7 +17,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: named.conf.docbook,v 1.1.2.23 2006/09/13 00:20:50 marka Exp $ -->
+<!-- $Id: named.conf.docbook,v 1.1.2.31 2008/09/04 23:46:08 tbox Exp $ -->
 <refentry>
  <refentryinfo>
    <date>Aug 13, 2004</date>
@@ -39,6 +39,8 @@
      <year>2004</year>
      <year>2005</year>
      <year>2006</year>
+      <year>2007</year>
+      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -200,6 +202,7 @@ options {
 	port <replaceable>integer</replaceable>;
 	querylog <replaceable>boolean</replaceable>;
 	recursing-file <replaceable>quoted_string</replaceable>;
+	reserved-sockets <replaceable>integer</replaceable>;
 	random-device <replaceable>quoted_string</replaceable>;
 	recursive-clients <replaceable>integer</replaceable>;
 	serial-query-rate <replaceable>integer</replaceable>;
@@ -283,6 +286,7 @@ options {
 	allow-update-forwarding { <replaceable>address_match_element</replaceable>; ... };
 	update-check-ksk <replaceable>boolean</replaceable>;

+	masterfile-format ( text | raw );
 	notify <replaceable>notifytype</replaceable>;
 	notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
@@ -431,6 +435,7 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 	allow-update-forwarding { <replaceable>address_match_element</replaceable>; ... };
 	update-check-ksk <replaceable>boolean</replaceable>;

+	masterfile-format ( text | raw );
 	notify <replaceable>notifytype</replaceable>;
 	notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
@@ -517,6 +522,7 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 	};
 	update-check-ksk <replaceable>boolean</replaceable>;

+	masterfile-format ( text | raw );
 	notify <replaceable>notifytype</replaceable>;
 	notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
 	notify-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
@@ -577,11 +583,12 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
        <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
      <citerefentry>
-        <refentrytitle>rndc</refentrytitle><manvolnum>8</manvolnum>
+        <refentrytitle>named-checkconf</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
      <citerefentry>
-        <refentrytitle>BIND 9 Administrator Reference Manual</refentrytitle>
-      </citerefentry>.
+        <refentrytitle>rndc</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry>,
+      <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
    </para>
  </refsect1>

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.conf.html,v 1.1.2.30 2006/12/12 01:44:27 marka Exp $ -->
+<!-- $Id: named.conf.html,v 1.1.2.36 2008/09/05 01:32:08 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -21,7 +21,7 @@
 <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2476419"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><code class="filename">named.conf</code> &#8212; configuration file for named</p>
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543594"></a><h2>DESCRIPTION</h2>
+<a name="id2543342"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">named.conf</code> is the configuration file
      for
      <span><strong class="command">named</strong></span>.  Statements are enclosed
@@ -50,14 +50,14 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543622"></a><h2>ACL</h2>
+<a name="id2543370"></a><h2>ACL</h2>
 <div class="literallayout"><p><br>
 acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 <br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543638"></a><h2>KEY</h2>
+<a name="id2543386"></a><h2>KEY</h2>
 <div class="literallayout"><p><br>
 key <em class="replaceable"><code>domain_name</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -66,7 +66,7 @@ key
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543657"></a><h2>MASTERS</h2>
+<a name="id2543405"></a><h2>MASTERS</h2>
 <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
 	( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
@@ -75,7 +75,7 @@ masters
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543703"></a><h2>SERVER</h2>
+<a name="id2543451"></a><h2>SERVER</h2>
 <div class="literallayout"><p><br>
 server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/prefixlen</span>]</code></em> | <em class="replaceable"><code>ipv6_address[<span class="optional">/prefixlen</span>]</code></em> ) {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -97,7 +97,7 @@ server
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543771"></a><h2>TRUSTED-KEYS</h2>
+<a name="id2543520"></a><h2>TRUSTED-KEYS</h2>
 <div class="literallayout"><p><br>
 trusted-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br>
@@ -105,7 +105,7 @@ trusted-keys
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543797"></a><h2>CONTROLS</h2>
+<a name="id2543545"></a><h2>CONTROLS</h2>
 <div class="literallayout"><p><br>
 controls {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br>
@@ -117,7 +117,7 @@ controls
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543832"></a><h2>LOGGING</h2>
+<a name="id2543580"></a><h2>LOGGING</h2>
 <div class="literallayout"><p><br>
 logging {<br>
 	channel <em class="replaceable"><code>string</code></em> {<br>
@@ -135,7 +135,7 @@ logging
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543870"></a><h2>LWRES</h2>
+<a name="id2543619"></a><h2>LWRES</h2>
 <div class="literallayout"><p><br>
 lwres {<br>
 	listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
@@ -148,7 +148,7 @@ lwres
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543912"></a><h2>OPTIONS</h2>
+<a name="id2543660"></a><h2>OPTIONS</h2>
 <div class="literallayout"><p><br>
 options {<br>
 	avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br>
@@ -172,6 +172,7 @@ options
 	port <em class="replaceable"><code>integer</code></em>;<br>
 	querylog <em class="replaceable"><code>boolean</code></em>;<br>
 	recursing-file <em class="replaceable"><code>quoted_string</code></em>;<br>
+	reserved-sockets <em class="replaceable"><code>integer</code></em>;<br>
 	random-device <em class="replaceable"><code>quoted_string</code></em>;<br>
 	recursive-clients <em class="replaceable"><code>integer</code></em>;<br>
 	serial-query-rate <em class="replaceable"><code>integer</code></em>;<br>
@@ -255,6 +256,7 @@ options
 	allow-update-forwarding { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 <br>
+	masterfile-format ( text | raw );<br>
 	notify <em class="replaceable"><code>notifytype</code></em>;<br>
 	notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
@@ -312,7 +314,7 @@ options
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544586"></a><h2>VIEW</h2>
+<a name="id2544407"></a><h2>VIEW</h2>
 <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -402,6 +404,7 @@ view
 	allow-update-forwarding { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 <br>
+	masterfile-format ( text | raw );<br>
 	notify <em class="replaceable"><code>notifytype</code></em>;<br>
 	notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
@@ -451,7 +454,7 @@ view
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545219"></a><h2>ZONE</h2>
+<a name="id2544972"></a><h2>ZONE</h2>
 <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	type ( master | slave | stub | hint |<br>
@@ -487,6 +490,7 @@ zone
 	};<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 <br>
+	masterfile-format ( text | raw );<br>
 	notify <em class="replaceable"><code>notifytype</code></em>;<br>
 	notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
 	notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
@@ -535,15 +539,16 @@ zone
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545502"></a><h2>FILES</h2>
+<a name="id2545325"></a><h2>FILES</h2>
 <p><code class="filename">/etc/named.conf</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545514"></a><h2>SEE ALSO</h2>
+<a name="id2545337"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">BIND 9 Administrator Reference Manual</span></span>.
+      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
 </div>
 </div></body>
@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: named.docbook,v 1.7.18.6 2006/01/17 23:49:31 marka Exp $ -->
+<!-- $Id: named.docbook,v 1.7.18.14 2008/08/21 23:46:01 tbox Exp $ -->
 <refentry id="man.named">
  <refentryinfo>
    <date>June 30, 2000</date>
@@ -40,6 +40,8 @@
      <year>2004</year>
      <year>2005</year>
      <year>2006</year>
+      <year>2007</year>
+      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -59,9 +61,11 @@
      <arg><option>-d <replaceable class="parameter">debug-level</replaceable></option></arg>
      <arg><option>-f</option></arg>
      <arg><option>-g</option></arg>
+      <arg><option>-m <replaceable class="parameter">flag</replaceable></option></arg>
      <arg><option>-n <replaceable class="parameter">#cpus</replaceable></option></arg>
      <arg><option>-p <replaceable class="parameter">port</replaceable></option></arg>
      <arg><option>-s</option></arg>
+      <arg><option>-S <replaceable class="parameter">#max-socks</replaceable></option></arg>
      <arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg>
      <arg><option>-u <replaceable class="parameter">user</replaceable></option></arg>
      <arg><option>-v</option></arg>
@@ -157,6 +161,22 @@
        </listitem>
      </varlistentry>

+      <varlistentry>
+        <term>-m <replaceable class="parameter">flag</replaceable></term>
+        <listitem>
+          <para>
+	    Turn on memory usage debugging flags.  Possible flags are
+	    <replaceable class="parameter">usage</replaceable>,
+	    <replaceable class="parameter">trace</replaceable>,
+	    <replaceable class="parameter">record</replaceable>,
+	    <replaceable class="parameter">size</replaceable>, and
+	    <replaceable class="parameter">mctx</replaceable>.
+	    These correspond to the ISC_MEM_DEBUGXXXX flags described in
+	    <filename>&lt;isc/mem.h&gt;</filename>.
+          </para>
+        </listitem>
+      </varlistentry>
+
      <varlistentry>
        <term>-n <replaceable class="parameter">#cpus</replaceable></term>
        <listitem>
@@ -196,10 +216,37 @@
        </listitem>
      </varlistentry>

+      <varlistentry>
+        <term>-S <replaceable class="parameter">#max-socks</replaceable></term>
+        <listitem>
+	  <para>
+	    Allow <command>named</command> to use up to
+	    <replaceable class="parameter">#max-socks</replaceable> sockets.
+	  </para>
+          <warning>
+            <para>
+              This option should be unnecessary for the vast majority
+              of users.
+	      The use of this option could even be harmful because the
+              specified value may exceed the limitation of the
+              underlying system API.
+	      It is therefore set only when the default configuration
+              causes exhaustion of file descriptors and the
+              operational environment is known to support the
+              specified number of sockets.
+	      Note also that the actual maximum number is normally a little
+              fewer than the specified value because
+	      <command>named</command> reserves some file descriptors
+	      for its internal use.
+            </para>
+          </warning>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
        <term>-t <replaceable class="parameter">directory</replaceable></term>
        <listitem>
-          <para><function>chroot()</function>
+          <para>Chroot
 	    to <replaceable class="parameter">directory</replaceable> after
            processing the command line arguments, but before
            reading the configuration file.
@@ -209,7 +256,7 @@
              This option should be used in conjunction with the
              <option>-u</option> option, as chrooting a process
              running as root doesn't enhance security on most
-              systems; the way <function>chroot()</function> is
+              systems; the way <function>chroot(2)</function> is
              defined allows a process with root privileges to
              escape a chroot jail.
            </para>
@@ -220,7 +267,7 @@
      <varlistentry>
        <term>-u <replaceable class="parameter">user</replaceable></term>
        <listitem>
-          <para><function>setuid()</function>
+          <para>Setuid
 	    to <replaceable class="parameter">user</replaceable> after completing
            privileged operations, such as creating sockets that
            listen on privileged ports.
@@ -229,7 +276,7 @@
            <para>
              On Linux, <command>named</command> uses the kernel's
              		capability mechanism to drop all root privileges
-              except the ability to <function>bind()</function> to
+              except the ability to <function>bind(2)</function> to
              a
              privileged port and set process resource limits.
              Unfortunately, this means that the <option>-u</option>
@@ -237,7 +284,7 @@
              run
              on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or
              later, since previous kernels did not allow privileges
-              to be retained after <function>setuid()</function>.
+              to be retained after <function>setuid(2)</function>.
            </para>
          </note>
        </listitem>
@@ -351,6 +398,14 @@
    <para><citetitle>RFC 1033</citetitle>,
      <citetitle>RFC 1034</citetitle>,
      <citetitle>RFC 1035</citetitle>,
+      <citerefentry>
+        <refentrytitle>named-checkconf</refentrytitle>
+	<manvolnum>8</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>named-checkzone</refentrytitle>
+	<manvolnum>8</manvolnum>
+      </citerefentry>,
      <citerefentry>
        <refentrytitle>rndc</refentrytitle>
 	<manvolnum>8</manvolnum>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.html,v 1.6.18.16 2006/12/12 01:44:27 marka Exp $ -->
+<!-- $Id: named.html,v 1.6.18.22 2008/09/01 02:29:00 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -29,10 +29,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543630"></a><h2>DESCRIPTION</h2>
+<a name="id2543464"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named</strong></span>
      is a Domain Name System (DNS) server,
      part of the BIND 9 distribution from ISC.  For more
@@ -47,7 +47,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543655"></a><h2>OPTIONS</h2>
+<a name="id2543489"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -88,6 +88,17 @@
            Run the server in the foreground and force all logging
            to <code class="filename">stderr</code>.
          </p></dd>
+<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt>
+<dd><p>
+	    Turn on memory usage debugging flags.  Possible flags are
+	    <em class="replaceable"><code>usage</code></em>,
+	    <em class="replaceable"><code>trace</code></em>,
+	    <em class="replaceable"><code>record</code></em>,
+	    <em class="replaceable"><code>size</code></em>, and
+	    <em class="replaceable"><code>mctx</code></em>.
+	    These correspond to the ISC_MEM_DEBUGXXXX flags described in
+	    <code class="filename">&lt;isc/mem.h&gt;</code>.
+          </p></dd>
 <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt>
 <dd><p>
            Create <em class="replaceable"><code>#cpus</code></em> worker threads
@@ -115,9 +126,34 @@
            </p>
 </div>
 </dd>
+<dt><span class="term">-S <em class="replaceable"><code>#max-socks</code></em></span></dt>
+<dd>
+<p>
+	    Allow <span><strong class="command">named</strong></span> to use up to
+	    <em class="replaceable"><code>#max-socks</code></em> sockets.
+	  </p>
+<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
+<h3 class="title">Warning</h3>
+<p>
+              This option should be unnecessary for the vast majority
+              of users.
+	      The use of this option could even be harmful because the
+              specified value may exceed the limitation of the
+              underlying system API.
+	      It is therefore set only when the default configuration
+              causes exhaustion of file descriptors and the
+              operational environment is known to support the
+              specified number of sockets.
+	      Note also that the actual maximum number is normally a little
+              fewer than the specified value because
+	      <span><strong class="command">named</strong></span> reserves some file descriptors
+	      for its internal use.
+            </p>
+</div>
+</dd>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd>
-<p><code class="function">chroot()</code>
+<p>Chroot
 	    to <em class="replaceable"><code>directory</code></em> after
            processing the command line arguments, but before
            reading the configuration file.
@@ -128,7 +164,7 @@
              This option should be used in conjunction with the
              <code class="option">-u</code> option, as chrooting a process
              running as root doesn't enhance security on most
-              systems; the way <code class="function">chroot()</code> is
+              systems; the way <code class="function">chroot(2)</code> is
              defined allows a process with root privileges to
              escape a chroot jail.
            </p>
@@ -136,7 +172,7 @@
 </dd>
 <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt>
 <dd>
-<p><code class="function">setuid()</code>
+<p>Setuid
 	    to <em class="replaceable"><code>user</code></em> after completing
            privileged operations, such as creating sockets that
            listen on privileged ports.
@@ -146,7 +182,7 @@
 <p>
              On Linux, <span><strong class="command">named</strong></span> uses the kernel's
              		capability mechanism to drop all root privileges
-              except the ability to <code class="function">bind()</code> to
+              except the ability to <code class="function">bind(2)</code> to
              a
              privileged port and set process resource limits.
              Unfortunately, this means that the <code class="option">-u</code>
@@ -154,7 +190,7 @@
              run
              on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or
              later, since previous kernels did not allow privileges
-              to be retained after <code class="function">setuid()</code>.
+              to be retained after <code class="function">setuid(2)</code>.
            </p>
 </div>
 </dd>
@@ -180,7 +216,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544000"></a><h2>SIGNALS</h2>
+<a name="id2543911"></a><h2>SIGNALS</h2>
 <p>
      In routine operation, signals should not be used to control
      the nameserver; <span><strong class="command">rndc</strong></span> should be used
@@ -201,7 +237,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544048"></a><h2>CONFIGURATION</h2>
+<a name="id2543959"></a><h2>CONFIGURATION</h2>
 <p>
      The <span><strong class="command">named</strong></span> configuration file is too complex
      to describe in detail here.  A complete description is provided
@@ -210,7 +246,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544065"></a><h2>FILES</h2>
+<a name="id2543976"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
 <dd><p>
@@ -223,10 +259,12 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544104"></a><h2>SEE ALSO</h2>
+<a name="id2544016"></a><h2>SEE ALSO</h2>
 <p><em class="citetitle">RFC 1033</em>,
      <em class="citetitle">RFC 1034</em>,
      <em class="citetitle">RFC 1035</em>,
+      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
+      <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
@@ -234,7 +272,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544155"></a><h2>AUTHOR</h2>
+<a name="id2544086"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: query.c,v 1.257.18.36 2007/01/08 02:41:59 marka Exp $ */
+/* $Id: query.c,v 1.257.18.46 2008/10/15 22:33:01 marka Exp $ */

 /*! \file */

@@ -2298,7 +2298,7 @@ mark_secure(ns_client_t *client, dns_db_t *db, dns_name_t *name,
 static isc_boolean_t
 get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,
 	dns_rdataset_t *keyrdataset, dst_key_t **keyp)
-{ 
+{
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
 	isc_boolean_t secure = ISC_FALSE;
@@ -2331,12 +2331,12 @@ get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,
 		isc_buffer_init(&b, rdata.data, rdata.length);
 		isc_buffer_add(&b, rdata.length);
 		result = dst_key_fromdns(&rrsig->signer, rdata.rdclass, &b,
-                                         client->mctx, keyp);
+					 client->mctx, keyp);
 		if (result != ISC_R_SUCCESS)
 			continue;
 		if (rrsig->algorithm == (dns_secalg_t)dst_key_alg(*keyp) &&
-                    rrsig->keyid == (dns_keytag_t)dst_key_id(*keyp) &&
-                    dst_key_iszonekey(*keyp)) {
+		    rrsig->keyid == (dns_keytag_t)dst_key_id(*keyp) &&
+		    dst_key_iszonekey(*keyp)) {
 			secure = ISC_TRUE;
 			break;
 		}
@@ -2354,7 +2354,7 @@ verify(dst_key_t *key, dns_name_t *name, dns_rdataset_t *rdataset,
 	isc_boolean_t ignore = ISC_FALSE;

 	dns_fixedname_init(&fixed);
-	
+
 again:
 	result = dns_dnssec_verify2(name, rdataset, key, ignore, mctx,
 				    rdata, NULL);
@@ -2382,7 +2382,7 @@ validate(ns_client_t *client, dns_db_t *db, dns_name_t *name,

 	if (sigrdataset == NULL || !dns_rdataset_isassociated(sigrdataset))
 		return (ISC_FALSE);
-	
+
 	for (result = dns_rdataset_first(sigrdataset);
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(sigrdataset)) {
@@ -2592,7 +2592,9 @@ query_addbestns(ns_client_t *client) {
 }

 static void
-query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) {
+query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node,
+	    dns_dbversion_t *version)
+{
 	dns_name_t *rname;
 	dns_rdataset_t *rdataset, *sigrdataset;
 	isc_result_t result;
@@ -2613,12 +2615,12 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) {
 	/*
 	 * Look for the DS record, which may or may not be present.
 	 */
-	result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ds, 0,
+	result = dns_db_findrdataset(db, node, version, dns_rdatatype_ds, 0,
 				     client->now, rdataset, sigrdataset);
 	/*
 	 * If we didn't find it, look for an NSEC. */
 	if (result == ISC_R_NOTFOUND)
-		result = dns_db_findrdataset(db, node, NULL,
+		result = dns_db_findrdataset(db, node, version,
 					     dns_rdatatype_nsec, 0, client->now,
 					     rdataset, sigrdataset);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND)
@@ -2657,7 +2659,8 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node) {

 static void
 query_addwildcardproof(ns_client_t *client, dns_db_t *db,
-		       dns_name_t *name, isc_boolean_t ispositive)
+		       dns_dbversion_t *version, dns_name_t *name,
+		       isc_boolean_t ispositive)
 {
 	isc_buffer_t *dbuf, b;
 	dns_name_t *fname;
@@ -2738,7 +2741,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 	if (fname == NULL || rdataset == NULL || sigrdataset == NULL)
 		goto cleanup;

-	result = dns_db_find(db, name, NULL, dns_rdatatype_nsec, options,
+	result = dns_db_find(db, name, version, dns_rdatatype_nsec, options,
 			     0, &node, fname, rdataset, sigrdataset);
 	if (node != NULL)
 		dns_db_detachnode(db, &node);
@@ -2754,6 +2757,13 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 						   &olabels);
 			(void)dns_name_fullcompare(name, &nsec.next, &order,
 						   &nlabels);
+			/*
+			 * Check for a pathological condition created when
+			 * serving some malformed signed zones and bail out.
+			 */
+			if (dns_name_countlabels(name) == nlabels)
+				goto cleanup;
+
 			if (olabels > nlabels)
 				dns_name_split(name, olabels, NULL, wname);
 			else
@@ -2790,8 +2800,9 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 }

 static void
-query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, dns_name_t **namep,
-		    dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp)
+query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db,
+		     dns_dbversion_t *version, dns_name_t **namep,
+		     dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp)
 {
 	dns_name_t *name;
 	dns_rdataset_t *sigrdataset;
@@ -2828,8 +2839,7 @@ query_addnxrrsetnsec(ns_client_t *client, dns_db_t *db, dns_name_t **namep,
 		return;

 	/* XXX */
-	query_addwildcardproof(client, db,
-			       client->query.qname,
+	query_addwildcardproof(client, db, version, client->query.qname,
 			       ISC_TRUE);

 	/*
@@ -2921,13 +2931,14 @@ query_resume(isc_task_t *task, isc_event_t *event) {

 static isc_result_t
 query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain,
-	      dns_rdataset_t *nameservers)
+	      dns_rdataset_t *nameservers, isc_boolean_t resuming)
 {
 	isc_result_t result;
 	dns_rdataset_t *rdataset, *sigrdataset;
 	isc_sockaddr_t *peeraddr;

-	inc_stats(client, dns_statscounter_recursion);
+	if (!resuming)
+		inc_stats(client, dns_statscounter_recursion);

 	/*
 	 * We are about to recurse, which means that this client will
@@ -3159,11 +3170,11 @@ query_addnoqnameproof(ns_client_t *client, dns_rdataset_t *rdataset) {

 cleanup:
 	if (nsec != NULL)
-                query_putrdataset(client, &nsec);
-        if (nsecsig != NULL)
-                query_putrdataset(client, &nsecsig);
-        if (fname != NULL)
-                query_releasename(client, &fname);
+		query_putrdataset(client, &nsec);
+	if (nsecsig != NULL)
+		query_putrdataset(client, &nsecsig);
+	if (fname != NULL)
+		query_releasename(client, &fname);
 }

 static inline void
@@ -3266,12 +3277,12 @@ warn_rfc1918(ns_client_t *client, dns_name_t *fname, dns_rdataset_t *rdataset) {
 	dns_rdata_soa_t soa;
 	dns_rdataset_t found;
 	isc_result_t result;
-	
+
 	for (i = 0; i < (sizeof(rfc1918names)/sizeof(*rfc1918names)); i++) {
 		if (dns_name_issubdomain(fname, &rfc1918names[i])) {
 			dns_rdataset_init(&found);
 			result = dns_ncache_getrdataset(rdataset,
-						        &rfc1918names[i],
+							&rfc1918names[i],
 							dns_rdatatype_soa,
 							&found);
 			if (result != ISC_R_SUCCESS)
@@ -3332,6 +3343,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	unsigned int options;
 	isc_boolean_t empty_wild;
 	dns_rdataset_t *noqname;
+	isc_boolean_t resuming;

 	CTRACE("query_find");

@@ -3357,6 +3369,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	need_wildcardproof = ISC_FALSE;
 	empty_wild = ISC_FALSE;
 	options = 0;
+	resuming = ISC_FALSE;
+	is_zone = ISC_FALSE;

 	if (event != NULL) {
 		/*
@@ -3366,7 +3380,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

 		want_restart = ISC_FALSE;
 		authoritative = ISC_FALSE;
-		is_zone = ISC_FALSE;

 		qtype = event->qtype;
 		if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)
@@ -3399,6 +3412,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		}

 		result = event->result;
+		resuming = ISC_TRUE;

 		goto resume;
 	}
@@ -3599,7 +3613,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			 */
 			if (RECURSIONOK(client)) {
 				result = query_recurse(client, qtype,
-						       NULL, NULL);
+						       NULL, NULL, resuming);
 				if (result == ISC_R_SUCCESS)
 					client->query.attributes |=
 						NS_QUERYATTR_RECURSING;
@@ -3705,7 +3719,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 					       dbuf, DNS_SECTION_AUTHORITY);
 				client->query.gluedb = NULL;
 				if (WANTDNSSEC(client) && dns_db_issecure(db))
-					query_addds(client, db, node);
+					query_addds(client, db, node, version);
 			} else {
 				/*
 				 * We might have a better answer or delegation
@@ -3770,10 +3784,12 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				 */
 				if (dns_rdatatype_atparent(type))
 					result = query_recurse(client, qtype,
-							       NULL, NULL);
+							       NULL, NULL,
+							       resuming);
 				else
 					result = query_recurse(client, qtype,
-							       fname, rdataset);
+							       fname, rdataset,
+							       resuming);
 				if (result == ISC_R_SUCCESS)
 					client->query.attributes |=
 						NS_QUERYATTR_RECURSING;
@@ -3809,7 +3825,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				client->query.attributes &=
 					~NS_QUERYATTR_CACHEGLUEOK;
 				if (WANTDNSSEC(client))
-					query_addds(client, db, node);
+					query_addds(client, db, node, version);
 			}
 		}
 		goto cleanup;
@@ -3846,8 +3862,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		 */
 		if (WANTDNSSEC(client)) {
 			if (dns_rdataset_isassociated(rdataset))
-				query_addnxrrsetnsec(client, db, &fname,
-						    &rdataset, &sigrdataset);
+				query_addnxrrsetnsec(client, db, version,
+						     &fname, &rdataset,
+						     &sigrdataset);
 		}
 		goto cleanup;
 	case DNS_R_EMPTYWILD:
@@ -3896,7 +3913,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				query_addrrset(client, &fname, &rdataset,
 					       &sigrdataset,
 					       NULL, DNS_SECTION_AUTHORITY);
-				query_addwildcardproof(client, db,
+				query_addwildcardproof(client, db, version,
 						       client->query.qname,
 						       ISC_FALSE);
 			}
@@ -4209,6 +4226,22 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				 * an error unless we were searching for
 				 * glue.  Ugh.
 				 */
+				if (!is_zone) {
+					authoritative = ISC_FALSE;
+					dns_rdatasetiter_destroy(&rdsiter);
+					if (RECURSIONOK(client)) {
+						result = query_recurse(client,
+								       qtype,
+								       NULL,
+								       NULL,
+								       resuming);
+						if (result == ISC_R_SUCCESS)
+						    client->query.attributes |=
+							NS_QUERYATTR_RECURSING;
+						else
+						    QUERY_ERROR(DNS_R_SERVFAIL);					}
+					goto addauth;
+				}
 				/*
 				 * We were searching for SIG records in
 				 * a nonsecure zone.  Send a "no error,
@@ -4290,7 +4323,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	 * DNSSEC wildcard proofs.
 	 */
 	if (need_wildcardproof && dns_db_issecure(db))
-		query_addwildcardproof(client, db,
+		query_addwildcardproof(client, db, version,
 				       dns_fixedname_name(&wildcardname),
 				       ISC_TRUE);
 cleanup:
@@ -4418,6 +4451,7 @@ ns_query_start(ns_client_t *client) {
 	dns_rdataset_t *rdataset;
 	ns_client_t *qclient;
 	dns_rdatatype_t qtype;
+	isc_boolean_t want_ad;

 	CTRACE("ns_query_start");

@@ -4556,6 +4590,15 @@ ns_query_start(ns_client_t *client) {
 	if (message->flags & DNS_MESSAGEFLAG_CD)
 		client->query.attributes &= ~NS_QUERYATTR_SECURE;

+	/*
+	 * Set 'want_ad' if the client has set AD in the query.
+	 * This allows AD to be returned on queries without DO set.
+	 */
+	if ((message->flags & DNS_MESSAGEFLAG_AD) != 0)
+		want_ad = ISC_TRUE;
+	else
+		want_ad = ISC_FALSE;
+
 	/*
 	 * This is an ordinary query.
 	 */
@@ -4575,7 +4618,7 @@ ns_query_start(ns_client_t *client) {
 	 * Set AD.  We must clear it if we add non-validated data to a
 	 * response.
 	 */
-	if (client->view->enablednssec)
+	if (WANTDNSSEC(client) || want_ad)
 		message->flags |= DNS_MESSAGEFLAG_AD;

 	qclient = NULL;
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,13 +15,14 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: server.c,v 1.419.18.49 2006/12/07 05:24:19 marka Exp $ */
+/* $Id: server.c,v 1.419.18.68 2008/09/04 23:46:08 tbox Exp $ */

 /*! \file */

 #include <config.h>

 #include <stdlib.h>
+#include <unistd.h>

 #include <isc/app.h>
 #include <isc/base64.h>
@@ -31,8 +32,10 @@
 #include <isc/hash.h>
 #include <isc/lex.h>
 #include <isc/parseint.h>
+#include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/resource.h>
+#include <isc/socket.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/task.h>
@@ -197,6 +200,7 @@ static const struct {
 #endif

 	/* RFC 3330 */
+	{ "0.IN-ADDR.ARPA", ISC_FALSE },	/* THIS NETWORK */
 	{ "127.IN-ADDR.ARPA", ISC_FALSE },	/* LOOPBACK */
 	{ "254.169.IN-ADDR.ARPA", ISC_FALSE },	/* LINK LOCAL */
 	{ "2.0.192.IN-ADDR.ARPA", ISC_FALSE },	/* TEST NET */
@@ -438,7 +442,7 @@ configure_view_dnsseckeys(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 	*target = keytable; /* Transfer ownership. */
 	keytable = NULL;
 	result = ISC_R_SUCCESS;
-	
+
 cleanup:
 	return (result);
 }
@@ -454,7 +458,7 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)
 	isc_boolean_t value;
 	isc_result_t result;
 	isc_buffer_t b;
-	
+
 	dns_fixedname_init(&fixed);
 	name = dns_fixedname_name(&fixed);
 	for (element = cfg_list_first(mbs);
@@ -472,7 +476,7 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)
 	}

 	result = ISC_R_SUCCESS;
-	
+
 cleanup:
 	return (result);
 }
@@ -482,13 +486,15 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)
 */
 static isc_result_t
 get_view_querysource_dispatch(const cfg_obj_t **maps,
-			      int af, dns_dispatch_t **dispatchp)
+			      int af, dns_dispatch_t **dispatchp,
+			      isc_boolean_t is_firstview)
 {
 	isc_result_t result;
 	dns_dispatch_t *disp;
 	isc_sockaddr_t sa;
 	unsigned int attrs, attrmask;
 	const cfg_obj_t *obj = NULL;
+	unsigned int maxdispatchbuffers;

 	/*
 	 * Make compiler happy.
@@ -540,6 +546,20 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
 		attrs |= DNS_DISPATCHATTR_IPV6;
 		break;
 	}
+	if (isc_sockaddr_getport(&sa) == 0) {
+		attrs |= DNS_DISPATCHATTR_EXCLUSIVE;
+		maxdispatchbuffers = 4096;
+	} else {
+		INSIST(obj != NULL);
+		if (is_firstview) {
+			cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO,
+				    "using specific query-source port "
+				    "suppresses port randomization and can be "
+				    "insecure.");
+		}
+		maxdispatchbuffers = 1000;
+	}
+
 	attrmask = 0;
 	attrmask |= DNS_DISPATCHATTR_UDP;
 	attrmask |= DNS_DISPATCHATTR_TCP;
@@ -549,7 +569,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
 	disp = NULL;
 	result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr,
 				     ns_g_taskmgr, &sa, 4096,
-				     1000, 32768, 16411, 16433,
+				     maxdispatchbuffers, 32768, 16411, 16433,
 				     attrs, attrmask, &disp);
 	if (result != ISC_R_SUCCESS) {
 		isc_sockaddr_t any;
@@ -601,7 +621,7 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 		return (result);

 	obj = cfg_tuple_get(ent, "name");
-	if (cfg_obj_isstring(obj)) 
+	if (cfg_obj_isstring(obj))
 		str = cfg_obj_asstring(obj);
 	else
 		str = "*";
@@ -654,7 +674,7 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 	cfg_obj_asnetprefix(cfg_map_getname(cpeer), &na, &prefixlen);

 	peer = NULL;
-	result = dns_peer_new(mctx, &na, &peer);
+	result = dns_peer_newprefix(mctx, &na, prefixlen, &peer);
 	if (result != ISC_R_SUCCESS)
 		return (result);

@@ -832,7 +852,7 @@ on_disable_list(const cfg_obj_t *disablelist, dns_name_t *zonename) {

 	dns_fixedname_init(&fixed);
 	name = dns_fixedname_name(&fixed);
-	
+
 	for (element = cfg_list_first(disablelist);
 	     element != NULL;
 	     element = cfg_list_next(element))
@@ -903,9 +923,9 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	const cfg_obj_t *alternates;
 	const cfg_obj_t *zonelist;
 #ifdef DLZ
- 	const cfg_obj_t *dlz;
- 	unsigned int dlzargc;
- 	char **dlzargv;
+	const cfg_obj_t *dlz;
+	unsigned int dlzargc;
+	char **dlzargv;
 #endif
 	const cfg_obj_t *disabled;
 	const cfg_obj_t *obj;
@@ -1056,7 +1076,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 				result = ISC_R_NOMEMORY;
 				goto cleanup;
 			}
-			
+
 			result = dns_dlzstrtoargv(mctx, s, &dlzargc, &dlzargv);
 			if (result != ISC_R_SUCCESS) {
 				isc_mem_free(mctx, s);
@@ -1175,8 +1195,12 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	 *
 	 * XXXRTH  Hardwired number of tasks.
 	 */
-	CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4));
-	CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6));
+	CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4,
+					    ISC_TF(ISC_LIST_PREV(view, link)
+						   == NULL)));
+	CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6,
+					    ISC_TF(ISC_LIST_PREV(view, link)
+						   == NULL)));
 	if (dispatch4 == NULL && dispatch6 == NULL) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "unable to obtain neither an IPv4 nor"
@@ -1215,7 +1239,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	result = ns_config_get(maps, "zero-no-soa-ttl-cache", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	dns_resolver_setzeronosoattl(view->resolver, cfg_obj_asboolean(obj));
-	
+
 	/*
 	 * Set the resolver's EDNS UDP size.
 	 */
@@ -1228,7 +1252,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	if (udpsize > 4096)
 		udpsize = 4096;
 	dns_resolver_setudpsize(view->resolver, (isc_uint16_t)udpsize);
-	
+
 	/*
 	 * Set the maximum UDP response size.
 	 */
@@ -1265,7 +1289,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	(void)ns_config_get(maps, "forward", &forwardtype);
 	(void)ns_config_get(maps, "forwarders", &forwarders);
 	if (forwarders != NULL)
-		CHECK(configure_forward(config, view, dns_rootname, 
+		CHECK(configure_forward(config, view, dns_rootname,
 					forwarders, forwardtype));

 	/*
@@ -1285,7 +1309,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	/*
 	 * If we still have no hints, this is a non-IN view with no
 	 * "hints zone" configured.  Issue a warning, except if this
-	 * is a root server.  Root servers never need to consult 
+	 * is a root server.  Root servers never need to consult
 	 * their hints, so it's no point requiring users to configure
 	 * them.
 	 */
@@ -1408,7 +1432,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 		view->transfer_format = dns_one_answer;
 	else
 		INSIST(0);
-	
+
 	/*
 	 * Set sources where additional data and CNAME/DNAME
 	 * targets for authoritative answers may be found.
@@ -1435,12 +1459,12 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 		view->additionalfromcache = ISC_TRUE;
 	}

+	/*
+	 * Set "allow-query-cache" and "allow-recursion" acls if
+	 * configured in named.conf.
+	 */
 	CHECK(configure_view_acl(vconfig, config, "allow-query-cache",
 				 actx, ns_g_mctx, &view->queryacl));
-	if (view->queryacl == NULL)
-		CHECK(configure_view_acl(NULL, ns_g_defaults,
-					 "allow-query-cache", actx,
-					 ns_g_mctx, &view->queryacl));

 	if (strcmp(view->name, "_bind") != 0)
 		CHECK(configure_view_acl(vconfig, config, "allow-recursion",
@@ -1460,11 +1484,29 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			      "active%s%s", forview, viewname);

 	/*
-	 * Set default "allow-recursion" acl.
+	 * "allow-query-cache" inherits from "allow-recursion" if set,
+	 * otherwise from "allow-query" if set.
+	 * "allow-recursion" inherits from "allow-query-cache" if set,
+	 * otherwise from "allow-query" if set.
+	 */
+	if (view->queryacl == NULL && view->recursionacl != NULL)
+		dns_acl_attach(view->recursionacl, &view->queryacl);
+	if (view->queryacl == NULL)
+		CHECK(configure_view_acl(vconfig, config, "allow-query",
+					 actx, ns_g_mctx, &view->queryacl));
+	if (view->recursionacl == NULL && view->queryacl != NULL)
+		dns_acl_attach(view->queryacl, &view->recursionacl);
+
+	/*
+	 * Set default "allow-recursion" and "allow-query-cache" acls.
 	 */
 	if (view->recursionacl == NULL && view->recursion)
-		CHECK(configure_view_acl(NULL, ns_g_defaults, "allow-recursion",
+		CHECK(configure_view_acl(NULL, ns_g_config, "allow-recursion",
 					 actx, ns_g_mctx, &view->recursionacl));
+	if (view->queryacl == NULL)
+		CHECK(configure_view_acl(NULL, ns_g_config,
+					 "allow-query-cache", actx,
+					 ns_g_mctx, &view->queryacl));

 	CHECK(configure_view_acl(vconfig, config, "sortlist",
 				 actx, ns_g_mctx, &view->sortlist));
@@ -1490,7 +1532,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	dns_resolver_setclientsperquery(view->resolver,
 					cfg_obj_asuint32(obj),
 					max_clients_per_query);
-			
+
 	obj = NULL;
 	result = ns_config_get(maps, "dnssec-enable", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -1719,14 +1761,14 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			if (result == ISC_R_SUCCESS &&
 			    forwarders->fwdpolicy == dns_fwdpolicy_only)
 				continue;
-						
+
 			if (!rfc1918 && empty_zones[empty_zone].rfc1918) {
 				if (logit) {
 					isc_log_write(ns_g_lctx,
 						      NS_LOGCATEGORY_GENERAL,
 						      NS_LOGMODULE_SERVER,
 						      ISC_LOG_WARNING,
-					              "Warning%s%s: "
+						      "Warning%s%s: "
 						      "'empty-zones-enable/"
 						      "disable-empty-zone' "
 						      "not set: disabling "
@@ -1755,6 +1797,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 						     empty_dbtype, mctx);
 				if (zone != NULL) {
 					dns_zone_setview(zone, view);
+					CHECK(dns_view_addzone(view, zone));
 					dns_zone_detach(&zone);
 					continue;
 				}
@@ -1767,7 +1810,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			dns_zone_setclass(zone, view->rdclass);
 			dns_zone_settype(zone, dns_zone_master);
 			CHECK(dns_zone_setdbtype(zone, empty_dbtypec,
-					 	 empty_dbtype));
+						 empty_dbtype));
 			if (view->queryacl != NULL)
 				dns_zone_setqueryacl(zone, view->queryacl);
 			dns_zone_setdialup(zone, dns_dialuptype_no);
@@ -1782,7 +1825,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			dns_zone_detach(&zone);
 		}
 	}
-	
+
 	result = ISC_R_SUCCESS;

 cleanup:
@@ -2098,7 +2141,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 							       "name"));
 		else
 			vname = "<default view>";
-	
+
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "zone '%s': wrong class for view '%s'",
@@ -2350,7 +2393,9 @@ scan_interfaces(ns_server_t *server, isc_boolean_t verbose) {
 }

 static isc_result_t
-add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr) {
+add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
+	      isc_boolean_t wcardport_ok)
+{
 	ns_listenelt_t *lelt = NULL;
 	dns_acl_t *src_acl = NULL;
 	dns_aclelement_t aelt;
@@ -2360,7 +2405,8 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr) {
 	REQUIRE(isc_sockaddr_pf(addr) == AF_INET6);

 	isc_sockaddr_any6(&any_sa6);
-	if (!isc_sockaddr_equal(&any_sa6, addr)) {
+	if (!isc_sockaddr_equal(&any_sa6, addr) &&
+	    (wcardport_ok || isc_sockaddr_getport(addr) != 0)) {
 		aelt.type = dns_aclelementtype_ipprefix;
 		aelt.negative = ISC_FALSE;
 		aelt.u.ip_prefix.prefixlen = 128;
@@ -2419,7 +2465,16 @@ adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {
 		result = dns_dispatch_getlocaladdress(dispatch6, &addr);
 		if (result != ISC_R_SUCCESS)
 			goto fail;
-		result = add_listenelt(mctx, list, &addr);
+
+		/*
+		 * We always add non-wildcard address regardless of whether
+		 * the port is 'any' (the fourth arg is TRUE): if the port is
+		 * specific, we need to add it since it may conflict with a
+		 * listening interface; if it's zero, we'll dynamically open
+		 * query ports, and some of them may override an existing
+		 * wildcard IPv6 port.
+		 */
+		result = add_listenelt(mctx, list, &addr, ISC_TRUE);
 		if (result != ISC_R_SUCCESS)
 			goto fail;
 	}
@@ -2449,18 +2504,18 @@ adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {
 			continue;

 		addrp = dns_zone_getnotifysrc6(zone);
-		result = add_listenelt(mctx, list, addrp);
+		result = add_listenelt(mctx, list, addrp, ISC_FALSE);
 		if (result != ISC_R_SUCCESS)
 			goto fail;

 		addrp = dns_zone_getxfrsource6(zone);
-		result = add_listenelt(mctx, list, addrp);
+		result = add_listenelt(mctx, list, addrp, ISC_FALSE);
 		if (result != ISC_R_SUCCESS)
 			goto fail;
 	}

 	ns_interfacemgr_adjust(server->interfacemgr, list, ISC_TRUE);
-	
+
 clean:
 	ns_listenlist_detach(&list);
 	return;
@@ -2549,7 +2604,7 @@ setstring(ns_server_t *server, char **field, const char *value) {

 	*field = copy;
 	return (ISC_R_SUCCESS);
-}	
+}

 /*
 * Replace the current value of '*field', a dynamically allocated
@@ -2591,7 +2646,7 @@ set_limit(const cfg_obj_t **maps, const char *configname,
 	result = isc_resource_setlimit(resourceid, value);
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
 		      result == ISC_R_SUCCESS ?
-		      	ISC_LOG_DEBUG(3) : ISC_LOG_WARNING,
+			ISC_LOG_DEBUG(3) : ISC_LOG_WARNING,
 		      "set maximum %s to %" ISC_PRINT_QUADFORMAT "d: %s",
 		      description, value, isc_result_totext(result));
 }
@@ -2608,31 +2663,48 @@ set_limits(const cfg_obj_t **maps) {
 	SETLIMIT("files", openfiles, "open files");
 }

-static isc_result_t
-portlist_fromconf(dns_portlist_t *portlist, unsigned int family,
-		  const cfg_obj_t *ports)
+static void
+portset_fromconf(isc_portset_t *portset, const cfg_obj_t *ports,
+		 isc_boolean_t positive)
 {
 	const cfg_listelt_t *element;
-	isc_result_t result = ISC_R_SUCCESS;

 	for (element = cfg_list_first(ports);
 	     element != NULL;
 	     element = cfg_list_next(element)) {
 		const cfg_obj_t *obj = cfg_listelt_value(element);
-		in_port_t port = (in_port_t)cfg_obj_asuint32(obj);
-		
-		result = dns_portlist_add(portlist, family, port);
-		if (result != ISC_R_SUCCESS)
-			break;
+
+		if (cfg_obj_isuint32(obj)) {
+			in_port_t port = (in_port_t)cfg_obj_asuint32(obj);
+
+			if (positive)
+				isc_portset_add(portset, port);
+			else
+				isc_portset_remove(portset, port);
+		} else {
+			const cfg_obj_t *obj_loport, *obj_hiport;
+			in_port_t loport, hiport;
+
+			obj_loport = cfg_tuple_get(obj, "loport");
+			loport = (in_port_t)cfg_obj_asuint32(obj_loport);
+			obj_hiport = cfg_tuple_get(obj, "hiport");
+			hiport = (in_port_t)cfg_obj_asuint32(obj_hiport);
+
+			if (positive)
+				isc_portset_addrange(portset, loport, hiport);
+			else {
+				isc_portset_removerange(portset, loport,
+							hiport);
+			}
+		}
 	}
-	return (result);
 }

 static isc_result_t
 removed(dns_zone_t *zone, void *uap) {
 	const char *type;

-        if (dns_zone_getview(zone) != uap)
+	if (dns_zone_getview(zone) != uap)
 		return (ISC_R_SUCCESS);

 	switch (dns_zone_gettype(zone)) {
@@ -2657,34 +2729,39 @@ static isc_result_t
 load_configuration(const char *filename, ns_server_t *server,
 		   isc_boolean_t first_time)
 {
-	isc_result_t result;
-	isc_interval_t interval;
-	cfg_parser_t *parser = NULL;
+	cfg_aclconfctx_t aclconfctx;
 	cfg_obj_t *config;
-	const cfg_obj_t *options;
-	const cfg_obj_t *views;
-	const cfg_obj_t *obj;
-	const cfg_obj_t *v4ports, *v6ports;
-	const cfg_obj_t *maps[3];
-	const cfg_obj_t *builtin_views;
+	cfg_parser_t *parser = NULL;
 	const cfg_listelt_t *element;
+	const cfg_obj_t *builtin_views;
+	const cfg_obj_t *maps[3];
+	const cfg_obj_t *obj;
+	const cfg_obj_t *options;
+	const cfg_obj_t *usev4ports, *avoidv4ports, *usev6ports, *avoidv6ports;
+	const cfg_obj_t *views;
 	dns_view_t *view = NULL;
 	dns_view_t *view_next;
-	dns_viewlist_t viewlist;
 	dns_viewlist_t tmpviewlist;
-	cfg_aclconfctx_t aclconfctx;
-	isc_uint32_t interface_interval;
-	isc_uint32_t heartbeat_interval;
-	isc_uint32_t udpsize;
-	in_port_t listen_port;
+	dns_viewlist_t viewlist;
+	in_port_t listen_port, udpport_low, udpport_high;
 	int i;
+	isc_interval_t interval;
+	isc_portset_t *v4portset = NULL;
+	isc_portset_t *v6portset = NULL;
+	isc_resourcevalue_t nfiles;
+	isc_result_t result;
+	isc_uint32_t heartbeat_interval;
+	isc_uint32_t interface_interval;
+	isc_uint32_t reserved;
+	isc_uint32_t udpsize;
+	unsigned int maxsocks;

 	cfg_aclconfctx_init(&aclconfctx);
 	ISC_LIST_INIT(viewlist);

 	/* Ensure exclusive access to configuration data. */
 	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);	
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);

 	/*
 	 * Parse the global default pseudo-config file.
@@ -2757,6 +2834,48 @@ load_configuration(const char *filename, ns_server_t *server,
 	 */
 	set_limits(maps);

+	/*
+	 * Check if max number of open sockets that the system allows is
+	 * sufficiently large.  Failing this condition is not necessarily fatal,
+	 * but may cause subsequent runtime failures for a busy recursive
+	 * server.
+	 */
+	result = isc_socketmgr_getmaxsockets(ns_g_socketmgr, &maxsocks);
+	if (result != ISC_R_SUCCESS)
+		maxsocks = 0;
+	result = isc_resource_getcurlimit(isc_resource_openfiles, &nfiles);
+	if (result == ISC_R_SUCCESS && (isc_resourcevalue_t)maxsocks > nfiles) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
+			      "max open files (%" ISC_PRINT_QUADFORMAT "u)"
+			      " is smaller than max sockets (%u)",
+			      nfiles, maxsocks);
+	}
+
+	/*
+	 * Set the number of socket reserved for TCP, stdio etc.
+	 */
+	obj = NULL;
+	result = ns_config_get(maps, "reserved-sockets", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	reserved = cfg_obj_asuint32(obj);
+	if (maxsocks != 0) {
+		if (maxsocks < 128U)			/* Prevent underflow. */
+			reserved = 0;
+		else if (reserved > maxsocks - 128U)	/* Minimum UDP space. */
+			reserved = maxsocks - 128;
+	}
+	/* Minimum TCP/stdio space. */
+	if (reserved < 128U)
+		reserved = 128;
+	if (reserved + 128U > maxsocks && maxsocks != 0) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
+			      "less than 128 UDP sockets available after "
+			      "applying 'reserved-sockets' and 'maxsockets'");
+	}
+	isc__socketmgr_setreserved(ns_g_socketmgr, reserved);
+
 	/*
 	 * Configure various server options.
 	 */
@@ -2781,24 +2900,64 @@ load_configuration(const char *filename, ns_server_t *server,
 	INSIST(result == ISC_R_SUCCESS);
 	server->aclenv.match_mapped = cfg_obj_asboolean(obj);

-	v4ports = NULL;
-	v6ports = NULL;
-	(void)ns_config_get(maps, "avoid-v4-udp-ports", &v4ports);
-	(void)ns_config_get(maps, "avoid-v6-udp-ports", &v6ports);
-	if (v4ports != NULL || v6ports != NULL) {
-		dns_portlist_t *portlist = NULL;
-		result = dns_portlist_create(ns_g_mctx, &portlist);
-		if (result == ISC_R_SUCCESS && v4ports != NULL)
-			result = portlist_fromconf(portlist, AF_INET, v4ports);
-		if (result == ISC_R_SUCCESS && v6ports != NULL)
-			portlist_fromconf(portlist, AF_INET6, v6ports);
-		if (result == ISC_R_SUCCESS)
-			dns_dispatchmgr_setblackportlist(ns_g_dispatchmgr, portlist);
-		if (portlist != NULL)
-			dns_portlist_detach(&portlist);
-		CHECK(result);
-	} else
-		dns_dispatchmgr_setblackportlist(ns_g_dispatchmgr, NULL);
+	/*
+	 * Configure sets of UDP query source ports.
+	 */
+	CHECKM(isc_portset_create(ns_g_mctx, &v4portset),
+	       "creating UDP port set");
+	CHECKM(isc_portset_create(ns_g_mctx, &v6portset),
+	       "creating UDP port set");
+
+	usev4ports = NULL;
+	usev6ports = NULL;
+	avoidv4ports = NULL;
+	avoidv6ports = NULL;
+
+	(void)ns_config_get(maps, "use-v4-udp-ports", &usev4ports);
+	if (usev4ports != NULL)
+		portset_fromconf(v4portset, usev4ports, ISC_TRUE);
+	else {
+		CHECKM(isc_net_getudpportrange(AF_INET, &udpport_low,
+					       &udpport_high),
+		       "get the default UDP/IPv4 port range");
+		if (udpport_low == udpport_high)
+			isc_portset_add(v4portset, udpport_low);
+		else {
+			isc_portset_addrange(v4portset, udpport_low,
+					     udpport_high);
+		}
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "using default UDP/IPv4 port range: [%d, %d]",
+			      udpport_low, udpport_high);
+	}
+	(void)ns_config_get(maps, "avoid-v4-udp-ports", &avoidv4ports);
+	if (avoidv4ports != NULL)
+		portset_fromconf(v4portset, avoidv4ports, ISC_FALSE);
+
+	(void)ns_config_get(maps, "use-v6-udp-ports", &usev6ports);
+	if (usev6ports != NULL)
+		portset_fromconf(v6portset, usev6ports, ISC_TRUE);
+	else {
+		CHECKM(isc_net_getudpportrange(AF_INET6, &udpport_low,
+					       &udpport_high),
+		       "get the default UDP/IPv6 port range");
+		if (udpport_low == udpport_high)
+			isc_portset_add(v6portset, udpport_low);
+		else {
+			isc_portset_addrange(v6portset, udpport_low,
+					     udpport_high);
+		}
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "using default UDP/IPv6 port range: [%d, %d]",
+			      udpport_low, udpport_high);
+	}
+	(void)ns_config_get(maps, "avoid-v6-udp-ports", &avoidv6ports);
+	if (avoidv6ports != NULL)
+		portset_fromconf(v6portset, avoidv6ports, ISC_FALSE);
+
+	dns_dispatchmgr_setavailports(ns_g_dispatchmgr, v4portset, v6portset);

 	/*
 	 * Set the EDNS UDP size when we don't match a view.
@@ -2959,7 +3118,7 @@ load_configuration(const char *filename, ns_server_t *server,
 				      NULL, &interval, ISC_FALSE));
 	}
 	server->heartbeat_interval = heartbeat_interval;
-	
+
 	isc_interval_set(&interval, 1200, 0);
 	CHECK(isc_timer_reset(server->pps_timer, isc_timertype_ticker, NULL,
 			      &interval, ISC_FALSE));
@@ -3106,6 +3265,15 @@ load_configuration(const char *filename, ns_server_t *server,
 	if (first_time)
 		ns_os_changeuser();

+	/*
+	 * Check that the working directory is writable.
+	 */
+	if (access(".", W_OK) != 0) {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "the working directory is not writable");
+	}
+
 	/*
 	 * Configure the logging system.
 	 *
@@ -3199,7 +3367,7 @@ load_configuration(const char *filename, ns_server_t *server,
 		ns_os_writepidfile(lwresd_g_defaultpidfile, first_time);
 	else
 		ns_os_writepidfile(ns_g_defaultpidfile, first_time);
-	
+
 	obj = NULL;
 	if (options != NULL &&
 	    cfg_map_get(options, "memstatistics-file", &obj) == ISC_R_SUCCESS)
@@ -3266,6 +3434,12 @@ load_configuration(const char *filename, ns_server_t *server,
 	result = ISC_R_SUCCESS;

 cleanup:
+	if (v4portset != NULL)
+		isc_portset_destroy(ns_g_mctx, &v4portset);
+
+	if (v6portset != NULL)
+		isc_portset_destroy(ns_g_mctx, &v6portset);
+
 	cfg_aclconfctx_destroy(&aclconfctx);

 	if (parser != NULL) {
@@ -3336,7 +3510,7 @@ load_zones(ns_server_t *server, isc_boolean_t stop) {
 	 */
 	CHECK(dns_zonemgr_forcemaint(server->zonemgr));
 cleanup:
-	isc_task_endexclusive(server->task);	
+	isc_task_endexclusive(server->task);
 	return (result);
 }

@@ -3364,7 +3538,7 @@ load_new_zones(ns_server_t *server, isc_boolean_t stop) {
 	 */
 	dns_zonemgr_resumexfrs(server->zonemgr);
 cleanup:
-	isc_task_endexclusive(server->task);	
+	isc_task_endexclusive(server->task);
 	return (result);
 }

@@ -3423,7 +3597,7 @@ run_server(isc_task_t *task, isc_event_t *event) {
 		      ISC_LOG_NOTICE, "running");
 }

-void 
+void
 ns_server_flushonshutdown(ns_server_t *server, isc_boolean_t flush) {

 	REQUIRE(NS_SERVER_VALID(server));
@@ -3557,7 +3731,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	server->interface_timer = NULL;
 	server->heartbeat_timer = NULL;
 	server->pps_timer = NULL;
-	
+
 	server->interface_interval = 0;
 	server->heartbeat_interval = 0;

@@ -3580,7 +3754,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {

 	server->hostname_set = ISC_FALSE;
 	server->hostname = NULL;
-	server->version_set = ISC_FALSE;	
+	server->version_set = ISC_FALSE;
 	server->version = NULL;
 	server->server_usehostname = ISC_FALSE;
 	server->server_id = NULL;
@@ -3736,7 +3910,7 @@ ns_add_reserved_dispatch(ns_server_t *server, const isc_sockaddr_t *addr) {
 	result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr,
 				     ns_g_taskmgr, &dispatch->addr, 4096,
 				     1000, 32768, 16411, 16433,
-				     attrs, attrmask, &dispatch->dispatch); 
+				     attrs, attrmask, &dispatch->dispatch);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;

@@ -3839,7 +4013,7 @@ next_token(char **stringp, const char *delim) {
 			break;
 	} while (*res == '\0');
 	return (res);
-}                       
+}

 /*
 * Find the zone specified in the control channel command 'args',
@@ -3897,14 +4071,14 @@ zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep) {
 	} else {
 		rdclass = dns_rdataclass_in;
 	}
-	
+
 	if (viewtxt == NULL)
 		viewtxt = "_default";
 	result = dns_viewlist_find(&server->viewlist, viewtxt,
 				   rdclass, &view);
 	if (result != ISC_R_SUCCESS)
 		goto fail1;
-	
+
 	result = dns_zt_find(view->zonetable, dns_fixedname_name(&name),
 			     0, NULL, zonep);
 	/* Partial match? */
@@ -3923,7 +4097,7 @@ ns_server_retransfercommand(ns_server_t *server, char *args) {
 	isc_result_t result;
 	dns_zone_t *zone = NULL;
 	dns_zonetype_t type;
-	
+
 	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -3936,7 +4110,7 @@ ns_server_retransfercommand(ns_server_t *server, char *args) {
 		result = ISC_R_NOTFOUND;
 	dns_zone_detach(&zone);
 	return (result);
-}	
+}

 /*
 * Act on a "reload" command from the command channel.
@@ -3947,7 +4121,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 	dns_zone_t *zone = NULL;
 	dns_zonetype_t type;
 	const char *msg = NULL;
-	
+
 	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -3959,11 +4133,12 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 		type = dns_zone_gettype(zone);
 		if (type == dns_zone_slave || type == dns_zone_stub) {
 			dns_zone_refresh(zone);
+			dns_zone_detach(&zone);
 			msg = "zone refresh queued";
 		} else {
 			result = dns_zone_load(zone);
 			dns_zone_detach(&zone);
-			switch (result) {	
+			switch (result) {
 			case ISC_R_SUCCESS:
 				 msg = "zone reload successful";
 				 break;
@@ -3985,7 +4160,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 		isc_buffer_putmem(text, (const unsigned char *)msg,
 				  strlen(msg) + 1);
 	return (result);
-}	
+}

 /*
 * Act on a "reconfig" command from the command channel.
@@ -4012,14 +4187,14 @@ ns_server_notifycommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 		return (result);
 	if (zone == NULL)
 		return (ISC_R_UNEXPECTEDEND);
-	
+
 	dns_zone_notify(zone);
 	dns_zone_detach(&zone);
 	if (sizeof(msg) <= isc_buffer_availablelength(text))
 		isc_buffer_putmem(text, msg, sizeof(msg));

 	return (ISC_R_SUCCESS);
-}	
+}

 /*
 * Act on a "refresh" command from the command channel.
@@ -4046,17 +4221,17 @@ ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 			isc_buffer_putmem(text, msg1, sizeof(msg1));
 		return (ISC_R_SUCCESS);
 	}
-		
+
 	dns_zone_detach(&zone);
 	if (sizeof(msg2) <= isc_buffer_availablelength(text))
 		isc_buffer_putmem(text, msg2, sizeof(msg2));
 	return (ISC_R_FAILURE);
-}	
+}

 isc_result_t
 ns_server_togglequerylog(ns_server_t *server) {
 	server->log_queries = server->log_queries ? ISC_FALSE : ISC_TRUE;
-	
+
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 		      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "query logging is now %s",
@@ -4160,15 +4335,15 @@ ns_server_dumpstats(ns_server_t *server) {

 	CHECKMF(isc_stdio_open(server->statsfile, "a", &fp),
 		"could not open statistics dump file", server->statsfile);
-	
+
 	ncounters = DNS_STATS_NCOUNTERS;
 	fprintf(fp, "+++ Statistics Dump +++ (%lu)\n", (unsigned long)now);
-	
+
 	for (i = 0; i < ncounters; i++)
 		fprintf(fp, "%s %" ISC_PRINT_QUADFORMAT "u\n",
 			dns_statscounter_names[i],
 			server->querystats[i]);
-	
+
 	zone = NULL;
 	for (result = dns_zone_first(server->zonemgr, &zone);
 	     result == ISC_R_SUCCESS;
@@ -4179,7 +4354,7 @@ ns_server_dumpstats(ns_server_t *server) {
 			char zonename[DNS_NAME_FORMATSIZE];
 			dns_view_t *view;
 			char *viewname;
-			
+
 			dns_name_format(dns_zone_getorigin(zone),
 					zonename, sizeof(zonename));
 			view = dns_zone_getview(zone);
@@ -4199,7 +4374,7 @@ ns_server_dumpstats(ns_server_t *server) {
 	if (result == ISC_R_NOMORE)
 		result = ISC_R_SUCCESS;
 	CHECK(result);
-	
+
 	fprintf(fp, "--- Statistics Dump --- (%lu)\n", (unsigned long)now);

 cleanup:
@@ -4227,7 +4402,7 @@ static isc_result_t
 add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
 	struct viewlistentry *vle;
 	isc_result_t result = ISC_R_SUCCESS;
-	
+
 	/*
 	 * Prevent duplicate views.
 	 */
@@ -4290,7 +4465,7 @@ dumpdone(void *arg, isc_result_t result) {
 	struct dumpcontext *dctx = arg;
 	char buf[1024+32];
 	const dns_master_style_t *style;
-	
+
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 	if (dctx->mdctx != NULL)
@@ -4447,7 +4622,7 @@ ns_server_dumpdb(ns_server_t *server, char *args) {
 		dctx->dumpzones = ISC_TRUE;
 		dctx->dumpcache = ISC_FALSE;
 		ptr = next_token(&args, " \t");
-	} 
+	}

 nextview:
 	for (view = ISC_LIST_HEAD(server->viewlist);
@@ -4567,7 +4742,7 @@ ns_server_validation(ns_server_t *server, char *args) {
 	else
 		result = ISC_R_FAILURE;
 out:
-	isc_task_endexclusive(server->task);	
+	isc_task_endexclusive(server->task);
 	return (result);
 }

@@ -4575,7 +4750,8 @@ isc_result_t
 ns_server_flushcache(ns_server_t *server, char *args) {
 	char *ptr, *viewname;
 	dns_view_t *view;
-	isc_boolean_t flushed = ISC_FALSE;
+	isc_boolean_t flushed;
+	isc_boolean_t found;
 	isc_result_t result;

 	/* Skip the command name. */
@@ -4588,23 +4764,28 @@ ns_server_flushcache(ns_server_t *server, char *args) {

 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	flushed = ISC_TRUE;
+	found = ISC_FALSE;
 	for (view = ISC_LIST_HEAD(server->viewlist);
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
 		if (viewname != NULL && strcasecmp(viewname, view->name) != 0)
 			continue;
+		found = ISC_TRUE;
 		result = dns_view_flushcache(view);
 		if (result != ISC_R_SUCCESS)
-			goto out;
-		flushed = ISC_TRUE;
+			flushed = ISC_FALSE;
 	}
-	if (flushed)
+	if (flushed && found) {
 		result = ISC_R_SUCCESS;
-	else
-		result = ISC_R_FAILURE;
- out:
-	isc_task_endexclusive(server->task);	
+	} else {
+		if (!found)
+			result = ISC_R_NOTFOUND;
+		else
+			result = ISC_R_FAILURE;
+	}
+	isc_task_endexclusive(server->task);
 	return (result);
 }

@@ -4612,7 +4793,8 @@ isc_result_t
 ns_server_flushname(ns_server_t *server, char *args) {
 	char *ptr, *target, *viewname;
 	dns_view_t *view;
-	isc_boolean_t flushed = ISC_FALSE;
+	isc_boolean_t flushed;
+	isc_boolean_t found;
 	isc_result_t result;
 	isc_buffer_t b;
 	dns_fixedname_t fixed;
@@ -4642,21 +4824,25 @@ ns_server_flushname(ns_server_t *server, char *args) {
 	result = isc_task_beginexclusive(server->task);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	flushed = ISC_TRUE;
+	found = ISC_FALSE;
 	for (view = ISC_LIST_HEAD(server->viewlist);
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
 		if (viewname != NULL && strcasecmp(viewname, view->name) != 0)
 			continue;
+		found = ISC_TRUE;
 		result = dns_view_flushname(view, name);
 		if (result != ISC_R_SUCCESS)
 			flushed = ISC_FALSE;
 	}
-	if (flushed)
+	if (flushed && found)
 		result = ISC_R_SUCCESS;
+	else if (!found)
+		result = ISC_R_NOTFOUND;
 	else
 		result = ISC_R_FAILURE;
-	isc_task_endexclusive(server->task);	
+	isc_task_endexclusive(server->task);
 	return (result);
 }

@@ -4708,7 +4894,7 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {
 	char *journal;
 	const char *vname, *sep;
 	isc_boolean_t frozen;
-	
+
 	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -4716,7 +4902,7 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {
 		result = isc_task_beginexclusive(server->task);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		tresult = ISC_R_SUCCESS;
-	        for (view = ISC_LIST_HEAD(server->viewlist);
+		for (view = ISC_LIST_HEAD(server->viewlist);
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link)) {
 			result = dns_view_freezezones(view, freeze);
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: os.h,v 1.22.18.3 2005/04/29 00:15:39 marka Exp $ */
+/* $Id: os.h,v 1.22.18.5 2008/10/24 01:43:17 tbox Exp $ */

 #ifndef NS_OS_H
 #define NS_OS_H 1
@@ -45,12 +45,14 @@ ns_os_inituserinfo(const char *username);
 void
 ns_os_changeuser(void);

+void
+ns_os_adjustnofile(void);
+
 void
 ns_os_minprivs(void);

 void
 ns_os_writepidfile(const char *filename, isc_boolean_t first_time);
-
 void
 ns_os_shutdown(void);

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: os.c,v 1.66.18.11 2006/02/03 23:51:38 marka Exp $ */
+/* $Id: os.c,v 1.66.18.17 2008/10/24 01:43:17 tbox Exp $ */

 /*! \file */

@@ -42,6 +42,7 @@
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/print.h>
+#include <isc/resource.h>
 #include <isc/result.h>
 #include <isc/strerror.h>
 #include <isc/string.h>
@@ -116,6 +117,16 @@ static int dfd[2] = { -1, -1 };
 static isc_boolean_t non_root = ISC_FALSE;
 static isc_boolean_t non_root_caps = ISC_FALSE;

+#if defined(HAVE_CAPSET)
+#undef _POSIX_SOURCE
+#ifdef HAVE_SYS_CAPABILITY_H
+#include <sys/capability.h>
+#else
+#include <linux/capability.h>
+int capset(cap_user_header_t hdrp, const cap_user_data_t datap);
+#endif
+#include <sys/prctl.h>
+#else
 /*%
 * We define _LINUX_FS_H to prevent it from being included.  We don't need
 * anything from it, and the files it includes cause warnings with 2.2
@@ -148,6 +159,7 @@ static isc_boolean_t non_root_caps = ISC_FALSE;
 #endif
 #define SYS_capset __NR_capset
 #endif
+#endif

 static void
 linux_setcaps(unsigned int caps) {
@@ -165,13 +177,23 @@ linux_setcaps(unsigned int caps) {
 	cap.effective = caps;
 	cap.permitted = caps;
 	cap.inheritable = 0;
-	if (syscall(SYS_capset, &caphead, &cap) < 0) {
+#ifdef HAVE_CAPSET
+	if (capset(&caphead, &cap) < 0 ) {
 		isc__strerror(errno, strbuf, sizeof(strbuf));
 		ns_main_earlyfatal("capset failed: %s:"
 				   " please ensure that the capset kernel"
 				   " module is loaded.  see insmod(8)",
 				   strbuf);
 	}
+#else
+	if (syscall(SYS_capset, &caphead, &cap) < 0) {
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		ns_main_earlyfatal("syscall(capset) failed: %s:"
+				   " please ensure that the capset kernel"
+				   " module is loaded.  see insmod(8)",
+				   strbuf);
+	}
+#endif
 }

 static void
@@ -326,7 +348,7 @@ ns_os_daemonize(void) {
 		/*
 		 * Wait for the child to finish loading for the first time.
 		 * This would be so much simpler if fork() worked once we
-	         * were multi-threaded.
+		 * were multi-threaded.
 		 */
 		(void)close(dfd[1]);
 		do {
@@ -496,15 +518,37 @@ ns_os_changeuser(void) {
 		ns_main_earlyfatal("setuid(): %s", strbuf);
 	}

-#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
-	linux_minprivs();
-#endif
 #if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)
 	/*
 	 * Restore the ability of named to drop core after the setuid()
 	 * call has disabled it.
 	 */
-	prctl(PR_SET_DUMPABLE,1,0,0,0);
+	if (prctl(PR_SET_DUMPABLE,1,0,0,0) < 0) {
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		ns_main_earlywarning("prctl(PR_SET_DUMPABLE) failed: %s",
+				     strbuf);
+	}
+#endif
+#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
+	linux_minprivs();
+#endif
+}
+
+void
+ns_os_adjustnofile() {
+#ifdef HAVE_LINUXTHREADS
+	isc_result_t result;
+	isc_resourcevalue_t newvalue;
+
+	/*
+	 * Linux: max number of open files specified by one thread doesn't seem
+	 * to apply to other threads on Linux.
+	 */
+	newvalue = ISC_RESOURCE_UNLIMITED;
+
+	result = isc_resource_setlimit(isc_resource_openfiles, newvalue);
+	if (result != ISC_R_SUCCESS)
+		ns_main_earlywarning("couldn't adjust limit on open files");
 #endif
 }

@@ -665,7 +709,7 @@ ns_os_shutdownmsg(char *command, isc_buffer_t *text) {
 	ptr = next_token(&input, " \t");
 	if (ptr == NULL)
 		return;
-	
+
 	if (strcmp(ptr, "-p") != 0)
 		return;

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: update.c,v 1.109.18.19 2006/03/06 01:38:00 marka Exp $ */
+/* $Id: update.c,v 1.109.18.27 2008/02/07 03:16:08 marka Exp $ */

 #include <config.h>

@@ -114,7 +114,7 @@
 		}						\
 		update_log(client, zone, LOGLEVEL_PROTOCOL,   	\
 			      "update %s: %s (%s)", _what,	\
-		      	      msg, isc_result_totext(result));	\
+			      msg, isc_result_totext(result));	\
 		if (result != ISC_R_SUCCESS) goto failure;	\
 	} while (0)

@@ -403,7 +403,7 @@ foreach_node_rr_action(void *data, dns_rdataset_t *rdataset) {
 	     result = dns_rdataset_next(rdataset))
 	{
 		rr_t rr = { 0, DNS_RDATA_INIT };
-		
+
 		dns_rdataset_current(rdataset, &rr.rdata);
 		rr.ttl = rdataset->ttl;
 		result = (*ctx->rr_action)(ctx->rr_action_data, &rr);
@@ -843,10 +843,14 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
 		/* A new unique name begins here. */
 		node = NULL;
 		result = dns_db_findnode(db, name, ISC_FALSE, &node);
-		if (result == ISC_R_NOTFOUND)
+		if (result == ISC_R_NOTFOUND) {
+			dns_diff_clear(&trash);
 			return (DNS_R_NXRRSET);
-		if (result != ISC_R_SUCCESS)
+		}
+		if (result != ISC_R_SUCCESS) {
+			dns_diff_clear(&trash);
 			return (result);
+		}

 		/* A new unique type begins here. */
 		while (t != NULL && dns_name_equal(&t->name, name)) {
@@ -854,7 +858,7 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
 			dns_rdataset_t rdataset;
 			dns_diff_t d_rrs; /* Database RRs with
 						this name and type */
- 			dns_diff_t u_rrs; /* Update RRs with
+			dns_diff_t u_rrs; /* Update RRs with
 						this name and type */

 			*typep = type = t->rdata.type;
@@ -874,6 +878,7 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,
 						     &rdataset, NULL);
 			if (result != ISC_R_SUCCESS) {
 				dns_db_detachnode(db, &node);
+				dns_diff_clear(&trash);
 				return (DNS_R_NXRRSET);
 			}

@@ -1119,7 +1124,7 @@ typedef struct {

 static isc_result_t
 add_rr_prepare_action(void *data, rr_t *rr) {
-	isc_result_t result = ISC_R_SUCCESS;	
+	isc_result_t result = ISC_R_SUCCESS;
 	add_rr_prepare_ctx_t *ctx = data;
 	dns_difftuple_t *tuple = NULL;
 	isc_boolean_t equal;
@@ -1647,10 +1652,11 @@ ksk_sanity(dns_db_t *db, dns_dbversion_t *ver) {
 * Add RRSIG records for an RRset, recording the change in "diff".
 */
 static isc_result_t
-add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
-	 dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys,
-	 unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception,
-	 isc_stdtime_t expire, isc_boolean_t check_ksk)
+add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
+	 dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type,
+	 dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys,
+	 isc_mem_t *mctx, isc_stdtime_t inception, isc_stdtime_t expire,
+	 isc_boolean_t check_ksk)
 {
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
@@ -1659,6 +1665,7 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	isc_buffer_t buffer;
 	unsigned char data[1024]; /* XXX */
 	unsigned int i;
+	isc_boolean_t added_sig = ISC_FALSE;

 	dns_rdataset_init(&rdataset);
 	isc_buffer_init(&buffer, data, sizeof(data));
@@ -1671,11 +1678,14 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	dns_db_detachnode(db, &node);

 	for (i = 0; i < nkeys; i++) {
-		
+
 		if (check_ksk && type != dns_rdatatype_dnskey &&
 		    (dst_key_flags(keys[i]) & DNS_KEYFLAG_KSK) != 0)
 			continue;
-		
+
+		if (!dst_key_isprivate(keys[i]))
+			continue;
+
 		/* Calculate the signature, creating a RRSIG RDATA. */
 		CHECK(dns_dnssec_sign(name, &rdataset, keys[i],
 				      &inception, &expire,
@@ -1686,6 +1696,13 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 		CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADD, name,
 				    rdataset.ttl, &sig_rdata));
 		dns_rdata_reset(&sig_rdata);
+		added_sig = ISC_TRUE;
+	}
+	if (!added_sig) {
+		update_log(client, zone, ISC_LOG_ERROR,
+			   "found no private keys, "
+			   "unable to generate any signatures");
+		result = ISC_R_NOTFOUND;
 	}

 failure:
@@ -1767,7 +1784,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node));
 	dns_rdataset_init(&rdataset);
 	CHECK(dns_db_findrdataset(db, node, newver, dns_rdatatype_soa, 0,
-                                  (isc_stdtime_t) 0, &rdataset, NULL));
+				  (isc_stdtime_t) 0, &rdataset, NULL));
 	CHECK(dns_rdataset_first(&rdataset));
 	dns_rdataset_current(&rdataset, &rdata);
 	CHECK(dns_rdata_tostruct(&rdata, &soa, NULL));
@@ -1817,9 +1834,9 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 			 */
 			CHECK(rrset_exists(db, newver, name, type, 0, &flag));
 			if (flag) {
-				CHECK(add_sigs(db, newver, name, type,
-					       &sig_diff, zone_keys, nkeys,
-					       client->mctx, inception,
+				CHECK(add_sigs(client, zone, db, newver, name,
+					       type, &sig_diff, zone_keys,
+					       nkeys, client->mctx, inception,
 					       expire, check_ksk));
 			}
 		skip:
@@ -2003,10 +2020,10 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 					dns_rdatatype_rrsig, dns_rdatatype_nsec,
 					NULL, &sig_diff));
 		} else if (t->op == DNS_DIFFOP_ADD) {
-			CHECK(add_sigs(db, newver, &t->name, dns_rdatatype_nsec,
-				       &sig_diff, zone_keys, nkeys,
-				       client->mctx, inception, expire,
-				       check_ksk));
+			CHECK(add_sigs(client, zone, db, newver, &t->name,
+				       dns_rdatatype_nsec, &sig_diff,
+				       zone_keys, nkeys, client->mctx,
+				       inception, expire, check_ksk));
 		} else {
 			INSIST(0);
 		}
@@ -2186,7 +2203,7 @@ remove_orphaned_ds(dns_db_t *db, dns_dbversion_t *newver, dns_diff_t *diff) {
 	for (t = ISC_LIST_HEAD(diff->tuples);
 	     t != NULL;
 	     t = ISC_LIST_NEXT(t, link)) {
-		if (t->op != DNS_DIFFOP_DEL ||
+		if (t->op != DNS_DIFFOP_ADD ||
 		    t->rdata.type != dns_rdatatype_ns)
 			continue;
 		CHECK(rrset_exists(db, newver, &t->name, dns_rdatatype_ns, 0,
@@ -2237,7 +2254,7 @@ check_mx(ns_client_t *client, dns_zone_t *zone,
 	for (t = ISC_LIST_HEAD(diff->tuples);
 	     t != NULL;
 	     t = ISC_LIST_NEXT(t, link)) {
-		if (t->op != DNS_DIFFOP_DEL ||
+		if (t->op != DNS_DIFFOP_ADD ||
 		    t->rdata.type != dns_rdatatype_mx)
 			continue;

@@ -2271,7 +2288,7 @@ check_mx(ns_client_t *client, dns_zone_t *zone,
 				   ownerbuf, namebuf,
 				   dns_result_totext(DNS_R_MXISADDRESS));
 		}
-		
+
 		/*
 		 * Check zone integrity checks.
 		 */
@@ -2471,7 +2488,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	else if (client->signer == NULL)
 		CHECK(checkupdateacl(client, NULL, "update", zonename,
 				     ISC_FALSE));
-	
+
 	if (dns_zone_getupdatedisabled(zone))
 		FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled");

@@ -2878,7 +2895,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	 * The reason for failure should have been logged at this point.
 	 */
 	if (ver != NULL) {
-		update_log(client, zone, LOGLEVEL_DEBUG, 
+		update_log(client, zone, LOGLEVEL_DEBUG,
 			   "rolling back");
 		dns_db_closeversion(db, &ver, ISC_FALSE);
 	}
@@ -2930,7 +2947,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {

 static void
 forward_fail(isc_task_t *task, isc_event_t *event) {
-        ns_client_t *client = (ns_client_t *)event->ev_arg;
+	ns_client_t *client = (ns_client_t *)event->ev_arg;

 	UNUSED(task);

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: os.h,v 1.9.18.1 2004/09/29 06:43:54 marka Exp $ */
+/* $Id: os.h,v 1.9.18.3 2008/10/24 01:43:17 tbox Exp $ */

 #ifndef NS_OS_H
 #define NS_OS_H 1
@@ -43,6 +43,9 @@ ns_os_inituserinfo(const char *username);
 void
 ns_os_changeuser(void);

+void
+ns_os_adjustnofile(void);
+
 void
 ns_os_minprivs(void);

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: os.c,v 1.20.18.4 2005/06/22 22:05:43 marka Exp $ */
+/* $Id: os.c,v 1.20.18.8 2008/10/24 01:28:08 marka Exp $ */

 #include <config.h>
 #include <stdarg.h>
@@ -51,7 +51,7 @@ static int devnullfd = -1;

 static BOOL Initialized = FALSE;

-static char *version_error = 
+static char *version_error =
 	"named requires Windows 2000 Service Pack 2 or later to run correctly";

 void
@@ -83,7 +83,7 @@ version_check(const char *progname) {
 	if(isc_win32os_versioncheck(5, 0, 2, 0) < 0)
 		if (ntservice_isservice())
 			NTReportError(progname, version_error);
-		else 
+		else
 			fprintf(stderr, "%s\n", version_error);
 }

@@ -103,7 +103,16 @@ void
 ns_os_init(const char *progname) {
 	ns_paths_init();
 	setup_syslog(progname);
-	ntservice_init();
+	/*
+	 * XXXMPA. We may need to split ntservice_init() in two and
+	 * just mark as running in ns_os_started().  If we do that
+	 * this is where the first part of ntservice_init() should be
+	 * called from.
+	 *
+	 * XXX970 Remove comment if no problems by 9.7.0.
+	 *
+	 * ntservice_init();
+	 */
 	version_check(progname);
 }

@@ -156,6 +165,10 @@ void
 ns_os_changeuser(void) {
 }

+void
+ns_os_adjustnofile(void) {
+}
+
 void
 ns_os_minprivs(void) {
 }
@@ -285,4 +298,5 @@ ns_os_tzset(void) {

 void
 ns_os_started(void) {
+	ntservice_init();
 }
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2002  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: Makefile.in,v 1.22.18.1 2004/07/20 07:03:20 marka Exp $
+# $Id: Makefile.in,v 1.22.18.3 2008/08/29 23:46:16 tbox Exp $

 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -55,7 +55,7 @@ UOBJS =

 SRCS =		nsupdate.c

-MANPAGES =	nsupdate.8
+MANPAGES =	nsupdate.1

 HTMLPAGES =	nsupdate.html

@@ -76,8 +76,8 @@ clean distclean::

 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
+	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1

 install:: nsupdate@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} nsupdate@EXEEXT@ ${DESTDIR}${bindir}
-	${INSTALL_DATA} ${srcdir}/nsupdate.8 ${DESTDIR}${mandir}/man8
+	${INSTALL_DATA} ${srcdir}/nsupdate.1 ${DESTDIR}${mandir}/man1
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: nsupdate.8,v 1.30.18.12 2006/12/17 04:54:15 marka Exp $
+.\" $Id: nsupdate.1,v 1.1.4.2 2008/09/01 02:29:00 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -24,7 +24,7 @@
 .\"    Manual: BIND9
 .\"    Source: BIND9
 .\"
-.TH "NSUPDATE" "8" "Jun 30, 2000" "BIND9" "BIND9"
+.TH "NSUPDATE" "1" "Jun 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -55,7 +55,7 @@ operate in debug mode. This provides tracing information about the update reques
 .PP
 Transaction signatures can be used to authenticate the Dynamic DNS updates. These use the TSIG resource record type described in RFC2845 or the SIG(0) record described in RFC3535 and RFC2931. TSIG relies on a shared secret that should only be known to
 \fBnsupdate\fR
-and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC\-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. For instance suitable
+and the name server. Currently, the only supported encryption algorithm for TSIG is HMAC\-MD5, which is defined in RFC 2104. Once other algorithms are defined for TSIG, applications will need to ensure they select the appropriate algorithm as well as the key when authenticating each other. For instance, suitable
 \fBkey\fR
 and
 \fBserver\fR
@@ -106,15 +106,15 @@ use a TCP connection. This may be preferable when a batch of update requests is
 .PP
 The
 \fB\-t\fR
-option sets the maximum time a update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout.
+option sets the maximum time an update request can take before it is aborted. The default is 300 seconds. Zero can be used to disable the timeout.
 .PP
 The
 \fB\-u\fR
-option sets the UDP retry interval. The default is 3 seconds. If zero the interval will be computed from the timeout interval and number of UDP retries.
+option sets the UDP retry interval. The default is 3 seconds. If zero, the interval will be computed from the timeout interval and number of UDP retries.
 .PP
 The
 \fB\-r\fR
-option sets the number of UDP retries. The default is 3. If zero only one update request will be made.
+option sets the number of UDP retries. The default is 3. If zero, only one update request will be made.
 .SH "INPUT FORMAT"
 .PP
 \fBnsupdate\fR
@@ -164,13 +164,13 @@ will attempt determine the correct zone to update based on the rest of the input
 .RS 4
 Specify the default class. If no
 \fIclass\fR
-is specified the default class is
+is specified, the default class is
 \fIIN\fR.
 .RE
 .PP
 \fBkey\fR {name} {secret}
 .RS 4
-Specifies that all updates are to be TSIG signed using the
+Specifies that all updates are to be TSIG\-signed using the
 \fIkeyname\fR
 \fIkeysecret\fR
 pair. The
@@ -293,9 +293,9 @@ zone. Notice that the input in each example contains a trailing blank line so th
 .PP
 Any A records for
 \fBoldhost.example.com\fR
-are deleted. and an A record for
+are deleted. And an A record for
 \fBnewhost.example.com\fR
-it IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds)
+with IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds).
 .sp
 .RS 4
 .nf
@@ -342,7 +342,7 @@ base\-64 encoding of HMAC\-MD5 key created by
 .PP
 The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2006 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: nsupdate.c,v 1.130.18.15 2006/12/07 05:39:45 marka Exp $ */
+/* $Id: nsupdate.c,v 1.130.18.22 2008/01/17 23:45:58 tbox Exp $ */

 /*! \file */

@@ -311,7 +311,7 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len) {

 	strncpy(buf, hmacstr, len);
 	buf[len] = 0;
-	
+
 	if (strcasecmp(buf, "hmac-md5") == 0) {
 		*hmac = DNS_TSIG_HMACMD5_NAME;
 	} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
@@ -1155,7 +1155,7 @@ evaluate_key(char *cmdline) {
 	secret = isc_mem_allocate(mctx, secretlen);
 	if (secret == NULL)
 		fatal("out of memory");
-	
+
 	isc_buffer_init(&secretbuf, secret, secretlen);
 	result = isc_base64_decodestring(secretstr, &secretbuf);
 	if (result != ISC_R_SUCCESS) {
@@ -1222,8 +1222,8 @@ evaluate_class(char *cmdline) {
 	}

 	r.base = word;
-        r.length = strlen(word);
-        result = dns_rdataclass_fromtext(&rdclass, &r);
+	r.length = strlen(word);
+	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not parse class name: %s\n", word);
 		return (STATUS_SYNTAX);
@@ -1407,8 +1407,7 @@ update_addordelete(char *cmdline, isc_boolean_t isdelete) {
 failure:
 	if (name != NULL)
 		dns_message_puttempname(updatemsg, &name);
-	if (rdata != NULL)
-		dns_message_puttemprdata(updatemsg, &rdata);
+	dns_message_puttemprdata(updatemsg, &rdata);
 	return (STATUS_SYNTAX);
 }

@@ -1480,7 +1479,7 @@ show_message(dns_message_t *msg) {
 	setzone(userzone);

 	bufsz = INITTEXT;
-	do { 
+	do {
 		if (bufsz > MAXTEXT) {
 			fprintf(stderr, "could not allocate large enough "
 				"buffer to display message\n");
@@ -1565,8 +1564,11 @@ user_interaction(void) {
 	isc_uint16_t result = STATUS_MORE;

 	ddebug("user_interaction()");
-	while ((result == STATUS_MORE) || (result == STATUS_SYNTAX))
+	while ((result == STATUS_MORE) || (result == STATUS_SYNTAX)) {
 		result = get_next_command();
+		if (!interactive && result == STATUS_SYNTAX)
+			fatal("syntax error");
+	}
 	if (result == STATUS_SEND)
 		return (ISC_TRUE);
 	return (ISC_FALSE);
@@ -1659,7 +1661,7 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 			char buf[64];
 			isc_buffer_t b;
 			dns_rdataset_t *rds;
-			
+
 			isc_buffer_init(&b, buf, sizeof(buf) - 1);
 			result = dns_rcode_totext(answer->rcode, &b);
 			check_result(result, "dns_rcode_totext");
@@ -1675,7 +1677,7 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 		int bufsz;

 		bufsz = INITTEXT;
-		do { 
+		do {
 			if (bufsz > MAXTEXT) {
 				fprintf(stderr, "could not allocate large "
 					"enough buffer to display message\n");
@@ -1763,7 +1765,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	ddebug("recvsoa()");

 	requests--;
-	
+
 	REQUIRE(event->ev_type == DNS_EVENT_REQUESTDONE);
 	reqev = (dns_requestevent_t *)event;
 	request = reqev->request;
@@ -1880,7 +1882,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		section = DNS_SECTION_ANSWER;
 	else if (pass == 1)
 		section = DNS_SECTION_AUTHORITY;
-	else 
+	else
 		goto droplabel;

 	result = dns_message_firstname(rcvmsg, section);
@@ -1909,7 +1911,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 				break;
 			}
 		}
-				
+
 		result = dns_message_nextname(rcvmsg, section);
 	}

@@ -1974,7 +1976,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	dns_message_destroy(&rcvmsg);
 	ddebug("Out of recvsoa");
 	return;
- 
+
 droplabel:
 	result = dns_message_firstname(soaquery, DNS_SECTION_QUESTION);
 	INSIST(result == ISC_R_SUCCESS);
@@ -2063,6 +2065,10 @@ start_update(void) {
 			result = dns_message_firstname(updatemsg, section);
 		}
 		if (result != ISC_R_SUCCESS) {
+			dns_message_puttempname(soaquery, &name);
+			dns_rdataset_disassociate(rdataset);
+			dns_message_puttemprdataset(soaquery, &rdataset);
+			dns_message_destroy(&soaquery);
 			done_update();
 			return;
 		}
@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,14 +18,14 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: nsupdate.docbook,v 1.18.18.6 2006/12/16 01:15:13 sra Exp $ -->
+<!-- $Id: nsupdate.docbook,v 1.18.18.12 2008/08/29 23:46:16 tbox Exp $ -->
 <refentry>
  <refentryinfo>
    <date>Jun 30, 2000</date>
  </refentryinfo>
  <refmeta>
    <refentrytitle>nsupdate</refentrytitle>
-    <manvolnum>8</manvolnum>
+    <manvolnum>1</manvolnum>
    <refmiscinfo>BIND9</refmiscinfo>
  </refmeta>
  <refnamediv>
@@ -38,6 +38,8 @@
      <year>2004</year>
      <year>2005</year>
      <year>2006</year>
+      <year>2007</year>
+      <year>2008</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -111,7 +113,7 @@
      Once other algorithms are defined for TSIG, applications will need to
      ensure they select the appropriate algorithm as well as the key when
      authenticating each other.
-      For instance suitable
+      For instance, suitable
      <type>key</type>
      and
      <type>server</type>
@@ -169,7 +171,7 @@
      This may be preferable when a batch of update requests is made.
    </para>
    <para>
-      The <option>-t</option> option sets the maximum time a update request
+      The <option>-t</option> option sets the maximum time an update request
      can
      take before it is aborted.  The default is 300 seconds.  Zero can be
      used
@@ -178,14 +180,14 @@
    <para>
      The <option>-u</option> option sets the UDP retry interval.  The default
      is
-      3 seconds.  If zero the interval will be computed from the timeout
+      3 seconds.  If zero, the interval will be computed from the timeout
      interval
      and number of UDP retries.
    </para>
    <para>
      The <option>-r</option> option sets the number of UDP retries. The
      default is
-      3.  If zero only one update request will be made.
+      3.  If zero, only one update request will be made.
    </para>
  </refsect1>

@@ -296,7 +298,7 @@
          <listitem>
            <para>
              Specify the default class.
-              If no <parameter>class</parameter> is specified the
+              If no <parameter>class</parameter> is specified, the
              default class is
              <parameter>IN</parameter>.
            </para>
@@ -311,7 +313,7 @@
            </term>
          <listitem>
            <para>
-              Specifies that all updates are to be TSIG signed using the
+              Specifies that all updates are to be TSIG-signed using the
              <parameter>keyname</parameter> <parameter>keysecret</parameter> pair.
              The <command>key</command> command
              overrides any key specified on the command line via
@@ -542,10 +544,10 @@
      Any A records for
      <type>oldhost.example.com</type>
      are deleted.
-      and an A record for
+      And an A record for
      <type>newhost.example.com</type>
-      it IP address 172.16.1.1 is added.
-      The newly-added record has a 1 day TTL (86400 seconds)
+      with IP address 172.16.1.1 is added.
+      The newly-added record has a 1 day TTL (86400 seconds).
      <programlisting>
 # nsupdate
 &gt; prereq nxdomain nickname.example.com
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: nsupdate.html,v 1.14.18.19 2006/12/17 04:54:15 marka Exp $ -->
+<!-- $Id: nsupdate.html,v 1.14.18.23 2008/09/01 02:29:00 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -22,7 +22,7 @@
 <meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2476419"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>nsupdate &#8212; Dynamic DNS update utility</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">nsupdate</code>  [<code class="option">-d</code>] [[<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-v</code>] [filename]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543604"></a><h2>DESCRIPTION</h2>
+<a name="id2543420"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">nsupdate</strong></span>
      is used to submit Dynamic DNS Update requests as defined in RFC2136
      to a name server.
@@ -77,7 +77,7 @@
      Once other algorithms are defined for TSIG, applications will need to
      ensure they select the appropriate algorithm as well as the key when
      authenticating each other.
-      For instance suitable
+      For instance, suitable
      <span class="type">key</span>
      and
      <span class="type">server</span>
@@ -133,7 +133,7 @@
      This may be preferable when a batch of update requests is made.
    </p>
 <p>
-      The <code class="option">-t</code> option sets the maximum time a update request
+      The <code class="option">-t</code> option sets the maximum time an update request
      can
      take before it is aborted.  The default is 300 seconds.  Zero can be
      used
@@ -142,18 +142,18 @@
 <p>
      The <code class="option">-u</code> option sets the UDP retry interval.  The default
      is
-      3 seconds.  If zero the interval will be computed from the timeout
+      3 seconds.  If zero, the interval will be computed from the timeout
      interval
      and number of UDP retries.
    </p>
 <p>
      The <code class="option">-r</code> option sets the number of UDP retries. The
      default is
-      3.  If zero only one update request will be made.
+      3.  If zero, only one update request will be made.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543764"></a><h2>INPUT FORMAT</h2>
+<a name="id2543649"></a><h2>INPUT FORMAT</h2>
 <p><span><strong class="command">nsupdate</strong></span>
      reads input from
      <em class="parameter"><code>filename</code></em>
@@ -242,7 +242,7 @@
            </span></dt>
 <dd><p>
              Specify the default class.
-              If no <em class="parameter"><code>class</code></em> is specified the
+              If no <em class="parameter"><code>class</code></em> is specified, the
              default class is
              <em class="parameter"><code>IN</code></em>.
            </p></dd>
@@ -252,7 +252,7 @@
               {secret}
            </span></dt>
 <dd><p>
-              Specifies that all updates are to be TSIG signed using the
+              Specifies that all updates are to be TSIG-signed using the
              <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>keysecret</code></em> pair.
              The <span><strong class="command">key</strong></span> command
              overrides any key specified on the command line via
@@ -402,7 +402,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544768"></a><h2>EXAMPLES</h2>
+<a name="id2544446"></a><h2>EXAMPLES</h2>
 <p>
      The examples below show how
      <span><strong class="command">nsupdate</strong></span>
@@ -428,10 +428,10 @@
      Any A records for
      <span class="type">oldhost.example.com</span>
      are deleted.
-      and an A record for
+      And an A record for
      <span class="type">newhost.example.com</span>
-      it IP address 172.16.1.1 is added.
-      The newly-added record has a 1 day TTL (86400 seconds)
+      with IP address 172.16.1.1 is added.
+      The newly-added record has a 1 day TTL (86400 seconds).
      </p>
 <pre class="programlisting">
 # nsupdate
@@ -456,7 +456,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544811"></a><h2>FILES</h2>
+<a name="id2544490"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
 <dd><p>
@@ -475,7 +475,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545017"></a><h2>SEE ALSO</h2>
+<a name="id2544560"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">RFC2136</span></span>,
      <span class="citerefentry"><span class="refentrytitle">RFC3007</span></span>,
      <span class="citerefentry"><span class="refentrytitle">RFC2104</span></span>,
@@ -488,7 +488,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545088"></a><h2>BUGS</h2>
+<a name="id2542172"></a><h2>BUGS</h2>
 <p>
      The TSIG key is redundantly stored in two separate files.
      This is a consequence of nsupdate using the DST library
@@ -1,7 +1,7 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2002  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: Makefile.in,v 1.40.18.1 2004/07/20 07:03:20 marka Exp $
+# $Id: Makefile.in,v 1.40.18.4 2007/08/28 07:20:01 tbox Exp $

 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -47,6 +47,8 @@ RNDCDEPLIBS =	${ISCCFGDEPLIBS} ${ISCCCDEPLIBS} ${BIND9DEPLIBS} ${DNSDEPLIBS} ${I
 CONFLIBS =	${DNSLIBS} ${ISCLIBS} @LIBS@
 CONFDEPLIBS =	${DNSDEPLIBS} ${ISCDEPLIBS}

+SRCS=		rndc.c rndc-confgen.c
+
 SUBDIRS =	unix

 TARGETS =	rndc@EXEEXT@ rndc-confgen@EXEEXT@
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: rndc-confgen.8,v 1.9.18.10 2006/12/12 01:44:28 marka Exp $
+.\" $Id: rndc-confgen.8,v 1.9.18.11 2007/01/30 00:23:44 marka Exp $
 .\"
 .hy 0
 .ad l
@@ -205,7 +205,7 @@ BIND 9 Administrator Reference Manual.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2001, 2003 Internet Software Consortium.
 .br
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001, 2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: rndc-confgen.c,v 1.18.18.3 2005/04/29 00:15:40 marka Exp $ */
+/* $Id: rndc-confgen.c,v 1.18.18.5 2008/10/15 23:46:06 tbox Exp $ */

 /*! \file */

@@ -62,7 +62,7 @@
 #define DEFAULT_PORT		953

 static char program[256];
-char *progname;
+const char *progname;

 isc_boolean_t verbose = ISC_FALSE;

@@ -148,7 +148,7 @@ main(int argc, char **argv) {
 	isc_boolean_t keyonly = ISC_FALSE;
 	int len;

- 	keydef = keyfile = RNDC_KEYFILE;
+	keydef = keyfile = RNDC_KEYFILE;

 	result = isc_file_progname(*argv, program, sizeof(program));
 	if (result != ISC_R_SUCCESS)
@@ -286,7 +286,7 @@ main(int argc, char **argv) {
 				fatal("isc_mem_get(%d) failed\n", len);
 			snprintf(buf, len, "%s%s%s", chrootdir,
 				 (*keyfile != '/') ? "/" : "", keyfile);
-			
+
 			write_key_file(buf, user, keyname, &key_txtbuffer);
 			isc_mem_put(mctx, buf, len);
 		}
@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2001, 2003  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: rndc-confgen.docbook,v 1.6.18.4 2005/07/19 05:55:43 marka Exp $ -->
+<!-- $Id: rndc-confgen.docbook,v 1.6.18.7 2007/08/28 07:20:01 tbox Exp $ -->
 <refentry id="man.rndc-confgen">
  <refentryinfo>
    <date>Aug 27, 2001</date>
@@ -39,6 +39,7 @@
    <copyright>
      <year>2004</year>
      <year>2005</year>
+      <year>2007</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2001, 2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: rndc-confgen.html,v 1.8.18.15 2006/12/12 01:44:28 marka Exp $ -->
+<!-- $Id: rndc-confgen.html,v 1.8.18.17 2007/01/30 00:23:44 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc-confgen</code>  [<code class="option">-a</code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543616"></a><h2>DESCRIPTION</h2>
+<a name="id2543429"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc-confgen</strong></span>
      generates configuration files
      for <span><strong class="command">rndc</strong></span>.  It can be used as a
@@ -48,7 +48,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543660"></a><h2>OPTIONS</h2>
+<a name="id2543474"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd>
@@ -155,7 +155,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543974"></a><h2>EXAMPLES</h2>
+<a name="id2543787"></a><h2>EXAMPLES</h2>
 <p>
      To allow <span><strong class="command">rndc</strong></span> to be used with
      no manual configuration, run
@@ -172,7 +172,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544016"></a><h2>SEE ALSO</h2>
+<a name="id2543829"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -180,7 +180,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544054"></a><h2>AUTHOR</h2>
+<a name="id2543867"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: rndc.8,v 1.26.18.11 2006/12/12 01:44:28 marka Exp $
+.\" $Id: rndc.8,v 1.26.18.16 2007/12/14 22:37:16 marka Exp $
 .\"
 .hy 0
 .ad l
@@ -47,8 +47,7 @@ is invoked with no command line options or arguments, it prints a short summary
 communicates with the name server over a TCP connection, sending commands authenticated with digital signatures. In the current versions of
 \fBrndc\fR
 and
-\fBnamed\fR
-named the only supported authentication algorithm is HMAC\-MD5, which uses a shared secret on each end of the connection. This provides TSIG\-style authentication for the command request and the name server's response. All commands sent over the channel must be signed by a key_id known to the server.
+\fBnamed\fR, the only supported authentication algorithm is HMAC\-MD5, which uses a shared secret on each end of the connection. This provides TSIG\-style authentication for the command request and the name server's response. All commands sent over the channel must be signed by a key_id known to the server.
 .PP
 \fBrndc\fR
 reads a configuration file to determine how to contact the name server and decide what algorithm and key it should use.
@@ -85,7 +84,9 @@ does not exist.
 .RS 4
 \fIserver\fR
 is the name or address of the server which matches a server statement in the configuration file for
-\fBrndc\fR. If no server is supplied on the command line, the host named by the default\-server clause in the option statement of the configuration file will be used.
+\fBrndc\fR. If no server is supplied on the command line, the host named by the default\-server clause in the options statement of the
+\fBrndc\fR
+configuration file will be used.
 .RE
 .PP
 \-p \fIport\fR
@@ -100,14 +101,14 @@ instead of BIND 9's default control channel port, 953.
 Enable verbose logging.
 .RE
 .PP
-\-y \fIkeyid\fR
+\-y \fIkey_id\fR
 .RS 4
 Use the key
-\fIkeyid\fR
+\fIkey_id\fR
 from the configuration file.
-\fIkeyid\fR
+\fIkey_id\fR
 must be known by named with the same algorithm and secret string in order for control message validation to succeed. If no
-\fIkeyid\fR
+\fIkey_id\fR
 is specified,
 \fBrndc\fR
 will first look for a key clause in the server statement of the server being used, or if no server statement is present for that host, then the default\-key clause of the options statement. Note that the configuration file contains shared secrets which are used to send authenticated control commands to name servers. It should therefore not have general read or write access.
@@ -132,15 +133,16 @@ Several error messages could be clearer.
 .SH "SEE ALSO"
 .PP
 \fBrndc.conf\fR(5),
+\fBrndc\-confgen\fR(8),
 \fBnamed\fR(8),
-\fBnamed.conf\fR(5)
+\fBnamed.conf\fR(5),
 \fBndc\fR(8),
 BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000, 2001 Internet Software Consortium.
 .br
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: rndc.c,v 1.96.18.17 2006/08/04 03:03:41 marka Exp $ */
+/* $Id: rndc.c,v 1.96.18.21 2008/10/15 03:07:19 marka Exp $ */

 /*! \file */

@@ -61,7 +61,7 @@

 #define SERVERADDRS 10

-char *progname;
+const char *progname;
 isc_boolean_t verbose;

 static const char *admin_conffile;
@@ -93,7 +93,7 @@ static void
 usage(int status) {
 	fprintf(stderr, "\
 Usage: %s [-c config] [-s server] [-p port]\n\
-        [-k key-file ] [-y key] [-V] command\n\
+	[-k key-file ] [-y key] [-V] command\n\
 \n\
 command is one of the following:\n\
 \n\
@@ -106,10 +106,10 @@ command is one of the following:\n\
 		Retransfer a single zone without checking serial number.\n\
  freeze	Suspend updates to all dynamic zones.\n\
  freeze zone [class [view]]\n\
-  		Suspend updates to a dynamic zone.\n\
+		Suspend updates to a dynamic zone.\n\
  thaw		Enable updates to all dynamic zones and reload them.\n\
  thaw zone [class [view]]\n\
-  		Enable updates to a frozen dynamic zone and reload it.\n\
+		Enable updates to a frozen dynamic zone and reload it.\n\
  notify zone [class [view]]\n\
 		Resend NOTIFY messages for the zone.\n\
  reconfig	Reload configuration file and new zones only.\n\
@@ -152,7 +152,7 @@ get_addresses(const char *host, in_port_t port) {
 		result = isc_sockaddr_frompath(&serveraddrs[nserveraddrs],
 					       host);
 		if (result == ISC_R_SUCCESS)
-			nserveraddrs++; 
+			nserveraddrs++;
 	} else {
 		count = SERVERADDRS - nserveraddrs;
 		result = bind9_getaddresses(host, port,
@@ -400,10 +400,10 @@ rndc_startconnect(isc_sockaddr_t *addr, isc_task_t *task) {
 	DO("create socket", isc_socket_create(socketmgr, pf, type, &sock));
 	switch (isc_sockaddr_pf(addr)) {
 	case AF_INET:
-		DO("bind socket", isc_socket_bind(sock, &local4));
+		DO("bind socket", isc_socket_bind(sock, &local4, 0));
 		break;
 	case AF_INET6:
-		DO("bind socket", isc_socket_bind(sock, &local6));
+		DO("bind socket", isc_socket_bind(sock, &local6, 0));
 		break;
 	default:
 		break;
@@ -485,7 +485,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 		(void)cfg_map_get(config, "server", &servers);
 		if (servers != NULL) {
 			for (elt = cfg_list_first(servers);
-			     elt != NULL; 
+			     elt != NULL;
 			     elt = cfg_list_next(elt))
 			{
 				const char *name;
@@ -521,7 +521,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 	else {
 		DO("get config key list", cfg_map_get(config, "key", &keys));
 		for (elt = cfg_list_first(keys);
-		     elt != NULL; 
+		     elt != NULL;
 		     elt = cfg_list_next(elt))
 		{
 			key = cfg_listelt_value(elt);
@@ -599,7 +599,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 					get_addresses(name, (in_port_t) myport);
 				else
 					fprintf(stderr, "too many address: "
-					        "%s: dropped\n", name);
+						"%s: dropped\n", name);
 				continue;
 			}
 			sa = *cfg_obj_assockaddr(address);
@@ -739,7 +739,7 @@ main(int argc, char **argv) {
 		case 'y':
 			keyname = isc_commandline_argument;
 			break;
- 
+
 		case '?':
 			usage(0);
 			break;
@@ -773,7 +773,7 @@ main(int argc, char **argv) {
 	logdest.file.maximum_size = 0;
 	DO("creating log channel",
 	   isc_log_createchannel(logconfig, "stderr",
-		   		 ISC_LOG_TOFILEDESC, ISC_LOG_INFO, &logdest,
+				 ISC_LOG_TOFILEDESC, ISC_LOG_INFO, &logdest,
 				 ISC_LOG_PRINTTAG|ISC_LOG_PRINTLEVEL));
 	DO("enabling log channel", isc_log_usechannel(logconfig, "stderr",
 						      NULL, NULL));
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: rndc.conf.5,v 1.23.18.12 2006/12/12 01:44:28 marka Exp $
+.\" $Id: rndc.conf.5,v 1.23.18.15 2007/05/09 13:35:47 marka Exp $
 .\"
 .hy 0
 .ad l
@@ -88,7 +88,7 @@ keyword, the server statement includes a string which is the hostname or address
 and
 \fBaddresses\fR. The key name must match the name of a key statement in the file. The port number specifies the port to connect to. If an
 \fBaddresses\fR
-clause is supplied these addresses will be used instead of the server name. Each address can take a optional port. If an
+clause is supplied these addresses will be used instead of the server name. Each address can take an optional port. If an
 \fBsource\-address\fR
 or
 \fBsource\-address\-v6\fR
@@ -156,7 +156,7 @@ does not ship with BIND 9 but is available on many systems. See the EXAMPLE sect
      key testkey {
        algorithm	hmac\-md5;
        secret		"R3HI8P6BKw9ZwXwN3VZKuQ==";
-      }
+      };
 .fi
 .RE
 .sp
@@ -178,7 +178,7 @@ To generate a random secret with
 .PP
 A complete
 \fIrndc.conf\fR
-file, including the randomly generated key, will be written to the standard output. Commented out
+file, including the randomly generated key, will be written to the standard output. Commented\-out
 \fBkey\fR
 and
 \fBcontrols\fR
@@ -208,7 +208,7 @@ BIND 9 Administrator Reference Manual.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000, 2001 Internet Software Consortium.
 .br
@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: rndc.conf.docbook,v 1.5.18.7 2005/07/19 05:55:43 marka Exp $ -->
+<!-- $Id: rndc.conf.docbook,v 1.5.18.12 2007/08/28 07:20:01 tbox Exp $ -->
 <refentry id="man.rndc.conf">
  <refentryinfo>
    <date>June 30, 2000</date>
@@ -39,6 +39,7 @@
    <copyright>
      <year>2004</year>
      <year>2005</year>
+      <year>2007</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -110,7 +111,7 @@
      name of a key statement in the file.  The port number
      specifies the port to connect to.  If an <option>addresses</option>
      clause is supplied these addresses will be used instead of
-      the server name.  Each address can take a optional port.
+      the server name.  Each address can take an optional port.
      If an <option>source-address</option> or <option>source-address-v6</option>
      of supplied then these will be used to specify the IPv4 and IPv6
      source addresses respectively.
@@ -174,7 +175,7 @@
      key testkey {
        algorithm	hmac-md5;
        secret		"R3HI8P6BKw9ZwXwN3VZKuQ==";
-      }
+      };
    </programlisting>
    </para>

@@ -201,7 +202,7 @@
      A complete <filename>rndc.conf</filename> file, including
      the
      randomly generated key, will be written to the standard
-      output.  Commented out <option>key</option> and
+      output.  Commented-out <option>key</option> and
      <option>controls</option> statements for
      <filename>named.conf</filename> are also printed.
    </para>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: rndc.conf.html,v 1.6.18.19 2006/12/12 01:44:28 marka Exp $ -->
+<!-- $Id: rndc.conf.html,v 1.6.18.23 2007/05/09 13:35:47 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2542924"></a><h2>DESCRIPTION</h2>
+<a name="id2543352"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">rndc.conf</code> is the configuration file
      for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
      utility.  This file has a similar structure and syntax to
@@ -87,7 +87,7 @@
      name of a key statement in the file.  The port number
      specifies the port to connect to.  If an <code class="option">addresses</code>
      clause is supplied these addresses will be used instead of
-      the server name.  Each address can take a optional port.
+      the server name.  Each address can take an optional port.
      If an <code class="option">source-address</code> or <code class="option">source-address-v6</code>
      of supplied then these will be used to specify the IPv4 and IPv6
      source addresses respectively.
@@ -117,7 +117,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543687"></a><h2>EXAMPLE</h2>
+<a name="id2543500"></a><h2>EXAMPLE</h2>
 <pre class="programlisting">
      options {
        default-server  localhost;
@@ -153,7 +153,7 @@
      key testkey {
        algorithm	hmac-md5;
        secret		"R3HI8P6BKw9ZwXwN3VZKuQ==";
-      }
+      };
    </pre>
 <p>
    </p>
@@ -180,7 +180,7 @@
      A complete <code class="filename">rndc.conf</code> file, including
      the
      randomly generated key, will be written to the standard
-      output.  Commented out <code class="option">key</code> and
+      output.  Commented-out <code class="option">key</code> and
      <code class="option">controls</code> statements for
      <code class="filename">named.conf</code> are also printed.
    </p>
@@ -191,7 +191,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543779"></a><h2>NAME SERVER CONFIGURATION</h2>
+<a name="id2543592"></a><h2>NAME SERVER CONFIGURATION</h2>
 <p>
      The name server must be configured to accept rndc connections and
      to recognize the key specified in the <code class="filename">rndc.conf</code>
@@ -201,7 +201,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543800"></a><h2>SEE ALSO</h2>
+<a name="id2543613"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>,
@@ -209,7 +209,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543838"></a><h2>AUTHOR</h2>
+<a name="id2543652"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,11 +1,11 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001  Internet Software Consortium.
 -
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
 - copyright notice and this permission notice appear in all copies.
 -
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: rndc.docbook,v 1.8.18.6 2005/07/19 05:55:44 marka Exp $ -->
+<!-- $Id: rndc.docbook,v 1.8.18.13 2007/12/14 20:53:58 marka Exp $ -->
 <refentry id="man.rndc">
  <refentryinfo>
    <date>June 30, 2000</date>
@@ -39,6 +39,7 @@
    <copyright>
      <year>2004</year>
      <year>2005</year>
+      <year>2007</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -77,7 +78,7 @@
      communicates with the name server
      over a TCP connection, sending commands authenticated with
      digital signatures.  In the current versions of
-      <command>rndc</command> and <command>named</command> named
+      <command>rndc</command> and <command>named</command>,
      the only supported authentication algorithm is HMAC-MD5,
      which uses a shared secret on each end of the connection.
      This provides TSIG-style authentication for the command
@@ -138,13 +139,12 @@
        <term>-s <replaceable class="parameter">server</replaceable></term>
        <listitem>
          <para><replaceable class="parameter">server</replaceable> is
-            	       the name or address of the server which matches a
+            the name or address of the server which matches a
            server statement in the configuration file for
-            <command>rndc</command>.  If no server is supplied on
-            the
+            <command>rndc</command>.  If no server is supplied on the
            command line, the host named by the default-server clause
-            in the option statement of the configuration file will be
-            used.
+            in the options statement of the <command>rndc</command>
+	    configuration file will be used.
          </para>
        </listitem>
      </varlistentry>
@@ -171,16 +171,16 @@
      </varlistentry>

      <varlistentry>
-        <term>-y <replaceable class="parameter">keyid</replaceable></term>
+        <term>-y <replaceable class="parameter">key_id</replaceable></term>
        <listitem>
          <para>
-            Use the key <replaceable class="parameter">keyid</replaceable>
+            Use the key <replaceable class="parameter">key_id</replaceable>
            from the configuration file.
-            <replaceable class="parameter">keyid</replaceable>
+            <replaceable class="parameter">key_id</replaceable>
            must be
            known by named with the same algorithm and secret string
            in order for control message validation to succeed.
-            If no <replaceable class="parameter">keyid</replaceable>
+            If no <replaceable class="parameter">key_id</replaceable>
            is specified, <command>rndc</command> will first look
            for a key clause in the server statement of the server
            being used, or if no server statement is present for that
@@ -224,12 +224,15 @@
    <para><citerefentry>
        <refentrytitle>rndc.conf</refentrytitle><manvolnum>5</manvolnum>
      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>rndc-confgen</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry>,
      <citerefentry>
        <refentrytitle>named</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
      <citerefentry>
        <refentrytitle>named.conf</refentrytitle><manvolnum>5</manvolnum>
-      </citerefentry>
+      </citerefentry>,
      <citerefentry>
        <refentrytitle>ndc</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: rndc.html,v 1.8.18.17 2006/12/12 01:44:28 marka Exp $ -->
+<!-- $Id: rndc.html,v 1.8.18.23 2007/12/14 22:37:16 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc</code>  [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543600"></a><h2>DESCRIPTION</h2>
+<a name="id2543413"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc</strong></span>
      controls the operation of a name
      server.  It supersedes the <span><strong class="command">ndc</strong></span> utility
@@ -46,7 +46,7 @@
      communicates with the name server
      over a TCP connection, sending commands authenticated with
      digital signatures.  In the current versions of
-      <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span> named
+      <span><strong class="command">rndc</strong></span> and <span><strong class="command">named</strong></span>,
      the only supported authentication algorithm is HMAC-MD5,
      which uses a shared secret on each end of the connection.
      This provides TSIG-style authentication for the command
@@ -61,7 +61,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543635"></a><h2>OPTIONS</h2>
+<a name="id2543448"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
 <dd><p>
@@ -88,13 +88,12 @@
          </p></dd>
 <dt><span class="term">-s <em class="replaceable"><code>server</code></em></span></dt>
 <dd><p><em class="replaceable"><code>server</code></em> is
-            	       the name or address of the server which matches a
+            the name or address of the server which matches a
            server statement in the configuration file for
-            <span><strong class="command">rndc</strong></span>.  If no server is supplied on
-            the
+            <span><strong class="command">rndc</strong></span>.  If no server is supplied on the
            command line, the host named by the default-server clause
-            in the option statement of the configuration file will be
-            used.
+            in the options statement of the <span><strong class="command">rndc</strong></span>
+	    configuration file will be used.
          </p></dd>
 <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
 <dd><p>
@@ -107,15 +106,15 @@
 <dd><p>
            Enable verbose logging.
          </p></dd>
-<dt><span class="term">-y <em class="replaceable"><code>keyid</code></em></span></dt>
+<dt><span class="term">-y <em class="replaceable"><code>key_id</code></em></span></dt>
 <dd><p>
-            Use the key <em class="replaceable"><code>keyid</code></em>
+            Use the key <em class="replaceable"><code>key_id</code></em>
            from the configuration file.
-            <em class="replaceable"><code>keyid</code></em>
+            <em class="replaceable"><code>key_id</code></em>
            must be
            known by named with the same algorithm and secret string
            in order for control message validation to succeed.
-            If no <em class="replaceable"><code>keyid</code></em>
+            If no <em class="replaceable"><code>key_id</code></em>
            is specified, <span><strong class="command">rndc</strong></span> will first look
            for a key clause in the server statement of the server
            being used, or if no server statement is present for that
@@ -134,7 +133,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543838"></a><h2>LIMITATIONS</h2>
+<a name="id2543656"></a><h2>LIMITATIONS</h2>
 <p><span><strong class="command">rndc</strong></span>
      does not yet support all the commands of
      the BIND 8 <span><strong class="command">ndc</strong></span> utility.
@@ -148,16 +147,17 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543865"></a><h2>SEE ALSO</h2>
+<a name="id2543683"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
+      <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>
+      <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
      <span class="citerefentry"><span class="refentrytitle">ndc</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543912"></a><h2>AUTHOR</h2>
+<a name="id2543738"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: compress_test.c,v 1.27.18.4 2006/02/26 23:49:49 marka Exp $ */
+/* $Id: compress_test.c,v 1.27.18.7 2007/08/28 07:20:01 tbox Exp $ */

 /*! \file */

@@ -41,11 +41,6 @@ unsigned char plain[] = "\003yyy\003foo\0\003bar\003yyy\003foo\0\003"
 /*
 * Result concatenate (plain1, plain2, plain2, plain3).
 */
-unsigned char bit1[] = "\101\010b";
-unsigned char bit2[] = "\101\014b\260";
-unsigned char bit3[] = "\101\020b\264";
-unsigned char bit[] = "\101\010b\0\101\014b\260\0\101\014b\260\0\101\020b\264";
-
 int raw = 0;
 int verbose = 0;

@@ -92,25 +87,6 @@ main(int argc, char *argv[]) {
 	     sizeof(plain));
 	test(DNS_COMPRESS_ALL, &name1, &name2, &name3, plain, sizeof(plain));

-	dns_name_init(&name1, NULL);
-	region.base = bit1;
-	region.length = sizeof(bit1);
-	dns_name_fromregion(&name1, &region);
-
-	dns_name_init(&name2, NULL);
-	region.base = bit2;
-	region.length = sizeof(bit2);
-	dns_name_fromregion(&name2, &region);
-
-	dns_name_init(&name3, NULL);
-	region.base = bit3;
-	region.length = sizeof(bit3);
-	dns_name_fromregion(&name3, &region);
-
-	test(DNS_COMPRESS_NONE, &name1, &name2, &name3, bit, sizeof(bit));
-	test(DNS_COMPRESS_GLOBAL14, &name1, &name2, &name3, bit, sizeof(bit));
-	test(DNS_COMPRESS_ALL, &name1, &name2, &name3, bit, sizeof(bit));
-
 	return (0);
 }

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: t_dst.c,v 1.48.18.3 2005/11/30 23:52:53 marka Exp $ */
+/* $Id: t_dst.c,v 1.48.18.5 2008/01/12 23:46:06 tbox Exp $ */

 #include <config.h>

@@ -377,7 +377,7 @@ t1(void) {
 		t_result(T_UNRESOLVED);
 		return;
 	}
-	result = isc_entropy_createfilesource(ectx, "randomfile");
+	isc_result = isc_entropy_createfilesource(ectx, "randomfile");
 	if (isc_result != ISC_R_SUCCESS) {
 		t_info("isc_entropy_create failed %s\n",
 		       isc_result_totext(isc_result));
@@ -876,7 +876,7 @@ t2_vfy(char **av) {
 		       isc_result_totext(isc_result));
 		return(T_UNRESOLVED);
 	}
-	result = isc_entropy_createfilesource(ectx, "randomfile");
+	isc_result = isc_entropy_createfilesource(ectx, "randomfile");
 	if (isc_result != ISC_R_SUCCESS) {
 		t_info("isc_entropy_create failed %s\n",
 		       isc_result_totext(isc_result));
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: journalprint.c,v 1.4.18.5 2006/08/25 05:25:51 marka Exp $ */
+/* $Id: journalprint.c,v 1.4.18.8 2007/08/28 07:20:01 tbox Exp $ */

 /*! \file */
 #include <config.h>
@@ -34,7 +34,7 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;

 	if (argc != 2) {
-		printf("usage: %s journal", argv[0]);
+		printf("usage: %s journal\n", argv[0]);
 		return(1);
 	}

@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2003  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: t_names.c,v 1.36.18.5 2006/12/07 23:57:58 marka Exp $ */
+/* $Id: t_names.c,v 1.36.18.8 2008/01/17 23:45:58 tbox Exp $ */

 #include <config.h>

@@ -209,6 +209,7 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
 		else if (('A' <= c) && (c <= 'Z'))
 			val = c - 'A'+ 10;
 		else {
+			(void)fclose(fp);
 			t_info("Bad format in datafile\n");
 			return (0);
 		}
@@ -222,6 +223,7 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
 				/*
 				 * Buffer too small.
 				 */
+				(void)fclose(fp);
 				t_info("Buffer overflow error\n");
 				return (0);
 			}
@@ -579,7 +581,7 @@ t_dns_name_isabsolute(void) {
 				 * label, bitpos, expected value.
 				 */
 				result = test_dns_name_isabsolute(Tokens[0],
-							        atoi(Tokens[1])
+								atoi(Tokens[1])
 								  == 0 ?
 								  ISC_FALSE :
 								  ISC_TRUE);
@@ -1364,7 +1366,7 @@ t_dns_name_getlabel(void) {
 				 */
 				result = test_dns_name_getlabel(Tokens[0],
 							      atoi(Tokens[1]),
-							           Tokens[2],
+								   Tokens[2],
 							      atoi(Tokens[3]));
 			} else {
 				t_info("bad format at line %d\n", line);
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: sig0_test.c,v 1.11.18.2 2005/03/17 03:57:08 marka Exp $ */
+/* $Id: sig0_test.c,v 1.11.18.4 2008/07/22 23:46:04 tbox Exp $ */

 #include <config.h>

@@ -189,7 +189,7 @@ buildquery(void) {

 	isc_buffer_usedregion(&qbuffer, &r);
 	isc_sockaddr_any(&sa);
-	result = isc_socket_bind(s, &sa);
+	result = isc_socket_bind(s, &sa, 0);
 	CHECK("isc_socket_bind", result);
 	result = isc_socket_sendto(s, &r, task1, senddone, NULL, &address,
 				   NULL);
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2008  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2001  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: sock_test.c,v 1.49.18.1 2004/08/28 06:17:30 marka Exp $ */
+/* $Id: sock_test.c,v 1.49.18.4 2008/07/23 23:33:02 marka Exp $ */

 #include <config.h>

@@ -321,7 +321,7 @@ main(int argc, char *argv[]) {
 	}
 	RUNTIME_CHECK(isc_socket_create(socketmgr, pf, isc_sockettype_tcp,
 					&so1) == ISC_R_SUCCESS);
-	result = isc_socket_bind(so1, &sockaddr);
+	result = isc_socket_bind(so1, &sockaddr, ISC_SOCKET_REUSEADDRESS);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	RUNTIME_CHECK(isc_socket_listen(so1, 0) == ISC_R_SUCCESS);

@@ -0,0 +1,25 @@
+#!/bin/sh
+#
+# Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: clean.sh,v 1.3.4.2 2008/01/11 23:45:59 tbox Exp $
+
+#
+# Clean up after zone transfer tests.
+#
+
+rm -f dig.out
+rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl ns2/named.conf
+rm -f */named.memstats
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named1.conf,v 1.2 2008/01/10 01:10:01 marka Exp $ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+	ixfr-from-differences yes;
+	check-integrity no;
+};
+
+include "../../common/controls.conf";
+
+key one {
+        algorithm hmac-md5;
+        secret "1234abcd8765";
+};
+
+key two {
+        algorithm hmac-md5;
+        secret "1234abcd8765";
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "example" {
+	type master;
+	file "example.db";
+};
+
+zone "tsigzone" {
+	type master;
+	file "tsigzone.db";
+        allow-transfer { !key one; any; };
+};
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named2.conf,v 1.2 2008/01/10 01:10:01 marka Exp $ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+	ixfr-from-differences yes;
+	check-integrity no;
+};
+
+include "../../common/controls.conf";
+
+key one {
+        algorithm hmac-md5;
+        secret "1234abcd8765";
+};
+
+key two {
+        algorithm hmac-md5;
+        secret "1234abcd8765";
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "example" {
+	type master;
+	file "example.db";
+};
+
+zone "tsigzone" {
+	type master;
+	file "tsigzone.db";
+        allow-transfer { !10/8; key one; };
+};
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named3.conf,v 1.2 2008/01/10 01:10:01 marka Exp $ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+	ixfr-from-differences yes;
+	check-integrity no;
+};
+
+include "../../common/controls.conf";
+
+key one {
+        algorithm hmac-md5;
+        secret "1234abcd8765";
+};
+
+key two {
+        algorithm hmac-md5;
+        secret "1234abcd8765";
+};
+
+key three {
+        algorithm hmac-md5;
+        secret "1234abcd8765";
+};
+
+acl reject {
+        !key one; !key two; any;
+};
+
+acl accept {
+        10.53.0.1; 10.53.0.2;
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "example" {
+	type master;
+	file "example.db";
+};
+
+zone "tsigzone" {
+	type master;
+	file "tsigzone.db";
+        allow-transfer { !reject; accept; };
+};
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named4.conf,v 1.2 2008/01/10 01:10:01 marka Exp $ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+	ixfr-from-differences yes;
+	check-integrity no;
+};
+
+include "../../common/controls.conf";
+
+key one {
+        algorithm hmac-md5;
+        secret "1234abcd8765";
+};
+
+key two {
+        algorithm hmac-md5;
+        secret "1234abcd8765";
+};
+
+acl rejectkeys {
+        !key one; !key two; any;
+};
+
+acl rejectaddrs {
+        !10.53.0.1; !10.53.0.2; any;
+};
+
+acl check1 { !key one; 10.53.0.1; };
+
+acl check2 { !key two; 10.53.0.2; };
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "example" {
+	type master;
+	file "example.db";
+};
+
+zone "tsigzone" {
+	type master;
+	file "tsigzone.db";
+        allow-transfer { !rejectkeys; !rejectaddrs; !check1; !check2; any; };
+};
@@ -0,0 +1,21 @@
+#!/bin/sh
+#
+# Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: setup.sh,v 1.3.4.2 2008/01/11 23:45:59 tbox Exp $
+
+sh ../genzone.sh 2 3 >ns2/example.db
+sh ../genzone.sh 2 3 >ns2/tsigzone.db
+cp -f ns2/named1.conf ns2/named.conf
@@ -0,0 +1,144 @@
+#!/bin/sh
+#
+# Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: tests.sh,v 1.3.4.3 2008/07/26 19:01:23 jinmei Exp $
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd"
+
+status=0
+t=0
+
+echo "I:testing basic ACL processing"
+# key "one" should fail
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
+
+# any other key should be fine
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
+
+cp -f ns2/named2.conf ns2/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
+sleep 5
+
+# prefix 10/8 should fail
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
+
+# any other address should work, as long as it sends key "one"
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
+
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
+
+echo "I:testing nested ACL processing"
+# all combinations of 10.53.0.{1|2} with key {one|two}, should succeed
+cp -f ns2/named3.conf ns2/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
+sleep 5
+
+# should succeed
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
+
+# should succeed
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
+
+# should succeed
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
+
+# should succeed
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
+
+# but only one or the other should fail
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
+
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.2 axfr -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $tt failed" ; status=1; }
+
+# and other values? right out
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
+
+# now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
+cp -f ns2/named4.conf ns2/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
+sleep 5
+
+# should succeed
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
+
+# should succeed
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
+
+# should fail
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
+
+# should fail
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
+
+# should fail
+t=`expr $t + 1`
+$DIG $DIGOPTS tsigzone. \
+    	@10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 -p 5300 > dig.out
+grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
+
+echo "I:exit status: $status"
+exit $status
@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.4 2004/03/05 04:59:41 marka Exp $ */
+/* $Id: named.conf,v 1.4.18.3 2007/08/28 07:20:01 tbox Exp $ */

 controls { /* empty */ };

@@ -27,6 +27,7 @@ options {
        listen-on { 10.53.0.2; };
        listen-on-v6 { none; };
        recursion yes;
+	acache-enable yes;
 	check-names response warn;
        notify yes;
 };
@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.4 2004/03/05 04:59:45 marka Exp $ */
+/* $Id: named.conf,v 1.4.18.3 2007/08/28 07:20:01 tbox Exp $ */

 controls { /* empty */ };

@@ -27,6 +27,7 @@ options {
        listen-on { 10.53.0.3; };
        listen-on-v6 { none; };
        recursion yes;
+	acache-enable yes;
 	check-names response fail;
        notify yes;
 };
@@ -1,9 +1,9 @@
 #!/bin/sh
 #
-# Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2006, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
-# Permission to use, copy, modify, and distribute this software for any
+# Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
 # copyright notice and this permission notice appear in all copies.
 #
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: conf.sh.in,v 1.27.18.8 2006/03/05 23:58:51 marka Exp $
+# $Id: conf.sh.in,v 1.27.18.10 2008/01/11 23:45:59 tbox Exp $

 #
 # Common configuration data for system tests, to be sourced into
@@ -43,7 +43,7 @@ CHECKCONF=$TOP/bin/check/named-checkconf
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
 # v6synth
-SUBDIRS="cacheclean checkconf checknames dnssec forward glue ixfr limits
+SUBDIRS="acl cacheclean checkconf checknames dnssec forward glue ixfr limits
    lwresd masterfile masterformat notify nsupdate resolver rrsetorder
    sortlist stub tkey unknown upforwd views xfer xferquota zonechecks"

@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.2.2.4 2006/03/10 00:23:20 marka Exp $ */
+/* $Id: named.conf,v 1.2.2.7 2007/08/28 07:20:02 tbox Exp $ */

 /*
 * Choose a keyname that is unlikely to clash with any real key names.
@@ -56,6 +56,7 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
+	acache-enable yes;
 	notify yes;
 	dnssec-enable yes;
 	dnssec-validation yes;
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.22.18.3 2006/03/10 00:23:20 marka Exp $ */
+/* $Id: named.conf,v 1.22.18.6 2007/08/28 07:20:02 tbox Exp $ */

 // NS4

@@ -30,6 +30,7 @@ options {
 	listen-on { 10.53.0.4; };
 	listen-on-v6 { none; };
 	recursion yes;
+	acache-enable yes;
 	dnssec-enable yes;
 	dnssec-validation yes;
 	dnssec-must-be-secure mustbesecure.example yes;
@@ -1,8 +1,8 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.20.18.2 2006/03/10 00:23:20 marka Exp $ */
+/* $Id: named.conf,v 1.20.18.5 2007/08/28 07:20:02 tbox Exp $ */

 // NS5

@@ -30,6 +30,7 @@ options {
 	listen-on { 10.53.0.5; };
 	listen-on-v6 { none; };
 	recursion yes;
+	acache-enable yes;
 	dnssec-enable yes;
 	dnssec-validation yes;
 };
--- a/Show More
+++ b/Show More