fixed an exploitable hang bug

3383. [security] A certain combination of records in the RBT could cause named to hang while populating the additional section of a response. [RT #31090]
use binary mode for raw/fast
2012-09-26 17:27:57 -07:00 · 2012-09-12 17:45:31 +10:00 · 2012-09-12 15:30:50 +10:00 · 2012-09-12 13:56:52 +10:00 · 2012-09-12 12:04:58 +10:00 · 2012-08-24 17:01:22 +10:00
222 changed files with 11292 additions and 2593 deletions
@@ -1,3 +1,87 @@
+	--- 9.6-ESV-R8 released ---
+
+3383.	[security]	A certain combination of records in the RBT could
+                        cause named to hang while populating the additional
+                        section of a response. [RT #31090]
+
+3373.	[bug]		win32: open raw files in binary mode. [RT #30944]
+
+3364.	[security]	Named could die on specially crafted record.
+			[RT #30416]
+
+	--- 9.6-ESV-R8rc1 released ---
+
+3369.	[bug]		nsupdate terminated unexpectedly in interactive mode
+			if built with readline support. [RT #29550]
+
+3368.	[bug]		<dns/iptable.h> and <dns/zone.h> were not C++ safe.
+
+3366.	[bug]		Fixed Read-After-Write dependency violation for IA64
+			atomic operations. [RT #25181]
+
+3365.	[bug]		Removed spurious newlines from log messages in
+			zone.c [RT #30675]
+
+3362.	[bug]		Setting some option values to 0 in named.conf
+			could trigger an assertion failure on startup.
+			[RT #27730]
+
+3360.	[bug]		'host -w' could die.  [RT #18723]
+
+3359.	[bug]		An improperly-formed TSIG secret could cause a
+			memory leak. [RT #30607]
+
+3358.	[bug]		Fix declaration of fatal in bin/named/server.c
+			and bin/nsupdate/main.c. [RT #30522]
+
+3357.	[port]		Add support for libxml2-2.8.x [RT #30440]
+
+	--- 9.6-ESV-R8b1 released ---
+
+3354.	[func]		Improve OpenSSL error logging. [RT #29932]
+
+3352.	[bug]		Ensure that learned server attributes timeout of the
+			adb cache. [RT #29856]
+
+3350.	[bug]		Memory read overrun in isc___mem_reallocate if
+			ISC_MEM_DEBUGCTX memory debugging flag is set.
+			[RT #30240]
+
+3348.	[bug]		Prevent RRSIG data from being cached if a negative
+			record matching the covering type exists at a higher
+			trust level. Such data already can't be retrieved from
+			the cache since change 3218 -- this prevents it
+			being inserted into the cache as well. [RT #26809]
+
+3346.	[security]	Bad-cache data could be used before it was
+			initialized, causing an assert. [RT #30025]
+
+3343.	[bug]		Relax isc_random_jitter() REQUIRE tests. [RT #29821]
+
+3342.	[bug]		Change #3314 broke saving of stub zones to disk
+			resulting in excessive cpu usage in some cases.
+			[RT #29952]
+
+3337.	[bug]		Change #3294 broke support for the multiple keys
+			in controls. [RT #29694]
+
+3335.	[func]		nslookup: return a nonzero exit code when unable
+			to get an answer. [RT #29492]
+
+3332.	[bug]		Re-use cached DS rrsets if possible. [RT #29446]
+
+3331.	[security]	dns_rdataslab_fromrdataset could produce bad
+			rdataslabs. [RT #29644]
+
+3329.	[bug]		Handle RRSIG signer-name case consistently: We
+			generate RRSIG records with the signer-name in
+			lower case.  We accept them with any case, but if
+			they fail to validate, we try again in lower case.
+			[RT #27451]
+
+3328.	[bug]		Fixed inconsistent data checking in dst_parse.c.
+			[RT #29401]
+
 	--- 9.6-ESV-R7 released ---

 3318.	[tuning]	Reduce the amount of work performed while holding a
@@ -1,3 +1,55 @@
+3370.	[bug]		Address use after free while shutting down. [RT #30241]
+
+3368.	[bug]		<dns/iptable.h>, <dns/private.h> and <dns/zone.h>
+			were not C++ safe.
+
+3367.	[bug]		dns_dnsseckey_create() result was not being checked.
+			[RT #30685]
+
+3363.   [bug]           Need to allow "forward" and "fowarders" options
+                        in static-stub zones; this had been overlooked.
+                        [RT #30482]
+ 
+3361.   [bug]           "rndc signing -nsec3param" didn't work correctly
+                        when salt was set to '-' (no salt). [RT #30099]
+
+3355.   [port]          Use more portable awk in verify system test.
+
+3353.   [bug]           Use a single task for task exclusive operations.
+                        [RT #29872]
+
+3351.   [bug]           isc_mem_put and isc_mem_putanddetach didn't report
+                        caller if either ISC_MEM_DEBUGSIZE or ISC_MEM_DEBUGCTX
+                        memory debugging flags are set. [RT #30243]
+
+3349.   [bug]           Change #3345 was incomplete. [RT #30233]
+
+3347.   [bug]           dnssec-settime: Issue a warning when writing a new
+                        private key file would cause a change in the
+                        permissions of the existing file. [RT #27724]
+
+3345.   [bug]           Addressed race condition when removing the last item
+                        or inserting the first item in an ISC_QUEUE.
+                        [RT #29539]
+
+3338.   [bug]           Address race condition in units tests: asyncload_zone
+                        and asyncload_zt. [RT #26100]
+
+3334.   [bug]           Hold a zone table reference while performing a
+                        asyncronous load of a zone. [RT #28326]
+
+3324.   [test]          Add better tests for ADB stats [RT #27057]
+
+3317.   [protocol]      Add ECDSA support (RFC 6605). [RT #21918]
+
+3316.   [tuning]        Improved locking performance when recursing.
+                        [RT #28836]
+
+3315.   [tuning]        Use multiple dispatch objects for sending upstream
+                        queries; this can improve performance on busy
+                        multiprocessor systems by reducing lock contention.
+                        [RT #28605]
+
 3312.	[bug]		named-checkconf didn't detect a bad dns64 clients acl.
 			[RT #27631]

@@ -156,6 +208,9 @@
 			sample external DLZ module in contrib/dlz/example.
 			[RT #26215]

+3174.   [bug]           Always compute to revoked key tag from scratch.
+                        [RT #26186]
+
 3172.	[port]		darwin 10.* and freebsd [89] are now built threaded by
 			default.

@@ -239,6 +294,9 @@
 			instead of in the options statement could trigger
 			an assertion failure in named-checkconf. [RT #24382]

+3101.   [bug]           Zones using automatic key maintenance could fail
+                        to check the key repository for updates. [RT #23744]
+
 3100.	[security]	Certain response policy zone configurations could
 			trigger an INSIST when receiving a query of type
 			RRSIG. [RT #24280]
@@ -496,6 +554,12 @@
 2832.	[bug]		Modify "struct stat" in lib/export/samples/nsprobe.c
 			to avoid redefinition in some OSs [RT 20831]

+2829.   [bug]           Fixed potential node inconsistency in rbtdb.c.
+                        [RT #20808]
+
+2826.   [bug]           NSEC3->NSEC transitions could fail due to a lock not
+                        being released.  [RT #20740]
+
 2824.	[bug]		"rndc sign" was not being run by the correct task.
 			[RT #20759]

@@ -508,6 +572,9 @@
 2816.	[bug]		previous_closest_nsec() could fail to return
 			data for NSEC3 nodes [RT #29730]

+2813.   [bug]           Better handling of unreadable DNSSEC key files.
+                        [RT #20710]
+
 2812.	[bug]		Make sure updates can't result in a zone with
 			NSEC-only keys and NSEC3 records. [RT #20748]

@@ -48,9 +48,14 @@ BIND 9
        For up-to-date release notes and errata, see
        http://www.isc.org/software/bind9/releasenotes

+BIND 9.6-ESV-R8 (Extended Support Version)
+
+        BIND 9.6-ESV-R8 includes several bug fixes and patches security
+        flaws described in CVE-2012-1667, CVE-2012-3817 and CVE-2012-4244.
+
 BIND 9.6-ESV-R7 (Extended Support Version)

-	BIND 9.4-ESV-R7 is a maintenance release, fixing bugs in BIND
+	BIND 9.6-ESV-R7 is a maintenance release, fixing bugs in BIND
 	9.6-ESV-R6.

 BIND 9.6-ESV-R6 (Extended Support Version)
@@ -60,7 +65,7 @@ BIND 9.6-ESV-R6 (Extended Support Version)

 BIND 9.6-ESV-R5 (Extended Support Version)

-	BIND 9.4-ESV-R5 is a maintenance release, fixing bugs in BIND
+	BIND 9.6-ESV-R5 is a maintenance release, fixing bugs in BIND
 	9.6-ESV-R4.

 BIND 9.6.3/BIND 9.6-ESV-R4
@@ -640,6 +640,9 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 {
 	isc_result_t result;
 	FILE *output = stdout;
+	const char *flags;
+
+	flags = (fileformat == dns_masterformat_text) ? "w+" : "wb+";

 	if (debug) {
 		if (filename != NULL && strcmp(filename, "-") != 0)
@@ -650,7 +653,7 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 	}

 	if (filename != NULL && strcmp(filename, "-") != 0) {
-		result = isc_stdio_open(filename, "w+", &output);
+		result = isc_stdio_open(filename, flags, &output);

 		if (result != ISC_R_SUCCESS) {
 			fprintf(stderr, "could not open output "
@@ -57,6 +57,7 @@ static isc_boolean_t in_use = ISC_FALSE;
 static char defclass[MXRD] = "IN";
 static char deftype[MXRD] = "A";
 static isc_event_t *global_event = NULL;
+static int query_error = 1, print_error = 0;

 static char domainopt[DNS_NAME_MAXTEXT];

@@ -406,6 +407,9 @@ isc_result_t
 printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	char servtext[ISC_SOCKADDR_FORMATSIZE];

+	/* I've we've gotten this far, we've reached a server. */
+	query_error = 0;
+
 	debug("printmessage()");

 	isc_sockaddr_format(&query->sockaddr, servtext, sizeof(servtext));
@@ -433,6 +437,9 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		       (msg->rcode != dns_rcode_nxdomain) ? nametext :
 		       query->lookup->textname, rcode_totext(msg->rcode));
 		debug("returning with rcode == 0");
+
+		/* the lookup failed */
+		print_error |= 1;
 		return (ISC_R_SUCCESS);
 	}

@@ -903,5 +910,5 @@ main(int argc, char **argv) {
 	destroy_libs();
 	isc_app_finish();

-	return (0);
+	return (query_error | print_error);
 }
@@ -3520,7 +3520,10 @@ main(int argc, char *argv[]) {
 	check_result(result, "isc_file_mktemplate");

 	fp = NULL;
-	result = isc_file_openunique(tempfile, &fp);
+	if (outputformat == dns_masterformat_text)
+		result = isc_file_openunique(tempfile, &fp);
+	else
+		result = isc_file_bopenunique(tempfile, &fp);
 	if (result != ISC_R_SUCCESS)
 		fatal("failed to open temporary output file: %s",
 		      isc_result_totext(result));
@@ -373,8 +373,10 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		if (result == ISC_R_SUCCESS)
 			break;
 		isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
-		log_invalid(&conn->ccmsg, result);
-		goto cleanup;
+		if (result != ISCCC_R_BADAUTH) {
+			log_invalid(&conn->ccmsg, result);
+			goto cleanup;
+		}
 	}

 	if (key == NULL) {
@@ -1,6 +1,6 @@
 #!/usr/bin/env perl
 #
-# Copyright (C) 2006-2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2006-2008, 2012  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -1025,13 +1025,6 @@ query_isduplicate(ns_client_t *client, dns_name_t *name,
 		mname = NULL;
 	}

-	/*
-	 * If the dns_name_t we're looking up is already in the message,
-	 * we don't want to trigger the caller's name replacement logic.
-	 */
-	if (name == mname)
-		mname = NULL;
-
 	if (mnamep != NULL)
 		*mnamep = mname;

@@ -1230,6 +1223,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 	if (dns_rdataset_isassociated(rdataset) &&
 	    !query_isduplicate(client, fname, type, &mname)) {
 		if (mname != NULL) {
+			INSIST(mname != fname);
 			query_releasename(client, &fname);
 			fname = mname;
 		} else
@@ -1292,11 +1286,13 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 			mname = NULL;
 			if (!query_isduplicate(client, fname,
 					       dns_rdatatype_a, &mname)) {
-				if (mname != NULL) {
-					query_releasename(client, &fname);
-					fname = mname;
-				} else
-					need_addname = ISC_TRUE;
+				if (mname != fname) {
+					if (mname != NULL) {
+						query_releasename(client, &fname);
+						fname = mname;
+					} else
+						need_addname = ISC_TRUE;
+				}
 				ISC_LIST_APPEND(fname->list, rdataset, link);
 				added_something = ISC_TRUE;
 				if (sigrdataset != NULL &&
@@ -1338,11 +1334,13 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 			mname = NULL;
 			if (!query_isduplicate(client, fname,
 					       dns_rdatatype_aaaa, &mname)) {
-				if (mname != NULL) {
-					query_releasename(client, &fname);
-					fname = mname;
-				} else
-					need_addname = ISC_TRUE;
+				if (mname != fname) {
+					if (mname != NULL) {
+						query_releasename(client, &fname);
+						fname = mname;
+					} else
+						need_addname = ISC_TRUE;
+				}
 				ISC_LIST_APPEND(fname->list, rdataset, link);
 				added_something = ISC_TRUE;
 				if (sigrdataset != NULL &&
@@ -1865,22 +1863,24 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 		    crdataset->type == dns_rdatatype_aaaa) {
 			if (!query_isduplicate(client, fname, crdataset->type,
 					       &mname)) {
-				if (mname != NULL) {
-					/*
-					 * A different type of this name is
-					 * already stored in the additional
-					 * section.  We'll reuse the name.
-					 * Note that this should happen at most
-					 * once.  Otherwise, fname->link could
-					 * leak below.
-					 */
-					INSIST(mname0 == NULL);
+				if (mname != fname) {
+					if (mname != NULL) {
+						/*
+						 * A different type of this name is
+						 * already stored in the additional
+						 * section.  We'll reuse the name.
+						 * Note that this should happen at most
+						 * once.  Otherwise, fname->link could
+						 * leak below.
+						 */
+						INSIST(mname0 == NULL);

-					query_releasename(client, &fname);
-					fname = mname;
-					mname0 = mname;
-				} else
-					need_addname = ISC_TRUE;
+						query_releasename(client, &fname);
+						fname = mname;
+						mname0 = mname;
+					} else
+						need_addname = ISC_TRUE;
+				}
 				ISC_LIST_UNLINK(cfname.list, crdataset, link);
 				ISC_LIST_APPEND(fname->list, crdataset, link);
 				added_something = ISC_TRUE;
@@ -228,7 +228,7 @@ static const struct {
 	{ NULL, ISC_FALSE }
 };

-ISC_PLATFORM_NORETURN_POST static void
+ISC_PLATFORM_NORETURN_PRE static void
 fatal(const char *msg, isc_result_t result) ISC_PLATFORM_NORETURN_POST;

 static void
@@ -84,16 +84,19 @@ static const char *nsstats_desc[dns_nsstatscounter_max];
 static const char *resstats_desc[dns_resstatscounter_max];
 static const char *zonestats_desc[dns_zonestatscounter_max];
 static const char *sockstats_desc[isc_sockstatscounter_max];
+static const char *dnssecstats_desc[dns_dnssecstats_max];
 #ifdef HAVE_LIBXML2
 static const char *nsstats_xmldesc[dns_nsstatscounter_max];
 static const char *resstats_xmldesc[dns_resstatscounter_max];
 static const char *zonestats_xmldesc[dns_zonestatscounter_max];
 static const char *sockstats_xmldesc[isc_sockstatscounter_max];
+static const char *dnssecstats_xmldesc[dns_dnssecstats_max];
 #else
 #define nsstats_xmldesc NULL
 #define resstats_xmldesc NULL
 #define zonestats_xmldesc NULL
 #define sockstats_xmldesc NULL
+#define dnssecstats_xmldesc NULL
 #endif	/* HAVE_LIBXML2 */

 #define TRY0(a) do { xmlrc = (a); if (xmlrc < 0) goto error; } while(0)
@@ -107,6 +110,7 @@ static int nsstats_index[dns_nsstatscounter_max];
 static int resstats_index[dns_resstatscounter_max];
 static int zonestats_index[dns_zonestatscounter_max];
 static int sockstats_index[isc_sockstatscounter_max];
+static int dnssecstats_index[dns_dnssecstats_max];

 static inline void
 set_desc(int counter, int maxcounter, const char *fdesc, const char **fdescs,
@@ -408,6 +412,33 @@ init_desc(void) {
 			 "FDwatchRecvErr");
 	INSIST(i == isc_sockstatscounter_max);

+	/* Initialize DNSSEC statistics */
+	for (i = 0; i < dns_dnssecstats_max; i++)
+		dnssecstats_desc[i] = NULL;
+#ifdef  HAVE_LIBXML2
+	for (i = 0; i < dns_dnssecstats_max; i++)
+		dnssecstats_xmldesc[i] = NULL;
+#endif
+
+#define SET_DNSSECSTATDESC(counterid, desc, xmldesc) \
+	do { \
+		set_desc(dns_dnssecstats_ ## counterid, \
+			 dns_dnssecstats_max, \
+			 desc, dnssecstats_desc,\
+			 xmldesc, dnssecstats_xmldesc); \
+		dnssecstats_index[i++] = dns_dnssecstats_ ## counterid; \
+	} while (0)
+
+	i = 0;
+	SET_DNSSECSTATDESC(asis, "dnssec validation success with signer "
+			   "\"as is\"", "DNSSECasis");
+	SET_DNSSECSTATDESC(downcase, "dnssec validation success with signer "
+			   "lower cased", "DNSSECdowncase");
+	SET_DNSSECSTATDESC(wildcard, "dnssec validation of wildcard signature",
+			   "DNSSECwild");
+	SET_DNSSECSTATDESC(fail, "dnssec validation failures", "DNSSECfail");
+	INSIST(i == dns_dnssecstats_max);
+
 	/* Sanity check */
 	for (i = 0; i < dns_nsstatscounter_max; i++)
 		INSIST(nsstats_desc[i] != NULL);
@@ -417,6 +448,8 @@ init_desc(void) {
 		INSIST(zonestats_desc[i] != NULL);
 	for (i = 0; i < isc_sockstatscounter_max; i++)
 		INSIST(sockstats_desc[i] != NULL);
+	for (i = 0; i < dns_dnssecstats_max; i++)
+		INSIST(dnssecstats_desc[i] != NULL);
 #ifdef  HAVE_LIBXML2
 	for (i = 0; i < dns_nsstatscounter_max; i++)
 		INSIST(nsstats_xmldesc[i] != NULL);
@@ -426,6 +459,8 @@ init_desc(void) {
 		INSIST(zonestats_xmldesc[i] != NULL);
 	for (i = 0; i < isc_sockstatscounter_max; i++)
 		INSIST(sockstats_xmldesc[i] != NULL);
+	for (i = 0; i < dns_dnssecstats_max; i++)
+		INSIST(dnssecstats_xmldesc[i] != NULL);
 #endif
 }

@@ -174,7 +174,7 @@ typedef struct nsu_requestinfo {
 static void
 sendrequest(isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr,
 	    dns_message_t *msg, dns_request_t **request);
-ISC_PLATFORM_NORETURN_POST static void
+ISC_PLATFORM_NORETURN_PRE static void
 fatal(const char *format, ...)
 ISC_FORMAT_PRINTF(1, 2) ISC_PLATFORM_NORETURN_POST;

@@ -1011,7 +1011,7 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	isc_buffer_t source;

 	word = nsu_strsep(cmdlinep, " \t\r\n");
-	if (*word == 0) {
+	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read owner name\n");
 		return (STATUS_SYNTAX);
 	}
@@ -1044,6 +1044,11 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 	dns_rdatacallbacks_t callbacks;
 	isc_result_t result;

+	if (cmdline == NULL) {
+		rdata->flags = DNS_RDATA_UPDATE;
+		return (STATUS_MORE);
+	}
+
 	while (*cmdline != 0 && isspace((unsigned char)*cmdline))
 		cmdline++;

@@ -1110,7 +1115,7 @@ make_prereq(char *cmdline, isc_boolean_t ispositive, isc_boolean_t isrrset) {
 	 */
 	if (isrrset) {
 		word = nsu_strsep(&cmdline, " \t\r\n");
-		if (*word == 0) {
+		if (word == NULL || *word == 0) {
 			fprintf(stderr, "could not read class or type\n");
 			goto failure;
 		}
@@ -1126,7 +1131,7 @@ make_prereq(char *cmdline, isc_boolean_t ispositive, isc_boolean_t isrrset) {
 			 * Now read the type.
 			 */
 			word = nsu_strsep(&cmdline, " \t\r\n");
-			if (*word == 0) {
+			if (word == NULL || *word == 0) {
 				fprintf(stderr, "could not read type\n");
 				goto failure;
 			}
@@ -1200,7 +1205,7 @@ evaluate_prereq(char *cmdline) {

 	ddebug("evaluate_prereq()");
 	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0) {
+	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read operation code\n");
 		return (STATUS_SYNTAX);
 	}
@@ -1229,14 +1234,14 @@ evaluate_server(char *cmdline) {
 	long port;

 	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0) {
+	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read server name\n");
 		return (STATUS_SYNTAX);
 	}
 	server = word;

 	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0)
+	if (word == NULL || *word == 0)
 		port = DNSDEFAULTPORT;
 	else {
 		char *endp;
@@ -1270,14 +1275,14 @@ evaluate_local(char *cmdline) {
 	struct in6_addr in6;

 	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0) {
+	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read server name\n");
 		return (STATUS_SYNTAX);
 	}
 	local = word;

 	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0)
+	if (word == NULL || *word == 0)
 		port = 0;
 	else {
 		char *endp;
@@ -1326,7 +1331,7 @@ evaluate_key(char *cmdline) {
 	char *n;

 	namestr = nsu_strsep(&cmdline, " \t\r\n");
-	if (*namestr == 0) {
+	if (namestr == NULL || *namestr == 0) {
 		fprintf(stderr, "could not read key name\n");
 		return (STATUS_SYNTAX);
 	}
@@ -1350,7 +1355,7 @@ evaluate_key(char *cmdline) {
 	}

 	secretstr = nsu_strsep(&cmdline, "\r\n");
-	if (*secretstr == 0) {
+	if (secretstr == NULL || *secretstr == 0) {
 		fprintf(stderr, "could not read key secret\n");
 		return (STATUS_SYNTAX);
 	}
@@ -1391,7 +1396,7 @@ evaluate_zone(char *cmdline) {
 	isc_result_t result;

 	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0) {
+	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read zone name\n");
 		return (STATUS_SYNTAX);
 	}
@@ -1418,7 +1423,7 @@ evaluate_realm(char *cmdline) {
 	char buf[1024];

 	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0) {
+	if (word == NULL || *word == 0) {
 		if (realm != NULL)
 			isc_mem_free(mctx, realm);
 		realm = NULL;
@@ -1443,7 +1448,7 @@ evaluate_ttl(char *cmdline) {
 	isc_uint32_t ttl;

 	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0) {
+	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not ttl\n");
 		return (STATUS_SYNTAX);
 	}
@@ -1477,7 +1482,7 @@ evaluate_class(char *cmdline) {
 	dns_rdataclass_t rdclass;

 	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0) {
+	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read class name\n");
 		return (STATUS_SYNTAX);
 	}
@@ -1535,7 +1540,7 @@ update_addordelete(char *cmdline, isc_boolean_t isdelete) {
 	 * If it's a delete, ignore a TTL if present (for compatibility).
 	 */
 	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0) {
+	if (word == NULL || *word == 0) {
 		if (!isdelete) {
 			fprintf(stderr, "could not read owner ttl\n");
 			goto failure;
@@ -1576,7 +1581,7 @@ update_addordelete(char *cmdline, isc_boolean_t isdelete) {
 	 */
 	word = nsu_strsep(&cmdline, " \t\r\n");
 parseclass:
-	if (*word == 0) {
+	if (word == NULL || *word == 0) {
 		if (isdelete) {
 			rdataclass = dns_rdataclass_any;
 			rdatatype = dns_rdatatype_any;
@@ -1600,7 +1605,7 @@ update_addordelete(char *cmdline, isc_boolean_t isdelete) {
 		 * Now read the type.
 		 */
 		word = nsu_strsep(&cmdline, " \t\r\n");
-		if (*word == 0) {
+		if (word == NULL || *word == 0) {
 			if (isdelete) {
 				rdataclass = dns_rdataclass_any;
 				rdatatype = dns_rdatatype_any;
@@ -1680,7 +1685,7 @@ evaluate_update(char *cmdline) {

 	ddebug("evaluate_update()");
 	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0) {
+	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read operation code\n");
 		return (STATUS_SYNTAX);
 	}
@@ -1770,6 +1775,7 @@ get_next_command(void) {
 	char cmdlinebuf[MAXCMD];
 	char *cmdline;
 	char *word;
+	char *tmp;

 	ddebug("get_next_command()");
 	if (interactive) {
@@ -1781,11 +1787,18 @@ get_next_command(void) {
 	isc_app_unblock();
 	if (cmdline == NULL)
 		return (STATUS_QUIT);
+
+	/*
+	 * Normalize input by removing any eol.
+	 */
+	tmp = cmdline;
+	(void)nsu_strsep(&tmp, "\r\n");
+
 	word = nsu_strsep(&cmdline, " \t\r\n");

 	if (feof(input))
 		return (STATUS_QUIT);
-	if (*word == 0)
+	if (word == NULL || *word == 0)
 		return (STATUS_SEND);
 	if (word[0] == ';')
 		return (STATUS_MORE);
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1999-2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1999-2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -179,7 +179,7 @@ dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx,
 	if (p == NULL) {
 		t_info("getcwd failed %d\n", errno);
 		++*nprobs;
-		return;
+		goto cleanup;
 	}

 	ret = dst_key_fromfile(name1, id1, alg, type, current, mctx, &key1);
@@ -187,7 +187,7 @@ dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx,
 		t_info("dst_key_fromfile(%d) returned: %s\n",
 		       alg, dst_result_totext(ret));
 		++*nfails;
-		return;
+		goto cleanup;
 	}

 	ret = dst_key_fromfile(name2, id2, alg, type, current, mctx, &key2);
@@ -195,7 +195,7 @@ dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx,
 		t_info("dst_key_fromfile(%d) returned: %s\n",
 		       alg, dst_result_totext(ret));
 		++*nfails;
-		return;
+		goto cleanup;
 	}

 	ret = isc_file_mktemplate("/tmp/", tmp, sizeof(tmp));
@@ -203,7 +203,7 @@ dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx,
 		t_info("isc_file_mktemplate failed %s\n",
 		       isc_result_totext(ret));
 		++*nprobs;
-		return;
+		goto cleanup;
 	}

 	ret = isc_dir_createunique(tmp);
@@ -211,7 +211,7 @@ dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx,
 		t_info("isc_dir_createunique failed %s\n",
 		       isc_result_totext(ret));
 		++*nprobs;
-		return;
+		goto cleanup;
 	}

 	ret = dst_key_tofile(key1, type, tmp);
@@ -219,7 +219,7 @@ dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx,
 		t_info("dst_key_tofile(%d) returned: %s\n",
 		       alg, dst_result_totext(ret));
 		++*nfails;
-		return;
+		goto cleanup;
 	}

 	ret = dst_key_tofile(key2, type, tmp);
@@ -227,7 +227,7 @@ dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx,
 		t_info("dst_key_tofile(%d) returned: %s\n",
 		       alg, dst_result_totext(ret));
 		++*nfails;
-		return;
+		goto cleanup;
 	}

 	cleandir(tmp);
@@ -238,7 +238,7 @@ dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx,
 		t_info("dst_computesecret() returned: %s\n",
 		       dst_result_totext(ret));
 		++*nfails;
-		return;
+		goto cleanup;
 	}

 	isc_buffer_init(&b2, array2, sizeof(array2));
@@ -247,7 +247,7 @@ dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx,
 		t_info("dst_computesecret() returned: %s\n",
 		       dst_result_totext(ret));
 		++*nfails;
-		return;
+		goto cleanup;
 	}

 	isc_buffer_usedregion(&b1, &r1);
@@ -256,11 +256,14 @@ dh(dns_name_t *name1, int id1, dns_name_t *name2, int id2, isc_mem_t *mctx,
 	{
 		t_info("computed secrets don't match\n");
 		++*nfails;
-		return;
+		goto cleanup;
 	}

-	dst_key_free(&key1);
-	dst_key_free(&key2);
+ cleanup:
+	if (key1 != NULL)
+		dst_key_free(&key1);
+	if (key2 != NULL)
+		dst_key_free(&key2);
 }

 static void
@@ -330,12 +333,14 @@ generate(int alg, isc_mem_t *mctx, int size, int *nfails) {
 		t_info("dst_key_generate(%d) returned: %s\n", alg,
 		       dst_result_totext(ret));
 		++*nfails;
-		return;
+		goto cleanup;
 	}

 	if (alg != DST_ALG_DH)
 		use(key, mctx, ISC_R_SUCCESS, nfails);
-	dst_key_free(&key);
+ cleanup:
+	if (key != NULL)
+		dst_key_free(&key);
 }

 #define	DBUFSIZ	25
@@ -787,14 +792,20 @@ t2_sigchk(char *datapath, char *sigpath, char *keyname,
 	if (isc_result != ISC_R_SUCCESS) {
 		t_info("dst_context_create returned %s\n",
 			isc_result_totext(isc_result));
+		(void) free(data);
+		dst_key_free(&key);
 		++*nfails;
+		return;
 	}
 	isc_result = dst_context_adddata(ctx, &datareg);
 	if (isc_result != ISC_R_SUCCESS) {
 		t_info("dst_context_adddata returned %s\n",
 			isc_result_totext(isc_result));
+		(void) free(data);
 		dst_context_destroy(&ctx);
+		dst_key_free(&key);
 		++*nfails;
+		return;
 	}
 	isc_result = dst_context_verify(ctx, &sigreg);
 	if (	((exp_res == 0) && (isc_result != ISC_R_SUCCESS))	||
@@ -803,7 +814,6 @@ t2_sigchk(char *datapath, char *sigpath, char *keyname,
 		t_info("dst_context_verify returned %s, expected %s\n",
 			isc_result_totext(isc_result),
 			expected_result);
-		dst_context_destroy(&ctx);
 		++*nfails;
 	}

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -121,20 +121,30 @@ chkdata(unsigned char *buf, size_t buflen, char *exp_data,

 			if (('0' <= *q) && (*q <= '9'))
 				*p = *q - '0';
-			else if (('a' <= *q) && (*q <= 'z'))
+			else if (('a' <= *q) && (*q <= 'f'))
 				*p = *q - 'a' + 10;
-			else if (('A' <= *q) && (*q <= 'Z'))
+			else if (('A' <= *q) && (*q <= 'F'))
 				*p = *q - 'A' + 10;
+			else {
+				t_info("malformed comparison data\n");
+				free(data);
+				return (-1);
+			}
 			++q;

 			*p <<= 4;

 			if (('0' <= *q) && (*q <= '9'))
 				*p |= ((*q - '0') & 0x0f);
-			else if (('a' <= *q) && (*q <= 'z'))
+			else if (('a' <= *q) && (*q <= 'f'))
 				*p |= ((*q - 'a' + 10) & 0x0f);
-			else if (('A' <= *q) && (*q <= 'Z'))
+			else if (('A' <= *q) && (*q <= 'F'))
 				*p |= ((*q - 'A' + 10) & 0x0f);
+			else {
+				t_info("malformed comparison data\n");
+				free(data);
+				return (-1);
+			}
 			++p;
 			++q;
 			++cnt;
@@ -203,9 +213,9 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
 		}
 		if (('0' <= c) && (c <= '9'))
 			val = c - '0';
-		else if (('a' <= c) && (c <= 'z'))
+		else if (('a' <= c) && (c <= 'f'))
 			val = c - 'a' + 10;
-		else if (('A' <= c) && (c <= 'Z'))
+		else if (('A' <= c) && (c <= 'F'))
 			val = c - 'A'+ 10;
 		else {
 			(void)fclose(fp);
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1999-2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2008, 2012  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2008, 2012  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2008, 2012  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* Bad secret */
+key "badtsig" {
+	algorithm hmac-md5;
+	secret "jEdD+BPKg==";
+};
+
@@ -0,0 +1,17 @@
+#!/bin/sh
+#
+# Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+rm -f badzero.conf
@@ -27,11 +27,55 @@ if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 echo "I: checking that named-checkconf handles a known bad config"
-
 ret=1
 $CHECKCONF bad.conf > /dev/null 2>&1 || ret=0
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+echo "I: checking that named-checkconf handles a known bad tsig secret"
+ret=0
+$CHECKCONF badtsig.conf > /dev/null 2>&1
+if [ $? != 1 ]; then echo "I:failed"; ret=1; fi
+status=`expr $status + $ret`
+
+echo "I: range checking fields that do not allow zero"
+ret=0
+for field in max-retry-time min-retry-time max-refresh-time min-refresh-time; do
+    cat > badzero.conf << EOF
+options {
+    $field 0;
+};
+EOF
+    $CHECKCONF badzero.conf > /dev/null 2>&1
+    [ $? -eq 1 ] || { echo "I: options $field failed" ; ret=1; }
+    cat > badzero.conf << EOF
+view dummy {
+    $field 0;
+};
+EOF
+    $CHECKCONF badzero.conf > /dev/null 2>&1
+    [ $? -eq 1 ] || { echo "I: view $field failed" ; ret=1; }
+    cat > badzero.conf << EOF
+options {
+    $field 0;
+};
+view dummy {
+};
+EOF
+    $CHECKCONF badzero.conf > /dev/null 2>&1
+    [ $? -eq 1 ] || { echo "I: options + view $field failed" ; ret=1; }
+    cat > badzero.conf << EOF
+zone dummy {
+    type slave;
+    masters { 0.0.0.0; };
+    $field 0;
+};
+EOF
+    $CHECKCONF badzero.conf > /dev/null 2>&1
+    [ $? -eq 1 ] || { echo "I: zone $field failed" ; ret=1; }
+done
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -46,7 +46,7 @@ CHECKCONF=$TOP/bin/check/named-checkconf
 SUBDIRS="acl allow_query builtin cacheclean checkconf checknames checkzone
 	 database dlv dlz dname dnssec forward glue ixfr
 	 limits logfileconfig lwresd masterfile masterformat notify
-	 nsupdate pending resolver rrsetorder sortlist stub tkey
+	 nsupdate pending resolver rndc rrsetorder sortlist stub tkey
 	 unknown upforwd views xfer xferquota zonechecks"

 # PERL will be an empty string if no perl interpreter was found.
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -44,3 +44,5 @@ rm -f signer/example.db
 rm -f ns2/algroll.db
 rm -f signer/example.db.after signer/example.db.before
 rm -f signer/example.db.changed
+rm -f ns3/lower.example.db ns3/upper.example.db ns3/upper.example.db.lower
+rm -f ns3/secure.below-cname.example.db
@@ -119,3 +119,9 @@ ns.insecure.below-cname	A	10.53.0.3

 secure.below-cname	NS	ns.secure.below-cname
 ns.secure.below-cname	A	10.53.0.3
+
+upper			NS	ns.upper
+ns.upper		A	10.53.0.3
+
+LOWER			NS	NS.LOWER
+NS.LOWER		A	10.53.0.3
@@ -32,7 +32,7 @@ zonefile=example.db

 for subdomain in secure bogus dynamic keyless nsec3 optout nsec3-unknown \
    optout-unknown multiple rsasha256 rsasha512 update-nsec3 \
-    secure.below-cname expired
+    secure.below-cname expired upper lower
 do
 	cp ../ns3/keyset-$subdomain.example. .
 done
@@ -0,0 +1,26 @@
+; Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: lower.example.db.in,v 1.1.2.1 2012/01/17 08:31:00 marka Exp $
+
+$TTL 300	; 5 minutes
+@			IN SOA	MNAME1. . (
+				2012042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+@			NS	NS
+NS			A	10.53.0.3
@@ -188,4 +188,14 @@ zone "secure.below-cname.example" {
 	file "secure.below-cname.example.db.signed";
 };

+zone "upper.example" {
+	type master;
+	file "upper.example.db.signed";
+};
+
+zone "LOWER.EXAMPLE" {
+	type master;
+	file "lower.example.db.signed";
+};
+
 include "trusted.conf";
@@ -283,3 +283,31 @@ zonefile=secure.below-cname.example.db
 keyname=`$KEYGEN -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
 cat $infile $keyname.key >$zonefile
 $SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1
+
+#
+# A zone where the signer's name has been forced to uppercase.
+#
+zone="upper.example."
+infile="upper.example.db.in"
+zonefile="upper.example.db"
+lower="upper.example.db.lower"
+signedfile="upper.example.db.signed"
+kskname=`$KEYGEN -r $RANDFILE -a RSASHA1 -b 1024 $zone`
+zskname=`$KEYGEN -r $RANDFILE -a RSASHA1 -b 1024 -f KSK $zone`
+cat $infile $kskname.key $zskname.key > $zonefile
+$SIGNER -P -r $RANDFILE -o $zone -f $lower $zonefile > /dev/null 2>&1
+$CHECKZONE -D upper.example $lower 2>&- | \
+	sed '/RRSIG/s/ upper.example. / UPPER.EXAMPLE. /' > $signedfile
+
+#
+# Check that the signer's name is in lower case when zone name is in
+# upper case.
+#
+zone="LOWER.EXAMPLE."
+infile="lower.example.db.in"
+zonefile="lower.example.db"
+signedfile="lower.example.db.signed"
+kskname=`$KEYGEN -r $RANDFILE -a RSASHA1 -b 1024 $zone`
+zskname=`$KEYGEN -r $RANDFILE -a RSASHA1 -b 1024 -f KSK $zone`
+cat $infile $kskname.key $zskname.key > $zonefile
+$SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1
@@ -0,0 +1,26 @@
+; Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: upper.example.db.in,v 1.1.2.1 2012/01/17 08:31:00 marka Exp $
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2012042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+@			NS	ns
+ns			A	10.53.0.3
@@ -1129,5 +1129,25 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+echo "I:testing legacy upper case signer name validation ($n)"
+ret=0
+$DIG +tcp +dnssec -p 5300 +noadd +noauth soa upper.example @10.53.0.4 \
+        > dig.out.ns4.test$n 2>&1
+grep 'flags:.* ad;' dig.out.ns4.test$n >/dev/null || ret=1
+grep 'RRSIG.*SOA.* UPPER\.EXAMPLE\. ' dig.out.ns4.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:testing that we lower case signer name ($n)"
+ret=0
+$DIG +tcp +dnssec -p 5300 +noadd +noauth soa LOWER.EXAMPLE @10.53.0.4 \
+        > dig.out.ns4.test$n 2>&1
+grep 'flags:.* ad;' dig.out.ns4.test$n >/dev/null || ret=1
+grep 'RRSIG.*SOA.* lower\.example\. ' dig.out.ns4.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -0,0 +1,15 @@
+server 127.0.0.1
+server 127.0.0.1 port
+update
+update delete
+update delete dummy
+update delete dummy in
+update delete dummy in a
+update delete dummy in a 127.0.0.1
+update add
+update add domain
+update add domain 0
+update add domain 0 in
+update add domain 0 in a
+update add domain 0 a
+update add domain 0 a in
@@ -254,5 +254,28 @@ then
 	echo "I:failed"; status=1
 fi

+n=`expr $n + 1`
+ret=0
+echo "I:check command list ($n)"
+(
+while read cmd 
+do
+    echo "$cmd" | $NSUPDATE  > /dev/null 2>&1
+    if test $? -gt 1 ; then
+	echo "I: failed ($cmd)"
+	ret=1
+    fi
+    echo "$cmd " | $NSUPDATE  > /dev/null 2>&1
+    if test $? -gt 1 ; then
+	echo "I: failed ($cmd)"
+	ret=1
+    fi
+done
+exit $ret
+) < commandlist || ret=1
+if [ $ret -ne 0 ]; then
+    status=1
+fi
+
 echo "I:exit status: $status"
 exit $status
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -25,7 +25,7 @@ rm -f dig.*.foo.*
 rm -f dig.*.bar.*
 rm -f dig.*.prime.*
 rm -f ns4/tld.db
-rm -r ns6/to-be-removed.tld.db ns6/to-be-removed.tld.db.jnl
+rm -f ns6/to-be-removed.tld.db ns6/to-be-removed.tld.db.jnl
 rm -f ns6/K*
 rm -f ns6/example.net.db.signed ns6/example.net.db
 rm -f ns6/keyset-example.net. ns6/dsset-example.net.
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -0,0 +1,21 @@
+#!/bin/sh
+#
+# Copyright (C) 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: clean.sh,v 1.2 2011/03/21 18:06:06 each Exp $
+
+rm -f ns2/*.db ns2/*.jnl
+rm -f ns2/session.key
+rm -f ns2/named.memstats
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named.conf,v 1.4 2011/06/10 01:32:37 each Exp $ */
+
+controls { /* empty */ };
+
+options {
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+        recursion no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-md5;
+};
+
+key secondkey {
+	secret "abcd1234abcd8765";
+	algorithm hmac-md5;
+};
+
+controls {
+	inet 10.53.0.2 port 9953 allow { any; } keys { rndc_key; secondkey; };
+};
+
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "nil" {
+	type master;
+	file "nil.db";
+        ixfr-from-differences yes;
+};
+
+zone "other" {
+	type master;
+	file "other.db";
+};
+
+zone "static" {
+	type master;
+	file "static.db";
+};
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: rndc.conf,v 1.5 2007/06/19 23:47:01 tbox Exp $ */
+
+options {
+        default-key     "secondkey";
+};
+
+key secondkey {
+        secret "abcd1234abcd8765";
+        algorithm hmac-md5;
+};
@@ -0,0 +1,23 @@
+#!/bin/sh
+#
+# Copyright (C) 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: setup.sh,v 1.2 2011/03/21 18:06:06 each Exp $
+
+sh clean.sh
+
+sh ../genzone.sh 2 >ns2/nil.db
+sh ../genzone.sh 2 >ns2/other.db
+sh ../genzone.sh 2 >ns2/static.db
@@ -0,0 +1,39 @@
+#!/bin/sh
+#
+# Copyright (C) 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: tests.sh,v 1.4 2011/06/10 01:32:37 each Exp $
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+RNDCCMD="$RNDC -s 10.53.0.2 -p 9953 -c ../common/rndc.conf"
+
+status=0
+
+echo "I:test using primary key"
+ret=0
+$RNDCCMD status > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:test using second key"
+ret=0
+$RNDC -s 10.53.0.2 -p 9953 -c ns2/secondkey.conf status > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:exit status: $status"
+exit $status
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/usr/bin/perl -w
 #
-# Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -21,14 +21,24 @@ SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

 status=0
+echo "I:check that the stub zone has been saved to disk"
+for i in 1 2 3 4 5 6 7 8 9 20
+do
+	[ -f ns3/child.example.st ] && break
+	sleep 1
+done
+[ -f ns3/child.example.st ] || { status=1;  echo "I:failed"; }

-echo "I:trying an axfr that should be denied (NOTAUTH)"
+for pass in 1 2
+do
+
+echo "I:trying an axfr that should be denied (NOTAUTH) (pass=$pass)"
 ret=0
-$DIG +tcp data.child.example. @10.53.0.3 axfr -p 5300 > dig.out.ns3 || ret=1
+$DIG +tcp child.example. @10.53.0.3 axfr -p 5300 > dig.out.ns3 || ret=1
 grep "; Transfer failed." dig.out.ns3 > /dev/null || ret=1
 [ $ret = 0 ] || { status=1;  echo "I:failed"; }

-echo "I:look for stub zone data without recursion (should not be found)"
+echo "I:look for stub zone data without recursion (should not be found) (pass=$pass)"
 for i in 1 2 3 4 5 6 7 8 9
 do
 	ret=0
@@ -41,11 +51,20 @@ done
 $PERL ../digcomp.pl knowngood.dig.out.norec dig.out.ns3 || ret=1
 [ $ret = 0 ] || { status=1;  echo "I:failed"; }

-echo "I:look for stub zone data with recursion (should be found)"
+echo "I:look for stub zone data with recursion (should be found) (pass=$pass)"
 ret=0
 $DIG +tcp data.child.example. @10.53.0.3 txt -p 5300 > dig.out.ns3 || ret=1
 $PERL ../digcomp.pl knowngood.dig.out.rec dig.out.ns3 || ret=1
 [ $ret = 0 ] || { status=1;  echo "I:failed"; }

+[ $pass = 1 ] && {
+	echo "I:stopping stub server"
+	$PERL $SYSTEMTESTTOP/stop.pl . ns3
+
+	echo "I:re-starting stub server"
+	$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns3
+}
+done
+
 echo "I:exit status: $status"
 exit $status
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2005-2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005-2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -19,3 +19,6 @@

 rm -f dig.out
 rm -f */named.memstats
+rm -f */*.bk
+rm -f */*.bk.*
+rm -f ns3/Kexample.*
@@ -41,6 +41,10 @@ a12		IN	A	\# 4 0A000001

 null		IN	NULL	\# 1 00
 empty		IN	NULL	\# 0
+empty		IN	TYPE124	\# 0
+
+emptyplus	IN	TYPE125 \# 0
+emptyplus	IN	TYPE125 \# 1 11

 txt1		IN	TXT	"hello"
 txt2		CLASS1	TXT	"hello"
@@ -53,3 +57,4 @@ txt7		IN	TXT	\# 6 0568656C6C6F
 unk1			TYPE123	\# 1 00
 unk2		CLASS1	TYPE123	\# 1 00
 unk3		IN	TYPE123	\# 1 00
+$INCLUDE large.db
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named.conf,v 1.11 2007/06/19 23:47:06 tbox Exp $ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify no;
+};
+
+view "in" {
+	zone "example." {
+		type slave;
+		masters { 10.53.0.1; };
+		file "example-in.bk";
+	};
+};
@@ -0,0 +1,17 @@
+# Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: setup.sh,v 1.11 2012/02/23 06:53:15 marka Exp $
+
+sh clean.sh
@@ -22,13 +22,13 @@ SYSTEMTESTTOP=..

 status=0

-DIGOPTS="@10.53.0.1 -p 5300"
+DIGOPTS="-p 5300"

 echo "I:querying for various representations of an IN A record"
 for i in 1 2 3 4 5 6 7 8 9 10 11 12
 do
 	ret=0
-	$DIG +short $DIGOPTS a$i.example a in > dig.out || ret=1
+	$DIG +short $DIGOPTS @10.53.0.1 a$i.example a in > dig.out || ret=1
 	echo 10.0.0.1 | diff - dig.out || ret=1
 	if [ $ret != 0 ]
 	then
@@ -41,7 +41,7 @@ echo "I:querying for various representations of an IN TXT record"
 for i in 1 2 3 4 5 6 7
 do
 	ret=0
-	$DIG +short $DIGOPTS txt$i.example txt in > dig.out || ret=1
+	$DIG +short $DIGOPTS @10.53.0.1 txt$i.example txt in > dig.out || ret=1
 	echo '"hello"' | diff - dig.out || ret=1
 	if [ $ret != 0 ]
 	then
@@ -54,7 +54,7 @@ echo "I:querying for various representations of an IN TYPE123 record"
 for i in 1 2 3
 do
 	ret=0
-	$DIG +short $DIGOPTS unk$i.example type123 in > dig.out || ret=1
+	$DIG +short $DIGOPTS @10.53.0.1 unk$i.example type123 in > dig.out || ret=1
 	echo '\# 1 00' | diff - dig.out || ret=1
 	if [ $ret != 0 ]
 	then
@@ -65,14 +65,14 @@ done

 echo "I:querying for NULL record"
 ret=0
-$DIG +short $DIGOPTS null.example null in > dig.out || ret=1
+$DIG +short $DIGOPTS @10.53.0.1 null.example null in > dig.out || ret=1
 echo '\# 1 00' | diff - dig.out || ret=1
 [ $ret = 0 ] || echo "I: failed"
 status=`expr $status + $ret`

 echo "I:querying for empty NULL record"
 ret=0
-$DIG +short $DIGOPTS empty.example null in > dig.out || ret=1
+$DIG +short $DIGOPTS @10.53.0.1 empty.example null in > dig.out || ret=1
 echo '\# 0' | diff - dig.out || ret=1
 [ $ret = 0 ] || echo "I: failed"
 status=`expr $status + $ret`
@@ -81,7 +81,7 @@ echo "I:querying for various representations of a CLASS10 TYPE1 record"
 for i in 1 2
 do
 	ret=0
-	$DIG +short $DIGOPTS a$i.example a class10 > dig.out || ret=1
+	$DIG +short $DIGOPTS @10.53.0.1 a$i.example a class10 > dig.out || ret=1
 	echo '\# 4 0A000001' | diff - dig.out || ret=1
 	if [ $ret != 0 ]
 	then
@@ -94,7 +94,7 @@ echo "I:querying for various representations of a CLASS10 TXT record"
 for i in 1 2 3 4
 do
 	ret=0
-	$DIG +short $DIGOPTS txt$i.example txt class10 > dig.out || ret=1
+	$DIG +short $DIGOPTS @10.53.0.1 txt$i.example txt class10 > dig.out || ret=1
 	echo '"hello"' | diff - dig.out || ret=1
 	if [ $ret != 0 ]
 	then
@@ -107,7 +107,7 @@ echo "I:querying for various representations of a CLASS10 TYPE123 record"
 for i in 1 2
 do
 	ret=0
-	$DIG +short $DIGOPTS unk$i.example type123 class10 > dig.out || ret=1
+	$DIG +short $DIGOPTS @10.53.0.1 unk$i.example type123 class10 > dig.out || ret=1
 	echo '\# 1 00' | diff - dig.out || ret=1
 	if [ $ret != 0 ]
 	then
@@ -120,7 +120,7 @@ echo "I:querying for SOAs of zone that should have failed to load"
 for i in 1 2 3 4
 do
 	ret=0
-	$DIG $DIGOPTS broken$i. soa in > dig.out || ret=1
+	$DIG $DIGOPTS @10.53.0.1 broken$i. soa in > dig.out || ret=1
 	grep "SERVFAIL" dig.out > /dev/null || ret=1
 	if [ $ret != 0 ]
 	then
@@ -129,5 +129,30 @@ do
 	status=`expr $status + $ret`
 done

+echo "I:checking large unknown record loading on master"
+ret=0
+$DIG $DIGOPTS @10.53.0.1 +tcp +short large.example TYPE45234 > dig.out || { ret=1 ; echo I: dig failed ; }
+diff -s large.out dig.out > /dev/null || { ret=1 ; echo "I: diff failed"; }
+[ $ret = 0 ] || echo "I: failed"
+status=`expr $status + $ret`
+
+echo "I:checking large unknown record loading on slave"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 +tcp +short large.example TYPE45234 > dig.out || { ret=1 ; echo I: dig failed ; }
+diff -s large.out dig.out > /dev/null || { ret=1 ; echo "I: diff failed"; }
+[ $ret = 0 ] || echo "I: failed"
+status=`expr $status + $ret`
+
+echo "I:stop and restart slave"
+$PERL $SYSTEMTESTTOP/stop.pl . ns2
+$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2
+
+echo "I:checking large unknown record loading on slave"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 +tcp +short large.example TYPE45234 > dig.out || { ret=1 ; echo I: dig failed ; }
+diff -s large.out dig.out > /dev/null || { ret=1 ; echo "I: diff failed"; }
+[ $ret = 0 ] || echo "I: failed"
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2005, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/usr/local/bin/perl
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1999-2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -22774,7 +22774,7 @@ case "$use_libxml2" in
 		;;
 	auto|yes)
 		case X`(xml2-config --version) 2>/dev/null` in
-		X2.[67].*)
+		X2.[678].*)
 			libxml2_libs=`xml2-config --libs`
 			libxml2_cflags=`xml2-config --cflags`
 			;;
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1090,7 +1090,7 @@ case "$use_libxml2" in
 		;;
 	auto|yes)
 		case X`(xml2-config --version) 2>/dev/null` in
-		X2.[[67]].*)
+		X2.[[678]].*)
 			libxml2_libs=`xml2-config --libs`
 			libxml2_cflags=`xml2-config --cflags`
 			;;
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -51,11 +51,11 @@ SRCS =		dlzbdb.c
@BIND9_MAKE_RULES@

 dlzbdb.@O@: dlzbdb.c
-	${LIBTOOL} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
+	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} -DVERSION=\"${VERSION}\" \
 		-c ${srcdir}/dlzbdb.c

 dlzbdb: dlzbdb.@O@ ${DEPLIBS}
-	${LIBTOOL} ${PURIFY} ${CC} ${CFLAGS} -o $@ dlzbdb.@O@ ${LIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} -o $@ dlzbdb.@O@ ${LIBS}

 doc man:: ${MANOBJS}

@@ -70,4 +70,4 @@ installdirs:
 #	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8

 install:: dlzbdb installdirs
-	${LIBTOOL} ${INSTALL_PROGRAM} dlzbdb ${DESTDIR}${sbindir}
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} dlzbdb ${DESTDIR}${sbindir}
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Portions Copyright (C) 2004, 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Portions Copyright (C) 2004, 2006, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 # Portions Copyright (C) 1999-2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Evan Hunt	ecc6435be0	fixed an exploitable hang bug 3383. [security] A certain combination of records in the RBT could cause named to hang while populating the additional section of a response. [RT #31090]	2012-09-26 17:27:57 -07:00
Mark Andrews	66d5d96cb6	use binary mode for raw/fast	2012-09-12 17:45:31 +10:00
Mark Andrews	3bf652ab70	turn binary mode on for raw/fast	2012-09-12 15:30:50 +10:00
Mark Andrews	44ebc35a16	O_BINARY -> _O_BINARY	2012-09-12 13:56:52 +10:00
Mark Andrews	36127d1a6c	3373. [bug] win32: open raw files in binary mode. [RT #30944 ]	2012-09-12 12:04:58 +10:00
Mark Andrews	1221ba2fbf	update	2012-08-24 17:01:22 +10:00
Tinderbox User	40f3ae7859	update SRCID	2012-08-24 05:16:58 +00:00
Mark Andrews	c13f4beb43	9.6-ESV-R8	2012-08-24 14:17:25 +10:00
Mark Andrews	b34173241e	update CVE list	2012-08-24 14:11:57 +10:00
Mark Andrews	ff56cee13c	3364. [security] Named could die on specially crafted record. [RT #30416]	2012-08-24 14:10:48 +10:00
Tinderbox User	2bee7bd587	update SRCID	2012-08-23 08:15:58 +00:00
Mark Andrews	702cf023d3	handle doc/arm/*.html	2012-08-23 17:55:29 +10:00
Tinderbox User	145a695fc5	update SRCID	2012-08-23 06:16:04 +00:00
Mark Andrews	77ff7325ad	9.6-ESV-R8rc1	2012-08-23 15:32:45 +10:00
Tinderbox User	9b1fb5da85	update SRCID	2012-08-23 00:15:54 +00:00
Mark Andrews	5c4f03600a	update	2012-08-23 09:59:17 +10:00
Tinderbox User	281b87dc88	update SRCID	2012-08-22 10:15:50 +00:00
Mark Andrews	977d6987ae	change number	2012-08-22 19:24:55 +10:00
Tinderbox User	fd7deb9201	update SRCID	2012-08-22 09:15:40 +00:00
Mark Andrews	58cbd8c4fd	back port parse_rdata fix to handle NULL commandline	2012-08-22 18:38:46 +10:00
Tinderbox User	41ff983eeb	update SRCID	2012-08-22 04:16:02 +00:00
Mark Andrews	a6598d6709	3379. [bug] nsupdate terminated unexpectedly in interactive mode if built with readline support. [RT #29550]	2012-08-22 13:55:39 +10:00
Tinderbox User	6a7dca8e8c	update SRCID	2012-08-22 00:15:44 +00:00
Tinderbox User	4a8fb790b0	update copyright notice	2012-08-21 23:45:12 +00:00
Tinderbox User	1c53153757	newcopyrights	2012-08-21 23:30:03 +00:00
Tinderbox User	433a832300	update SRCID	2012-08-21 19:15:34 +00:00
Evan Hunt	6678d435cc	spelling	2012-08-21 12:08:33 -07:00
Tinderbox User	acba1a78d0	update SRCID	2012-08-21 07:16:09 +00:00
Mark Andrews	19f97857e4	3368. [bug] <dns/iptable.h> and <dns/zone.h> where not C++ safe.	2012-08-21 16:48:32 +10:00
Tinderbox User	fb1c254dd0	update SRCID	2012-08-17 18:15:43 +00:00
ckb	d026886b08	3366. [bug] Fixed Read-After-Write dependency violation for IA64 atomic operations. [RT #25181]	2012-08-17 13:07:11 -05:00
Tinderbox User	9623917ad8	update SRCID	2012-08-17 06:15:57 +00:00
Mark Andrews	734b0a4b9f	clean testdir's as well	2012-08-17 16:06:24 +10:00
Tinderbox User	8bc478c05f	update SRCID	2012-08-17 04:15:56 +00:00
Mark Andrews	02fefa5b52	we didn't catch a zero option at the global level when views are active	2012-08-17 13:56:20 +10:00
Tinderbox User	13e3932260	update SRCID	2012-08-16 22:15:31 +00:00
Mark Andrews	361165650f	silence "t_names.c:130:7: warning: The left expression of the compound assignment is an uninitialized value. The computed value will also be garbage"	2012-08-17 07:21:38 +10:00
Tinderbox User	6cc8b4b8fd	update SRCID	2012-08-16 19:15:42 +00:00
Evan Hunt	ff413dbe66	remove spurious newlines in zone.c logging 3365. [bug] Removed spurious newlines from log messages in zone.c [RT #30675]	2012-08-16 10:50:06 -07:00
Tinderbox User	3782efb7d0	update SRCID	2012-08-16 05:17:04 +00:00
Evan Hunt	44f94b4af2	specify libtool mode in DLZBDB makefile	2012-08-15 21:54:27 -07:00
Tinderbox User	8e6b6115cd	update SRCID	2012-08-15 00:15:41 +00:00
Tinderbox User	3fed8757e9	update copyright notice	2012-08-14 23:45:11 +00:00
Tinderbox User	6929f23913	newcopyrights	2012-08-14 23:30:04 +00:00
Tinderbox User	c9da7da070	update SRCID	2012-08-14 06:15:42 +00:00
Evan Hunt	6202b2ec2a	properly range-check fields that do not allow 0 3362. [bug] Setting some option values to 0 in named.conf could trigger an assertion failure on startup. [RT #27730]	2012-08-13 22:52:29 -07:00
Tinderbox User	cb7e02ba7f	update SRCID	2012-08-14 05:15:44 +00:00
Mark Andrews	112f7c3785	test against unsigned zero	2012-08-14 14:29:47 +10:00
Tinderbox User	136d2fada0	update SRCID	2012-08-14 01:16:00 +00:00
Mark Andrews	054a9cc454	3360. [bug] 'host -w' could die. [RT #18723 ]	2012-08-14 11:11:23 +10:00
Tinderbox User	af724aff4e	update SRCID	2012-08-12 05:16:08 +00:00
Mark Andrews	58ee862835	update	2012-08-12 14:52:40 +10:00
Tinderbox User	2f65d30ad9	update SRCID	2012-08-11 04:16:39 +00:00
Evan Hunt	8dc862fe22	address memory leak with bad tsig secret 3359. [bug] An improperly-formed TSIG secret could cause a memory leak. [RT #30607]	2012-08-10 20:23:57 -07:00
Tinderbox User	ee76b2ef38	update SRCID	2012-08-05 03:15:58 +00:00
Mark Andrews	53d0f8a914	3358 [bug] Fix declaration of fatal in bin/named/server.c and bin/nsupdate/main.c. [RT #30522]	2012-08-05 13:09:07 +10:00
Tinderbox User	c9acb5511f	update SRCID	2012-08-04 15:15:43 +00:00
Mark Andrews	1486f91694	Fix declaration of fatal in bin/named/server.c.	2012-08-05 01:08:27 +10:00
Tinderbox User	0b029832cd	update SRCID	2012-08-02 02:15:41 +00:00
Mar Andrews	dd678452b9	3357. [port] Add support for libxml2-2.8.x [RT #30440 ]	2012-08-02 01:53:20 +00:00
Tinderbox User	61e1d262cd	update SRCID	2012-07-26 06:15:56 +00:00
Evan Hunt	4dfb52131e	Merge branch 'v9_6' of ssh://repo/proj/git/prod/bind9 into v9_6	2012-07-25 22:24:15 -07:00
Evan Hunt	2f16faf485	revert rt26429 due to incompatibilities with 9.6	2012-07-25 22:22:16 -07:00
Tinderbox User	4dd24fbcf1	update SRCID	2012-07-26 05:15:46 +00:00
Mark Andrews	817bceaf01	remove test skipping	2012-07-26 14:49:56 +10:00
Evan Hunt	0953cc2c36	fix merge errors	2012-07-25 21:19:51 -07:00
Tinderbox User	c53306d856	update SRCID	2012-07-26 03:15:59 +00:00
Mark Andrews	9611cd2068	remove conflict marker	2012-07-26 13:11:56 +10:00
Tinderbox User	24c06f4799	update SRCID	2012-07-26 00:15:49 +00:00
Tinderbox User	2615007d77	update copyright notice	2012-07-25 23:45:12 +00:00
Tinderbox User	2c6afd50e8	newcopyrights	2012-07-25 23:30:06 +00:00
Tinderbox User	ccdb39648f	update SRCID	2012-07-25 23:15:41 +00:00
ckb	8d74549a5c	3356. [bug] Cap the TTL of signed RRsets when RRSIGs are approaching their expiry, so they don't remain in caches after expiry. [RT #26429]	2012-07-25 17:38:47 -05:00
Tinderbox User	58d4e6452a	update SRCID	2012-07-24 07:15:35 +00:00
Evan Hunt	779ec9984d	Merge branch 'v9_6' of ssh://repo/proj/git/prod/bind9 into v9_6	2012-07-23 23:31:14 -07:00
Evan Hunt	8181ca0d97	update api	2012-07-23 23:31:00 -07:00
Tinderbox User	bbe6cf8aed	update SRCID	2012-07-24 03:16:04 +00:00
Mark Andrews	d72d9d5858	cleanup unused variables	2012-07-24 12:26:54 +10:00
Tinderbox User	70fcea59c5	update SRCID	2012-07-24 00:15:45 +00:00
Tinderbox User	f69f6d9d65	update copyright notice	2012-07-23 23:45:13 +00:00
Tinderbox User	a8ac2df240	newcopyrights	2012-07-23 23:30:02 +00:00
Tinderbox User	ddf3b86e0b	update SRCID	2012-07-23 21:15:37 +00:00
Evan Hunt	9644984506	update	2012-07-23 13:35:33 -07:00
Tinderbox User	228aed11b2	update SRCID	2012-07-23 20:15:32 +00:00
Evan Hunt	1cac29a57c	fix change note 3348, bug not security	2012-07-23 12:59:48 -07:00
Evan Hunt	7bd0a3c6a2	prep 9.6-ESV-R8b1	2012-07-23 12:58:45 -07:00
Tinderbox User	013e87384b	update SRCID	2012-07-23 07:15:44 +00:00
Mark Andrews	29173e699a	3354. [func] Improve OpenSSL error logging. [RT #29932 ]	2012-07-23 16:30:55 +10:00
Tinderbox User	598a07a616	update SRCID	2012-07-20 05:16:35 +00:00
Tinderbox User	9a3a8f524c	regen v9_6	2012-07-20 04:37:04 +00:00
Tinderbox User	71083d9a1a	sync	2012-07-20 04:34:43 +00:00
Tinderbox User	3eae25e2ef	update SRCID	2012-07-18 05:16:52 +00:00
Mark Andrews	88e814e0e4	3352. [bug] Ensure that learned server attributes timeout of the adb cache. [RT #29856]	2012-07-18 14:20:09 +10:00
Tinderbox User	72f2207fc5	update SRCID	2012-07-18 00:15:43 +00:00
Mark Andrews	6439173dae	3350. [bug] Memory read overrun in isc___mem_reallocate if ISC_MEM_DEBUGCTX memory debugging flag is set. [RT #30240]	2012-07-18 09:54:25 +10:00
Tinderbox User	d92f5ce987	update SRCID	2012-07-09 19:15:34 +00:00
ckb	960012de77	3348. [security] prevent RRSIG data from being cached if a negative record matching the covering type exists at a higher trust level. Such data already can't be retrieved from the cache since change 3218 -- this prevents it being inserted into the cache as well. [RT #26809]	2012-07-09 13:29:42 -05:00
Tinderbox User	484b950181	update SRCID	2012-07-02 17:15:30 +00:00
Evan Hunt	28aae970ea	fix bad-cache assert 3346. [security] Bad-cache data could be used before it was initialized, causing an assert. [RT #30025]	2012-07-02 10:05:20 -07:00
Evan Hunt	bc892cc381	wrong RT number	2012-07-02 09:28:29 -07:00
Tinderbox User	794bd47f6d	update SRCID	2012-06-30 00:15:44 +00:00
Tinderbox User	ae47f254c7	update copyright notice	2012-06-29 23:45:10 +00:00
Tinderbox User	f149d3087f	newcopyrights	2012-06-29 23:30:03 +00:00
Tinderbox User	1ed281f48e	update SRCID	2012-06-29 02:15:43 +00:00
Mark Andrews	77092470f0	lost line	2012-06-29 11:47:30 +10:00
Mark Andrews	0b51f38570	reverse bad copyright update	2012-06-29 11:47:25 +10:00
Tinderbox User	a4da60cb18	update copyright notice	2012-06-29 01:21:32 +00:00
Tinderbox User	95dd83a7bc	update SRCID	2012-06-29 01:15:21 +00:00
Mark Andrews	cbe6d5d7e1	add support for python	2012-06-29 11:06:04 +10:00
Tinderbox User	cbba858415	update SRCID	2012-06-27 00:15:28 +00:00
Mark Andrews	916d7e4d87	3343. [bug] Relax isc_random_jitter() REQUIRE tests. [RT# 19821]	2012-06-27 10:06:44 +10:00
Mark Andrews	eb4ad81ccb	3342. [bug] Change #3314 broke saving of stub zones to disk resulting in excessive cpu usage in some cases. [RT #29952]	2012-06-27 09:45:41 +10:00
Tinderbox User	610e44c0e1	update SRCID	2012-06-25 02:15:32 +00:00
Mark Andrews	abf344768f	silence compiler warning by using offsetof to get structure element offsets	2012-06-25 12:05:14 +10:00
Tinderbox User	aa6802d74b	update SRCID	2012-06-22 00:15:28 +00:00
Tinderbox User	cf77da1598	update copyright notice	2012-06-21 23:45:09 +00:00
Tinderbox User	db54e2dd5c	update SRCID	2012-06-21 06:15:40 +00:00
Evan Hunt	0c0c7ae630	fix secondkey test, properly	2012-06-20 22:48:20 -07:00
Tinderbox User	e1b256f3b7	update SRCID	2012-06-21 05:15:27 +00:00
Mark Andrews	abc4784748	remove rundundent call 'result = isc_parse_uint8(&ui, r.base, 10);'	2012-06-21 14:32:35 +10:00
Tinderbox User	779ceee98a	update SRCID	2012-06-20 22:16:10 +00:00
Evan Hunt	aa3ed1b594	fixed second-key test to use correct rndc.conf	2012-06-20 15:10:01 -07:00
Tinderbox User	adb73a5926	update SRCID	2012-06-15 00:15:59 +00:00
Tinderbox User	981af8798a	update copyright notice	2012-06-14 23:45:08 +00:00
Tinderbox User	eae6301d93	update SRCID	2012-06-14 01:15:27 +00:00
Tinderbox User	1f6c540eb5	Merge branch 'v9_6' of /proj/git/prod/bind9 into v9_6	2012-06-14 01:15:26 +00:00
Tinderbox User	8c99375816	update SRCID	2012-06-14 00:15:28 +00:00
Mark Andrews	d5eb49141a	only use 9.6 features	2012-06-14 10:15:08 +10:00
Mark Andrews	0dce2c6123	update	2012-06-14 09:45:19 +10:00
Mark Andrews	242af366a8	add ./bin/tests/system/rndc/ns2/secondkey.key	2012-06-14 09:42:01 +10:00
Tinderbox User	b0ef27d2d7	update SRCID	2012-06-13 07:15:27 +00:00
Mark Andrews	3024c922ff	3337. [bug] Change #3294 broke support for the multiple keys in controls. [RT #29694]	2012-06-13 16:57:23 +10:00
Tinderbox User	3873426088	update SRCID	2012-06-08 05:16:38 +00:00
Evan Hunt	df79d703ed	nslookup exit with error if unsuccessful 3335. [func] nslookup: return a nonzero exit code when unable to get an answer. [RT #29492]	2012-06-07 22:09:47 -07:00
Tinderbox User	8cd91651ca	update SRCID	2012-06-08 04:15:45 +00:00
Mark Andrews	5af98b88f1	add #	2012-06-08 13:58:45 +10:00
Tinderbox User	26cde354f2	update SRCID	2012-06-07 03:16:05 +00:00
Mark Andrews	11496d8be5	3332. [bug] Re-use cached DS rrsets if possible. [RT 29446]	2012-06-07 13:00:00 +10:00
Tinderbox User	855af5daaa	update SRCID	2012-06-02 05:15:44 +00:00
Mark Andrews	d932ee4853	Merge branch 'v9_6' of repo.isc.org:/proj/git/prod/bind9 into v9_6	2012-06-02 14:55:43 +10:00
Mark Andrews	d1c848f8ca	add missing change note	2012-06-02 14:54:10 +10:00
Tinderbox User	863cda8fd0	update SRCID	2012-06-02 00:15:48 +00:00
Tinderbox User	b40e492c83	update copyright notice	2012-06-01 23:45:12 +00:00
Tinderbox User	718be0d6a2	newcopyrights	2012-06-01 23:42:45 +00:00
Mark Andrews	390bdd73d2	add ./bin/tests/system/unknown/large.out	2012-06-02 09:41:32 +10:00
Tinderbox User	01b8938dcb	update SRCID	2012-06-01 17:15:26 +00:00
Evan Hunt	c149639f1a	security fix 3331. [security] dns_rdataslab_fromrdataset could produce bad rdataslabs. [RT #29644]	2012-06-01 10:04:46 -07:00
Tinderbox User	446f5852c6	update SRCID	2012-06-01 11:15:27 +00:00
Mark Andrews	d4b59ed307	fixup merge conflict	2012-06-01 21:10:57 +10:00
Tinderbox User	9ab672f69e	update SRCID	2012-06-01 01:15:39 +00:00
Tinderbox User	05e61fc99c	regen v9_6	2012-06-01 01:06:53 +00:00
Tinderbox User	4c8eb049f1	sync	2012-06-01 01:04:36 +00:00
Tinderbox User	c66c4e78c9	update SRCID	2012-05-31 01:15:37 +00:00
Tinderbox User	26c0f0424c	regen v9_6	2012-05-31 01:07:19 +00:00
Tinderbox User	bd575ac7ec	update SRCID	2012-05-30 16:15:34 +00:00
Evan Hunt	798f680440	fixed ARM typo: s/replacable/replaceable/	2012-05-30 08:17:25 -07:00
Tinderbox User	ed9062cb49	update SRCID	2012-05-21 05:41:13 +00:00
Mark Andrews	938a013c39	portability awk add space between -v and it's argument, if anything has changed add ./COPYRIGHT	2012-05-21 15:19:21 +10:00
Tinderbox User	f9e63ab5d9	update SRCID	2012-05-21 01:15:41 +00:00
Mark Andrews	83f94c2255	awk and toupper is not portable, use sed instead	2012-05-21 10:18:46 +10:00
Tinderbox User	84e7b77ba8	update SRCID	2012-05-21 00:15:27 +00:00
Tinderbox User	43da4bdf27	update SRCID	2012-05-20 00:15:22 +00:00
Tinderbox User	c6076cafe2	update SRCID	2012-05-19 00:15:36 +00:00
Tinderbox User	37ab9b45c7	update SRCID	2012-05-18 00:15:47 +00:00
Tinderbox User	76c46f0fd3	update copyright notice	2012-05-17 23:45:10 +00:00
Evan Hunt	6de0ec806a	Merge branch 'v9_6' of ssh://repo/proj/git/prod/bind9 into v9_6	2012-05-17 16:33:04 -07:00
Evan Hunt	1ac5fa17b0	fix check_data() usage 3328. [bug] Fixed inconsistent data checking in dst_parse.c. [RT #29401]	2012-05-17 16:31:59 -07:00
Tinderbox User	ba6db14388	newcopyrights	2012-05-17 23:30:09 +00:00
Tinderbox User	65c60ad5eb	update SRCID	2012-05-17 22:15:27 +00:00
Evan Hunt	cee7943a1b	some files were not cleaned up	2012-05-17 14:59:33 -07:00
Tinderbox User	4bdc863453	update SRCID	2012-05-17 19:15:35 +00:00
Evan Hunt	c92cfa7eae	Handle RRSIG signer case consistently 3329. [bug] Handle RRSIG signer-name case consistently: We generate RRSIG records with the signer-name in lower case. We accept them with any case, but if they fail to validate, we try again in lower case. [RT #27451]	2012-05-17 11:39:23 -07:00
Tinderbox User	511687b15b	update SRCID	2012-05-17 00:15:20 +00:00
Tinderbox User	6950929fa4	update SRCID	2012-05-16 00:15:42 +00:00
Tinderbox User	4d588491b1	update SRCID	2012-05-15 00:15:42 +00:00
Tinderbox User	a7021ba3f7	update SRCID	2012-05-14 00:15:35 +00:00
Tinderbox User	758ea2a01d	update SRCID	2012-05-13 00:15:22 +00:00
Tinderbox User	522f945e0f	update SRCID	2012-05-12 00:15:35 +00:00
Tinderbox User	857d8059b1	update SRCID	2012-05-11 00:15:35 +00:00
Tinderbox User	f9d2229db9	update SRCID	2012-05-10 00:15:45 +00:00
Tinderbox User	ed420395f8	update SRCID	2012-05-09 23:15:28 +00:00